| 1 | --- a/net/ipv4/netfilter/Config.in |
| 2 | +++ b/net/ipv4/netfilter/Config.in |
| 3 | @@ -14,6 +14,7 @@ if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; |
| 4 | dep_tristate ' Connection tracking flow accounting' CONFIG_IP_NF_CT_ACCT $CONFIG_IP_NF_CONNTRACK |
| 5 | dep_tristate ' Connection byte counter support' CONFIG_IP_NF_MATCH_CONNBYTES $CONFIG_IP_NF_CT_ACCT $CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES |
| 6 | dep_tristate ' H.323 (netmeeting) support' CONFIG_IP_NF_H323 $CONFIG_IP_NF_CONNTRACK |
| 7 | + dep_tristate ' RTSP protocol support' CONFIG_IP_NF_RTSP $CONFIG_IP_NF_CONNTRACK |
| 8 | fi |
| 9 | |
| 10 | if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then |
| 11 | @@ -88,6 +89,13 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ]; |
| 12 | define_tristate CONFIG_IP_NF_NAT_H323 $CONFIG_IP_NF_NAT |
| 13 | fi |
| 14 | fi |
| 15 | + if [ "$CONFIG_IP_NF_RTSP" = "m" ]; then |
| 16 | + define_tristate CONFIG_IP_NF_NAT_RTSP m |
| 17 | + else |
| 18 | + if [ "$CONFIG_IP_NF_RTSP" = "y" ]; then |
| 19 | + define_tristate CONFIG_IP_NF_NAT_RTSP $CONFIG_IP_NF_NAT |
| 20 | + fi |
| 21 | + fi |
| 22 | if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then |
| 23 | dep_tristate ' Basic SNMP-ALG support (EXPERIMENTAL)' CONFIG_IP_NF_NAT_SNMP_BASIC $CONFIG_IP_NF_NAT |
| 24 | fi |
| 25 | --- a/net/ipv4/netfilter/Makefile |
| 26 | +++ b/net/ipv4/netfilter/Makefile |
| 27 | @@ -51,6 +51,11 @@ obj-$(CONFIG_IP_NF_H323) += ip_conntrack |
| 28 | ifdef CONFIG_IP_NF_NAT_H323 |
| 29 | export-objs += ip_conntrack_h323.o |
| 30 | endif |
| 31 | +obj-$(CONFIG_IP_NF_RTSP) += ip_conntrack_rtsp.o |
| 32 | +ifdef CONFIG_IP_NF_NAT_RTSP |
| 33 | + export-objs += ip_conntrack_rtsp.o |
| 34 | +endif |
| 35 | + |
| 36 | |
| 37 | # NAT helpers |
| 38 | obj-$(CONFIG_IP_NF_NAT_AMANDA) += ip_nat_amanda.o |
| 39 | @@ -58,6 +63,7 @@ obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_t |
| 40 | obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o |
| 41 | obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o |
| 42 | obj-$(CONFIG_IP_NF_NAT_H323) += ip_nat_h323.o |
| 43 | +obj-$(CONFIG_IP_NF_NAT_RTSP) += ip_nat_rtsp.o |
| 44 | |
| 45 | # generic IP tables |
| 46 | obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o |
| 47 | --- /dev/null |
| 48 | +++ b/net/ipv4/netfilter/ip_conntrack_rtsp.c |
| 49 | @@ -0,0 +1,507 @@ |
| 50 | +/* |
| 51 | + * RTSP extension for IP connection tracking |
| 52 | + * (C) 2003 by Tom Marshall <tmarshall@real.com> |
| 53 | + * based on ip_conntrack_irc.c |
| 54 | + * |
| 55 | + * This program is free software; you can redistribute it and/or |
| 56 | + * modify it under the terms of the GNU General Public License |
| 57 | + * as published by the Free Software Foundation; either version |
| 58 | + * 2 of the License, or (at your option) any later version. |
| 59 | + * |
| 60 | + * Module load syntax: |
| 61 | + * insmod ip_conntrack_rtsp.o ports=port1,port2,...port<MAX_PORTS> |
| 62 | + * max_outstanding=n setup_timeout=secs |
| 63 | + * |
| 64 | + * If no ports are specified, the default will be port 554. |
| 65 | + * |
| 66 | + * With max_outstanding you can define the maximum number of not yet |
| 67 | + * answered SETUP requests per RTSP session (default 8). |
| 68 | + * With setup_timeout you can specify how long the system waits for |
| 69 | + * an expected data channel (default 300 seconds). |
| 70 | + */ |
| 71 | + |
| 72 | +#include <linux/config.h> |
| 73 | +#include <linux/module.h> |
| 74 | +#include <linux/netfilter.h> |
| 75 | +#include <linux/ip.h> |
| 76 | +#include <net/checksum.h> |
| 77 | +#include <net/tcp.h> |
| 78 | + |
| 79 | +#include <linux/netfilter_ipv4/lockhelp.h> |
| 80 | +#include <linux/netfilter_ipv4/ip_conntrack_helper.h> |
| 81 | +#include <linux/netfilter_ipv4/ip_conntrack_rtsp.h> |
| 82 | + |
| 83 | +#include <linux/ctype.h> |
| 84 | +#define NF_NEED_STRNCASECMP |
| 85 | +#define NF_NEED_STRTOU16 |
| 86 | +#define NF_NEED_STRTOU32 |
| 87 | +#define NF_NEED_NEXTLINE |
| 88 | +#include <linux/netfilter_helpers.h> |
| 89 | +#define NF_NEED_MIME_NEXTLINE |
| 90 | +#include <linux/netfilter_mime.h> |
| 91 | + |
| 92 | +#define MAX_SIMUL_SETUP 8 /* XXX: use max_outstanding */ |
| 93 | + |
| 94 | +#define INFOP(fmt, args...) printk(KERN_INFO "%s: %s: " fmt, __FILE__, __FUNCTION__ , ## args) |
| 95 | +#ifdef IP_NF_RTSP_DEBUG |
| 96 | +#define DEBUGP(fmt, args...) printk(KERN_DEBUG "%s: %s: " fmt, __FILE__, __FUNCTION__ , ## args) |
| 97 | +#else |
| 98 | +#define DEBUGP(fmt, args...) |
| 99 | +#endif |
| 100 | + |
| 101 | +#define MAX_PORTS 8 |
| 102 | +static int ports[MAX_PORTS]; |
| 103 | +static int num_ports = 0; |
| 104 | +static int max_outstanding = 8; |
| 105 | +static unsigned int setup_timeout = 300; |
| 106 | + |
| 107 | +MODULE_AUTHOR("Tom Marshall <tmarshall@real.com>"); |
| 108 | +MODULE_DESCRIPTION("RTSP connection tracking module"); |
| 109 | +MODULE_LICENSE("GPL"); |
| 110 | +#ifdef MODULE_PARM |
| 111 | +MODULE_PARM(ports, "1-" __MODULE_STRING(MAX_PORTS) "i"); |
| 112 | +MODULE_PARM_DESC(ports, "port numbers of RTSP servers"); |
| 113 | +MODULE_PARM(max_outstanding, "i"); |
| 114 | +MODULE_PARM_DESC(max_outstanding, "max number of outstanding SETUP requests per RTSP session"); |
| 115 | +MODULE_PARM(setup_timeout, "i"); |
| 116 | +MODULE_PARM_DESC(setup_timeout, "timeout on for unestablished data channels"); |
| 117 | +#endif |
| 118 | + |
| 119 | +DECLARE_LOCK(ip_rtsp_lock); |
| 120 | +struct module* ip_conntrack_rtsp = THIS_MODULE; |
| 121 | + |
| 122 | +/* |
| 123 | + * Max mappings we will allow for one RTSP connection (for RTP, the number |
| 124 | + * of allocated ports is twice this value). Note that SMIL burns a lot of |
| 125 | + * ports so keep this reasonably high. If this is too low, you will see a |
| 126 | + * lot of "no free client map entries" messages. |
| 127 | + */ |
| 128 | +#define MAX_PORT_MAPS 16 |
| 129 | + |
| 130 | +/*** default port list was here in the masq code: 554, 3030, 4040 ***/ |
| 131 | + |
| 132 | +#define SKIP_WSPACE(ptr,len,off) while(off < len && isspace(*(ptr+off))) { off++; } |
| 133 | + |
| 134 | +/* |
| 135 | + * Parse an RTSP packet. |
| 136 | + * |
| 137 | + * Returns zero if parsing failed. |
| 138 | + * |
| 139 | + * Parameters: |
| 140 | + * IN ptcp tcp data pointer |
| 141 | + * IN tcplen tcp data len |
| 142 | + * IN/OUT ptcpoff points to current tcp offset |
| 143 | + * OUT phdrsoff set to offset of rtsp headers |
| 144 | + * OUT phdrslen set to length of rtsp headers |
| 145 | + * OUT pcseqoff set to offset of CSeq header |
| 146 | + * OUT pcseqlen set to length of CSeq header |
| 147 | + */ |
| 148 | +static int |
| 149 | +rtsp_parse_message(char* ptcp, uint tcplen, uint* ptcpoff, |
| 150 | + uint* phdrsoff, uint* phdrslen, |
| 151 | + uint* pcseqoff, uint* pcseqlen) |
| 152 | +{ |
| 153 | + uint entitylen = 0; |
| 154 | + uint lineoff; |
| 155 | + uint linelen; |
| 156 | + |
| 157 | + if (!nf_nextline(ptcp, tcplen, ptcpoff, &lineoff, &linelen)) |
| 158 | + { |
| 159 | + return 0; |
| 160 | + } |
| 161 | + |
| 162 | + *phdrsoff = *ptcpoff; |
| 163 | + while (nf_mime_nextline(ptcp, tcplen, ptcpoff, &lineoff, &linelen)) |
| 164 | + { |
| 165 | + if (linelen == 0) |
| 166 | + { |
| 167 | + if (entitylen > 0) |
| 168 | + { |
| 169 | + *ptcpoff += min(entitylen, tcplen - *ptcpoff); |
| 170 | + } |
| 171 | + break; |
| 172 | + } |
| 173 | + if (lineoff+linelen > tcplen) |
| 174 | + { |
| 175 | + INFOP("!! overrun !!\n"); |
| 176 | + break; |
| 177 | + } |
| 178 | + |
| 179 | + if (nf_strncasecmp(ptcp+lineoff, "CSeq:", 5) == 0) |
| 180 | + { |
| 181 | + *pcseqoff = lineoff; |
| 182 | + *pcseqlen = linelen; |
| 183 | + } |
| 184 | + if (nf_strncasecmp(ptcp+lineoff, "Content-Length:", 15) == 0) |
| 185 | + { |
| 186 | + uint off = lineoff+15; |
| 187 | + SKIP_WSPACE(ptcp+lineoff, linelen, off); |
| 188 | + nf_strtou32(ptcp+off, &entitylen); |
| 189 | + } |
| 190 | + } |
| 191 | + *phdrslen = (*ptcpoff) - (*phdrsoff); |
| 192 | + |
| 193 | + return 1; |
| 194 | +} |
| 195 | + |
| 196 | +/* |
| 197 | + * Find lo/hi client ports (if any) in transport header |
| 198 | + * In: |
| 199 | + * ptcp, tcplen = packet |
| 200 | + * tranoff, tranlen = buffer to search |
| 201 | + * |
| 202 | + * Out: |
| 203 | + * pport_lo, pport_hi = lo/hi ports (host endian) |
| 204 | + * |
| 205 | + * Returns nonzero if any client ports found |
| 206 | + * |
| 207 | + * Note: it is valid (and expected) for the client to request multiple |
| 208 | + * transports, so we need to parse the entire line. |
| 209 | + */ |
| 210 | +static int |
| 211 | +rtsp_parse_transport(char* ptran, uint tranlen, |
| 212 | + struct ip_ct_rtsp_expect* prtspexp) |
| 213 | +{ |
| 214 | + int rc = 0; |
| 215 | + uint off = 0; |
| 216 | + |
| 217 | + if (tranlen < 10 || !iseol(ptran[tranlen-1]) || |
| 218 | + nf_strncasecmp(ptran, "Transport:", 10) != 0) |
| 219 | + { |
| 220 | + INFOP("sanity check failed\n"); |
| 221 | + return 0; |
| 222 | + } |
| 223 | + DEBUGP("tran='%.*s'\n", (int)tranlen, ptran); |
| 224 | + off += 10; |
| 225 | + SKIP_WSPACE(ptran, tranlen, off); |
| 226 | + |
| 227 | + /* Transport: tran;field;field=val,tran;field;field=val,... */ |
| 228 | + while (off < tranlen) |
| 229 | + { |
| 230 | + const char* pparamend; |
| 231 | + uint nextparamoff; |
| 232 | + |
| 233 | + pparamend = memchr(ptran+off, ',', tranlen-off); |
| 234 | + pparamend = (pparamend == NULL) ? ptran+tranlen : pparamend+1; |
| 235 | + nextparamoff = pparamend-ptran; |
| 236 | + |
| 237 | + while (off < nextparamoff) |
| 238 | + { |
| 239 | + const char* pfieldend; |
| 240 | + uint nextfieldoff; |
| 241 | + |
| 242 | + pfieldend = memchr(ptran+off, ';', nextparamoff-off); |
| 243 | + nextfieldoff = (pfieldend == NULL) ? nextparamoff : pfieldend-ptran+1; |
| 244 | + |
| 245 | + if (strncmp(ptran+off, "client_port=", 12) == 0) |
| 246 | + { |
| 247 | + u_int16_t port; |
| 248 | + uint numlen; |
| 249 | + |
| 250 | + off += 12; |
| 251 | + numlen = nf_strtou16(ptran+off, &port); |
| 252 | + off += numlen; |
| 253 | + if (prtspexp->loport != 0 && prtspexp->loport != port) |
| 254 | + { |
| 255 | + DEBUGP("multiple ports found, port %hu ignored\n", port); |
| 256 | + } |
| 257 | + else |
| 258 | + { |
| 259 | + prtspexp->loport = prtspexp->hiport = port; |
| 260 | + if (ptran[off] == '-') |
| 261 | + { |
| 262 | + off++; |
| 263 | + numlen = nf_strtou16(ptran+off, &port); |
| 264 | + off += numlen; |
| 265 | + prtspexp->pbtype = pb_range; |
| 266 | + prtspexp->hiport = port; |
| 267 | + |
| 268 | + // If we have a range, assume rtp: |
| 269 | + // loport must be even, hiport must be loport+1 |
| 270 | + if ((prtspexp->loport & 0x0001) != 0 || |
| 271 | + prtspexp->hiport != prtspexp->loport+1) |
| 272 | + { |
| 273 | + DEBUGP("incorrect range: %hu-%hu, correcting\n", |
| 274 | + prtspexp->loport, prtspexp->hiport); |
| 275 | + prtspexp->loport &= 0xfffe; |
| 276 | + prtspexp->hiport = prtspexp->loport+1; |
| 277 | + } |
| 278 | + } |
| 279 | + else if (ptran[off] == '/') |
| 280 | + { |
| 281 | + off++; |
| 282 | + numlen = nf_strtou16(ptran+off, &port); |
| 283 | + off += numlen; |
| 284 | + prtspexp->pbtype = pb_discon; |
| 285 | + prtspexp->hiport = port; |
| 286 | + } |
| 287 | + rc = 1; |
| 288 | + } |
| 289 | + } |
| 290 | + |
| 291 | + /* |
| 292 | + * Note we don't look for the destination parameter here. |
| 293 | + * If we are using NAT, the NAT module will handle it. If not, |
| 294 | + * and the client is sending packets elsewhere, the expectation |
| 295 | + * will quietly time out. |
| 296 | + */ |
| 297 | + |
| 298 | + off = nextfieldoff; |
| 299 | + } |
| 300 | + |
| 301 | + off = nextparamoff; |
| 302 | + } |
| 303 | + |
| 304 | + return rc; |
| 305 | +} |
| 306 | + |
| 307 | +/*** conntrack functions ***/ |
| 308 | + |
| 309 | +/* outbound packet: client->server */ |
| 310 | +static int |
| 311 | +help_out(const struct iphdr* iph, size_t pktlen, |
| 312 | + struct ip_conntrack* ct, enum ip_conntrack_info ctinfo) |
| 313 | +{ |
| 314 | + int dir = CTINFO2DIR(ctinfo); /* = IP_CT_DIR_ORIGINAL */ |
| 315 | + struct tcphdr* tcph = (void*)iph + iph->ihl * 4; |
| 316 | + uint tcplen = pktlen - iph->ihl * 4; |
| 317 | + char* pdata = (char*)tcph + tcph->doff * 4; |
| 318 | + uint datalen = tcplen - tcph->doff * 4; |
| 319 | + uint dataoff = 0; |
| 320 | + |
| 321 | + struct ip_conntrack_expect exp; |
| 322 | + |
| 323 | + while (dataoff < datalen) |
| 324 | + { |
| 325 | + uint cmdoff = dataoff; |
| 326 | + uint hdrsoff = 0; |
| 327 | + uint hdrslen = 0; |
| 328 | + uint cseqoff = 0; |
| 329 | + uint cseqlen = 0; |
| 330 | + uint lineoff = 0; |
| 331 | + uint linelen = 0; |
| 332 | + uint off; |
| 333 | + int rc; |
| 334 | + |
| 335 | + if (!rtsp_parse_message(pdata, datalen, &dataoff, |
| 336 | + &hdrsoff, &hdrslen, |
| 337 | + &cseqoff, &cseqlen)) |
| 338 | + { |
| 339 | + break; /* not a valid message */ |
| 340 | + } |
| 341 | + |
| 342 | + if (strncmp(pdata+cmdoff, "SETUP ", 6) != 0) |
| 343 | + { |
| 344 | + continue; /* not a SETUP message */ |
| 345 | + } |
| 346 | + DEBUGP("found a setup message\n"); |
| 347 | + |
| 348 | + memset(&exp, 0, sizeof(exp)); |
| 349 | + |
| 350 | + off = 0; |
| 351 | + while (nf_mime_nextline(pdata+hdrsoff, hdrslen, &off, |
| 352 | + &lineoff, &linelen)) |
| 353 | + { |
| 354 | + if (linelen == 0) |
| 355 | + { |
| 356 | + break; |
| 357 | + } |
| 358 | + if (off > hdrsoff+hdrslen) |
| 359 | + { |
| 360 | + INFOP("!! overrun !!"); |
| 361 | + break; |
| 362 | + } |
| 363 | + |
| 364 | + if (nf_strncasecmp(pdata+hdrsoff+lineoff, "Transport:", 10) == 0) |
| 365 | + { |
| 366 | + rtsp_parse_transport(pdata+hdrsoff+lineoff, linelen, |
| 367 | + &exp.help.exp_rtsp_info); |
| 368 | + } |
| 369 | + } |
| 370 | + |
| 371 | + if (exp.help.exp_rtsp_info.loport == 0) |
| 372 | + { |
| 373 | + DEBUGP("no udp transports found\n"); |
| 374 | + continue; /* no udp transports found */ |
| 375 | + } |
| 376 | + |
| 377 | + DEBUGP("udp transport found, ports=(%d,%hu,%hu)\n", |
| 378 | + (int)exp.help.exp_rtsp_info.pbtype, |
| 379 | + exp.help.exp_rtsp_info.loport, |
| 380 | + exp.help.exp_rtsp_info.hiport); |
| 381 | + |
| 382 | + LOCK_BH(&ip_rtsp_lock); |
| 383 | + exp.seq = ntohl(tcph->seq) + hdrsoff; /* mark all the headers */ |
| 384 | + exp.help.exp_rtsp_info.len = hdrslen; |
| 385 | + |
| 386 | + exp.tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip; |
| 387 | + exp.mask.src.ip = 0xffffffff; |
| 388 | + exp.tuple.dst.ip = ct->tuplehash[dir].tuple.src.ip; |
| 389 | + exp.mask.dst.ip = 0xffffffff; |
| 390 | + exp.tuple.dst.u.udp.port = exp.help.exp_rtsp_info.loport; |
| 391 | + exp.mask.dst.u.udp.port = (exp.help.exp_rtsp_info.pbtype == pb_range) ? 0xfffe : 0xffff; |
| 392 | + exp.tuple.dst.protonum = IPPROTO_UDP; |
| 393 | + exp.mask.dst.protonum = 0xffff; |
| 394 | + |
| 395 | + DEBUGP("expect_related %u.%u.%u.%u:%u-%u.%u.%u.%u:%u\n", |
| 396 | + NIPQUAD(exp.tuple.src.ip), |
| 397 | + ntohs(exp.tuple.src.u.tcp.port), |
| 398 | + NIPQUAD(exp.tuple.dst.ip), |
| 399 | + ntohs(exp.tuple.dst.u.tcp.port)); |
| 400 | + |
| 401 | + /* pass the request off to the nat helper */ |
| 402 | + rc = ip_conntrack_expect_related(ct, &exp); |
| 403 | + UNLOCK_BH(&ip_rtsp_lock); |
| 404 | + if (rc == 0) |
| 405 | + { |
| 406 | + DEBUGP("ip_conntrack_expect_related succeeded\n"); |
| 407 | + } |
| 408 | + else |
| 409 | + { |
| 410 | + INFOP("ip_conntrack_expect_related failed (%d)\n", rc); |
| 411 | + } |
| 412 | + } |
| 413 | + |
| 414 | + return NF_ACCEPT; |
| 415 | +} |
| 416 | + |
| 417 | +/* inbound packet: server->client */ |
| 418 | +static int |
| 419 | +help_in(const struct iphdr* iph, size_t pktlen, |
| 420 | + struct ip_conntrack* ct, enum ip_conntrack_info ctinfo) |
| 421 | +{ |
| 422 | + return NF_ACCEPT; |
| 423 | +} |
| 424 | + |
| 425 | +static int |
| 426 | +help(const struct iphdr* iph, size_t pktlen, |
| 427 | + struct ip_conntrack* ct, enum ip_conntrack_info ctinfo) |
| 428 | +{ |
| 429 | + /* tcplen not negative guarenteed by ip_conntrack_tcp.c */ |
| 430 | + struct tcphdr* tcph = (void*)iph + iph->ihl * 4; |
| 431 | + u_int32_t tcplen = pktlen - iph->ihl * 4; |
| 432 | + |
| 433 | + /* Until there's been traffic both ways, don't look in packets. */ |
| 434 | + if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) |
| 435 | + { |
| 436 | + DEBUGP("conntrackinfo = %u\n", ctinfo); |
| 437 | + return NF_ACCEPT; |
| 438 | + } |
| 439 | + |
| 440 | + /* Not whole TCP header? */ |
| 441 | + if (tcplen < sizeof(struct tcphdr) || tcplen < tcph->doff * 4) |
| 442 | + { |
| 443 | + DEBUGP("tcplen = %u\n", (unsigned)tcplen); |
| 444 | + return NF_ACCEPT; |
| 445 | + } |
| 446 | + |
| 447 | + /* Checksum invalid? Ignore. */ |
| 448 | + /* FIXME: Source route IP option packets --RR */ |
| 449 | + if (tcp_v4_check(tcph, tcplen, iph->saddr, iph->daddr, |
| 450 | + csum_partial((char*)tcph, tcplen, 0))) |
| 451 | + { |
| 452 | + DEBUGP("bad csum: %p %u %u.%u.%u.%u %u.%u.%u.%u\n", |
| 453 | + tcph, tcplen, NIPQUAD(iph->saddr), NIPQUAD(iph->daddr)); |
| 454 | + return NF_ACCEPT; |
| 455 | + } |
| 456 | + |
| 457 | + switch (CTINFO2DIR(ctinfo)) |
| 458 | + { |
| 459 | + case IP_CT_DIR_ORIGINAL: |
| 460 | + help_out(iph, pktlen, ct, ctinfo); |
| 461 | + break; |
| 462 | + case IP_CT_DIR_REPLY: |
| 463 | + help_in(iph, pktlen, ct, ctinfo); |
| 464 | + break; |
| 465 | + } |
| 466 | + |
| 467 | + return NF_ACCEPT; |
| 468 | +} |
| 469 | + |
| 470 | +static struct ip_conntrack_helper rtsp_helpers[MAX_PORTS]; |
| 471 | +static char rtsp_names[MAX_PORTS][10]; |
| 472 | + |
| 473 | +/* This function is intentionally _NOT_ defined as __exit */ |
| 474 | +static void |
| 475 | +fini(void) |
| 476 | +{ |
| 477 | + int i; |
| 478 | + for (i = 0; i < num_ports; i++) |
| 479 | + { |
| 480 | + DEBUGP("unregistering port %d\n", ports[i]); |
| 481 | + ip_conntrack_helper_unregister(&rtsp_helpers[i]); |
| 482 | + } |
| 483 | +} |
| 484 | + |
| 485 | +static int __init |
| 486 | +init(void) |
| 487 | +{ |
| 488 | + int i, ret; |
| 489 | + struct ip_conntrack_helper *hlpr; |
| 490 | + char *tmpname; |
| 491 | + |
| 492 | + printk("ip_conntrack_rtsp v" IP_NF_RTSP_VERSION " loading\n"); |
| 493 | + |
| 494 | + if (max_outstanding < 1) |
| 495 | + { |
| 496 | + printk("ip_conntrack_rtsp: max_outstanding must be a positive integer\n"); |
| 497 | + return -EBUSY; |
| 498 | + } |
| 499 | + if (setup_timeout < 0) |
| 500 | + { |
| 501 | + printk("ip_conntrack_rtsp: setup_timeout must be a positive integer\n"); |
| 502 | + return -EBUSY; |
| 503 | + } |
| 504 | + |
| 505 | + /* If no port given, default to standard rtsp port */ |
| 506 | + if (ports[0] == 0) |
| 507 | + { |
| 508 | + ports[0] = RTSP_PORT; |
| 509 | + } |
| 510 | + |
| 511 | + for (i = 0; (i < MAX_PORTS) && ports[i]; i++) |
| 512 | + { |
| 513 | + hlpr = &rtsp_helpers[i]; |
| 514 | + memset(hlpr, 0, sizeof(struct ip_conntrack_helper)); |
| 515 | + hlpr->tuple.src.u.tcp.port = htons(ports[i]); |
| 516 | + hlpr->tuple.dst.protonum = IPPROTO_TCP; |
| 517 | + hlpr->mask.src.u.tcp.port = 0xFFFF; |
| 518 | + hlpr->mask.dst.protonum = 0xFFFF; |
| 519 | + hlpr->max_expected = max_outstanding; |
| 520 | + hlpr->timeout = setup_timeout; |
| 521 | + hlpr->flags = IP_CT_HELPER_F_REUSE_EXPECT; |
| 522 | + hlpr->me = ip_conntrack_rtsp; |
| 523 | + hlpr->help = help; |
| 524 | + |
| 525 | + tmpname = &rtsp_names[i][0]; |
| 526 | + if (ports[i] == RTSP_PORT) |
| 527 | + { |
| 528 | + sprintf(tmpname, "rtsp"); |
| 529 | + } |
| 530 | + else |
| 531 | + { |
| 532 | + sprintf(tmpname, "rtsp-%d", i); |
| 533 | + } |
| 534 | + hlpr->name = tmpname; |
| 535 | + |
| 536 | + DEBUGP("port #%d: %d\n", i, ports[i]); |
| 537 | + |
| 538 | + ret = ip_conntrack_helper_register(hlpr); |
| 539 | + |
| 540 | + if (ret) |
| 541 | + { |
| 542 | + printk("ip_conntrack_rtsp: ERROR registering port %d\n", ports[i]); |
| 543 | + fini(); |
| 544 | + return -EBUSY; |
| 545 | + } |
| 546 | + num_ports++; |
| 547 | + } |
| 548 | + return 0; |
| 549 | +} |
| 550 | + |
| 551 | +#ifdef CONFIG_IP_NF_NAT_NEEDED |
| 552 | +EXPORT_SYMBOL(ip_rtsp_lock); |
| 553 | +#endif |
| 554 | + |
| 555 | +module_init(init); |
| 556 | +module_exit(fini); |
| 557 | --- /dev/null |
| 558 | +++ b/net/ipv4/netfilter/ip_nat_rtsp.c |
| 559 | @@ -0,0 +1,621 @@ |
| 560 | +/* |
| 561 | + * RTSP extension for TCP NAT alteration |
| 562 | + * (C) 2003 by Tom Marshall <tmarshall@real.com> |
| 563 | + * based on ip_nat_irc.c |
| 564 | + * |
| 565 | + * This program is free software; you can redistribute it and/or |
| 566 | + * modify it under the terms of the GNU General Public License |
| 567 | + * as published by the Free Software Foundation; either version |
| 568 | + * 2 of the License, or (at your option) any later version. |
| 569 | + * |
| 570 | + * Module load syntax: |
| 571 | + * insmod ip_nat_rtsp.o ports=port1,port2,...port<MAX_PORTS> |
| 572 | + * stunaddr=<address> |
| 573 | + * destaction=[auto|strip|none] |
| 574 | + * |
| 575 | + * If no ports are specified, the default will be port 554 only. |
| 576 | + * |
| 577 | + * stunaddr specifies the address used to detect that a client is using STUN. |
| 578 | + * If this address is seen in the destination parameter, it is assumed that |
| 579 | + * the client has already punched a UDP hole in the firewall, so we don't |
| 580 | + * mangle the client_port. If none is specified, it is autodetected. It |
| 581 | + * only needs to be set if you have multiple levels of NAT. It should be |
| 582 | + * set to the external address that the STUN clients detect. Note that in |
| 583 | + * this case, it will not be possible for clients to use UDP with servers |
| 584 | + * between the NATs. |
| 585 | + * |
| 586 | + * If no destaction is specified, auto is used. |
| 587 | + * destaction=auto: strip destination parameter if it is not stunaddr. |
| 588 | + * destaction=strip: always strip destination parameter (not recommended). |
| 589 | + * destaction=none: do not touch destination parameter (not recommended). |
| 590 | + */ |
| 591 | + |
| 592 | +#include <linux/module.h> |
| 593 | +#include <linux/netfilter_ipv4.h> |
| 594 | +#include <linux/ip.h> |
| 595 | +#include <linux/tcp.h> |
| 596 | +#include <linux/kernel.h> |
| 597 | +#include <net/tcp.h> |
| 598 | +#include <linux/netfilter_ipv4/ip_nat.h> |
| 599 | +#include <linux/netfilter_ipv4/ip_nat_helper.h> |
| 600 | +#include <linux/netfilter_ipv4/ip_nat_rule.h> |
| 601 | +#include <linux/netfilter_ipv4/ip_conntrack_rtsp.h> |
| 602 | +#include <linux/netfilter_ipv4/ip_conntrack_helper.h> |
| 603 | + |
| 604 | +#include <linux/inet.h> |
| 605 | +#include <linux/ctype.h> |
| 606 | +#define NF_NEED_STRNCASECMP |
| 607 | +#define NF_NEED_STRTOU16 |
| 608 | +#include <linux/netfilter_helpers.h> |
| 609 | +#define NF_NEED_MIME_NEXTLINE |
| 610 | +#include <linux/netfilter_mime.h> |
| 611 | + |
| 612 | +#define INFOP(fmt, args...) printk(KERN_INFO "%s: %s: " fmt, __FILE__, __FUNCTION__ , ## args) |
| 613 | +#ifdef IP_NF_RTSP_DEBUG |
| 614 | +#define DEBUGP(fmt, args...) printk(KERN_DEBUG "%s: %s: " fmt, __FILE__, __FUNCTION__ , ## args) |
| 615 | +#else |
| 616 | +#define DEBUGP(fmt, args...) |
| 617 | +#endif |
| 618 | + |
| 619 | +#define MAX_PORTS 8 |
| 620 | +#define DSTACT_AUTO 0 |
| 621 | +#define DSTACT_STRIP 1 |
| 622 | +#define DSTACT_NONE 2 |
| 623 | + |
| 624 | +static int ports[MAX_PORTS]; |
| 625 | +static char* stunaddr = NULL; |
| 626 | +static char* destaction = NULL; |
| 627 | + |
| 628 | +static int num_ports = 0; |
| 629 | +static u_int32_t extip = 0; |
| 630 | +static int dstact = 0; |
| 631 | + |
| 632 | +MODULE_AUTHOR("Tom Marshall <tmarshall@real.com>"); |
| 633 | +MODULE_DESCRIPTION("RTSP network address translation module"); |
| 634 | +MODULE_LICENSE("GPL"); |
| 635 | +#ifdef MODULE_PARM |
| 636 | +MODULE_PARM(ports, "1-" __MODULE_STRING(MAX_PORTS) "i"); |
| 637 | +MODULE_PARM_DESC(ports, "port numbers of RTSP servers"); |
| 638 | +MODULE_PARM(stunaddr, "s"); |
| 639 | +MODULE_PARM_DESC(stunaddr, "Address for detecting STUN"); |
| 640 | +MODULE_PARM(destaction, "s"); |
| 641 | +MODULE_PARM_DESC(destaction, "Action for destination parameter (auto/strip/none)"); |
| 642 | +#endif |
| 643 | + |
| 644 | +/* protects rtsp part of conntracks */ |
| 645 | +DECLARE_LOCK_EXTERN(ip_rtsp_lock); |
| 646 | + |
| 647 | +#define SKIP_WSPACE(ptr,len,off) while(off < len && isspace(*(ptr+off))) { off++; } |
| 648 | + |
| 649 | +/*** helper functions ***/ |
| 650 | + |
| 651 | +static void |
| 652 | +get_skb_tcpdata(struct sk_buff* skb, char** pptcpdata, uint* ptcpdatalen) |
| 653 | +{ |
| 654 | + struct iphdr* iph = (struct iphdr*)skb->nh.iph; |
| 655 | + struct tcphdr* tcph = (struct tcphdr*)((char*)iph + iph->ihl*4); |
| 656 | + |
| 657 | + *pptcpdata = (char*)tcph + tcph->doff*4; |
| 658 | + *ptcpdatalen = ((char*)skb->h.raw + skb->len) - *pptcpdata; |
| 659 | +} |
| 660 | + |
| 661 | +/*** nat functions ***/ |
| 662 | + |
| 663 | +/* |
| 664 | + * Mangle the "Transport:" header: |
| 665 | + * - Replace all occurences of "client_port=<spec>" |
| 666 | + * - Handle destination parameter |
| 667 | + * |
| 668 | + * In: |
| 669 | + * ct, ctinfo = conntrack context |
| 670 | + * pskb = packet |
| 671 | + * tranoff = Transport header offset from TCP data |
| 672 | + * tranlen = Transport header length (incl. CRLF) |
| 673 | + * rport_lo = replacement low port (host endian) |
| 674 | + * rport_hi = replacement high port (host endian) |
| 675 | + * |
| 676 | + * Returns packet size difference. |
| 677 | + * |
| 678 | + * Assumes that a complete transport header is present, ending with CR or LF |
| 679 | + */ |
| 680 | +static int |
| 681 | +rtsp_mangle_tran(struct ip_conntrack* ct, enum ip_conntrack_info ctinfo, |
| 682 | + struct ip_conntrack_expect* exp, |
| 683 | + struct sk_buff** pskb, uint tranoff, uint tranlen) |
| 684 | +{ |
| 685 | + char* ptcp; |
| 686 | + uint tcplen; |
| 687 | + char* ptran; |
| 688 | + char rbuf1[16]; /* Replacement buffer (one port) */ |
| 689 | + uint rbuf1len; /* Replacement len (one port) */ |
| 690 | + char rbufa[16]; /* Replacement buffer (all ports) */ |
| 691 | + uint rbufalen; /* Replacement len (all ports) */ |
| 692 | + u_int32_t newip; |
| 693 | + u_int16_t loport, hiport; |
| 694 | + uint off = 0; |
| 695 | + uint diff; /* Number of bytes we removed */ |
| 696 | + |
| 697 | + struct ip_ct_rtsp_expect* prtspexp = &exp->help.exp_rtsp_info; |
| 698 | + struct ip_conntrack_tuple t; |
| 699 | + |
| 700 | + char szextaddr[15+1]; |
| 701 | + uint extaddrlen; |
| 702 | + int is_stun; |
| 703 | + |
| 704 | + get_skb_tcpdata(*pskb, &ptcp, &tcplen); |
| 705 | + ptran = ptcp+tranoff; |
| 706 | + |
| 707 | + if (tranoff+tranlen > tcplen || tcplen-tranoff < tranlen || |
| 708 | + tranlen < 10 || !iseol(ptran[tranlen-1]) || |
| 709 | + nf_strncasecmp(ptran, "Transport:", 10) != 0) |
| 710 | + { |
| 711 | + INFOP("sanity check failed\n"); |
| 712 | + return 0; |
| 713 | + } |
| 714 | + off += 10; |
| 715 | + SKIP_WSPACE(ptcp+tranoff, tranlen, off); |
| 716 | + |
| 717 | + newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip; |
| 718 | + t = exp->tuple; |
| 719 | + t.dst.ip = newip; |
| 720 | + |
| 721 | + extaddrlen = extip ? sprintf(szextaddr, "%u.%u.%u.%u", NIPQUAD(extip)) |
| 722 | + : sprintf(szextaddr, "%u.%u.%u.%u", NIPQUAD(newip)); |
| 723 | + DEBUGP("stunaddr=%s (%s)\n", szextaddr, (extip?"forced":"auto")); |
| 724 | + |
| 725 | + rbuf1len = rbufalen = 0; |
| 726 | + switch (prtspexp->pbtype) |
| 727 | + { |
| 728 | + case pb_single: |
| 729 | + for (loport = prtspexp->loport; loport != 0; loport++) /* XXX: improper wrap? */ |
| 730 | + { |
| 731 | + t.dst.u.udp.port = htons(loport); |
| 732 | + if (ip_conntrack_change_expect(exp, &t) == 0) |
| 733 | + { |
| 734 | + DEBUGP("using port %hu\n", loport); |
| 735 | + break; |
| 736 | + } |
| 737 | + } |
| 738 | + if (loport != 0) |
| 739 | + { |
| 740 | + rbuf1len = sprintf(rbuf1, "%hu", loport); |
| 741 | + rbufalen = sprintf(rbufa, "%hu", loport); |
| 742 | + } |
| 743 | + break; |
| 744 | + case pb_range: |
| 745 | + for (loport = prtspexp->loport; loport != 0; loport += 2) /* XXX: improper wrap? */ |
| 746 | + { |
| 747 | + t.dst.u.udp.port = htons(loport); |
| 748 | + if (ip_conntrack_change_expect(exp, &t) == 0) |
| 749 | + { |
| 750 | + hiport = loport + ~exp->mask.dst.u.udp.port; |
| 751 | + DEBUGP("using ports %hu-%hu\n", loport, hiport); |
| 752 | + break; |
| 753 | + } |
| 754 | + } |
| 755 | + if (loport != 0) |
| 756 | + { |
| 757 | + rbuf1len = sprintf(rbuf1, "%hu", loport); |
| 758 | + rbufalen = sprintf(rbufa, "%hu-%hu", loport, loport+1); |
| 759 | + } |
| 760 | + break; |
| 761 | + case pb_discon: |
| 762 | + for (loport = prtspexp->loport; loport != 0; loport++) /* XXX: improper wrap? */ |
| 763 | + { |
| 764 | + t.dst.u.udp.port = htons(loport); |
| 765 | + if (ip_conntrack_change_expect(exp, &t) == 0) |
| 766 | + { |
| 767 | + DEBUGP("using port %hu (1 of 2)\n", loport); |
| 768 | + break; |
| 769 | + } |
| 770 | + } |
| 771 | + for (hiport = prtspexp->hiport; hiport != 0; hiport++) /* XXX: improper wrap? */ |
| 772 | + { |
| 773 | + t.dst.u.udp.port = htons(hiport); |
| 774 | + if (ip_conntrack_change_expect(exp, &t) == 0) |
| 775 | + { |
| 776 | + DEBUGP("using port %hu (2 of 2)\n", hiport); |
| 777 | + break; |
| 778 | + } |
| 779 | + } |
| 780 | + if (loport != 0 && hiport != 0) |
| 781 | + { |
| 782 | + rbuf1len = sprintf(rbuf1, "%hu", loport); |
| 783 | + if (hiport == loport+1) |
| 784 | + { |
| 785 | + rbufalen = sprintf(rbufa, "%hu-%hu", loport, hiport); |
| 786 | + } |
| 787 | + else |
| 788 | + { |
| 789 | + rbufalen = sprintf(rbufa, "%hu/%hu", loport, hiport); |
| 790 | + } |
| 791 | + } |
| 792 | + break; |
| 793 | + } |
| 794 | + |
| 795 | + if (rbuf1len == 0) |
| 796 | + { |
| 797 | + return 0; /* cannot get replacement port(s) */ |
| 798 | + } |
| 799 | + |
| 800 | + /* Transport: tran;field;field=val,tran;field;field=val,... */ |
| 801 | + while (off < tranlen) |
| 802 | + { |
| 803 | + uint saveoff; |
| 804 | + const char* pparamend; |
| 805 | + uint nextparamoff; |
| 806 | + |
| 807 | + pparamend = memchr(ptran+off, ',', tranlen-off); |
| 808 | + pparamend = (pparamend == NULL) ? ptran+tranlen : pparamend+1; |
| 809 | + nextparamoff = pparamend-ptcp; |
| 810 | + |
| 811 | + /* |
| 812 | + * We pass over each param twice. On the first pass, we look for a |
| 813 | + * destination= field. It is handled by the security policy. If it |
| 814 | + * is present, allowed, and equal to our external address, we assume |
| 815 | + * that STUN is being used and we leave the client_port= field alone. |
| 816 | + */ |
| 817 | + is_stun = 0; |
| 818 | + saveoff = off; |
| 819 | + while (off < nextparamoff) |
| 820 | + { |
| 821 | + const char* pfieldend; |
| 822 | + uint nextfieldoff; |
| 823 | + |
| 824 | + pfieldend = memchr(ptran+off, ';', nextparamoff-off); |
| 825 | + nextfieldoff = (pfieldend == NULL) ? nextparamoff : pfieldend-ptran+1; |
| 826 | + |
| 827 | + if (dstact != DSTACT_NONE && strncmp(ptran+off, "destination=", 12) == 0) |
| 828 | + { |
| 829 | + if (strncmp(ptran+off+12, szextaddr, extaddrlen) == 0) |
| 830 | + { |
| 831 | + is_stun = 1; |
| 832 | + } |
| 833 | + if (dstact == DSTACT_STRIP || (dstact == DSTACT_AUTO && !is_stun)) |
| 834 | + { |
| 835 | + diff = nextfieldoff-off; |
| 836 | + if (!ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, |
| 837 | + off, diff, NULL, 0)) |
| 838 | + { |
| 839 | + /* mangle failed, all we can do is bail */ |
| 840 | + return 0; |
| 841 | + } |
| 842 | + get_skb_tcpdata(*pskb, &ptcp, &tcplen); |
| 843 | + ptran = ptcp+tranoff; |
| 844 | + tranlen -= diff; |
| 845 | + nextparamoff -= diff; |
| 846 | + nextfieldoff -= diff; |
| 847 | + } |
| 848 | + } |
| 849 | + |
| 850 | + off = nextfieldoff; |
| 851 | + } |
| 852 | + if (is_stun) |
| 853 | + { |
| 854 | + continue; |
| 855 | + } |
| 856 | + off = saveoff; |
| 857 | + while (off < nextparamoff) |
| 858 | + { |
| 859 | + const char* pfieldend; |
| 860 | + uint nextfieldoff; |
| 861 | + |
| 862 | + pfieldend = memchr(ptran+off, ';', nextparamoff-off); |
| 863 | + nextfieldoff = (pfieldend == NULL) ? nextparamoff : pfieldend-ptran+1; |
| 864 | + |
| 865 | + if (strncmp(ptran+off, "client_port=", 12) == 0) |
| 866 | + { |
| 867 | + u_int16_t port; |
| 868 | + uint numlen; |
| 869 | + uint origoff; |
| 870 | + uint origlen; |
| 871 | + char* rbuf = rbuf1; |
| 872 | + uint rbuflen = rbuf1len; |
| 873 | + |
| 874 | + off += 12; |
| 875 | + origoff = (ptran-ptcp)+off; |
| 876 | + origlen = 0; |
| 877 | + numlen = nf_strtou16(ptran+off, &port); |
| 878 | + off += numlen; |
| 879 | + origlen += numlen; |
| 880 | + if (port != prtspexp->loport) |
| 881 | + { |
| 882 | + DEBUGP("multiple ports found, port %hu ignored\n", port); |
| 883 | + } |
| 884 | + else |
| 885 | + { |
| 886 | + if (ptran[off] == '-' || ptran[off] == '/') |
| 887 | + { |
| 888 | + off++; |
| 889 | + origlen++; |
| 890 | + numlen = nf_strtou16(ptran+off, &port); |
| 891 | + off += numlen; |
| 892 | + origlen += numlen; |
| 893 | + rbuf = rbufa; |
| 894 | + rbuflen = rbufalen; |
| 895 | + } |
| 896 | + |
| 897 | + /* |
| 898 | + * note we cannot just memcpy() if the sizes are the same. |
| 899 | + * the mangle function does skb resizing, checks for a |
| 900 | + * cloned skb, and updates the checksums. |
| 901 | + * |
| 902 | + * parameter 4 below is offset from start of tcp data. |
| 903 | + */ |
| 904 | + diff = origlen-rbuflen; |
| 905 | + if (!ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, |
| 906 | + origoff, origlen, rbuf, rbuflen)) |
| 907 | + { |
| 908 | + /* mangle failed, all we can do is bail */ |
| 909 | + return 0; |
| 910 | + } |
| 911 | + get_skb_tcpdata(*pskb, &ptcp, &tcplen); |
| 912 | + ptran = ptcp+tranoff; |
| 913 | + tranlen -= diff; |
| 914 | + nextparamoff -= diff; |
| 915 | + nextfieldoff -= diff; |
| 916 | + } |
| 917 | + } |
| 918 | + |
| 919 | + off = nextfieldoff; |
| 920 | + } |
| 921 | + |
| 922 | + off = nextparamoff; |
| 923 | + } |
| 924 | + |
| 925 | + return 1; |
| 926 | +} |
| 927 | + |
| 928 | +static unsigned int |
| 929 | +expected(struct sk_buff **pskb, uint hooknum, struct ip_conntrack* ct, struct ip_nat_info* info) |
| 930 | +{ |
| 931 | + struct ip_nat_multi_range mr; |
| 932 | + u_int32_t newdstip, newsrcip, newip; |
| 933 | + |
| 934 | + struct ip_conntrack *master = master_ct(ct); |
| 935 | + |
| 936 | + IP_NF_ASSERT(info); |
| 937 | + IP_NF_ASSERT(master); |
| 938 | + |
| 939 | + IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum)))); |
| 940 | + |
| 941 | + newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip; |
| 942 | + newsrcip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip; |
| 943 | + newip = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC) ? newsrcip : newdstip; |
| 944 | + |
| 945 | + DEBUGP("newsrcip=%u.%u.%u.%u, newdstip=%u.%u.%u.%u, newip=%u.%u.%u.%u\n", |
| 946 | + NIPQUAD(newsrcip), NIPQUAD(newdstip), NIPQUAD(newip)); |
| 947 | + |
| 948 | + mr.rangesize = 1; |
| 949 | + /* We don't want to manip the per-protocol, just the IPs. */ |
| 950 | + mr.range[0].flags = IP_NAT_RANGE_MAP_IPS; |
| 951 | + mr.range[0].min_ip = mr.range[0].max_ip = newip; |
| 952 | + |
| 953 | + return ip_nat_setup_info(ct, &mr, hooknum); |
| 954 | +} |
| 955 | + |
| 956 | +static uint |
| 957 | +help_out(struct ip_conntrack* ct, enum ip_conntrack_info ctinfo, |
| 958 | + struct ip_conntrack_expect* exp, struct sk_buff** pskb) |
| 959 | +{ |
| 960 | + char* ptcp; |
| 961 | + uint tcplen; |
| 962 | + uint hdrsoff; |
| 963 | + uint hdrslen; |
| 964 | + uint lineoff; |
| 965 | + uint linelen; |
| 966 | + uint off; |
| 967 | + |
| 968 | + struct iphdr* iph = (struct iphdr*)(*pskb)->nh.iph; |
| 969 | + struct tcphdr* tcph = (struct tcphdr*)((void*)iph + iph->ihl*4); |
| 970 | + |
| 971 | + struct ip_ct_rtsp_expect* prtspexp = &exp->help.exp_rtsp_info; |
| 972 | + |
| 973 | + get_skb_tcpdata(*pskb, &ptcp, &tcplen); |
| 974 | + |
| 975 | + hdrsoff = exp->seq - ntohl(tcph->seq); |
| 976 | + hdrslen = prtspexp->len; |
| 977 | + off = hdrsoff; |
| 978 | + |
| 979 | + while (nf_mime_nextline(ptcp, hdrsoff+hdrslen, &off, &lineoff, &linelen)) |
| 980 | + { |
| 981 | + if (linelen == 0) |
| 982 | + { |
| 983 | + break; |
| 984 | + } |
| 985 | + if (off > hdrsoff+hdrslen) |
| 986 | + { |
| 987 | + INFOP("!! overrun !!"); |
| 988 | + break; |
| 989 | + } |
| 990 | + DEBUGP("hdr: len=%u, %.*s", linelen, (int)linelen, ptcp+lineoff); |
| 991 | + |
| 992 | + if (nf_strncasecmp(ptcp+lineoff, "Transport:", 10) == 0) |
| 993 | + { |
| 994 | + uint oldtcplen = tcplen; |
| 995 | + if (!rtsp_mangle_tran(ct, ctinfo, exp, pskb, lineoff, linelen)) |
| 996 | + { |
| 997 | + break; |
| 998 | + } |
| 999 | + get_skb_tcpdata(*pskb, &ptcp, &tcplen); |
| 1000 | + hdrslen -= (oldtcplen-tcplen); |
| 1001 | + off -= (oldtcplen-tcplen); |
| 1002 | + lineoff -= (oldtcplen-tcplen); |
| 1003 | + linelen -= (oldtcplen-tcplen); |
| 1004 | + DEBUGP("rep: len=%u, %.*s", linelen, (int)linelen, ptcp+lineoff); |
| 1005 | + } |
| 1006 | + } |
| 1007 | + |
| 1008 | + return NF_ACCEPT; |
| 1009 | +} |
| 1010 | + |
| 1011 | +static uint |
| 1012 | +help_in(struct ip_conntrack* ct, enum ip_conntrack_info ctinfo, |
| 1013 | + struct ip_conntrack_expect* exp, struct sk_buff** pskb) |
| 1014 | +{ |
| 1015 | + /* XXX: unmangle */ |
| 1016 | + return NF_ACCEPT; |
| 1017 | +} |
| 1018 | + |
| 1019 | +static uint |
| 1020 | +help(struct ip_conntrack* ct, |
| 1021 | + struct ip_conntrack_expect* exp, |
| 1022 | + struct ip_nat_info* info, |
| 1023 | + enum ip_conntrack_info ctinfo, |
| 1024 | + unsigned int hooknum, |
| 1025 | + struct sk_buff** pskb) |
| 1026 | +{ |
| 1027 | + struct iphdr* iph = (struct iphdr*)(*pskb)->nh.iph; |
| 1028 | + struct tcphdr* tcph = (struct tcphdr*)((char*)iph + iph->ihl * 4); |
| 1029 | + uint datalen; |
| 1030 | + int dir; |
| 1031 | + struct ip_ct_rtsp_expect* ct_rtsp_info; |
| 1032 | + int rc = NF_ACCEPT; |
| 1033 | + |
| 1034 | + if (ct == NULL || exp == NULL || info == NULL || pskb == NULL) |
| 1035 | + { |
| 1036 | + DEBUGP("!! null ptr (%p,%p,%p,%p) !!\n", ct, exp, info, pskb); |
| 1037 | + return NF_ACCEPT; |
| 1038 | + } |
| 1039 | + |
| 1040 | + ct_rtsp_info = &exp->help.exp_rtsp_info; |
| 1041 | + |
| 1042 | + /* |
| 1043 | + * Only mangle things once: original direction in POST_ROUTING |
| 1044 | + * and reply direction on PRE_ROUTING. |
| 1045 | + */ |
| 1046 | + dir = CTINFO2DIR(ctinfo); |
| 1047 | + if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL) |
| 1048 | + || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY))) |
| 1049 | + { |
| 1050 | + DEBUGP("Not touching dir %s at hook %s\n", |
| 1051 | + dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY", |
| 1052 | + hooknum == NF_IP_POST_ROUTING ? "POSTROUTING" |
| 1053 | + : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING" |
| 1054 | + : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???"); |
| 1055 | + return NF_ACCEPT; |
| 1056 | + } |
| 1057 | + DEBUGP("got beyond not touching\n"); |
| 1058 | + |
| 1059 | + datalen = (*pskb)->len - iph->ihl * 4 - tcph->doff * 4; |
| 1060 | + |
| 1061 | + LOCK_BH(&ip_rtsp_lock); |
| 1062 | + /* Ensure the packet contains all of the marked data */ |
| 1063 | + if (!between(exp->seq + ct_rtsp_info->len, |
| 1064 | + ntohl(tcph->seq), ntohl(tcph->seq) + datalen)) |
| 1065 | + { |
| 1066 | + /* Partial retransmission? Probably a hacker. */ |
| 1067 | + if (net_ratelimit()) |
| 1068 | + { |
| 1069 | + INFOP("partial packet %u/%u in %u/%u\n", |
| 1070 | + exp->seq, ct_rtsp_info->len, ntohl(tcph->seq), ntohl(tcph->seq) + datalen); |
| 1071 | + } |
| 1072 | + UNLOCK_BH(&ip_rtsp_lock); |
| 1073 | + return NF_DROP; |
| 1074 | + } |
| 1075 | + |
| 1076 | + switch (dir) |
| 1077 | + { |
| 1078 | + case IP_CT_DIR_ORIGINAL: |
| 1079 | + rc = help_out(ct, ctinfo, exp, pskb); |
| 1080 | + break; |
| 1081 | + case IP_CT_DIR_REPLY: |
| 1082 | + rc = help_in(ct, ctinfo, exp, pskb); |
| 1083 | + break; |
| 1084 | + } |
| 1085 | + UNLOCK_BH(&ip_rtsp_lock); |
| 1086 | + |
| 1087 | + return rc; |
| 1088 | +} |
| 1089 | + |
| 1090 | +static struct ip_nat_helper ip_nat_rtsp_helpers[MAX_PORTS]; |
| 1091 | +static char rtsp_names[MAX_PORTS][10]; |
| 1092 | + |
| 1093 | +/* This function is intentionally _NOT_ defined as __exit */ |
| 1094 | +static void |
| 1095 | +fini(void) |
| 1096 | +{ |
| 1097 | + int i; |
| 1098 | + |
| 1099 | + for (i = 0; i < num_ports; i++) |
| 1100 | + { |
| 1101 | + DEBUGP("unregistering helper for port %d\n", ports[i]); |
| 1102 | + ip_nat_helper_unregister(&ip_nat_rtsp_helpers[i]); |
| 1103 | + } |
| 1104 | +} |
| 1105 | + |
| 1106 | +static int __init |
| 1107 | +init(void) |
| 1108 | +{ |
| 1109 | + int ret = 0; |
| 1110 | + int i; |
| 1111 | + struct ip_nat_helper* hlpr; |
| 1112 | + char* tmpname; |
| 1113 | + |
| 1114 | + printk("ip_nat_rtsp v" IP_NF_RTSP_VERSION " loading\n"); |
| 1115 | + |
| 1116 | + if (ports[0] == 0) |
| 1117 | + { |
| 1118 | + ports[0] = RTSP_PORT; |
| 1119 | + } |
| 1120 | + |
| 1121 | + for (i = 0; (i < MAX_PORTS) && ports[i] != 0; i++) |
| 1122 | + { |
| 1123 | + hlpr = &ip_nat_rtsp_helpers[i]; |
| 1124 | + memset(hlpr, 0, sizeof(struct ip_nat_helper)); |
| 1125 | + |
| 1126 | + hlpr->tuple.dst.protonum = IPPROTO_TCP; |
| 1127 | + hlpr->tuple.src.u.tcp.port = htons(ports[i]); |
| 1128 | + hlpr->mask.src.u.tcp.port = 0xFFFF; |
| 1129 | + hlpr->mask.dst.protonum = 0xFFFF; |
| 1130 | + hlpr->help = help; |
| 1131 | + hlpr->flags = 0; |
| 1132 | + hlpr->me = THIS_MODULE; |
| 1133 | + hlpr->expect = expected; |
| 1134 | + |
| 1135 | + tmpname = &rtsp_names[i][0]; |
| 1136 | + if (ports[i] == RTSP_PORT) |
| 1137 | + { |
| 1138 | + sprintf(tmpname, "rtsp"); |
| 1139 | + } |
| 1140 | + else |
| 1141 | + { |
| 1142 | + sprintf(tmpname, "rtsp-%d", i); |
| 1143 | + } |
| 1144 | + hlpr->name = tmpname; |
| 1145 | + |
| 1146 | + DEBUGP("registering helper for port %d: name %s\n", ports[i], hlpr->name); |
| 1147 | + ret = ip_nat_helper_register(hlpr); |
| 1148 | + |
| 1149 | + if (ret) |
| 1150 | + { |
| 1151 | + printk("ip_nat_rtsp: error registering helper for port %d\n", ports[i]); |
| 1152 | + fini(); |
| 1153 | + return 1; |
| 1154 | + } |
| 1155 | + num_ports++; |
| 1156 | + } |
| 1157 | + if (stunaddr != NULL) |
| 1158 | + { |
| 1159 | + extip = in_aton(stunaddr); |
| 1160 | + } |
| 1161 | + if (destaction != NULL) |
| 1162 | + { |
| 1163 | + if (strcmp(destaction, "auto") == 0) |
| 1164 | + { |
| 1165 | + dstact = DSTACT_AUTO; |
| 1166 | + } |
| 1167 | + if (strcmp(destaction, "strip") == 0) |
| 1168 | + { |
| 1169 | + dstact = DSTACT_STRIP; |
| 1170 | + } |
| 1171 | + if (strcmp(destaction, "none") == 0) |
| 1172 | + { |
| 1173 | + dstact = DSTACT_NONE; |
| 1174 | + } |
| 1175 | + } |
| 1176 | + return ret; |
| 1177 | +} |
| 1178 | + |
| 1179 | +module_init(init); |
| 1180 | +module_exit(fini); |
| 1181 | --- a/arch/mips/kernel/mips_ksyms.c |
| 1182 | +++ b/arch/mips/kernel/mips_ksyms.c |
| 1183 | @@ -52,6 +52,7 @@ EXPORT_SYMBOL(EISA_bus); |
| 1184 | /* |
| 1185 | * String functions |
| 1186 | */ |
| 1187 | +EXPORT_SYMBOL_NOVERS(memchr); |
| 1188 | EXPORT_SYMBOL_NOVERS(memcmp); |
| 1189 | EXPORT_SYMBOL_NOVERS(memset); |
| 1190 | EXPORT_SYMBOL_NOVERS(memcpy); |
| 1191 | --- /dev/null |
| 1192 | +++ b/include/linux/netfilter_helpers.h |
| 1193 | @@ -0,0 +1,133 @@ |
| 1194 | +/* |
| 1195 | + * Helpers for netfiler modules. This file provides implementations for basic |
| 1196 | + * functions such as strncasecmp(), etc. |
| 1197 | + * |
| 1198 | + * gcc will warn for defined but unused functions, so we only include the |
| 1199 | + * functions requested. The following macros are used: |
| 1200 | + * NF_NEED_STRNCASECMP nf_strncasecmp() |
| 1201 | + * NF_NEED_STRTOU16 nf_strtou16() |
| 1202 | + * NF_NEED_STRTOU32 nf_strtou32() |
| 1203 | + */ |
| 1204 | +#ifndef _NETFILTER_HELPERS_H |
| 1205 | +#define _NETFILTER_HELPERS_H |
| 1206 | + |
| 1207 | +/* Only include these functions for kernel code. */ |
| 1208 | +#ifdef __KERNEL__ |
| 1209 | + |
| 1210 | +#include <linux/ctype.h> |
| 1211 | +#define iseol(c) ( (c) == '\r' || (c) == '\n' ) |
| 1212 | + |
| 1213 | +/* |
| 1214 | + * The standard strncasecmp() |
| 1215 | + */ |
| 1216 | +#ifdef NF_NEED_STRNCASECMP |
| 1217 | +static int |
| 1218 | +nf_strncasecmp(const char* s1, const char* s2, u_int32_t len) |
| 1219 | +{ |
| 1220 | + if (s1 == NULL || s2 == NULL) |
| 1221 | + { |
| 1222 | + if (s1 == NULL && s2 == NULL) |
| 1223 | + { |
| 1224 | + return 0; |
| 1225 | + } |
| 1226 | + return (s1 == NULL) ? -1 : 1; |
| 1227 | + } |
| 1228 | + while (len > 0 && tolower(*s1) == tolower(*s2)) |
| 1229 | + { |
| 1230 | + len--; |
| 1231 | + s1++; |
| 1232 | + s2++; |
| 1233 | + } |
| 1234 | + return ( (len == 0) ? 0 : (tolower(*s1) - tolower(*s2)) ); |
| 1235 | +} |
| 1236 | +#endif /* NF_NEED_STRNCASECMP */ |
| 1237 | + |
| 1238 | +/* |
| 1239 | + * Parse a string containing a 16-bit unsigned integer. |
| 1240 | + * Returns the number of chars used, or zero if no number is found. |
| 1241 | + */ |
| 1242 | +#ifdef NF_NEED_STRTOU16 |
| 1243 | +static int |
| 1244 | +nf_strtou16(const char* pbuf, u_int16_t* pval) |
| 1245 | +{ |
| 1246 | + int n = 0; |
| 1247 | + |
| 1248 | + *pval = 0; |
| 1249 | + while (isdigit(pbuf[n])) |
| 1250 | + { |
| 1251 | + *pval = (*pval * 10) + (pbuf[n] - '0'); |
| 1252 | + n++; |
| 1253 | + } |
| 1254 | + |
| 1255 | + return n; |
| 1256 | +} |
| 1257 | +#endif /* NF_NEED_STRTOU16 */ |
| 1258 | + |
| 1259 | +/* |
| 1260 | + * Parse a string containing a 32-bit unsigned integer. |
| 1261 | + * Returns the number of chars used, or zero if no number is found. |
| 1262 | + */ |
| 1263 | +#ifdef NF_NEED_STRTOU32 |
| 1264 | +static int |
| 1265 | +nf_strtou32(const char* pbuf, u_int32_t* pval) |
| 1266 | +{ |
| 1267 | + int n = 0; |
| 1268 | + |
| 1269 | + *pval = 0; |
| 1270 | + while (pbuf[n] >= '0' && pbuf[n] <= '9') |
| 1271 | + { |
| 1272 | + *pval = (*pval * 10) + (pbuf[n] - '0'); |
| 1273 | + n++; |
| 1274 | + } |
| 1275 | + |
| 1276 | + return n; |
| 1277 | +} |
| 1278 | +#endif /* NF_NEED_STRTOU32 */ |
| 1279 | + |
| 1280 | +/* |
| 1281 | + * Given a buffer and length, advance to the next line and mark the current |
| 1282 | + * line. |
| 1283 | + */ |
| 1284 | +#ifdef NF_NEED_NEXTLINE |
| 1285 | +static int |
| 1286 | +nf_nextline(char* p, uint len, uint* poff, uint* plineoff, uint* plinelen) |
| 1287 | +{ |
| 1288 | + uint off = *poff; |
| 1289 | + uint physlen = 0; |
| 1290 | + |
| 1291 | + if (off >= len) |
| 1292 | + { |
| 1293 | + return 0; |
| 1294 | + } |
| 1295 | + |
| 1296 | + while (p[off] != '\n') |
| 1297 | + { |
| 1298 | + if (len-off <= 1) |
| 1299 | + { |
| 1300 | + return 0; |
| 1301 | + } |
| 1302 | + |
| 1303 | + physlen++; |
| 1304 | + off++; |
| 1305 | + } |
| 1306 | + |
| 1307 | + /* if we saw a crlf, physlen needs adjusted */ |
| 1308 | + if (physlen > 0 && p[off] == '\n' && p[off-1] == '\r') |
| 1309 | + { |
| 1310 | + physlen--; |
| 1311 | + } |
| 1312 | + |
| 1313 | + /* advance past the newline */ |
| 1314 | + off++; |
| 1315 | + |
| 1316 | + *plineoff = *poff; |
| 1317 | + *plinelen = physlen; |
| 1318 | + *poff = off; |
| 1319 | + |
| 1320 | + return 1; |
| 1321 | +} |
| 1322 | +#endif /* NF_NEED_NEXTLINE */ |
| 1323 | + |
| 1324 | +#endif /* __KERNEL__ */ |
| 1325 | + |
| 1326 | +#endif /* _NETFILTER_HELPERS_H */ |
| 1327 | --- /dev/null |
| 1328 | +++ b/include/linux/netfilter_ipv4/ip_conntrack_rtsp.h |
| 1329 | @@ -0,0 +1,68 @@ |
| 1330 | +/* |
| 1331 | + * RTSP extension for IP connection tracking. |
| 1332 | + * (C) 2003 by Tom Marshall <tmarshall@real.com> |
| 1333 | + * based on ip_conntrack_irc.h |
| 1334 | + * |
| 1335 | + * This program is free software; you can redistribute it and/or |
| 1336 | + * modify it under the terms of the GNU General Public License |
| 1337 | + * as published by the Free Software Foundation; either version |
| 1338 | + * 2 of the License, or (at your option) any later version. |
| 1339 | + */ |
| 1340 | +#ifndef _IP_CONNTRACK_RTSP_H |
| 1341 | +#define _IP_CONNTRACK_RTSP_H |
| 1342 | + |
| 1343 | +/* #define IP_NF_RTSP_DEBUG */ |
| 1344 | +#define IP_NF_RTSP_VERSION "0.01" |
| 1345 | + |
| 1346 | +/* port block types */ |
| 1347 | +typedef enum { |
| 1348 | + pb_single, /* client_port=x */ |
| 1349 | + pb_range, /* client_port=x-y */ |
| 1350 | + pb_discon /* client_port=x/y (rtspbis) */ |
| 1351 | +} portblock_t; |
| 1352 | + |
| 1353 | +/* We record seq number and length of rtsp headers here, all in host order. */ |
| 1354 | + |
| 1355 | +/* |
| 1356 | + * This structure is per expected connection. It is a member of struct |
| 1357 | + * ip_conntrack_expect. The TCP SEQ for the conntrack expect is stored |
| 1358 | + * there and we are expected to only store the length of the data which |
| 1359 | + * needs replaced. If a packet contains multiple RTSP messages, we create |
| 1360 | + * one expected connection per message. |
| 1361 | + * |
| 1362 | + * We use these variables to mark the entire header block. This may seem |
| 1363 | + * like overkill, but the nature of RTSP requires it. A header may appear |
| 1364 | + * multiple times in a message. We must treat two Transport headers the |
| 1365 | + * same as one Transport header with two entries. |
| 1366 | + */ |
| 1367 | +struct ip_ct_rtsp_expect |
| 1368 | +{ |
| 1369 | + u_int32_t len; /* length of header block */ |
| 1370 | + portblock_t pbtype; /* Type of port block that was requested */ |
| 1371 | + u_int16_t loport; /* Port that was requested, low or first */ |
| 1372 | + u_int16_t hiport; /* Port that was requested, high or second */ |
| 1373 | +#if 0 |
| 1374 | + uint method; /* RTSP method */ |
| 1375 | + uint cseq; /* CSeq from request */ |
| 1376 | +#endif |
| 1377 | +}; |
| 1378 | + |
| 1379 | +/* This structure exists only once per master */ |
| 1380 | +struct ip_ct_rtsp_master |
| 1381 | +{ |
| 1382 | + /* Empty (?) */ |
| 1383 | +}; |
| 1384 | + |
| 1385 | + |
| 1386 | +#ifdef __KERNEL__ |
| 1387 | + |
| 1388 | +#include <linux/netfilter_ipv4/lockhelp.h> |
| 1389 | + |
| 1390 | +#define RTSP_PORT 554 |
| 1391 | + |
| 1392 | +/* Protects rtsp part of conntracks */ |
| 1393 | +DECLARE_LOCK_EXTERN(ip_rtsp_lock); |
| 1394 | + |
| 1395 | +#endif /* __KERNEL__ */ |
| 1396 | + |
| 1397 | +#endif /* _IP_CONNTRACK_RTSP_H */ |
| 1398 | --- /dev/null |
| 1399 | +++ b/include/linux/netfilter_mime.h |
| 1400 | @@ -0,0 +1,90 @@ |
| 1401 | +/* |
| 1402 | + * MIME functions for netfilter modules. This file provides implementations |
| 1403 | + * for basic MIME parsing. MIME headers are used in many protocols, such as |
| 1404 | + * HTTP, RTSP, SIP, etc. |
| 1405 | + * |
| 1406 | + * gcc will warn for defined but unused functions, so we only include the |
| 1407 | + * functions requested. The following macros are used: |
| 1408 | + * NF_NEED_MIME_NEXTLINE nf_mime_nextline() |
| 1409 | + */ |
| 1410 | +#ifndef _NETFILTER_MIME_H |
| 1411 | +#define _NETFILTER_MIME_H |
| 1412 | + |
| 1413 | +/* Only include these functions for kernel code. */ |
| 1414 | +#ifdef __KERNEL__ |
| 1415 | + |
| 1416 | +#include <linux/kernel.h> |
| 1417 | +#include <linux/ctype.h> |
| 1418 | + |
| 1419 | +/* |
| 1420 | + * Given a buffer and length, advance to the next line and mark the current |
| 1421 | + * line. If the current line is empty, *plinelen will be set to zero. If |
| 1422 | + * not, it will be set to the actual line length (including CRLF). |
| 1423 | + * |
| 1424 | + * 'line' in this context means logical line (includes LWS continuations). |
| 1425 | + * Returns 1 on success, 0 on failure. |
| 1426 | + */ |
| 1427 | +#ifdef NF_NEED_MIME_NEXTLINE |
| 1428 | +static int |
| 1429 | +nf_mime_nextline(char* p, uint len, uint* poff, uint* plineoff, uint* plinelen) |
| 1430 | +{ |
| 1431 | + uint off = *poff; |
| 1432 | + uint physlen = 0; |
| 1433 | + int is_first_line = 1; |
| 1434 | + |
| 1435 | + if (off >= len) |
| 1436 | + { |
| 1437 | + return 0; |
| 1438 | + } |
| 1439 | + |
| 1440 | + do |
| 1441 | + { |
| 1442 | + while (p[off] != '\n') |
| 1443 | + { |
| 1444 | + if (len-off <= 1) |
| 1445 | + { |
| 1446 | + return 0; |
| 1447 | + } |
| 1448 | + |
| 1449 | + physlen++; |
| 1450 | + off++; |
| 1451 | + } |
| 1452 | + |
| 1453 | + /* if we saw a crlf, physlen needs adjusted */ |
| 1454 | + if (physlen > 0 && p[off] == '\n' && p[off-1] == '\r') |
| 1455 | + { |
| 1456 | + physlen--; |
| 1457 | + } |
| 1458 | + |
| 1459 | + /* advance past the newline */ |
| 1460 | + off++; |
| 1461 | + |
| 1462 | + /* check for an empty line */ |
| 1463 | + if (physlen == 0) |
| 1464 | + { |
| 1465 | + break; |
| 1466 | + } |
| 1467 | + |
| 1468 | + /* check for colon on the first physical line */ |
| 1469 | + if (is_first_line) |
| 1470 | + { |
| 1471 | + is_first_line = 0; |
| 1472 | + if (memchr(p+(*poff), ':', physlen) == NULL) |
| 1473 | + { |
| 1474 | + return 0; |
| 1475 | + } |
| 1476 | + } |
| 1477 | + } |
| 1478 | + while (p[off] == ' ' || p[off] == '\t'); |
| 1479 | + |
| 1480 | + *plineoff = *poff; |
| 1481 | + *plinelen = (physlen == 0) ? 0 : (off - *poff); |
| 1482 | + *poff = off; |
| 1483 | + |
| 1484 | + return 1; |
| 1485 | +} |
| 1486 | +#endif /* NF_NEED_MIME_NEXTLINE */ |
| 1487 | + |
| 1488 | +#endif /* __KERNEL__ */ |
| 1489 | + |
| 1490 | +#endif /* _NETFILTER_MIME_H */ |
| 1491 | --- a/include/linux/netfilter_ipv4/ip_conntrack.h |
| 1492 | +++ b/include/linux/netfilter_ipv4/ip_conntrack.h |
| 1493 | @@ -68,6 +68,7 @@ union ip_conntrack_expect_proto { |
| 1494 | #include <linux/netfilter_ipv4/ip_conntrack_ftp.h> |
| 1495 | #include <linux/netfilter_ipv4/ip_conntrack_irc.h> |
| 1496 | #include <linux/netfilter_ipv4/ip_conntrack_h323.h> |
| 1497 | +#include <linux/netfilter_ipv4/ip_conntrack_rtsp.h> |
| 1498 | |
| 1499 | /* per expectation: application helper private data */ |
| 1500 | union ip_conntrack_expect_help { |
| 1501 | @@ -76,6 +77,7 @@ union ip_conntrack_expect_help { |
| 1502 | struct ip_ct_ftp_expect exp_ftp_info; |
| 1503 | struct ip_ct_irc_expect exp_irc_info; |
| 1504 | struct ip_ct_h225_expect exp_h225_info; |
| 1505 | + struct ip_ct_rtsp_expect exp_rtsp_info; |
| 1506 | |
| 1507 | #ifdef CONFIG_IP_NF_NAT_NEEDED |
| 1508 | union { |
| 1509 | @@ -90,6 +92,7 @@ union ip_conntrack_help { |
| 1510 | struct ip_ct_ftp_master ct_ftp_info; |
| 1511 | struct ip_ct_irc_master ct_irc_info; |
| 1512 | struct ip_ct_h225_master ct_h225_info; |
| 1513 | + struct ip_ct_rtsp_master ct_rtsp_info; |
| 1514 | }; |
| 1515 | |
| 1516 | #ifdef CONFIG_IP_NF_NAT_NEEDED |
| 1517 | |
