1 /* SIP extension for UDP NAT alteration.
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_nat_ftp.c and other modules.
5 * (C) 2007 United Security Providers
6 * (C) 2007, 2008 Patrick McHardy <kaber@trash.net>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
17 #include <linux/udp.h>
19 #include <net/netfilter/nf_nat.h>
20 #include <net/netfilter/nf_nat_helper.h>
21 #include <net/netfilter/nf_nat_rule.h>
22 #include <net/netfilter/nf_conntrack_helper.h>
23 #include <net/netfilter/nf_conntrack_expect.h>
24 #include <linux/netfilter/nf_conntrack_sip.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
28 MODULE_DESCRIPTION("SIP NAT helper");
29 MODULE_ALIAS("ip_nat_sip");
32 static unsigned int mangle_packet(struct sk_buff
*skb
,
33 const char **dptr
, unsigned int *datalen
,
34 unsigned int matchoff
, unsigned int matchlen
,
35 const char *buffer
, unsigned int buflen
)
37 enum ip_conntrack_info ctinfo
;
38 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
40 if (!nf_nat_mangle_udp_packet(skb
, ct
, ctinfo
, matchoff
, matchlen
,
44 /* Reload data pointer and adjust datalen value */
45 *dptr
= skb
->data
+ ip_hdrlen(skb
) + sizeof(struct udphdr
);
46 *datalen
+= buflen
- matchlen
;
50 static int map_addr(struct sk_buff
*skb
,
51 const char **dptr
, unsigned int *datalen
,
52 unsigned int matchoff
, unsigned int matchlen
,
53 union nf_inet_addr
*addr
, __be16 port
)
55 enum ip_conntrack_info ctinfo
;
56 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
57 enum ip_conntrack_dir dir
= CTINFO2DIR(ctinfo
);
58 char buffer
[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
63 if (ct
->tuplehash
[dir
].tuple
.src
.u3
.ip
== addr
->ip
&&
64 ct
->tuplehash
[dir
].tuple
.src
.u
.udp
.port
== port
) {
65 newaddr
= ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
;
66 newport
= ct
->tuplehash
[!dir
].tuple
.dst
.u
.udp
.port
;
67 } else if (ct
->tuplehash
[dir
].tuple
.dst
.u3
.ip
== addr
->ip
&&
68 ct
->tuplehash
[dir
].tuple
.dst
.u
.udp
.port
== port
) {
69 newaddr
= ct
->tuplehash
[!dir
].tuple
.src
.u3
.ip
;
70 newport
= ct
->tuplehash
[!dir
].tuple
.src
.u
.udp
.port
;
74 if (newaddr
== addr
->ip
&& newport
== port
)
77 buflen
= sprintf(buffer
, "%u.%u.%u.%u:%u",
78 NIPQUAD(newaddr
), ntohs(newport
));
80 return mangle_packet(skb
, dptr
, datalen
, matchoff
, matchlen
,
84 static int map_sip_addr(struct sk_buff
*skb
,
85 const char **dptr
, unsigned int *datalen
,
86 enum sip_header_types type
)
88 enum ip_conntrack_info ctinfo
;
89 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
90 unsigned int matchlen
, matchoff
;
91 union nf_inet_addr addr
;
94 if (ct_sip_parse_header_uri(ct
, *dptr
, NULL
, *datalen
, type
, NULL
,
95 &matchoff
, &matchlen
, &addr
, &port
) <= 0)
97 return map_addr(skb
, dptr
, datalen
, matchoff
, matchlen
, &addr
, port
);
100 static unsigned int ip_nat_sip(struct sk_buff
*skb
,
101 const char **dptr
, unsigned int *datalen
)
103 enum ip_conntrack_info ctinfo
;
104 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
105 enum ip_conntrack_dir dir
= CTINFO2DIR(ctinfo
);
106 unsigned int dataoff
, matchoff
, matchlen
;
107 union nf_inet_addr addr
;
109 int request
, in_header
;
111 /* Basic rules: requests and responses. */
112 if (strnicmp(*dptr
, "SIP/2.0", strlen("SIP/2.0")) != 0) {
113 if (ct_sip_parse_request(ct
, *dptr
, *datalen
,
114 &matchoff
, &matchlen
,
116 !map_addr(skb
, dptr
, datalen
, matchoff
, matchlen
,
123 /* Translate topmost Via header and parameters */
124 if (ct_sip_parse_header_uri(ct
, *dptr
, NULL
, *datalen
,
125 SIP_HDR_VIA
, NULL
, &matchoff
, &matchlen
,
127 unsigned int matchend
, poff
, plen
, buflen
, n
;
128 char buffer
[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
130 /* We're only interested in headers related to this
133 if (addr
.ip
!= ct
->tuplehash
[dir
].tuple
.src
.u3
.ip
||
134 port
!= ct
->tuplehash
[dir
].tuple
.src
.u
.udp
.port
)
137 if (addr
.ip
!= ct
->tuplehash
[dir
].tuple
.dst
.u3
.ip
||
138 port
!= ct
->tuplehash
[dir
].tuple
.dst
.u
.udp
.port
)
142 if (!map_addr(skb
, dptr
, datalen
, matchoff
, matchlen
,
146 matchend
= matchoff
+ matchlen
;
148 /* The maddr= parameter (RFC 2361) specifies where to send
150 if (ct_sip_parse_address_param(ct
, *dptr
, matchend
, *datalen
,
151 "maddr=", &poff
, &plen
,
153 addr
.ip
== ct
->tuplehash
[dir
].tuple
.src
.u3
.ip
&&
154 addr
.ip
!= ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
) {
155 __be32 ip
= ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
;
156 buflen
= sprintf(buffer
, "%u.%u.%u.%u", NIPQUAD(ip
));
157 if (!mangle_packet(skb
, dptr
, datalen
, poff
, plen
,
162 /* The received= parameter (RFC 2361) contains the address
163 * from which the server received the request. */
164 if (ct_sip_parse_address_param(ct
, *dptr
, matchend
, *datalen
,
165 "received=", &poff
, &plen
,
167 addr
.ip
== ct
->tuplehash
[dir
].tuple
.dst
.u3
.ip
&&
168 addr
.ip
!= ct
->tuplehash
[!dir
].tuple
.src
.u3
.ip
) {
169 __be32 ip
= ct
->tuplehash
[!dir
].tuple
.src
.u3
.ip
;
170 buflen
= sprintf(buffer
, "%u.%u.%u.%u", NIPQUAD(ip
));
171 if (!mangle_packet(skb
, dptr
, datalen
, poff
, plen
,
176 /* The rport= parameter (RFC 3581) contains the port number
177 * from which the server received the request. */
178 if (ct_sip_parse_numerical_param(ct
, *dptr
, matchend
, *datalen
,
179 "rport=", &poff
, &plen
,
181 htons(n
) == ct
->tuplehash
[dir
].tuple
.dst
.u
.udp
.port
&&
182 htons(n
) != ct
->tuplehash
[!dir
].tuple
.src
.u
.udp
.port
) {
183 __be16 p
= ct
->tuplehash
[!dir
].tuple
.src
.u
.udp
.port
;
184 buflen
= sprintf(buffer
, "%u", ntohs(p
));
185 if (!mangle_packet(skb
, dptr
, datalen
, poff
, plen
,
192 /* Translate Contact headers */
195 while (ct_sip_parse_header_uri(ct
, *dptr
, &dataoff
, *datalen
,
196 SIP_HDR_CONTACT
, &in_header
,
197 &matchoff
, &matchlen
,
199 if (!map_addr(skb
, dptr
, datalen
, matchoff
, matchlen
,
204 if (!map_sip_addr(skb
, dptr
, datalen
, SIP_HDR_FROM
) ||
205 !map_sip_addr(skb
, dptr
, datalen
, SIP_HDR_TO
))
210 /* Handles expected signalling connections and media streams */
211 static void ip_nat_sip_expected(struct nf_conn
*ct
,
212 struct nf_conntrack_expect
*exp
)
214 struct nf_nat_range range
;
216 /* This must be a fresh one. */
217 BUG_ON(ct
->status
& IPS_NAT_DONE_MASK
);
219 /* For DST manip, map port here to where it's expected. */
220 range
.flags
= (IP_NAT_RANGE_MAP_IPS
| IP_NAT_RANGE_PROTO_SPECIFIED
);
221 range
.min
= range
.max
= exp
->saved_proto
;
222 range
.min_ip
= range
.max_ip
= exp
->saved_ip
;
223 nf_nat_setup_info(ct
, &range
, IP_NAT_MANIP_DST
);
225 /* Change src to where master sends to, but only if the connection
226 * actually came from the same source. */
227 if (ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u3
.ip
==
228 ct
->master
->tuplehash
[exp
->dir
].tuple
.src
.u3
.ip
) {
229 range
.flags
= IP_NAT_RANGE_MAP_IPS
;
230 range
.min_ip
= range
.max_ip
231 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.dst
.u3
.ip
;
232 nf_nat_setup_info(ct
, &range
, IP_NAT_MANIP_SRC
);
236 static unsigned int ip_nat_sip_expect(struct sk_buff
*skb
,
237 const char **dptr
, unsigned int *datalen
,
238 struct nf_conntrack_expect
*exp
,
239 unsigned int matchoff
,
240 unsigned int matchlen
)
242 enum ip_conntrack_info ctinfo
;
243 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
244 enum ip_conntrack_dir dir
= CTINFO2DIR(ctinfo
);
247 char buffer
[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
250 /* Connection will come from reply */
251 if (ct
->tuplehash
[dir
].tuple
.src
.u3
.ip
== ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
)
252 newip
= exp
->tuple
.dst
.u3
.ip
;
254 newip
= ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
;
256 /* If the signalling port matches the connection's source port in the
257 * original direction, try to use the destination port in the opposite
259 if (exp
->tuple
.dst
.u
.udp
.port
==
260 ct
->tuplehash
[dir
].tuple
.src
.u
.udp
.port
)
261 port
= ntohs(ct
->tuplehash
[!dir
].tuple
.dst
.u
.udp
.port
);
263 port
= ntohs(exp
->tuple
.dst
.u
.udp
.port
);
265 exp
->saved_ip
= exp
->tuple
.dst
.u3
.ip
;
266 exp
->tuple
.dst
.u3
.ip
= newip
;
267 exp
->saved_proto
.udp
.port
= exp
->tuple
.dst
.u
.udp
.port
;
269 exp
->expectfn
= ip_nat_sip_expected
;
271 for (; port
!= 0; port
++) {
272 exp
->tuple
.dst
.u
.udp
.port
= htons(port
);
273 if (nf_ct_expect_related(exp
) == 0)
280 if (exp
->tuple
.dst
.u3
.ip
!= exp
->saved_ip
||
281 exp
->tuple
.dst
.u
.udp
.port
!= exp
->saved_proto
.udp
.port
) {
282 buflen
= sprintf(buffer
, "%u.%u.%u.%u:%u",
283 NIPQUAD(newip
), port
);
284 if (!mangle_packet(skb
, dptr
, datalen
, matchoff
, matchlen
,
291 nf_ct_unexpect_related(exp
);
295 static int mangle_content_len(struct sk_buff
*skb
,
296 const char **dptr
, unsigned int *datalen
)
298 enum ip_conntrack_info ctinfo
;
299 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
300 unsigned int matchoff
, matchlen
;
301 char buffer
[sizeof("65536")];
304 /* Get actual SDP length */
305 if (ct_sip_get_sdp_header(ct
, *dptr
, 0, *datalen
,
306 SDP_HDR_VERSION
, SDP_HDR_UNSPEC
,
307 &matchoff
, &matchlen
) <= 0)
309 c_len
= *datalen
- matchoff
+ strlen("v=");
311 /* Now, update SDP length */
312 if (ct_sip_get_header(ct
, *dptr
, 0, *datalen
, SIP_HDR_CONTENT_LENGTH
,
313 &matchoff
, &matchlen
) <= 0)
316 buflen
= sprintf(buffer
, "%u", c_len
);
317 return mangle_packet(skb
, dptr
, datalen
, matchoff
, matchlen
,
321 static unsigned mangle_sdp_packet(struct sk_buff
*skb
, const char **dptr
,
322 unsigned int dataoff
, unsigned int *datalen
,
323 enum sdp_header_types type
,
324 enum sdp_header_types term
,
325 char *buffer
, int buflen
)
327 enum ip_conntrack_info ctinfo
;
328 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
329 unsigned int matchlen
, matchoff
;
331 if (ct_sip_get_sdp_header(ct
, *dptr
, dataoff
, *datalen
, type
, term
,
332 &matchoff
, &matchlen
) <= 0)
334 return mangle_packet(skb
, dptr
, datalen
, matchoff
, matchlen
,
338 static unsigned int ip_nat_sdp_addr(struct sk_buff
*skb
, const char **dptr
,
339 unsigned int dataoff
,
340 unsigned int *datalen
,
341 enum sdp_header_types type
,
342 enum sdp_header_types term
,
343 const union nf_inet_addr
*addr
)
345 char buffer
[sizeof("nnn.nnn.nnn.nnn")];
348 buflen
= sprintf(buffer
, NIPQUAD_FMT
, NIPQUAD(addr
->ip
));
349 if (!mangle_sdp_packet(skb
, dptr
, dataoff
, datalen
, type
, term
,
353 return mangle_content_len(skb
, dptr
, datalen
);
356 static unsigned int ip_nat_sdp_port(struct sk_buff
*skb
,
358 unsigned int *datalen
,
359 unsigned int matchoff
,
360 unsigned int matchlen
,
363 char buffer
[sizeof("nnnnn")];
366 buflen
= sprintf(buffer
, "%u", port
);
367 if (!mangle_packet(skb
, dptr
, datalen
, matchoff
, matchlen
,
371 return mangle_content_len(skb
, dptr
, datalen
);
374 static unsigned int ip_nat_sdp_session(struct sk_buff
*skb
, const char **dptr
,
375 unsigned int dataoff
,
376 unsigned int *datalen
,
377 const union nf_inet_addr
*addr
)
379 char buffer
[sizeof("nnn.nnn.nnn.nnn")];
382 /* Mangle session description owner and contact addresses */
383 buflen
= sprintf(buffer
, "%u.%u.%u.%u", NIPQUAD(addr
->ip
));
384 if (!mangle_sdp_packet(skb
, dptr
, dataoff
, datalen
,
385 SDP_HDR_OWNER_IP4
, SDP_HDR_MEDIA
,
389 if (!mangle_sdp_packet(skb
, dptr
, dataoff
, datalen
,
390 SDP_HDR_CONNECTION_IP4
, SDP_HDR_MEDIA
,
394 return mangle_content_len(skb
, dptr
, datalen
);
397 /* So, this packet has hit the connection tracking matching code.
398 Mangle it, and change the expectation to match the new version. */
399 static unsigned int ip_nat_sdp_media(struct sk_buff
*skb
,
401 unsigned int *datalen
,
402 struct nf_conntrack_expect
*rtp_exp
,
403 struct nf_conntrack_expect
*rtcp_exp
,
404 unsigned int mediaoff
,
405 unsigned int medialen
,
406 union nf_inet_addr
*rtp_addr
)
408 enum ip_conntrack_info ctinfo
;
409 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
410 enum ip_conntrack_dir dir
= CTINFO2DIR(ctinfo
);
413 /* Connection will come from reply */
414 if (ct
->tuplehash
[dir
].tuple
.src
.u3
.ip
==
415 ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
)
416 rtp_addr
->ip
= rtp_exp
->tuple
.dst
.u3
.ip
;
418 rtp_addr
->ip
= ct
->tuplehash
[!dir
].tuple
.dst
.u3
.ip
;
420 rtp_exp
->saved_ip
= rtp_exp
->tuple
.dst
.u3
.ip
;
421 rtp_exp
->tuple
.dst
.u3
.ip
= rtp_addr
->ip
;
422 rtp_exp
->saved_proto
.udp
.port
= rtp_exp
->tuple
.dst
.u
.udp
.port
;
424 rtp_exp
->expectfn
= ip_nat_sip_expected
;
426 rtcp_exp
->saved_ip
= rtcp_exp
->tuple
.dst
.u3
.ip
;
427 rtcp_exp
->tuple
.dst
.u3
.ip
= rtp_addr
->ip
;
428 rtcp_exp
->saved_proto
.udp
.port
= rtcp_exp
->tuple
.dst
.u
.udp
.port
;
429 rtcp_exp
->dir
= !dir
;
430 rtcp_exp
->expectfn
= ip_nat_sip_expected
;
432 /* Try to get same pair of ports: if not, try to change them. */
433 for (port
= ntohs(rtp_exp
->tuple
.dst
.u
.udp
.port
);
434 port
!= 0; port
+= 2) {
435 rtp_exp
->tuple
.dst
.u
.udp
.port
= htons(port
);
436 if (nf_ct_expect_related(rtp_exp
) != 0)
438 rtcp_exp
->tuple
.dst
.u
.udp
.port
= htons(port
+ 1);
439 if (nf_ct_expect_related(rtcp_exp
) == 0)
441 nf_ct_unexpect_related(rtp_exp
);
447 /* Update media port. */
448 if (rtp_exp
->tuple
.dst
.u
.udp
.port
!= rtp_exp
->saved_proto
.udp
.port
&&
449 !ip_nat_sdp_port(skb
, dptr
, datalen
, mediaoff
, medialen
, port
))
455 nf_ct_unexpect_related(rtp_exp
);
456 nf_ct_unexpect_related(rtcp_exp
);
461 static void __exit
nf_nat_sip_fini(void)
463 rcu_assign_pointer(nf_nat_sip_hook
, NULL
);
464 rcu_assign_pointer(nf_nat_sip_expect_hook
, NULL
);
465 rcu_assign_pointer(nf_nat_sdp_addr_hook
, NULL
);
466 rcu_assign_pointer(nf_nat_sdp_port_hook
, NULL
);
467 rcu_assign_pointer(nf_nat_sdp_session_hook
, NULL
);
468 rcu_assign_pointer(nf_nat_sdp_media_hook
, NULL
);
472 static int __init
nf_nat_sip_init(void)
474 BUG_ON(nf_nat_sip_hook
!= NULL
);
475 BUG_ON(nf_nat_sip_expect_hook
!= NULL
);
476 BUG_ON(nf_nat_sdp_addr_hook
!= NULL
);
477 BUG_ON(nf_nat_sdp_port_hook
!= NULL
);
478 BUG_ON(nf_nat_sdp_session_hook
!= NULL
);
479 BUG_ON(nf_nat_sdp_media_hook
!= NULL
);
480 rcu_assign_pointer(nf_nat_sip_hook
, ip_nat_sip
);
481 rcu_assign_pointer(nf_nat_sip_expect_hook
, ip_nat_sip_expect
);
482 rcu_assign_pointer(nf_nat_sdp_addr_hook
, ip_nat_sdp_addr
);
483 rcu_assign_pointer(nf_nat_sdp_port_hook
, ip_nat_sdp_port
);
484 rcu_assign_pointer(nf_nat_sdp_session_hook
, ip_nat_sdp_session
);
485 rcu_assign_pointer(nf_nat_sdp_media_hook
, ip_nat_sdp_media
);
489 module_init(nf_nat_sip_init
);
490 module_exit(nf_nat_sip_fini
);