target/linux/generic-2.6/patches/107-netfilter_nat_sip.patch

   1 diff -urN linux-2.6.16.4/net/ipv4/netfilter/ip_conntrack_sip.c linux-2.6.16.4.new/net/ipv4/netfilter/ip_conntrack_sip.c
   2 --- linux-2.6.16.4/net/ipv4/netfilter/ip_conntrack_sip.c        1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.6.16.4.new/net/ipv4/netfilter/ip_conntrack_sip.c    2006-04-12 17:31:44.000000000 +0200
   4 @@ -0,0 +1,414 @@
   5 +/* SIP extension for IP connection tracking.
   6 + *
   7 + * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
   8 + * based on RR's ip_conntrack_ftp.c and other modules.
   9 + *
  10 + * This program is free software; you can redistribute it and/or modify
  11 + * it under the terms of the GNU General Public License version 2 as
  12 + * published by the Free Software Foundation.
  13 + */
  14 +
  15 +#include <linux/config.h>
  16 +#include <linux/module.h>
  17 +#include <linux/netfilter.h>
  18 +#include <linux/ip.h>
  19 +#include <linux/ctype.h>
  20 +#include <linux/in.h>
  21 +#include <linux/udp.h>
  22 +#include <net/checksum.h>
  23 +#include <net/udp.h>
  24 +
  25 +#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  26 +#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
  27 +
  28 +MODULE_LICENSE("GPL");
  29 +MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  30 +MODULE_DESCRIPTION("SIP connection tracking helper");
  31 +
  32 +static DEFINE_SPINLOCK(sipbf_lock);
  33 +
  34 +
  35 +#define MAX_PORTS      8
  36 +static int ports[MAX_PORTS];
  37 +static int ports_c;
  38 +module_param_array(ports, int, &ports_c, 0400);
  39 +MODULE_PARM_DESC(ports, " port numbers of sip servers");
  40 +
  41 +static unsigned int sip_timeout = SIP_TIMEOUT;
  42 +
  43 +module_param(sip_timeout, int, 0600);
  44 +MODULE_PARM_DESC(sip_timeout, "timeout for the master sip session");
  45 +
  46 +unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,
  47 +                               enum ip_conntrack_info ctinfo,
  48 +                               struct ip_conntrack *ct,
  49 +                               const char **dptr);
  50 +EXPORT_SYMBOL_GPL(ip_nat_sip_hook);
  51 +
  52 +unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,
  53 +                               enum ip_conntrack_info ctinfo,
  54 +                               struct ip_conntrack_expect *exp,
  55 +                               const char *dptr);
  56 +EXPORT_SYMBOL_GPL(ip_nat_sdp_hook);
  57 +
  58 +int ct_sip_get_info(const char *dptr, size_t dlen,
  59 +                               unsigned int *matchoff,
  60 +                               unsigned int *matchlen,
  61 +                               struct sip_header_nfo *hnfo);
  62 +EXPORT_SYMBOL(ct_sip_get_info);
  63 +
  64 +#if 0
  65 +#define DEBUGP printk
  66 +#else
  67 +#define DEBUGP(format, args...)
  68 +#endif
  69 +
  70 +static int digits_len(const char *dptr, const char *limit, int *shift);
  71 +static int epaddr_len(const char *dptr, const char *limit, int *shift);
  72 +static int skp_digits_len(const char *dptr, const char *limit, int *shift);
  73 +static int skp_epaddr_len(const char *dptr, const char *limit, int *shift);
  74 +
  75 +struct sip_header_nfo ct_sip_hdrs[] = {
  76 +       {       /* Via header */
  77 +               "Via:",         sizeof("Via:") - 1,
  78 +               "\r\nv:",       sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
  79 +               "UDP ",         sizeof("UDP ") - 1,
  80 +               epaddr_len
  81 +       },
  82 +       {       /* Contact header */
  83 +               "Contact:",     sizeof("Contact:") - 1,
  84 +               "\r\nm:",       sizeof("\r\nm:") - 1,
  85 +               "sip:",         sizeof("sip:") - 1,
  86 +               skp_epaddr_len
  87 +       },
  88 +       {       /* Content length header */
  89 +               "Content-Length:", sizeof("Content-Length:") - 1,
  90 +               "\r\nl:",       sizeof("\r\nl:") - 1,
  91 +               ":",            sizeof(":") - 1,
  92 +               skp_digits_len
  93 +       },
  94 +       {       /* SDP media info */
  95 +               "\nm=",         sizeof("\nm=") - 1,
  96 +               "\rm=",         sizeof("\rm=") - 1,
  97 +               "audio ",       sizeof("audio ") - 1,
  98 +               digits_len
  99 +       },
 100 +       {       /* SDP owner address*/
 101 +               "\no=",         sizeof("\no=") - 1,
 102 +               "\ro=",         sizeof("\ro=") - 1,
 103 +               "IN IP4 ",      sizeof("IN IP4 ") - 1,
 104 +               epaddr_len
 105 +       },
 106 +       {       /* SDP connection info */
 107 +               "\nc=",         sizeof("\nc=") - 1,
 108 +               "\rc=",         sizeof("\rc=") - 1,
 109 +               "IN IP4 ",      sizeof("IN IP4 ") - 1,
 110 +               epaddr_len
 111 +       },
 112 +       {       /* Requests headers */
 113 +               "sip:",         sizeof("sip:") - 1,
 114 +               "sip:",         sizeof("sip:") - 1, /* yes, i know.. ;) */
 115 +               "@",            sizeof("@") - 1,
 116 +               epaddr_len
 117 +       },
 118 +       {       /* SDP version header */
 119 +               "\nv=",         sizeof("\nv=") - 1,
 120 +               "\rv=",         sizeof("\rv=") - 1,
 121 +               "=",            sizeof("=") - 1,
 122 +               digits_len
 123 +       }
 124 +};
 125 +EXPORT_SYMBOL(ct_sip_hdrs);
 126 +
 127 +
 128 +static int digits_len(const char *dptr, const char *limit, int *shift)
 129 +{
 130 +       int len = 0;
 131 +       while (dptr <= limit && isdigit(*dptr)) {
 132 +               dptr++;
 133 +               len++;
 134 +       }
 135 +       return len;
 136 +}
 137 +
 138 +/* get digits lenght, skiping blank spaces. */
 139 +static int skp_digits_len(const char *dptr, const char *limit, int *shift)
 140 +{
 141 +       for (; dptr <= limit && *dptr == ' '; dptr++)
 142 +               (*shift)++;
 143 +
 144 +       return digits_len(dptr, limit, shift);
 145 +}
 146 +
 147 +/* Simple ipaddr parser.. */
 148 +static int parse_ipaddr(const char *cp,        const char **endp,
 149 +                       uint32_t *ipaddr, const char *limit)
 150 +{
 151 +       unsigned long int val;
 152 +       int i, digit = 0;
 153 +
 154 +       for (i = 0, *ipaddr = 0; cp <= limit && i < 4; i++) {
 155 +               digit = 0;
 156 +               if (!isdigit(*cp))
 157 +                       break;
 158 +
 159 +               val = simple_strtoul(cp, (char **)&cp, 10);
 160 +               if (val > 0xFF)
 161 +                       return -1;
 162 +
 163 +               ((uint8_t *)ipaddr)[i] = val;
 164 +               digit = 1;
 165 +
 166 +               if (*cp != '.')
 167 +                       break;
 168 +               cp++;
 169 +       }
 170 +       if (!digit)
 171 +               return -1;
 172 +
 173 +       if (endp)
 174 +               *endp = cp;
 175 +
 176 +       return 0;
 177 +}
 178 +
 179 +/* skip ip address. returns it lenght. */
 180 +static int epaddr_len(const char *dptr, const char *limit, int *shift)
 181 +{
 182 +       const char *aux = dptr;
 183 +       uint32_t ip;
 184 +
 185 +       if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {
 186 +               DEBUGP("ip: %s parse failed.!\n", dptr);
 187 +               return 0;
 188 +       }
 189 +
 190 +       /* Port number */
 191 +       if (*dptr == ':') {
 192 +               dptr++;
 193 +               dptr += digits_len(dptr, limit, shift);
 194 +       }
 195 +       return dptr - aux;
 196 +}
 197 +
 198 +/* get address lenght, skiping user info. */
 199 +static int skp_epaddr_len(const char *dptr, const char *limit, int *shift)
 200 +{
 201 +       for (; dptr <= limit && *dptr != '@'; dptr++)
 202 +               (*shift)++;
 203 +
 204 +       if (*dptr == '@') {
 205 +               dptr++;
 206 +               (*shift)++;
 207 +               return epaddr_len(dptr, limit, shift);
 208 +       }
 209 +       return  0;
 210 +}
 211 +
 212 +/* Returns 0 if not found, -1 error parsing. */
 213 +int ct_sip_get_info(const char *dptr, size_t dlen,
 214 +               unsigned int *matchoff,
 215 +               unsigned int *matchlen,
 216 +               struct sip_header_nfo *hnfo)
 217 +{
 218 +       const char *limit, *aux, *k = dptr;
 219 +       int shift = 0;
 220 +
 221 +       limit = dptr + (dlen - hnfo->lnlen);
 222 +
 223 +       while (dptr <= limit) {
 224 +               if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
 225 +                       (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0))
 226 +               {
 227 +                       dptr++;
 228 +                       continue;
 229 +               }
 230 +               aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
 231 +                                               ct_sip_lnlen(dptr, limit));
 232 +               if (!aux) {
 233 +                       DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str, hnfo->lname);
 234 +                       return -1;
 235 +               }
 236 +               aux += hnfo->ln_strlen;
 237 +
 238 +               *matchlen = hnfo->match_len(aux, limit, &shift);
 239 +               if (!*matchlen)
 240 +                       return -1;
 241 +
 242 +               *matchoff = (aux - k) + shift;
 243 +
 244 +               DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname, *matchlen);
 245 +               return 1;
 246 +       }
 247 +       DEBUGP("%s header not found.\n", hnfo->lname);
 248 +       return 0;
 249 +}
 250 +
 251 +static int set_expected_rtp(struct sk_buff **pskb,
 252 +                       struct ip_conntrack *ct,
 253 +                       enum ip_conntrack_info ctinfo,
 254 +                       uint32_t ipaddr, uint16_t port,
 255 +                       const char *dptr)
 256 +{
 257 +       struct ip_conntrack_expect *exp;
 258 +       int ret;
 259 +
 260 +       exp = ip_conntrack_expect_alloc(ct);
 261 +       if (exp == NULL)
 262 +               return NF_DROP;
 263 +
 264 +       exp->tuple = ((struct ip_conntrack_tuple)
 265 +               { { ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip, { 0 } },
 266 +                 { ipaddr, { .udp = { htons(port) } }, IPPROTO_UDP }});
 267 +
 268 +       exp->mask = ((struct ip_conntrack_tuple)
 269 +               { { 0xFFFFFFFF, { 0 } },
 270 +                 { 0xFFFFFFFF, { .udp = { 0xFFFF } }, 0xFF }});
 271 +
 272 +       exp->expectfn = NULL;
 273 +
 274 +       if (ip_nat_sdp_hook)
 275 +               ret = ip_nat_sdp_hook(pskb, ctinfo, exp, dptr);
 276 +       else {
 277 +               if (ip_conntrack_expect_related(exp) != 0)
 278 +                       ret = NF_DROP;
 279 +               else
 280 +                       ret = NF_ACCEPT;
 281 +       }
 282 +       ip_conntrack_expect_put(exp);
 283 +
 284 +       return ret;
 285 +}
 286 +
 287 +static int sip_help(struct sk_buff **pskb,
 288 +               struct ip_conntrack *ct,
 289 +               enum ip_conntrack_info ctinfo)
 290 +{
 291 +       unsigned int dataoff, datalen;
 292 +       const char *dptr;
 293 +       int ret = NF_ACCEPT;
 294 +       int matchoff, matchlen;
 295 +       uint32_t ipaddr;
 296 +       uint16_t port;
 297 +
 298 +       /* No Data ? */
 299 +       dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
 300 +       if (dataoff >= (*pskb)->len) {
 301 +               DEBUGP("skb->len = %u\n", (*pskb)->len);
 302 +               return NF_ACCEPT;
 303 +        }
 304 +
 305 +       ip_ct_refresh(ct, *pskb, sip_timeout * HZ);
 306 +
 307 +       spin_lock_bh(&sipbf_lock);
 308 +
 309 +       if ((dataoff + (*pskb)->len - dataoff) <= skb_headlen(*pskb))
 310 +               dptr = (*pskb)->data + dataoff;
 311 +       else {
 312 +               DEBUGP("Copy of skbuff not supported yet.\n");
 313 +               goto out;
 314 +       }
 315 +
 316 +       if (ip_nat_sip_hook) {
 317 +               if (!ip_nat_sip_hook(pskb, ctinfo, ct, &dptr)) {
 318 +                       ret = NF_DROP;
 319 +                       goto out;
 320 +               }
 321 +       }
 322 +
 323 +       if ((ctinfo) >= IP_CT_IS_REPLY)
 324 +               goto out;
 325 +
 326 +       /* After this point NAT, could have mangled skb, so
 327 +          we need to recalculate payload lenght. */
 328 +       datalen = (*pskb)->len - dataoff;
 329 +
 330 +       if (datalen < (sizeof("SIP/2.0 200") - 1))
 331 +               goto out;
 332 +
 333 +       /* RTP info only in some SDP pkts */
 334 +       if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
 335 +           memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
 336 +               goto out;
 337 +       }
 338 +       /* Get ip and port address from SDP packet. */
 339 +       if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
 340 +           &ct_sip_hdrs[POS_CONECTION]) > 0) {
 341 +
 342 +               /* We'll drop only if there are parse problems. */
 343 +               if (parse_ipaddr(dptr + matchoff, NULL, &ipaddr,
 344 +                   dptr + datalen) < 0) {
 345 +                       ret = NF_DROP;
 346 +                       goto out;
 347 +               }
 348 +               if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
 349 +                   &ct_sip_hdrs[POS_MEDIA]) > 0) {
 350 +
 351 +                       port = simple_strtoul(dptr + matchoff, NULL, 10);
 352 +                       if (port < 1024) {
 353 +                               ret = NF_DROP;
 354 +                               goto out;
 355 +                       }
 356 +                       ret = set_expected_rtp(pskb, ct, ctinfo,
 357 +                                               ipaddr, port, dptr);
 358 +               }
 359 +       }
 360 +out:   spin_unlock_bh(&sipbf_lock);
 361 +       return ret;
 362 +}
 363 +
 364 +static struct ip_conntrack_helper sip[MAX_PORTS];
 365 +static char sip_names[MAX_PORTS][10];
 366 +
 367 +static void fini(void)
 368 +{
 369 +       int i = 0;
 370 +       for (; i < ports_c; i++) {
 371 +               DEBUGP("unregistering helper for port %d\n", ports[i]);
 372 +               ip_conntrack_helper_unregister(&sip[i]);
 373 +       }
 374 +}
 375 +
 376 +static int __init init(void)
 377 +{
 378 +       int i, ret;
 379 +       char *tmpname;
 380 +
 381 +       if (ports_c == 0)
 382 +               ports[ports_c++] = SIP_PORT;
 383 +
 384 +       for (i = 0; i < ports_c; i++) {
 385 +               /* Create helper structure */
 386 +               memset(&sip[i], 0, sizeof(struct ip_conntrack_helper));
 387 +
 388 +               sip[i].tuple.dst.protonum = IPPROTO_UDP;
 389 +               sip[i].tuple.src.u.udp.port = htons(ports[i]);
 390 +               sip[i].mask.src.u.udp.port = 0xFFFF;
 391 +               sip[i].mask.dst.protonum = 0xFF;
 392 +               sip[i].max_expected = 1;
 393 +               sip[i].timeout = 3 * 60; /* 3 minutes */
 394 +               sip[i].me = THIS_MODULE;
 395 +               sip[i].help = sip_help;
 396 +
 397 +               tmpname = &sip_names[i][0];
 398 +               if (ports[i] == SIP_PORT)
 399 +                       sprintf(tmpname, "sip");
 400 +               else
 401 +                       sprintf(tmpname, "sip-%d", i);
 402 +               sip[i].name = tmpname;
 403 +
 404 +               DEBUGP("port #%d: %d\n", i, ports[i]);
 405 +
 406 +               ret=ip_conntrack_helper_register(&sip[i]);
 407 +               if (ret) {
 408 +                       printk("ERROR registering helper for port %d\n",
 409 +                               ports[i]);
 410 +                       fini();
 411 +                       return(ret);
 412 +               }
 413 +       }
 414 +       return(0);
 415 +}
 416 +
 417 +module_init(init);
 418 +module_exit(fini);
 419 diff -urN linux-2.6.16.4/net/ipv4/netfilter/ip_nat_sip.c linux-2.6.16.4.new/net/ipv4/netfilter/ip_nat_sip.c
 420 --- linux-2.6.16.4/net/ipv4/netfilter/ip_nat_sip.c      1970-01-01 01:00:00.000000000 +0100
 421 +++ linux-2.6.16.4.new/net/ipv4/netfilter/ip_nat_sip.c  2006-04-12 17:31:53.000000000 +0200
 422 @@ -0,0 +1,249 @@
 423 +/* SIP extension for UDP NAT alteration.
 424 + *
 425 + * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
 426 + * based on RR's ip_nat_ftp.c and other modules.
 427 + *
 428 + * This program is free software; you can redistribute it and/or modify
 429 + * it under the terms of the GNU General Public License version 2 as
 430 + * published by the Free Software Foundation.
 431 + */
 432 +
 433 +#include <linux/module.h>
 434 +#include <linux/netfilter_ipv4.h>
 435 +#include <linux/ip.h>
 436 +#include <linux/udp.h>
 437 +#include <net/udp.h>
 438 +
 439 +#include <linux/netfilter_ipv4/ip_nat.h>
 440 +#include <linux/netfilter_ipv4/ip_nat_helper.h>
 441 +#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 442 +#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
 443 +
 444 +MODULE_LICENSE("GPL");
 445 +MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
 446 +MODULE_DESCRIPTION("SIP NAT helper");
 447 +
 448 +#if 0
 449 +#define DEBUGP printk
 450 +#else
 451 +#define DEBUGP(format, args...)
 452 +#endif
 453 +
 454 +extern struct sip_header_nfo ct_sip_hdrs[];
 455 +
 456 +static unsigned int mangle_sip_packet(struct sk_buff **pskb,
 457 +                       enum ip_conntrack_info ctinfo,
 458 +                       struct ip_conntrack *ct,
 459 +                       const char **dptr, size_t dlen,
 460 +                       char *buffer, int bufflen,
 461 +                       struct sip_header_nfo *hnfo)
 462 +{
 463 +       unsigned int matchlen, matchoff;
 464 +
 465 +       if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)
 466 +               return 0;
 467 +
 468 +       if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
 469 +           matchoff, matchlen, buffer, bufflen)) {
 470 +               return 0;
 471 +       }
 472 +       /* We need to reload this. Thanks Patrick. */
 473 +       *dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
 474 +       return 1;
 475 +}
 476 +
 477 +static unsigned int ip_nat_sip(struct sk_buff **pskb,
 478 +                       enum ip_conntrack_info ctinfo,
 479 +                       struct ip_conntrack *ct,
 480 +                       const char **dptr)
 481 +{
 482 +       char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
 483 +       unsigned int bufflen, dataoff;
 484 +       uint32_t ip;
 485 +       uint16_t port;
 486 +
 487 +       dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
 488 +
 489 +       if ((ctinfo) >= IP_CT_IS_REPLY) {
 490 +               ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
 491 +               port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
 492 +       } else {
 493 +               ip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
 494 +               port = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.udp.port;
 495 +       }
 496 +       bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));
 497 +
 498 +       /* short packet ? */
 499 +       if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))
 500 +               return 0;
 501 +
 502 +       /* Basic rules: requests and responses. */
 503 +       if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {
 504 +
 505 +               if ((ctinfo) < IP_CT_IS_REPLY) {
 506 +                       mangle_sip_packet(pskb, ctinfo, ct, dptr,
 507 +                               (*pskb)->len - dataoff, buffer, bufflen,
 508 +                               &ct_sip_hdrs[POS_CONTACT]);
 509 +                       return 1;
 510 +               }
 511 +
 512 +               if (!mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
 513 +                   buffer, bufflen, &ct_sip_hdrs[POS_VIA])) {
 514 +                       return 0;
 515 +               }
 516 +
 517 +               /* This search should ignore case, but later.. */
 518 +               const char *aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1,
 519 +                                                               (*pskb)->len - dataoff);
 520 +               if (!aux)
 521 +                       return 0;
 522 +
 523 +               if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"),
 524 +                   ct_sip_lnlen(aux, *dptr + (*pskb)->len - dataoff))) {
 525 +                       return 1;
 526 +               }
 527 +               return mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
 528 +                                               buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
 529 +       }
 530 +       if ((ctinfo) < IP_CT_IS_REPLY) {
 531 +               if (!mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
 532 +                   buffer, bufflen, &ct_sip_hdrs[POS_VIA])) {
 533 +                       return 0;
 534 +               }
 535 +
 536 +               /* Mangle Contact if exists only. - watch udp_nat_mangle()! */
 537 +               mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
 538 +                                               buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
 539 +               return 1;
 540 +       }
 541 +       /* This mangle requests headers. */
 542 +       return mangle_sip_packet(pskb, ctinfo, ct, dptr,
 543 +                       ct_sip_lnlen(*dptr, *dptr + (*pskb)->len - dataoff),
 544 +                       buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);
 545 +}
 546 +
 547 +static int mangle_content_len(struct sk_buff **pskb,
 548 +                       enum ip_conntrack_info ctinfo,
 549 +                       struct ip_conntrack *ct,
 550 +                       const char *dptr)
 551 +{
 552 +       unsigned int dataoff, matchoff, matchlen;
 553 +       char buffer[sizeof("65536")];
 554 +       int bufflen;
 555 +
 556 +       dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
 557 +
 558 +       /* Get actual SDP lenght */
 559 +       if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
 560 +           &matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {
 561 +
 562 +               /* since ct_sip_get_info() give us a pointer passing 'v='
 563 +                  we need to add 2 bytes in this count. */
 564 +               int c_len = (*pskb)->len - dataoff - matchoff + 2;
 565 +
 566 +               /* Now, update SDP lenght */
 567 +               if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
 568 +                   &matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {
 569 +
 570 +                       bufflen = sprintf(buffer, "%u", c_len);
 571 +
 572 +                       return ip_nat_mangle_udp_packet(pskb, ct, ctinfo, matchoff,
 573 +                                                       matchlen, buffer, bufflen);
 574 +               }
 575 +       }
 576 +       return 0;
 577 +}
 578 +
 579 +static unsigned int mangle_sdp(struct sk_buff **pskb,
 580 +                       enum ip_conntrack_info ctinfo,
 581 +                       struct ip_conntrack *ct,
 582 +                       uint32_t newip, uint16_t port,
 583 +                       const char *dptr)
 584 +{
 585 +       char buffer[sizeof("nnn.nnn.nnn.nnn")];
 586 +       unsigned int dataoff, bufflen;
 587 +
 588 +       dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
 589 +
 590 +       /* Mangle owner and contact info. */
 591 +       bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
 592 +       if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
 593 +           buffer, bufflen, &ct_sip_hdrs[POS_OWNER])) {
 594 +               return 0;
 595 +       }
 596 +
 597 +       if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
 598 +           buffer, bufflen, &ct_sip_hdrs[POS_CONECTION])) {
 599 +               return 0;
 600 +       }
 601 +
 602 +       /* Mangle media port. */
 603 +       bufflen = sprintf(buffer, "%u", port);
 604 +       if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
 605 +           buffer, bufflen, &ct_sip_hdrs[POS_MEDIA])) {
 606 +               return 0;
 607 +       }
 608 +
 609 +       return mangle_content_len(pskb, ctinfo, ct, dptr);
 610 +}
 611 +
 612 +/* So, this packet has hit the connection tracking matching code.
 613 +   Mangle it, and change the expectation to match the new version. */
 614 +static unsigned int ip_nat_sdp(struct sk_buff **pskb,
 615 +                       enum ip_conntrack_info ctinfo,
 616 +                       struct ip_conntrack_expect *exp,
 617 +                       const char *dptr)
 618 +{
 619 +       struct ip_conntrack *ct = exp->master;
 620 +       uint32_t newip;
 621 +       uint16_t port;
 622 +
 623 +       DEBUGP("ip_nat_sdp():\n");
 624 +
 625 +       /* Connection will come from reply */
 626 +       newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
 627 +
 628 +       exp->tuple.dst.ip = newip;
 629 +       exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
 630 +       exp->dir = IP_CT_DIR_REPLY;
 631 +
 632 +       /* When you see the packet, we need to NAT it the same as the
 633 +          this one. */
 634 +       exp->expectfn = ip_nat_follow_master;
 635 +
 636 +       /* Try to get same port: if not, try to change it. */
 637 +       for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
 638 +               exp->tuple.dst.u.udp.port = htons(port);
 639 +               if (ip_conntrack_expect_related(exp) == 0)
 640 +                       break;
 641 +       }
 642 +
 643 +       if (port == 0)
 644 +               return NF_DROP;
 645 +
 646 +       if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
 647 +               ip_conntrack_unexpect_related(exp);
 648 +               return NF_DROP;
 649 +       }
 650 +       return NF_ACCEPT;
 651 +}
 652 +
 653 +static void __exit fini(void)
 654 +{
 655 +       ip_nat_sip_hook = NULL;
 656 +       ip_nat_sdp_hook = NULL;
 657 +       /* Make sure noone calls it, meanwhile. */
 658 +       synchronize_net();
 659 +}
 660 +
 661 +static int __init init(void)
 662 +{
 663 +       BUG_ON(ip_nat_sip_hook);
 664 +       BUG_ON(ip_nat_sdp_hook);
 665 +       ip_nat_sip_hook = ip_nat_sip;
 666 +       ip_nat_sdp_hook = ip_nat_sdp;
 667 +       return 0;
 668 +}
 669 +
 670 +module_init(init);
 671 +module_exit(fini);
 672 diff -urN linux-2.6.16.4/net/ipv4/netfilter/Kconfig linux-2.6.16.4.new/net/ipv4/netfilter/Kconfig
 673 --- linux-2.6.16.4/net/ipv4/netfilter/Kconfig   2006-04-12 17:29:19.000000000 +0200
 674 +++ linux-2.6.16.4.new/net/ipv4/netfilter/Kconfig       2006-04-12 17:32:53.000000000 +0200
 675 @@ -168,6 +168,19 @@
 676           If you want to compile it as a module, say M here and read
 677           Documentation/modules.txt.  If unsure, say `N'.
 678
 679 +config IP_NF_SIP
 680 +       tristate  'SIP support'
 681 +       depends on IP_NF_CONNTRACK
 682 +       help
 683 +         SIP is an application-layer control protocol that can establish,
 684 +         modify, and terminate multimedia sessions (conferences) such as
 685 +         Internet telephony calls. With the ip_conntrack_sip and
 686 +         the ip_nat_sip modules you can support the protocol on a connection
 687 +         tracking/NATing firewall.
 688 +
 689 +         If you want to compile it as a module, say 'M' here and read
 690 +         Documentation/modules.txt.  If unsure, say 'N'.
 691 +
 692  config IP_NF_QUEUE
 693         tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
 694         help
 695 @@ -545,6 +558,12 @@
 696         default IP_NF_NAT if IP_NF_PPTP=y
 697         default m if IP_NF_PPTP=m
 698
 699 +config IP_NF_NAT_SIP
 700 +       tristate
 701 +       depends on IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
 702 +       default IP_NF_NAT if IP_NF_SIP=y
 703 +       default m if IP_NF_SIP=m
 704 +
 705  # mangle + specific targets
 706  config IP_NF_MANGLE
 707         tristate "Packet mangling"
 708 diff -urN linux-2.6.16.4/net/ipv4/netfilter/Makefile linux-2.6.16.4.new/net/ipv4/netfilter/Makefile
 709 --- linux-2.6.16.4/net/ipv4/netfilter/Makefile  2006-04-12 17:29:19.000000000 +0200
 710 +++ linux-2.6.16.4.new/net/ipv4/netfilter/Makefile      2006-04-12 17:33:39.000000000 +0200
 711 @@ -28,6 +28,7 @@
 712  obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o
 713  obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o
 714  obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o
 715 +obj-$(CONFIG_IP_NF_SIP) += ip_conntrack_sip.o
 716
 717  # NAT helpers
 718  obj-$(CONFIG_IP_NF_NAT_PPTP) += ip_nat_pptp.o
 719 @@ -35,6 +36,7 @@
 720  obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o
 721  obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
 722  obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
 723 +obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o
 724
 725  # generic IP tables
 726  obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 727 diff -urN linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack.h
 728 --- linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack.h  2006-04-12 17:29:19.000000000 +0200
 729 +++ linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack.h      2006-04-12 17:30:38.000000000 +0200
 730 @@ -33,6 +33,7 @@
 731  #include <linux/netfilter_ipv4/ip_conntrack_amanda.h>
 732  #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
 733  #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
 734 +#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
 735
 736  /* per conntrack: application helper private data */
 737  union ip_conntrack_help {
 738 @@ -40,6 +41,7 @@
 739         struct ip_ct_pptp_master ct_pptp_info;
 740         struct ip_ct_ftp_master ct_ftp_info;
 741         struct ip_ct_irc_master ct_irc_info;
 742 +       struct ip_ct_sip_master ct_sip_info;
 743  };
 744
 745  #ifdef CONFIG_IP_NF_NAT_NEEDED
 746 diff -urN linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack_sip.h linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack_sip.h
 747 --- linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack_sip.h      1970-01-01 01:00:00.000000000 +0100
 748 +++ linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack_sip.h  2006-04-12 17:31:12.000000000 +0200
 749 @@ -0,0 +1,81 @@
 750 +#ifndef __IP_CONNTRACK_SIP_H__
 751 +#define __IP_CONNTRACK_SIP_H__
 752 +/* SIP tracking. */
 753 +
 754 +#ifdef __KERNEL__
 755 +
 756 +#define SIP_PORT       5060
 757 +#define SIP_TIMEOUT    3600
 758 +
 759 +#define POS_VIA                0
 760 +#define POS_CONTACT    1
 761 +#define POS_CONTENT    2
 762 +#define POS_MEDIA      3
 763 +#define POS_OWNER      4
 764 +#define POS_CONECTION  5
 765 +#define POS_REQ_HEADER 6
 766 +#define POS_SDP_HEADER 7
 767 +
 768 +struct ip_ct_sip_master {
 769 +};
 770 +
 771 +struct sip_header_nfo {
 772 +       const char *lname;
 773 +       size_t lnlen;
 774 +       const char *sname;
 775 +       size_t snlen;
 776 +       const char *ln_str;
 777 +       size_t ln_strlen;
 778 +       int (*match_len)(const char *, const char *, int *);
 779 +
 780 +};
 781 +
 782 +extern unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,
 783 +                               enum ip_conntrack_info ctinfo,
 784 +                               struct ip_conntrack *ct,
 785 +                               const char **dptr);
 786 +
 787 +/* For NAT to hook in when on expect. */
 788 +extern unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,
 789 +                               enum ip_conntrack_info ctinfo,
 790 +                               struct ip_conntrack_expect *exp,
 791 +                               const char *dptr);
 792 +
 793 +extern int ct_sip_get_info(const char *dptr, size_t dlen,
 794 +                               unsigned int *matchoff,
 795 +                               unsigned int *matchlen,
 796 +                               struct sip_header_nfo *hnfo);
 797 +
 798 +/* get line lenght until first CR or LF seen. */
 799 +static __inline__ int ct_sip_lnlen(const char *line, const char *limit)
 800 +{
 801 +        const char *k = line;
 802 +
 803 +        while ((line <= limit) && (*line == '\r' || *line == '\n'))
 804 +                line++;
 805 +
 806 +        while (line <= limit) {
 807 +                if (*line == '\r' || *line == '\n')
 808 +                        break;
 809 +                line++;
 810 +        }
 811 +        return line - k;
 812 +}
 813 +
 814 +/* Linear string search, case sensitive. */
 815 +static __inline__
 816 +const char *ct_sip_search(const char *needle, const char *haystack,
 817 +                       size_t needle_len, size_t haystack_len)
 818 +{
 819 +       const char *limit = haystack + (haystack_len - needle_len);
 820 +
 821 +       while (haystack <= limit) {
 822 +               if (memcmp(haystack, needle, needle_len) == 0)
 823 +                       return haystack;
 824 +               haystack++;
 825 +       }
 826 +       return NULL;
 827 +}
 828 +#endif /* __KERNEL__ */
 829 +
 830 +#endif /* __IP_CONNTRACK_SIP_H__ */