[NETFILTER]: Add SIP connection tracking helper
Add SIP connection tracking helper. Originally written by Christian Hentschel <chentschel@arnet.com.ar>, some cleanup, minor fixes and bidirectional SIP support added by myself. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>hifive-unleashed-5.1
Patrick McHardy
David S. Miller
parent
e44ab66a75
commit
ae5b7d8ba2
|
|
@ -0,0 +1,44 @@
|
|||
#ifndef __IP_CONNTRACK_SIP_H__
|
||||
#define __IP_CONNTRACK_SIP_H__
|
||||
#ifdef __KERNEL__
|
||||
|
||||
#define SIP_PORT 5060
|
||||
#define SIP_TIMEOUT 3600
|
||||
|
||||
#define POS_VIA 0
|
||||
#define POS_CONTACT 1
|
||||
#define POS_CONTENT 2
|
||||
#define POS_MEDIA 3
|
||||
#define POS_OWNER 4
|
||||
#define POS_CONNECTION 5
|
||||
#define POS_REQ_HEADER 6
|
||||
#define POS_SDP_HEADER 7
|
||||
|
||||
struct sip_header_nfo {
|
||||
const char *lname;
|
||||
const char *sname;
|
||||
const char *ln_str;
|
||||
size_t lnlen;
|
||||
size_t snlen;
|
||||
size_t ln_strlen;
|
||||
int (*match_len)(const char *, const char *, int *);
|
||||
};
|
||||
|
||||
extern unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack *ct,
|
||||
const char **dptr);
|
||||
extern unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack_expect *exp,
|
||||
const char *dptr);
|
||||
|
||||
extern int ct_sip_get_info(const char *dptr, size_t dlen,
|
||||
unsigned int *matchoff,
|
||||
unsigned int *matchlen,
|
||||
struct sip_header_nfo *hnfo);
|
||||
extern int ct_sip_lnlen(const char *line, const char *limit);
|
||||
extern const char *ct_sip_search(const char *needle, const char *haystack,
|
||||
size_t needle_len, size_t haystack_len);
|
||||
#endif /* __KERNEL__ */
|
||||
#endif /* __IP_CONNTRACK_SIP_H__ */
|
||||
|
|
@ -191,6 +191,18 @@ config IP_NF_H323
|
|||
If you want to compile it as a module, say 'M' here and read
|
||||
Documentation/modules.txt. If unsure, say 'N'.
|
||||
|
||||
config IP_NF_SIP
|
||||
tristate "SIP protocol support (EXPERIMENTAL)"
|
||||
depends on IP_NF_CONNTRACK && EXPERIMENTAL
|
||||
help
|
||||
SIP is an application-layer control protocol that can establish,
|
||||
modify, and terminate multimedia sessions (conferences) such as
|
||||
Internet telephony calls. With the ip_conntrack_sip and
|
||||
the ip_nat_sip modules you can support the protocol on a connection
|
||||
tracking/NATing firewall.
|
||||
|
||||
To compile it as a module, choose M here. If unsure, say Y.
|
||||
|
||||
config IP_NF_QUEUE
|
||||
tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
|
||||
help
|
||||
|
|
@ -503,6 +515,12 @@ config IP_NF_NAT_H323
|
|||
default IP_NF_NAT if IP_NF_H323=y
|
||||
default m if IP_NF_H323=m
|
||||
|
||||
config IP_NF_NAT_SIP
|
||||
tristate
|
||||
depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
|
||||
default IP_NF_NAT if IP_NF_SIP=y
|
||||
default m if IP_NF_SIP=m
|
||||
|
||||
# mangle + specific targets
|
||||
config IP_NF_MANGLE
|
||||
tristate "Packet mangling"
|
||||
|
|
|
|||
|
|
@ -31,6 +31,7 @@ obj-$(CONFIG_IP_NF_AMANDA) += ip_conntrack_amanda.o
|
|||
obj-$(CONFIG_IP_NF_TFTP) += ip_conntrack_tftp.o
|
||||
obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o
|
||||
obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o
|
||||
obj-$(CONFIG_IP_NF_SIP) += ip_conntrack_sip.o
|
||||
obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o
|
||||
|
||||
# NAT helpers
|
||||
|
|
@ -40,6 +41,7 @@ obj-$(CONFIG_IP_NF_NAT_AMANDA) += ip_nat_amanda.o
|
|||
obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o
|
||||
obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
|
||||
obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
|
||||
obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o
|
||||
|
||||
# generic IP tables
|
||||
obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
|
||||
|
|
|
|||
|
|
@ -0,0 +1,471 @@
|
|||
/* SIP extension for IP connection tracking.
|
||||
*
|
||||
* (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
|
||||
* based on RR's ip_conntrack_ftp.c and other modules.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#include <linux/config.h>
|
||||
#include <linux/module.h>
|
||||
#include <linux/ctype.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/in.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/udp.h>
|
||||
|
||||
#include <linux/netfilter.h>
|
||||
#include <linux/netfilter_ipv4.h>
|
||||
#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
|
||||
#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
|
||||
|
||||
#if 0
|
||||
#define DEBUGP printk
|
||||
#else
|
||||
#define DEBUGP(format, args...)
|
||||
#endif
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
|
||||
MODULE_DESCRIPTION("SIP connection tracking helper");
|
||||
|
||||
#define MAX_PORTS 8
|
||||
static unsigned short ports[MAX_PORTS];
|
||||
static int ports_c;
|
||||
module_param_array(ports, ushort, &ports_c, 0400);
|
||||
MODULE_PARM_DESC(ports, "port numbers of sip servers");
|
||||
|
||||
static unsigned int sip_timeout = SIP_TIMEOUT;
|
||||
module_param(sip_timeout, uint, 0600);
|
||||
MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
|
||||
|
||||
unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack *ct,
|
||||
const char **dptr);
|
||||
EXPORT_SYMBOL_GPL(ip_nat_sip_hook);
|
||||
|
||||
unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack_expect *exp,
|
||||
const char *dptr);
|
||||
EXPORT_SYMBOL_GPL(ip_nat_sdp_hook);
|
||||
|
||||
int ct_sip_get_info(const char *dptr, size_t dlen,
|
||||
unsigned int *matchoff,
|
||||
unsigned int *matchlen,
|
||||
struct sip_header_nfo *hnfo);
|
||||
EXPORT_SYMBOL_GPL(ct_sip_get_info);
|
||||
|
||||
|
||||
static int digits_len(const char *dptr, const char *limit, int *shift);
|
||||
static int epaddr_len(const char *dptr, const char *limit, int *shift);
|
||||
static int skp_digits_len(const char *dptr, const char *limit, int *shift);
|
||||
static int skp_epaddr_len(const char *dptr, const char *limit, int *shift);
|
||||
|
||||
struct sip_header_nfo ct_sip_hdrs[] = {
|
||||
{ /* Via header */
|
||||
.lname = "Via:",
|
||||
.lnlen = sizeof("Via:") - 1,
|
||||
.sname = "\r\nv:",
|
||||
.snlen = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
|
||||
.ln_str = "UDP ",
|
||||
.ln_strlen = sizeof("UDP ") - 1,
|
||||
.match_len = epaddr_len,
|
||||
},
|
||||
{ /* Contact header */
|
||||
.lname = "Contact:",
|
||||
.lnlen = sizeof("Contact:") - 1,
|
||||
.sname = "\r\nm:",
|
||||
.snlen = sizeof("\r\nm:") - 1,
|
||||
.ln_str = "sip:",
|
||||
.ln_strlen = sizeof("sip:") - 1,
|
||||
.match_len = skp_epaddr_len
|
||||
},
|
||||
{ /* Content length header */
|
||||
.lname = "Content-Length:",
|
||||
.lnlen = sizeof("Content-Length:") - 1,
|
||||
.sname = "\r\nl:",
|
||||
.snlen = sizeof("\r\nl:") - 1,
|
||||
.ln_str = ":",
|
||||
.ln_strlen = sizeof(":") - 1,
|
||||
.match_len = skp_digits_len
|
||||
},
|
||||
{ /* SDP media info */
|
||||
.lname = "\nm=",
|
||||
.lnlen = sizeof("\nm=") - 1,
|
||||
.sname = "\rm=",
|
||||
.snlen = sizeof("\rm=") - 1,
|
||||
.ln_str = "audio ",
|
||||
.ln_strlen = sizeof("audio ") - 1,
|
||||
.match_len = digits_len
|
||||
},
|
||||
{ /* SDP owner address*/
|
||||
.lname = "\no=",
|
||||
.lnlen = sizeof("\no=") - 1,
|
||||
.sname = "\ro=",
|
||||
.snlen = sizeof("\ro=") - 1,
|
||||
.ln_str = "IN IP4 ",
|
||||
.ln_strlen = sizeof("IN IP4 ") - 1,
|
||||
.match_len = epaddr_len
|
||||
},
|
||||
{ /* SDP connection info */
|
||||
.lname = "\nc=",
|
||||
.lnlen = sizeof("\nc=") - 1,
|
||||
.sname = "\rc=",
|
||||
.snlen = sizeof("\rc=") - 1,
|
||||
.ln_str = "IN IP4 ",
|
||||
.ln_strlen = sizeof("IN IP4 ") - 1,
|
||||
.match_len = epaddr_len
|
||||
},
|
||||
{ /* Requests headers */
|
||||
.lname = "sip:",
|
||||
.lnlen = sizeof("sip:") - 1,
|
||||
.sname = "sip:",
|
||||
.snlen = sizeof("sip:") - 1, /* yes, i know.. ;) */
|
||||
.ln_str = "@",
|
||||
.ln_strlen = sizeof("@") - 1,
|
||||
.match_len = epaddr_len
|
||||
},
|
||||
{ /* SDP version header */
|
||||
.lname = "\nv=",
|
||||
.lnlen = sizeof("\nv=") - 1,
|
||||
.sname = "\rv=",
|
||||
.snlen = sizeof("\rv=") - 1,
|
||||
.ln_str = "=",
|
||||
.ln_strlen = sizeof("=") - 1,
|
||||
.match_len = digits_len
|
||||
}
|
||||
};
|
||||
EXPORT_SYMBOL_GPL(ct_sip_hdrs);
|
||||
|
||||
/* get line lenght until first CR or LF seen. */
|
||||
int ct_sip_lnlen(const char *line, const char *limit)
|
||||
{
|
||||
const char *k = line;
|
||||
|
||||
while ((line <= limit) && (*line == '\r' || *line == '\n'))
|
||||
line++;
|
||||
|
||||
while (line <= limit) {
|
||||
if (*line == '\r' || *line == '\n')
|
||||
break;
|
||||
line++;
|
||||
}
|
||||
return line - k;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(ct_sip_lnlen);
|
||||
|
||||
/* Linear string search, case sensitive. */
|
||||
const char *ct_sip_search(const char *needle, const char *haystack,
|
||||
size_t needle_len, size_t haystack_len)
|
||||
{
|
||||
const char *limit = haystack + (haystack_len - needle_len);
|
||||
|
||||
while (haystack <= limit) {
|
||||
if (memcmp(haystack, needle, needle_len) == 0)
|
||||
return haystack;
|
||||
haystack++;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(ct_sip_search);
|
||||
|
||||
static int digits_len(const char *dptr, const char *limit, int *shift)
|
||||
{
|
||||
int len = 0;
|
||||
while (dptr <= limit && isdigit(*dptr)) {
|
||||
dptr++;
|
||||
len++;
|
||||
}
|
||||
return len;
|
||||
}
|
||||
|
||||
/* get digits lenght, skiping blank spaces. */
|
||||
static int skp_digits_len(const char *dptr, const char *limit, int *shift)
|
||||
{
|
||||
for (; dptr <= limit && *dptr == ' '; dptr++)
|
||||
(*shift)++;
|
||||
|
||||
return digits_len(dptr, limit, shift);
|
||||
}
|
||||
|
||||
/* Simple ipaddr parser.. */
|
||||
static int parse_ipaddr(const char *cp, const char **endp,
|
||||
u_int32_t *ipaddr, const char *limit)
|
||||
{
|
||||
unsigned long int val;
|
||||
int i, digit = 0;
|
||||
|
||||
for (i = 0, *ipaddr = 0; cp <= limit && i < 4; i++) {
|
||||
digit = 0;
|
||||
if (!isdigit(*cp))
|
||||
break;
|
||||
|
||||
val = simple_strtoul(cp, (char **)&cp, 10);
|
||||
if (val > 0xFF)
|
||||
return -1;
|
||||
|
||||
((u_int8_t *)ipaddr)[i] = val;
|
||||
digit = 1;
|
||||
|
||||
if (*cp != '.')
|
||||
break;
|
||||
cp++;
|
||||
}
|
||||
if (!digit)
|
||||
return -1;
|
||||
|
||||
if (endp)
|
||||
*endp = cp;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* skip ip address. returns it lenght. */
|
||||
static int epaddr_len(const char *dptr, const char *limit, int *shift)
|
||||
{
|
||||
const char *aux = dptr;
|
||||
u_int32_t ip;
|
||||
|
||||
if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {
|
||||
DEBUGP("ip: %s parse failed.!\n", dptr);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Port number */
|
||||
if (*dptr == ':') {
|
||||
dptr++;
|
||||
dptr += digits_len(dptr, limit, shift);
|
||||
}
|
||||
return dptr - aux;
|
||||
}
|
||||
|
||||
/* get address length, skiping user info. */
|
||||
static int skp_epaddr_len(const char *dptr, const char *limit, int *shift)
|
||||
{
|
||||
int s = *shift;
|
||||
|
||||
for (; dptr <= limit && *dptr != '@'; dptr++)
|
||||
(*shift)++;
|
||||
|
||||
if (*dptr == '@') {
|
||||
dptr++;
|
||||
(*shift)++;
|
||||
} else
|
||||
*shift = s;
|
||||
|
||||
return epaddr_len(dptr, limit, shift);
|
||||
}
|
||||
|
||||
/* Returns 0 if not found, -1 error parsing. */
|
||||
int ct_sip_get_info(const char *dptr, size_t dlen,
|
||||
unsigned int *matchoff,
|
||||
unsigned int *matchlen,
|
||||
struct sip_header_nfo *hnfo)
|
||||
{
|
||||
const char *limit, *aux, *k = dptr;
|
||||
int shift = 0;
|
||||
|
||||
limit = dptr + (dlen - hnfo->lnlen);
|
||||
|
||||
while (dptr <= limit) {
|
||||
if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
|
||||
(strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
|
||||
dptr++;
|
||||
continue;
|
||||
}
|
||||
aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
|
||||
ct_sip_lnlen(dptr, limit));
|
||||
if (!aux) {
|
||||
DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str,
|
||||
hnfo->lname);
|
||||
return -1;
|
||||
}
|
||||
aux += hnfo->ln_strlen;
|
||||
|
||||
*matchlen = hnfo->match_len(aux, limit, &shift);
|
||||
if (!*matchlen)
|
||||
return -1;
|
||||
|
||||
*matchoff = (aux - k) + shift;
|
||||
|
||||
DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname,
|
||||
*matchlen);
|
||||
return 1;
|
||||
}
|
||||
DEBUGP("%s header not found.\n", hnfo->lname);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int set_expected_rtp(struct sk_buff **pskb,
|
||||
struct ip_conntrack *ct,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
u_int32_t ipaddr, u_int16_t port,
|
||||
const char *dptr)
|
||||
{
|
||||
struct ip_conntrack_expect *exp;
|
||||
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
|
||||
int ret;
|
||||
|
||||
exp = ip_conntrack_expect_alloc(ct);
|
||||
if (exp == NULL)
|
||||
return NF_DROP;
|
||||
|
||||
exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
|
||||
exp->tuple.src.u.udp.port = 0;
|
||||
exp->tuple.dst.ip = ipaddr;
|
||||
exp->tuple.dst.u.udp.port = htons(port);
|
||||
exp->tuple.dst.protonum = IPPROTO_UDP;
|
||||
|
||||
exp->mask.src.ip = 0xFFFFFFFF;
|
||||
exp->mask.src.u.udp.port = 0;
|
||||
exp->mask.dst.ip = 0xFFFFFFFF;
|
||||
exp->mask.dst.u.udp.port = 0xFFFF;
|
||||
exp->mask.dst.protonum = 0xFF;
|
||||
|
||||
exp->expectfn = NULL;
|
||||
exp->flags = 0;
|
||||
|
||||
if (ip_nat_sdp_hook)
|
||||
ret = ip_nat_sdp_hook(pskb, ctinfo, exp, dptr);
|
||||
else {
|
||||
if (ip_conntrack_expect_related(exp) != 0)
|
||||
ret = NF_DROP;
|
||||
else
|
||||
ret = NF_ACCEPT;
|
||||
}
|
||||
ip_conntrack_expect_put(exp);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int sip_help(struct sk_buff **pskb,
|
||||
struct ip_conntrack *ct,
|
||||
enum ip_conntrack_info ctinfo)
|
||||
{
|
||||
unsigned int dataoff, datalen;
|
||||
const char *dptr;
|
||||
int ret = NF_ACCEPT;
|
||||
int matchoff, matchlen;
|
||||
u_int32_t ipaddr;
|
||||
u_int16_t port;
|
||||
|
||||
/* No Data ? */
|
||||
dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
|
||||
if (dataoff >= (*pskb)->len) {
|
||||
DEBUGP("skb->len = %u\n", (*pskb)->len);
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
ip_ct_refresh(ct, *pskb, sip_timeout * HZ);
|
||||
|
||||
if (!skb_is_nonlinear(*pskb))
|
||||
dptr = (*pskb)->data + dataoff;
|
||||
else {
|
||||
DEBUGP("Copy of skbuff not supported yet.\n");
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (ip_nat_sip_hook) {
|
||||
if (!ip_nat_sip_hook(pskb, ctinfo, ct, &dptr)) {
|
||||
ret = NF_DROP;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
/* After this point NAT, could have mangled skb, so
|
||||
we need to recalculate payload lenght. */
|
||||
datalen = (*pskb)->len - dataoff;
|
||||
|
||||
if (datalen < (sizeof("SIP/2.0 200") - 1))
|
||||
goto out;
|
||||
|
||||
/* RTP info only in some SDP pkts */
|
||||
if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
|
||||
memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
|
||||
goto out;
|
||||
}
|
||||
/* Get ip and port address from SDP packet. */
|
||||
if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
|
||||
&ct_sip_hdrs[POS_CONNECTION]) > 0) {
|
||||
|
||||
/* We'll drop only if there are parse problems. */
|
||||
if (parse_ipaddr(dptr + matchoff, NULL, &ipaddr,
|
||||
dptr + datalen) < 0) {
|
||||
ret = NF_DROP;
|
||||
goto out;
|
||||
}
|
||||
if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
|
||||
&ct_sip_hdrs[POS_MEDIA]) > 0) {
|
||||
|
||||
port = simple_strtoul(dptr + matchoff, NULL, 10);
|
||||
if (port < 1024) {
|
||||
ret = NF_DROP;
|
||||
goto out;
|
||||
}
|
||||
ret = set_expected_rtp(pskb, ct, ctinfo,
|
||||
ipaddr, port, dptr);
|
||||
}
|
||||
}
|
||||
out:
|
||||
return ret;
|
||||
}
|
||||
|
||||
static struct ip_conntrack_helper sip[MAX_PORTS];
|
||||
static char sip_names[MAX_PORTS][10];
|
||||
|
||||
static void fini(void)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < ports_c; i++) {
|
||||
DEBUGP("unregistering helper for port %d\n", ports[i]);
|
||||
ip_conntrack_helper_unregister(&sip[i]);
|
||||
}
|
||||
}
|
||||
|
||||
static int __init init(void)
|
||||
{
|
||||
int i, ret;
|
||||
char *tmpname;
|
||||
|
||||
if (ports_c == 0)
|
||||
ports[ports_c++] = SIP_PORT;
|
||||
|
||||
for (i = 0; i < ports_c; i++) {
|
||||
/* Create helper structure */
|
||||
memset(&sip[i], 0, sizeof(struct ip_conntrack_helper));
|
||||
|
||||
sip[i].tuple.dst.protonum = IPPROTO_UDP;
|
||||
sip[i].tuple.src.u.udp.port = htons(ports[i]);
|
||||
sip[i].mask.src.u.udp.port = 0xFFFF;
|
||||
sip[i].mask.dst.protonum = 0xFF;
|
||||
sip[i].max_expected = 1;
|
||||
sip[i].timeout = 3 * 60; /* 3 minutes */
|
||||
sip[i].me = THIS_MODULE;
|
||||
sip[i].help = sip_help;
|
||||
|
||||
tmpname = &sip_names[i][0];
|
||||
if (ports[i] == SIP_PORT)
|
||||
sprintf(tmpname, "sip");
|
||||
else
|
||||
sprintf(tmpname, "sip-%d", i);
|
||||
sip[i].name = tmpname;
|
||||
|
||||
DEBUGP("port #%d: %d\n", i, ports[i]);
|
||||
|
||||
ret = ip_conntrack_helper_register(&sip[i]);
|
||||
if (ret) {
|
||||
printk("ERROR registering helper for port %d\n",
|
||||
ports[i]);
|
||||
fini();
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
module_init(init);
|
||||
module_exit(fini);
|
||||
|
|
@ -0,0 +1,249 @@
|
|||
/* SIP extension for UDP NAT alteration.
|
||||
*
|
||||
* (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
|
||||
* based on RR's ip_nat_ftp.c and other modules.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/udp.h>
|
||||
|
||||
#include <linux/netfilter_ipv4.h>
|
||||
#include <linux/netfilter_ipv4/ip_nat.h>
|
||||
#include <linux/netfilter_ipv4/ip_nat_helper.h>
|
||||
#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
|
||||
#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
|
||||
MODULE_DESCRIPTION("SIP NAT helper");
|
||||
|
||||
#if 0
|
||||
#define DEBUGP printk
|
||||
#else
|
||||
#define DEBUGP(format, args...)
|
||||
#endif
|
||||
|
||||
extern struct sip_header_nfo ct_sip_hdrs[];
|
||||
|
||||
static unsigned int mangle_sip_packet(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack *ct,
|
||||
const char **dptr, size_t dlen,
|
||||
char *buffer, int bufflen,
|
||||
struct sip_header_nfo *hnfo)
|
||||
{
|
||||
unsigned int matchlen, matchoff;
|
||||
|
||||
if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)
|
||||
return 0;
|
||||
|
||||
if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
|
||||
matchoff, matchlen, buffer, bufflen))
|
||||
return 0;
|
||||
|
||||
/* We need to reload this. Thanks Patrick. */
|
||||
*dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
|
||||
return 1;
|
||||
}
|
||||
|
||||
static unsigned int ip_nat_sip(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack *ct,
|
||||
const char **dptr)
|
||||
{
|
||||
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
|
||||
char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
|
||||
unsigned int bufflen, dataoff;
|
||||
u_int32_t ip;
|
||||
u_int16_t port;
|
||||
|
||||
dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
|
||||
|
||||
ip = ct->tuplehash[!dir].tuple.dst.ip;
|
||||
port = ct->tuplehash[!dir].tuple.dst.u.udp.port;
|
||||
bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));
|
||||
|
||||
/* short packet ? */
|
||||
if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))
|
||||
return 0;
|
||||
|
||||
/* Basic rules: requests and responses. */
|
||||
if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {
|
||||
const char *aux;
|
||||
|
||||
if ((ctinfo) < IP_CT_IS_REPLY) {
|
||||
mangle_sip_packet(pskb, ctinfo, ct, dptr,
|
||||
(*pskb)->len - dataoff,
|
||||
buffer, bufflen,
|
||||
&ct_sip_hdrs[POS_CONTACT]);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,
|
||||
(*pskb)->len - dataoff,
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_VIA]))
|
||||
return 0;
|
||||
|
||||
/* This search should ignore case, but later.. */
|
||||
aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1,
|
||||
(*pskb)->len - dataoff);
|
||||
if (!aux)
|
||||
return 0;
|
||||
|
||||
if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"),
|
||||
ct_sip_lnlen(aux, *dptr + (*pskb)->len - dataoff)))
|
||||
return 1;
|
||||
|
||||
return mangle_sip_packet(pskb, ctinfo, ct, dptr,
|
||||
(*pskb)->len - dataoff,
|
||||
buffer, bufflen,
|
||||
&ct_sip_hdrs[POS_CONTACT]);
|
||||
}
|
||||
if ((ctinfo) < IP_CT_IS_REPLY) {
|
||||
if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,
|
||||
(*pskb)->len - dataoff,
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_VIA]))
|
||||
return 0;
|
||||
|
||||
/* Mangle Contact if exists only. - watch udp_nat_mangle()! */
|
||||
mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
|
||||
return 1;
|
||||
}
|
||||
/* This mangle requests headers. */
|
||||
return mangle_sip_packet(pskb, ctinfo, ct, dptr,
|
||||
ct_sip_lnlen(*dptr,
|
||||
*dptr + (*pskb)->len - dataoff),
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);
|
||||
}
|
||||
|
||||
static int mangle_content_len(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack *ct,
|
||||
const char *dptr)
|
||||
{
|
||||
unsigned int dataoff, matchoff, matchlen;
|
||||
char buffer[sizeof("65536")];
|
||||
int bufflen;
|
||||
|
||||
dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
|
||||
|
||||
/* Get actual SDP lenght */
|
||||
if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
|
||||
&matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {
|
||||
|
||||
/* since ct_sip_get_info() give us a pointer passing 'v='
|
||||
we need to add 2 bytes in this count. */
|
||||
int c_len = (*pskb)->len - dataoff - matchoff + 2;
|
||||
|
||||
/* Now, update SDP lenght */
|
||||
if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
|
||||
&matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {
|
||||
|
||||
bufflen = sprintf(buffer, "%u", c_len);
|
||||
|
||||
return ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
|
||||
matchoff, matchlen,
|
||||
buffer, bufflen);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static unsigned int mangle_sdp(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack *ct,
|
||||
u_int32_t newip, u_int16_t port,
|
||||
const char *dptr)
|
||||
{
|
||||
char buffer[sizeof("nnn.nnn.nnn.nnn")];
|
||||
unsigned int dataoff, bufflen;
|
||||
|
||||
dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
|
||||
|
||||
/* Mangle owner and contact info. */
|
||||
bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
|
||||
if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_OWNER]))
|
||||
return 0;
|
||||
|
||||
if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_CONNECTION]))
|
||||
return 0;
|
||||
|
||||
/* Mangle media port. */
|
||||
bufflen = sprintf(buffer, "%u", port);
|
||||
if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
|
||||
buffer, bufflen, &ct_sip_hdrs[POS_MEDIA]))
|
||||
return 0;
|
||||
|
||||
return mangle_content_len(pskb, ctinfo, ct, dptr);
|
||||
}
|
||||
|
||||
/* So, this packet has hit the connection tracking matching code.
|
||||
Mangle it, and change the expectation to match the new version. */
|
||||
static unsigned int ip_nat_sdp(struct sk_buff **pskb,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
struct ip_conntrack_expect *exp,
|
||||
const char *dptr)
|
||||
{
|
||||
struct ip_conntrack *ct = exp->master;
|
||||
enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
|
||||
u_int32_t newip;
|
||||
u_int16_t port;
|
||||
|
||||
DEBUGP("ip_nat_sdp():\n");
|
||||
|
||||
/* Connection will come from reply */
|
||||
newip = ct->tuplehash[!dir].tuple.dst.ip;
|
||||
|
||||
exp->tuple.dst.ip = newip;
|
||||
exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
|
||||
exp->dir = !dir;
|
||||
|
||||
/* When you see the packet, we need to NAT it the same as the
|
||||
this one. */
|
||||
exp->expectfn = ip_nat_follow_master;
|
||||
|
||||
/* Try to get same port: if not, try to change it. */
|
||||
for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
|
||||
exp->tuple.dst.u.udp.port = htons(port);
|
||||
if (ip_conntrack_expect_related(exp) == 0)
|
||||
break;
|
||||
}
|
||||
|
||||
if (port == 0)
|
||||
return NF_DROP;
|
||||
|
||||
if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
|
||||
ip_conntrack_unexpect_related(exp);
|
||||
return NF_DROP;
|
||||
}
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
static void __exit fini(void)
|
||||
{
|
||||
ip_nat_sip_hook = NULL;
|
||||
ip_nat_sdp_hook = NULL;
|
||||
/* Make sure noone calls it, meanwhile. */
|
||||
synchronize_net();
|
||||
}
|
||||
|
||||
static int __init init(void)
|
||||
{
|
||||
BUG_ON(ip_nat_sip_hook);
|
||||
BUG_ON(ip_nat_sdp_hook);
|
||||
ip_nat_sip_hook = ip_nat_sip;
|
||||
ip_nat_sdp_hook = ip_nat_sdp;
|
||||
return 0;
|
||||
}
|
||||
|
||||
module_init(init);
|
||||
module_exit(fini);
|
||||
Loading…
Reference in New Issue