1 /* SIP extension for NAT alteration.
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_nat_ftp.c and other modules.
5 * (C) 2007 United Security Providers
6 * (C) 2007, 2008, 2011, 2012 Patrick McHardy <kaber@trash.net>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/inet.h>
16 #include <linux/udp.h>
17 #include <linux/tcp.h>
19 #include <net/netfilter/nf_nat.h>
20 #include <net/netfilter/nf_nat_helper.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <net/netfilter/nf_conntrack_expect.h>
23 #include <linux/netfilter/nf_conntrack_sip.h>
25 MODULE_LICENSE("GPL");
26 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
27 MODULE_DESCRIPTION("SIP NAT helper");
28 MODULE_ALIAS("ip_nat_sip");
31 static unsigned int mangle_packet(struct sk_buff *skb, unsigned int protoff,
33 const char **dptr, unsigned int *datalen,
34 unsigned int matchoff, unsigned int matchlen,
35 const char *buffer, unsigned int buflen)
37 enum ip_conntrack_info ctinfo;
38 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
42 if (nf_ct_protonum(ct) == IPPROTO_TCP) {
43 th = (struct tcphdr *)(skb->data + protoff);
44 baseoff = protoff + th->doff * 4;
45 matchoff += dataoff - baseoff;
47 if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
48 protoff, matchoff, matchlen,
49 buffer, buflen, false))
52 baseoff = protoff + sizeof(struct udphdr);
53 matchoff += dataoff - baseoff;
55 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
56 protoff, matchoff, matchlen,
61 /* Reload data pointer and adjust datalen value */
62 *dptr = skb->data + dataoff;
63 *datalen += buflen - matchlen;
67 static int sip_sprintf_addr(const struct nf_conn *ct, char *buffer,
68 const union nf_inet_addr *addr, bool delim)
70 if (nf_ct_l3num(ct) == NFPROTO_IPV4)
71 return sprintf(buffer, "%pI4", &addr->ip);
74 return sprintf(buffer, "[%pI6c]", &addr->ip6);
76 return sprintf(buffer, "%pI6c", &addr->ip6);
80 static int sip_sprintf_addr_port(const struct nf_conn *ct, char *buffer,
81 const union nf_inet_addr *addr, u16 port)
83 if (nf_ct_l3num(ct) == NFPROTO_IPV4)
84 return sprintf(buffer, "%pI4:%u", &addr->ip, port);
86 return sprintf(buffer, "[%pI6c]:%u", &addr->ip6, port);
89 static int map_addr(struct sk_buff *skb, unsigned int protoff,
91 const char **dptr, unsigned int *datalen,
92 unsigned int matchoff, unsigned int matchlen,
93 union nf_inet_addr *addr, __be16 port)
95 enum ip_conntrack_info ctinfo;
96 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
97 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
98 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
99 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
101 union nf_inet_addr newaddr;
104 if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, addr) &&
105 ct->tuplehash[dir].tuple.src.u.udp.port == port) {
106 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
107 newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
108 } else if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, addr) &&
109 ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
110 newaddr = ct->tuplehash[!dir].tuple.src.u3;
111 newport = ct_sip_info->forced_dport ? :
112 ct->tuplehash[!dir].tuple.src.u.udp.port;
116 if (nf_inet_addr_cmp(&newaddr, addr) && newport == port)
119 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, ntohs(newport));
120 return mangle_packet(skb, protoff, dataoff, dptr, datalen,
121 matchoff, matchlen, buffer, buflen);
124 static int map_sip_addr(struct sk_buff *skb, unsigned int protoff,
125 unsigned int dataoff,
126 const char **dptr, unsigned int *datalen,
127 enum sip_header_types type)
129 enum ip_conntrack_info ctinfo;
130 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
131 unsigned int matchlen, matchoff;
132 union nf_inet_addr addr;
135 if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
136 &matchoff, &matchlen, &addr, &port) <= 0)
138 return map_addr(skb, protoff, dataoff, dptr, datalen,
139 matchoff, matchlen, &addr, port);
142 static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
143 unsigned int dataoff,
144 const char **dptr, unsigned int *datalen)
146 enum ip_conntrack_info ctinfo;
147 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
148 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
149 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
150 unsigned int coff, matchoff, matchlen;
151 enum sip_header_types hdr;
152 union nf_inet_addr addr;
154 int request, in_header;
156 /* Basic rules: requests and responses. */
157 if (strnicmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
158 if (ct_sip_parse_request(ct, *dptr, *datalen,
159 &matchoff, &matchlen,
161 !map_addr(skb, protoff, dataoff, dptr, datalen,
162 matchoff, matchlen, &addr, port))
168 if (nf_ct_protonum(ct) == IPPROTO_TCP)
169 hdr = SIP_HDR_VIA_TCP;
171 hdr = SIP_HDR_VIA_UDP;
173 /* Translate topmost Via header and parameters */
174 if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
175 hdr, NULL, &matchoff, &matchlen,
177 unsigned int olen, matchend, poff, plen, buflen, n;
178 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
180 /* We're only interested in headers related to this
183 if (!nf_inet_addr_cmp(&addr,
184 &ct->tuplehash[dir].tuple.src.u3) ||
185 port != ct->tuplehash[dir].tuple.src.u.udp.port)
188 if (!nf_inet_addr_cmp(&addr,
189 &ct->tuplehash[dir].tuple.dst.u3) ||
190 port != ct->tuplehash[dir].tuple.dst.u.udp.port)
195 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
196 matchoff, matchlen, &addr, port))
199 matchend = matchoff + matchlen + *datalen - olen;
201 /* The maddr= parameter (RFC 2361) specifies where to send
203 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
204 "maddr=", &poff, &plen,
206 nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3) &&
207 !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3)) {
208 buflen = sip_sprintf_addr(ct, buffer,
209 &ct->tuplehash[!dir].tuple.dst.u3,
211 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
212 poff, plen, buffer, buflen))
216 /* The received= parameter (RFC 2361) contains the address
217 * from which the server received the request. */
218 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
219 "received=", &poff, &plen,
221 nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.dst.u3) &&
222 !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.src.u3)) {
223 buflen = sip_sprintf_addr(ct, buffer,
224 &ct->tuplehash[!dir].tuple.src.u3,
226 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
227 poff, plen, buffer, buflen))
231 /* The rport= parameter (RFC 3581) contains the port number
232 * from which the server received the request. */
233 if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
234 "rport=", &poff, &plen,
236 htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
237 htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
238 __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
239 buflen = sprintf(buffer, "%u", ntohs(p));
240 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
241 poff, plen, buffer, buflen))
247 /* Translate Contact headers */
250 while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
251 SIP_HDR_CONTACT, &in_header,
252 &matchoff, &matchlen,
254 if (!map_addr(skb, protoff, dataoff, dptr, datalen,
260 if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
261 !map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_TO))
264 /* Mangle destination port for Cisco phones, then fix up checksums */
265 if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
268 if (!skb_make_writable(skb, skb->len))
271 uh = (void *)skb->data + protoff;
272 uh->dest = ct_sip_info->forced_dport;
274 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
282 static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
285 enum ip_conntrack_info ctinfo;
286 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
287 const struct tcphdr *th;
289 if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
292 th = (struct tcphdr *)(skb->data + protoff);
293 nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
296 /* Handles expected signalling connections and media streams */
297 static void nf_nat_sip_expected(struct nf_conn *ct,
298 struct nf_conntrack_expect *exp)
300 struct nf_nat_range range;
302 /* This must be a fresh one. */
303 BUG_ON(ct->status & IPS_NAT_DONE_MASK);
305 /* For DST manip, map port here to where it's expected. */
306 range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
307 range.min_proto = range.max_proto = exp->saved_proto;
308 range.min_addr = range.max_addr = exp->saved_addr;
309 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
311 /* Change src to where master sends to, but only if the connection
312 * actually came from the same source. */
313 if (nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
314 &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
315 range.flags = NF_NAT_RANGE_MAP_IPS;
316 range.min_addr = range.max_addr
317 = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
318 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
322 static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
323 unsigned int dataoff,
324 const char **dptr, unsigned int *datalen,
325 struct nf_conntrack_expect *exp,
326 unsigned int matchoff,
327 unsigned int matchlen)
329 enum ip_conntrack_info ctinfo;
330 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
331 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
332 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
333 union nf_inet_addr newaddr;
336 char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
339 /* Connection will come from reply */
340 if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
341 &ct->tuplehash[!dir].tuple.dst.u3))
342 newaddr = exp->tuple.dst.u3;
344 newaddr = ct->tuplehash[!dir].tuple.dst.u3;
346 /* If the signalling port matches the connection's source port in the
347 * original direction, try to use the destination port in the opposite
349 srcport = ct_sip_info->forced_dport ? :
350 ct->tuplehash[dir].tuple.src.u.udp.port;
351 if (exp->tuple.dst.u.udp.port == srcport)
352 port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
354 port = ntohs(exp->tuple.dst.u.udp.port);
356 exp->saved_addr = exp->tuple.dst.u3;
357 exp->tuple.dst.u3 = newaddr;
358 exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
360 exp->expectfn = nf_nat_sip_expected;
362 for (; port != 0; port++) {
365 exp->tuple.dst.u.udp.port = htons(port);
366 ret = nf_ct_expect_related(exp);
369 else if (ret != -EBUSY) {
378 if (!nf_inet_addr_cmp(&exp->tuple.dst.u3, &exp->saved_addr) ||
379 exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
380 buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, port);
381 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
382 matchoff, matchlen, buffer, buflen))
388 nf_ct_unexpect_related(exp);
392 static int mangle_content_len(struct sk_buff *skb, unsigned int protoff,
393 unsigned int dataoff,
394 const char **dptr, unsigned int *datalen)
396 enum ip_conntrack_info ctinfo;
397 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
398 unsigned int matchoff, matchlen;
399 char buffer[sizeof("65536")];
402 /* Get actual SDP length */
403 if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
404 SDP_HDR_VERSION, SDP_HDR_UNSPEC,
405 &matchoff, &matchlen) <= 0)
407 c_len = *datalen - matchoff + strlen("v=");
409 /* Now, update SDP length */
410 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CONTENT_LENGTH,
411 &matchoff, &matchlen) <= 0)
414 buflen = sprintf(buffer, "%u", c_len);
415 return mangle_packet(skb, protoff, dataoff, dptr, datalen,
416 matchoff, matchlen, buffer, buflen);
419 static int mangle_sdp_packet(struct sk_buff *skb, unsigned int protoff,
420 unsigned int dataoff,
421 const char **dptr, unsigned int *datalen,
423 enum sdp_header_types type,
424 enum sdp_header_types term,
425 char *buffer, int buflen)
427 enum ip_conntrack_info ctinfo;
428 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
429 unsigned int matchlen, matchoff;
431 if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
432 &matchoff, &matchlen) <= 0)
434 return mangle_packet(skb, protoff, dataoff, dptr, datalen,
435 matchoff, matchlen, buffer, buflen) ? 0 : -EINVAL;
438 static unsigned int nf_nat_sdp_addr(struct sk_buff *skb, unsigned int protoff,
439 unsigned int dataoff,
440 const char **dptr, unsigned int *datalen,
442 enum sdp_header_types type,
443 enum sdp_header_types term,
444 const union nf_inet_addr *addr)
446 enum ip_conntrack_info ctinfo;
447 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
448 char buffer[INET6_ADDRSTRLEN];
451 buflen = sip_sprintf_addr(ct, buffer, addr, false);
452 if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen,
453 sdpoff, type, term, buffer, buflen))
456 return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
459 static unsigned int nf_nat_sdp_port(struct sk_buff *skb, unsigned int protoff,
460 unsigned int dataoff,
461 const char **dptr, unsigned int *datalen,
462 unsigned int matchoff,
463 unsigned int matchlen,
466 char buffer[sizeof("nnnnn")];
469 buflen = sprintf(buffer, "%u", port);
470 if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
471 matchoff, matchlen, buffer, buflen))
474 return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
477 static unsigned int nf_nat_sdp_session(struct sk_buff *skb, unsigned int protoff,
478 unsigned int dataoff,
479 const char **dptr, unsigned int *datalen,
481 const union nf_inet_addr *addr)
483 enum ip_conntrack_info ctinfo;
484 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
485 char buffer[INET6_ADDRSTRLEN];
488 /* Mangle session description owner and contact addresses */
489 buflen = sip_sprintf_addr(ct, buffer, addr, false);
490 if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
491 SDP_HDR_OWNER, SDP_HDR_MEDIA, buffer, buflen))
494 switch (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
495 SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
501 * Session description
503 * c=* (connection information - not required if included in all media)
511 return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
514 /* So, this packet has hit the connection tracking matching code.
515 Mangle it, and change the expectation to match the new version. */
516 static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
517 unsigned int dataoff,
518 const char **dptr, unsigned int *datalen,
519 struct nf_conntrack_expect *rtp_exp,
520 struct nf_conntrack_expect *rtcp_exp,
521 unsigned int mediaoff,
522 unsigned int medialen,
523 union nf_inet_addr *rtp_addr)
525 enum ip_conntrack_info ctinfo;
526 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
527 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
530 /* Connection will come from reply */
531 if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
532 &ct->tuplehash[!dir].tuple.dst.u3))
533 *rtp_addr = rtp_exp->tuple.dst.u3;
535 *rtp_addr = ct->tuplehash[!dir].tuple.dst.u3;
537 rtp_exp->saved_addr = rtp_exp->tuple.dst.u3;
538 rtp_exp->tuple.dst.u3 = *rtp_addr;
539 rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
541 rtp_exp->expectfn = nf_nat_sip_expected;
543 rtcp_exp->saved_addr = rtcp_exp->tuple.dst.u3;
544 rtcp_exp->tuple.dst.u3 = *rtp_addr;
545 rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
546 rtcp_exp->dir = !dir;
547 rtcp_exp->expectfn = nf_nat_sip_expected;
549 /* Try to get same pair of ports: if not, try to change them. */
550 for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
551 port != 0; port += 2) {
554 rtp_exp->tuple.dst.u.udp.port = htons(port);
555 ret = nf_ct_expect_related(rtp_exp);
562 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
563 ret = nf_ct_expect_related(rtcp_exp);
566 else if (ret == -EBUSY) {
567 nf_ct_unexpect_related(rtp_exp);
569 } else if (ret < 0) {
570 nf_ct_unexpect_related(rtp_exp);
579 /* Update media port. */
580 if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
581 !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
582 mediaoff, medialen, port))
588 nf_ct_unexpect_related(rtp_exp);
589 nf_ct_unexpect_related(rtcp_exp);
594 static struct nf_ct_helper_expectfn sip_nat = {
596 .expectfn = nf_nat_sip_expected,
599 static void __exit nf_nat_sip_fini(void)
601 RCU_INIT_POINTER(nf_nat_sip_hook, NULL);
602 RCU_INIT_POINTER(nf_nat_sip_seq_adjust_hook, NULL);
603 RCU_INIT_POINTER(nf_nat_sip_expect_hook, NULL);
604 RCU_INIT_POINTER(nf_nat_sdp_addr_hook, NULL);
605 RCU_INIT_POINTER(nf_nat_sdp_port_hook, NULL);
606 RCU_INIT_POINTER(nf_nat_sdp_session_hook, NULL);
607 RCU_INIT_POINTER(nf_nat_sdp_media_hook, NULL);
608 nf_ct_helper_expectfn_unregister(&sip_nat);
612 static int __init nf_nat_sip_init(void)
614 BUG_ON(nf_nat_sip_hook != NULL);
615 BUG_ON(nf_nat_sip_seq_adjust_hook != NULL);
616 BUG_ON(nf_nat_sip_expect_hook != NULL);
617 BUG_ON(nf_nat_sdp_addr_hook != NULL);
618 BUG_ON(nf_nat_sdp_port_hook != NULL);
619 BUG_ON(nf_nat_sdp_session_hook != NULL);
620 BUG_ON(nf_nat_sdp_media_hook != NULL);
621 RCU_INIT_POINTER(nf_nat_sip_hook, nf_nat_sip);
622 RCU_INIT_POINTER(nf_nat_sip_seq_adjust_hook, nf_nat_sip_seq_adjust);
623 RCU_INIT_POINTER(nf_nat_sip_expect_hook, nf_nat_sip_expect);
624 RCU_INIT_POINTER(nf_nat_sdp_addr_hook, nf_nat_sdp_addr);
625 RCU_INIT_POINTER(nf_nat_sdp_port_hook, nf_nat_sdp_port);
626 RCU_INIT_POINTER(nf_nat_sdp_session_hook, nf_nat_sdp_session);
627 RCU_INIT_POINTER(nf_nat_sdp_media_hook, nf_nat_sdp_media);
628 nf_ct_helper_expectfn_register(&sip_nat);
632 module_init(nf_nat_sip_init);
633 module_exit(nf_nat_sip_fini);