+++ /dev/null
-diff -urN linux-2.6.16.4/net/ipv4/netfilter/ip_conntrack_sip.c linux-2.6.16.4.new/net/ipv4/netfilter/ip_conntrack_sip.c
---- linux-2.6.16.4/net/ipv4/netfilter/ip_conntrack_sip.c 1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.16.4.new/net/ipv4/netfilter/ip_conntrack_sip.c 2006-04-12 17:31:44.000000000 +0200
-@@ -0,0 +1,414 @@
-+/* SIP extension for IP connection tracking.
-+ *
-+ * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
-+ * based on RR's ip_conntrack_ftp.c and other modules.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/config.h>
-+#include <linux/module.h>
-+#include <linux/netfilter.h>
-+#include <linux/ip.h>
-+#include <linux/ctype.h>
-+#include <linux/in.h>
-+#include <linux/udp.h>
-+#include <net/checksum.h>
-+#include <net/udp.h>
-+
-+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
-+#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
-+MODULE_DESCRIPTION("SIP connection tracking helper");
-+
-+static DEFINE_SPINLOCK(sipbf_lock);
-+
-+
-+#define MAX_PORTS 8
-+static int ports[MAX_PORTS];
-+static int ports_c;
-+module_param_array(ports, int, &ports_c, 0400);
-+MODULE_PARM_DESC(ports, " port numbers of sip servers");
-+
-+static unsigned int sip_timeout = SIP_TIMEOUT;
-+
-+module_param(sip_timeout, int, 0600);
-+MODULE_PARM_DESC(sip_timeout, "timeout for the master sip session");
-+
-+unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack *ct,
-+ const char **dptr);
-+EXPORT_SYMBOL_GPL(ip_nat_sip_hook);
-+
-+unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack_expect *exp,
-+ const char *dptr);
-+EXPORT_SYMBOL_GPL(ip_nat_sdp_hook);
-+
-+int ct_sip_get_info(const char *dptr, size_t dlen,
-+ unsigned int *matchoff,
-+ unsigned int *matchlen,
-+ struct sip_header_nfo *hnfo);
-+EXPORT_SYMBOL(ct_sip_get_info);
-+
-+#if 0
-+#define DEBUGP printk
-+#else
-+#define DEBUGP(format, args...)
-+#endif
-+
-+static int digits_len(const char *dptr, const char *limit, int *shift);
-+static int epaddr_len(const char *dptr, const char *limit, int *shift);
-+static int skp_digits_len(const char *dptr, const char *limit, int *shift);
-+static int skp_epaddr_len(const char *dptr, const char *limit, int *shift);
-+
-+struct sip_header_nfo ct_sip_hdrs[] = {
-+ { /* Via header */
-+ "Via:", sizeof("Via:") - 1,
-+ "\r\nv:", sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
-+ "UDP ", sizeof("UDP ") - 1,
-+ epaddr_len
-+ },
-+ { /* Contact header */
-+ "Contact:", sizeof("Contact:") - 1,
-+ "\r\nm:", sizeof("\r\nm:") - 1,
-+ "sip:", sizeof("sip:") - 1,
-+ skp_epaddr_len
-+ },
-+ { /* Content length header */
-+ "Content-Length:", sizeof("Content-Length:") - 1,
-+ "\r\nl:", sizeof("\r\nl:") - 1,
-+ ":", sizeof(":") - 1,
-+ skp_digits_len
-+ },
-+ { /* SDP media info */
-+ "\nm=", sizeof("\nm=") - 1,
-+ "\rm=", sizeof("\rm=") - 1,
-+ "audio ", sizeof("audio ") - 1,
-+ digits_len
-+ },
-+ { /* SDP owner address*/
-+ "\no=", sizeof("\no=") - 1,
-+ "\ro=", sizeof("\ro=") - 1,
-+ "IN IP4 ", sizeof("IN IP4 ") - 1,
-+ epaddr_len
-+ },
-+ { /* SDP connection info */
-+ "\nc=", sizeof("\nc=") - 1,
-+ "\rc=", sizeof("\rc=") - 1,
-+ "IN IP4 ", sizeof("IN IP4 ") - 1,
-+ epaddr_len
-+ },
-+ { /* Requests headers */
-+ "sip:", sizeof("sip:") - 1,
-+ "sip:", sizeof("sip:") - 1, /* yes, i know.. ;) */
-+ "@", sizeof("@") - 1,
-+ epaddr_len
-+ },
-+ { /* SDP version header */
-+ "\nv=", sizeof("\nv=") - 1,
-+ "\rv=", sizeof("\rv=") - 1,
-+ "=", sizeof("=") - 1,
-+ digits_len
-+ }
-+};
-+EXPORT_SYMBOL(ct_sip_hdrs);
-+
-+
-+static int digits_len(const char *dptr, const char *limit, int *shift)
-+{
-+ int len = 0;
-+ while (dptr <= limit && isdigit(*dptr)) {
-+ dptr++;
-+ len++;
-+ }
-+ return len;
-+}
-+
-+/* get digits lenght, skiping blank spaces. */
-+static int skp_digits_len(const char *dptr, const char *limit, int *shift)
-+{
-+ for (; dptr <= limit && *dptr == ' '; dptr++)
-+ (*shift)++;
-+
-+ return digits_len(dptr, limit, shift);
-+}
-+
-+/* Simple ipaddr parser.. */
-+static int parse_ipaddr(const char *cp, const char **endp,
-+ uint32_t *ipaddr, const char *limit)
-+{
-+ unsigned long int val;
-+ int i, digit = 0;
-+
-+ for (i = 0, *ipaddr = 0; cp <= limit && i < 4; i++) {
-+ digit = 0;
-+ if (!isdigit(*cp))
-+ break;
-+
-+ val = simple_strtoul(cp, (char **)&cp, 10);
-+ if (val > 0xFF)
-+ return -1;
-+
-+ ((uint8_t *)ipaddr)[i] = val;
-+ digit = 1;
-+
-+ if (*cp != '.')
-+ break;
-+ cp++;
-+ }
-+ if (!digit)
-+ return -1;
-+
-+ if (endp)
-+ *endp = cp;
-+
-+ return 0;
-+}
-+
-+/* skip ip address. returns it lenght. */
-+static int epaddr_len(const char *dptr, const char *limit, int *shift)
-+{
-+ const char *aux = dptr;
-+ uint32_t ip;
-+
-+ if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {
-+ DEBUGP("ip: %s parse failed.!\n", dptr);
-+ return 0;
-+ }
-+
-+ /* Port number */
-+ if (*dptr == ':') {
-+ dptr++;
-+ dptr += digits_len(dptr, limit, shift);
-+ }
-+ return dptr - aux;
-+}
-+
-+/* get address lenght, skiping user info. */
-+static int skp_epaddr_len(const char *dptr, const char *limit, int *shift)
-+{
-+ for (; dptr <= limit && *dptr != '@'; dptr++)
-+ (*shift)++;
-+
-+ if (*dptr == '@') {
-+ dptr++;
-+ (*shift)++;
-+ return epaddr_len(dptr, limit, shift);
-+ }
-+ return 0;
-+}
-+
-+/* Returns 0 if not found, -1 error parsing. */
-+int ct_sip_get_info(const char *dptr, size_t dlen,
-+ unsigned int *matchoff,
-+ unsigned int *matchlen,
-+ struct sip_header_nfo *hnfo)
-+{
-+ const char *limit, *aux, *k = dptr;
-+ int shift = 0;
-+
-+ limit = dptr + (dlen - hnfo->lnlen);
-+
-+ while (dptr <= limit) {
-+ if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
-+ (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0))
-+ {
-+ dptr++;
-+ continue;
-+ }
-+ aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
-+ ct_sip_lnlen(dptr, limit));
-+ if (!aux) {
-+ DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str, hnfo->lname);
-+ return -1;
-+ }
-+ aux += hnfo->ln_strlen;
-+
-+ *matchlen = hnfo->match_len(aux, limit, &shift);
-+ if (!*matchlen)
-+ return -1;
-+
-+ *matchoff = (aux - k) + shift;
-+
-+ DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname, *matchlen);
-+ return 1;
-+ }
-+ DEBUGP("%s header not found.\n", hnfo->lname);
-+ return 0;
-+}
-+
-+static int set_expected_rtp(struct sk_buff **pskb,
-+ struct ip_conntrack *ct,
-+ enum ip_conntrack_info ctinfo,
-+ uint32_t ipaddr, uint16_t port,
-+ const char *dptr)
-+{
-+ struct ip_conntrack_expect *exp;
-+ int ret;
-+
-+ exp = ip_conntrack_expect_alloc(ct);
-+ if (exp == NULL)
-+ return NF_DROP;
-+
-+ exp->tuple = ((struct ip_conntrack_tuple)
-+ { { ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip, { 0 } },
-+ { ipaddr, { .udp = { htons(port) } }, IPPROTO_UDP }});
-+
-+ exp->mask = ((struct ip_conntrack_tuple)
-+ { { 0xFFFFFFFF, { 0 } },
-+ { 0xFFFFFFFF, { .udp = { 0xFFFF } }, 0xFF }});
-+
-+ exp->expectfn = NULL;
-+
-+ if (ip_nat_sdp_hook)
-+ ret = ip_nat_sdp_hook(pskb, ctinfo, exp, dptr);
-+ else {
-+ if (ip_conntrack_expect_related(exp) != 0)
-+ ret = NF_DROP;
-+ else
-+ ret = NF_ACCEPT;
-+ }
-+ ip_conntrack_expect_put(exp);
-+
-+ return ret;
-+}
-+
-+static int sip_help(struct sk_buff **pskb,
-+ struct ip_conntrack *ct,
-+ enum ip_conntrack_info ctinfo)
-+{
-+ unsigned int dataoff, datalen;
-+ const char *dptr;
-+ int ret = NF_ACCEPT;
-+ int matchoff, matchlen;
-+ uint32_t ipaddr;
-+ uint16_t port;
-+
-+ /* No Data ? */
-+ dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
-+ if (dataoff >= (*pskb)->len) {
-+ DEBUGP("skb->len = %u\n", (*pskb)->len);
-+ return NF_ACCEPT;
-+ }
-+
-+ ip_ct_refresh(ct, *pskb, sip_timeout * HZ);
-+
-+ spin_lock_bh(&sipbf_lock);
-+
-+ if ((dataoff + (*pskb)->len - dataoff) <= skb_headlen(*pskb))
-+ dptr = (*pskb)->data + dataoff;
-+ else {
-+ DEBUGP("Copy of skbuff not supported yet.\n");
-+ goto out;
-+ }
-+
-+ if (ip_nat_sip_hook) {
-+ if (!ip_nat_sip_hook(pskb, ctinfo, ct, &dptr)) {
-+ ret = NF_DROP;
-+ goto out;
-+ }
-+ }
-+
-+ if ((ctinfo) >= IP_CT_IS_REPLY)
-+ goto out;
-+
-+ /* After this point NAT, could have mangled skb, so
-+ we need to recalculate payload lenght. */
-+ datalen = (*pskb)->len - dataoff;
-+
-+ if (datalen < (sizeof("SIP/2.0 200") - 1))
-+ goto out;
-+
-+ /* RTP info only in some SDP pkts */
-+ if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
-+ memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
-+ goto out;
-+ }
-+ /* Get ip and port address from SDP packet. */
-+ if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
-+ &ct_sip_hdrs[POS_CONECTION]) > 0) {
-+
-+ /* We'll drop only if there are parse problems. */
-+ if (parse_ipaddr(dptr + matchoff, NULL, &ipaddr,
-+ dptr + datalen) < 0) {
-+ ret = NF_DROP;
-+ goto out;
-+ }
-+ if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
-+ &ct_sip_hdrs[POS_MEDIA]) > 0) {
-+
-+ port = simple_strtoul(dptr + matchoff, NULL, 10);
-+ if (port < 1024) {
-+ ret = NF_DROP;
-+ goto out;
-+ }
-+ ret = set_expected_rtp(pskb, ct, ctinfo,
-+ ipaddr, port, dptr);
-+ }
-+ }
-+out: spin_unlock_bh(&sipbf_lock);
-+ return ret;
-+}
-+
-+static struct ip_conntrack_helper sip[MAX_PORTS];
-+static char sip_names[MAX_PORTS][10];
-+
-+static void fini(void)
-+{
-+ int i = 0;
-+ for (; i < ports_c; i++) {
-+ DEBUGP("unregistering helper for port %d\n", ports[i]);
-+ ip_conntrack_helper_unregister(&sip[i]);
-+ }
-+}
-+
-+static int __init init(void)
-+{
-+ int i, ret;
-+ char *tmpname;
-+
-+ if (ports_c == 0)
-+ ports[ports_c++] = SIP_PORT;
-+
-+ for (i = 0; i < ports_c; i++) {
-+ /* Create helper structure */
-+ memset(&sip[i], 0, sizeof(struct ip_conntrack_helper));
-+
-+ sip[i].tuple.dst.protonum = IPPROTO_UDP;
-+ sip[i].tuple.src.u.udp.port = htons(ports[i]);
-+ sip[i].mask.src.u.udp.port = 0xFFFF;
-+ sip[i].mask.dst.protonum = 0xFF;
-+ sip[i].max_expected = 1;
-+ sip[i].timeout = 3 * 60; /* 3 minutes */
-+ sip[i].me = THIS_MODULE;
-+ sip[i].help = sip_help;
-+
-+ tmpname = &sip_names[i][0];
-+ if (ports[i] == SIP_PORT)
-+ sprintf(tmpname, "sip");
-+ else
-+ sprintf(tmpname, "sip-%d", i);
-+ sip[i].name = tmpname;
-+
-+ DEBUGP("port #%d: %d\n", i, ports[i]);
-+
-+ ret=ip_conntrack_helper_register(&sip[i]);
-+ if (ret) {
-+ printk("ERROR registering helper for port %d\n",
-+ ports[i]);
-+ fini();
-+ return(ret);
-+ }
-+ }
-+ return(0);
-+}
-+
-+module_init(init);
-+module_exit(fini);
-diff -urN linux-2.6.16.4/net/ipv4/netfilter/ip_nat_sip.c linux-2.6.16.4.new/net/ipv4/netfilter/ip_nat_sip.c
---- linux-2.6.16.4/net/ipv4/netfilter/ip_nat_sip.c 1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.16.4.new/net/ipv4/netfilter/ip_nat_sip.c 2006-04-12 17:31:53.000000000 +0200
-@@ -0,0 +1,249 @@
-+/* SIP extension for UDP NAT alteration.
-+ *
-+ * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
-+ * based on RR's ip_nat_ftp.c and other modules.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/netfilter_ipv4.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <net/udp.h>
-+
-+#include <linux/netfilter_ipv4/ip_nat.h>
-+#include <linux/netfilter_ipv4/ip_nat_helper.h>
-+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
-+#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
-+MODULE_DESCRIPTION("SIP NAT helper");
-+
-+#if 0
-+#define DEBUGP printk
-+#else
-+#define DEBUGP(format, args...)
-+#endif
-+
-+extern struct sip_header_nfo ct_sip_hdrs[];
-+
-+static unsigned int mangle_sip_packet(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack *ct,
-+ const char **dptr, size_t dlen,
-+ char *buffer, int bufflen,
-+ struct sip_header_nfo *hnfo)
-+{
-+ unsigned int matchlen, matchoff;
-+
-+ if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)
-+ return 0;
-+
-+ if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
-+ matchoff, matchlen, buffer, bufflen)) {
-+ return 0;
-+ }
-+ /* We need to reload this. Thanks Patrick. */
-+ *dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
-+ return 1;
-+}
-+
-+static unsigned int ip_nat_sip(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack *ct,
-+ const char **dptr)
-+{
-+ char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
-+ unsigned int bufflen, dataoff;
-+ uint32_t ip;
-+ uint16_t port;
-+
-+ dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
-+
-+ if ((ctinfo) >= IP_CT_IS_REPLY) {
-+ ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
-+ port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
-+ } else {
-+ ip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
-+ port = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.udp.port;
-+ }
-+ bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));
-+
-+ /* short packet ? */
-+ if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))
-+ return 0;
-+
-+ /* Basic rules: requests and responses. */
-+ if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {
-+
-+ if ((ctinfo) < IP_CT_IS_REPLY) {
-+ mangle_sip_packet(pskb, ctinfo, ct, dptr,
-+ (*pskb)->len - dataoff, buffer, bufflen,
-+ &ct_sip_hdrs[POS_CONTACT]);
-+ return 1;
-+ }
-+
-+ if (!mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_VIA])) {
-+ return 0;
-+ }
-+
-+ /* This search should ignore case, but later.. */
-+ const char *aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1,
-+ (*pskb)->len - dataoff);
-+ if (!aux)
-+ return 0;
-+
-+ if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"),
-+ ct_sip_lnlen(aux, *dptr + (*pskb)->len - dataoff))) {
-+ return 1;
-+ }
-+ return mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
-+ }
-+ if ((ctinfo) < IP_CT_IS_REPLY) {
-+ if (!mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_VIA])) {
-+ return 0;
-+ }
-+
-+ /* Mangle Contact if exists only. - watch udp_nat_mangle()! */
-+ mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
-+ return 1;
-+ }
-+ /* This mangle requests headers. */
-+ return mangle_sip_packet(pskb, ctinfo, ct, dptr,
-+ ct_sip_lnlen(*dptr, *dptr + (*pskb)->len - dataoff),
-+ buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);
-+}
-+
-+static int mangle_content_len(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack *ct,
-+ const char *dptr)
-+{
-+ unsigned int dataoff, matchoff, matchlen;
-+ char buffer[sizeof("65536")];
-+ int bufflen;
-+
-+ dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
-+
-+ /* Get actual SDP lenght */
-+ if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
-+ &matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {
-+
-+ /* since ct_sip_get_info() give us a pointer passing 'v='
-+ we need to add 2 bytes in this count. */
-+ int c_len = (*pskb)->len - dataoff - matchoff + 2;
-+
-+ /* Now, update SDP lenght */
-+ if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
-+ &matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {
-+
-+ bufflen = sprintf(buffer, "%u", c_len);
-+
-+ return ip_nat_mangle_udp_packet(pskb, ct, ctinfo, matchoff,
-+ matchlen, buffer, bufflen);
-+ }
-+ }
-+ return 0;
-+}
-+
-+static unsigned int mangle_sdp(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack *ct,
-+ uint32_t newip, uint16_t port,
-+ const char *dptr)
-+{
-+ char buffer[sizeof("nnn.nnn.nnn.nnn")];
-+ unsigned int dataoff, bufflen;
-+
-+ dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
-+
-+ /* Mangle owner and contact info. */
-+ bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
-+ if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_OWNER])) {
-+ return 0;
-+ }
-+
-+ if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_CONECTION])) {
-+ return 0;
-+ }
-+
-+ /* Mangle media port. */
-+ bufflen = sprintf(buffer, "%u", port);
-+ if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
-+ buffer, bufflen, &ct_sip_hdrs[POS_MEDIA])) {
-+ return 0;
-+ }
-+
-+ return mangle_content_len(pskb, ctinfo, ct, dptr);
-+}
-+
-+/* So, this packet has hit the connection tracking matching code.
-+ Mangle it, and change the expectation to match the new version. */
-+static unsigned int ip_nat_sdp(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack_expect *exp,
-+ const char *dptr)
-+{
-+ struct ip_conntrack *ct = exp->master;
-+ uint32_t newip;
-+ uint16_t port;
-+
-+ DEBUGP("ip_nat_sdp():\n");
-+
-+ /* Connection will come from reply */
-+ newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
-+
-+ exp->tuple.dst.ip = newip;
-+ exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
-+ exp->dir = IP_CT_DIR_REPLY;
-+
-+ /* When you see the packet, we need to NAT it the same as the
-+ this one. */
-+ exp->expectfn = ip_nat_follow_master;
-+
-+ /* Try to get same port: if not, try to change it. */
-+ for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
-+ exp->tuple.dst.u.udp.port = htons(port);
-+ if (ip_conntrack_expect_related(exp) == 0)
-+ break;
-+ }
-+
-+ if (port == 0)
-+ return NF_DROP;
-+
-+ if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
-+ ip_conntrack_unexpect_related(exp);
-+ return NF_DROP;
-+ }
-+ return NF_ACCEPT;
-+}
-+
-+static void __exit fini(void)
-+{
-+ ip_nat_sip_hook = NULL;
-+ ip_nat_sdp_hook = NULL;
-+ /* Make sure noone calls it, meanwhile. */
-+ synchronize_net();
-+}
-+
-+static int __init init(void)
-+{
-+ BUG_ON(ip_nat_sip_hook);
-+ BUG_ON(ip_nat_sdp_hook);
-+ ip_nat_sip_hook = ip_nat_sip;
-+ ip_nat_sdp_hook = ip_nat_sdp;
-+ return 0;
-+}
-+
-+module_init(init);
-+module_exit(fini);
-diff -urN linux-2.6.16.4/net/ipv4/netfilter/Kconfig linux-2.6.16.4.new/net/ipv4/netfilter/Kconfig
---- linux-2.6.16.4/net/ipv4/netfilter/Kconfig 2006-04-12 17:29:19.000000000 +0200
-+++ linux-2.6.16.4.new/net/ipv4/netfilter/Kconfig 2006-04-12 17:32:53.000000000 +0200
-@@ -168,6 +168,19 @@
- If you want to compile it as a module, say M here and read
- Documentation/modules.txt. If unsure, say `N'.
-
-+config IP_NF_SIP
-+ tristate 'SIP support'
-+ depends on IP_NF_CONNTRACK
-+ help
-+ SIP is an application-layer control protocol that can establish,
-+ modify, and terminate multimedia sessions (conferences) such as
-+ Internet telephony calls. With the ip_conntrack_sip and
-+ the ip_nat_sip modules you can support the protocol on a connection
-+ tracking/NATing firewall.
-+
-+ If you want to compile it as a module, say 'M' here and read
-+ Documentation/modules.txt. If unsure, say 'N'.
-+
- config IP_NF_QUEUE
- tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
- help
-@@ -545,6 +558,12 @@
- default IP_NF_NAT if IP_NF_PPTP=y
- default m if IP_NF_PPTP=m
-
-+config IP_NF_NAT_SIP
-+ tristate
-+ depends on IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
-+ default IP_NF_NAT if IP_NF_SIP=y
-+ default m if IP_NF_SIP=m
-+
- # mangle + specific targets
- config IP_NF_MANGLE
- tristate "Packet mangling"
-diff -urN linux-2.6.16.4/net/ipv4/netfilter/Makefile linux-2.6.16.4.new/net/ipv4/netfilter/Makefile
---- linux-2.6.16.4/net/ipv4/netfilter/Makefile 2006-04-12 17:29:19.000000000 +0200
-+++ linux-2.6.16.4.new/net/ipv4/netfilter/Makefile 2006-04-12 17:33:39.000000000 +0200
-@@ -28,6 +28,7 @@
- obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o
- obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o
- obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o
-+obj-$(CONFIG_IP_NF_SIP) += ip_conntrack_sip.o
-
- # NAT helpers
- obj-$(CONFIG_IP_NF_NAT_PPTP) += ip_nat_pptp.o
-@@ -35,6 +36,7 @@
- obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o
- obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
- obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
-+obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o
-
- # generic IP tables
- obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
-diff -urN linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack.h
---- linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack.h 2006-04-12 17:29:19.000000000 +0200
-+++ linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack.h 2006-04-12 17:30:38.000000000 +0200
-@@ -33,6 +33,7 @@
- #include <linux/netfilter_ipv4/ip_conntrack_amanda.h>
- #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
- #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
-+#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
-
- /* per conntrack: application helper private data */
- union ip_conntrack_help {
-@@ -40,6 +41,7 @@
- struct ip_ct_pptp_master ct_pptp_info;
- struct ip_ct_ftp_master ct_ftp_info;
- struct ip_ct_irc_master ct_irc_info;
-+ struct ip_ct_sip_master ct_sip_info;
- };
-
- #ifdef CONFIG_IP_NF_NAT_NEEDED
-diff -urN linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack_sip.h linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack_sip.h
---- linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack_sip.h 1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack_sip.h 2006-04-12 17:31:12.000000000 +0200
-@@ -0,0 +1,81 @@
-+#ifndef __IP_CONNTRACK_SIP_H__
-+#define __IP_CONNTRACK_SIP_H__
-+/* SIP tracking. */
-+
-+#ifdef __KERNEL__
-+
-+#define SIP_PORT 5060
-+#define SIP_TIMEOUT 3600
-+
-+#define POS_VIA 0
-+#define POS_CONTACT 1
-+#define POS_CONTENT 2
-+#define POS_MEDIA 3
-+#define POS_OWNER 4
-+#define POS_CONECTION 5
-+#define POS_REQ_HEADER 6
-+#define POS_SDP_HEADER 7
-+
-+struct ip_ct_sip_master {
-+};
-+
-+struct sip_header_nfo {
-+ const char *lname;
-+ size_t lnlen;
-+ const char *sname;
-+ size_t snlen;
-+ const char *ln_str;
-+ size_t ln_strlen;
-+ int (*match_len)(const char *, const char *, int *);
-+
-+};
-+
-+extern unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack *ct,
-+ const char **dptr);
-+
-+/* For NAT to hook in when on expect. */
-+extern unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb,
-+ enum ip_conntrack_info ctinfo,
-+ struct ip_conntrack_expect *exp,
-+ const char *dptr);
-+
-+extern int ct_sip_get_info(const char *dptr, size_t dlen,
-+ unsigned int *matchoff,
-+ unsigned int *matchlen,
-+ struct sip_header_nfo *hnfo);
-+
-+/* get line lenght until first CR or LF seen. */
-+static __inline__ int ct_sip_lnlen(const char *line, const char *limit)
-+{
-+ const char *k = line;
-+
-+ while ((line <= limit) && (*line == '\r' || *line == '\n'))
-+ line++;
-+
-+ while (line <= limit) {
-+ if (*line == '\r' || *line == '\n')
-+ break;
-+ line++;
-+ }
-+ return line - k;
-+}
-+
-+/* Linear string search, case sensitive. */
-+static __inline__
-+const char *ct_sip_search(const char *needle, const char *haystack,
-+ size_t needle_len, size_t haystack_len)
-+{
-+ const char *limit = haystack + (haystack_len - needle_len);
-+
-+ while (haystack <= limit) {
-+ if (memcmp(haystack, needle, needle_len) == 0)
-+ return haystack;
-+ haystack++;
-+ }
-+ return NULL;
-+}
-+#endif /* __KERNEL__ */
-+
-+#endif /* __IP_CONNTRACK_SIP_H__ */
projects / openwrt / svn-archive / archive.git / blobdiff