1 // SPDX-License-Identifier: GPL-2.0-only
2 /* SIP extension for NAT alteration.
3 *
4 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
5 * based on RR's ip_nat_ftp.c and other modules.
6 * (C) 2007 United Security Providers
7 * (C) 2007, 2008, 2011, 2012 Patrick McHardy <kaber@trash.net>
8 */
9
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
12 #include <linux/inet.h>
13 #include <linux/udp.h>
14 #include <linux/tcp.h>
15
16 #include <net/netfilter/nf_nat.h>
17 #include <net/netfilter/nf_nat_helper.h>
18 #include <net/netfilter/nf_conntrack_core.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_expect.h>
21 #include <net/netfilter/nf_conntrack_seqadj.h>
22 #include <linux/netfilter/nf_conntrack_sip.h>
23
24 #define NAT_HELPER_NAME "sip"
25
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
28 MODULE_DESCRIPTION("SIP NAT helper");
29 MODULE_ALIAS_NF_NAT_HELPER(NAT_HELPER_NAME);
30
31 static struct nf_conntrack_nat_helper nat_helper_sip =
32 NF_CT_NAT_HELPER_INIT(NAT_HELPER_NAME);
33
mangle_packet(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,unsigned int matchoff,unsigned int matchlen,const char * buffer,unsigned int buflen)34 static unsigned int mangle_packet(struct sk_buff *skb, unsigned int protoff,
35 unsigned int dataoff,
36 const char **dptr, unsigned int *datalen,
37 unsigned int matchoff, unsigned int matchlen,
38 const char *buffer, unsigned int buflen)
39 {
40 enum ip_conntrack_info ctinfo;
41 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
42 struct tcphdr *th;
43 unsigned int baseoff;
44
45 if (nf_ct_protonum(ct) == IPPROTO_TCP) {
46 th = (struct tcphdr *)(skb->data + protoff);
47 baseoff = protoff + th->doff * 4;
48 matchoff += dataoff - baseoff;
49
50 if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
51 protoff, matchoff, matchlen,
52 buffer, buflen, false))
53 return 0;
54 } else {
55 baseoff = protoff + sizeof(struct udphdr);
56 matchoff += dataoff - baseoff;
57
58 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
59 protoff, matchoff, matchlen,
60 buffer, buflen))
61 return 0;
62 }
63
64 /* Reload data pointer and adjust datalen value */
65 *dptr = skb->data + dataoff;
66 *datalen += buflen - matchlen;
67 return 1;
68 }
69
sip_sprintf_addr(const struct nf_conn * ct,char * buffer,const union nf_inet_addr * addr,bool delim)70 static int sip_sprintf_addr(const struct nf_conn *ct, char *buffer,
71 const union nf_inet_addr *addr, bool delim)
72 {
73 if (nf_ct_l3num(ct) == NFPROTO_IPV4)
74 return sprintf(buffer, "%pI4", &addr->ip);
75 else {
76 if (delim)
77 return sprintf(buffer, "[%pI6c]", &addr->ip6);
78 else
79 return sprintf(buffer, "%pI6c", &addr->ip6);
80 }
81 }
82
sip_sprintf_addr_port(const struct nf_conn * ct,char * buffer,const union nf_inet_addr * addr,u16 port)83 static int sip_sprintf_addr_port(const struct nf_conn *ct, char *buffer,
84 const union nf_inet_addr *addr, u16 port)
85 {
86 if (nf_ct_l3num(ct) == NFPROTO_IPV4)
87 return sprintf(buffer, "%pI4:%u", &addr->ip, port);
88 else
89 return sprintf(buffer, "[%pI6c]:%u", &addr->ip6, port);
90 }
91
map_addr(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,unsigned int matchoff,unsigned int matchlen,union nf_inet_addr * addr,__be16 port)92 static int map_addr(struct sk_buff *skb, unsigned int protoff,
93 unsigned int dataoff,
94 const char **dptr, unsigned int *datalen,
95 unsigned int matchoff, unsigned int matchlen,
96 union nf_inet_addr *addr, __be16 port)
97 {
98 enum ip_conntrack_info ctinfo;
99 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
100 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
101 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
102 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
103 unsigned int buflen;
104 union nf_inet_addr newaddr;
105 __be16 newport;
106
107 if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, addr) &&
108 ct->tuplehash[dir].tuple.src.u.udp.port == port) {
109 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
110 newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
111 } else if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, addr) &&
112 ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
113 newaddr = ct->tuplehash[!dir].tuple.src.u3;
114 newport = ct_sip_info->forced_dport ? :
115 ct->tuplehash[!dir].tuple.src.u.udp.port;
116 } else
117 return 1;
118
119 if (nf_inet_addr_cmp(&newaddr, addr) && newport == port)
120 return 1;
121
122 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, ntohs(newport));
123 return mangle_packet(skb, protoff, dataoff, dptr, datalen,
124 matchoff, matchlen, buffer, buflen);
125 }
126
map_sip_addr(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,enum sip_header_types type)127 static int map_sip_addr(struct sk_buff *skb, unsigned int protoff,
128 unsigned int dataoff,
129 const char **dptr, unsigned int *datalen,
130 enum sip_header_types type)
131 {
132 enum ip_conntrack_info ctinfo;
133 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
134 unsigned int matchlen, matchoff;
135 union nf_inet_addr addr;
136 __be16 port;
137
138 if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
139 &matchoff, &matchlen, &addr, &port) <= 0)
140 return 1;
141 return map_addr(skb, protoff, dataoff, dptr, datalen,
142 matchoff, matchlen, &addr, port);
143 }
144
nf_nat_sip(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen)145 static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
146 unsigned int dataoff,
147 const char **dptr, unsigned int *datalen)
148 {
149 enum ip_conntrack_info ctinfo;
150 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
151 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
152 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
153 unsigned int coff, matchoff, matchlen;
154 enum sip_header_types hdr;
155 union nf_inet_addr addr;
156 __be16 port;
157 int request, in_header;
158
159 /* Basic rules: requests and responses. */
160 if (strncasecmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
161 if (ct_sip_parse_request(ct, *dptr, *datalen,
162 &matchoff, &matchlen,
163 &addr, &port) > 0 &&
164 !map_addr(skb, protoff, dataoff, dptr, datalen,
165 matchoff, matchlen, &addr, port)) {
166 nf_ct_helper_log(skb, ct, "cannot mangle SIP message");
167 return NF_DROP;
168 }
169 request = 1;
170 } else
171 request = 0;
172
173 if (nf_ct_protonum(ct) == IPPROTO_TCP)
174 hdr = SIP_HDR_VIA_TCP;
175 else
176 hdr = SIP_HDR_VIA_UDP;
177
178 /* Translate topmost Via header and parameters */
179 if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
180 hdr, NULL, &matchoff, &matchlen,
181 &addr, &port) > 0) {
182 unsigned int olen, matchend, poff, plen, buflen, n;
183 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
184
185 /* We're only interested in headers related to this
186 * connection */
187 if (request) {
188 if (!nf_inet_addr_cmp(&addr,
189 &ct->tuplehash[dir].tuple.src.u3) ||
190 port != ct->tuplehash[dir].tuple.src.u.udp.port)
191 goto next;
192 } else {
193 if (!nf_inet_addr_cmp(&addr,
194 &ct->tuplehash[dir].tuple.dst.u3) ||
195 port != ct->tuplehash[dir].tuple.dst.u.udp.port)
196 goto next;
197 }
198
199 olen = *datalen;
200 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
201 matchoff, matchlen, &addr, port)) {
202 nf_ct_helper_log(skb, ct, "cannot mangle Via header");
203 return NF_DROP;
204 }
205
206 matchend = matchoff + matchlen + *datalen - olen;
207
208 /* The maddr= parameter (RFC 2361) specifies where to send
209 * the reply. */
210 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
211 "maddr=", &poff, &plen,
212 &addr, true) > 0 &&
213 nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3) &&
214 !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3)) {
215 buflen = sip_sprintf_addr(ct, buffer,
216 &ct->tuplehash[!dir].tuple.dst.u3,
217 true);
218 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
219 poff, plen, buffer, buflen)) {
220 nf_ct_helper_log(skb, ct, "cannot mangle maddr");
221 return NF_DROP;
222 }
223 }
224
225 /* The received= parameter (RFC 2361) contains the address
226 * from which the server received the request. */
227 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
228 "received=", &poff, &plen,
229 &addr, false) > 0 &&
230 nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.dst.u3) &&
231 !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.src.u3)) {
232 buflen = sip_sprintf_addr(ct, buffer,
233 &ct->tuplehash[!dir].tuple.src.u3,
234 false);
235 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
236 poff, plen, buffer, buflen)) {
237 nf_ct_helper_log(skb, ct, "cannot mangle received");
238 return NF_DROP;
239 }
240 }
241
242 /* The rport= parameter (RFC 3581) contains the port number
243 * from which the server received the request. */
244 if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
245 "rport=", &poff, &plen,
246 &n) > 0 &&
247 htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
248 htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
249 __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
250 buflen = sprintf(buffer, "%u", ntohs(p));
251 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
252 poff, plen, buffer, buflen)) {
253 nf_ct_helper_log(skb, ct, "cannot mangle rport");
254 return NF_DROP;
255 }
256 }
257 }
258
259 next:
260 /* Translate Contact headers */
261 coff = 0;
262 in_header = 0;
263 while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
264 SIP_HDR_CONTACT, &in_header,
265 &matchoff, &matchlen,
266 &addr, &port) > 0) {
267 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
268 matchoff, matchlen,
269 &addr, port)) {
270 nf_ct_helper_log(skb, ct, "cannot mangle contact");
271 return NF_DROP;
272 }
273 }
274
275 if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
276 !map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_TO)) {
277 nf_ct_helper_log(skb, ct, "cannot mangle SIP from/to");
278 return NF_DROP;
279 }
280
281 /* Mangle destination port for Cisco phones, then fix up checksums */
282 if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
283 struct udphdr *uh;
284
285 if (skb_ensure_writable(skb, skb->len)) {
286 nf_ct_helper_log(skb, ct, "cannot mangle packet");
287 return NF_DROP;
288 }
289
290 uh = (void *)skb->data + protoff;
291 uh->dest = ct_sip_info->forced_dport;
292
293 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
294 0, 0, NULL, 0)) {
295 nf_ct_helper_log(skb, ct, "cannot mangle packet");
296 return NF_DROP;
297 }
298 }
299
300 return NF_ACCEPT;
301 }
302
nf_nat_sip_seq_adjust(struct sk_buff * skb,unsigned int protoff,s16 off)303 static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
304 s16 off)
305 {
306 enum ip_conntrack_info ctinfo;
307 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
308 const struct tcphdr *th;
309
310 if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
311 return;
312
313 th = (struct tcphdr *)(skb->data + protoff);
314 nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
315 }
316
317 /* Handles expected signalling connections and media streams */
nf_nat_sip_expected(struct nf_conn * ct,struct nf_conntrack_expect * exp)318 static void nf_nat_sip_expected(struct nf_conn *ct,
319 struct nf_conntrack_expect *exp)
320 {
321 struct nf_conn_help *help = nfct_help(ct->master);
322 struct nf_conntrack_expect *pair_exp;
323 int range_set_for_snat = 0;
324 struct nf_nat_range2 range;
325
326 /* This must be a fresh one. */
327 BUG_ON(ct->status & IPS_NAT_DONE_MASK);
328
329 /* For DST manip, map port here to where it's expected. */
330 range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
331 range.min_proto = range.max_proto = exp->saved_proto;
332 range.min_addr = range.max_addr = exp->saved_addr;
333 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
334
335 /* Do media streams SRC manip according with the parameters
336 * found in the paired expectation.
337 */
338 if (exp->class != SIP_EXPECT_SIGNALLING) {
339 spin_lock_bh(&nf_conntrack_expect_lock);
340 hlist_for_each_entry(pair_exp, &help->expectations, lnode) {
341 if (pair_exp->tuple.src.l3num == nf_ct_l3num(ct) &&
342 pair_exp->tuple.dst.protonum == ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum &&
343 nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, &pair_exp->saved_addr) &&
344 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == pair_exp->saved_proto.all) {
345 range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
346 range.min_proto.all = range.max_proto.all = pair_exp->tuple.dst.u.all;
347 range.min_addr = range.max_addr = pair_exp->tuple.dst.u3;
348 range_set_for_snat = 1;
349 break;
350 }
351 }
352 spin_unlock_bh(&nf_conntrack_expect_lock);
353 }
354
355 /* When no paired expectation has been found, change src to
356 * where master sends to, but only if the connection actually came
357 * from the same source.
358 */
359 if (!range_set_for_snat &&
360 nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
361 &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
362 range.flags = NF_NAT_RANGE_MAP_IPS;
363 range.min_addr = range.max_addr
364 = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
365 range_set_for_snat = 1;
366 }
367
368 /* Perform SRC manip. */
369 if (range_set_for_snat)
370 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
371 }
372
nf_nat_sip_expect(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,struct nf_conntrack_expect * exp,unsigned int matchoff,unsigned int matchlen)373 static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
374 unsigned int dataoff,
375 const char **dptr, unsigned int *datalen,
376 struct nf_conntrack_expect *exp,
377 unsigned int matchoff,
378 unsigned int matchlen)
379 {
380 enum ip_conntrack_info ctinfo;
381 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
382 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
383 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
384 union nf_inet_addr newaddr;
385 u_int16_t port;
386 __be16 srcport;
387 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
388 unsigned int buflen;
389
390 /* Connection will come from reply */
391 if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
392 &ct->tuplehash[!dir].tuple.dst.u3))
393 newaddr = exp->tuple.dst.u3;
394 else
395 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
396
397 /* If the signalling port matches the connection's source port in the
398 * original direction, try to use the destination port in the opposite
399 * direction. */
400 srcport = ct_sip_info->forced_dport ? :
401 ct->tuplehash[dir].tuple.src.u.udp.port;
402 if (exp->tuple.dst.u.udp.port == srcport)
403 port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
404 else
405 port = ntohs(exp->tuple.dst.u.udp.port);
406
407 exp->saved_addr = exp->tuple.dst.u3;
408 exp->tuple.dst.u3 = newaddr;
409 exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
410 exp->dir = !dir;
411 exp->expectfn = nf_nat_sip_expected;
412
413 port = nf_nat_exp_find_port(exp, port);
414 if (port == 0) {
415 nf_ct_helper_log(skb, ct, "all ports in use for SIP");
416 return NF_DROP;
417 }
418
419 if (!nf_inet_addr_cmp(&exp->tuple.dst.u3, &exp->saved_addr) ||
420 exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
421 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, port);
422 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
423 matchoff, matchlen, buffer, buflen)) {
424 nf_ct_helper_log(skb, ct, "cannot mangle packet");
425 goto err;
426 }
427 }
428 return NF_ACCEPT;
429
430 err:
431 nf_ct_unexpect_related(exp);
432 return NF_DROP;
433 }
434
mangle_content_len(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen)435 static int mangle_content_len(struct sk_buff *skb, unsigned int protoff,
436 unsigned int dataoff,
437 const char **dptr, unsigned int *datalen)
438 {
439 enum ip_conntrack_info ctinfo;
440 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
441 unsigned int matchoff, matchlen;
442 char buffer[sizeof("65536")];
443 int buflen, c_len;
444
445 /* Get actual SDP length */
446 if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
447 SDP_HDR_VERSION, SDP_HDR_UNSPEC,
448 &matchoff, &matchlen) <= 0)
449 return 0;
450 c_len = *datalen - matchoff + strlen("v=");
451
452 /* Now, update SDP length */
453 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CONTENT_LENGTH,
454 &matchoff, &matchlen) <= 0)
455 return 0;
456
457 buflen = sprintf(buffer, "%u", c_len);
458 return mangle_packet(skb, protoff, dataoff, dptr, datalen,
459 matchoff, matchlen, buffer, buflen);
460 }
461
mangle_sdp_packet(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,unsigned int sdpoff,enum sdp_header_types type,enum sdp_header_types term,char * buffer,int buflen)462 static int mangle_sdp_packet(struct sk_buff *skb, unsigned int protoff,
463 unsigned int dataoff,
464 const char **dptr, unsigned int *datalen,
465 unsigned int sdpoff,
466 enum sdp_header_types type,
467 enum sdp_header_types term,
468 char *buffer, int buflen)
469 {
470 enum ip_conntrack_info ctinfo;
471 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
472 unsigned int matchlen, matchoff;
473
474 if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
475 &matchoff, &matchlen) <= 0)
476 return -ENOENT;
477 return mangle_packet(skb, protoff, dataoff, dptr, datalen,
478 matchoff, matchlen, buffer, buflen) ? 0 : -EINVAL;
479 }
480
nf_nat_sdp_addr(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,unsigned int sdpoff,enum sdp_header_types type,enum sdp_header_types term,const union nf_inet_addr * addr)481 static unsigned int nf_nat_sdp_addr(struct sk_buff *skb, unsigned int protoff,
482 unsigned int dataoff,
483 const char **dptr, unsigned int *datalen,
484 unsigned int sdpoff,
485 enum sdp_header_types type,
486 enum sdp_header_types term,
487 const union nf_inet_addr *addr)
488 {
489 enum ip_conntrack_info ctinfo;
490 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
491 char buffer[INET6_ADDRSTRLEN];
492 unsigned int buflen;
493
494 buflen = sip_sprintf_addr(ct, buffer, addr, false);
495 if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen,
496 sdpoff, type, term, buffer, buflen))
497 return 0;
498
499 return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
500 }
501
nf_nat_sdp_port(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,unsigned int matchoff,unsigned int matchlen,u_int16_t port)502 static unsigned int nf_nat_sdp_port(struct sk_buff *skb, unsigned int protoff,
503 unsigned int dataoff,
504 const char **dptr, unsigned int *datalen,
505 unsigned int matchoff,
506 unsigned int matchlen,
507 u_int16_t port)
508 {
509 char buffer[sizeof("nnnnn")];
510 unsigned int buflen;
511
512 buflen = sprintf(buffer, "%u", port);
513 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
514 matchoff, matchlen, buffer, buflen))
515 return 0;
516
517 return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
518 }
519
nf_nat_sdp_session(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,unsigned int sdpoff,const union nf_inet_addr * addr)520 static unsigned int nf_nat_sdp_session(struct sk_buff *skb, unsigned int protoff,
521 unsigned int dataoff,
522 const char **dptr, unsigned int *datalen,
523 unsigned int sdpoff,
524 const union nf_inet_addr *addr)
525 {
526 enum ip_conntrack_info ctinfo;
527 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
528 char buffer[INET6_ADDRSTRLEN];
529 unsigned int buflen;
530
531 /* Mangle session description owner and contact addresses */
532 buflen = sip_sprintf_addr(ct, buffer, addr, false);
533 if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
534 SDP_HDR_OWNER, SDP_HDR_MEDIA, buffer, buflen))
535 return 0;
536
537 switch (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
538 SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
539 buffer, buflen)) {
540 case 0:
541 /*
542 * RFC 2327:
543 *
544 * Session description
545 *
546 * c=* (connection information - not required if included in all media)
547 */
548 case -ENOENT:
549 break;
550 default:
551 return 0;
552 }
553
554 return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
555 }
556
557 /* So, this packet has hit the connection tracking matching code.
558 Mangle it, and change the expectation to match the new version. */
nf_nat_sdp_media(struct sk_buff * skb,unsigned int protoff,unsigned int dataoff,const char ** dptr,unsigned int * datalen,struct nf_conntrack_expect * rtp_exp,struct nf_conntrack_expect * rtcp_exp,unsigned int mediaoff,unsigned int medialen,union nf_inet_addr * rtp_addr)559 static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
560 unsigned int dataoff,
561 const char **dptr, unsigned int *datalen,
562 struct nf_conntrack_expect *rtp_exp,
563 struct nf_conntrack_expect *rtcp_exp,
564 unsigned int mediaoff,
565 unsigned int medialen,
566 union nf_inet_addr *rtp_addr)
567 {
568 enum ip_conntrack_info ctinfo;
569 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
570 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
571 u_int16_t port;
572
573 /* Connection will come from reply */
574 if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
575 &ct->tuplehash[!dir].tuple.dst.u3))
576 *rtp_addr = rtp_exp->tuple.dst.u3;
577 else
578 *rtp_addr = ct->tuplehash[!dir].tuple.dst.u3;
579
580 rtp_exp->saved_addr = rtp_exp->tuple.dst.u3;
581 rtp_exp->tuple.dst.u3 = *rtp_addr;
582 rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
583 rtp_exp->dir = !dir;
584 rtp_exp->expectfn = nf_nat_sip_expected;
585
586 rtcp_exp->saved_addr = rtcp_exp->tuple.dst.u3;
587 rtcp_exp->tuple.dst.u3 = *rtp_addr;
588 rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
589 rtcp_exp->dir = !dir;
590 rtcp_exp->expectfn = nf_nat_sip_expected;
591
592 /* Try to get same pair of ports: if not, try to change them. */
593 for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
594 port != 0; port += 2) {
595 int ret;
596
597 rtp_exp->tuple.dst.u.udp.port = htons(port);
598 ret = nf_ct_expect_related(rtp_exp,
599 NF_CT_EXP_F_SKIP_MASTER);
600 if (ret == -EBUSY)
601 continue;
602 else if (ret < 0) {
603 port = 0;
604 break;
605 }
606 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
607 ret = nf_ct_expect_related(rtcp_exp,
608 NF_CT_EXP_F_SKIP_MASTER);
609 if (ret == 0)
610 break;
611 else if (ret == -EBUSY) {
612 nf_ct_unexpect_related(rtp_exp);
613 continue;
614 } else if (ret < 0) {
615 nf_ct_unexpect_related(rtp_exp);
616 port = 0;
617 break;
618 }
619 }
620
621 if (port == 0) {
622 nf_ct_helper_log(skb, ct, "all ports in use for SDP media");
623 goto err1;
624 }
625
626 /* Update media port. */
627 if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
628 !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
629 mediaoff, medialen, port)) {
630 nf_ct_helper_log(skb, ct, "cannot mangle SDP message");
631 goto err2;
632 }
633
634 return NF_ACCEPT;
635
636 err2:
637 nf_ct_unexpect_related(rtp_exp);
638 nf_ct_unexpect_related(rtcp_exp);
639 err1:
640 return NF_DROP;
641 }
642
643 static struct nf_ct_helper_expectfn sip_nat = {
644 .name = "sip",
645 .expectfn = nf_nat_sip_expected,
646 };
647
nf_nat_sip_fini(void)648 static void __exit nf_nat_sip_fini(void)
649 {
650 nf_nat_helper_unregister(&nat_helper_sip);
651 RCU_INIT_POINTER(nf_nat_sip_hooks, NULL);
652 nf_ct_helper_expectfn_unregister(&sip_nat);
653 synchronize_rcu();
654 }
655
656 static const struct nf_nat_sip_hooks sip_hooks = {
657 .msg = nf_nat_sip,
658 .seq_adjust = nf_nat_sip_seq_adjust,
659 .expect = nf_nat_sip_expect,
660 .sdp_addr = nf_nat_sdp_addr,
661 .sdp_port = nf_nat_sdp_port,
662 .sdp_session = nf_nat_sdp_session,
663 .sdp_media = nf_nat_sdp_media,
664 };
665
nf_nat_sip_init(void)666 static int __init nf_nat_sip_init(void)
667 {
668 BUG_ON(nf_nat_sip_hooks != NULL);
669 nf_nat_helper_register(&nat_helper_sip);
670 RCU_INIT_POINTER(nf_nat_sip_hooks, &sip_hooks);
671 nf_ct_helper_expectfn_register(&sip_nat);
672 return 0;
673 }
674
675 module_init(nf_nat_sip_init);
676 module_exit(nf_nat_sip_fini);
677