~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_nat_sip.c

Version: ~ [ linux-5.2-rc5 ] ~ [ linux-5.1.12 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.53 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.128 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.182 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.182 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.68 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* SIP extension for NAT alteration.
  2  *
  3  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  4  * based on RR's ip_nat_ftp.c and other modules.
  5  * (C) 2007 United Security Providers
  6  * (C) 2007, 2008, 2011, 2012 Patrick McHardy <kaber@trash.net>
  7  *
  8  * This program is free software; you can redistribute it and/or modify
  9  * it under the terms of the GNU General Public License version 2 as
 10  * published by the Free Software Foundation.
 11  */
 12 
 13 #include <linux/module.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/inet.h>
 16 #include <linux/udp.h>
 17 #include <linux/tcp.h>
 18 
 19 #include <net/netfilter/nf_nat.h>
 20 #include <net/netfilter/nf_nat_helper.h>
 21 #include <net/netfilter/nf_conntrack_helper.h>
 22 #include <net/netfilter/nf_conntrack_expect.h>
 23 #include <net/netfilter/nf_conntrack_seqadj.h>
 24 #include <linux/netfilter/nf_conntrack_sip.h>
 25 
 26 MODULE_LICENSE("GPL");
 27 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
 28 MODULE_DESCRIPTION("SIP NAT helper");
 29 MODULE_ALIAS("ip_nat_sip");
 30 
 31 
 32 static unsigned int mangle_packet(struct sk_buff *skb, unsigned int protoff,
 33                                   unsigned int dataoff,
 34                                   const char **dptr, unsigned int *datalen,
 35                                   unsigned int matchoff, unsigned int matchlen,
 36                                   const char *buffer, unsigned int buflen)
 37 {
 38         enum ip_conntrack_info ctinfo;
 39         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 40         struct tcphdr *th;
 41         unsigned int baseoff;
 42 
 43         if (nf_ct_protonum(ct) == IPPROTO_TCP) {
 44                 th = (struct tcphdr *)(skb->data + protoff);
 45                 baseoff = protoff + th->doff * 4;
 46                 matchoff += dataoff - baseoff;
 47 
 48                 if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
 49                                                 protoff, matchoff, matchlen,
 50                                                 buffer, buflen, false))
 51                         return 0;
 52         } else {
 53                 baseoff = protoff + sizeof(struct udphdr);
 54                 matchoff += dataoff - baseoff;
 55 
 56                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
 57                                               protoff, matchoff, matchlen,
 58                                               buffer, buflen))
 59                         return 0;
 60         }
 61 
 62         /* Reload data pointer and adjust datalen value */
 63         *dptr = skb->data + dataoff;
 64         *datalen += buflen - matchlen;
 65         return 1;
 66 }
 67 
 68 static int sip_sprintf_addr(const struct nf_conn *ct, char *buffer,
 69                             const union nf_inet_addr *addr, bool delim)
 70 {
 71         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
 72                 return sprintf(buffer, "%pI4", &addr->ip);
 73         else {
 74                 if (delim)
 75                         return sprintf(buffer, "[%pI6c]", &addr->ip6);
 76                 else
 77                         return sprintf(buffer, "%pI6c", &addr->ip6);
 78         }
 79 }
 80 
 81 static int sip_sprintf_addr_port(const struct nf_conn *ct, char *buffer,
 82                                  const union nf_inet_addr *addr, u16 port)
 83 {
 84         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
 85                 return sprintf(buffer, "%pI4:%u", &addr->ip, port);
 86         else
 87                 return sprintf(buffer, "[%pI6c]:%u", &addr->ip6, port);
 88 }
 89 
 90 static int map_addr(struct sk_buff *skb, unsigned int protoff,
 91                     unsigned int dataoff,
 92                     const char **dptr, unsigned int *datalen,
 93                     unsigned int matchoff, unsigned int matchlen,
 94                     union nf_inet_addr *addr, __be16 port)
 95 {
 96         enum ip_conntrack_info ctinfo;
 97         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 98         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 99         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
100         char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
101         unsigned int buflen;
102         union nf_inet_addr newaddr;
103         __be16 newport;
104 
105         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, addr) &&
106             ct->tuplehash[dir].tuple.src.u.udp.port == port) {
107                 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
108                 newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
109         } else if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, addr) &&
110                    ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
111                 newaddr = ct->tuplehash[!dir].tuple.src.u3;
112                 newport = ct_sip_info->forced_dport ? :
113                           ct->tuplehash[!dir].tuple.src.u.udp.port;
114         } else
115                 return 1;
116 
117         if (nf_inet_addr_cmp(&newaddr, addr) && newport == port)
118                 return 1;
119 
120         buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, ntohs(newport));
121         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
122                              matchoff, matchlen, buffer, buflen);
123 }
124 
125 static int map_sip_addr(struct sk_buff *skb, unsigned int protoff,
126                         unsigned int dataoff,
127                         const char **dptr, unsigned int *datalen,
128                         enum sip_header_types type)
129 {
130         enum ip_conntrack_info ctinfo;
131         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
132         unsigned int matchlen, matchoff;
133         union nf_inet_addr addr;
134         __be16 port;
135 
136         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
137                                     &matchoff, &matchlen, &addr, &port) <= 0)
138                 return 1;
139         return map_addr(skb, protoff, dataoff, dptr, datalen,
140                         matchoff, matchlen, &addr, port);
141 }
142 
143 static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
144                                unsigned int dataoff,
145                                const char **dptr, unsigned int *datalen)
146 {
147         enum ip_conntrack_info ctinfo;
148         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
149         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
150         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
151         unsigned int coff, matchoff, matchlen;
152         enum sip_header_types hdr;
153         union nf_inet_addr addr;
154         __be16 port;
155         int request, in_header;
156 
157         /* Basic rules: requests and responses. */
158         if (strncasecmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
159                 if (ct_sip_parse_request(ct, *dptr, *datalen,
160                                          &matchoff, &matchlen,
161                                          &addr, &port) > 0 &&
162                     !map_addr(skb, protoff, dataoff, dptr, datalen,
163                               matchoff, matchlen, &addr, port)) {
164                         nf_ct_helper_log(skb, ct, "cannot mangle SIP message");
165                         return NF_DROP;
166                 }
167                 request = 1;
168         } else
169                 request = 0;
170 
171         if (nf_ct_protonum(ct) == IPPROTO_TCP)
172                 hdr = SIP_HDR_VIA_TCP;
173         else
174                 hdr = SIP_HDR_VIA_UDP;
175 
176         /* Translate topmost Via header and parameters */
177         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
178                                     hdr, NULL, &matchoff, &matchlen,
179                                     &addr, &port) > 0) {
180                 unsigned int olen, matchend, poff, plen, buflen, n;
181                 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
182 
183                 /* We're only interested in headers related to this
184                  * connection */
185                 if (request) {
186                         if (!nf_inet_addr_cmp(&addr,
187                                         &ct->tuplehash[dir].tuple.src.u3) ||
188                             port != ct->tuplehash[dir].tuple.src.u.udp.port)
189                                 goto next;
190                 } else {
191                         if (!nf_inet_addr_cmp(&addr,
192                                         &ct->tuplehash[dir].tuple.dst.u3) ||
193                             port != ct->tuplehash[dir].tuple.dst.u.udp.port)
194                                 goto next;
195                 }
196 
197                 olen = *datalen;
198                 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
199                               matchoff, matchlen, &addr, port)) {
200                         nf_ct_helper_log(skb, ct, "cannot mangle Via header");
201                         return NF_DROP;
202                 }
203 
204                 matchend = matchoff + matchlen + *datalen - olen;
205 
206                 /* The maddr= parameter (RFC 2361) specifies where to send
207                  * the reply. */
208                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
209                                                "maddr=", &poff, &plen,
210                                                &addr, true) > 0 &&
211                     nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3) &&
212                     !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3)) {
213                         buflen = sip_sprintf_addr(ct, buffer,
214                                         &ct->tuplehash[!dir].tuple.dst.u3,
215                                         true);
216                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
217                                            poff, plen, buffer, buflen)) {
218                                 nf_ct_helper_log(skb, ct, "cannot mangle maddr");
219                                 return NF_DROP;
220                         }
221                 }
222 
223                 /* The received= parameter (RFC 2361) contains the address
224                  * from which the server received the request. */
225                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
226                                                "received=", &poff, &plen,
227                                                &addr, false) > 0 &&
228                     nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.dst.u3) &&
229                     !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.src.u3)) {
230                         buflen = sip_sprintf_addr(ct, buffer,
231                                         &ct->tuplehash[!dir].tuple.src.u3,
232                                         false);
233                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
234                                            poff, plen, buffer, buflen)) {
235                                 nf_ct_helper_log(skb, ct, "cannot mangle received");
236                                 return NF_DROP;
237                         }
238                 }
239 
240                 /* The rport= parameter (RFC 3581) contains the port number
241                  * from which the server received the request. */
242                 if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
243                                                  "rport=", &poff, &plen,
244                                                  &n) > 0 &&
245                     htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
246                     htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
247                         __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
248                         buflen = sprintf(buffer, "%u", ntohs(p));
249                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
250                                            poff, plen, buffer, buflen)) {
251                                 nf_ct_helper_log(skb, ct, "cannot mangle rport");
252                                 return NF_DROP;
253                         }
254                 }
255         }
256 
257 next:
258         /* Translate Contact headers */
259         coff = 0;
260         in_header = 0;
261         while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
262                                        SIP_HDR_CONTACT, &in_header,
263                                        &matchoff, &matchlen,
264                                        &addr, &port) > 0) {
265                 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
266                               matchoff, matchlen,
267                               &addr, port)) {
268                         nf_ct_helper_log(skb, ct, "cannot mangle contact");
269                         return NF_DROP;
270                 }
271         }
272 
273         if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
274             !map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_TO)) {
275                 nf_ct_helper_log(skb, ct, "cannot mangle SIP from/to");
276                 return NF_DROP;
277         }
278 
279         /* Mangle destination port for Cisco phones, then fix up checksums */
280         if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
281                 struct udphdr *uh;
282 
283                 if (!skb_make_writable(skb, skb->len)) {
284                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
285                         return NF_DROP;
286                 }
287 
288                 uh = (void *)skb->data + protoff;
289                 uh->dest = ct_sip_info->forced_dport;
290 
291                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
292                                               0, 0, NULL, 0)) {
293                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
294                         return NF_DROP;
295                 }
296         }
297 
298         return NF_ACCEPT;
299 }
300 
301 static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
302                                   s16 off)
303 {
304         enum ip_conntrack_info ctinfo;
305         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
306         const struct tcphdr *th;
307 
308         if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
309                 return;
310 
311         th = (struct tcphdr *)(skb->data + protoff);
312         nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
313 }
314 
315 /* Handles expected signalling connections and media streams */
316 static void nf_nat_sip_expected(struct nf_conn *ct,
317                                 struct nf_conntrack_expect *exp)
318 {
319         struct nf_nat_range range;
320 
321         /* This must be a fresh one. */
322         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
323 
324         /* For DST manip, map port here to where it's expected. */
325         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
326         range.min_proto = range.max_proto = exp->saved_proto;
327         range.min_addr = range.max_addr = exp->saved_addr;
328         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
329 
330         /* Change src to where master sends to, but only if the connection
331          * actually came from the same source. */
332         if (nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
333                              &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
334                 range.flags = NF_NAT_RANGE_MAP_IPS;
335                 range.min_addr = range.max_addr
336                         = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
337                 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
338         }
339 }
340 
341 static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
342                                       unsigned int dataoff,
343                                       const char **dptr, unsigned int *datalen,
344                                       struct nf_conntrack_expect *exp,
345                                       unsigned int matchoff,
346                                       unsigned int matchlen)
347 {
348         enum ip_conntrack_info ctinfo;
349         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
350         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
351         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
352         union nf_inet_addr newaddr;
353         u_int16_t port;
354         __be16 srcport;
355         char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
356         unsigned int buflen;
357 
358         /* Connection will come from reply */
359         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
360                              &ct->tuplehash[!dir].tuple.dst.u3))
361                 newaddr = exp->tuple.dst.u3;
362         else
363                 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
364 
365         /* If the signalling port matches the connection's source port in the
366          * original direction, try to use the destination port in the opposite
367          * direction. */
368         srcport = ct_sip_info->forced_dport ? :
369                   ct->tuplehash[dir].tuple.src.u.udp.port;
370         if (exp->tuple.dst.u.udp.port == srcport)
371                 port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
372         else
373                 port = ntohs(exp->tuple.dst.u.udp.port);
374 
375         exp->saved_addr = exp->tuple.dst.u3;
376         exp->tuple.dst.u3 = newaddr;
377         exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
378         exp->dir = !dir;
379         exp->expectfn = nf_nat_sip_expected;
380 
381         for (; port != 0; port++) {
382                 int ret;
383 
384                 exp->tuple.dst.u.udp.port = htons(port);
385                 ret = nf_ct_expect_related(exp);
386                 if (ret == 0)
387                         break;
388                 else if (ret != -EBUSY) {
389                         port = 0;
390                         break;
391                 }
392         }
393 
394         if (port == 0) {
395                 nf_ct_helper_log(skb, ct, "all ports in use for SIP");
396                 return NF_DROP;
397         }
398 
399         if (!nf_inet_addr_cmp(&exp->tuple.dst.u3, &exp->saved_addr) ||
400             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
401                 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, port);
402                 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
403                                    matchoff, matchlen, buffer, buflen)) {
404                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
405                         goto err;
406                 }
407         }
408         return NF_ACCEPT;
409 
410 err:
411         nf_ct_unexpect_related(exp);
412         return NF_DROP;
413 }
414 
415 static int mangle_content_len(struct sk_buff *skb, unsigned int protoff,
416                               unsigned int dataoff,
417                               const char **dptr, unsigned int *datalen)
418 {
419         enum ip_conntrack_info ctinfo;
420         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
421         unsigned int matchoff, matchlen;
422         char buffer[sizeof("65536")];
423         int buflen, c_len;
424 
425         /* Get actual SDP length */
426         if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
427                                   SDP_HDR_VERSION, SDP_HDR_UNSPEC,
428                                   &matchoff, &matchlen) <= 0)
429                 return 0;
430         c_len = *datalen - matchoff + strlen("v=");
431 
432         /* Now, update SDP length */
433         if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CONTENT_LENGTH,
434                               &matchoff, &matchlen) <= 0)
435                 return 0;
436 
437         buflen = sprintf(buffer, "%u", c_len);
438         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
439                              matchoff, matchlen, buffer, buflen);
440 }
441 
442 static int mangle_sdp_packet(struct sk_buff *skb, unsigned int protoff,
443                              unsigned int dataoff,
444                              const char **dptr, unsigned int *datalen,
445                              unsigned int sdpoff,
446                              enum sdp_header_types type,
447                              enum sdp_header_types term,
448                              char *buffer, int buflen)
449 {
450         enum ip_conntrack_info ctinfo;
451         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
452         unsigned int matchlen, matchoff;
453 
454         if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
455                                   &matchoff, &matchlen) <= 0)
456                 return -ENOENT;
457         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
458                              matchoff, matchlen, buffer, buflen) ? 0 : -EINVAL;
459 }
460 
461 static unsigned int nf_nat_sdp_addr(struct sk_buff *skb, unsigned int protoff,
462                                     unsigned int dataoff,
463                                     const char **dptr, unsigned int *datalen,
464                                     unsigned int sdpoff,
465                                     enum sdp_header_types type,
466                                     enum sdp_header_types term,
467                                     const union nf_inet_addr *addr)
468 {
469         enum ip_conntrack_info ctinfo;
470         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
471         char buffer[INET6_ADDRSTRLEN];
472         unsigned int buflen;
473 
474         buflen = sip_sprintf_addr(ct, buffer, addr, false);
475         if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen,
476                               sdpoff, type, term, buffer, buflen))
477                 return 0;
478 
479         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
480 }
481 
482 static unsigned int nf_nat_sdp_port(struct sk_buff *skb, unsigned int protoff,
483                                     unsigned int dataoff,
484                                     const char **dptr, unsigned int *datalen,
485                                     unsigned int matchoff,
486                                     unsigned int matchlen,
487                                     u_int16_t port)
488 {
489         char buffer[sizeof("nnnnn")];
490         unsigned int buflen;
491 
492         buflen = sprintf(buffer, "%u", port);
493         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
494                            matchoff, matchlen, buffer, buflen))
495                 return 0;
496 
497         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
498 }
499 
500 static unsigned int nf_nat_sdp_session(struct sk_buff *skb, unsigned int protoff,
501                                        unsigned int dataoff,
502                                        const char **dptr, unsigned int *datalen,
503                                        unsigned int sdpoff,
504                                        const union nf_inet_addr *addr)
505 {
506         enum ip_conntrack_info ctinfo;
507         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
508         char buffer[INET6_ADDRSTRLEN];
509         unsigned int buflen;
510 
511         /* Mangle session description owner and contact addresses */
512         buflen = sip_sprintf_addr(ct, buffer, addr, false);
513         if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
514                               SDP_HDR_OWNER, SDP_HDR_MEDIA, buffer, buflen))
515                 return 0;
516 
517         switch (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
518                                   SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
519                                   buffer, buflen)) {
520         case 0:
521         /*
522          * RFC 2327:
523          *
524          * Session description
525          *
526          * c=* (connection information - not required if included in all media)
527          */
528         case -ENOENT:
529                 break;
530         default:
531                 return 0;
532         }
533 
534         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
535 }
536 
537 /* So, this packet has hit the connection tracking matching code.
538    Mangle it, and change the expectation to match the new version. */
539 static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
540                                      unsigned int dataoff,
541                                      const char **dptr, unsigned int *datalen,
542                                      struct nf_conntrack_expect *rtp_exp,
543                                      struct nf_conntrack_expect *rtcp_exp,
544                                      unsigned int mediaoff,
545                                      unsigned int medialen,
546                                      union nf_inet_addr *rtp_addr)
547 {
548         enum ip_conntrack_info ctinfo;
549         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
550         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
551         u_int16_t port;
552 
553         /* Connection will come from reply */
554         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
555                              &ct->tuplehash[!dir].tuple.dst.u3))
556                 *rtp_addr = rtp_exp->tuple.dst.u3;
557         else
558                 *rtp_addr = ct->tuplehash[!dir].tuple.dst.u3;
559 
560         rtp_exp->saved_addr = rtp_exp->tuple.dst.u3;
561         rtp_exp->tuple.dst.u3 = *rtp_addr;
562         rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
563         rtp_exp->dir = !dir;
564         rtp_exp->expectfn = nf_nat_sip_expected;
565 
566         rtcp_exp->saved_addr = rtcp_exp->tuple.dst.u3;
567         rtcp_exp->tuple.dst.u3 = *rtp_addr;
568         rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
569         rtcp_exp->dir = !dir;
570         rtcp_exp->expectfn = nf_nat_sip_expected;
571 
572         /* Try to get same pair of ports: if not, try to change them. */
573         for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
574              port != 0; port += 2) {
575                 int ret;
576 
577                 rtp_exp->tuple.dst.u.udp.port = htons(port);
578                 ret = nf_ct_expect_related(rtp_exp);
579                 if (ret == -EBUSY)
580                         continue;
581                 else if (ret < 0) {
582                         port = 0;
583                         break;
584                 }
585                 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
586                 ret = nf_ct_expect_related(rtcp_exp);
587                 if (ret == 0)
588                         break;
589                 else if (ret == -EBUSY) {
590                         nf_ct_unexpect_related(rtp_exp);
591                         continue;
592                 } else if (ret < 0) {
593                         nf_ct_unexpect_related(rtp_exp);
594                         port = 0;
595                         break;
596                 }
597         }
598 
599         if (port == 0) {
600                 nf_ct_helper_log(skb, ct, "all ports in use for SDP media");
601                 goto err1;
602         }
603 
604         /* Update media port. */
605         if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
606             !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
607                              mediaoff, medialen, port)) {
608                 nf_ct_helper_log(skb, ct, "cannot mangle SDP message");
609                 goto err2;
610         }
611 
612         return NF_ACCEPT;
613 
614 err2:
615         nf_ct_unexpect_related(rtp_exp);
616         nf_ct_unexpect_related(rtcp_exp);
617 err1:
618         return NF_DROP;
619 }
620 
621 static struct nf_ct_helper_expectfn sip_nat = {
622         .name           = "sip",
623         .expectfn       = nf_nat_sip_expected,
624 };
625 
626 static void __exit nf_nat_sip_fini(void)
627 {
628         RCU_INIT_POINTER(nf_nat_sip_hooks, NULL);
629 
630         nf_ct_helper_expectfn_unregister(&sip_nat);
631         synchronize_rcu();
632 }
633 
634 static const struct nf_nat_sip_hooks sip_hooks = {
635         .msg            = nf_nat_sip,
636         .seq_adjust     = nf_nat_sip_seq_adjust,
637         .expect         = nf_nat_sip_expect,
638         .sdp_addr       = nf_nat_sdp_addr,
639         .sdp_port       = nf_nat_sdp_port,
640         .sdp_session    = nf_nat_sdp_session,
641         .sdp_media      = nf_nat_sdp_media,
642 };
643 
644 static int __init nf_nat_sip_init(void)
645 {
646         BUG_ON(nf_nat_sip_hooks != NULL);
647         RCU_INIT_POINTER(nf_nat_sip_hooks, &sip_hooks);
648         nf_ct_helper_expectfn_register(&sip_nat);
649         return 0;
650 }
651 
652 module_init(nf_nat_sip_init);
653 module_exit(nf_nat_sip_fini);
654 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp