[NETFILTER]: Add SIP connection tracking helper
[linux-2.6.git] / net / ipv4 / netfilter / ip_nat_sip.c
1 /* SIP extension for UDP NAT alteration.
2  *
3  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4  * based on RR's ip_nat_ftp.c and other modules.
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/ip.h>
14 #include <linux/udp.h>
15
16 #include <linux/netfilter_ipv4.h>
17 #include <linux/netfilter_ipv4/ip_nat.h>
18 #include <linux/netfilter_ipv4/ip_nat_helper.h>
19 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
20 #include <linux/netfilter_ipv4/ip_conntrack_sip.h>
21
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
24 MODULE_DESCRIPTION("SIP NAT helper");
25
26 #if 0
27 #define DEBUGP printk
28 #else
29 #define DEBUGP(format, args...)
30 #endif
31
32 extern struct sip_header_nfo ct_sip_hdrs[];
33
34 static unsigned int mangle_sip_packet(struct sk_buff **pskb,
35                                       enum ip_conntrack_info ctinfo,
36                                       struct ip_conntrack *ct,
37                                       const char **dptr, size_t dlen,
38                                       char *buffer, int bufflen,
39                                       struct sip_header_nfo *hnfo)
40 {
41         unsigned int matchlen, matchoff;
42
43         if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)
44                 return 0;
45
46         if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
47                                       matchoff, matchlen, buffer, bufflen))
48                 return 0;
49
50         /* We need to reload this. Thanks Patrick. */
51         *dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
52         return 1;
53 }
54
55 static unsigned int ip_nat_sip(struct sk_buff **pskb,
56                                enum ip_conntrack_info ctinfo,
57                                struct ip_conntrack *ct,
58                                const char **dptr)
59 {
60         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
61         char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
62         unsigned int bufflen, dataoff;
63         u_int32_t ip;
64         u_int16_t port;
65
66         dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
67
68         ip   = ct->tuplehash[!dir].tuple.dst.ip;
69         port = ct->tuplehash[!dir].tuple.dst.u.udp.port;
70         bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));
71
72         /* short packet ? */
73         if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))
74                 return 0;
75
76         /* Basic rules: requests and responses. */
77         if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {
78                 const char *aux;
79
80                 if ((ctinfo) < IP_CT_IS_REPLY) {
81                         mangle_sip_packet(pskb, ctinfo, ct, dptr,
82                                           (*pskb)->len - dataoff,
83                                           buffer, bufflen,
84                                           &ct_sip_hdrs[POS_CONTACT]);
85                         return 1;
86                 }
87
88                 if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,
89                                        (*pskb)->len - dataoff,
90                                        buffer, bufflen, &ct_sip_hdrs[POS_VIA]))
91                         return 0;
92
93                 /* This search should ignore case, but later.. */
94                 aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1,
95                                     (*pskb)->len - dataoff);
96                 if (!aux)
97                         return 0;
98
99                 if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"),
100                     ct_sip_lnlen(aux, *dptr + (*pskb)->len - dataoff)))
101                         return 1;
102
103                 return mangle_sip_packet(pskb, ctinfo, ct, dptr,
104                                          (*pskb)->len - dataoff,
105                                          buffer, bufflen,
106                                          &ct_sip_hdrs[POS_CONTACT]);
107         }
108         if ((ctinfo) < IP_CT_IS_REPLY) {
109                 if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,
110                                        (*pskb)->len - dataoff,
111                                        buffer, bufflen, &ct_sip_hdrs[POS_VIA]))
112                         return 0;
113
114                 /* Mangle Contact if exists only. - watch udp_nat_mangle()! */
115                 mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
116                                   buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
117                 return 1;
118         }
119         /* This mangle requests headers. */
120         return mangle_sip_packet(pskb, ctinfo, ct, dptr,
121                                  ct_sip_lnlen(*dptr,
122                                               *dptr + (*pskb)->len - dataoff),
123                                  buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);
124 }
125
126 static int mangle_content_len(struct sk_buff **pskb,
127                               enum ip_conntrack_info ctinfo,
128                               struct ip_conntrack *ct,
129                               const char *dptr)
130 {
131         unsigned int dataoff, matchoff, matchlen;
132         char buffer[sizeof("65536")];
133         int bufflen;
134
135         dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
136
137         /* Get actual SDP lenght */
138         if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
139                             &matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {
140
141                 /* since ct_sip_get_info() give us a pointer passing 'v='
142                    we need to add 2 bytes in this count. */
143                 int c_len = (*pskb)->len - dataoff - matchoff + 2;
144
145                 /* Now, update SDP lenght */
146                 if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
147                                     &matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {
148
149                         bufflen = sprintf(buffer, "%u", c_len);
150
151                         return ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
152                                                         matchoff, matchlen,
153                                                         buffer, bufflen);
154                 }
155         }
156         return 0;
157 }
158
159 static unsigned int mangle_sdp(struct sk_buff **pskb,
160                                enum ip_conntrack_info ctinfo,
161                                struct ip_conntrack *ct,
162                                u_int32_t newip, u_int16_t port,
163                                const char *dptr)
164 {
165         char buffer[sizeof("nnn.nnn.nnn.nnn")];
166         unsigned int dataoff, bufflen;
167
168         dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
169
170         /* Mangle owner and contact info. */
171         bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
172         if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
173                                buffer, bufflen, &ct_sip_hdrs[POS_OWNER]))
174                 return 0;
175
176         if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
177                                buffer, bufflen, &ct_sip_hdrs[POS_CONNECTION]))
178                 return 0;
179
180         /* Mangle media port. */
181         bufflen = sprintf(buffer, "%u", port);
182         if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
183                                buffer, bufflen, &ct_sip_hdrs[POS_MEDIA]))
184                 return 0;
185
186         return mangle_content_len(pskb, ctinfo, ct, dptr);
187 }
188
189 /* So, this packet has hit the connection tracking matching code.
190    Mangle it, and change the expectation to match the new version. */
191 static unsigned int ip_nat_sdp(struct sk_buff **pskb,
192                                enum ip_conntrack_info ctinfo,
193                                struct ip_conntrack_expect *exp,
194                                const char *dptr)
195 {
196         struct ip_conntrack *ct = exp->master;
197         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
198         u_int32_t newip;
199         u_int16_t port;
200
201         DEBUGP("ip_nat_sdp():\n");
202
203         /* Connection will come from reply */
204         newip = ct->tuplehash[!dir].tuple.dst.ip;
205
206         exp->tuple.dst.ip = newip;
207         exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
208         exp->dir = !dir;
209
210         /* When you see the packet, we need to NAT it the same as the
211            this one. */
212         exp->expectfn = ip_nat_follow_master;
213
214         /* Try to get same port: if not, try to change it. */
215         for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
216                 exp->tuple.dst.u.udp.port = htons(port);
217                 if (ip_conntrack_expect_related(exp) == 0)
218                         break;
219         }
220
221         if (port == 0)
222                 return NF_DROP;
223
224         if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
225                 ip_conntrack_unexpect_related(exp);
226                 return NF_DROP;
227         }
228         return NF_ACCEPT;
229 }
230
231 static void __exit fini(void)
232 {
233         ip_nat_sip_hook = NULL;
234         ip_nat_sdp_hook = NULL;
235         /* Make sure noone calls it, meanwhile. */
236         synchronize_net();
237 }
238
239 static int __init init(void)
240 {
241         BUG_ON(ip_nat_sip_hook);
242         BUG_ON(ip_nat_sdp_hook);
243         ip_nat_sip_hook = ip_nat_sip;
244         ip_nat_sdp_hook = ip_nat_sdp;
245         return 0;
246 }
247
248 module_init(init);
249 module_exit(fini);