[net-next-2.6.git] / net / ipv4 / netfilter / nf_nat_sip.c

/* SIP extension for NAT alteration.
 *
 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
 * based on RR's ip_nat_ftp.c and other modules.
 * (C) 2007 United Security Providers
 * (C) 2007, 2008 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <net/ip.h>
#include <linux/udp.h>
#include <linux/tcp.h>

#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_helper.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <linux/netfilter/nf_conntrack_sip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
MODULE_DESCRIPTION("SIP NAT helper");
MODULE_ALIAS("ip_nat_sip");


static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
				  const char **dptr, unsigned int *datalen,
				  unsigned int matchoff, unsigned int matchlen,
				  const char *buffer, unsigned int buflen)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	struct tcphdr *th;
	unsigned int baseoff;

	if (nf_ct_protonum(ct) == IPPROTO_TCP) {
		th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
		baseoff = ip_hdrlen(skb) + th->doff * 4;
		matchoff += dataoff - baseoff;

		if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
						matchoff, matchlen,
						buffer, buflen, false))
			return 0;
	} else {
		baseoff = ip_hdrlen(skb) + sizeof(struct udphdr);
		matchoff += dataoff - baseoff;

		if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
					      matchoff, matchlen,
					      buffer, buflen))
			return 0;
	}

	/* Reload data pointer and adjust datalen value */
	*dptr = skb->data + dataoff;
	*datalen += buflen - matchlen;
	return 1;
}

static int map_addr(struct sk_buff *skb, unsigned int dataoff,
		    const char **dptr, unsigned int *datalen,
		    unsigned int matchoff, unsigned int matchlen,
		    union nf_inet_addr *addr, __be16 port)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
	unsigned int buflen;
	__be32 newaddr;
	__be16 newport;

	if (ct->tuplehash[dir].tuple.src.u3.ip == addr->ip &&
	    ct->tuplehash[dir].tuple.src.u.udp.port == port) {
		newaddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
		newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
	} else if (ct->tuplehash[dir].tuple.dst.u3.ip == addr->ip &&
		   ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
		newaddr = ct->tuplehash[!dir].tuple.src.u3.ip;
		newport = ct->tuplehash[!dir].tuple.src.u.udp.port;
	} else
		return 1;

	if (newaddr == addr->ip && newport == port)
		return 1;

	buflen = sprintf(buffer, "%pI4:%u", &newaddr, ntohs(newport));

	return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
			     buffer, buflen);
}

static int map_sip_addr(struct sk_buff *skb, unsigned int dataoff,
			const char **dptr, unsigned int *datalen,
			enum sip_header_types type)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	unsigned int matchlen, matchoff;
	union nf_inet_addr addr;
	__be16 port;

	if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
				    &matchoff, &matchlen, &addr, &port) <= 0)
		return 1;
	return map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
			&addr, port);
}

static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
			       const char **dptr, unsigned int *datalen)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	unsigned int coff, matchoff, matchlen;
	enum sip_header_types hdr;
	union nf_inet_addr addr;
	__be16 port;
	int request, in_header;

	/* Basic rules: requests and responses. */
	if (strnicmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
		if (ct_sip_parse_request(ct, *dptr, *datalen,
					 &matchoff, &matchlen,
					 &addr, &port) > 0 &&
		    !map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
			      &addr, port))
			return NF_DROP;
		request = 1;
	} else
		request = 0;

	if (nf_ct_protonum(ct) == IPPROTO_TCP)
		hdr = SIP_HDR_VIA_TCP;
	else
		hdr = SIP_HDR_VIA_UDP;

	/* Translate topmost Via header and parameters */
	if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
				    hdr, NULL, &matchoff, &matchlen,
				    &addr, &port) > 0) {
		unsigned int matchend, poff, plen, buflen, n;
		char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];

		/* We're only interested in headers related to this
		 * connection */
		if (request) {
			if (addr.ip != ct->tuplehash[dir].tuple.src.u3.ip ||
			    port != ct->tuplehash[dir].tuple.src.u.udp.port)
				goto next;
		} else {
			if (addr.ip != ct->tuplehash[dir].tuple.dst.u3.ip ||
			    port != ct->tuplehash[dir].tuple.dst.u.udp.port)
				goto next;
		}

		if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
			      &addr, port))
			return NF_DROP;

		matchend = matchoff + matchlen;

		/* The maddr= parameter (RFC 2361) specifies where to send
		 * the reply. */
		if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
					       "maddr=", &poff, &plen,
					       &addr) > 0 &&
		    addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
		    addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
			buflen = sprintf(buffer, "%pI4",
					&ct->tuplehash[!dir].tuple.dst.u3.ip);
			if (!mangle_packet(skb, dataoff, dptr, datalen,
					   poff, plen, buffer, buflen))
				return NF_DROP;
		}

		/* The received= parameter (RFC 2361) contains the address
		 * from which the server received the request. */
		if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
					       "received=", &poff, &plen,
					       &addr) > 0 &&
		    addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
		    addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
			buflen = sprintf(buffer, "%pI4",
					&ct->tuplehash[!dir].tuple.src.u3.ip);
			if (!mangle_packet(skb, dataoff, dptr, datalen,
					   poff, plen, buffer, buflen))
				return NF_DROP;
		}

		/* The rport= parameter (RFC 3581) contains the port number
		 * from which the server received the request. */
		if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
						 "rport=", &poff, &plen,
						 &n) > 0 &&
		    htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
		    htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
			__be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
			buflen = sprintf(buffer, "%u", ntohs(p));
			if (!mangle_packet(skb, dataoff, dptr, datalen,
					   poff, plen, buffer, buflen))
				return NF_DROP;
		}
	}

next:
	/* Translate Contact headers */
	coff = 0;
	in_header = 0;
	while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
				       SIP_HDR_CONTACT, &in_header,
				       &matchoff, &matchlen,
				       &addr, &port) > 0) {
		if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
			      &addr, port))
			return NF_DROP;
	}

	if (!map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_FROM) ||
	    !map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_TO))
		return NF_DROP;

	return NF_ACCEPT;
}

static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	const struct tcphdr *th;

	if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
		return;

	th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
	nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
}

/* Handles expected signalling connections and media streams */
static void ip_nat_sip_expected(struct nf_conn *ct,
				struct nf_conntrack_expect *exp)
{
	struct nf_nat_range range;

	/* This must be a fresh one. */
	BUG_ON(ct->status & IPS_NAT_DONE_MASK);

	/* For DST manip, map port here to where it's expected. */
	range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
	range.min = range.max = exp->saved_proto;
	range.min_ip = range.max_ip = exp->saved_ip;
	nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);

	/* Change src to where master sends to, but only if the connection
	 * actually came from the same source. */
	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip ==
	    ct->master->tuplehash[exp->dir].tuple.src.u3.ip) {
		range.flags = IP_NAT_RANGE_MAP_IPS;
		range.min_ip = range.max_ip
			= ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
		nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
	}
}

static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
				      const char **dptr, unsigned int *datalen,
				      struct nf_conntrack_expect *exp,
				      unsigned int matchoff,
				      unsigned int matchlen)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	__be32 newip;
	u_int16_t port;
	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
	unsigned buflen;

	/* Connection will come from reply */
	if (ct->tuplehash[dir].tuple.src.u3.ip == ct->tuplehash[!dir].tuple.dst.u3.ip)
		newip = exp->tuple.dst.u3.ip;
	else
		newip = ct->tuplehash[!dir].tuple.dst.u3.ip;

	/* If the signalling port matches the connection's source port in the
	 * original direction, try to use the destination port in the opposite
	 * direction. */
	if (exp->tuple.dst.u.udp.port ==
	    ct->tuplehash[dir].tuple.src.u.udp.port)
		port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
	else
		port = ntohs(exp->tuple.dst.u.udp.port);

	exp->saved_ip = exp->tuple.dst.u3.ip;
	exp->tuple.dst.u3.ip = newip;
	exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
	exp->dir = !dir;
	exp->expectfn = ip_nat_sip_expected;

	for (; port != 0; port++) {
		exp->tuple.dst.u.udp.port = htons(port);
		if (nf_ct_expect_related(exp) == 0)
			break;
	}

	if (port == 0)
		return NF_DROP;

	if (exp->tuple.dst.u3.ip != exp->saved_ip ||
	    exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
		buflen = sprintf(buffer, "%pI4:%u", &newip, port);
		if (!mangle_packet(skb, dataoff, dptr, datalen,
				   matchoff, matchlen, buffer, buflen))
			goto err;
	}
	return NF_ACCEPT;

err:
	nf_ct_unexpect_related(exp);
	return NF_DROP;
}

static int mangle_content_len(struct sk_buff *skb, unsigned int dataoff,
			      const char **dptr, unsigned int *datalen)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	unsigned int matchoff, matchlen;
	char buffer[sizeof("65536")];
	int buflen, c_len;

	/* Get actual SDP length */
	if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
				  SDP_HDR_VERSION, SDP_HDR_UNSPEC,
				  &matchoff, &matchlen) <= 0)
		return 0;
	c_len = *datalen - matchoff + strlen("v=");

	/* Now, update SDP length */
	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CONTENT_LENGTH,
			      &matchoff, &matchlen) <= 0)
		return 0;

	buflen = sprintf(buffer, "%u", c_len);
	return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
			     buffer, buflen);
}

static int mangle_sdp_packet(struct sk_buff *skb, unsigned int dataoff,
			     const char **dptr, unsigned int *datalen,
			     unsigned int sdpoff,
			     enum sdp_header_types type,
			     enum sdp_header_types term,
			     char *buffer, int buflen)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	unsigned int matchlen, matchoff;

	if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
				  &matchoff, &matchlen) <= 0)
		return -ENOENT;
	return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
			     buffer, buflen) ? 0 : -EINVAL;
}

static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, unsigned int dataoff,
				    const char **dptr, unsigned int *datalen,
				    unsigned int sdpoff,
				    enum sdp_header_types type,
				    enum sdp_header_types term,
				    const union nf_inet_addr *addr)
{
	char buffer[sizeof("nnn.nnn.nnn.nnn")];
	unsigned int buflen;

	buflen = sprintf(buffer, "%pI4", &addr->ip);
	if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff, type, term,
			      buffer, buflen))
		return 0;

	return mangle_content_len(skb, dataoff, dptr, datalen);
}

static unsigned int ip_nat_sdp_port(struct sk_buff *skb, unsigned int dataoff,
				    const char **dptr, unsigned int *datalen,
				    unsigned int matchoff,
				    unsigned int matchlen,
				    u_int16_t port)
{
	char buffer[sizeof("nnnnn")];
	unsigned int buflen;

	buflen = sprintf(buffer, "%u", port);
	if (!mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
			   buffer, buflen))
		return 0;

	return mangle_content_len(skb, dataoff, dptr, datalen);
}

static unsigned int ip_nat_sdp_session(struct sk_buff *skb, unsigned int dataoff,
				       const char **dptr, unsigned int *datalen,
				       unsigned int sdpoff,
				       const union nf_inet_addr *addr)
{
	char buffer[sizeof("nnn.nnn.nnn.nnn")];
	unsigned int buflen;

	/* Mangle session description owner and contact addresses */
	buflen = sprintf(buffer, "%pI4", &addr->ip);
	if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
			       SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
			       buffer, buflen))
		return 0;

	switch (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
				  SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
				  buffer, buflen)) {
	case 0:
	/*
	 * RFC 2327:
	 *
	 * Session description
	 *
	 * c=* (connection information - not required if included in all media)
	 */
	case -ENOENT:
		break;
	default:
		return 0;
	}

	return mangle_content_len(skb, dataoff, dptr, datalen);
}

/* So, this packet has hit the connection tracking matching code.
   Mangle it, and change the expectation to match the new version. */
static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
				     const char **dptr, unsigned int *datalen,
				     struct nf_conntrack_expect *rtp_exp,
				     struct nf_conntrack_expect *rtcp_exp,
				     unsigned int mediaoff,
				     unsigned int medialen,
				     union nf_inet_addr *rtp_addr)
{
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	u_int16_t port;

	/* Connection will come from reply */
	if (ct->tuplehash[dir].tuple.src.u3.ip ==
	    ct->tuplehash[!dir].tuple.dst.u3.ip)
		rtp_addr->ip = rtp_exp->tuple.dst.u3.ip;
	else
		rtp_addr->ip = ct->tuplehash[!dir].tuple.dst.u3.ip;

	rtp_exp->saved_ip = rtp_exp->tuple.dst.u3.ip;
	rtp_exp->tuple.dst.u3.ip = rtp_addr->ip;
	rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
	rtp_exp->dir = !dir;
	rtp_exp->expectfn = ip_nat_sip_expected;

	rtcp_exp->saved_ip = rtcp_exp->tuple.dst.u3.ip;
	rtcp_exp->tuple.dst.u3.ip = rtp_addr->ip;
	rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
	rtcp_exp->dir = !dir;
	rtcp_exp->expectfn = ip_nat_sip_expected;

	/* Try to get same pair of ports: if not, try to change them. */
	for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
	     port != 0; port += 2) {
		rtp_exp->tuple.dst.u.udp.port = htons(port);
		if (nf_ct_expect_related(rtp_exp) != 0)
			continue;
		rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
		if (nf_ct_expect_related(rtcp_exp) == 0)
			break;
		nf_ct_unexpect_related(rtp_exp);
	}

	if (port == 0)
		goto err1;

	/* Update media port. */
	if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
	    !ip_nat_sdp_port(skb, dataoff, dptr, datalen,
			     mediaoff, medialen, port))
		goto err2;

	return NF_ACCEPT;

err2:
	nf_ct_unexpect_related(rtp_exp);
	nf_ct_unexpect_related(rtcp_exp);
err1:
	return NF_DROP;
}

static void __exit nf_nat_sip_fini(void)
{
	rcu_assign_pointer(nf_nat_sip_hook, NULL);
	rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, NULL);
	rcu_assign_pointer(nf_nat_sip_expect_hook, NULL);
	rcu_assign_pointer(nf_nat_sdp_addr_hook, NULL);
	rcu_assign_pointer(nf_nat_sdp_port_hook, NULL);
	rcu_assign_pointer(nf_nat_sdp_session_hook, NULL);
	rcu_assign_pointer(nf_nat_sdp_media_hook, NULL);
	synchronize_rcu();
}

static int __init nf_nat_sip_init(void)
{
	BUG_ON(nf_nat_sip_hook != NULL);
	BUG_ON(nf_nat_sip_seq_adjust_hook != NULL);
	BUG_ON(nf_nat_sip_expect_hook != NULL);
	BUG_ON(nf_nat_sdp_addr_hook != NULL);
	BUG_ON(nf_nat_sdp_port_hook != NULL);
	BUG_ON(nf_nat_sdp_session_hook != NULL);
	BUG_ON(nf_nat_sdp_media_hook != NULL);
	rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
	rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
	rcu_assign_pointer(nf_nat_sip_expect_hook, ip_nat_sip_expect);
	rcu_assign_pointer(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
	rcu_assign_pointer(nf_nat_sdp_port_hook, ip_nat_sdp_port);
	rcu_assign_pointer(nf_nat_sdp_session_hook, ip_nat_sdp_session);
	rcu_assign_pointer(nf_nat_sdp_media_hook, ip_nat_sdp_media);
	return 0;
}

module_init(nf_nat_sip_init);
module_exit(nf_nat_sip_fini);
Commit	Line	Data
48f8ac26	1	/* SIP extension for NAT alteration.
9fafcd7b PM	2	*
	3	* (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
	4	* based on RR's ip_nat_ftp.c and other modules.
f49e1aa1 PM	5	* (C) 2007 United Security Providers
f49e1aa1 PM	6	* (C) 2007, 2008 Patrick McHardy <kaber@trash.net>
9fafcd7b PM	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License version 2 as
	10	* published by the Free Software Foundation.
	11	*/
	12
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/ip.h>
c9bdd4b5	16	#include <net/ip.h>
9fafcd7b	17	#include <linux/udp.h>
48f8ac26	18	#include <linux/tcp.h>
9fafcd7b PM	19
	20	#include <net/netfilter/nf_nat.h>
	21	#include <net/netfilter/nf_nat_helper.h>
	22	#include <net/netfilter/nf_nat_rule.h>
	23	#include <net/netfilter/nf_conntrack_helper.h>
	24	#include <net/netfilter/nf_conntrack_expect.h>
	25	#include <linux/netfilter/nf_conntrack_sip.h>
	26
	27	MODULE_LICENSE("GPL");
	28	MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
	29	MODULE_DESCRIPTION("SIP NAT helper");
	30	MODULE_ALIAS("ip_nat_sip");
	31
9fafcd7b	32
3b6b9fab	33	static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
2a6cfb22 PM	34	const char *dptr, unsigned int datalen,
	35	unsigned int matchoff, unsigned int matchlen,
	36	const char *buffer, unsigned int buflen)
	37	{
	38	enum ip_conntrack_info ctinfo;
	39	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
48f8ac26 PM	40	struct tcphdr *th;
	41	unsigned int baseoff;
	42
	43	if (nf_ct_protonum(ct) == IPPROTO_TCP) {
	44	th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
	45	baseoff = ip_hdrlen(skb) + th->doff * 4;
	46	matchoff += dataoff - baseoff;
	47
	48	if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
	49	matchoff, matchlen,
	50	buffer, buflen, false))
	51	return 0;
	52	} else {
	53	baseoff = ip_hdrlen(skb) + sizeof(struct udphdr);
	54	matchoff += dataoff - baseoff;
	55
	56	if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
	57	matchoff, matchlen,
	58	buffer, buflen))
	59	return 0;
	60	}
2a6cfb22 PM	61
2a6cfb22 PM	62	/* Reload data pointer and adjust datalen value */
3b6b9fab	63	*dptr = skb->data + dataoff;
2a6cfb22 PM	64	*datalen += buflen - matchlen;
	65	return 1;
	66	}
	67
3b6b9fab	68	static int map_addr(struct sk_buff *skb, unsigned int dataoff,
ac367740 PM	69	const char *dptr, unsigned int datalen,
ac367740 PM	70	unsigned int matchoff, unsigned int matchlen,
624f8b7b	71	union nf_inet_addr *addr, __be16 port)
9fafcd7b	72	{
212440a7	73	enum ip_conntrack_info ctinfo;
624f8b7b	74	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
9fafcd7b	75	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
624f8b7b PM	76	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
	77	unsigned int buflen;
	78	__be32 newaddr;
	79	__be16 newport;
	80
	81	if (ct->tuplehash[dir].tuple.src.u3.ip == addr->ip &&
	82	ct->tuplehash[dir].tuple.src.u.udp.port == port) {
	83	newaddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
	84	newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
	85	} else if (ct->tuplehash[dir].tuple.dst.u3.ip == addr->ip &&
	86	ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
	87	newaddr = ct->tuplehash[!dir].tuple.src.u3.ip;
	88	newport = ct->tuplehash[!dir].tuple.src.u.udp.port;
9fafcd7b PM	89	} else
	90	return 1;
	91
624f8b7b PM	92	if (newaddr == addr->ip && newport == port)
	93	return 1;
	94
cffee385	95	buflen = sprintf(buffer, "%pI4:%u", &newaddr, ntohs(newport));
624f8b7b	96
3b6b9fab	97	return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
624f8b7b	98	buffer, buflen);
9fafcd7b PM	99	}
9fafcd7b PM	100
3b6b9fab	101	static int map_sip_addr(struct sk_buff *skb, unsigned int dataoff,
ac367740	102	const char *dptr, unsigned int datalen,
624f8b7b	103	enum sip_header_types type)
ac367740 PM	104	{
	105	enum ip_conntrack_info ctinfo;
	106	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	107	unsigned int matchlen, matchoff;
624f8b7b PM	108	union nf_inet_addr addr;
624f8b7b PM	109	__be16 port;
ac367740	110
624f8b7b PM	111	if (ct_sip_parse_header_uri(ct, dptr, NULL, datalen, type, NULL,
624f8b7b PM	112	&matchoff, &matchlen, &addr, &port) <= 0)
ac367740	113	return 1;
3b6b9fab PM	114	return map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
3b6b9fab PM	115	&addr, port);
ac367740 PM	116	}
ac367740 PM	117
3b6b9fab	118	static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
2a6cfb22	119	const char *dptr, unsigned int datalen)
9fafcd7b	120	{
212440a7 PM	121	enum ip_conntrack_info ctinfo;
212440a7 PM	122	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
720ac708	123	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
3b6b9fab	124	unsigned int coff, matchoff, matchlen;
48f8ac26	125	enum sip_header_types hdr;
624f8b7b PM	126	union nf_inet_addr addr;
624f8b7b PM	127	__be16 port;
c978cd3a	128	int request, in_header;
9fafcd7b	129
9fafcd7b	130	/* Basic rules: requests and responses. */
779382eb	131	if (strnicmp(*dptr, "SIP/2.0", strlen("SIP/2.0")) != 0) {
ac367740	132	if (ct_sip_parse_request(ct, dptr, datalen,
624f8b7b PM	133	&matchoff, &matchlen,
624f8b7b PM	134	&addr, &port) > 0 &&
3b6b9fab	135	!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
624f8b7b	136	&addr, port))
9fafcd7b	137	return NF_DROP;
720ac708 PM	138	request = 1;
	139	} else
	140	request = 0;
	141
48f8ac26 PM	142	if (nf_ct_protonum(ct) == IPPROTO_TCP)
	143	hdr = SIP_HDR_VIA_TCP;
	144	else
	145	hdr = SIP_HDR_VIA_UDP;
	146
720ac708 PM	147	/* Translate topmost Via header and parameters */
720ac708 PM	148	if (ct_sip_parse_header_uri(ct, dptr, NULL, datalen,
48f8ac26	149	hdr, NULL, &matchoff, &matchlen,
720ac708 PM	150	&addr, &port) > 0) {
	151	unsigned int matchend, poff, plen, buflen, n;
	152	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
	153
	154	/* We're only interested in headers related to this
	155	* connection */
	156	if (request) {
	157	if (addr.ip != ct->tuplehash[dir].tuple.src.u3.ip \|\|
	158	port != ct->tuplehash[dir].tuple.src.u.udp.port)
	159	goto next;
	160	} else {
	161	if (addr.ip != ct->tuplehash[dir].tuple.dst.u3.ip \|\|
	162	port != ct->tuplehash[dir].tuple.dst.u.udp.port)
	163	goto next;
	164	}
	165
3b6b9fab	166	if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
720ac708 PM	167	&addr, port))
	168	return NF_DROP;
	169
	170	matchend = matchoff + matchlen;
	171
	172	/* The maddr= parameter (RFC 2361) specifies where to send
	173	* the reply. */
	174	if (ct_sip_parse_address_param(ct, dptr, matchend, datalen,
	175	"maddr=", &poff, &plen,
	176	&addr) > 0 &&
	177	addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
	178	addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
cffee385 HH	179	buflen = sprintf(buffer, "%pI4",
cffee385 HH	180	&ct->tuplehash[!dir].tuple.dst.u3.ip);
3b6b9fab PM	181	if (!mangle_packet(skb, dataoff, dptr, datalen,
3b6b9fab PM	182	poff, plen, buffer, buflen))
720ac708 PM	183	return NF_DROP;
	184	}
	185
	186	/* The received= parameter (RFC 2361) contains the address
	187	* from which the server received the request. */
	188	if (ct_sip_parse_address_param(ct, dptr, matchend, datalen,
	189	"received=", &poff, &plen,
	190	&addr) > 0 &&
	191	addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
	192	addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
cffee385 HH	193	buflen = sprintf(buffer, "%pI4",
cffee385 HH	194	&ct->tuplehash[!dir].tuple.src.u3.ip);
3b6b9fab PM	195	if (!mangle_packet(skb, dataoff, dptr, datalen,
3b6b9fab PM	196	poff, plen, buffer, buflen))
720ac708 PM	197	return NF_DROP;
	198	}
	199
	200	/* The rport= parameter (RFC 3581) contains the port number
	201	* from which the server received the request. */
	202	if (ct_sip_parse_numerical_param(ct, dptr, matchend, datalen,
	203	"rport=", &poff, &plen,
	204	&n) > 0 &&
	205	htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
	206	htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
	207	__be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
	208	buflen = sprintf(buffer, "%u", ntohs(p));
3b6b9fab PM	209	if (!mangle_packet(skb, dataoff, dptr, datalen,
3b6b9fab PM	210	poff, plen, buffer, buflen))
720ac708 PM	211	return NF_DROP;
720ac708 PM	212	}
9fafcd7b PM	213	}
9fafcd7b PM	214
720ac708	215	next:
c978cd3a	216	/* Translate Contact headers */
3b6b9fab	217	coff = 0;
c978cd3a	218	in_header = 0;
3b6b9fab	219	while (ct_sip_parse_header_uri(ct, dptr, &coff, datalen,
c978cd3a PM	220	SIP_HDR_CONTACT, &in_header,
	221	&matchoff, &matchlen,
	222	&addr, &port) > 0) {
3b6b9fab	223	if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
c978cd3a PM	224	&addr, port))
	225	return NF_DROP;
	226	}
	227
3b6b9fab PM	228	if (!map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_FROM) \|\|
3b6b9fab PM	229	!map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_TO))
9fafcd7b	230	return NF_DROP;
48f8ac26	231
9fafcd7b PM	232	return NF_ACCEPT;
	233	}
	234
48f8ac26 PM	235	static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
	236	{
	237	enum ip_conntrack_info ctinfo;
	238	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	239	const struct tcphdr *th;
	240
	241	if (nf_ct_protonum(ct) != IPPROTO_TCP \|\| off == 0)
	242	return;
	243
	244	th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
	245	nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
	246	}
	247
0f32a40f PM	248	/* Handles expected signalling connections and media streams */
	249	static void ip_nat_sip_expected(struct nf_conn *ct,
	250	struct nf_conntrack_expect *exp)
	251	{
	252	struct nf_nat_range range;
	253
	254	/* This must be a fresh one. */
	255	BUG_ON(ct->status & IPS_NAT_DONE_MASK);
	256
	257	/* For DST manip, map port here to where it's expected. */
	258	range.flags = (IP_NAT_RANGE_MAP_IPS \| IP_NAT_RANGE_PROTO_SPECIFIED);
	259	range.min = range.max = exp->saved_proto;
	260	range.min_ip = range.max_ip = exp->saved_ip;
	261	nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
	262
	263	/* Change src to where master sends to, but only if the connection
	264	* actually came from the same source. */
	265	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip ==
	266	ct->master->tuplehash[exp->dir].tuple.src.u3.ip) {
	267	range.flags = IP_NAT_RANGE_MAP_IPS;
	268	range.min_ip = range.max_ip
	269	= ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
	270	nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
	271	}
	272	}
	273
3b6b9fab	274	static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
0f32a40f PM	275	const char *dptr, unsigned int datalen,
	276	struct nf_conntrack_expect *exp,
	277	unsigned int matchoff,
	278	unsigned int matchlen)
	279	{
	280	enum ip_conntrack_info ctinfo;
	281	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	282	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	283	__be32 newip;
	284	u_int16_t port;
	285	char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
	286	unsigned buflen;
	287
	288	/* Connection will come from reply */
	289	if (ct->tuplehash[dir].tuple.src.u3.ip == ct->tuplehash[!dir].tuple.dst.u3.ip)
	290	newip = exp->tuple.dst.u3.ip;
	291	else
	292	newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
	293
	294	/* If the signalling port matches the connection's source port in the
	295	* original direction, try to use the destination port in the opposite
	296	* direction. */
	297	if (exp->tuple.dst.u.udp.port ==
	298	ct->tuplehash[dir].tuple.src.u.udp.port)
	299	port = ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port);
	300	else
	301	port = ntohs(exp->tuple.dst.u.udp.port);
	302
	303	exp->saved_ip = exp->tuple.dst.u3.ip;
	304	exp->tuple.dst.u3.ip = newip;
	305	exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
	306	exp->dir = !dir;
	307	exp->expectfn = ip_nat_sip_expected;
	308
	309	for (; port != 0; port++) {
	310	exp->tuple.dst.u.udp.port = htons(port);
	311	if (nf_ct_expect_related(exp) == 0)
	312	break;
	313	}
	314
	315	if (port == 0)
	316	return NF_DROP;
	317
	318	if (exp->tuple.dst.u3.ip != exp->saved_ip \|\|
	319	exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
cffee385	320	buflen = sprintf(buffer, "%pI4:%u", &newip, port);
3b6b9fab PM	321	if (!mangle_packet(skb, dataoff, dptr, datalen,
3b6b9fab PM	322	matchoff, matchlen, buffer, buflen))
0f32a40f PM	323	goto err;
	324	}
	325	return NF_ACCEPT;
	326
	327	err:
	328	nf_ct_unexpect_related(exp);
	329	return NF_DROP;
	330	}
	331
3b6b9fab	332	static int mangle_content_len(struct sk_buff *skb, unsigned int dataoff,
3e9b4600	333	const char *dptr, unsigned int datalen)
9fafcd7b	334	{
212440a7 PM	335	enum ip_conntrack_info ctinfo;
212440a7 PM	336	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
3e9b4600 PM	337	unsigned int matchoff, matchlen;
	338	char buffer[sizeof("65536")];
	339	int buflen, c_len;
9fafcd7b	340
3e9b4600 PM	341	/* Get actual SDP length */
	342	if (ct_sip_get_sdp_header(ct, dptr, 0, datalen,
	343	SDP_HDR_VERSION, SDP_HDR_UNSPEC,
	344	&matchoff, &matchlen) <= 0)
	345	return 0;
	346	c_len = *datalen - matchoff + strlen("v=");
	347
	348	/* Now, update SDP length */
ea45f12a PM	349	if (ct_sip_get_header(ct, dptr, 0, datalen, SIP_HDR_CONTENT_LENGTH,
ea45f12a PM	350	&matchoff, &matchlen) <= 0)
9fafcd7b PM	351	return 0;
9fafcd7b PM	352
3e9b4600	353	buflen = sprintf(buffer, "%u", c_len);
3b6b9fab	354	return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
3e9b4600	355	buffer, buflen);
9fafcd7b PM	356	}
9fafcd7b PM	357
3b6b9fab PM	358	static int mangle_sdp_packet(struct sk_buff *skb, unsigned int dataoff,
	359	const char *dptr, unsigned int datalen,
	360	unsigned int sdpoff,
c71529e4 HX	361	enum sdp_header_types type,
	362	enum sdp_header_types term,
	363	char *buffer, int buflen)
9fafcd7b	364	{
212440a7 PM	365	enum ip_conntrack_info ctinfo;
212440a7 PM	366	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
3e9b4600	367	unsigned int matchlen, matchoff;
9fafcd7b	368
3b6b9fab	369	if (ct_sip_get_sdp_header(ct, dptr, sdpoff, datalen, type, term,
3e9b4600	370	&matchoff, &matchlen) <= 0)
c71529e4	371	return -ENOENT;
3b6b9fab	372	return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
c71529e4	373	buffer, buflen) ? 0 : -EINVAL;
9fafcd7b PM	374	}
9fafcd7b PM	375
3b6b9fab PM	376	static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, unsigned int dataoff,
	377	const char *dptr, unsigned int datalen,
	378	unsigned int sdpoff,
4ab9e64e PM	379	enum sdp_header_types type,
	380	enum sdp_header_types term,
	381	const union nf_inet_addr *addr)
9fafcd7b PM	382	{
9fafcd7b PM	383	char buffer[sizeof("nnn.nnn.nnn.nnn")];
4ab9e64e	384	unsigned int buflen;
9fafcd7b	385
cffee385	386	buflen = sprintf(buffer, "%pI4", &addr->ip);
3b6b9fab	387	if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff, type, term,
c71529e4	388	buffer, buflen))
9fafcd7b PM	389	return 0;
9fafcd7b PM	390
3b6b9fab	391	return mangle_content_len(skb, dataoff, dptr, datalen);
4ab9e64e PM	392	}
4ab9e64e PM	393
3b6b9fab PM	394	static unsigned int ip_nat_sdp_port(struct sk_buff *skb, unsigned int dataoff,
3b6b9fab PM	395	const char *dptr, unsigned int datalen,
4ab9e64e PM	396	unsigned int matchoff,
	397	unsigned int matchlen,
	398	u_int16_t port)
	399	{
	400	char buffer[sizeof("nnnnn")];
	401	unsigned int buflen;
	402
	403	buflen = sprintf(buffer, "%u", port);
3b6b9fab	404	if (!mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
4ab9e64e	405	buffer, buflen))
9fafcd7b PM	406	return 0;
9fafcd7b PM	407
3b6b9fab	408	return mangle_content_len(skb, dataoff, dptr, datalen);
4ab9e64e PM	409	}
4ab9e64e PM	410
3b6b9fab PM	411	static unsigned int ip_nat_sdp_session(struct sk_buff *skb, unsigned int dataoff,
	412	const char *dptr, unsigned int datalen,
	413	unsigned int sdpoff,
4ab9e64e PM	414	const union nf_inet_addr *addr)
	415	{
	416	char buffer[sizeof("nnn.nnn.nnn.nnn")];
	417	unsigned int buflen;
	418
	419	/* Mangle session description owner and contact addresses */
cffee385	420	buflen = sprintf(buffer, "%pI4", &addr->ip);
3b6b9fab	421	if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
4ab9e64e PM	422	SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
	423	buffer, buflen))
	424	return 0;
	425
3b6b9fab	426	switch (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
c71529e4 HX	427	SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
	428	buffer, buflen)) {
	429	case 0:
	430	/*
	431	* RFC 2327:
	432	*
	433	* Session description
	434	*
	435	* c=* (connection information - not required if included in all media)
	436	*/
	437	case -ENOENT:
	438	break;
	439	default:
9fafcd7b	440	return 0;
c71529e4	441	}
9fafcd7b	442
3b6b9fab	443	return mangle_content_len(skb, dataoff, dptr, datalen);
9fafcd7b PM	444	}
	445
	446	/* So, this packet has hit the connection tracking matching code.
	447	Mangle it, and change the expectation to match the new version. */
3b6b9fab PM	448	static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
3b6b9fab PM	449	const char *dptr, unsigned int datalen,
4ab9e64e PM	450	struct nf_conntrack_expect *rtp_exp,
	451	struct nf_conntrack_expect *rtcp_exp,
	452	unsigned int mediaoff,
	453	unsigned int medialen,
	454	union nf_inet_addr *rtp_addr)
9fafcd7b	455	{
212440a7 PM	456	enum ip_conntrack_info ctinfo;
212440a7 PM	457	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
9fafcd7b	458	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
9fafcd7b PM	459	u_int16_t port;
9fafcd7b PM	460
9fafcd7b	461	/* Connection will come from reply */
f4a607bf JB	462	if (ct->tuplehash[dir].tuple.src.u3.ip ==
f4a607bf JB	463	ct->tuplehash[!dir].tuple.dst.u3.ip)
4ab9e64e	464	rtp_addr->ip = rtp_exp->tuple.dst.u3.ip;
f4a607bf	465	else
4ab9e64e	466	rtp_addr->ip = ct->tuplehash[!dir].tuple.dst.u3.ip;
9fafcd7b	467
a9c1d359	468	rtp_exp->saved_ip = rtp_exp->tuple.dst.u3.ip;
4ab9e64e	469	rtp_exp->tuple.dst.u3.ip = rtp_addr->ip;
a9c1d359 PM	470	rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
	471	rtp_exp->dir = !dir;
	472	rtp_exp->expectfn = ip_nat_sip_expected;
	473
	474	rtcp_exp->saved_ip = rtcp_exp->tuple.dst.u3.ip;
4ab9e64e	475	rtcp_exp->tuple.dst.u3.ip = rtp_addr->ip;
a9c1d359 PM	476	rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
	477	rtcp_exp->dir = !dir;
	478	rtcp_exp->expectfn = ip_nat_sip_expected;
	479
	480	/* Try to get same pair of ports: if not, try to change them. */
	481	for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
	482	port != 0; port += 2) {
	483	rtp_exp->tuple.dst.u.udp.port = htons(port);
	484	if (nf_ct_expect_related(rtp_exp) != 0)
	485	continue;
	486	rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
	487	if (nf_ct_expect_related(rtcp_exp) == 0)
9fafcd7b	488	break;
a9c1d359	489	nf_ct_unexpect_related(rtp_exp);
9fafcd7b PM	490	}
	491
	492	if (port == 0)
4ab9e64e PM	493	goto err1;
	494
	495	/* Update media port. */
	496	if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
3b6b9fab PM	497	!ip_nat_sdp_port(skb, dataoff, dptr, datalen,
3b6b9fab PM	498	mediaoff, medialen, port))
4ab9e64e	499	goto err2;
9fafcd7b	500
9fafcd7b	501	return NF_ACCEPT;
4ab9e64e PM	502
	503	err2:
	504	nf_ct_unexpect_related(rtp_exp);
	505	nf_ct_unexpect_related(rtcp_exp);
	506	err1:
	507	return NF_DROP;
9fafcd7b PM	508	}
	509
	510	static void __exit nf_nat_sip_fini(void)
	511	{
	512	rcu_assign_pointer(nf_nat_sip_hook, NULL);
48f8ac26	513	rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, NULL);
0f32a40f	514	rcu_assign_pointer(nf_nat_sip_expect_hook, NULL);
4ab9e64e	515	rcu_assign_pointer(nf_nat_sdp_addr_hook, NULL);
c7f485ab	516	rcu_assign_pointer(nf_nat_sdp_port_hook, NULL);
4ab9e64e PM	517	rcu_assign_pointer(nf_nat_sdp_session_hook, NULL);
4ab9e64e PM	518	rcu_assign_pointer(nf_nat_sdp_media_hook, NULL);
9fafcd7b PM	519	synchronize_rcu();
	520	}
	521
	522	static int __init nf_nat_sip_init(void)
	523	{
d1332e0a	524	BUG_ON(nf_nat_sip_hook != NULL);
48f8ac26	525	BUG_ON(nf_nat_sip_seq_adjust_hook != NULL);
0f32a40f	526	BUG_ON(nf_nat_sip_expect_hook != NULL);
4ab9e64e	527	BUG_ON(nf_nat_sdp_addr_hook != NULL);
c7f485ab	528	BUG_ON(nf_nat_sdp_port_hook != NULL);
4ab9e64e PM	529	BUG_ON(nf_nat_sdp_session_hook != NULL);
4ab9e64e PM	530	BUG_ON(nf_nat_sdp_media_hook != NULL);
9fafcd7b	531	rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
48f8ac26	532	rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
0f32a40f	533	rcu_assign_pointer(nf_nat_sip_expect_hook, ip_nat_sip_expect);
4ab9e64e	534	rcu_assign_pointer(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
c7f485ab	535	rcu_assign_pointer(nf_nat_sdp_port_hook, ip_nat_sdp_port);
4ab9e64e PM	536	rcu_assign_pointer(nf_nat_sdp_session_hook, ip_nat_sdp_session);
4ab9e64e PM	537	rcu_assign_pointer(nf_nat_sdp_media_hook, ip_nat_sdp_media);
9fafcd7b PM	538	return 0;
	539	}
	540
	541	module_init(nf_nat_sip_init);
	542	module_exit(nf_nat_sip_fini);