[NETFILTER]: Add SIP connection tracking helper (ae5b7d8b) · Commits · e / devices / android_kernel_samsung_herolte

include/linux/netfilter_ipv4/ip_conntrack_sip.h

0 → 100644

+44 −0

Original line number	Diff line number	Diff line
		#ifndef __IP_CONNTRACK_SIP_H__
		#define __IP_CONNTRACK_SIP_H__
		#ifdef __KERNEL__

		#define SIP_PORT 5060
		#define SIP_TIMEOUT 3600

		#define POS_VIA 0
		#define POS_CONTACT 1
		#define POS_CONTENT 2
		#define POS_MEDIA 3
		#define POS_OWNER 4
		#define POS_CONNECTION 5
		#define POS_REQ_HEADER 6
		#define POS_SDP_HEADER 7

		struct sip_header_nfo {
		const char *lname;
		const char *sname;
		const char *ln_str;
		size_t lnlen;
		size_t snlen;
		size_t ln_strlen;
		int (match_len)(const char , const char , int );
		};

		extern unsigned int (ip_nat_sip_hook)(struct sk_buff *pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack *ct,
		const char **dptr);
		extern unsigned int (ip_nat_sdp_hook)(struct sk_buff *pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack_expect *exp,
		const char *dptr);

		extern int ct_sip_get_info(const char *dptr, size_t dlen,
		unsigned int *matchoff,
		unsigned int *matchlen,
		struct sip_header_nfo *hnfo);
		extern int ct_sip_lnlen(const char line, const char limit);
		extern const char ct_sip_search(const char needle, const char *haystack,
		size_t needle_len, size_t haystack_len);
		#endif /* __KERNEL__ */
		#endif /* __IP_CONNTRACK_SIP_H__ */

net/ipv4/netfilter/Kconfig

+18 −0

Original line number	Diff line number	Diff line
		@@ -191,6 +191,18 @@ config IP_NF_H323
		If you want to compile it as a module, say 'M' here and read
		Documentation/modules.txt. If unsure, say 'N'.

		config IP_NF_SIP
		tristate "SIP protocol support (EXPERIMENTAL)"
		depends on IP_NF_CONNTRACK && EXPERIMENTAL
		help
		SIP is an application-layer control protocol that can establish,
		modify, and terminate multimedia sessions (conferences) such as
		Internet telephony calls. With the ip_conntrack_sip and
		the ip_nat_sip modules you can support the protocol on a connection
		tracking/NATing firewall.

		To compile it as a module, choose M here. If unsure, say Y.

		config IP_NF_QUEUE
		tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
		help
		@@ -503,6 +515,12 @@ config IP_NF_NAT_H323
		default IP_NF_NAT if IP_NF_H323=y
		default m if IP_NF_H323=m

		config IP_NF_NAT_SIP
		tristate
		depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
		default IP_NF_NAT if IP_NF_SIP=y
		default m if IP_NF_SIP=m

		# mangle + specific targets
		config IP_NF_MANGLE
		tristate "Packet mangling"

net/ipv4/netfilter/Makefile

+2 −0

Original line number	Diff line number	Diff line
		@@ -31,6 +31,7 @@ obj-$(CONFIG_IP_NF_AMANDA) += ip_conntrack_amanda.o
		obj-$(CONFIG_IP_NF_TFTP) += ip_conntrack_tftp.o
		obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o
		obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o
		obj-$(CONFIG_IP_NF_SIP) += ip_conntrack_sip.o
		obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o

		# NAT helpers
		@@ -40,6 +41,7 @@ obj-$(CONFIG_IP_NF_NAT_AMANDA) += ip_nat_amanda.o
		obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o
		obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
		obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
		obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o

		# generic IP tables
		obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o

net/ipv4/netfilter/ip_conntrack_sip.c

0 → 100644

+471 −0

Original line number	Diff line number	Diff line
		/* SIP extension for IP connection tracking.
		*
		* (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
		* based on RR's ip_conntrack_ftp.c and other modules.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		* published by the Free Software Foundation.
		*/

		#include <linux/config.h>
		#include <linux/module.h>
		#include <linux/ctype.h>
		#include <linux/skbuff.h>
		#include <linux/in.h>
		#include <linux/ip.h>
		#include <linux/udp.h>

		#include <linux/netfilter.h>
		#include <linux/netfilter_ipv4.h>
		#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
		#include <linux/netfilter_ipv4/ip_conntrack_sip.h>

		#if 0
		#define DEBUGP printk
		#else
		#define DEBUGP(format, args...)
		#endif

		MODULE_LICENSE("GPL");
		MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
		MODULE_DESCRIPTION("SIP connection tracking helper");

		#define MAX_PORTS 8
		static unsigned short ports[MAX_PORTS];
		static int ports_c;
		module_param_array(ports, ushort, &ports_c, 0400);
		MODULE_PARM_DESC(ports, "port numbers of sip servers");

		static unsigned int sip_timeout = SIP_TIMEOUT;
		module_param(sip_timeout, uint, 0600);
		MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");

		unsigned int (ip_nat_sip_hook)(struct sk_buff *pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack *ct,
		const char **dptr);
		EXPORT_SYMBOL_GPL(ip_nat_sip_hook);

		unsigned int (ip_nat_sdp_hook)(struct sk_buff *pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack_expect *exp,
		const char *dptr);
		EXPORT_SYMBOL_GPL(ip_nat_sdp_hook);

		int ct_sip_get_info(const char *dptr, size_t dlen,
		unsigned int *matchoff,
		unsigned int *matchlen,
		struct sip_header_nfo *hnfo);
		EXPORT_SYMBOL_GPL(ct_sip_get_info);


		static int digits_len(const char dptr, const char limit, int *shift);
		static int epaddr_len(const char dptr, const char limit, int *shift);
		static int skp_digits_len(const char dptr, const char limit, int *shift);
		static int skp_epaddr_len(const char dptr, const char limit, int *shift);

		struct sip_header_nfo ct_sip_hdrs[] = {
		{ /* Via header */
		.lname = "Via:",
		.lnlen = sizeof("Via:") - 1,
		.sname = "\r\nv:",
		.snlen = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
		.ln_str = "UDP ",
		.ln_strlen = sizeof("UDP ") - 1,
		.match_len = epaddr_len,
		},
		{ /* Contact header */
		.lname = "Contact:",
		.lnlen = sizeof("Contact:") - 1,
		.sname = "\r\nm:",
		.snlen = sizeof("\r\nm:") - 1,
		.ln_str = "sip:",
		.ln_strlen = sizeof("sip:") - 1,
		.match_len = skp_epaddr_len
		},
		{ /* Content length header */
		.lname = "Content-Length:",
		.lnlen = sizeof("Content-Length:") - 1,
		.sname = "\r\nl:",
		.snlen = sizeof("\r\nl:") - 1,
		.ln_str = ":",
		.ln_strlen = sizeof(":") - 1,
		.match_len = skp_digits_len
		},
		{ /* SDP media info */
		.lname = "\nm=",
		.lnlen = sizeof("\nm=") - 1,
		.sname = "\rm=",
		.snlen = sizeof("\rm=") - 1,
		.ln_str = "audio ",
		.ln_strlen = sizeof("audio ") - 1,
		.match_len = digits_len
		},
		{ /* SDP owner address*/
		.lname = "\no=",
		.lnlen = sizeof("\no=") - 1,
		.sname = "\ro=",
		.snlen = sizeof("\ro=") - 1,
		.ln_str = "IN IP4 ",
		.ln_strlen = sizeof("IN IP4 ") - 1,
		.match_len = epaddr_len
		},
		{ /* SDP connection info */
		.lname = "\nc=",
		.lnlen = sizeof("\nc=") - 1,
		.sname = "\rc=",
		.snlen = sizeof("\rc=") - 1,
		.ln_str = "IN IP4 ",
		.ln_strlen = sizeof("IN IP4 ") - 1,
		.match_len = epaddr_len
		},
		{ /* Requests headers */
		.lname = "sip:",
		.lnlen = sizeof("sip:") - 1,
		.sname = "sip:",
		.snlen = sizeof("sip:") - 1, /* yes, i know.. ;) */
		.ln_str = "@",
		.ln_strlen = sizeof("@") - 1,
		.match_len = epaddr_len
		},
		{ /* SDP version header */
		.lname = "\nv=",
		.lnlen = sizeof("\nv=") - 1,
		.sname = "\rv=",
		.snlen = sizeof("\rv=") - 1,
		.ln_str = "=",
		.ln_strlen = sizeof("=") - 1,
		.match_len = digits_len
		}
		};
		EXPORT_SYMBOL_GPL(ct_sip_hdrs);

		/* get line lenght until first CR or LF seen. */
		int ct_sip_lnlen(const char line, const char limit)
		{
		const char *k = line;

		while ((line <= limit) && (line == '\r' \|\| line == '\n'))
		line++;

		while (line <= limit) {
		if (line == '\r' \|\| line == '\n')
		break;
		line++;
		}
		return line - k;
		}
		EXPORT_SYMBOL_GPL(ct_sip_lnlen);

		/* Linear string search, case sensitive. */
		const char ct_sip_search(const char needle, const char *haystack,
		size_t needle_len, size_t haystack_len)
		{
		const char *limit = haystack + (haystack_len - needle_len);

		while (haystack <= limit) {
		if (memcmp(haystack, needle, needle_len) == 0)
		return haystack;
		haystack++;
		}
		return NULL;
		}
		EXPORT_SYMBOL_GPL(ct_sip_search);

		static int digits_len(const char dptr, const char limit, int *shift)
		{
		int len = 0;
		while (dptr <= limit && isdigit(*dptr)) {
		dptr++;
		len++;
		}
		return len;
		}

		/* get digits lenght, skiping blank spaces. */
		static int skp_digits_len(const char dptr, const char limit, int *shift)
		{
		for (; dptr <= limit && *dptr == ' '; dptr++)
		(*shift)++;

		return digits_len(dptr, limit, shift);
		}

		/* Simple ipaddr parser.. */
		static int parse_ipaddr(const char cp, const char *endp,
		u_int32_t ipaddr, const char limit)
		{
		unsigned long int val;
		int i, digit = 0;

		for (i = 0, *ipaddr = 0; cp <= limit && i < 4; i++) {
		digit = 0;
		if (!isdigit(*cp))
		break;

		val = simple_strtoul(cp, (char **)&cp, 10);
		if (val > 0xFF)
		return -1;

		((u_int8_t *)ipaddr)[i] = val;
		digit = 1;

		if (*cp != '.')
		break;
		cp++;
		}
		if (!digit)
		return -1;

		if (endp)
		*endp = cp;

		return 0;
		}

		/* skip ip address. returns it lenght. */
		static int epaddr_len(const char dptr, const char limit, int *shift)
		{
		const char *aux = dptr;
		u_int32_t ip;

		if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {
		DEBUGP("ip: %s parse failed.!\n", dptr);
		return 0;
		}

		/* Port number */
		if (*dptr == ':') {
		dptr++;
		dptr += digits_len(dptr, limit, shift);
		}
		return dptr - aux;
		}

		/* get address length, skiping user info. */
		static int skp_epaddr_len(const char dptr, const char limit, int *shift)
		{
		int s = *shift;

		for (; dptr <= limit && *dptr != '@'; dptr++)
		(*shift)++;

		if (*dptr == '@') {
		dptr++;
		(*shift)++;
		} else
		*shift = s;

		return epaddr_len(dptr, limit, shift);
		}

		/* Returns 0 if not found, -1 error parsing. */
		int ct_sip_get_info(const char *dptr, size_t dlen,
		unsigned int *matchoff,
		unsigned int *matchlen,
		struct sip_header_nfo *hnfo)
		{
		const char limit, aux, *k = dptr;
		int shift = 0;

		limit = dptr + (dlen - hnfo->lnlen);

		while (dptr <= limit) {
		if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
		(strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
		dptr++;
		continue;
		}
		aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
		ct_sip_lnlen(dptr, limit));
		if (!aux) {
		DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str,
		hnfo->lname);
		return -1;
		}
		aux += hnfo->ln_strlen;

		*matchlen = hnfo->match_len(aux, limit, &shift);
		if (!*matchlen)
		return -1;

		*matchoff = (aux - k) + shift;

		DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname,
		*matchlen);
		return 1;
		}
		DEBUGP("%s header not found.\n", hnfo->lname);
		return 0;
		}

		static int set_expected_rtp(struct sk_buff **pskb,
		struct ip_conntrack *ct,
		enum ip_conntrack_info ctinfo,
		u_int32_t ipaddr, u_int16_t port,
		const char *dptr)
		{
		struct ip_conntrack_expect *exp;
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
		int ret;

		exp = ip_conntrack_expect_alloc(ct);
		if (exp == NULL)
		return NF_DROP;

		exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
		exp->tuple.src.u.udp.port = 0;
		exp->tuple.dst.ip = ipaddr;
		exp->tuple.dst.u.udp.port = htons(port);
		exp->tuple.dst.protonum = IPPROTO_UDP;

		exp->mask.src.ip = 0xFFFFFFFF;
		exp->mask.src.u.udp.port = 0;
		exp->mask.dst.ip = 0xFFFFFFFF;
		exp->mask.dst.u.udp.port = 0xFFFF;
		exp->mask.dst.protonum = 0xFF;

		exp->expectfn = NULL;
		exp->flags = 0;

		if (ip_nat_sdp_hook)
		ret = ip_nat_sdp_hook(pskb, ctinfo, exp, dptr);
		else {
		if (ip_conntrack_expect_related(exp) != 0)
		ret = NF_DROP;
		else
		ret = NF_ACCEPT;
		}
		ip_conntrack_expect_put(exp);

		return ret;
		}

		static int sip_help(struct sk_buff **pskb,
		struct ip_conntrack *ct,
		enum ip_conntrack_info ctinfo)
		{
		unsigned int dataoff, datalen;
		const char *dptr;
		int ret = NF_ACCEPT;
		int matchoff, matchlen;
		u_int32_t ipaddr;
		u_int16_t port;

		/* No Data ? */
		dataoff = (pskb)->nh.iph->ihl4 + sizeof(struct udphdr);
		if (dataoff >= (*pskb)->len) {
		DEBUGP("skb->len = %u\n", (*pskb)->len);
		return NF_ACCEPT;
		}

		ip_ct_refresh(ct, pskb, sip_timeout HZ);

		if (!skb_is_nonlinear(*pskb))
		dptr = (*pskb)->data + dataoff;
		else {
		DEBUGP("Copy of skbuff not supported yet.\n");
		goto out;
		}

		if (ip_nat_sip_hook) {
		if (!ip_nat_sip_hook(pskb, ctinfo, ct, &dptr)) {
		ret = NF_DROP;
		goto out;
		}
		}

		/* After this point NAT, could have mangled skb, so
		we need to recalculate payload lenght. */
		datalen = (*pskb)->len - dataoff;

		if (datalen < (sizeof("SIP/2.0 200") - 1))
		goto out;

		/* RTP info only in some SDP pkts */
		if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
		memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
		goto out;
		}
		/* Get ip and port address from SDP packet. */
		if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
		&ct_sip_hdrs[POS_CONNECTION]) > 0) {

		/* We'll drop only if there are parse problems. */
		if (parse_ipaddr(dptr + matchoff, NULL, &ipaddr,
		dptr + datalen) < 0) {
		ret = NF_DROP;
		goto out;
		}
		if (ct_sip_get_info(dptr, datalen, &matchoff, &matchlen,
		&ct_sip_hdrs[POS_MEDIA]) > 0) {

		port = simple_strtoul(dptr + matchoff, NULL, 10);
		if (port < 1024) {
		ret = NF_DROP;
		goto out;
		}
		ret = set_expected_rtp(pskb, ct, ctinfo,
		ipaddr, port, dptr);
		}
		}
		out:
		return ret;
		}

		static struct ip_conntrack_helper sip[MAX_PORTS];
		static char sip_names[MAX_PORTS][10];

		static void fini(void)
		{
		int i;
		for (i = 0; i < ports_c; i++) {
		DEBUGP("unregistering helper for port %d\n", ports[i]);
		ip_conntrack_helper_unregister(&sip[i]);
		}
		}

		static int __init init(void)
		{
		int i, ret;
		char *tmpname;

		if (ports_c == 0)
		ports[ports_c++] = SIP_PORT;

		for (i = 0; i < ports_c; i++) {
		/* Create helper structure */
		memset(&sip[i], 0, sizeof(struct ip_conntrack_helper));

		sip[i].tuple.dst.protonum = IPPROTO_UDP;
		sip[i].tuple.src.u.udp.port = htons(ports[i]);
		sip[i].mask.src.u.udp.port = 0xFFFF;
		sip[i].mask.dst.protonum = 0xFF;
		sip[i].max_expected = 1;
		sip[i].timeout = 3 * 60; /* 3 minutes */
		sip[i].me = THIS_MODULE;
		sip[i].help = sip_help;

		tmpname = &sip_names[i][0];
		if (ports[i] == SIP_PORT)
		sprintf(tmpname, "sip");
		else
		sprintf(tmpname, "sip-%d", i);
		sip[i].name = tmpname;

		DEBUGP("port #%d: %d\n", i, ports[i]);

		ret = ip_conntrack_helper_register(&sip[i]);
		if (ret) {
		printk("ERROR registering helper for port %d\n",
		ports[i]);
		fini();
		return ret;
		}
		}
		return 0;
		}

		module_init(init);
		module_exit(fini);

net/ipv4/netfilter/ip_nat_sip.c

0 → 100644

+249 −0

Original line number	Diff line number	Diff line
		/* SIP extension for UDP NAT alteration.
		*
		* (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
		* based on RR's ip_nat_ftp.c and other modules.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		* published by the Free Software Foundation.
		*/

		#include <linux/module.h>
		#include <linux/skbuff.h>
		#include <linux/ip.h>
		#include <linux/udp.h>

		#include <linux/netfilter_ipv4.h>
		#include <linux/netfilter_ipv4/ip_nat.h>
		#include <linux/netfilter_ipv4/ip_nat_helper.h>
		#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
		#include <linux/netfilter_ipv4/ip_conntrack_sip.h>

		MODULE_LICENSE("GPL");
		MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
		MODULE_DESCRIPTION("SIP NAT helper");

		#if 0
		#define DEBUGP printk
		#else
		#define DEBUGP(format, args...)
		#endif

		extern struct sip_header_nfo ct_sip_hdrs[];

		static unsigned int mangle_sip_packet(struct sk_buff **pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack *ct,
		const char **dptr, size_t dlen,
		char *buffer, int bufflen,
		struct sip_header_nfo *hnfo)
		{
		unsigned int matchlen, matchoff;

		if (ct_sip_get_info(*dptr, dlen, &matchoff, &matchlen, hnfo) <= 0)
		return 0;

		if (!ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
		matchoff, matchlen, buffer, bufflen))
		return 0;

		/* We need to reload this. Thanks Patrick. */
		dptr = (pskb)->data + (pskb)->nh.iph->ihl4 + sizeof(struct udphdr);
		return 1;
		}

		static unsigned int ip_nat_sip(struct sk_buff **pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack *ct,
		const char **dptr)
		{
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
		char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
		unsigned int bufflen, dataoff;
		u_int32_t ip;
		u_int16_t port;

		dataoff = (pskb)->nh.iph->ihl4 + sizeof(struct udphdr);

		ip = ct->tuplehash[!dir].tuple.dst.ip;
		port = ct->tuplehash[!dir].tuple.dst.u.udp.port;
		bufflen = sprintf(buffer, "%u.%u.%u.%u:%u", NIPQUAD(ip), ntohs(port));

		/* short packet ? */
		if (((*pskb)->len - dataoff) < (sizeof("SIP/2.0") - 1))
		return 0;

		/* Basic rules: requests and responses. */
		if (memcmp(*dptr, "SIP/2.0", sizeof("SIP/2.0") - 1) == 0) {
		const char *aux;

		if ((ctinfo) < IP_CT_IS_REPLY) {
		mangle_sip_packet(pskb, ctinfo, ct, dptr,
		(*pskb)->len - dataoff,
		buffer, bufflen,
		&ct_sip_hdrs[POS_CONTACT]);
		return 1;
		}

		if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,
		(*pskb)->len - dataoff,
		buffer, bufflen, &ct_sip_hdrs[POS_VIA]))
		return 0;

		/* This search should ignore case, but later.. */
		aux = ct_sip_search("CSeq:", *dptr, sizeof("CSeq:") - 1,
		(*pskb)->len - dataoff);
		if (!aux)
		return 0;

		if (!ct_sip_search("REGISTER", aux, sizeof("REGISTER"),
		ct_sip_lnlen(aux, dptr + (pskb)->len - dataoff)))
		return 1;

		return mangle_sip_packet(pskb, ctinfo, ct, dptr,
		(*pskb)->len - dataoff,
		buffer, bufflen,
		&ct_sip_hdrs[POS_CONTACT]);
		}
		if ((ctinfo) < IP_CT_IS_REPLY) {
		if (!mangle_sip_packet(pskb, ctinfo, ct, dptr,
		(*pskb)->len - dataoff,
		buffer, bufflen, &ct_sip_hdrs[POS_VIA]))
		return 0;

		/* Mangle Contact if exists only. - watch udp_nat_mangle()! */
		mangle_sip_packet(pskb, ctinfo, ct, dptr, (*pskb)->len - dataoff,
		buffer, bufflen, &ct_sip_hdrs[POS_CONTACT]);
		return 1;
		}
		/* This mangle requests headers. */
		return mangle_sip_packet(pskb, ctinfo, ct, dptr,
		ct_sip_lnlen(*dptr,
		dptr + (pskb)->len - dataoff),
		buffer, bufflen, &ct_sip_hdrs[POS_REQ_HEADER]);
		}

		static int mangle_content_len(struct sk_buff **pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack *ct,
		const char *dptr)
		{
		unsigned int dataoff, matchoff, matchlen;
		char buffer[sizeof("65536")];
		int bufflen;

		dataoff = (pskb)->nh.iph->ihl4 + sizeof(struct udphdr);

		/* Get actual SDP lenght */
		if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
		&matchlen, &ct_sip_hdrs[POS_SDP_HEADER]) > 0) {

		/* since ct_sip_get_info() give us a pointer passing 'v='
		we need to add 2 bytes in this count. */
		int c_len = (*pskb)->len - dataoff - matchoff + 2;

		/* Now, update SDP lenght */
		if (ct_sip_get_info(dptr, (*pskb)->len - dataoff, &matchoff,
		&matchlen, &ct_sip_hdrs[POS_CONTENT]) > 0) {

		bufflen = sprintf(buffer, "%u", c_len);

		return ip_nat_mangle_udp_packet(pskb, ct, ctinfo,
		matchoff, matchlen,
		buffer, bufflen);
		}
		}
		return 0;
		}

		static unsigned int mangle_sdp(struct sk_buff **pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack *ct,
		u_int32_t newip, u_int16_t port,
		const char *dptr)
		{
		char buffer[sizeof("nnn.nnn.nnn.nnn")];
		unsigned int dataoff, bufflen;

		dataoff = (pskb)->nh.iph->ihl4 + sizeof(struct udphdr);

		/* Mangle owner and contact info. */
		bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
		if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
		buffer, bufflen, &ct_sip_hdrs[POS_OWNER]))
		return 0;

		if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
		buffer, bufflen, &ct_sip_hdrs[POS_CONNECTION]))
		return 0;

		/* Mangle media port. */
		bufflen = sprintf(buffer, "%u", port);
		if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
		buffer, bufflen, &ct_sip_hdrs[POS_MEDIA]))
		return 0;

		return mangle_content_len(pskb, ctinfo, ct, dptr);
		}

		/* So, this packet has hit the connection tracking matching code.
		Mangle it, and change the expectation to match the new version. */
		static unsigned int ip_nat_sdp(struct sk_buff **pskb,
		enum ip_conntrack_info ctinfo,
		struct ip_conntrack_expect *exp,
		const char *dptr)
		{
		struct ip_conntrack *ct = exp->master;
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
		u_int32_t newip;
		u_int16_t port;

		DEBUGP("ip_nat_sdp():\n");

		/* Connection will come from reply */
		newip = ct->tuplehash[!dir].tuple.dst.ip;

		exp->tuple.dst.ip = newip;
		exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
		exp->dir = !dir;

		/* When you see the packet, we need to NAT it the same as the
		this one. */
		exp->expectfn = ip_nat_follow_master;

		/* Try to get same port: if not, try to change it. */
		for (port = ntohs(exp->saved_proto.udp.port); port != 0; port++) {
		exp->tuple.dst.u.udp.port = htons(port);
		if (ip_conntrack_expect_related(exp) == 0)
		break;
		}

		if (port == 0)
		return NF_DROP;

		if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
		ip_conntrack_unexpect_related(exp);
		return NF_DROP;
		}
		return NF_ACCEPT;
		}

		static void __exit fini(void)
		{
		ip_nat_sip_hook = NULL;
		ip_nat_sdp_hook = NULL;
		/* Make sure noone calls it, meanwhile. */
		synchronize_net();
		}

		static int __init init(void)
		{
		BUG_ON(ip_nat_sip_hook);
		BUG_ON(ip_nat_sdp_hook);
		ip_nat_sip_hook = ip_nat_sip;
		ip_nat_sdp_hook = ip_nat_sdp;
		return 0;
		}

		module_init(init);
		module_exit(fini);