static int tftp_help(struct sk_buff **pskb,
unsigned int protoff,
struct nf_conn *ct,
enum ip_conntrack_info ctinfo)
{
struct tftphdr _tftph, *tfh;
struct nf_conntrack_expect *exp;
struct nf_conntrack_tuple *tuple;
unsigned int ret = NF_ACCEPT;
int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
typeof(nf_nat_tftp_hook) nf_nat_tftp;
tfh = skb_header_pointer(*pskb, protoff + sizeof(struct udphdr),
sizeof(_tftph), &_tftph);
if (tfh == NULL)
return NF_ACCEPT;
switch (ntohs(tfh->opcode)) {
case TFTP_OPCODE_READ:
case TFTP_OPCODE_WRITE:
/* RRQ and WRQ works the same way */
DEBUGP("");
NF_CT_DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
NF_CT_DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
exp = nf_conntrack_expect_alloc(ct);
if (exp == NULL)
return NF_DROP;
tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
nf_conntrack_expect_init(exp, family,
&tuple->src.u3, &tuple->dst.u3,
IPPROTO_UDP,
NULL, &tuple->dst.u.udp.port);
DEBUGP("expect: ");
NF_CT_DUMP_TUPLE(&exp->tuple);
NF_CT_DUMP_TUPLE(&exp->mask);
nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
ret = nf_nat_tftp(pskb, ctinfo, exp);
else if (nf_conntrack_expect_related(exp) != 0)
ret = NF_DROP;
nf_conntrack_expect_put(exp);
break;
case TFTP_OPCODE_DATA:
case TFTP_OPCODE_ACK:
DEBUGP("Data/ACK opcode\n");
break;
case TFTP_OPCODE_ERROR:
DEBUGP("Error opcode\n");
break;
default:
DEBUGP("Unknown opcode\n");
}
return ret;
}
/* expect GRE connections (PNS->PAC and PAC->PNS direction) */
static int exp_gre(struct nf_conn *ct, __be16 callid, __be16 peer_callid)
{
struct nf_conntrack_expect *exp_orig, *exp_reply;
enum ip_conntrack_dir dir;
int ret = 1;
typeof(nf_nat_pptp_hook_exp_gre) nf_nat_pptp_exp_gre;
exp_orig = nf_conntrack_expect_alloc(ct);
if (exp_orig == NULL)
goto out;
exp_reply = nf_conntrack_expect_alloc(ct);
if (exp_reply == NULL)
goto out_put_orig;
/* original direction, PNS->PAC */
dir = IP_CT_DIR_ORIGINAL;
nf_conntrack_expect_init(exp_orig, NF_CT_EXPECT_CLASS_DEFAULT,
ct->tuplehash[dir].tuple.src.l3num,
&ct->tuplehash[dir].tuple.src.u3,
&ct->tuplehash[dir].tuple.dst.u3,
IPPROTO_GRE, &peer_callid, &callid);
exp_orig->expectfn = pptp_expectfn;
/* reply direction, PAC->PNS */
dir = IP_CT_DIR_REPLY;
nf_conntrack_expect_init(exp_reply, NF_CT_EXPECT_CLASS_DEFAULT,
ct->tuplehash[dir].tuple.src.l3num,
&ct->tuplehash[dir].tuple.src.u3,
&ct->tuplehash[dir].tuple.dst.u3,
IPPROTO_GRE, &callid, &peer_callid);
exp_reply->expectfn = pptp_expectfn;
nf_nat_pptp_exp_gre = rcu_dereference(nf_nat_pptp_hook_exp_gre);
if (nf_nat_pptp_exp_gre && ct->status & IPS_NAT_MASK)
nf_nat_pptp_exp_gre(exp_orig, exp_reply);
if (nf_conntrack_expect_related(exp_orig) != 0)
goto out_put_both;
if (nf_conntrack_expect_related(exp_reply) != 0)
goto out_unexpect_orig;
/* Add GRE keymap entries */
if (nf_ct_gre_keymap_add(ct, IP_CT_DIR_ORIGINAL, &exp_orig->tuple) != 0)
goto out_unexpect_both;
if (nf_ct_gre_keymap_add(ct, IP_CT_DIR_REPLY, &exp_reply->tuple) != 0) {
nf_ct_gre_keymap_destroy(ct);
goto out_unexpect_both;
}
ret = 0;
out_put_both:
nf_conntrack_expect_put(exp_reply);
out_put_orig:
nf_conntrack_expect_put(exp_orig);
out:
return ret;
out_unexpect_both:
nf_conntrack_unexpect_related(exp_reply);
out_unexpect_orig:
nf_conntrack_unexpect_related(exp_orig);
goto out_put_both;
}
static int help(struct sk_buff *skb, unsigned int protoff,
struct nf_conn *ct, enum ip_conntrack_info ctinfo)
{
unsigned int dataoff;
const struct iphdr *iph;
const struct tcphdr *th;
struct tcphdr _tcph;
char *data, *data_limit, *ib_ptr;
int dir = CTINFO2DIR(ctinfo);
struct nf_conntrack_expect *exp;
struct nf_conntrack_tuple *tuple;
u_int32_t dcc_ip;
u_int16_t dcc_port;
__be16 port;
int i, ret = NF_ACCEPT;
char *addr_beg_p, *addr_end_p;
typeof(nf_nat_irc_hook) nf_nat_irc;
/* If packet is coming from IRC server */
if (dir == IP_CT_DIR_REPLY)
return NF_ACCEPT;
/* Until there's been traffic both ways, don't look in packets. */
if (ctinfo != IP_CT_ESTABLISHED &&
ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
return NF_ACCEPT;
/* Not a full tcp header? */
th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
if (th == NULL)
return NF_ACCEPT;
/* No data? */
dataoff = protoff + th->doff*4;
if (dataoff >= skb->len)
return NF_ACCEPT;
spin_lock_bh(&irc_buffer_lock);
ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
irc_buffer);
BUG_ON(ib_ptr == NULL);
data = ib_ptr;
data_limit = ib_ptr + skb->len - dataoff;
/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
* 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
while (data < data_limit - (19 + MINMATCHLEN)) {
if (memcmp(data, "\1DCC ", 5)) {
data++;
continue;
}
data += 5;
/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
iph = ip_hdr(skb);
pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
&iph->saddr, ntohs(th->source),
&iph->daddr, ntohs(th->dest));
for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
/* no match */
continue;
}
data += strlen(dccprotos[i]);
pr_debug("DCC %s detected\n", dccprotos[i]);
/* we have at least
* (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
* data left (== 14/13 bytes) */
if (parse_dcc((char *)data, data_limit, &dcc_ip,
&dcc_port, &addr_beg_p, &addr_end_p)) {
pr_debug("unable to parse dcc command\n");
continue;
}
pr_debug("DCC bound ip/port: %pI4:%u\n",
&dcc_ip, dcc_port);
/* dcc_ip can be the internal OR external (NAT'ed) IP */
tuple = &ct->tuplehash[dir].tuple;
if (tuple->src.u3.ip != htonl(dcc_ip) &&
tuple->dst.u3.ip != htonl(dcc_ip)) {
if (net_ratelimit())
printk(KERN_WARNING
"Forged DCC command from %pI4: %pI4:%u\n",
&tuple->src.u3.ip,
&dcc_ip, dcc_port);
continue;
}
exp = nf_conntrack_expect_alloc(ct);
if (exp == NULL) {
ret = NF_DROP;
goto out;
}
tuple = &ct->tuplehash[!dir].tuple;
port = htons(dcc_port);
nf_conntrack_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
tuple->src.l3num,
NULL, &tuple->dst.u3,
IPPROTO_TCP, NULL, &port);
nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
if (nf_nat_irc && ct->status & IPS_NAT_MASK)
ret = nf_nat_irc(skb, ctinfo,
addr_beg_p - ib_ptr,
addr_end_p - addr_beg_p,
exp);
else if (nf_conntrack_expect_related(exp) != 0)
ret = NF_DROP;
nf_conntrack_expect_put(exp);
goto out;
}
}
out:
spin_unlock_bh(&irc_buffer_lock);
return ret;
}
static void
autofw_expect(struct nf_conn *ct, struct nf_conntrack_expect *exp)
{
struct nf_nat_range pre_range;
u_int32_t newdstip, newsrcip;
u_int16_t port;
int ret;
struct nf_conn_help *help;
struct nf_conn *exp_ct = exp->master;
struct nf_conntrack_expect *newexp;
int count;
/* expect has been removed from expect list, but expect isn't free yet. */
help = nfct_help(exp_ct);
DEBUGP("autofw_nat_expected: got ");
NF_CT_DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
spin_lock_bh(&nf_nat_autofw_lock);
port = ntohs(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.all);
newdstip = exp->tuple.dst.u3.ip;
newsrcip = exp->tuple.src.u3.ip;
if (port < ntohs(help->help.ct_autofw_info.dport[0]) ||
port > ntohs(help->help.ct_autofw_info.dport[1])) {
spin_unlock_bh(&nf_nat_autofw_lock);
return;
}
/* Only need to do PRE_ROUTING */
port -= ntohs(help->help.ct_autofw_info.dport[0]);
port += ntohs(help->help.ct_autofw_info.to[0]);
pre_range.flags = IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED;
pre_range.min_ip = pre_range.max_ip = newdstip;
pre_range.min.all = pre_range.max.all = htons(port);
nf_nat_setup_info(ct, &pre_range, NF_IP_PRE_ROUTING);
spin_unlock_bh(&nf_nat_autofw_lock);
/* Add expect again */
/* alloc will set exp->master = exp_ct */
newexp = nf_conntrack_expect_alloc(exp_ct);
if (!newexp)
return;
newexp->tuple.src.u3.ip = exp->tuple.src.u3.ip;
newexp->tuple.dst.protonum = exp->tuple.dst.protonum;
newexp->mask.src.u3.ip = 0xFFFFFFFF;
newexp->mask.dst.protonum = 0xFF;
newexp->tuple.dst.u3.ip = exp->tuple.dst.u3.ip;
newexp->mask.dst.u3.ip = 0x0;
for (count = 1; count < NF_CT_TUPLE_L3SIZE; count++) {
newexp->tuple.src.u3.all[count] = 0x0;
newexp->tuple.dst.u3.all[count] = 0x0;
}
newexp->mask.dst.u.all = 0x0;
newexp->mask.src.u.all = 0x0;
newexp->mask.src.l3num = 0x0;
newexp->expectfn = autofw_expect;
newexp->helper = NULL;
newexp->flags = 0;
/*
* exp->timeout.expires will set as
* (jiffies + helper->timeout * HZ), when insert exp.
*/
ret = nf_conntrack_expect_related(newexp);
if (ret == 0)
nf_conntrack_expect_put(newexp);
}
static unsigned int
autofw_target(struct sk_buff **pskb,
const struct net_device *in,
const struct net_device *out,
unsigned int hooknum,
const struct xt_target *target,
const void *targinfo)
{
const struct ip_autofw_info *info = targinfo;
const struct iphdr *iph = ip_hdr(*pskb);
int ret;
struct nf_conntrack_helper *helper;
struct nf_conntrack_expect *exp;
struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
struct nf_conn_help *help;
int count;
ct = nf_ct_get(*pskb, &ctinfo);
if (!ct)
goto out;
helper = __nf_conntrack_helper_find_byname("autofw");
if (!helper)
goto out;
help = nfct_help(ct);
help->helper = helper;
/* alloc will set exp->master = ct */
exp = nf_conntrack_expect_alloc(ct);
if (!exp)
goto out;
helper->me = THIS_MODULE;
helper->timeout = 5 * 60;
exp->tuple.src.u3.ip = iph->daddr;
exp->tuple.dst.protonum = info->proto;
exp->mask.src.u3.ip = 0xFFFFFFFF;
exp->mask.dst.protonum = 0xFF;
exp->tuple.dst.u3.ip = iph->saddr;
exp->mask.dst.u3.ip = 0x0;
for (count = 1; count < NF_CT_TUPLE_L3SIZE; count++) {
exp->tuple.src.u3.all[count] = 0x0;
exp->tuple.dst.u3.all[count] = 0x0;
}
exp->mask.dst.u.all = 0x0;
exp->mask.src.u.all = 0x0;
exp->mask.src.l3num = 0x0;
exp->expectfn = autofw_expect;
exp->helper = NULL;
exp->flags = 0;
/*
* exp->timeout.expires will set as
* (jiffies + helper->timeout * HZ), when insert exp.
*/
ret = nf_conntrack_expect_related(exp);
if (ret != 0)
goto out;
nf_conntrack_expect_put(exp);
help->help.ct_autofw_info.dport[0] = info->dport[0];
help->help.ct_autofw_info.dport[1] = info->dport[1];
help->help.ct_autofw_info.to[0] = info->to[0];
help->help.ct_autofw_info.to[1] = info->to[1];
out:
return IPT_CONTINUE;
}
static inline int
help_out(struct sk_buff **pskb, unsigned char *rb_ptr, unsigned int datalen,
struct nf_conn *ct, enum ip_conntrack_info ctinfo)
{
struct ip_ct_rtsp_expect expinfo;
int dir = CTINFO2DIR(ctinfo); /* = IP_CT_DIR_ORIGINAL */
//struct tcphdr* tcph = (void*)iph + iph->ihl * 4;
//uint tcplen = pktlen - iph->ihl * 4;
char* pdata = rb_ptr;
//uint datalen = tcplen - tcph->doff * 4;
uint dataoff = 0;
int ret = NF_ACCEPT;
struct nf_conntrack_expect *exp;
__be16 be_loport;
typeof(nf_nat_rtsp_hook) nf_nat_rtsp;
memset(&expinfo, 0, sizeof(expinfo));
while (dataoff < datalen) {
uint cmdoff = dataoff;
uint hdrsoff = 0;
uint hdrslen = 0;
uint cseqoff = 0;
uint cseqlen = 0;
uint transoff = 0;
uint translen = 0;
uint off;
if (!rtsp_parse_message(pdata, datalen, &dataoff,
&hdrsoff, &hdrslen,
&cseqoff, &cseqlen,
&transoff, &translen))
break; /* not a valid message */
if (strncmp(pdata+cmdoff, "SETUP ", 6) != 0)
continue; /* not a SETUP message */
pr_debug("found a setup message\n");
off = 0;
if(translen) {
rtsp_parse_transport(pdata+transoff, translen, &expinfo);
}
if (expinfo.loport == 0) {
pr_debug("no udp transports found\n");
continue; /* no udp transports found */
}
pr_debug("udp transport found, ports=(%d,%hu,%hu)\n",
(int)expinfo.pbtype, expinfo.loport, expinfo.hiport);
exp = nf_conntrack_expect_alloc(ct);
if (!exp) {
ret = NF_DROP;
goto out;
}
be_loport = htons(expinfo.loport);
/*
nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
&ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3,
IPPROTO_UDP, NULL, &be_loport);
¸øexp¸³Öµ */
exp->tuple.dst.u3 = ct->tuplehash[!dir].tuple.dst.u3;
exp->tuple.src.u3 = ct->tuplehash[!dir].tuple.src.u3;
exp->tuple.src.l3num = ct->tuplehash[dir].tuple.src.l3num;
exp->tuple.src.u.udp.port = 0;
exp->tuple.dst.u.udp.port = be_loport;
exp->tuple.dst.protonum = IPPROTO_UDP;
exp->mask = (struct nf_conntrack_tuple)
{ .src = { .l3num = 0xFFFF,
.u = { .udp = { 0 }},
},
.dst = { .protonum = 0xFF,
.u = { .udp = { __constant_htons(0xFFFF) }},
},
};
if (ct->tuplehash[dir].tuple.src.l3num == PF_INET) {
exp->mask.src.u3.ip = htonl(0xFFFFFFFF);
exp->mask.dst.u3.ip = htonl(0xFFFFFFFF);
} else {
memset(exp->mask.src.u3.ip6, 0xFF,
sizeof(exp->mask.src.u3.ip6));
memset(exp->mask.dst.u3.ip6, 0xFF,
sizeof(exp->mask.src.u3.ip6));
}
// exp->master = ct;
exp->helper = NULL;
exp->flags = 0;
if (expinfo.pbtype == pb_range) {
pr_debug("Changing expectation mask to handle multiple ports\n");
//exp->mask.dst.u.udp.port = 0xfffe;
}
pr_debug("expect_related %u.%u.%u.%u:%u-%u.%u.%u.%u:%u\n",
NIPQUAD(exp->tuple.src.u3.ip),
ntohs(exp->tuple.src.u.udp.port),
NIPQUAD(exp->tuple.dst.u3.ip),
ntohs(exp->tuple.dst.u.udp.port));
nf_nat_rtsp = rcu_dereference(nf_nat_rtsp_hook);
if (nf_nat_rtsp && ct->status & IPS_NAT_MASK)
/* pass the request off to the nat helper */
ret = nf_nat_rtsp(pskb, ctinfo, hdrsoff, hdrslen, &expinfo, exp);
else if (nf_conntrack_expect_related(exp) != 0) {
pr_info("nf_conntrack_expect_related failed\n");
ret = NF_DROP;
}
nf_conntrack_expect_put(exp);
goto out;
}
static int help(struct sk_buff **pskb,
unsigned int protoff,
struct nf_conn *ct,
enum ip_conntrack_info ctinfo)
{
unsigned int dataoff, datalen;
struct tcphdr _tcph, *th;
char *sb_ptr;
int ret = NF_ACCEPT;
int dir = CTINFO2DIR(ctinfo);
struct nf_ct_sane_master *ct_sane_info;
struct nf_conntrack_expect *exp;
struct nf_conntrack_tuple *tuple;
struct sane_request *req;
struct sane_reply_net_start *reply;
int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
if((alg_flag & SANE_FLAG) == 0)
{
(*pskb)->ff_flag = ff_clr_flag((*pskb), DRV_FF_FLAG_ALG);
return NF_ACCEPT;
}
ct_sane_info = &(ct->help.help.ct_sane_info);
/* Until there's been traffic both ways, don't look in packets. */
if (ctinfo != IP_CT_ESTABLISHED &&
ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY)
return NF_ACCEPT;
/* Not a full tcp header? */
th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
if (th == NULL)
return NF_ACCEPT;
/* No data? */
dataoff = protoff + th->doff * 4;
if (dataoff >= (*pskb)->len)
return NF_ACCEPT;
datalen = (*pskb)->len - dataoff;
spin_lock_bh(&nf_sane_lock);
sb_ptr = skb_header_pointer(*pskb, dataoff, datalen, sane_buffer);
BUG_ON(sb_ptr == NULL);
if (dir == IP_CT_DIR_ORIGINAL) {
if (datalen != sizeof(struct sane_request))
goto out;
req = (struct sane_request *)sb_ptr;
if (req->RPC_code != htonl(SANE_NET_START)) {
/* Not an interesting command */
ct_sane_info->state = SANE_STATE_NORMAL;
goto out;
}
/* We're interested in the next reply */
ct_sane_info->state = SANE_STATE_START_REQUESTED;
goto out;
}
/* Is it a reply to an uninteresting command? */
if (ct_sane_info->state != SANE_STATE_START_REQUESTED)
goto out;
/* It's a reply to SANE_NET_START. */
ct_sane_info->state = SANE_STATE_NORMAL;
if (datalen < sizeof(struct sane_reply_net_start)) {
DEBUGP("nf_ct_sane: NET_START reply too short\n");
goto out;
}
reply = (struct sane_reply_net_start *)sb_ptr;
if (reply->status != htonl(SANE_STATUS_SUCCESS)) {
/* saned refused the command */
DEBUGP("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
ntohl(reply->status));
goto out;
}
/* Invalid saned reply? Ignore it. */
if (reply->zero != 0)
goto out;
exp = nf_conntrack_expect_alloc(ct);
if (exp == NULL) {
ret = NF_DROP;
goto out;
}
tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
nf_conntrack_expect_init(exp, family,
&tuple->src.u3, &tuple->dst.u3,
IPPROTO_TCP,
NULL, &reply->port);
DEBUGP("nf_ct_sane: expect: ");
NF_CT_DUMP_TUPLE(&exp->tuple);
NF_CT_DUMP_TUPLE(&exp->mask);
/* Can't expect this? Best to drop packet now. */
if (nf_conntrack_expect_related(exp) != 0)
ret = NF_DROP;
nf_conntrack_expect_put(exp);
out:
spin_unlock_bh(&nf_sane_lock);
return ret;
}
/*******************************************************************************
函 数 名 : oracle_alg_help
功能描述 : oracle alg 模块报文入口
输入参数 :
输出参数 :
返 回 值 : NF_ACCEPT 不论对报文是否修改, 均返回NF_ACCEPT
--------------------------------------------------------------------------------
最近一次修改记录 :
修改作者 : 周瑞红
修改目的 : 新生成函数
修改日期 : 2010-07-2
*******************************************************************************/
static s32 oracle_alg_help(struct sk_buff **pskb,
u32 protoff,
struct nf_conn *ct,
enum ip_conntrack_info ctinfo)
{
u32 dataoff;
struct tcphdr _tcph, *th;
struct oracle_pkt_hdr *oraclehdr = NULL;
char *oracle_ptr;
s32 ret;
u16 oracle_port, port;
s32 dir = CTINFO2DIR(ctinfo);
u32 matchlen, matchoff;
u32 datalen;
struct nf_conntrack_expect *exp;
typeof(nf_nat_oracle_hook) nf_nat_oracle;
if((alg_flag & ORACLE_FLAG)==0)
{
(*pskb)->ff_flag = ff_clr_flag((*pskb), DRV_FF_FLAG_ALG);
return NF_ACCEPT;
}
if (ctinfo != IP_CT_ESTABLISHED
&& ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY)
{
return NF_ACCEPT;
}
/* 获取tcp头 */
th = skb_header_pointer(*pskb, (s32)protoff, sizeof(_tcph), &_tcph);
if (th == NULL)
{
return NF_ACCEPT;
}
/* 获取源端口 */
oracle_port = th->source;
if (oracle_port != ORACLE_PORT) /* 非oracle协商报文报文 */
{
return NF_ACCEPT;
}
dataoff = protoff + th->doff * 4;
if (dataoff >= (*pskb)->len)
{
return NF_ACCEPT;
}
oracle_ptr = (unsigned char*)th;
oracle_ptr += sizeof (struct tcphdr);
oraclehdr = (struct oracle_pkt_hdr*)oracle_ptr;
if (NULL == oraclehdr)
{
return NF_ACCEPT;
}
if (dataoff >=(*pskb)->len)
{
return NF_ACCEPT;
}
datalen = (*pskb)->len - dataoff;
dataoff += sizeof(struct oracle_pkt_hdr);
/* 获取协商信息中的端口 */
port = oracle_alg_get_port((u8*)oraclehdr, datalen);
if (port == 0)
{
return NF_ACCEPT;
}
spin_lock_bh(&nf_oracle_lock);
exp = nf_conntrack_expect_alloc(ct);
if (exp == NULL)
{
ret = NF_DROP;
goto out;
}
exp->tuple.dst.u3 = ct->tuplehash[!dir].tuple.dst.u3;
exp->tuple.src.u3 = ct->tuplehash[!dir].tuple.src.u3;
exp->tuple.src.l3num = ct->tuplehash[dir].tuple.src.l3num;
exp->tuple.src.u.tcp.port = 0;
exp->tuple.dst.u.tcp.port = port;
exp->tuple.dst.protonum = IPPROTO_TCP;
exp->mask = (struct nf_conntrack_tuple)
{ .src = { .l3num = 0xFFFF,
.u = { .tcp = { 0 }},
},
.dst = { .protonum = 0xFF,
.u = { .tcp = { __constant_htons(0xFFFF) }},
},
};
static inline int
help_out(struct sk_buff *skb, unsigned char *rb_ptr, unsigned int datalen,
struct nf_conn *ct, enum ip_conntrack_info ctinfo)
{
struct ip_ct_rtsp_expect expinfo;
int dir = CTINFO2DIR(ctinfo); /* = IP_CT_DIR_ORIGINAL */
//struct tcphdr* tcph = (void*)iph + iph->ihl * 4;
//uint tcplen = pktlen - iph->ihl * 4;
char* pdata = rb_ptr;
//uint datalen = tcplen - tcph->doff * 4;
uint dataoff = 0;
int ret = NF_ACCEPT;
struct nf_conntrack_expect *exp;
__be16 be_loport;
typeof(nf_nat_rtsp_hook) nf_nat_rtsp;
memset(&expinfo, 0, sizeof(expinfo));
while (dataoff < datalen) {
uint cmdoff = dataoff;
uint hdrsoff = 0;
uint hdrslen = 0;
uint cseqoff = 0;
uint cseqlen = 0;
uint transoff = 0;
uint translen = 0;
if (!rtsp_parse_message(pdata, datalen, &dataoff,
&hdrsoff, &hdrslen,
&cseqoff, &cseqlen,
&transoff, &translen))
break; /* not a valid message */
if (strncmp(pdata+cmdoff, "SETUP ", 6) != 0)
continue; /* not a SETUP message */
DEBUGP("found a setup message\n");
if (translen) {
rtsp_parse_transport(pdata+transoff, translen, &expinfo);
}
if (expinfo.loport == 0) {
DEBUGP("no udp transports found\n");
continue; /* no udp transports found */
}
DEBUGP("udp transport found, ports=(%d,%hu,%hu)\n",
(int)expinfo.pbtype, expinfo.loport, expinfo.hiport);
exp = nf_conntrack_expect_alloc(ct);
if (!exp) {
ret = NF_DROP;
goto out;
}
be_loport = htons(expinfo.loport);
nf_conntrack_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, ct->tuplehash[!dir].tuple.src.l3num,
/* media stream source can be different from the RTSP server address
&ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3, */
NULL, &ct->tuplehash[!dir].tuple.dst.u3,
IPPROTO_UDP, NULL, &be_loport);
exp->master = ct;
exp->expectfn = expected;
exp->flags = 0;
if (expinfo.pbtype == pb_range) {
DEBUGP("Changing expectation mask to handle multiple ports\n");
//exp->mask.dst.u.udp.port = 0xfffe;
}
DEBUGP("expect_related %u.%u.%u.%u:%u-%u.%u.%u.%u:%u\n",
NIPQUAD(exp->tuple.src.u3.ip),
ntohs(exp->tuple.src.u.udp.port),
NIPQUAD(exp->tuple.dst.u3.ip),
ntohs(exp->tuple.dst.u.udp.port));
nf_nat_rtsp = rcu_dereference(nf_nat_rtsp_hook);
if (nf_nat_rtsp && ct->status & IPS_NAT_MASK)
/* pass the request off to the nat helper */
ret = nf_nat_rtsp(skb, ctinfo, hdrsoff, hdrslen, &expinfo, exp);
else if (nf_conntrack_expect_related(exp) != 0) {
DEBUGP("nf_conntrack_expect_related failed\n");
ret = NF_DROP;
}
nf_conntrack_expect_put(exp);
goto out;
}
out:
return ret;
}
