nf_nat_sip.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283
  1. /* SIP extension for UDP NAT alteration.
  2. *
  3. * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  4. * based on RR's ip_nat_ftp.c and other modules.
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License version 2 as
  8. * published by the Free Software Foundation.
  9. */
  10. #include <linux/module.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/ip.h>
  13. #include <linux/udp.h>
  14. #include <net/netfilter/nf_nat.h>
  15. #include <net/netfilter/nf_nat_helper.h>
  16. #include <net/netfilter/nf_nat_rule.h>
  17. #include <net/netfilter/nf_conntrack_helper.h>
  18. #include <net/netfilter/nf_conntrack_expect.h>
  19. #include <linux/netfilter/nf_conntrack_sip.h>
  20. MODULE_LICENSE("GPL");
  21. MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  22. MODULE_DESCRIPTION("SIP NAT helper");
  23. MODULE_ALIAS("ip_nat_sip");
  24. #if 0
  25. #define DEBUGP printk
  26. #else
  27. #define DEBUGP(format, args...)
  28. #endif
  29. struct addr_map {
  30. struct {
  31. char src[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
  32. char dst[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
  33. unsigned int srclen, srciplen;
  34. unsigned int dstlen, dstiplen;
  35. } addr[IP_CT_DIR_MAX];
  36. };
  37. static void addr_map_init(struct nf_conn *ct, struct addr_map *map)
  38. {
  39. struct nf_conntrack_tuple *t;
  40. enum ip_conntrack_dir dir;
  41. unsigned int n;
  42. for (dir = 0; dir < IP_CT_DIR_MAX; dir++) {
  43. t = &ct->tuplehash[dir].tuple;
  44. n = sprintf(map->addr[dir].src, "%u.%u.%u.%u",
  45. NIPQUAD(t->src.u3.ip));
  46. map->addr[dir].srciplen = n;
  47. n += sprintf(map->addr[dir].src + n, ":%u",
  48. ntohs(t->src.u.udp.port));
  49. map->addr[dir].srclen = n;
  50. n = sprintf(map->addr[dir].dst, "%u.%u.%u.%u",
  51. NIPQUAD(t->dst.u3.ip));
  52. map->addr[dir].dstiplen = n;
  53. n += sprintf(map->addr[dir].dst + n, ":%u",
  54. ntohs(t->dst.u.udp.port));
  55. map->addr[dir].dstlen = n;
  56. }
  57. }
  58. static int map_sip_addr(struct sk_buff **pskb, enum ip_conntrack_info ctinfo,
  59. struct nf_conn *ct, const char **dptr, size_t dlen,
  60. enum sip_header_pos pos, struct addr_map *map)
  61. {
  62. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  63. unsigned int matchlen, matchoff, addrlen;
  64. char *addr;
  65. if (ct_sip_get_info(ct, *dptr, dlen, &matchoff, &matchlen, pos) <= 0)
  66. return 1;
  67. if ((matchlen == map->addr[dir].srciplen ||
  68. matchlen == map->addr[dir].srclen) &&
  69. memcmp(*dptr + matchoff, map->addr[dir].src, matchlen) == 0) {
  70. addr = map->addr[!dir].dst;
  71. addrlen = map->addr[!dir].dstlen;
  72. } else if ((matchlen == map->addr[dir].dstiplen ||
  73. matchlen == map->addr[dir].dstlen) &&
  74. memcmp(*dptr + matchoff, map->addr[dir].dst, matchlen) == 0) {
  75. addr = map->addr[!dir].src;
  76. addrlen = map->addr[!dir].srclen;
  77. } else
  78. return 1;
  79. if (!nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
  80. matchoff, matchlen, addr, addrlen))
  81. return 0;
  82. *dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
  83. return 1;
  84. }
  85. static unsigned int ip_nat_sip(struct sk_buff **pskb,
  86. enum ip_conntrack_info ctinfo,
  87. struct nf_conn *ct,
  88. const char **dptr)
  89. {
  90. enum sip_header_pos pos;
  91. struct addr_map map;
  92. int dataoff, datalen;
  93. dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
  94. datalen = (*pskb)->len - dataoff;
  95. if (datalen < sizeof("SIP/2.0") - 1)
  96. return NF_DROP;
  97. addr_map_init(ct, &map);
  98. /* Basic rules: requests and responses. */
  99. if (strncmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) != 0) {
  100. /* 10.2: Constructing the REGISTER Request:
  101. *
  102. * The "userinfo" and "@" components of the SIP URI MUST NOT
  103. * be present.
  104. */
  105. if (datalen >= sizeof("REGISTER") - 1 &&
  106. strncmp(*dptr, "REGISTER", sizeof("REGISTER") - 1) == 0)
  107. pos = POS_REG_REQ_URI;
  108. else
  109. pos = POS_REQ_URI;
  110. if (!map_sip_addr(pskb, ctinfo, ct, dptr, datalen, pos, &map))
  111. return NF_DROP;
  112. }
  113. if (!map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_FROM, &map) ||
  114. !map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_TO, &map) ||
  115. !map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_VIA, &map) ||
  116. !map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_CONTACT, &map))
  117. return NF_DROP;
  118. return NF_ACCEPT;
  119. }
  120. static unsigned int mangle_sip_packet(struct sk_buff **pskb,
  121. enum ip_conntrack_info ctinfo,
  122. struct nf_conn *ct,
  123. const char **dptr, size_t dlen,
  124. char *buffer, int bufflen,
  125. enum sip_header_pos pos)
  126. {
  127. unsigned int matchlen, matchoff;
  128. if (ct_sip_get_info(ct, *dptr, dlen, &matchoff, &matchlen, pos) <= 0)
  129. return 0;
  130. if (!nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
  131. matchoff, matchlen, buffer, bufflen))
  132. return 0;
  133. /* We need to reload this. Thanks Patrick. */
  134. *dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
  135. return 1;
  136. }
  137. static int mangle_content_len(struct sk_buff **pskb,
  138. enum ip_conntrack_info ctinfo,
  139. struct nf_conn *ct,
  140. const char *dptr)
  141. {
  142. unsigned int dataoff, matchoff, matchlen;
  143. char buffer[sizeof("65536")];
  144. int bufflen;
  145. dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
  146. /* Get actual SDP lenght */
  147. if (ct_sip_get_info(ct, dptr, (*pskb)->len - dataoff, &matchoff,
  148. &matchlen, POS_SDP_HEADER) > 0) {
  149. /* since ct_sip_get_info() give us a pointer passing 'v='
  150. we need to add 2 bytes in this count. */
  151. int c_len = (*pskb)->len - dataoff - matchoff + 2;
  152. /* Now, update SDP length */
  153. if (ct_sip_get_info(ct, dptr, (*pskb)->len - dataoff, &matchoff,
  154. &matchlen, POS_CONTENT) > 0) {
  155. bufflen = sprintf(buffer, "%u", c_len);
  156. return nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
  157. matchoff, matchlen,
  158. buffer, bufflen);
  159. }
  160. }
  161. return 0;
  162. }
  163. static unsigned int mangle_sdp(struct sk_buff **pskb,
  164. enum ip_conntrack_info ctinfo,
  165. struct nf_conn *ct,
  166. __be32 newip, u_int16_t port,
  167. const char *dptr)
  168. {
  169. char buffer[sizeof("nnn.nnn.nnn.nnn")];
  170. unsigned int dataoff, bufflen;
  171. dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
  172. /* Mangle owner and contact info. */
  173. bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
  174. if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
  175. buffer, bufflen, POS_OWNER_IP4))
  176. return 0;
  177. if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
  178. buffer, bufflen, POS_CONNECTION_IP4))
  179. return 0;
  180. /* Mangle media port. */
  181. bufflen = sprintf(buffer, "%u", port);
  182. if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
  183. buffer, bufflen, POS_MEDIA))
  184. return 0;
  185. return mangle_content_len(pskb, ctinfo, ct, dptr);
  186. }
  187. /* So, this packet has hit the connection tracking matching code.
  188. Mangle it, and change the expectation to match the new version. */
  189. static unsigned int ip_nat_sdp(struct sk_buff **pskb,
  190. enum ip_conntrack_info ctinfo,
  191. struct nf_conntrack_expect *exp,
  192. const char *dptr)
  193. {
  194. struct nf_conn *ct = exp->master;
  195. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  196. __be32 newip;
  197. u_int16_t port;
  198. DEBUGP("ip_nat_sdp():\n");
  199. /* Connection will come from reply */
  200. newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
  201. exp->tuple.dst.u3.ip = newip;
  202. exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
  203. exp->dir = !dir;
  204. /* When you see the packet, we need to NAT it the same as the
  205. this one. */
  206. exp->expectfn = nf_nat_follow_master;
  207. /* Try to get same port: if not, try to change it. */
  208. for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
  209. exp->tuple.dst.u.udp.port = htons(port);
  210. if (nf_conntrack_expect_related(exp) == 0)
  211. break;
  212. }
  213. if (port == 0)
  214. return NF_DROP;
  215. if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
  216. nf_conntrack_unexpect_related(exp);
  217. return NF_DROP;
  218. }
  219. return NF_ACCEPT;
  220. }
  221. static void __exit nf_nat_sip_fini(void)
  222. {
  223. rcu_assign_pointer(nf_nat_sip_hook, NULL);
  224. rcu_assign_pointer(nf_nat_sdp_hook, NULL);
  225. synchronize_rcu();
  226. }
  227. static int __init nf_nat_sip_init(void)
  228. {
  229. BUG_ON(rcu_dereference(nf_nat_sip_hook));
  230. BUG_ON(rcu_dereference(nf_nat_sdp_hook));
  231. rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
  232. rcu_assign_pointer(nf_nat_sdp_hook, ip_nat_sdp);
  233. return 0;
  234. }
  235. module_init(nf_nat_sip_init);
  236. module_exit(nf_nat_sip_fini);