path: root/target/linux/generic-2.6/patches/107-netfilter_nat_sip.patch

diff -urN linux-2.6.16.4/net/ipv4/netfilter/ip_conntrack_sip.c linux-2.6.16.4.new/net/ipv4/netfilter/ip_conntrack_sip.c
--- linux-2.6.16.4/net/ipv4/netfilter/ip_conntrack_sip.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.16.4.new/net/ipv4/netfilter/ip_conntrack_sip.c	2006-04-12 17:31:44.000000000 +0200
@@ -0,0 +1,414 @@
+/* SIP extension for IP connection tracking.
+ *
+ * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
+ * based on RR's ip_conntrack_ftp.c and other modules.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/ip.h>
+#include <linux/ctype.h>
+#include <linux/in.h>
+#include <linux/udp.h>
+#include <net/checksum.h>
+#include <net/udp.h>
+
+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
+#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
+MODULE_DESCRIPTION("SIP connection tracking helper");
+
+static DEFINE_SPINLOCK(sipbf_lock);
+
+
+#define MAX_PORTS	8
+static int ports[MAX_PORTS];
+static int ports_c;
+module_param_array(ports, int, &ports_c, 0400);
+MODULE_PARM_DESC(ports, " port numbers of sip servers");
+
+static unsigned int sip_timeout = SIP_TIMEOUT;
+
+module_param(sip_timeout, int, 0600);
+MODULE_PARM_DESC(sip_timeout, "timeout for the master sip session");
+
+unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb, 
+				enum ip_conntrack_info ctinfo,
+				struct ip_conntrack *ct,
+				const char **dptr);
+EXPORT_SYMBOL_GPL(ip_nat_sip_hook);
+				
+unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb, 
+				enum ip_conntrack_info ctinfo,
+				struct ip_conntrack_expect *exp,
+				const char *dptr);
+EXPORT_SYMBOL_GPL(ip_nat_sdp_hook);
+
+int ct_sip_get_info(const char *dptr, size_t dlen, 
+				unsigned int *matchoff, 
+				unsigned int *matchlen, 
+				struct sip_header_nfo *hnfo);
+EXPORT_SYMBOL(ct_sip_get_info);
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+static int digits_len(const char *dptr, const char *limit, int *shift);
+static int epaddr_len(const char *dptr, const char *limit, int *shift);
+static int skp_digits_len(const char *dptr, const char *limit, int *shift);
+static int skp_epaddr_len(const char *dptr, const char *limit, int *shift);
+
+struct sip_header_nfo ct_sip_hdrs[] = {
+	{ 	/* Via header */
+		"Via:",		sizeof("Via:") - 1,
+		"\r\nv:",	sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
+		"UDP ", 	sizeof("UDP ") - 1,
+		epaddr_len
+	},
+	{ 	/* Contact header */
+		"Contact:",	sizeof("Contact:") - 1,
+		"\r\nm:",	sizeof("\r\nm:") - 1,
+		"sip:",		sizeof("sip:") - 1,
+		skp_epaddr_len
+	},
+	{ 	/* Content length header */
+		"Content-Length:", sizeof("Content-Length:") - 1,
+		"\r\nl:",	sizeof("\r\nl:") - 1,
+		":",		sizeof(":") - 1, 
+		skp_digits_len
+	},
+	{	/* SDP media info */
+		"\nm=",		sizeof("\nm=") - 1,	
+		"\rm=",		sizeof("\rm=") - 1,
+		"audio ",	sizeof("audio ") - 1,
+		digits_len
+	},
+	{ 	/* SDP owner address*/	
+		"\no=",		sizeof("\no=") - 1, 
+		"\ro=",		sizeof("\ro=") - 1,
+		"IN IP4 ",	sizeof("IN IP4 ") - 1,
+		epaddr_len
+	},
+	{ 	/* SDP connection info */
+		"\nc=",		sizeof("\nc=") - 1, 
+		"\rc=",		sizeof("\rc=") - 1,
+		"IN IP4 ",	sizeof("IN IP4 ") - 1,
+		epaddr_len
+	},
+	{ 	/* Requests headers */
+		"sip:",		sizeof("sip:") - 1,
+		"sip:",		sizeof("sip:") - 1, /* yes, i know.. ;) */
+		"@", 		sizeof("@") - 1, 
+		epaddr_len
+	},
+	{ 	/* SDP version header */
+		"\nv=",		sizeof("\nv=") - 1,
+		"\rv=",		sizeof("\rv=") - 1,
+		"=", 		sizeof("=") - 1, 
+		digits_len
+	}
+};
+EXPORT_SYMBOL(ct_sip_hdrs);
+
+
+static int digits_len(const char *dptr, const char *limit, int *shift)
+{
+	int len = 0;	
+	while (dptr <= limit && isdigit(*dptr)) {
+		dptr++;
+		len++;
+	}
+	return len;
+} 
+
+/* get digits lenght, skiping blank spaces. */
+static int skp_digits_len(const char *dptr, const char *limit, int *shift)
+{
+	for (; dptr <= limit && *dptr == ' '; dptr++)
+		(*shift)++;
+		
+	return digits_len(dptr, limit, shift);
+}
+
+/* Simple ipaddr parser.. */
+static int parse_ipaddr(const char *cp,	const char **endp, 
+			uint32_t *ipaddr, const char *limit)
+{
+	unsigned long int val;
+	int i, digit = 0;
+	
+	for (i = 0, *ipaddr = 0; cp <= limit && i < 4; i++) {
+		digit = 0;
+		if (!isdigit(*cp))
+			break;
+		
+		val = simple_strtoul(cp, (char **)&cp, 10);
+		if (val > 0xFF)
+			return -1;
+	
+		((uint8_t *)ipaddr)[i] = val;	
+		digit = 1;
+	
+		if (*cp != '.')
+			break;
+		cp++;
+	}
+	if (!digit)
+		return -1;
+	
+	if (endp)
+		*endp = cp;
+
+	return 0;
+}
+
+/* skip ip address. returns it lenght. */
+static int epaddr_len(const char *dptr, const char *limit, int *shift)
+{
+	const char *aux = dptr;
+	uint32_t ip;
+	
+	if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {
+		DEBUGP("ip: %s parse failed.!\n", dptr);
+		return 0;
+	}
+
+	/* Port number */
+	if (*dptr == ':') {
+		dptr++;
+		dptr += digits_len(dptr, limit, shift);
+	}
+	return dptr - aux;
+}
+
+/* get address lenght, skiping user info. */
+static int skp_epaddr_len(const char *dptr, const char *limit, int *shift)
+{
+	for (; dptr <= limit && *dptr != '@'; dptr++)
+		(*shift)++;	
+	
+	if (*dptr == '@') {
+		dptr++;
+		(*shift)++;
+		return epaddr_len(dptr, limit, shift);
+	}	
+	return  0;
+}
+
+/* Returns 0 if not found, -1 error parsing. */
+int ct_sip_get_info(const char *dptr, size_t dlen, 
+		unsigned int *matchoff, 
+		unsigned int *matchlen,
+		struct sip_header_nfo *hnfo)
+{
+	const char *limit, *aux, *k = dptr;
+	int shift = 0;
+	
+	limit = dptr + (dlen - hnfo->lnlen);
+
+	while (dptr <= limit) {
+		if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
+			(strncmp(dptr, hnfo->sname, hnfo->snlen) != 0))
+		{
+			dptr++;
+			continue;
+		}
+		aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen, 
+						ct_sip_lnlen(dptr, limit));
+		if (!aux) {
+			DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str, hnfo->lname);
+			return -1;
+		}
+		aux += hnfo->ln_strlen;
+		
+		*matchlen = hnfo->match_len(aux, limit, &shift);
+		if (!*matchlen)
+			return -1;
+
+		*matchoff = (aux - k) + shift; 
+		
+		DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname, *matchlen);
+		return 1;
+	}
+	DEBUGP("%s header not found.\n", hnfo->lname);
+	return 0;
+}
+
+static int set_expected_rtp(struct sk_buff **pskb, 
+			struct ip_conntrack *ct,
+			enum ip_conntrack_info ctinfo, 
+			uint32_t ipaddr, uint16_t port,
+			const char *dptr)
+{
+	struct ip_conntrack_expect *exp;
+	int ret;
+	
+	exp = ip_conntrack_expect_alloc(ct);
+	if (exp == NULL)
+		return NF_DROP;
+
+	exp->tuple = ((struct ip_conntrack_tuple)
+		{ { ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip, { 0 } },
+		  { ipaddr, { .udp = { htons(port) } }, IPPROTO_UDP }});
+		  
+	exp->mask = ((struct ip_conntrack_tuple) 
+		{ { 0xFFFFFFFF, { 0 } },
+		  { 0xFFFFFFFF, { .udp = { 0xFFFF } }, 0xFF }});
+	
+	exp->expectfn = NULL;
+	
+	if (ip_nat_sdp_hook)
+		ret = ip_nat_sdp_hook(pskb, ctinfo, exp, dptr);
+	else {
+		if (ip_conntrack_expect_related(exp) != 0)
+			ret = NF_DROP;
+		else
+			ret = NF_ACCEPT;
+	}
+	ip_conntrack_expect_put(exp);
+
+	return ret;
+}
+
+static int sip_help(struct sk_buff **pskb,
+		struct ip_conntrack *ct,
+		enum ip_conntrack_info ctinfo)
+{
+	unsigned int dataoff, datalen;
+	const char *dptr;
+	int ret = NF_ACCEPT;
+	int matchoff, matchlen;
+	uint32_t ipaddr;
+	uint16_t port;
+	
+	/* No Data ? */ 
+	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
+	if (dataoff >= (*pskb)->len) {
+		DEBUGP("skb->len = %u\n", (*pskb)->len);
+		return NF_ACCEPT;
+        }
+        
+	ip_ct_refresh(ct, *pskb, sip_timeout * HZ);
+		
+	spin_lock_bh(&sipbf_lock);
+	
+	if ((dataoff + (*pskb)->len - dataoff) <= skb_headlen(*pskb))
+		dptr = (*pskb)->data + dataoff;
+	else {
+		DEBUGP("Copy of skbuff not supported yet.\n");
+		goto out;
+	}
+	
+	if (ip_nat_sip_hook) {
+		if (!ip_nat_sip_hook(pskb, ctinfo, ct, &dptr)) {
+			ret = NF_DROP;
+			goto out;
+		}
+	}
+	
+	if ((ctinfo) >= IP_CT_IS_REPLY)
+		goto out;
+
+	/* After this point NAT, could have mangled skb, so 
+	   we need to recalculate payload lenght. */
+	datalen = (*pskb)->len - dataoff;
+
+	if (datalen < (sizeof("SIP/2.0 200") - 1))
+		goto out;
+	
+	/* RTP info only in some SDP pkts */
+	if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 && 
+	    memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
+		goto out;
+	}
+	/* Get ip and port address from SDP packet. */
+	if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen, 
+	    &ct_sip_hdrs[POS_CONECTION]) > 0) {
+
+		/* We'll drop only if there are parse problems. */
+		if (parse_ipaddr(dptr + matchoff, NULL, &ipaddr, 
+		    dptr + datalen) < 0) {
+			ret = NF_DROP;
+			goto out;
+		}
+		if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen, 
+		    &ct_sip_hdrs[POS_MEDIA]) > 0) {
+
+			port = simple_strtoul(dptr + matchoff, NULL, 10);
+			if (port < 1024) {
+				ret = NF_DROP;
+				goto out;
+			}
+			ret = set_expected_rtp(pskb, ct, ctinfo,
+						ipaddr, port, dptr);
+		}
+	}
+out:	spin_unlock_bh(&sipbf_lock);
+	return ret;
+}
+
+static struct ip_conntrack_helper sip[MAX_PORTS];
+static char sip_names[MAX_PORTS][10];
+
+static void fini(void)
+{
+	int i = 0;
+	for (; i < ports_c; i++) {
+		DEBUGP("unregistering helper for port %d\n", ports[i]);
+		ip_conntrack_helper_unregister(&sip[i]);
+	} 
+}
+
+static int __init init(void)
+{
+	int i, ret;
+	char *tmpname;
+
+	if (ports_c == 0)
+		ports[ports_c++] = SIP_PORT;
+
+	for (i = 0; i < ports_c; i++) {
+		/* Create helper structure */
+		memset(&sip[i], 0, sizeof(struct ip_conntrack_helper));
+
+		sip[i].tuple.dst.protonum = IPPROTO_UDP;
+		sip[i].tuple.src.u.udp.port = htons(ports[i]);
+		sip[i].mask.src.u.udp.port = 0xFFFF;
+		sip[i].mask.dst.protonum = 0xFF;
+		sip[i].max_expected = 1;
+		sip[i].timeout = 3 * 60; /* 3 minutes */
+		sip[i].me = THIS_MODULE;
+		sip[i].help = sip_help;
+
+		tmpname = &sip_names[i][0];
+		if (ports[i] == SIP_PORT)
+			sprintf(tmpname, "sip");
+		else
+			sprintf(tmpname, "sip-%d", i);
+		sip[i].name = tmpname;
+
+		DEBUGP("port #%d: %d\n", i, ports[i]);
+
+		ret=ip_conntrack_helper_register(&sip[i]);
+		if (ret) {
+			printk("ERROR registering helper for port %d\n",
+				ports[i]);
+			fini();
+			return(ret);
+		}
+	}
+	return(0);
+}
+
+module_init(init);
+module_exit(fini);
diff -urN linux-2.6.16.4/net/ipv4/netfilter/ip_nat_sip.c linux-2.6.16.4.new/net/ipv4/netfilter/ip_nat_sip.c
--- linux-2.6.16.4/net/ipv4/netfilter/ip_nat_sip.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.16.4.new/net/ipv4/netfilter/ip_nat_sip.c	2006-04-12 17:31:53.000000000 +0200
@@ -0,0 +1,249 @@
+/* SIP extension for UDP NAT alteration.
+ *
+ * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
+ * based on RR's ip_nat_ftp.c and other modules.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <net/udp.h>
+
+#include <linux/netfilter_ipv4/ip_nat.h>
+#include <linux/netfilter_ipv4/ip_nat_helper.h>
+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
+#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
+MODULE_DESCRIPTION("SIP NAT helper");
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+extern struct sip_header_nfo ct_sip_hdrs[];
+
+static unsigned int mangle_sip_packet(struct sk_buff **pskb, 
+			enum ip_conntrack_info ctinfo,
+			struct ip_conntrack *ct, 
+			const char **dptr, size_t dlen,
+			char *buffer, int bufflen,
+			struct sip_header_nfo *hnfo)
+{
+	unsigned int matchlen, matchoff;
+	
+	if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)
+		return 0;
+
+	if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo, 
+	    matchoff, matchlen, buffer, bufflen)) {
+		return 0;
+	}
+	/* We need to reload this. Thanks Patrick. */
+	*dptr = (*pskb)->data + (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr); 
+	return 1;
+}
+
+static unsigned int ip_nat_sip(struct sk_buff **pskb, 
+			enum ip_conntrack_info ctinfo,
+			struct ip_conntrack *ct,
+			const char **dptr)
+{
+	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];	
+	unsigned int bufflen, dataoff;
+	uint32_t ip;
+	uint16_t port;
+	
+	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
+	
+	if ((ctinfo) >= IP_CT_IS_REPLY) {
+		ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
+		port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
+	} else {
+		ip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
+		port = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.udp.port;
+	}
+	bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));
+	
+	/* short packet ? */
+	if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))
+		return 0;
+	
+	/* Basic rules: requests and responses. */
+	if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {
+	
+		if ((ctinfo) < IP_CT_IS_REPLY) {
+			mangle_sip_packet(pskb, ctinfo, ct, dptr, 
+				(*pskb)->len - dataoff, buffer, bufflen,
+				&ct_sip_hdrs[POS_CONTACT]);
+			return 1;
+		}
+
+		if (!mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
+		    buffer, bufflen, &ct_sip_hdrs[POS_VIA])) {
+			return 0;
+		}
+		
+		/* This search should ignore case, but later.. */
+		const char *aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1, 
+								(*pskb)->len - dataoff);
+		if (!aux)
+			return 0;
+		
+		if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"), 
+		    ct_sip_lnlen(aux, *dptr + (*pskb)->len - dataoff))) {
+			return 1;
+		}
+		return mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff, 
+						buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
+	}
+	if ((ctinfo) < IP_CT_IS_REPLY) {
+		if (!mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
+		    buffer, bufflen, &ct_sip_hdrs[POS_VIA])) {
+			return 0;
+		}
+		
+		/* Mangle Contact if exists only. - watch udp_nat_mangle()! */
+		mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff, 
+						buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
+		return 1;
+	}
+	/* This mangle requests headers. */
+	return mangle_sip_packet(pskb, ctinfo, ct, dptr, 
+			ct_sip_lnlen(*dptr, *dptr + (*pskb)->len - dataoff),
+			buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);
+}
+
+static int mangle_content_len(struct sk_buff **pskb, 
+			enum ip_conntrack_info ctinfo,
+			struct ip_conntrack *ct,
+			const char *dptr)
+{
+	unsigned int dataoff, matchoff, matchlen;
+	char buffer[sizeof("65536")];
+	int bufflen;
+	
+	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
+	
+	/* Get actual SDP lenght */
+	if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff, 
+	    &matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {
+		
+		/* since ct_sip_get_info() give us a pointer passing 'v='
+		   we need to add 2 bytes in this count. */
+		int c_len = (*pskb)->len - dataoff - matchoff + 2;
+		
+		/* Now, update SDP lenght */
+		if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff, 
+		    &matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {
+		    
+			bufflen = sprintf(buffer, "%u", c_len);
+			
+			return ip_nat_mangle_udp_packet(pskb, ct, ctinfo, matchoff,
+							matchlen, buffer, bufflen);
+		}
+	}
+	return 0;
+}
+
+static unsigned int mangle_sdp(struct sk_buff **pskb, 
+			enum ip_conntrack_info ctinfo,
+			struct ip_conntrack *ct,
+			uint32_t newip, uint16_t port,
+			const char *dptr)
+{
+	char buffer[sizeof("nnn.nnn.nnn.nnn")];
+	unsigned int dataoff, bufflen;
+
+	dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
+	
+	/* Mangle owner and contact info. */
+	bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
+	if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
+	    buffer, bufflen, &ct_sip_hdrs[POS_OWNER])) {
+		return 0;	
+	}
+	
+	if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
+	    buffer, bufflen, &ct_sip_hdrs[POS_CONECTION])) {
+		return 0;
+	}
+	
+	/* Mangle media port. */
+	bufflen = sprintf(buffer, "%u", port);
+	if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
+	    buffer, bufflen, &ct_sip_hdrs[POS_MEDIA])) {
+		return 0;
+	}
+	
+	return mangle_content_len(pskb, ctinfo, ct, dptr);
+}
+
+/* So, this packet has hit the connection tracking matching code.
+   Mangle it, and change the expectation to match the new version. */
+static unsigned int ip_nat_sdp(struct sk_buff **pskb, 
+			enum ip_conntrack_info ctinfo,
+			struct ip_conntrack_expect *exp,
+			const char *dptr)
+{
+	struct ip_conntrack *ct = exp->master;
+	uint32_t newip;
+	uint16_t port;
+	
+	DEBUGP("ip_nat_sdp():\n");
+
+	/* Connection will come from reply */
+	newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
+	
+	exp->tuple.dst.ip = newip;
+	exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
+	exp->dir = IP_CT_DIR_REPLY;
+
+	/* When you see the packet, we need to NAT it the same as the
+	   this one. */
+	exp->expectfn = ip_nat_follow_master;
+
+	/* Try to get same port: if not, try to change it. */
+	for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
+		exp->tuple.dst.u.udp.port = htons(port);
+		if (ip_conntrack_expect_related(exp) == 0)
+			break;
+	}
+	
+	if (port == 0)
+		return NF_DROP;
+	
+	if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
+		ip_conntrack_unexpect_related(exp);
+		return NF_DROP;
+	}
+	return NF_ACCEPT;
+}
+
+static void __exit fini(void)
+{
+	ip_nat_sip_hook = NULL;
+	ip_nat_sdp_hook = NULL;
+	/* Make sure noone calls it, meanwhile. */
+	synchronize_net();
+}
+
+static int __init init(void)
+{
+	BUG_ON(ip_nat_sip_hook);
+	BUG_ON(ip_nat_sdp_hook);
+	ip_nat_sip_hook = ip_nat_sip;
+	ip_nat_sdp_hook = ip_nat_sdp;
+	return 0;
+}
+
+module_init(init);
+module_exit(fini);
diff -urN linux-2.6.16.4/net/ipv4/netfilter/Kconfig linux-2.6.16.4.new/net/ipv4/netfilter/Kconfig
--- linux-2.6.16.4/net/ipv4/netfilter/Kconfig	2006-04-12 17:29:19.000000000 +0200
+++ linux-2.6.16.4.new/net/ipv4/netfilter/Kconfig	2006-04-12 17:32:53.000000000 +0200
@@ -168,6 +168,19 @@
 	  If you want to compile it as a module, say M here and read
 	  Documentation/modules.txt.  If unsure, say `N'.
 
+config IP_NF_SIP
+	tristate  'SIP support'
+	depends on IP_NF_CONNTRACK
+	help
+	  SIP is an application-layer control protocol that can establish,
+   	  modify, and terminate multimedia sessions (conferences) such as
+   	  Internet telephony calls. With the ip_conntrack_sip and
+	  the ip_nat_sip modules you can support the protocol on a connection
+	  tracking/NATing firewall.
+	
+	  If you want to compile it as a module, say 'M' here and read
+	  Documentation/modules.txt.  If unsure, say 'N'.
+
 config IP_NF_QUEUE
 	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
 	help
@@ -545,6 +558,12 @@
 	default IP_NF_NAT if IP_NF_PPTP=y
 	default m if IP_NF_PPTP=m
 
+config IP_NF_NAT_SIP
+	tristate
+	depends on IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
+	default IP_NF_NAT if IP_NF_SIP=y
+	default m if IP_NF_SIP=m
+
 # mangle + specific targets
 config IP_NF_MANGLE
 	tristate "Packet mangling"
diff -urN linux-2.6.16.4/net/ipv4/netfilter/Makefile linux-2.6.16.4.new/net/ipv4/netfilter/Makefile
--- linux-2.6.16.4/net/ipv4/netfilter/Makefile	2006-04-12 17:29:19.000000000 +0200
+++ linux-2.6.16.4.new/net/ipv4/netfilter/Makefile	2006-04-12 17:33:39.000000000 +0200
@@ -28,6 +28,7 @@
 obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o
 obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o
 obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o
+obj-$(CONFIG_IP_NF_SIP) += ip_conntrack_sip.o
 
 # NAT helpers 
 obj-$(CONFIG_IP_NF_NAT_PPTP) += ip_nat_pptp.o
@@ -35,6 +36,7 @@
 obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o
 obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
 obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
+obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o
 
 # generic IP tables 
 obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
diff -urN linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack.h
--- linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack.h	2006-04-12 17:29:19.000000000 +0200
+++ linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack.h	2006-04-12 17:30:38.000000000 +0200
@@ -33,6 +33,7 @@
 #include <linux/netfilter_ipv4/ip_conntrack_amanda.h>
 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
+#include <linux/netfilter_ipv4/ip_conntrack_sip.h>
 
 /* per conntrack: application helper private data */
 union ip_conntrack_help {
@@ -40,6 +41,7 @@
 	struct ip_ct_pptp_master ct_pptp_info;
 	struct ip_ct_ftp_master ct_ftp_info;
 	struct ip_ct_irc_master ct_irc_info;
+	struct ip_ct_sip_master ct_sip_info;
 };
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED
diff -urN linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack_sip.h linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack_sip.h
--- linux-2.6.16.4/include/linux/netfilter_ipv4/ip_conntrack_sip.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.16.4.new/include/linux/netfilter_ipv4/ip_conntrack_sip.h	2006-04-12 17:31:12.000000000 +0200
@@ -0,0 +1,81 @@
+#ifndef __IP_CONNTRACK_SIP_H__
+#define __IP_CONNTRACK_SIP_H__
+/* SIP tracking. */
+
+#ifdef __KERNEL__
+
+#define SIP_PORT	5060
+#define SIP_TIMEOUT	3600
+
+#define POS_VIA		0
+#define POS_CONTACT	1
+#define POS_CONTENT	2
+#define POS_MEDIA	3
+#define POS_OWNER	4
+#define POS_CONECTION	5
+#define POS_REQ_HEADER	6
+#define POS_SDP_HEADER	7
+
+struct ip_ct_sip_master {
+};
+
+struct sip_header_nfo {
+	const char *lname;
+	size_t lnlen;
+	const char *sname;
+	size_t snlen;
+	const char *ln_str;
+	size_t ln_strlen;
+	int (*match_len)(const char *, const char *, int *);
+
+};
+
+extern unsigned int (*ip_nat_sip_hook)(struct sk_buff **pskb, 
+				enum ip_conntrack_info ctinfo,
+				struct ip_conntrack *ct,
+				const char **dptr);
+				
+/* For NAT to hook in when on expect. */
+extern unsigned int (*ip_nat_sdp_hook)(struct sk_buff **pskb, 
+				enum ip_conntrack_info ctinfo,
+				struct ip_conntrack_expect *exp,
+				const char *dptr);
+
+extern int ct_sip_get_info(const char *dptr, size_t dlen, 
+				unsigned int *matchoff, 
+				unsigned int *matchlen, 
+				struct sip_header_nfo *hnfo);
+
+/* get line lenght until first CR or LF seen. */
+static __inline__ int ct_sip_lnlen(const char *line, const char *limit)
+{
+        const char *k = line;
+
+        while ((line <= limit) && (*line == '\r' || *line == '\n'))
+                line++;
+
+        while (line <= limit) {
+                if (*line == '\r' || *line == '\n')
+                        break;
+                line++;
+        }
+        return line - k;
+}
+
+/* Linear string search, case sensitive. */
+static __inline__ 
+const char *ct_sip_search(const char *needle, const char *haystack, 
+			size_t needle_len, size_t haystack_len) 
+{
+	const char *limit = haystack + (haystack_len - needle_len);
+
+	while (haystack <= limit) {
+		if (memcmp(haystack, needle, needle_len) == 0)
+			return haystack;
+		haystack++;
+	}
+	return NULL;
+}
+#endif /* __KERNEL__ */
+
+#endif /* __IP_CONNTRACK_SIP_H__ */