net/netfilter/nf_nat_sip.c

   1 /* SIP extension for NAT alteration.
   2  *
   3  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
   4  * based on RR's ip_nat_ftp.c and other modules.
   5  * (C) 2007 United Security Providers
   6  * (C) 2007, 2008, 2011, 2012 Patrick McHardy <kaber@trash.net>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/inet.h>
  16 #include <linux/udp.h>
  17 #include <linux/tcp.h>
  18
  19 #include <net/netfilter/nf_nat.h>
  20 #include <net/netfilter/nf_nat_helper.h>
  21 #include <net/netfilter/nf_conntrack_core.h>
  22 #include <net/netfilter/nf_conntrack_helper.h>
  23 #include <net/netfilter/nf_conntrack_expect.h>
  24 #include <net/netfilter/nf_conntrack_seqadj.h>
  25 #include <linux/netfilter/nf_conntrack_sip.h>
  26
  27 MODULE_LICENSE("GPL");
  28 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  29 MODULE_DESCRIPTION("SIP NAT helper");
  30 MODULE_ALIAS("ip_nat_sip");
  31
  32
  33 static unsigned int mangle_packet(struct sk_buff *skb, unsigned int protoff,
  34                                   unsigned int dataoff,
  35                                   const char **dptr, unsigned int *datalen,
  36                                   unsigned int matchoff, unsigned int matchlen,
  37                                   const char *buffer, unsigned int buflen)
  38 {
  39         enum ip_conntrack_info ctinfo;
  40         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
  41         struct tcphdr *th;
  42         unsigned int baseoff;
  43
  44         if (nf_ct_protonum(ct) == IPPROTO_TCP) {
  45                 th = (struct tcphdr *)(skb->data + protoff);
  46                 baseoff = protoff + th->doff * 4;
  47                 matchoff += dataoff - baseoff;
  48
  49                 if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
  50                                                 protoff, matchoff, matchlen,
  51                                                 buffer, buflen, false))
  52                         return 0;
  53         } else {
  54                 baseoff = protoff + sizeof(struct udphdr);
  55                 matchoff += dataoff - baseoff;
  56
  57                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
  58                                               protoff, matchoff, matchlen,
  59                                               buffer, buflen))
  60                         return 0;
  61         }
  62
  63         /* Reload data pointer and adjust datalen value */
  64         *dptr = skb->data + dataoff;
  65         *datalen += buflen - matchlen;
  66         return 1;
  67 }
  68
  69 static int sip_sprintf_addr(const struct nf_conn *ct, char *buffer,
  70                             const union nf_inet_addr *addr, bool delim)
  71 {
  72         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
  73                 return sprintf(buffer, "%pI4", &addr->ip);
  74         else {
  75                 if (delim)
  76                         return sprintf(buffer, "[%pI6c]", &addr->ip6);
  77                 else
  78                         return sprintf(buffer, "%pI6c", &addr->ip6);
  79         }
  80 }
  81
  82 static int sip_sprintf_addr_port(const struct nf_conn *ct, char *buffer,
  83                                  const union nf_inet_addr *addr, u16 port)
  84 {
  85         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
  86                 return sprintf(buffer, "%pI4:%u", &addr->ip, port);
  87         else
  88                 return sprintf(buffer, "[%pI6c]:%u", &addr->ip6, port);
  89 }
  90
  91 static int map_addr(struct sk_buff *skb, unsigned int protoff,
  92                     unsigned int dataoff,
  93                     const char **dptr, unsigned int *datalen,
  94                     unsigned int matchoff, unsigned int matchlen,
  95                     union nf_inet_addr *addr, __be16 port)
  96 {
  97         enum ip_conntrack_info ctinfo;
  98         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
  99         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 100         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
 101         char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
 102         unsigned int buflen;
 103         union nf_inet_addr newaddr;
 104         __be16 newport;
 105
 106         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, addr) &&
 107             ct->tuplehash[dir].tuple.src.u.udp.port == port) {
 108                 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
 109                 newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
 110         } else if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, addr) &&
 111                    ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
 112                 newaddr = ct->tuplehash[!dir].tuple.src.u3;
 113                 newport = ct_sip_info->forced_dport ? :
 114                           ct->tuplehash[!dir].tuple.src.u.udp.port;
 115         } else
 116                 return 1;
 117
 118         if (nf_inet_addr_cmp(&newaddr, addr) && newport == port)
 119                 return 1;
 120
 121         buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, ntohs(newport));
 122         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
 123                              matchoff, matchlen, buffer, buflen);
 124 }
 125
 126 static int map_sip_addr(struct sk_buff *skb, unsigned int protoff,
 127                         unsigned int dataoff,
 128                         const char **dptr, unsigned int *datalen,
 129                         enum sip_header_types type)
 130 {
 131         enum ip_conntrack_info ctinfo;
 132         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 133         unsigned int matchlen, matchoff;
 134         union nf_inet_addr addr;
 135         __be16 port;
 136
 137         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
 138                                     &matchoff, &matchlen, &addr, &port) <= 0)
 139                 return 1;
 140         return map_addr(skb, protoff, dataoff, dptr, datalen,
 141                         matchoff, matchlen, &addr, port);
 142 }
 143
 144 static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
 145                                unsigned int dataoff,
 146                                const char **dptr, unsigned int *datalen)
 147 {
 148         enum ip_conntrack_info ctinfo;
 149         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 150         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 151         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
 152         unsigned int coff, matchoff, matchlen;
 153         enum sip_header_types hdr;
 154         union nf_inet_addr addr;
 155         __be16 port;
 156         int request, in_header;
 157
 158         /* Basic rules: requests and responses. */
 159         if (strncasecmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
 160                 if (ct_sip_parse_request(ct, *dptr, *datalen,
 161                                          &matchoff, &matchlen,
 162                                          &addr, &port) > 0 &&
 163                     !map_addr(skb, protoff, dataoff, dptr, datalen,
 164                               matchoff, matchlen, &addr, port)) {
 165                         nf_ct_helper_log(skb, ct, "cannot mangle SIP message");
 166                         return NF_DROP;
 167                 }
 168                 request = 1;
 169         } else
 170                 request = 0;
 171
 172         if (nf_ct_protonum(ct) == IPPROTO_TCP)
 173                 hdr = SIP_HDR_VIA_TCP;
 174         else
 175                 hdr = SIP_HDR_VIA_UDP;
 176
 177         /* Translate topmost Via header and parameters */
 178         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
 179                                     hdr, NULL, &matchoff, &matchlen,
 180                                     &addr, &port) > 0) {
 181                 unsigned int olen, matchend, poff, plen, buflen, n;
 182                 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
 183
 184                 /* We're only interested in headers related to this
 185                  * connection */
 186                 if (request) {
 187                         if (!nf_inet_addr_cmp(&addr,
 188                                         &ct->tuplehash[dir].tuple.src.u3) ||
 189                             port != ct->tuplehash[dir].tuple.src.u.udp.port)
 190                                 goto next;
 191                 } else {
 192                         if (!nf_inet_addr_cmp(&addr,
 193                                         &ct->tuplehash[dir].tuple.dst.u3) ||
 194                             port != ct->tuplehash[dir].tuple.dst.u.udp.port)
 195                                 goto next;
 196                 }
 197
 198                 olen = *datalen;
 199                 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
 200                               matchoff, matchlen, &addr, port)) {
 201                         nf_ct_helper_log(skb, ct, "cannot mangle Via header");
 202                         return NF_DROP;
 203                 }
 204
 205                 matchend = matchoff + matchlen + *datalen - olen;
 206
 207                 /* The maddr= parameter (RFC 2361) specifies where to send
 208                  * the reply. */
 209                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
 210                                                "maddr=", &poff, &plen,
 211                                                &addr, true) > 0 &&
 212                     nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3) &&
 213                     !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3)) {
 214                         buflen = sip_sprintf_addr(ct, buffer,
 215                                         &ct->tuplehash[!dir].tuple.dst.u3,
 216                                         true);
 217                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
 218                                            poff, plen, buffer, buflen)) {
 219                                 nf_ct_helper_log(skb, ct, "cannot mangle maddr");
 220                                 return NF_DROP;
 221                         }
 222                 }
 223
 224                 /* The received= parameter (RFC 2361) contains the address
 225                  * from which the server received the request. */
 226                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
 227                                                "received=", &poff, &plen,
 228                                                &addr, false) > 0 &&
 229                     nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.dst.u3) &&
 230                     !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.src.u3)) {
 231                         buflen = sip_sprintf_addr(ct, buffer,
 232                                         &ct->tuplehash[!dir].tuple.src.u3,
 233                                         false);
 234                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
 235                                            poff, plen, buffer, buflen)) {
 236                                 nf_ct_helper_log(skb, ct, "cannot mangle received");
 237                                 return NF_DROP;
 238                         }
 239                 }
 240
 241                 /* The rport= parameter (RFC 3581) contains the port number
 242                  * from which the server received the request. */
 243                 if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
 244                                                  "rport=", &poff, &plen,
 245                                                  &n) > 0 &&
 246                     htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
 247                     htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
 248                         __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
 249                         buflen = sprintf(buffer, "%u", ntohs(p));
 250                         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
 251                                            poff, plen, buffer, buflen)) {
 252                                 nf_ct_helper_log(skb, ct, "cannot mangle rport");
 253                                 return NF_DROP;
 254                         }
 255                 }
 256         }
 257
 258 next:
 259         /* Translate Contact headers */
 260         coff = 0;
 261         in_header = 0;
 262         while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
 263                                        SIP_HDR_CONTACT, &in_header,
 264                                        &matchoff, &matchlen,
 265                                        &addr, &port) > 0) {
 266                 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
 267                               matchoff, matchlen,
 268                               &addr, port)) {
 269                         nf_ct_helper_log(skb, ct, "cannot mangle contact");
 270                         return NF_DROP;
 271                 }
 272         }
 273
 274         if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
 275             !map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_TO)) {
 276                 nf_ct_helper_log(skb, ct, "cannot mangle SIP from/to");
 277                 return NF_DROP;
 278         }
 279
 280         /* Mangle destination port for Cisco phones, then fix up checksums */
 281         if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
 282                 struct udphdr *uh;
 283
 284                 if (!skb_make_writable(skb, skb->len)) {
 285                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
 286                         return NF_DROP;
 287                 }
 288
 289                 uh = (void *)skb->data + protoff;
 290                 uh->dest = ct_sip_info->forced_dport;
 291
 292                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
 293                                               0, 0, NULL, 0)) {
 294                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
 295                         return NF_DROP;
 296                 }
 297         }
 298
 299         return NF_ACCEPT;
 300 }
 301
 302 static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
 303                                   s16 off)
 304 {
 305         enum ip_conntrack_info ctinfo;
 306         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 307         const struct tcphdr *th;
 308
 309         if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
 310                 return;
 311
 312         th = (struct tcphdr *)(skb->data + protoff);
 313         nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
 314 }
 315
 316 /* Handles expected signalling connections and media streams */
 317 static void nf_nat_sip_expected(struct nf_conn *ct,
 318                                 struct nf_conntrack_expect *exp)
 319 {
 320         struct nf_conn_help *help = nfct_help(ct->master);
 321         struct nf_conntrack_expect *pair_exp;
 322         int range_set_for_snat = 0;
 323         struct nf_nat_range2 range;
 324
 325         /* This must be a fresh one. */
 326         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
 327
 328         /* For DST manip, map port here to where it's expected. */
 329         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
 330         range.min_proto = range.max_proto = exp->saved_proto;
 331         range.min_addr = range.max_addr = exp->saved_addr;
 332         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 333
 334         /* Do media streams SRC manip according with the parameters
 335          * found in the paired expectation.
 336          */
 337         if (exp->class != SIP_EXPECT_SIGNALLING) {
 338                 spin_lock_bh(&nf_conntrack_expect_lock);
 339                 hlist_for_each_entry(pair_exp, &help->expectations, lnode) {
 340                         if (pair_exp->tuple.src.l3num == nf_ct_l3num(ct) &&
 341                             pair_exp->tuple.dst.protonum == ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum &&
 342                             nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, &pair_exp->saved_addr) &&
 343                             ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == pair_exp->saved_proto.all) {
 344                                 range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
 345                                 range.min_proto.all = range.max_proto.all = pair_exp->tuple.dst.u.all;
 346                                 range.min_addr = range.max_addr = pair_exp->tuple.dst.u3;
 347                                 range_set_for_snat = 1;
 348                                 break;
 349                         }
 350                 }
 351                 spin_unlock_bh(&nf_conntrack_expect_lock);
 352         }
 353
 354         /* When no paired expectation has been found, change src to
 355          * where master sends to, but only if the connection actually came
 356          * from the same source.
 357          */
 358         if (!range_set_for_snat &&
 359             nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
 360                              &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
 361                 range.flags = NF_NAT_RANGE_MAP_IPS;
 362                 range.min_addr = range.max_addr
 363                         = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
 364                 range_set_for_snat = 1;
 365         }
 366
 367         /* Perform SRC manip. */
 368         if (range_set_for_snat)
 369                 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 370 }
 371
 372 static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
 373                                       unsigned int dataoff,
 374                                       const char **dptr, unsigned int *datalen,
 375                                       struct nf_conntrack_expect *exp,
 376                                       unsigned int matchoff,
 377                                       unsigned int matchlen)
 378 {
 379         enum ip_conntrack_info ctinfo;
 380         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 381         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 382         struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
 383         union nf_inet_addr newaddr;
 384         u_int16_t port;
 385         __be16 srcport;
 386         char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
 387         unsigned int buflen;
 388
 389         /* Connection will come from reply */
 390         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
 391                              &ct->tuplehash[!dir].tuple.dst.u3))
 392                 newaddr = exp->tuple.dst.u3;
 393         else
 394                 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
 395
 396         /* If the signalling port matches the connection's source port in the
 397          * original direction, try to use the destination port in the opposite
 398          * direction. */
 399         srcport = ct_sip_info->forced_dport ? :
 400                   ct->tuplehash[dir].tuple.src.u.udp.port;
 401         if (exp->tuple.dst.u.udp.port == srcport)
 402                 port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
 403         else
 404                 port = ntohs(exp->tuple.dst.u.udp.port);
 405
 406         exp->saved_addr = exp->tuple.dst.u3;
 407         exp->tuple.dst.u3 = newaddr;
 408         exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
 409         exp->dir = !dir;
 410         exp->expectfn = nf_nat_sip_expected;
 411
 412         for (; port != 0; port++) {
 413                 int ret;
 414
 415                 exp->tuple.dst.u.udp.port = htons(port);
 416                 ret = nf_ct_expect_related(exp);
 417                 if (ret == 0)
 418                         break;
 419                 else if (ret != -EBUSY) {
 420                         port = 0;
 421                         break;
 422                 }
 423         }
 424
 425         if (port == 0) {
 426                 nf_ct_helper_log(skb, ct, "all ports in use for SIP");
 427                 return NF_DROP;
 428         }
 429
 430         if (!nf_inet_addr_cmp(&exp->tuple.dst.u3, &exp->saved_addr) ||
 431             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
 432                 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, port);
 433                 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
 434                                    matchoff, matchlen, buffer, buflen)) {
 435                         nf_ct_helper_log(skb, ct, "cannot mangle packet");
 436                         goto err;
 437                 }
 438         }
 439         return NF_ACCEPT;
 440
 441 err:
 442         nf_ct_unexpect_related(exp);
 443         return NF_DROP;
 444 }
 445
 446 static int mangle_content_len(struct sk_buff *skb, unsigned int protoff,
 447                               unsigned int dataoff,
 448                               const char **dptr, unsigned int *datalen)
 449 {
 450         enum ip_conntrack_info ctinfo;
 451         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 452         unsigned int matchoff, matchlen;
 453         char buffer[sizeof("65536")];
 454         int buflen, c_len;
 455
 456         /* Get actual SDP length */
 457         if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
 458                                   SDP_HDR_VERSION, SDP_HDR_UNSPEC,
 459                                   &matchoff, &matchlen) <= 0)
 460                 return 0;
 461         c_len = *datalen - matchoff + strlen("v=");
 462
 463         /* Now, update SDP length */
 464         if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CONTENT_LENGTH,
 465                               &matchoff, &matchlen) <= 0)
 466                 return 0;
 467
 468         buflen = sprintf(buffer, "%u", c_len);
 469         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
 470                              matchoff, matchlen, buffer, buflen);
 471 }
 472
 473 static int mangle_sdp_packet(struct sk_buff *skb, unsigned int protoff,
 474                              unsigned int dataoff,
 475                              const char **dptr, unsigned int *datalen,
 476                              unsigned int sdpoff,
 477                              enum sdp_header_types type,
 478                              enum sdp_header_types term,
 479                              char *buffer, int buflen)
 480 {
 481         enum ip_conntrack_info ctinfo;
 482         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 483         unsigned int matchlen, matchoff;
 484
 485         if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
 486                                   &matchoff, &matchlen) <= 0)
 487                 return -ENOENT;
 488         return mangle_packet(skb, protoff, dataoff, dptr, datalen,
 489                              matchoff, matchlen, buffer, buflen) ? 0 : -EINVAL;
 490 }
 491
 492 static unsigned int nf_nat_sdp_addr(struct sk_buff *skb, unsigned int protoff,
 493                                     unsigned int dataoff,
 494                                     const char **dptr, unsigned int *datalen,
 495                                     unsigned int sdpoff,
 496                                     enum sdp_header_types type,
 497                                     enum sdp_header_types term,
 498                                     const union nf_inet_addr *addr)
 499 {
 500         enum ip_conntrack_info ctinfo;
 501         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 502         char buffer[INET6_ADDRSTRLEN];
 503         unsigned int buflen;
 504
 505         buflen = sip_sprintf_addr(ct, buffer, addr, false);
 506         if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen,
 507                               sdpoff, type, term, buffer, buflen))
 508                 return 0;
 509
 510         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
 511 }
 512
 513 static unsigned int nf_nat_sdp_port(struct sk_buff *skb, unsigned int protoff,
 514                                     unsigned int dataoff,
 515                                     const char **dptr, unsigned int *datalen,
 516                                     unsigned int matchoff,
 517                                     unsigned int matchlen,
 518                                     u_int16_t port)
 519 {
 520         char buffer[sizeof("nnnnn")];
 521         unsigned int buflen;
 522
 523         buflen = sprintf(buffer, "%u", port);
 524         if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
 525                            matchoff, matchlen, buffer, buflen))
 526                 return 0;
 527
 528         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
 529 }
 530
 531 static unsigned int nf_nat_sdp_session(struct sk_buff *skb, unsigned int protoff,
 532                                        unsigned int dataoff,
 533                                        const char **dptr, unsigned int *datalen,
 534                                        unsigned int sdpoff,
 535                                        const union nf_inet_addr *addr)
 536 {
 537         enum ip_conntrack_info ctinfo;
 538         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 539         char buffer[INET6_ADDRSTRLEN];
 540         unsigned int buflen;
 541
 542         /* Mangle session description owner and contact addresses */
 543         buflen = sip_sprintf_addr(ct, buffer, addr, false);
 544         if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
 545                               SDP_HDR_OWNER, SDP_HDR_MEDIA, buffer, buflen))
 546                 return 0;
 547
 548         switch (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
 549                                   SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
 550                                   buffer, buflen)) {
 551         case 0:
 552         /*
 553          * RFC 2327:
 554          *
 555          * Session description
 556          *
 557          * c=* (connection information - not required if included in all media)
 558          */
 559         case -ENOENT:
 560                 break;
 561         default:
 562                 return 0;
 563         }
 564
 565         return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
 566 }
 567
 568 /* So, this packet has hit the connection tracking matching code.
 569    Mangle it, and change the expectation to match the new version. */
 570 static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
 571                                      unsigned int dataoff,
 572                                      const char **dptr, unsigned int *datalen,
 573                                      struct nf_conntrack_expect *rtp_exp,
 574                                      struct nf_conntrack_expect *rtcp_exp,
 575                                      unsigned int mediaoff,
 576                                      unsigned int medialen,
 577                                      union nf_inet_addr *rtp_addr)
 578 {
 579         enum ip_conntrack_info ctinfo;
 580         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 581         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 582         u_int16_t port;
 583
 584         /* Connection will come from reply */
 585         if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
 586                              &ct->tuplehash[!dir].tuple.dst.u3))
 587                 *rtp_addr = rtp_exp->tuple.dst.u3;
 588         else
 589                 *rtp_addr = ct->tuplehash[!dir].tuple.dst.u3;
 590
 591         rtp_exp->saved_addr = rtp_exp->tuple.dst.u3;
 592         rtp_exp->tuple.dst.u3 = *rtp_addr;
 593         rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
 594         rtp_exp->dir = !dir;
 595         rtp_exp->expectfn = nf_nat_sip_expected;
 596
 597         rtcp_exp->saved_addr = rtcp_exp->tuple.dst.u3;
 598         rtcp_exp->tuple.dst.u3 = *rtp_addr;
 599         rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
 600         rtcp_exp->dir = !dir;
 601         rtcp_exp->expectfn = nf_nat_sip_expected;
 602
 603         /* Try to get same pair of ports: if not, try to change them. */
 604         for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
 605              port != 0; port += 2) {
 606                 int ret;
 607
 608                 rtp_exp->tuple.dst.u.udp.port = htons(port);
 609                 ret = nf_ct_expect_related(rtp_exp);
 610                 if (ret == -EBUSY)
 611                         continue;
 612                 else if (ret < 0) {
 613                         port = 0;
 614                         break;
 615                 }
 616                 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
 617                 ret = nf_ct_expect_related(rtcp_exp);
 618                 if (ret == 0)
 619                         break;
 620                 else if (ret == -EBUSY) {
 621                         nf_ct_unexpect_related(rtp_exp);
 622                         continue;
 623                 } else if (ret < 0) {
 624                         nf_ct_unexpect_related(rtp_exp);
 625                         port = 0;
 626                         break;
 627                 }
 628         }
 629
 630         if (port == 0) {
 631                 nf_ct_helper_log(skb, ct, "all ports in use for SDP media");
 632                 goto err1;
 633         }
 634
 635         /* Update media port. */
 636         if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
 637             !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
 638                              mediaoff, medialen, port)) {
 639                 nf_ct_helper_log(skb, ct, "cannot mangle SDP message");
 640                 goto err2;
 641         }
 642
 643         return NF_ACCEPT;
 644
 645 err2:
 646         nf_ct_unexpect_related(rtp_exp);
 647         nf_ct_unexpect_related(rtcp_exp);
 648 err1:
 649         return NF_DROP;
 650 }
 651
 652 static struct nf_ct_helper_expectfn sip_nat = {
 653         .name           = "sip",
 654         .expectfn       = nf_nat_sip_expected,
 655 };
 656
 657 static void __exit nf_nat_sip_fini(void)
 658 {
 659         RCU_INIT_POINTER(nf_nat_sip_hooks, NULL);
 660
 661         nf_ct_helper_expectfn_unregister(&sip_nat);
 662         synchronize_rcu();
 663 }
 664
 665 static const struct nf_nat_sip_hooks sip_hooks = {
 666         .msg            = nf_nat_sip,
 667         .seq_adjust     = nf_nat_sip_seq_adjust,
 668         .expect         = nf_nat_sip_expect,
 669         .sdp_addr       = nf_nat_sdp_addr,
 670         .sdp_port       = nf_nat_sdp_port,
 671         .sdp_session    = nf_nat_sdp_session,
 672         .sdp_media      = nf_nat_sdp_media,
 673 };
 674
 675 static int __init nf_nat_sip_init(void)
 676 {
 677         BUG_ON(nf_nat_sip_hooks != NULL);
 678         RCU_INIT_POINTER(nf_nat_sip_hooks, &sip_hooks);
 679         nf_ct_helper_expectfn_register(&sip_nat);
 680         return 0;
 681 }
 682
 683 module_init(nf_nat_sip_init);
 684 module_exit(nf_nat_sip_fini);