~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_nat_sip.c

Version: ~ [ linux-5.9-rc5 ] ~ [ linux-5.8.10 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.66 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.146 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.198 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.236 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.236 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /* SIP extension for NAT alteration.
  3  *
  4  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  5  * based on RR's ip_nat_ftp.c and other modules.
  6  * (C) 2007 United Security Providers
  7  * (C) 2007, 2008, 2011, 2012 Patrick McHardy <kaber@trash.net>
  8  */
  9 
 10 #include <linux/module.h>
 11 #include <linux/skbuff.h>
 12 #include <linux/inet.h>
 13 #include <linux/udp.h>
 14 #include <linux/tcp.h>
 15 
 16 #include <net/netfilter/nf_nat.h>
 17 #include <net/netfilter/nf_nat_helper.h>
 18 #include <net/netfilter/nf_conntrack_core.h>
 19 #include <net/netfilter/nf_conntrack_helper.h>
 20 #include <net/netfilter/nf_conntrack_expect.h>
 21 #include <net/netfilter/nf_conntrack_seqadj.h>
 22 #include <linux/netfilter/nf_conntrack_sip.h>
 23 
 24 #define NAT_HELPER_NAME "sip"
 25 
 26 MODULE_LICENSE("GPL");
 27 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
 28 MODULE_DESCRIPTION("SIP NAT helper");
 29 MODULE_ALIAS_NF_NAT_HELPER(NAT_HELPER_NAME);
 30 
 31 static struct nf_conntrack_nat_helper nat_helper_sip =
 32         NF_CT_NAT_HELPER_INIT(NAT_HELPER_NAME);
 33 
 34 static unsigned int mangle_packet(struct sk_buff *skb, unsigned int protoff,
 35                                   unsigned int dataoff,
 36                                   const char **dptr, unsigned int *datalen,
 37                                   unsigned int matchoff, unsigned int matchlen,
 38                                   const char *buffer, unsigned int buflen)
 39 {
 40         enum ip_conntrack_info ctinfo;
 41         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 42         struct tcphdr *th;
 43         unsigned int baseoff;
 44 
 45         if (nf_ct_protonum(ct) == IPPROTO_TCP) {
 46                 th = (struct tcphdr *)(skb->data + protoff);
 47                 baseoff = protoff + th->doff * 4;
 48                 matchoff += dataoff - baseoff;
 49 
 50                 if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
 51                                                 protoff, matchoff, matchlen,
 52                                                 buffer, buflen, false))
 53                         return 0;
 54         } else {
 55                 baseoff = protoff + sizeof(struct udphdr);
 56                 matchoff += dataoff - baseoff;
 57 
 58                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
 59                                               protoff, matchoff, matchlen,
 60                                               buffer, buflen))
 61                         return 0;
 62         }
 63 
 64         /* Reload data pointer and adjust datalen value */
 65         *dptr = skb->data + dataoff;
 66         *datalen += buflen - matchlen;
 67         return 1;
 68 }
 69 
 70 static int sip_sprintf_addr(const struct nf_conn *ct, char *buffer,
 71                             const union nf_inet_addr *addr, bool delim)
 72 {
 73         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
 74                 return sprintf(buffer, "%pI4", &addr->ip);
 75         else {
 76                 if (delim)
 77                         return sprintf(buffer, "[%pI6c]", &addr->ip6);
 78                 else
 79                         return sprintf(buffer, "%pI6c", &addr->ip6);
 80         }
 81 }
 82 
 83 static int sip_sprintf_addr_port(const struct nf_conn *ct, char *buffer,
 84                                  const union nf_inet_addr *addr, u16 port)
 85 {
 86         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
 87                 return sprintf(buffer, "%pI4:%u", &addr->ip, port);
 88         else
 89                 return sprintf(buffer, "[%pI6c]:%u", &addr->ip6, port);
 90 }
 91 
 92 static int map_addr(struct sk_buff *skb, unsigned int protoff,
 93                     unsigned int dataoff,
 94                     const char **dptr, unsigned int *datalen,
 95                     unsigned int matchoff, unsigned int matchlen,
 96                     union nf_inet_addr *addr, __be16 port)
 97 {
 98         enum ip_conntrack_info ctinfo;
 99         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
100         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
101         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
102         char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
103         unsigned int buflen;
104         union nf_inet_addr newaddr;
105         __be16 newport;
106 
107         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, addr) &&
108             ct->tuplehash[dir].tuple.src.u.udp.port == port) {
109                 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
110                 newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
111         } else if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, addr) &&
112                    ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
113                 newaddr = ct->tuplehash[!dir].tuple.src.u3;
114                 newport = ct_sip_info->forced_dport ? :
115                           ct->tuplehash[!dir].tuple.src.u.udp.port;
116         } else
117                 return 1;
118 
119         if (nf_inet_addr_cmp(&newaddr, addr) && newport == port)
120                 return 1;
121 
122         buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, ntohs(newport));
123         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
124                              matchoff, matchlen, buffer, buflen);
125 }
126 
127 static int map_sip_addr(struct sk_buff *skb, unsigned int protoff,
128                         unsigned int dataoff,
129                         const char **dptr, unsigned int *datalen,
130                         enum sip_header_types type)
131 {
132         enum ip_conntrack_info ctinfo;
133         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
134         unsigned int matchlen, matchoff;
135         union nf_inet_addr addr;
136         __be16 port;
137 
138         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
139                                     &matchoff, &matchlen, &addr, &port) <= 0)
140                 return 1;
141         return map_addr(skb, protoff, dataoff, dptr, datalen,
142                         matchoff, matchlen, &addr, port);
143 }
144 
145 static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
146                                unsigned int dataoff,
147                                const char **dptr, unsigned int *datalen)
148 {
149         enum ip_conntrack_info ctinfo;
150         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
151         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
152         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
153         unsigned int coff, matchoff, matchlen;
154         enum sip_header_types hdr;
155         union nf_inet_addr addr;
156         __be16 port;
157         int request, in_header;
158 
159         /* Basic rules: requests and responses. */
160         if (strncasecmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
161                 if (ct_sip_parse_request(ct, *dptr, *datalen,
162                                          &matchoff, &matchlen,
163                                          &addr, &port) > 0 &&
164                     !map_addr(skb, protoff, dataoff, dptr, datalen,
165                               matchoff, matchlen, &addr, port)) {
166                         nf_ct_helper_log(skb, ct, "cannot mangle SIP message");
167                         return NF_DROP;
168                 }
169                 request = 1;
170         } else
171                 request = 0;
172 
173         if (nf_ct_protonum(ct) == IPPROTO_TCP)
174                 hdr = SIP_HDR_VIA_TCP;
175         else
176                 hdr = SIP_HDR_VIA_UDP;
177 
178         /* Translate topmost Via header and parameters */
179         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
180                                     hdr, NULL, &matchoff, &matchlen,
181                                     &addr, &port) > 0) {
182                 unsigned int olen, matchend, poff, plen, buflen, n;
183                 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
184 
185                 /* We're only interested in headers related to this
186                  * connection */
187                 if (request) {
188                         if (!nf_inet_addr_cmp(&addr,
189                                         &ct->tuplehash[dir].tuple.src.u3) ||
190                             port != ct->tuplehash[dir].tuple.src.u.udp.port)
191                                 goto next;
192                 } else {
193                         if (!nf_inet_addr_cmp(&addr,
194                                         &ct->tuplehash[dir].tuple.dst.u3) ||
195                             port != ct->tuplehash[dir].tuple.dst.u.udp.port)
196                                 goto next;
197                 }
198 
199                 olen = *datalen;
200                 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
201                               matchoff, matchlen, &addr, port)) {
202                         nf_ct_helper_log(skb, ct, "cannot mangle Via header");
203                         return NF_DROP;
204                 }
205 
206                 matchend = matchoff + matchlen + *datalen - olen;
207 
208                 /* The maddr= parameter (RFC 2361) specifies where to send
209                  * the reply. */
210                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
211                                                "maddr=", &poff, &plen,
212                                                &addr, true) > 0 &&
213                     nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3) &&
214                     !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3)) {
215                         buflen = sip_sprintf_addr(ct, buffer,
216                                         &ct->tuplehash[!dir].tuple.dst.u3,
217                                         true);
218                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
219                                            poff, plen, buffer, buflen)) {
220                                 nf_ct_helper_log(skb, ct, "cannot mangle maddr");
221                                 return NF_DROP;
222                         }
223                 }
224 
225                 /* The received= parameter (RFC 2361) contains the address
226                  * from which the server received the request. */
227                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
228                                                "received=", &poff, &plen,
229                                                &addr, false) > 0 &&
230                     nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.dst.u3) &&
231                     !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.src.u3)) {
232                         buflen = sip_sprintf_addr(ct, buffer,
233                                         &ct->tuplehash[!dir].tuple.src.u3,
234                                         false);
235                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
236                                            poff, plen, buffer, buflen)) {
237                                 nf_ct_helper_log(skb, ct, "cannot mangle received");
238                                 return NF_DROP;
239                         }
240                 }
241 
242                 /* The rport= parameter (RFC 3581) contains the port number
243                  * from which the server received the request. */
244                 if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
245                                                  "rport=", &poff, &plen,
246                                                  &n) > 0 &&
247                     htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
248                     htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
249                         __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
250                         buflen = sprintf(buffer, "%u", ntohs(p));
251                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
252                                            poff, plen, buffer, buflen)) {
253                                 nf_ct_helper_log(skb, ct, "cannot mangle rport");
254                                 return NF_DROP;
255                         }
256                 }
257         }
258 
259 next:
260         /* Translate Contact headers */
261         coff = 0;
262         in_header = 0;
263         while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
264                                        SIP_HDR_CONTACT, &in_header,
265                                        &matchoff, &matchlen,
266                                        &addr, &port) > 0) {
267                 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
268                               matchoff, matchlen,
269                               &addr, port)) {
270                         nf_ct_helper_log(skb, ct, "cannot mangle contact");
271                         return NF_DROP;
272                 }
273         }
274 
275         if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
276             !map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_TO)) {
277                 nf_ct_helper_log(skb, ct, "cannot mangle SIP from/to");
278                 return NF_DROP;
279         }
280 
281         /* Mangle destination port for Cisco phones, then fix up checksums */
282         if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
283                 struct udphdr *uh;
284 
285                 if (skb_ensure_writable(skb, skb->len)) {
286                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
287                         return NF_DROP;
288                 }
289 
290                 uh = (void *)skb->data + protoff;
291                 uh->dest = ct_sip_info->forced_dport;
292 
293                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
294                                               0, 0, NULL, 0)) {
295                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
296                         return NF_DROP;
297                 }
298         }
299 
300         return NF_ACCEPT;
301 }
302 
303 static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
304                                   s16 off)
305 {
306         enum ip_conntrack_info ctinfo;
307         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
308         const struct tcphdr *th;
309 
310         if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
311                 return;
312 
313         th = (struct tcphdr *)(skb->data + protoff);
314         nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
315 }
316 
317 /* Handles expected signalling connections and media streams */
318 static void nf_nat_sip_expected(struct nf_conn *ct,
319                                 struct nf_conntrack_expect *exp)
320 {
321         struct nf_conn_help *help = nfct_help(ct->master);
322         struct nf_conntrack_expect *pair_exp;
323         int range_set_for_snat = 0;
324         struct nf_nat_range2 range;
325 
326         /* This must be a fresh one. */
327         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
328 
329         /* For DST manip, map port here to where it's expected. */
330         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
331         range.min_proto = range.max_proto = exp->saved_proto;
332         range.min_addr = range.max_addr = exp->saved_addr;
333         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
334 
335         /* Do media streams SRC manip according with the parameters
336          * found in the paired expectation.
337          */
338         if (exp->class != SIP_EXPECT_SIGNALLING) {
339                 spin_lock_bh(&nf_conntrack_expect_lock);
340                 hlist_for_each_entry(pair_exp, &help->expectations, lnode) {
341                         if (pair_exp->tuple.src.l3num == nf_ct_l3num(ct) &&
342                             pair_exp->tuple.dst.protonum == ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum &&
343                             nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, &pair_exp->saved_addr) &&
344                             ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == pair_exp->saved_proto.all) {
345                                 range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
346                                 range.min_proto.all = range.max_proto.all = pair_exp->tuple.dst.u.all;
347                                 range.min_addr = range.max_addr = pair_exp->tuple.dst.u3;
348                                 range_set_for_snat = 1;
349                                 break;
350                         }
351                 }
352                 spin_unlock_bh(&nf_conntrack_expect_lock);
353         }
354 
355         /* When no paired expectation has been found, change src to
356          * where master sends to, but only if the connection actually came
357          * from the same source.
358          */
359         if (!range_set_for_snat &&
360             nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
361                              &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
362                 range.flags = NF_NAT_RANGE_MAP_IPS;
363                 range.min_addr = range.max_addr
364                         = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
365                 range_set_for_snat = 1;
366         }
367 
368         /* Perform SRC manip. */
369         if (range_set_for_snat)
370                 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
371 }
372 
373 static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
374                                       unsigned int dataoff,
375                                       const char **dptr, unsigned int *datalen,
376                                       struct nf_conntrack_expect *exp,
377                                       unsigned int matchoff,
378                                       unsigned int matchlen)
379 {
380         enum ip_conntrack_info ctinfo;
381         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
382         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
383         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
384         union nf_inet_addr newaddr;
385         u_int16_t port;
386         __be16 srcport;
387         char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
388         unsigned int buflen;
389 
390         /* Connection will come from reply */
391         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
392                              &ct->tuplehash[!dir].tuple.dst.u3))
393                 newaddr = exp->tuple.dst.u3;
394         else
395                 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
396 
397         /* If the signalling port matches the connection's source port in the
398          * original direction, try to use the destination port in the opposite
399          * direction. */
400         srcport = ct_sip_info->forced_dport ? :
401                   ct->tuplehash[dir].tuple.src.u.udp.port;
402         if (exp->tuple.dst.u.udp.port == srcport)
403                 port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
404         else
405                 port = ntohs(exp->tuple.dst.u.udp.port);
406 
407         exp->saved_addr = exp->tuple.dst.u3;
408         exp->tuple.dst.u3 = newaddr;
409         exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
410         exp->dir = !dir;
411         exp->expectfn = nf_nat_sip_expected;
412 
413         for (; port != 0; port++) {
414                 int ret;
415 
416                 exp->tuple.dst.u.udp.port = htons(port);
417                 ret = nf_ct_expect_related(exp, NF_CT_EXP_F_SKIP_MASTER);
418                 if (ret == 0)
419                         break;
420                 else if (ret != -EBUSY) {
421                         port = 0;
422                         break;
423                 }
424         }
425 
426         if (port == 0) {
427                 nf_ct_helper_log(skb, ct, "all ports in use for SIP");
428                 return NF_DROP;
429         }
430 
431         if (!nf_inet_addr_cmp(&exp->tuple.dst.u3, &exp->saved_addr) ||
432             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
433                 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, port);
434                 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
435                                    matchoff, matchlen, buffer, buflen)) {
436                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
437                         goto err;
438                 }
439         }
440         return NF_ACCEPT;
441 
442 err:
443         nf_ct_unexpect_related(exp);
444         return NF_DROP;
445 }
446 
447 static int mangle_content_len(struct sk_buff *skb, unsigned int protoff,
448                               unsigned int dataoff,
449                               const char **dptr, unsigned int *datalen)
450 {
451         enum ip_conntrack_info ctinfo;
452         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
453         unsigned int matchoff, matchlen;
454         char buffer[sizeof("65536")];
455         int buflen, c_len;
456 
457         /* Get actual SDP length */
458         if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
459                                   SDP_HDR_VERSION, SDP_HDR_UNSPEC,
460                                   &matchoff, &matchlen) <= 0)
461                 return 0;
462         c_len = *datalen - matchoff + strlen("v=");
463 
464         /* Now, update SDP length */
465         if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CONTENT_LENGTH,
466                               &matchoff, &matchlen) <= 0)
467                 return 0;
468 
469         buflen = sprintf(buffer, "%u", c_len);
470         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
471                              matchoff, matchlen, buffer, buflen);
472 }
473 
474 static int mangle_sdp_packet(struct sk_buff *skb, unsigned int protoff,
475                              unsigned int dataoff,
476                              const char **dptr, unsigned int *datalen,
477                              unsigned int sdpoff,
478                              enum sdp_header_types type,
479                              enum sdp_header_types term,
480                              char *buffer, int buflen)
481 {
482         enum ip_conntrack_info ctinfo;
483         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
484         unsigned int matchlen, matchoff;
485 
486         if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
487                                   &matchoff, &matchlen) <= 0)
488                 return -ENOENT;
489         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
490                              matchoff, matchlen, buffer, buflen) ? 0 : -EINVAL;
491 }
492 
493 static unsigned int nf_nat_sdp_addr(struct sk_buff *skb, unsigned int protoff,
494                                     unsigned int dataoff,
495                                     const char **dptr, unsigned int *datalen,
496                                     unsigned int sdpoff,
497                                     enum sdp_header_types type,
498                                     enum sdp_header_types term,
499                                     const union nf_inet_addr *addr)
500 {
501         enum ip_conntrack_info ctinfo;
502         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
503         char buffer[INET6_ADDRSTRLEN];
504         unsigned int buflen;
505 
506         buflen = sip_sprintf_addr(ct, buffer, addr, false);
507         if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen,
508                               sdpoff, type, term, buffer, buflen))
509                 return 0;
510 
511         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
512 }
513 
514 static unsigned int nf_nat_sdp_port(struct sk_buff *skb, unsigned int protoff,
515                                     unsigned int dataoff,
516                                     const char **dptr, unsigned int *datalen,
517                                     unsigned int matchoff,
518                                     unsigned int matchlen,
519                                     u_int16_t port)
520 {
521         char buffer[sizeof("nnnnn")];
522         unsigned int buflen;
523 
524         buflen = sprintf(buffer, "%u", port);
525         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
526                            matchoff, matchlen, buffer, buflen))
527                 return 0;
528 
529         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
530 }
531 
532 static unsigned int nf_nat_sdp_session(struct sk_buff *skb, unsigned int protoff,
533                                        unsigned int dataoff,
534                                        const char **dptr, unsigned int *datalen,
535                                        unsigned int sdpoff,
536                                        const union nf_inet_addr *addr)
537 {
538         enum ip_conntrack_info ctinfo;
539         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
540         char buffer[INET6_ADDRSTRLEN];
541         unsigned int buflen;
542 
543         /* Mangle session description owner and contact addresses */
544         buflen = sip_sprintf_addr(ct, buffer, addr, false);
545         if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
546                               SDP_HDR_OWNER, SDP_HDR_MEDIA, buffer, buflen))
547                 return 0;
548 
549         switch (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
550                                   SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
551                                   buffer, buflen)) {
552         case 0:
553         /*
554          * RFC 2327:
555          *
556          * Session description
557          *
558          * c=* (connection information - not required if included in all media)
559          */
560         case -ENOENT:
561                 break;
562         default:
563                 return 0;
564         }
565 
566         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
567 }
568 
569 /* So, this packet has hit the connection tracking matching code.
570    Mangle it, and change the expectation to match the new version. */
571 static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
572                                      unsigned int dataoff,
573                                      const char **dptr, unsigned int *datalen,
574                                      struct nf_conntrack_expect *rtp_exp,
575                                      struct nf_conntrack_expect *rtcp_exp,
576                                      unsigned int mediaoff,
577                                      unsigned int medialen,
578                                      union nf_inet_addr *rtp_addr)
579 {
580         enum ip_conntrack_info ctinfo;
581         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
582         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
583         u_int16_t port;
584 
585         /* Connection will come from reply */
586         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
587                              &ct->tuplehash[!dir].tuple.dst.u3))
588                 *rtp_addr = rtp_exp->tuple.dst.u3;
589         else
590                 *rtp_addr = ct->tuplehash[!dir].tuple.dst.u3;
591 
592         rtp_exp->saved_addr = rtp_exp->tuple.dst.u3;
593         rtp_exp->tuple.dst.u3 = *rtp_addr;
594         rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
595         rtp_exp->dir = !dir;
596         rtp_exp->expectfn = nf_nat_sip_expected;
597 
598         rtcp_exp->saved_addr = rtcp_exp->tuple.dst.u3;
599         rtcp_exp->tuple.dst.u3 = *rtp_addr;
600         rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
601         rtcp_exp->dir = !dir;
602         rtcp_exp->expectfn = nf_nat_sip_expected;
603 
604         /* Try to get same pair of ports: if not, try to change them. */
605         for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
606              port != 0; port += 2) {
607                 int ret;
608 
609                 rtp_exp->tuple.dst.u.udp.port = htons(port);
610                 ret = nf_ct_expect_related(rtp_exp,
611                                            NF_CT_EXP_F_SKIP_MASTER);
612                 if (ret == -EBUSY)
613                         continue;
614                 else if (ret < 0) {
615                         port = 0;
616                         break;
617                 }
618                 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
619                 ret = nf_ct_expect_related(rtcp_exp,
620                                            NF_CT_EXP_F_SKIP_MASTER);
621                 if (ret == 0)
622                         break;
623                 else if (ret == -EBUSY) {
624                         nf_ct_unexpect_related(rtp_exp);
625                         continue;
626                 } else if (ret < 0) {
627                         nf_ct_unexpect_related(rtp_exp);
628                         port = 0;
629                         break;
630                 }
631         }
632 
633         if (port == 0) {
634                 nf_ct_helper_log(skb, ct, "all ports in use for SDP media");
635                 goto err1;
636         }
637 
638         /* Update media port. */
639         if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
640             !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
641                              mediaoff, medialen, port)) {
642                 nf_ct_helper_log(skb, ct, "cannot mangle SDP message");
643                 goto err2;
644         }
645 
646         return NF_ACCEPT;
647 
648 err2:
649         nf_ct_unexpect_related(rtp_exp);
650         nf_ct_unexpect_related(rtcp_exp);
651 err1:
652         return NF_DROP;
653 }
654 
655 static struct nf_ct_helper_expectfn sip_nat = {
656         .name           = "sip",
657         .expectfn       = nf_nat_sip_expected,
658 };
659 
660 static void __exit nf_nat_sip_fini(void)
661 {
662         nf_nat_helper_unregister(&nat_helper_sip);
663         RCU_INIT_POINTER(nf_nat_sip_hooks, NULL);
664         nf_ct_helper_expectfn_unregister(&sip_nat);
665         synchronize_rcu();
666 }
667 
668 static const struct nf_nat_sip_hooks sip_hooks = {
669         .msg            = nf_nat_sip,
670         .seq_adjust     = nf_nat_sip_seq_adjust,
671         .expect         = nf_nat_sip_expect,
672         .sdp_addr       = nf_nat_sdp_addr,
673         .sdp_port       = nf_nat_sdp_port,
674         .sdp_session    = nf_nat_sdp_session,
675         .sdp_media      = nf_nat_sdp_media,
676 };
677 
678 static int __init nf_nat_sip_init(void)
679 {
680         BUG_ON(nf_nat_sip_hooks != NULL);
681         nf_nat_helper_register(&nat_helper_sip);
682         RCU_INIT_POINTER(nf_nat_sip_hooks, &sip_hooks);
683         nf_ct_helper_expectfn_register(&sip_nat);
684         return 0;
685 }
686 
687 module_init(nf_nat_sip_init);
688 module_exit(nf_nat_sip_fini);
689 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp