Eric Lee / smarc-fsl-linux-kernel

Commit 3a8fc53a45c444400259e2e285ba414a87061e3d

Authored by Pablo Neira Ayuso 2012-01-15 23:34:08 +0800

netfilter: nf_ct_helper: allocate 16 bytes for the helper and policy names

This patch modifies the struct nf_conntrack_helper to allocate
the room for the helper name. The maximum length is 16 bytes
(this was already introduced in 2.6.24).

For the maximum length for expectation policy names, I have
also selected 16 bytes.

This patch is required by the follow-up patch to support
user-space connection tracking helpers.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Showing 7 changed files with 14 additions and 31 deletions Inline Diff

include/net/netfilter/nf_conntrack_expect.h
include/net/netfilter/nf_conntrack_helper.h
net/netfilter/nf_conntrack_ftp.c
net/netfilter/nf_conntrack_irc.c
net/netfilter/nf_conntrack_sane.c
net/netfilter/nf_conntrack_sip.c
net/netfilter/nf_conntrack_tftp.c

include/net/netfilter/nf_conntrack_expect.h

Diff comments View file @ 3a8fc53

 /*
  * connection tracking expectations.
  */
 #ifndef _NF_CONNTRACK_EXPECT_H
 #define _NF_CONNTRACK_EXPECT_H
 #include <net/netfilter/nf_conntrack.h>
 extern unsigned int nf_ct_expect_hsize;
 extern unsigned int nf_ct_expect_max;
 struct nf_conntrack_expect {
 	/* Conntrack expectation list member */
 	struct hlist_node lnode;
 	/* Hash member */
 	struct hlist_node hnode;
 	/* We expect this tuple, with the following mask */
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_mask mask;
 	/* Function to call after setup and insertion */
 	void (*expectfn)(struct nf_conn *new,
 			 struct nf_conntrack_expect *this);
 	/* Helper to assign to new connection */
 	struct nf_conntrack_helper *helper;
 	/* The conntrack of the master connection */
 	struct nf_conn *master;
 	/* Timer function; deletes the expectation. */
 	struct timer_list timeout;
 	/* Usage count. */
 	atomic_t use;
 	/* Flags */
 	unsigned int flags;
 	/* Expectation class */
 	unsigned int class;
 #ifdef CONFIG_NF_NAT_NEEDED
 	__be32 saved_ip;
 	/* This is the original per-proto part, used to map the
 	 * expected connection the way the recipient expects. */
 	union nf_conntrack_man_proto saved_proto;
 	/* Direction relative to the master connection. */
 	enum ip_conntrack_dir dir;
 #endif
 	struct rcu_head rcu;
 };
 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
 {
 	return nf_ct_net(exp->master);
 }
+#define NF_CT_EXP_POLICY_NAME_LEN	16
 struct nf_conntrack_expect_policy {
 	unsigned int	max_expected;
 	unsigned int	timeout;
-	const char	*name;
+	char		name[NF_CT_EXP_POLICY_NAME_LEN];
 };
 #define NF_CT_EXPECT_CLASS_DEFAULT	0
 int nf_conntrack_expect_init(struct net *net);
 void nf_conntrack_expect_fini(struct net *net);
 struct nf_conntrack_expect *
 __nf_ct_expect_find(struct net *net, u16 zone,
 		    const struct nf_conntrack_tuple *tuple);
 struct nf_conntrack_expect *
 nf_ct_expect_find_get(struct net *net, u16 zone,
 		      const struct nf_conntrack_tuple *tuple);
 struct nf_conntrack_expect *
 nf_ct_find_expectation(struct net *net, u16 zone,
 		       const struct nf_conntrack_tuple *tuple);
 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
 				u32 pid, int report);
 static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
 {
 	nf_ct_unlink_expect_report(exp, 0, 0);
 }
 void nf_ct_remove_expectations(struct nf_conn *ct);
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);
 /* Allocate space for an expectation: this is mandatory before calling
    nf_ct_expect_related.  You will have to call put afterwards. */
 struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me);
 void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, u_int8_t,
 		       const union nf_inet_addr *,
 		       const union nf_inet_addr *,
 		       u_int8_t, const __be16 *, const __be16 *);
 void nf_ct_expect_put(struct nf_conntrack_expect *exp);
 int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
 				u32 pid, int report);
 static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect)
 {
 	return nf_ct_expect_related_report(expect, 0, 0);
 }
 #endif /*_NF_CONNTRACK_EXPECT_H*/

include/net/netfilter/nf_conntrack_helper.h

Diff comments View file @ 3a8fc53

net/netfilter/nf_conntrack_ftp.c

Diff comments View file @ 3a8fc53

 /* FTP extension for connection tracking. */
 /* (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
 #include <linux/slab.h>
 #include <linux/ipv6.h>
 #include <linux/ctype.h>
 #include <linux/inet.h>
 #include <net/checksum.h>
 #include <net/tcp.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <linux/netfilter/nf_conntrack_ftp.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
 MODULE_DESCRIPTION("ftp connection tracking helper");
 MODULE_ALIAS("ip_conntrack_ftp");
 MODULE_ALIAS_NFCT_HELPER("ftp");
 /* This is slow, but it's simple. --RR */
 static char *ftp_buffer;
 static DEFINE_SPINLOCK(nf_ftp_lock);
 #define MAX_PORTS 8
 static u_int16_t ports[MAX_PORTS];
 static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 static bool loose;
 module_param(loose, bool, 0600);
 unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
 				enum ip_conntrack_info ctinfo,
 				enum nf_ct_ftp_type type,
 				unsigned int matchoff,
 				unsigned int matchlen,
 				struct nf_conntrack_expect *exp);
 EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
 static int try_rfc959(const char *, size_t, struct nf_conntrack_man *, char);
 static int try_eprt(const char *, size_t, struct nf_conntrack_man *, char);
 static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *,
 			     char);
 static struct ftp_search {
 	const char *pattern;
 	size_t plen;
 	char skip;
 	char term;
 	enum nf_ct_ftp_type ftptype;
 	int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char);
 } search[IP_CT_DIR_MAX][2] = {
 	[IP_CT_DIR_ORIGINAL] = {
 		{
 			.pattern	= "PORT",
 			.plen		= sizeof("PORT") - 1,
 			.skip		= ' ',
 			.term		= '\r',
 			.ftptype	= NF_CT_FTP_PORT,
 			.getnum		= try_rfc959,
 		},
 		{
 			.pattern	= "EPRT",
 			.plen		= sizeof("EPRT") - 1,
 			.skip		= ' ',
 			.term		= '\r',
 			.ftptype	= NF_CT_FTP_EPRT,
 			.getnum		= try_eprt,
 		},
 	},
 	[IP_CT_DIR_REPLY] = {
 		{
 			.pattern	= "227 ",
 			.plen		= sizeof("227 ") - 1,
 			.skip		= '(',
 			.term		= ')',
 			.ftptype	= NF_CT_FTP_PASV,
 			.getnum		= try_rfc959,
 		},
 		{
 			.pattern	= "229 ",
 			.plen		= sizeof("229 ") - 1,
 			.skip		= '(',
 			.term		= ')',
 			.ftptype	= NF_CT_FTP_EPSV,
 			.getnum		= try_epsv_response,
 		},
 	},
 };
 static int
 get_ipv6_addr(const char *src, size_t dlen, struct in6_addr *dst, u_int8_t term)
 {
 	const char *end;
 	int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
 	if (ret > 0)
 		return (int)(end - src);
 	return 0;
 }
 static int try_number(const char *data, size_t dlen, u_int32_t array[],
 		      int array_size, char sep, char term)
 {
 	u_int32_t i, len;
 	memset(array, 0, sizeof(array[0])*array_size);
 	/* Keep data pointing at next char. */
 	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
 		if (*data >= '0' && *data <= '9') {
 			array[i] = array[i]*10 + *data - '0';
 		}
 		else if (*data == sep)
 			i++;
 		else {
 			/* Unexpected character; true if it's the
 			   terminator and we're finished. */
 			if (*data == term && i == array_size - 1)
 				return len;
 			pr_debug("Char %u (got %u nums) `%u' unexpected\n",
 				 len, i, *data);
 			return 0;
 		}
 	}
 	pr_debug("Failed to fill %u numbers separated by %c\n",
 		 array_size, sep);
 	return 0;
 }
 /* Returns 0, or length of numbers: 192,168,1,1,5,6 */
 static int try_rfc959(const char *data, size_t dlen,
 		      struct nf_conntrack_man *cmd, char term)
 {
 	int length;
 	u_int32_t array[6];
 	length = try_number(data, dlen, array, 6, ',', term);
 	if (length == 0)
 		return 0;
 	cmd->u3.ip =  htonl((array[0] << 24) | (array[1] << 16) |
 				    (array[2] << 8) | array[3]);
 	cmd->u.tcp.port = htons((array[4] << 8) | array[5]);
 	return length;
 }
 /* Grab port: number up to delimiter */
 static int get_port(const char *data, int start, size_t dlen, char delim,
 		    __be16 *port)
 {
 	u_int16_t tmp_port = 0;
 	int i;
 	for (i = start; i < dlen; i++) {
 		/* Finished? */
 		if (data[i] == delim) {
 			if (tmp_port == 0)
 				break;
 			*port = htons(tmp_port);
 			pr_debug("get_port: return %d\n", tmp_port);
 			return i + 1;
 		}
 		else if (data[i] >= '0' && data[i] <= '9')
 			tmp_port = tmp_port*10 + data[i] - '0';
 		else { /* Some other crap */
 			pr_debug("get_port: invalid char.\n");
 			break;
 		}
 	}
 	return 0;
 }
 /* Returns 0, or length of numbers: |1|132.235.1.2|6275| or |2|3ffe::1|6275| */
 static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
 		    char term)
 {
 	char delim;
 	int length;
 	/* First character is delimiter, then "1" for IPv4 or "2" for IPv6,
 	   then delimiter again. */
 	if (dlen <= 3) {
 		pr_debug("EPRT: too short\n");
 		return 0;
 	}
 	delim = data[0];
 	if (isdigit(delim) || delim < 33 || delim > 126 || data[2] != delim) {
 		pr_debug("try_eprt: invalid delimitter.\n");
 		return 0;
 	}
 	if ((cmd->l3num == PF_INET && data[1] != '1') ||
 	    (cmd->l3num == PF_INET6 && data[1] != '2')) {
 		pr_debug("EPRT: invalid protocol number.\n");
 		return 0;
 	}
 	pr_debug("EPRT: Got %c%c%c\n", delim, data[1], delim);
 	if (data[1] == '1') {
 		u_int32_t array[4];
 		/* Now we have IP address. */
 		length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
 		if (length != 0)
 			cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16)
 					   | (array[2] << 8) | array[3]);
 	} else {
 		/* Now we have IPv6 address. */
 		length = get_ipv6_addr(data + 3, dlen - 3,
 				       (struct in6_addr *)cmd->u3.ip6, delim);
 	}
 	if (length == 0)
 		return 0;
 	pr_debug("EPRT: Got IP address!\n");
 	/* Start offset includes initial "|1|", and trailing delimiter */
 	return get_port(data, 3 + length + 1, dlen, delim, &cmd->u.tcp.port);
 }
 /* Returns 0, or length of numbers: |||6446| */
 static int try_epsv_response(const char *data, size_t dlen,
 			     struct nf_conntrack_man *cmd, char term)
 {
 	char delim;
 	/* Three delimiters. */
 	if (dlen <= 3) return 0;
 	delim = data[0];
 	if (isdigit(delim) || delim < 33 || delim > 126 ||
 	    data[1] != delim || data[2] != delim)
 		return 0;
 	return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
 }
 /* Return 1 for match, 0 for accept, -1 for partial. */
 static int find_pattern(const char *data, size_t dlen,
 			const char *pattern, size_t plen,
 			char skip, char term,
 			unsigned int *numoff,
 			unsigned int *numlen,
 			struct nf_conntrack_man *cmd,
 			int (*getnum)(const char *, size_t,
 				      struct nf_conntrack_man *, char))
 {
 	size_t i;
 	pr_debug("find_pattern `%s': dlen = %Zu\n", pattern, dlen);
 	if (dlen == 0)
 		return 0;
 	if (dlen <= plen) {
 		/* Short packet: try for partial? */
 		if (strnicmp(data, pattern, dlen) == 0)
 			return -1;
 		else return 0;
 	}
 	if (strnicmp(data, pattern, plen) != 0) {
 #if 0
 		size_t i;
 		pr_debug("ftp: string mismatch\n");
 		for (i = 0; i < plen; i++) {
 			pr_debug("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
 				 i, data[i], data[i],
 				 pattern[i], pattern[i]);
 		}
 #endif
 		return 0;
 	}
 	pr_debug("Pattern matches!\n");
 	/* Now we've found the constant string, try to skip
 	   to the 'skip' character */
 	for (i = plen; data[i] != skip; i++)
 		if (i == dlen - 1) return -1;
 	/* Skip over the last character */
 	i++;
 	pr_debug("Skipped up to `%c'!\n", skip);
 	*numoff = i;
 	*numlen = getnum(data + i, dlen - i, cmd, term);
 	if (!*numlen)
 		return -1;
 	pr_debug("Match succeeded!\n");
 	return 1;
 }
 /* Look up to see if we're just after a \n. */
 static int find_nl_seq(u32 seq, const struct nf_ct_ftp_master *info, int dir)
 {
 	unsigned int i;
 	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
 		if (info->seq_aft_nl[dir][i] == seq)
 			return 1;
 	return 0;
 }
 /* We don't update if it's older than what we have. */
 static void update_nl_seq(struct nf_conn *ct, u32 nl_seq,
 			  struct nf_ct_ftp_master *info, int dir,
 			  struct sk_buff *skb)
 {
 	unsigned int i, oldest;
 	/* Look for oldest: if we find exact match, we're done. */
 	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
 		if (info->seq_aft_nl[dir][i] == nl_seq)
 			return;
 	}
 	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
 		info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
 	} else {
 		if (before(info->seq_aft_nl[dir][0], info->seq_aft_nl[dir][1]))
 			oldest = 0;
 		else
 			oldest = 1;
 		if (after(nl_seq, info->seq_aft_nl[dir][oldest]))
 			info->seq_aft_nl[dir][oldest] = nl_seq;
 	}
 }
 static int help(struct sk_buff *skb,
 		unsigned int protoff,
 		struct nf_conn *ct,
 		enum ip_conntrack_info ctinfo)
 {
 	unsigned int dataoff, datalen;
 	const struct tcphdr *th;
 	struct tcphdr _tcph;
 	const char *fb_ptr;
 	int ret;
 	u32 seq;
 	int dir = CTINFO2DIR(ctinfo);
 	unsigned int uninitialized_var(matchlen), uninitialized_var(matchoff);
 	struct nf_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
 	struct nf_conntrack_expect *exp;
 	union nf_inet_addr *daddr;
 	struct nf_conntrack_man cmd = {};
 	unsigned int i;
 	int found = 0, ends_in_nl;
 	typeof(nf_nat_ftp_hook) nf_nat_ftp;
 	/* Until there's been traffic both ways, don't look in packets. */
 	if (ctinfo != IP_CT_ESTABLISHED &&
 	    ctinfo != IP_CT_ESTABLISHED_REPLY) {
 		pr_debug("ftp: Conntrackinfo = %u\n", ctinfo);
 		return NF_ACCEPT;
 	}
 	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
 	if (th == NULL)
 		return NF_ACCEPT;
 	dataoff = protoff + th->doff * 4;
 	/* No data? */
 	if (dataoff >= skb->len) {
 		pr_debug("ftp: dataoff(%u) >= skblen(%u)\n", dataoff,
 			 skb->len);
 		return NF_ACCEPT;
 	}
 	datalen = skb->len - dataoff;
 	spin_lock_bh(&nf_ftp_lock);
 	fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer);
 	BUG_ON(fb_ptr == NULL);
 	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
 	seq = ntohl(th->seq) + datalen;
 	/* Look up to see if we're just after a \n. */
 	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
 		/* Now if this ends in \n, update ftp info. */
 		pr_debug("nf_conntrack_ftp: wrong seq pos %s(%u) or %s(%u)\n",
 			 ct_ftp_info->seq_aft_nl_num[dir] > 0 ? "" : "(UNSET)",
 			 ct_ftp_info->seq_aft_nl[dir][0],
 			 ct_ftp_info->seq_aft_nl_num[dir] > 1 ? "" : "(UNSET)",
 			 ct_ftp_info->seq_aft_nl[dir][1]);
 		ret = NF_ACCEPT;
 		goto out_update_nl;
 	}
 	/* Initialize IP/IPv6 addr to expected address (it's not mentioned
 	   in EPSV responses) */
 	cmd.l3num = nf_ct_l3num(ct);
 	memcpy(cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
 	       sizeof(cmd.u3.all));
 	for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
 		found = find_pattern(fb_ptr, datalen,
 				     search[dir][i].pattern,
 				     search[dir][i].plen,
 				     search[dir][i].skip,
 				     search[dir][i].term,
 				     &matchoff, &matchlen,
 				     &cmd,
 				     search[dir][i].getnum);
 		if (found) break;
 	}
 	if (found == -1) {
 		/* We don't usually drop packets.  After all, this is
 		   connection tracking, not packet filtering.
 		   However, it is necessary for accurate tracking in
 		   this case. */
 		pr_debug("conntrack_ftp: partial %s %u+%u\n",
 			 search[dir][i].pattern,  ntohl(th->seq), datalen);
 		ret = NF_DROP;
 		goto out;
 	} else if (found == 0) { /* No match */
 		ret = NF_ACCEPT;
 		goto out_update_nl;
 	}
 	pr_debug("conntrack_ftp: match `%.*s' (%u bytes at %u)\n",
 		 matchlen, fb_ptr + matchoff,
 		 matchlen, ntohl(th->seq) + matchoff);
 	exp = nf_ct_expect_alloc(ct);
 	if (exp == NULL) {
 		ret = NF_DROP;
 		goto out;
 	}
 	/* We refer to the reverse direction ("!dir") tuples here,
 	 * because we're expecting something in the other direction.
 	 * Doesn't matter unless NAT is happening.  */
 	daddr = &ct->tuplehash[!dir].tuple.dst.u3;
 	/* Update the ftp info */
 	if ((cmd.l3num == nf_ct_l3num(ct)) &&
 	    memcmp(&cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
 		     sizeof(cmd.u3.all))) {
 		/* Enrico Scholz's passive FTP to partially RNAT'd ftp
 		   server: it really wants us to connect to a
 		   different IP address.  Simply don't record it for
 		   NAT. */
 		if (cmd.l3num == PF_INET) {
 			pr_debug("conntrack_ftp: NOT RECORDING: %pI4 != %pI4\n",
 				 &cmd.u3.ip,
 				 &ct->tuplehash[dir].tuple.src.u3.ip);
 		} else {
 			pr_debug("conntrack_ftp: NOT RECORDING: %pI6 != %pI6\n",
 				 cmd.u3.ip6,
 				 ct->tuplehash[dir].tuple.src.u3.ip6);
 		}
 		/* Thanks to Cristiano Lincoln Mattos
 		   <lincoln@cesar.org.br> for reporting this potential
 		   problem (DMZ machines opening holes to internal
 		   networks, or the packet filter itself). */
 		if (!loose) {
 			ret = NF_ACCEPT;
 			goto out_put_expect;
 		}
 		daddr = &cmd.u3;
 	}
 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, cmd.l3num,
 			  &ct->tuplehash[!dir].tuple.src.u3, daddr,
 			  IPPROTO_TCP, NULL, &cmd.u.tcp.port);
 	/* Now, NAT might want to mangle the packet, and register the
 	 * (possibly changed) expectation itself. */
 	nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
 	if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
 		ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
 				 matchoff, matchlen, exp);
 	else {
 		/* Can't expect this?  Best to drop packet now. */
 		if (nf_ct_expect_related(exp) != 0)
 			ret = NF_DROP;
 		else
 			ret = NF_ACCEPT;
 	}
 out_put_expect:
 	nf_ct_expect_put(exp);
 out_update_nl:
 	/* Now if this ends in \n, update ftp info.  Seq may have been
 	 * adjusted by NAT code. */
 	if (ends_in_nl)
 		update_nl_seq(ct, seq, ct_ftp_info, dir, skb);
  out:
 	spin_unlock_bh(&nf_ftp_lock);
 	return ret;
 }
 static struct nf_conntrack_helper ftp[MAX_PORTS][2] __read_mostly;
-static char ftp_names[MAX_PORTS][2][sizeof("ftp-65535")] __read_mostly;
 static const struct nf_conntrack_expect_policy ftp_exp_policy = {
 	.max_expected	= 1,
 	.timeout	= 5 * 60,
 };
 /* don't make this __exit, since it's called from __init ! */
 static void nf_conntrack_ftp_fini(void)
 {
 	int i, j;
 	for (i = 0; i < ports_c; i++) {
 		for (j = 0; j < 2; j++) {
 			if (ftp[i][j].me == NULL)
 				continue;
 			pr_debug("nf_ct_ftp: unregistering helper for pf: %d "
 				 "port: %d\n",
 				 ftp[i][j].tuple.src.l3num, ports[i]);
 			nf_conntrack_helper_unregister(&ftp[i][j]);
 		}
 	}
 	kfree(ftp_buffer);
 }
 static int __init nf_conntrack_ftp_init(void)
 {
 	int i, j = -1, ret = 0;
-	char *tmpname;
 	ftp_buffer = kmalloc(65536, GFP_KERNEL);
 	if (!ftp_buffer)
 		return -ENOMEM;
 	if (ports_c == 0)
 		ports[ports_c++] = FTP_PORT;
 	/* FIXME should be configurable whether IPv4 and IPv6 FTP connections
 		 are tracked or not - YK */
 	for (i = 0; i < ports_c; i++) {
 		ftp[i][0].tuple.src.l3num = PF_INET;
 		ftp[i][1].tuple.src.l3num = PF_INET6;
 		for (j = 0; j < 2; j++) {
 			ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
 			ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
 			ftp[i][j].expect_policy = &ftp_exp_policy;
 			ftp[i][j].me = THIS_MODULE;
 			ftp[i][j].help = help;
-			tmpname = &ftp_names[i][j][0];
 			if (ports[i] == FTP_PORT)
-				sprintf(tmpname, "ftp");
+				sprintf(ftp[i][j].name, "ftp");
 			else
-				sprintf(tmpname, "ftp-%d", ports[i]);
+				sprintf(ftp[i][j].name, "ftp-%d", ports[i]);
-			ftp[i][j].name = tmpname;
 			pr_debug("nf_ct_ftp: registering helper for pf: %d "
 				 "port: %d\n",
 				 ftp[i][j].tuple.src.l3num, ports[i]);
 			ret = nf_conntrack_helper_register(&ftp[i][j]);
 			if (ret) {
 				printk(KERN_ERR "nf_ct_ftp: failed to register"
 				       " helper for pf: %d port: %d\n",
 					ftp[i][j].tuple.src.l3num, ports[i]);
 				nf_conntrack_ftp_fini();
 				return ret;
 			}
 		}
 	}
 	return 0;
 }
 module_init(nf_conntrack_ftp_init);
 module_exit(nf_conntrack_ftp_fini);

net/netfilter/nf_conntrack_irc.c

Diff comments View file @ 3a8fc53

 /* IRC extension for IP connection tracking, Version 1.21
  * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
  * based on RR's ip_conntrack_ftp.c
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version
  * 2 of the License, or (at your option) any later version.
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/skbuff.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/netfilter.h>
 #include <linux/slab.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <linux/netfilter/nf_conntrack_irc.h>
 #define MAX_PORTS 8
 static unsigned short ports[MAX_PORTS];
 static unsigned int ports_c;
 static unsigned int max_dcc_channels = 8;
 static unsigned int dcc_timeout __read_mostly = 300;
 /* This is slow, but it's simple. --RR */
 static char *irc_buffer;
 static DEFINE_SPINLOCK(irc_buffer_lock);
 unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
 				enum ip_conntrack_info ctinfo,
 				unsigned int matchoff,
 				unsigned int matchlen,
 				struct nf_conntrack_expect *exp) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_irc");
 MODULE_ALIAS_NFCT_HELPER("irc");
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
 module_param(max_dcc_channels, uint, 0400);
 MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
 				   "IRC session");
 module_param(dcc_timeout, uint, 0400);
 MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
 static const char *const dccprotos[] = {
 	"SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
 };
 #define MINMATCHLEN	5
 /* tries to get the ip_addr and port out of a dcc command
  * return value: -1 on failure, 0 on success
  *	data		pointer to first byte of DCC command data
  *	data_end	pointer to last byte of dcc command data
  *	ip		returns parsed ip of dcc command
  *	port		returns parsed port of dcc command
  *	ad_beg_p	returns pointer to first byte of addr data
  *	ad_end_p	returns pointer to last byte of addr data
  */
 static int parse_dcc(char *data, const char *data_end, __be32 *ip,
 		     u_int16_t *port, char **ad_beg_p, char **ad_end_p)
 {
 	char *tmp;
 	/* at least 12: "AAAAAAAA P\1\n" */
 	while (*data++ != ' ')
 		if (data > data_end - 12)
 			return -1;
 	/* Make sure we have a newline character within the packet boundaries
 	 * because simple_strtoul parses until the first invalid character. */
 	for (tmp = data; tmp <= data_end; tmp++)
 		if (*tmp == '\n')
 			break;
 	if (tmp > data_end || *tmp != '\n')
 		return -1;
 	*ad_beg_p = data;
 	*ip = cpu_to_be32(simple_strtoul(data, &data, 10));
 	/* skip blanks between ip and port */
 	while (*data == ' ') {
 		if (data >= data_end)
 			return -1;
 		data++;
 	}
 	*port = simple_strtoul(data, &data, 10);
 	*ad_end_p = data;
 	return 0;
 }
 static int help(struct sk_buff *skb, unsigned int protoff,
 		struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
 	unsigned int dataoff;
 	const struct iphdr *iph;
 	const struct tcphdr *th;
 	struct tcphdr _tcph;
 	const char *data_limit;
 	char *data, *ib_ptr;
 	int dir = CTINFO2DIR(ctinfo);
 	struct nf_conntrack_expect *exp;
 	struct nf_conntrack_tuple *tuple;
 	__be32 dcc_ip;
 	u_int16_t dcc_port;
 	__be16 port;
 	int i, ret = NF_ACCEPT;
 	char *addr_beg_p, *addr_end_p;
 	typeof(nf_nat_irc_hook) nf_nat_irc;
 	/* If packet is coming from IRC server */
 	if (dir == IP_CT_DIR_REPLY)
 		return NF_ACCEPT;
 	/* Until there's been traffic both ways, don't look in packets. */
 	if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
 		return NF_ACCEPT;
 	/* Not a full tcp header? */
 	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
 	if (th == NULL)
 		return NF_ACCEPT;
 	/* No data? */
 	dataoff = protoff + th->doff*4;
 	if (dataoff >= skb->len)
 		return NF_ACCEPT;
 	spin_lock_bh(&irc_buffer_lock);
 	ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
 				    irc_buffer);
 	BUG_ON(ib_ptr == NULL);
 	data = ib_ptr;
 	data_limit = ib_ptr + skb->len - dataoff;
 	/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
 	 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
 	while (data < data_limit - (19 + MINMATCHLEN)) {
 		if (memcmp(data, "\1DCC ", 5)) {
 			data++;
 			continue;
 		}
 		data += 5;
 		/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
 		iph = ip_hdr(skb);
 		pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
 			 &iph->saddr, ntohs(th->source),
 			 &iph->daddr, ntohs(th->dest));
 		for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
 			if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
 				/* no match */
 				continue;
 			}
 			data += strlen(dccprotos[i]);
 			pr_debug("DCC %s detected\n", dccprotos[i]);
 			/* we have at least
 			 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
 			 * data left (== 14/13 bytes) */
 			if (parse_dcc(data, data_limit, &dcc_ip,
 				       &dcc_port, &addr_beg_p, &addr_end_p)) {
 				pr_debug("unable to parse dcc command\n");
 				continue;
 			}
 			pr_debug("DCC bound ip/port: %pI4:%u\n",
 				 &dcc_ip, dcc_port);
 			/* dcc_ip can be the internal OR external (NAT'ed) IP */
 			tuple = &ct->tuplehash[dir].tuple;
 			if (tuple->src.u3.ip != dcc_ip &&
 			    tuple->dst.u3.ip != dcc_ip) {
 				net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
 						     &tuple->src.u3.ip,
 						     &dcc_ip, dcc_port);
 				continue;
 			}
 			exp = nf_ct_expect_alloc(ct);
 			if (exp == NULL) {
 				ret = NF_DROP;
 				goto out;
 			}
 			tuple = &ct->tuplehash[!dir].tuple;
 			port = htons(dcc_port);
 			nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
 					  tuple->src.l3num,
 					  NULL, &tuple->dst.u3,
 					  IPPROTO_TCP, NULL, &port);
 			nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
 			if (nf_nat_irc && ct->status & IPS_NAT_MASK)
 				ret = nf_nat_irc(skb, ctinfo,
 						 addr_beg_p - ib_ptr,
 						 addr_end_p - addr_beg_p,
 						 exp);
 			else if (nf_ct_expect_related(exp) != 0)
 				ret = NF_DROP;
 			nf_ct_expect_put(exp);
 			goto out;
 		}
 	}
  out:
 	spin_unlock_bh(&irc_buffer_lock);
 	return ret;
 }
 static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
-static char irc_names[MAX_PORTS][sizeof("irc-65535")] __read_mostly;
 static struct nf_conntrack_expect_policy irc_exp_policy;
 static void nf_conntrack_irc_fini(void);
 static int __init nf_conntrack_irc_init(void)
 {
 	int i, ret;
-	char *tmpname;
 	if (max_dcc_channels < 1) {
 		printk(KERN_ERR "nf_ct_irc: max_dcc_channels must not be zero\n");
 		return -EINVAL;
 	}
 	irc_exp_policy.max_expected = max_dcc_channels;
 	irc_exp_policy.timeout = dcc_timeout;
 	irc_buffer = kmalloc(65536, GFP_KERNEL);
 	if (!irc_buffer)
 		return -ENOMEM;
 	/* If no port given, default to standard irc port */
 	if (ports_c == 0)
 		ports[ports_c++] = IRC_PORT;
 	for (i = 0; i < ports_c; i++) {
 		irc[i].tuple.src.l3num = AF_INET;
 		irc[i].tuple.src.u.tcp.port = htons(ports[i]);
 		irc[i].tuple.dst.protonum = IPPROTO_TCP;
 		irc[i].expect_policy = &irc_exp_policy;
 		irc[i].me = THIS_MODULE;
 		irc[i].help = help;
-		tmpname = &irc_names[i][0];
 		if (ports[i] == IRC_PORT)
-			sprintf(tmpname, "irc");
+			sprintf(irc[i].name, "irc");
 		else
-			sprintf(tmpname, "irc-%u", i);
+			sprintf(irc[i].name, "irc-%u", i);
-		irc[i].name = tmpname;
 		ret = nf_conntrack_helper_register(&irc[i]);
 		if (ret) {
 			printk(KERN_ERR "nf_ct_irc: failed to register helper "
 			       "for pf: %u port: %u\n",
 			       irc[i].tuple.src.l3num, ports[i]);
 			nf_conntrack_irc_fini();
 			return ret;
 		}
 	}
 	return 0;
 }
 /* This function is intentionally _NOT_ defined as __exit, because
  * it is needed by the init function */
 static void nf_conntrack_irc_fini(void)
 {
 	int i;
 	for (i = 0; i < ports_c; i++)
 		nf_conntrack_helper_unregister(&irc[i]);
 	kfree(irc_buffer);
 }
 module_init(nf_conntrack_irc_init);
 module_exit(nf_conntrack_irc_fini);

net/netfilter/nf_conntrack_sane.c

Diff comments View file @ 3a8fc53

 /* SANE connection tracking helper
  * (SANE = Scanner Access Now Easy)
  * For documentation about the SANE network protocol see
  * http://www.sane-project.org/html/doc015.html
  */
 /* Copyright (C) 2007 Red Hat, Inc.
  * Author: Michal Schmidt <mschmidt@redhat.com>
  * Based on the FTP conntrack helper (net/netfilter/nf_conntrack_ftp.c):
  *  (C) 1999-2001 Paul `Rusty' Russell
  *  (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  *  (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  *  (C) 2003 Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter.h>
 #include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/tcp.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <linux/netfilter/nf_conntrack_sane.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Schmidt <mschmidt@redhat.com>");
 MODULE_DESCRIPTION("SANE connection tracking helper");
 MODULE_ALIAS_NFCT_HELPER("sane");
 static char *sane_buffer;
 static DEFINE_SPINLOCK(nf_sane_lock);
 #define MAX_PORTS 8
 static u_int16_t ports[MAX_PORTS];
 static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 struct sane_request {
 	__be32 RPC_code;
 #define SANE_NET_START      7   /* RPC code */
 	__be32 handle;
 };
 struct sane_reply_net_start {
 	__be32 status;
 #define SANE_STATUS_SUCCESS 0
 	__be16 zero;
 	__be16 port;
 	/* other fields aren't interesting for conntrack */
 };
 static int help(struct sk_buff *skb,
 		unsigned int protoff,
 		struct nf_conn *ct,
 		enum ip_conntrack_info ctinfo)
 {
 	unsigned int dataoff, datalen;
 	const struct tcphdr *th;
 	struct tcphdr _tcph;
 	void *sb_ptr;
 	int ret = NF_ACCEPT;
 	int dir = CTINFO2DIR(ctinfo);
 	struct nf_ct_sane_master *ct_sane_info;
 	struct nf_conntrack_expect *exp;
 	struct nf_conntrack_tuple *tuple;
 	struct sane_request *req;
 	struct sane_reply_net_start *reply;
 	ct_sane_info = &nfct_help(ct)->help.ct_sane_info;
 	/* Until there's been traffic both ways, don't look in packets. */
 	if (ctinfo != IP_CT_ESTABLISHED &&
 	    ctinfo != IP_CT_ESTABLISHED_REPLY)
 		return NF_ACCEPT;
 	/* Not a full tcp header? */
 	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
 	if (th == NULL)
 		return NF_ACCEPT;
 	/* No data? */
 	dataoff = protoff + th->doff * 4;
 	if (dataoff >= skb->len)
 		return NF_ACCEPT;
 	datalen = skb->len - dataoff;
 	spin_lock_bh(&nf_sane_lock);
 	sb_ptr = skb_header_pointer(skb, dataoff, datalen, sane_buffer);
 	BUG_ON(sb_ptr == NULL);
 	if (dir == IP_CT_DIR_ORIGINAL) {
 		if (datalen != sizeof(struct sane_request))
 			goto out;
 		req = sb_ptr;
 		if (req->RPC_code != htonl(SANE_NET_START)) {
 			/* Not an interesting command */
 			ct_sane_info->state = SANE_STATE_NORMAL;
 			goto out;
 		}
 		/* We're interested in the next reply */
 		ct_sane_info->state = SANE_STATE_START_REQUESTED;
 		goto out;
 	}
 	/* Is it a reply to an uninteresting command? */
 	if (ct_sane_info->state != SANE_STATE_START_REQUESTED)
 		goto out;
 	/* It's a reply to SANE_NET_START. */
 	ct_sane_info->state = SANE_STATE_NORMAL;
 	if (datalen < sizeof(struct sane_reply_net_start)) {
 		pr_debug("nf_ct_sane: NET_START reply too short\n");
 		goto out;
 	}
 	reply = sb_ptr;
 	if (reply->status != htonl(SANE_STATUS_SUCCESS)) {
 		/* saned refused the command */
 		pr_debug("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
 			 ntohl(reply->status));
 		goto out;
 	}
 	/* Invalid saned reply? Ignore it. */
 	if (reply->zero != 0)
 		goto out;
 	exp = nf_ct_expect_alloc(ct);
 	if (exp == NULL) {
 		ret = NF_DROP;
 		goto out;
 	}
 	tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
 			  &tuple->src.u3, &tuple->dst.u3,
 			  IPPROTO_TCP, NULL, &reply->port);
 	pr_debug("nf_ct_sane: expect: ");
 	nf_ct_dump_tuple(&exp->tuple);
 	/* Can't expect this?  Best to drop packet now. */
 	if (nf_ct_expect_related(exp) != 0)
 		ret = NF_DROP;
 	nf_ct_expect_put(exp);
 out:
 	spin_unlock_bh(&nf_sane_lock);
 	return ret;
 }
 static struct nf_conntrack_helper sane[MAX_PORTS][2] __read_mostly;
-static char sane_names[MAX_PORTS][2][sizeof("sane-65535")] __read_mostly;
 static const struct nf_conntrack_expect_policy sane_exp_policy = {
 	.max_expected	= 1,
 	.timeout	= 5 * 60,
 };
 /* don't make this __exit, since it's called from __init ! */
 static void nf_conntrack_sane_fini(void)
 {
 	int i, j;
 	for (i = 0; i < ports_c; i++) {
 		for (j = 0; j < 2; j++) {
 			pr_debug("nf_ct_sane: unregistering helper for pf: %d "
 				 "port: %d\n",
 				 sane[i][j].tuple.src.l3num, ports[i]);
 			nf_conntrack_helper_unregister(&sane[i][j]);
 		}
 	}
 	kfree(sane_buffer);
 }
 static int __init nf_conntrack_sane_init(void)
 {
 	int i, j = -1, ret = 0;
-	char *tmpname;
 	sane_buffer = kmalloc(65536, GFP_KERNEL);
 	if (!sane_buffer)
 		return -ENOMEM;
 	if (ports_c == 0)
 		ports[ports_c++] = SANE_PORT;
 	/* FIXME should be configurable whether IPv4 and IPv6 connections
 		 are tracked or not - YK */
 	for (i = 0; i < ports_c; i++) {
 		sane[i][0].tuple.src.l3num = PF_INET;
 		sane[i][1].tuple.src.l3num = PF_INET6;
 		for (j = 0; j < 2; j++) {
 			sane[i][j].tuple.src.u.tcp.port = htons(ports[i]);
 			sane[i][j].tuple.dst.protonum = IPPROTO_TCP;
 			sane[i][j].expect_policy = &sane_exp_policy;
 			sane[i][j].me = THIS_MODULE;
 			sane[i][j].help = help;
-			tmpname = &sane_names[i][j][0];
 			if (ports[i] == SANE_PORT)
-				sprintf(tmpname, "sane");
+				sprintf(sane[i][j].name, "sane");
 			else
-				sprintf(tmpname, "sane-%d", ports[i]);
+				sprintf(sane[i][j].name, "sane-%d", ports[i]);
-			sane[i][j].name = tmpname;
 			pr_debug("nf_ct_sane: registering helper for pf: %d "
 				 "port: %d\n",
 				 sane[i][j].tuple.src.l3num, ports[i]);
 			ret = nf_conntrack_helper_register(&sane[i][j]);
 			if (ret) {
 				printk(KERN_ERR "nf_ct_sane: failed to "
 				       "register helper for pf: %d port: %d\n",
 					sane[i][j].tuple.src.l3num, ports[i]);
 				nf_conntrack_sane_fini();
 				return ret;
 			}
 		}
 	}
 	return 0;
 }
 module_init(nf_conntrack_sane_init);
 module_exit(nf_conntrack_sane_fini);

net/netfilter/nf_conntrack_sip.c

Diff comments View file @ 3a8fc53

 /* SIP extension for IP connection tracking.
  *
  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  * based on RR's ip_conntrack_ftp.c and other modules.
  * (C) 2007 United Security Providers
  * (C) 2007, 2008 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/ctype.h>
 #include <linux/skbuff.h>
 #include <linux/inet.h>
 #include <linux/in.h>
 #include <linux/udp.h>
 #include <linux/tcp.h>
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_conntrack_sip.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
 MODULE_DESCRIPTION("SIP connection tracking helper");
 MODULE_ALIAS("ip_conntrack_sip");
 MODULE_ALIAS_NFCT_HELPER("sip");
 #define MAX_PORTS	8
 static unsigned short ports[MAX_PORTS];
 static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
 module_param(sip_timeout, uint, 0600);
 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
 static int sip_direct_signalling __read_mostly = 1;
 module_param(sip_direct_signalling, int, 0600);
 MODULE_PARM_DESC(sip_direct_signalling, "expect incoming calls from registrar "
 					"only (default 1)");
 static int sip_direct_media __read_mostly = 1;
 module_param(sip_direct_media, int, 0600);
 MODULE_PARM_DESC(sip_direct_media, "Expect Media streams between signalling "
 				   "endpoints only (default 1)");
 unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb, unsigned int dataoff,
 				const char **dptr,
 				unsigned int *datalen) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
 void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb, s16 off) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_seq_adjust_hook);
 unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
 				       unsigned int dataoff,
 				       const char **dptr,
 				       unsigned int *datalen,
 				       struct nf_conntrack_expect *exp,
 				       unsigned int matchoff,
 				       unsigned int matchlen) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_expect_hook);
 unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb, unsigned int dataoff,
 				     const char **dptr,
 				     unsigned int *datalen,
 				     unsigned int sdpoff,
 				     enum sdp_header_types type,
 				     enum sdp_header_types term,
 				     const union nf_inet_addr *addr)
 				     __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_addr_hook);
 unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb, unsigned int dataoff,
 				     const char **dptr,
 				     unsigned int *datalen,
 				     unsigned int matchoff,
 				     unsigned int matchlen,
 				     u_int16_t port) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_port_hook);
 unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
 					unsigned int dataoff,
 					const char **dptr,
 					unsigned int *datalen,
 					unsigned int sdpoff,
 					const union nf_inet_addr *addr)
 					__read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_session_hook);
 unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb, unsigned int dataoff,
 				      const char **dptr,
 				      unsigned int *datalen,
 				      struct nf_conntrack_expect *rtp_exp,
 				      struct nf_conntrack_expect *rtcp_exp,
 				      unsigned int mediaoff,
 				      unsigned int medialen,
 				      union nf_inet_addr *rtp_addr)
 				      __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_media_hook);
 static int string_len(const struct nf_conn *ct, const char *dptr,
 		      const char *limit, int *shift)
 {
 	int len = 0;
 	while (dptr < limit && isalpha(*dptr)) {
 		dptr++;
 		len++;
 	}
 	return len;
 }
 static int digits_len(const struct nf_conn *ct, const char *dptr,
 		      const char *limit, int *shift)
 {
 	int len = 0;
 	while (dptr < limit && isdigit(*dptr)) {
 		dptr++;
 		len++;
 	}
 	return len;
 }
 static int iswordc(const char c)
 {
 	if (isalnum(c) || c == '!' || c == '"' || c == '%' ||
 	    (c >= '(' && c <= '/') || c == ':' || c == '<' || c == '>' ||
 	    c == '?' || (c >= '[' && c <= ']') || c == '_' || c == '`' ||
 	    c == '{' || c == '}' || c == '~')
 		return 1;
 	return 0;
 }
 static int word_len(const char *dptr, const char *limit)
 {
 	int len = 0;
 	while (dptr < limit && iswordc(*dptr)) {
 		dptr++;
 		len++;
 	}
 	return len;
 }
 static int callid_len(const struct nf_conn *ct, const char *dptr,
 		      const char *limit, int *shift)
 {
 	int len, domain_len;
 	len = word_len(dptr, limit);
 	dptr += len;
 	if (!len || dptr == limit || *dptr != '@')
 		return len;
 	dptr++;
 	len++;
 	domain_len = word_len(dptr, limit);
 	if (!domain_len)
 		return 0;
 	return len + domain_len;
 }
 /* get media type + port length */
 static int media_len(const struct nf_conn *ct, const char *dptr,
 		     const char *limit, int *shift)
 {
 	int len = string_len(ct, dptr, limit, shift);
 	dptr += len;
 	if (dptr >= limit || *dptr != ' ')
 		return 0;
 	len++;
 	dptr++;
 	return len + digits_len(ct, dptr, limit, shift);
 }
 static int parse_addr(const struct nf_conn *ct, const char *cp,
                       const char **endp, union nf_inet_addr *addr,
                       const char *limit)
 {
 	const char *end;
 	int ret = 0;
 	if (!ct)
 		return 0;
 	memset(addr, 0, sizeof(*addr));
 	switch (nf_ct_l3num(ct)) {
 	case AF_INET:
 		ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
 		break;
 	case AF_INET6:
 		ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
 		break;
 	default:
 		BUG();
 	}
 	if (ret == 0 || end == cp)
 		return 0;
 	if (endp)
 		*endp = end;
 	return 1;
 }
 /* skip ip address. returns its length. */
 static int epaddr_len(const struct nf_conn *ct, const char *dptr,
 		      const char *limit, int *shift)
 {
 	union nf_inet_addr addr;
 	const char *aux = dptr;
 	if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
 		pr_debug("ip: %s parse failed.!\n", dptr);
 		return 0;
 	}
 	/* Port number */
 	if (*dptr == ':') {
 		dptr++;
 		dptr += digits_len(ct, dptr, limit, shift);
 	}
 	return dptr - aux;
 }
 /* get address length, skiping user info. */
 static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
 			  const char *limit, int *shift)
 {
 	const char *start = dptr;
 	int s = *shift;
 	/* Search for @, but stop at the end of the line.
 	 * We are inside a sip: URI, so we don't need to worry about
 	 * continuation lines. */
 	while (dptr < limit &&
 	       *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
 		(*shift)++;
 		dptr++;
 	}
 	if (dptr < limit && *dptr == '@') {
 		dptr++;
 		(*shift)++;
 	} else {
 		dptr = start;
 		*shift = s;
 	}
 	return epaddr_len(ct, dptr, limit, shift);
 }
 /* Parse a SIP request line of the form:
  *
  * Request-Line = Method SP Request-URI SP SIP-Version CRLF
  *
  * and return the offset and length of the address contained in the Request-URI.
  */
 int ct_sip_parse_request(const struct nf_conn *ct,
 			 const char *dptr, unsigned int datalen,
 			 unsigned int *matchoff, unsigned int *matchlen,
 			 union nf_inet_addr *addr, __be16 *port)
 {
 	const char *start = dptr, *limit = dptr + datalen, *end;
 	unsigned int mlen;
 	unsigned int p;
 	int shift = 0;
 	/* Skip method and following whitespace */
 	mlen = string_len(ct, dptr, limit, NULL);
 	if (!mlen)
 		return 0;
 	dptr += mlen;
 	if (++dptr >= limit)
 		return 0;
 	/* Find SIP URI */
 	for (; dptr < limit - strlen("sip:"); dptr++) {
 		if (*dptr == '\r' || *dptr == '\n')
 			return -1;
 		if (strnicmp(dptr, "sip:", strlen("sip:")) == 0) {
 			dptr += strlen("sip:");
 			break;
 		}
 	}
 	if (!skp_epaddr_len(ct, dptr, limit, &shift))
 		return 0;
 	dptr += shift;
 	if (!parse_addr(ct, dptr, &end, addr, limit))
 		return -1;
 	if (end < limit && *end == ':') {
 		end++;
 		p = simple_strtoul(end, (char **)&end, 10);
 		if (p < 1024 || p > 65535)
 			return -1;
 		*port = htons(p);
 	} else
 		*port = htons(SIP_PORT);
 	if (end == dptr)
 		return 0;
 	*matchoff = dptr - start;
 	*matchlen = end - dptr;
 	return 1;
 }
 EXPORT_SYMBOL_GPL(ct_sip_parse_request);
 /* SIP header parsing: SIP headers are located at the beginning of a line, but
  * may span several lines, in which case the continuation lines begin with a
  * whitespace character. RFC 2543 allows lines to be terminated with CR, LF or
  * CRLF, RFC 3261 allows only CRLF, we support both.
  *
  * Headers are followed by (optionally) whitespace, a colon, again (optionally)
  * whitespace and the values. Whitespace in this context means any amount of
  * tabs, spaces and continuation lines, which are treated as a single whitespace
  * character.
  *
  * Some headers may appear multiple times. A comma separated list of values is
  * equivalent to multiple headers.
  */
 static const struct sip_header ct_sip_hdrs[] = {
 	[SIP_HDR_CSEQ]			= SIP_HDR("CSeq", NULL, NULL, digits_len),
 	[SIP_HDR_FROM]			= SIP_HDR("From", "f", "sip:", skp_epaddr_len),
 	[SIP_HDR_TO]			= SIP_HDR("To", "t", "sip:", skp_epaddr_len),
 	[SIP_HDR_CONTACT]		= SIP_HDR("Contact", "m", "sip:", skp_epaddr_len),
 	[SIP_HDR_VIA_UDP]		= SIP_HDR("Via", "v", "UDP ", epaddr_len),
 	[SIP_HDR_VIA_TCP]		= SIP_HDR("Via", "v", "TCP ", epaddr_len),
 	[SIP_HDR_EXPIRES]		= SIP_HDR("Expires", NULL, NULL, digits_len),
 	[SIP_HDR_CONTENT_LENGTH]	= SIP_HDR("Content-Length", "l", NULL, digits_len),
 	[SIP_HDR_CALL_ID]		= SIP_HDR("Call-Id", "i", NULL, callid_len),
 };
 static const char *sip_follow_continuation(const char *dptr, const char *limit)
 {
 	/* Walk past newline */
 	if (++dptr >= limit)
 		return NULL;
 	/* Skip '\n' in CR LF */
 	if (*(dptr - 1) == '\r' && *dptr == '\n') {
 		if (++dptr >= limit)
 			return NULL;
 	}
 	/* Continuation line? */
 	if (*dptr != ' ' && *dptr != '\t')
 		return NULL;
 	/* skip leading whitespace */
 	for (; dptr < limit; dptr++) {
 		if (*dptr != ' ' && *dptr != '\t')
 			break;
 	}
 	return dptr;
 }
 static const char *sip_skip_whitespace(const char *dptr, const char *limit)
 {
 	for (; dptr < limit; dptr++) {
 		if (*dptr == ' ')
 			continue;
 		if (*dptr != '\r' && *dptr != '\n')
 			break;
 		dptr = sip_follow_continuation(dptr, limit);
 		if (dptr == NULL)
 			return NULL;
 	}
 	return dptr;
 }
 /* Search within a SIP header value, dealing with continuation lines */
 static const char *ct_sip_header_search(const char *dptr, const char *limit,
 					const char *needle, unsigned int len)
 {
 	for (limit -= len; dptr < limit; dptr++) {
 		if (*dptr == '\r' || *dptr == '\n') {
 			dptr = sip_follow_continuation(dptr, limit);
 			if (dptr == NULL)
 				break;
 			continue;
 		}
 		if (strnicmp(dptr, needle, len) == 0)
 			return dptr;
 	}
 	return NULL;
 }
 int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
 		      unsigned int dataoff, unsigned int datalen,
 		      enum sip_header_types type,
 		      unsigned int *matchoff, unsigned int *matchlen)
 {
 	const struct sip_header *hdr = &ct_sip_hdrs[type];
 	const char *start = dptr, *limit = dptr + datalen;
 	int shift = 0;
 	for (dptr += dataoff; dptr < limit; dptr++) {
 		/* Find beginning of line */
 		if (*dptr != '\r' && *dptr != '\n')
 			continue;
 		if (++dptr >= limit)
 			break;
 		if (*(dptr - 1) == '\r' && *dptr == '\n') {
 			if (++dptr >= limit)
 				break;
 		}
 		/* Skip continuation lines */
 		if (*dptr == ' ' || *dptr == '\t')
 			continue;
 		/* Find header. Compact headers must be followed by a
 		 * non-alphabetic character to avoid mismatches. */
 		if (limit - dptr >= hdr->len &&
 		    strnicmp(dptr, hdr->name, hdr->len) == 0)
 			dptr += hdr->len;
 		else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
 			 strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
 			 !isalpha(*(dptr + hdr->clen)))
 			dptr += hdr->clen;
 		else
 			continue;
 		/* Find and skip colon */
 		dptr = sip_skip_whitespace(dptr, limit);
 		if (dptr == NULL)
 			break;
 		if (*dptr != ':' || ++dptr >= limit)
 			break;
 		/* Skip whitespace after colon */
 		dptr = sip_skip_whitespace(dptr, limit);
 		if (dptr == NULL)
 			break;
 		*matchoff = dptr - start;
 		if (hdr->search) {
 			dptr = ct_sip_header_search(dptr, limit, hdr->search,
 						    hdr->slen);
 			if (!dptr)
 				return -1;
 			dptr += hdr->slen;
 		}
 		*matchlen = hdr->match_len(ct, dptr, limit, &shift);
 		if (!*matchlen)
 			return -1;
 		*matchoff = dptr - start + shift;
 		return 1;
 	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(ct_sip_get_header);
 /* Get next header field in a list of comma separated values */
 static int ct_sip_next_header(const struct nf_conn *ct, const char *dptr,
 			      unsigned int dataoff, unsigned int datalen,
 			      enum sip_header_types type,
 			      unsigned int *matchoff, unsigned int *matchlen)
 {
 	const struct sip_header *hdr = &ct_sip_hdrs[type];
 	const char *start = dptr, *limit = dptr + datalen;
 	int shift = 0;
 	dptr += dataoff;
 	dptr = ct_sip_header_search(dptr, limit, ",", strlen(","));
 	if (!dptr)
 		return 0;
 	dptr = ct_sip_header_search(dptr, limit, hdr->search, hdr->slen);
 	if (!dptr)
 		return 0;
 	dptr += hdr->slen;
 	*matchoff = dptr - start;
 	*matchlen = hdr->match_len(ct, dptr, limit, &shift);
 	if (!*matchlen)
 		return -1;
 	*matchoff += shift;
 	return 1;
 }
 /* Walk through headers until a parsable one is found or no header of the
  * given type is left. */
 static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
 			       unsigned int dataoff, unsigned int datalen,
 			       enum sip_header_types type, int *in_header,
 			       unsigned int *matchoff, unsigned int *matchlen)
 {
 	int ret;
 	if (in_header && *in_header) {
 		while (1) {
 			ret = ct_sip_next_header(ct, dptr, dataoff, datalen,
 						 type, matchoff, matchlen);
 			if (ret > 0)
 				return ret;
 			if (ret == 0)
 				break;
 			dataoff += *matchoff;
 		}
 		*in_header = 0;
 	}
 	while (1) {
 		ret = ct_sip_get_header(ct, dptr, dataoff, datalen,
 					type, matchoff, matchlen);
 		if (ret > 0)
 			break;
 		if (ret == 0)
 			return ret;
 		dataoff += *matchoff;
 	}
 	if (in_header)
 		*in_header = 1;
 	return 1;
 }
 /* Locate a SIP header, parse the URI and return the offset and length of
  * the address as well as the address and port themselves. A stream of
  * headers can be parsed by handing in a non-NULL datalen and in_header
  * pointer.
  */
 int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
 			    unsigned int *dataoff, unsigned int datalen,
 			    enum sip_header_types type, int *in_header,
 			    unsigned int *matchoff, unsigned int *matchlen,
 			    union nf_inet_addr *addr, __be16 *port)
 {
 	const char *c, *limit = dptr + datalen;
 	unsigned int p;
 	int ret;
 	ret = ct_sip_walk_headers(ct, dptr, dataoff ? *dataoff : 0, datalen,
 				  type, in_header, matchoff, matchlen);
 	WARN_ON(ret < 0);
 	if (ret == 0)
 		return ret;
 	if (!parse_addr(ct, dptr + *matchoff, &c, addr, limit))
 		return -1;
 	if (*c == ':') {
 		c++;
 		p = simple_strtoul(c, (char **)&c, 10);
 		if (p < 1024 || p > 65535)
 			return -1;
 		*port = htons(p);
 	} else
 		*port = htons(SIP_PORT);
 	if (dataoff)
 		*dataoff = c - dptr;
 	return 1;
 }
 EXPORT_SYMBOL_GPL(ct_sip_parse_header_uri);
 static int ct_sip_parse_param(const struct nf_conn *ct, const char *dptr,
 			      unsigned int dataoff, unsigned int datalen,
 			      const char *name,
 			      unsigned int *matchoff, unsigned int *matchlen)
 {
 	const char *limit = dptr + datalen;
 	const char *start;
 	const char *end;
 	limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 	if (!limit)
 		limit = dptr + datalen;
 	start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 	if (!start)
 		return 0;
 	start += strlen(name);
 	end = ct_sip_header_search(start, limit, ";", strlen(";"));
 	if (!end)
 		end = limit;
 	*matchoff = start - dptr;
 	*matchlen = end - start;
 	return 1;
 }
 /* Parse address from header parameter and return address, offset and length */
 int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
 			       unsigned int dataoff, unsigned int datalen,
 			       const char *name,
 			       unsigned int *matchoff, unsigned int *matchlen,
 			       union nf_inet_addr *addr)
 {
 	const char *limit = dptr + datalen;
 	const char *start, *end;
 	limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 	if (!limit)
 		limit = dptr + datalen;
 	start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 	if (!start)
 		return 0;
 	start += strlen(name);
 	if (!parse_addr(ct, start, &end, addr, limit))
 		return 0;
 	*matchoff = start - dptr;
 	*matchlen = end - start;
 	return 1;
 }
 EXPORT_SYMBOL_GPL(ct_sip_parse_address_param);
 /* Parse numerical header parameter and return value, offset and length */
 int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
 				 unsigned int dataoff, unsigned int datalen,
 				 const char *name,
 				 unsigned int *matchoff, unsigned int *matchlen,
 				 unsigned int *val)
 {
 	const char *limit = dptr + datalen;
 	const char *start;
 	char *end;
 	limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 	if (!limit)
 		limit = dptr + datalen;
 	start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 	if (!start)
 		return 0;
 	start += strlen(name);
 	*val = simple_strtoul(start, &end, 0);
 	if (start == end)
 		return 0;
 	if (matchoff && matchlen) {
 		*matchoff = start - dptr;
 		*matchlen = end - start;
 	}
 	return 1;
 }
 EXPORT_SYMBOL_GPL(ct_sip_parse_numerical_param);
 static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
 				  unsigned int dataoff, unsigned int datalen,
 				  u8 *proto)
 {
 	unsigned int matchoff, matchlen;
 	if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
 			       &matchoff, &matchlen)) {
 		if (!strnicmp(dptr + matchoff, "TCP", strlen("TCP")))
 			*proto = IPPROTO_TCP;
 		else if (!strnicmp(dptr + matchoff, "UDP", strlen("UDP")))
 			*proto = IPPROTO_UDP;
 		else
 			return 0;
 		if (*proto != nf_ct_protonum(ct))
 			return 0;
 	} else
 		*proto = nf_ct_protonum(ct);
 	return 1;
 }
 /* SDP header parsing: a SDP session description contains an ordered set of
  * headers, starting with a section containing general session parameters,
  * optionally followed by multiple media descriptions.
  *
  * SDP headers always start at the beginning of a line. According to RFC 2327:
  * "The sequence CRLF (0x0d0a) is used to end a record, although parsers should
  * be tolerant and also accept records terminated with a single newline
  * character". We handle both cases.
  */
 static const struct sip_header ct_sdp_hdrs[] = {
 	[SDP_HDR_VERSION]		= SDP_HDR("v=", NULL, digits_len),
 	[SDP_HDR_OWNER_IP4]		= SDP_HDR("o=", "IN IP4 ", epaddr_len),
 	[SDP_HDR_CONNECTION_IP4]	= SDP_HDR("c=", "IN IP4 ", epaddr_len),
 	[SDP_HDR_OWNER_IP6]		= SDP_HDR("o=", "IN IP6 ", epaddr_len),
 	[SDP_HDR_CONNECTION_IP6]	= SDP_HDR("c=", "IN IP6 ", epaddr_len),
 	[SDP_HDR_MEDIA]			= SDP_HDR("m=", NULL, media_len),
 };
 /* Linear string search within SDP header values */
 static const char *ct_sdp_header_search(const char *dptr, const char *limit,
 					const char *needle, unsigned int len)
 {
 	for (limit -= len; dptr < limit; dptr++) {
 		if (*dptr == '\r' || *dptr == '\n')
 			break;
 		if (strncmp(dptr, needle, len) == 0)
 			return dptr;
 	}
 	return NULL;
 }
 /* Locate a SDP header (optionally a substring within the header value),
  * optionally stopping at the first occurrence of the term header, parse
  * it and return the offset and length of the data we're interested in.
  */
 int ct_sip_get_sdp_header(const struct nf_conn *ct, const char *dptr,
 			  unsigned int dataoff, unsigned int datalen,
 			  enum sdp_header_types type,
 			  enum sdp_header_types term,
 			  unsigned int *matchoff, unsigned int *matchlen)
 {
 	const struct sip_header *hdr = &ct_sdp_hdrs[type];
 	const struct sip_header *thdr = &ct_sdp_hdrs[term];
 	const char *start = dptr, *limit = dptr + datalen;
 	int shift = 0;
 	for (dptr += dataoff; dptr < limit; dptr++) {
 		/* Find beginning of line */
 		if (*dptr != '\r' && *dptr != '\n')
 			continue;
 		if (++dptr >= limit)
 			break;
 		if (*(dptr - 1) == '\r' && *dptr == '\n') {
 			if (++dptr >= limit)
 				break;
 		}
 		if (term != SDP_HDR_UNSPEC &&
 		    limit - dptr >= thdr->len &&
 		    strnicmp(dptr, thdr->name, thdr->len) == 0)
 			break;
 		else if (limit - dptr >= hdr->len &&
 			 strnicmp(dptr, hdr->name, hdr->len) == 0)
 			dptr += hdr->len;
 		else
 			continue;
 		*matchoff = dptr - start;
 		if (hdr->search) {
 			dptr = ct_sdp_header_search(dptr, limit, hdr->search,
 						    hdr->slen);
 			if (!dptr)
 				return -1;
 			dptr += hdr->slen;
 		}
 		*matchlen = hdr->match_len(ct, dptr, limit, &shift);
 		if (!*matchlen)
 			return -1;
 		*matchoff = dptr - start + shift;
 		return 1;
 	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(ct_sip_get_sdp_header);
 static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr,
 				 unsigned int dataoff, unsigned int datalen,
 				 enum sdp_header_types type,
 				 enum sdp_header_types term,
 				 unsigned int *matchoff, unsigned int *matchlen,
 				 union nf_inet_addr *addr)
 {
 	int ret;
 	ret = ct_sip_get_sdp_header(ct, dptr, dataoff, datalen, type, term,
 				    matchoff, matchlen);
 	if (ret <= 0)
 		return ret;
 	if (!parse_addr(ct, dptr + *matchoff, NULL, addr,
 			dptr + *matchoff + *matchlen))
 		return -1;
 	return 1;
 }
 static int refresh_signalling_expectation(struct nf_conn *ct,
 					  union nf_inet_addr *addr,
 					  u8 proto, __be16 port,
 					  unsigned int expires)
 {
 	struct nf_conn_help *help = nfct_help(ct);
 	struct nf_conntrack_expect *exp;
 	struct hlist_node *n, *next;
 	int found = 0;
 	spin_lock_bh(&nf_conntrack_lock);
 	hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
 		if (exp->class != SIP_EXPECT_SIGNALLING ||
 		    !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
 		    exp->tuple.dst.protonum != proto ||
 		    exp->tuple.dst.u.udp.port != port)
 			continue;
 		if (!del_timer(&exp->timeout))
 			continue;
 		exp->flags &= ~NF_CT_EXPECT_INACTIVE;
 		exp->timeout.expires = jiffies + expires * HZ;
 		add_timer(&exp->timeout);
 		found = 1;
 		break;
 	}
 	spin_unlock_bh(&nf_conntrack_lock);
 	return found;
 }
 static void flush_expectations(struct nf_conn *ct, bool media)
 {
 	struct nf_conn_help *help = nfct_help(ct);
 	struct nf_conntrack_expect *exp;
 	struct hlist_node *n, *next;
 	spin_lock_bh(&nf_conntrack_lock);
 	hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
 		if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
 			continue;
 		if (!del_timer(&exp->timeout))
 			continue;
 		nf_ct_unlink_expect(exp);
 		nf_ct_expect_put(exp);
 		if (!media)
 			break;
 	}
 	spin_unlock_bh(&nf_conntrack_lock);
 }
 static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int dataoff,
 				 const char **dptr, unsigned int *datalen,
 				 union nf_inet_addr *daddr, __be16 port,
 				 enum sip_expectation_classes class,
 				 unsigned int mediaoff, unsigned int medialen)
 {
 	struct nf_conntrack_expect *exp, *rtp_exp, *rtcp_exp;
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct net *net = nf_ct_net(ct);
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	union nf_inet_addr *saddr;
 	struct nf_conntrack_tuple tuple;
 	int direct_rtp = 0, skip_expect = 0, ret = NF_DROP;
 	u_int16_t base_port;
 	__be16 rtp_port, rtcp_port;
 	typeof(nf_nat_sdp_port_hook) nf_nat_sdp_port;
 	typeof(nf_nat_sdp_media_hook) nf_nat_sdp_media;
 	saddr = NULL;
 	if (sip_direct_media) {
 		if (!nf_inet_addr_cmp(daddr, &ct->tuplehash[dir].tuple.src.u3))
 			return NF_ACCEPT;
 		saddr = &ct->tuplehash[!dir].tuple.src.u3;
 	}
 	/* We need to check whether the registration exists before attempting
 	 * to register it since we can see the same media description multiple
 	 * times on different connections in case multiple endpoints receive
 	 * the same call.
 	 *
 	 * RTP optimization: if we find a matching media channel expectation
 	 * and both the expectation and this connection are SNATed, we assume
 	 * both sides can reach each other directly and use the final
 	 * destination address from the expectation. We still need to keep
 	 * the NATed expectations for media that might arrive from the
 	 * outside, and additionally need to expect the direct RTP stream
 	 * in case it passes through us even without NAT.
 	 */
 	memset(&tuple, 0, sizeof(tuple));
 	if (saddr)
 		tuple.src.u3 = *saddr;
 	tuple.src.l3num		= nf_ct_l3num(ct);
 	tuple.dst.protonum	= IPPROTO_UDP;
 	tuple.dst.u3		= *daddr;
 	tuple.dst.u.udp.port	= port;
 	rcu_read_lock();
 	do {
 		exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
 		if (!exp || exp->master == ct ||
 		    nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
 		    exp->class != class)
 			break;
 #ifdef CONFIG_NF_NAT_NEEDED
 		if (exp->tuple.src.l3num == AF_INET && !direct_rtp &&
 		    (exp->saved_ip != exp->tuple.dst.u3.ip ||
 		     exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) &&
 		    ct->status & IPS_NAT_MASK) {
 			daddr->ip		= exp->saved_ip;
 			tuple.dst.u3.ip		= exp->saved_ip;
 			tuple.dst.u.udp.port	= exp->saved_proto.udp.port;
 			direct_rtp = 1;
 		} else
 #endif
 			skip_expect = 1;
 	} while (!skip_expect);
 	rcu_read_unlock();
 	base_port = ntohs(tuple.dst.u.udp.port) & ~1;
 	rtp_port = htons(base_port);
 	rtcp_port = htons(base_port + 1);
 	if (direct_rtp) {
 		nf_nat_sdp_port = rcu_dereference(nf_nat_sdp_port_hook);
 		if (nf_nat_sdp_port &&
 		    !nf_nat_sdp_port(skb, dataoff, dptr, datalen,
 				     mediaoff, medialen, ntohs(rtp_port)))
 			goto err1;
 	}
 	if (skip_expect)
 		return NF_ACCEPT;
 	rtp_exp = nf_ct_expect_alloc(ct);
 	if (rtp_exp == NULL)
 		goto err1;
 	nf_ct_expect_init(rtp_exp, class, nf_ct_l3num(ct), saddr, daddr,
 			  IPPROTO_UDP, NULL, &rtp_port);
 	rtcp_exp = nf_ct_expect_alloc(ct);
 	if (rtcp_exp == NULL)
 		goto err2;
 	nf_ct_expect_init(rtcp_exp, class, nf_ct_l3num(ct), saddr, daddr,
 			  IPPROTO_UDP, NULL, &rtcp_port);
 	nf_nat_sdp_media = rcu_dereference(nf_nat_sdp_media_hook);
 	if (nf_nat_sdp_media && ct->status & IPS_NAT_MASK && !direct_rtp)
 		ret = nf_nat_sdp_media(skb, dataoff, dptr, datalen,
 				       rtp_exp, rtcp_exp,
 				       mediaoff, medialen, daddr);
 	else {
 		if (nf_ct_expect_related(rtp_exp) == 0) {
 			if (nf_ct_expect_related(rtcp_exp) != 0)
 				nf_ct_unexpect_related(rtp_exp);
 			else
 				ret = NF_ACCEPT;
 		}
 	}
 	nf_ct_expect_put(rtcp_exp);
 err2:
 	nf_ct_expect_put(rtp_exp);
 err1:
 	return ret;
 }
 static const struct sdp_media_type sdp_media_types[] = {
 	SDP_MEDIA_TYPE("audio ", SIP_EXPECT_AUDIO),
 	SDP_MEDIA_TYPE("video ", SIP_EXPECT_VIDEO),
 	SDP_MEDIA_TYPE("image ", SIP_EXPECT_IMAGE),
 };
 static const struct sdp_media_type *sdp_media_type(const char *dptr,
 						   unsigned int matchoff,
 						   unsigned int matchlen)
 {
 	const struct sdp_media_type *t;
 	unsigned int i;
 	for (i = 0; i < ARRAY_SIZE(sdp_media_types); i++) {
 		t = &sdp_media_types[i];
 		if (matchlen < t->len ||
 		    strncmp(dptr + matchoff, t->name, t->len))
 			continue;
 		return t;
 	}
 	return NULL;
 }
 static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
 		       const char **dptr, unsigned int *datalen,
 		       unsigned int cseq)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	unsigned int matchoff, matchlen;
 	unsigned int mediaoff, medialen;
 	unsigned int sdpoff;
 	unsigned int caddr_len, maddr_len;
 	unsigned int i;
 	union nf_inet_addr caddr, maddr, rtp_addr;
 	unsigned int port;
 	enum sdp_header_types c_hdr;
 	const struct sdp_media_type *t;
 	int ret = NF_ACCEPT;
 	typeof(nf_nat_sdp_addr_hook) nf_nat_sdp_addr;
 	typeof(nf_nat_sdp_session_hook) nf_nat_sdp_session;
 	nf_nat_sdp_addr = rcu_dereference(nf_nat_sdp_addr_hook);
 	c_hdr = nf_ct_l3num(ct) == AF_INET ? SDP_HDR_CONNECTION_IP4 :
 					     SDP_HDR_CONNECTION_IP6;
 	/* Find beginning of session description */
 	if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
 				  SDP_HDR_VERSION, SDP_HDR_UNSPEC,
 				  &matchoff, &matchlen) <= 0)
 		return NF_ACCEPT;
 	sdpoff = matchoff;
 	/* The connection information is contained in the session description
 	 * and/or once per media description. The first media description marks
 	 * the end of the session description. */
 	caddr_len = 0;
 	if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen,
 				  c_hdr, SDP_HDR_MEDIA,
 				  &matchoff, &matchlen, &caddr) > 0)
 		caddr_len = matchlen;
 	mediaoff = sdpoff;
 	for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) {
 		if (ct_sip_get_sdp_header(ct, *dptr, mediaoff, *datalen,
 					  SDP_HDR_MEDIA, SDP_HDR_UNSPEC,
 					  &mediaoff, &medialen) <= 0)
 			break;
 		/* Get media type and port number. A media port value of zero
 		 * indicates an inactive stream. */
 		t = sdp_media_type(*dptr, mediaoff, medialen);
 		if (!t) {
 			mediaoff += medialen;
 			continue;
 		}
 		mediaoff += t->len;
 		medialen -= t->len;
 		port = simple_strtoul(*dptr + mediaoff, NULL, 10);
 		if (port == 0)
 			continue;
 		if (port < 1024 || port > 65535)
 			return NF_DROP;
 		/* The media description overrides the session description. */
 		maddr_len = 0;
 		if (ct_sip_parse_sdp_addr(ct, *dptr, mediaoff, *datalen,
 					  c_hdr, SDP_HDR_MEDIA,
 					  &matchoff, &matchlen, &maddr) > 0) {
 			maddr_len = matchlen;
 			memcpy(&rtp_addr, &maddr, sizeof(rtp_addr));
 		} else if (caddr_len)
 			memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
 		else
 			return NF_DROP;
 		ret = set_expected_rtp_rtcp(skb, dataoff, dptr, datalen,
 					    &rtp_addr, htons(port), t->class,
 					    mediaoff, medialen);
 		if (ret != NF_ACCEPT)
 			return ret;
 		/* Update media connection address if present */
 		if (maddr_len && nf_nat_sdp_addr && ct->status & IPS_NAT_MASK) {
 			ret = nf_nat_sdp_addr(skb, dataoff, dptr, datalen,
 					      mediaoff, c_hdr, SDP_HDR_MEDIA,
 					      &rtp_addr);
 			if (ret != NF_ACCEPT)
 				return ret;
 		}
 		i++;
 	}
 	/* Update session connection and owner addresses */
 	nf_nat_sdp_session = rcu_dereference(nf_nat_sdp_session_hook);
 	if (nf_nat_sdp_session && ct->status & IPS_NAT_MASK)
 		ret = nf_nat_sdp_session(skb, dataoff, dptr, datalen, sdpoff,
 					 &rtp_addr);
 	return ret;
 }
 static int process_invite_response(struct sk_buff *skb, unsigned int dataoff,
 				   const char **dptr, unsigned int *datalen,
 				   unsigned int cseq, unsigned int code)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct nf_conn_help *help = nfct_help(ct);
 	if ((code >= 100 && code <= 199) ||
 	    (code >= 200 && code <= 299))
 		return process_sdp(skb, dataoff, dptr, datalen, cseq);
 	else if (help->help.ct_sip_info.invite_cseq == cseq)
 		flush_expectations(ct, true);
 	return NF_ACCEPT;
 }
 static int process_update_response(struct sk_buff *skb, unsigned int dataoff,
 				   const char **dptr, unsigned int *datalen,
 				   unsigned int cseq, unsigned int code)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct nf_conn_help *help = nfct_help(ct);
 	if ((code >= 100 && code <= 199) ||
 	    (code >= 200 && code <= 299))
 		return process_sdp(skb, dataoff, dptr, datalen, cseq);
 	else if (help->help.ct_sip_info.invite_cseq == cseq)
 		flush_expectations(ct, true);
 	return NF_ACCEPT;
 }
 static int process_prack_response(struct sk_buff *skb, unsigned int dataoff,
 				  const char **dptr, unsigned int *datalen,
 				  unsigned int cseq, unsigned int code)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct nf_conn_help *help = nfct_help(ct);
 	if ((code >= 100 && code <= 199) ||
 	    (code >= 200 && code <= 299))
 		return process_sdp(skb, dataoff, dptr, datalen, cseq);
 	else if (help->help.ct_sip_info.invite_cseq == cseq)
 		flush_expectations(ct, true);
 	return NF_ACCEPT;
 }
 static int process_invite_request(struct sk_buff *skb, unsigned int dataoff,
 				  const char **dptr, unsigned int *datalen,
 				  unsigned int cseq)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct nf_conn_help *help = nfct_help(ct);
 	unsigned int ret;
 	flush_expectations(ct, true);
 	ret = process_sdp(skb, dataoff, dptr, datalen, cseq);
 	if (ret == NF_ACCEPT)
 		help->help.ct_sip_info.invite_cseq = cseq;
 	return ret;
 }
 static int process_bye_request(struct sk_buff *skb, unsigned int dataoff,
 			       const char **dptr, unsigned int *datalen,
 			       unsigned int cseq)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	flush_expectations(ct, true);
 	return NF_ACCEPT;
 }
 /* Parse a REGISTER request and create a permanent expectation for incoming
  * signalling connections. The expectation is marked inactive and is activated
  * when receiving a response indicating success from the registrar.
  */
 static int process_register_request(struct sk_buff *skb, unsigned int dataoff,
 				    const char **dptr, unsigned int *datalen,
 				    unsigned int cseq)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct nf_conn_help *help = nfct_help(ct);
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	unsigned int matchoff, matchlen;
 	struct nf_conntrack_expect *exp;
 	union nf_inet_addr *saddr, daddr;
 	__be16 port;
 	u8 proto;
 	unsigned int expires = 0;
 	int ret;
 	typeof(nf_nat_sip_expect_hook) nf_nat_sip_expect;
 	/* Expected connections can not register again. */
 	if (ct->status & IPS_EXPECTED)
 		return NF_ACCEPT;
 	/* We must check the expiration time: a value of zero signals the
 	 * registrar to release the binding. We'll remove our expectation
 	 * when receiving the new bindings in the response, but we don't
 	 * want to create new ones.
 	 *
 	 * The expiration time may be contained in Expires: header, the
 	 * Contact: header parameters or the URI parameters.
 	 */
 	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
 			      &matchoff, &matchlen) > 0)
 		expires = simple_strtoul(*dptr + matchoff, NULL, 10);
 	ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
 				      SIP_HDR_CONTACT, NULL,
 				      &matchoff, &matchlen, &daddr, &port);
 	if (ret < 0)
 		return NF_DROP;
 	else if (ret == 0)
 		return NF_ACCEPT;
 	/* We don't support third-party registrations */
 	if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, &daddr))
 		return NF_ACCEPT;
 	if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen, *datalen,
 				   &proto) == 0)
 		return NF_ACCEPT;
 	if (ct_sip_parse_numerical_param(ct, *dptr,
 					 matchoff + matchlen, *datalen,
 					 "expires=", NULL, NULL, &expires) < 0)
 		return NF_DROP;
 	if (expires == 0) {
 		ret = NF_ACCEPT;
 		goto store_cseq;
 	}
 	exp = nf_ct_expect_alloc(ct);
 	if (!exp)
 		return NF_DROP;
 	saddr = NULL;
 	if (sip_direct_signalling)
 		saddr = &ct->tuplehash[!dir].tuple.src.u3;
 	nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
 			  saddr, &daddr, proto, NULL, &port);
 	exp->timeout.expires = sip_timeout * HZ;
 	exp->helper = nfct_help(ct)->helper;
 	exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
 	nf_nat_sip_expect = rcu_dereference(nf_nat_sip_expect_hook);
 	if (nf_nat_sip_expect && ct->status & IPS_NAT_MASK)
 		ret = nf_nat_sip_expect(skb, dataoff, dptr, datalen, exp,
 					matchoff, matchlen);
 	else {
 		if (nf_ct_expect_related(exp) != 0)
 			ret = NF_DROP;
 		else
 			ret = NF_ACCEPT;
 	}
 	nf_ct_expect_put(exp);
 store_cseq:
 	if (ret == NF_ACCEPT)
 		help->help.ct_sip_info.register_cseq = cseq;
 	return ret;
 }
 static int process_register_response(struct sk_buff *skb, unsigned int dataoff,
 				     const char **dptr, unsigned int *datalen,
 				     unsigned int cseq, unsigned int code)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	struct nf_conn_help *help = nfct_help(ct);
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	union nf_inet_addr addr;
 	__be16 port;
 	u8 proto;
 	unsigned int matchoff, matchlen, coff = 0;
 	unsigned int expires = 0;
 	int in_contact = 0, ret;
 	/* According to RFC 3261, "UAs MUST NOT send a new registration until
 	 * they have received a final response from the registrar for the
 	 * previous one or the previous REGISTER request has timed out".
 	 *
 	 * However, some servers fail to detect retransmissions and send late
 	 * responses, so we store the sequence number of the last valid
 	 * request and compare it here.
 	 */
 	if (help->help.ct_sip_info.register_cseq != cseq)
 		return NF_ACCEPT;
 	if (code >= 100 && code <= 199)
 		return NF_ACCEPT;
 	if (code < 200 || code > 299)
 		goto flush;
 	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
 			      &matchoff, &matchlen) > 0)
 		expires = simple_strtoul(*dptr + matchoff, NULL, 10);
 	while (1) {
 		unsigned int c_expires = expires;
 		ret = ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
 					      SIP_HDR_CONTACT, &in_contact,
 					      &matchoff, &matchlen,
 					      &addr, &port);
 		if (ret < 0)
 			return NF_DROP;
 		else if (ret == 0)
 			break;
 		/* We don't support third-party registrations */
 		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, &addr))
 			continue;
 		if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen,
 					   *datalen, &proto) == 0)
 			continue;
 		ret = ct_sip_parse_numerical_param(ct, *dptr,
 						   matchoff + matchlen,
 						   *datalen, "expires=",
 						   NULL, NULL, &c_expires);
 		if (ret < 0)
 			return NF_DROP;
 		if (c_expires == 0)
 			break;
 		if (refresh_signalling_expectation(ct, &addr, proto, port,
 						   c_expires))
 			return NF_ACCEPT;
 	}
 flush:
 	flush_expectations(ct, false);
 	return NF_ACCEPT;
 }
 static const struct sip_handler sip_handlers[] = {
 	SIP_HANDLER("INVITE", process_invite_request, process_invite_response),
 	SIP_HANDLER("UPDATE", process_sdp, process_update_response),
 	SIP_HANDLER("ACK", process_sdp, NULL),
 	SIP_HANDLER("PRACK", process_sdp, process_prack_response),
 	SIP_HANDLER("BYE", process_bye_request, NULL),
 	SIP_HANDLER("REGISTER", process_register_request, process_register_response),
 };
 static int process_sip_response(struct sk_buff *skb, unsigned int dataoff,
 				const char **dptr, unsigned int *datalen)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	unsigned int matchoff, matchlen, matchend;
 	unsigned int code, cseq, i;
 	if (*datalen < strlen("SIP/2.0 200"))
 		return NF_ACCEPT;
 	code = simple_strtoul(*dptr + strlen("SIP/2.0 "), NULL, 10);
 	if (!code)
 		return NF_DROP;
 	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
 			      &matchoff, &matchlen) <= 0)
 		return NF_DROP;
 	cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
 	if (!cseq)
 		return NF_DROP;
 	matchend = matchoff + matchlen + 1;
 	for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
 		const struct sip_handler *handler;
 		handler = &sip_handlers[i];
 		if (handler->response == NULL)
 			continue;
 		if (*datalen < matchend + handler->len ||
 		    strnicmp(*dptr + matchend, handler->method, handler->len))
 			continue;
 		return handler->response(skb, dataoff, dptr, datalen,
 					 cseq, code);
 	}
 	return NF_ACCEPT;
 }
 static int process_sip_request(struct sk_buff *skb, unsigned int dataoff,
 			       const char **dptr, unsigned int *datalen)
 {
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	unsigned int matchoff, matchlen;
 	unsigned int cseq, i;
 	for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
 		const struct sip_handler *handler;
 		handler = &sip_handlers[i];
 		if (handler->request == NULL)
 			continue;
 		if (*datalen < handler->len ||
 		    strnicmp(*dptr, handler->method, handler->len))
 			continue;
 		if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
 				      &matchoff, &matchlen) <= 0)
 			return NF_DROP;
 		cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
 		if (!cseq)
 			return NF_DROP;
 		return handler->request(skb, dataoff, dptr, datalen, cseq);
 	}
 	return NF_ACCEPT;
 }
 static int process_sip_msg(struct sk_buff *skb, struct nf_conn *ct,
 			   unsigned int dataoff, const char **dptr,
 			   unsigned int *datalen)
 {
 	typeof(nf_nat_sip_hook) nf_nat_sip;
 	int ret;
 	if (strnicmp(*dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
 		ret = process_sip_request(skb, dataoff, dptr, datalen);
 	else
 		ret = process_sip_response(skb, dataoff, dptr, datalen);
 	if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
 		nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
 		if (nf_nat_sip && !nf_nat_sip(skb, dataoff, dptr, datalen))
 			ret = NF_DROP;
 	}
 	return ret;
 }
 static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
 			struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
 	struct tcphdr *th, _tcph;
 	unsigned int dataoff, datalen;
 	unsigned int matchoff, matchlen, clen;
 	unsigned int msglen, origlen;
 	const char *dptr, *end;
 	s16 diff, tdiff = 0;
 	int ret = NF_ACCEPT;
 	bool term;
 	typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
 	if (ctinfo != IP_CT_ESTABLISHED &&
 	    ctinfo != IP_CT_ESTABLISHED_REPLY)
 		return NF_ACCEPT;
 	/* No Data ? */
 	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
 	if (th == NULL)
 		return NF_ACCEPT;
 	dataoff = protoff + th->doff * 4;
 	if (dataoff >= skb->len)
 		return NF_ACCEPT;
 	nf_ct_refresh(ct, skb, sip_timeout * HZ);
 	if (unlikely(skb_linearize(skb)))
 		return NF_DROP;
 	dptr = skb->data + dataoff;
 	datalen = skb->len - dataoff;
 	if (datalen < strlen("SIP/2.0 200"))
 		return NF_ACCEPT;
 	while (1) {
 		if (ct_sip_get_header(ct, dptr, 0, datalen,
 				      SIP_HDR_CONTENT_LENGTH,
 				      &matchoff, &matchlen) <= 0)
 			break;
 		clen = simple_strtoul(dptr + matchoff, (char **)&end, 10);
 		if (dptr + matchoff == end)
 			break;
 		term = false;
 		for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) {
 			if (end[0] == '\r' && end[1] == '\n' &&
 			    end[2] == '\r' && end[3] == '\n') {
 				term = true;
 				break;
 			}
 		}
 		if (!term)
 			break;
 		end += strlen("\r\n\r\n") + clen;
 		msglen = origlen = end - dptr;
 		if (msglen > datalen)
 			return NF_DROP;
 		ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
 		if (ret != NF_ACCEPT)
 			break;
 		diff     = msglen - origlen;
 		tdiff   += diff;
 		dataoff += msglen;
 		dptr    += msglen;
 		datalen  = datalen + diff - msglen;
 	}
 	if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
 		nf_nat_sip_seq_adjust = rcu_dereference(nf_nat_sip_seq_adjust_hook);
 		if (nf_nat_sip_seq_adjust)
 			nf_nat_sip_seq_adjust(skb, tdiff);
 	}
 	return ret;
 }
 static int sip_help_udp(struct sk_buff *skb, unsigned int protoff,
 			struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
 	unsigned int dataoff, datalen;
 	const char *dptr;
 	/* No Data ? */
 	dataoff = protoff + sizeof(struct udphdr);
 	if (dataoff >= skb->len)
 		return NF_ACCEPT;
 	nf_ct_refresh(ct, skb, sip_timeout * HZ);
 	if (unlikely(skb_linearize(skb)))
 		return NF_DROP;
 	dptr = skb->data + dataoff;
 	datalen = skb->len - dataoff;
 	if (datalen < strlen("SIP/2.0 200"))
 		return NF_ACCEPT;
 	return process_sip_msg(skb, ct, dataoff, &dptr, &datalen);
 }
 static struct nf_conntrack_helper sip[MAX_PORTS][4] __read_mostly;
 static char sip_names[MAX_PORTS][4][sizeof("sip-65535")] __read_mostly;
 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
 	[SIP_EXPECT_SIGNALLING] = {
 		.name		= "signalling",
 		.max_expected	= 1,
 		.timeout	= 3 * 60,
 	},
 	[SIP_EXPECT_AUDIO] = {
 		.name		= "audio",
 		.max_expected	= 2 * IP_CT_DIR_MAX,
 		.timeout	= 3 * 60,
 	},
 	[SIP_EXPECT_VIDEO] = {
 		.name		= "video",
 		.max_expected	= 2 * IP_CT_DIR_MAX,
 		.timeout	= 3 * 60,
 	},
 	[SIP_EXPECT_IMAGE] = {
 		.name		= "image",
 		.max_expected	= IP_CT_DIR_MAX,
 		.timeout	= 3 * 60,
 	},
 };
 static void nf_conntrack_sip_fini(void)
 {
 	int i, j;
 	for (i = 0; i < ports_c; i++) {
 		for (j = 0; j < ARRAY_SIZE(sip[i]); j++) {
 			if (sip[i][j].me == NULL)
 				continue;
 			nf_conntrack_helper_unregister(&sip[i][j]);
 		}
 	}
 }
 static int __init nf_conntrack_sip_init(void)
 {
 	int i, j, ret;
-	char *tmpname;
 	if (ports_c == 0)
 		ports[ports_c++] = SIP_PORT;
 	for (i = 0; i < ports_c; i++) {
 		memset(&sip[i], 0, sizeof(sip[i]));
 		sip[i][0].tuple.src.l3num = AF_INET;
 		sip[i][0].tuple.dst.protonum = IPPROTO_UDP;
 		sip[i][0].help = sip_help_udp;
 		sip[i][1].tuple.src.l3num = AF_INET;
 		sip[i][1].tuple.dst.protonum = IPPROTO_TCP;
 		sip[i][1].help = sip_help_tcp;
 		sip[i][2].tuple.src.l3num = AF_INET6;
 		sip[i][2].tuple.dst.protonum = IPPROTO_UDP;
 		sip[i][2].help = sip_help_udp;
 		sip[i][3].tuple.src.l3num = AF_INET6;
 		sip[i][3].tuple.dst.protonum = IPPROTO_TCP;
 		sip[i][3].help = sip_help_tcp;
 		for (j = 0; j < ARRAY_SIZE(sip[i]); j++) {
 			sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
 			sip[i][j].expect_policy = sip_exp_policy;
 			sip[i][j].expect_class_max = SIP_EXPECT_MAX;
 			sip[i][j].me = THIS_MODULE;
-			tmpname = &sip_names[i][j][0];
 			if (ports[i] == SIP_PORT)
-				sprintf(tmpname, "sip");
+				sprintf(sip_names[i][j], "sip");
 			else
-				sprintf(tmpname, "sip-%u", i);
+				sprintf(sip_names[i][j], "sip-%u", i);
-			sip[i][j].name = tmpname;
 			pr_debug("port #%u: %u\n", i, ports[i]);
 			ret = nf_conntrack_helper_register(&sip[i][j]);
 			if (ret) {
 				printk(KERN_ERR "nf_ct_sip: failed to register"
 				       " helper for pf: %u port: %u\n",
 				       sip[i][j].tuple.src.l3num, ports[i]);
 				nf_conntrack_sip_fini();
 				return ret;
 			}
 		}
 	}
 	return 0;
 }
 module_init(nf_conntrack_sip_init);
 module_exit(nf_conntrack_sip_fini);

net/netfilter/nf_conntrack_tftp.c

Diff comments View file @ 3a8fc53

 /* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/in.h>
 #include <linux/udp.h>
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <linux/netfilter/nf_conntrack_tftp.h>
 MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
 MODULE_DESCRIPTION("TFTP connection tracking helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_conntrack_tftp");
 MODULE_ALIAS_NFCT_HELPER("tftp");
 #define MAX_PORTS 8
 static unsigned short ports[MAX_PORTS];
 static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");
 unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
 				 enum ip_conntrack_info ctinfo,
 				 struct nf_conntrack_expect *exp) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_tftp_hook);
 static int tftp_help(struct sk_buff *skb,
 		     unsigned int protoff,
 		     struct nf_conn *ct,
 		     enum ip_conntrack_info ctinfo)
 {
 	const struct tftphdr *tfh;
 	struct tftphdr _tftph;
 	struct nf_conntrack_expect *exp;
 	struct nf_conntrack_tuple *tuple;
 	unsigned int ret = NF_ACCEPT;
 	typeof(nf_nat_tftp_hook) nf_nat_tftp;
 	tfh = skb_header_pointer(skb, protoff + sizeof(struct udphdr),
 				 sizeof(_tftph), &_tftph);
 	if (tfh == NULL)
 		return NF_ACCEPT;
 	switch (ntohs(tfh->opcode)) {
 	case TFTP_OPCODE_READ:
 	case TFTP_OPCODE_WRITE:
 		/* RRQ and WRQ works the same way */
 		nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 		nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 		exp = nf_ct_expect_alloc(ct);
 		if (exp == NULL)
 			return NF_DROP;
 		tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 		nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
 				  nf_ct_l3num(ct),
 				  &tuple->src.u3, &tuple->dst.u3,
 				  IPPROTO_UDP, NULL, &tuple->dst.u.udp.port);
 		pr_debug("expect: ");
 		nf_ct_dump_tuple(&exp->tuple);
 		nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
 		if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
 			ret = nf_nat_tftp(skb, ctinfo, exp);
 		else if (nf_ct_expect_related(exp) != 0)
 			ret = NF_DROP;
 		nf_ct_expect_put(exp);
 		break;
 	case TFTP_OPCODE_DATA:
 	case TFTP_OPCODE_ACK:
 		pr_debug("Data/ACK opcode\n");
 		break;
 	case TFTP_OPCODE_ERROR:
 		pr_debug("Error opcode\n");
 		break;
 	default:
 		pr_debug("Unknown opcode\n");
 	}
 	return ret;
 }
 static struct nf_conntrack_helper tftp[MAX_PORTS][2] __read_mostly;
-static char tftp_names[MAX_PORTS][2][sizeof("tftp-65535")] __read_mostly;
 static const struct nf_conntrack_expect_policy tftp_exp_policy = {
 	.max_expected	= 1,
 	.timeout	= 5 * 60,
 };
 static void nf_conntrack_tftp_fini(void)
 {
 	int i, j;
 	for (i = 0; i < ports_c; i++) {
 		for (j = 0; j < 2; j++)
 			nf_conntrack_helper_unregister(&tftp[i][j]);
 	}
 }
 static int __init nf_conntrack_tftp_init(void)
 {
 	int i, j, ret;
-	char *tmpname;
 	if (ports_c == 0)
 		ports[ports_c++] = TFTP_PORT;
 	for (i = 0; i < ports_c; i++) {
 		memset(&tftp[i], 0, sizeof(tftp[i]));
 		tftp[i][0].tuple.src.l3num = AF_INET;
 		tftp[i][1].tuple.src.l3num = AF_INET6;
 		for (j = 0; j < 2; j++) {
 			tftp[i][j].tuple.dst.protonum = IPPROTO_UDP;
 			tftp[i][j].tuple.src.u.udp.port = htons(ports[i]);
 			tftp[i][j].expect_policy = &tftp_exp_policy;
 			tftp[i][j].me = THIS_MODULE;
 			tftp[i][j].help = tftp_help;
-			tmpname = &tftp_names[i][j][0];
 			if (ports[i] == TFTP_PORT)
-				sprintf(tmpname, "tftp");
+				sprintf(tftp[i][j].name, "tftp");
 			else
-				sprintf(tmpname, "tftp-%u", i);
+				sprintf(tftp[i][j].name, "tftp-%u", i);
-			tftp[i][j].name = tmpname;
 			ret = nf_conntrack_helper_register(&tftp[i][j]);
 			if (ret) {
 				printk(KERN_ERR "nf_ct_tftp: failed to register"
 				       " helper for pf: %u port: %u\n",
 					tftp[i][j].tuple.src.l3num, ports[i]);
 				nf_conntrack_tftp_fini();
 				return ret;
 			}
 		}
 	}
 	return 0;
 }
 module_init(nf_conntrack_tftp_init);
 module_exit(nf_conntrack_tftp_fini);

Link here
Eric Lee 2015-01-20 16:33:41 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2015-01-20 16:34:35 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2015-01-20 16:35:02 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2015-05-06 17:20:36 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2015-06-23 15:35:45 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2015-08-04 07:18:27 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2015-08-04 08:05:48 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2016-04-06 11:16:22 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2016-04-06 11:27:17 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2016-05-23 04:43:11 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2016-05-23 16:55:29 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2016-07-29 03:42:44 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2016-09-28 07:09:07 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2017-01-15 15:08:36 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2017-03-06 10:14:34 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2018-09-03 12:10:41 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2018-09-03 13:21:41 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2018-09-03 13:42:42 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2018-11-28 03:23:50 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-01-14 08:33:55 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-01-23 06:44:59 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-03-27 12:40:02 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-04-03 08:24:30 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-04-27 07:56:35 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-07-10 04:16:49 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-11-01 15:34:04 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-11-11 03:03:07 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-11-25 02:40:30 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2019-12-09 03:03:38 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2020-01-15 02:31:01 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2020-04-16 03:53:46 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2020-05-08 05:49:38 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2020-07-07 11:02:46 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2020-08-14 06:21:57 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2020-09-08 09:07:33 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2021-04-28 07:53:33 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2021-10-31 07:36:26 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2021-12-10 07:04:23 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2021-12-14 03:56:19 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2022-06-14 08:09:59 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2023-05-03 12:29:33 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2023-05-08 10:19:07 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel
Link here
Eric Lee 2023-05-26 07:57:07 UTC

mentioned in commit e9324b

_mentioned in commit e9324b_

Choose File ... File name...
Cancel

1	/*	1	/*
2	* connection tracking helpers.	2	* connection tracking helpers.
3	*	3	*
4	* 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>	4	* 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
5	* - generalize L3 protocol dependent part.	5	* - generalize L3 protocol dependent part.
6	*	6	*
7	* Derived from include/linux/netfiter_ipv4/ip_conntrack_helper.h	7	* Derived from include/linux/netfiter_ipv4/ip_conntrack_helper.h
8	*/	8	*/
9		9
10	#ifndef _NF_CONNTRACK_HELPER_H	10	#ifndef _NF_CONNTRACK_HELPER_H
11	#define _NF_CONNTRACK_HELPER_H	11	#define _NF_CONNTRACK_HELPER_H
12	#include <net/netfilter/nf_conntrack.h>	12	#include <net/netfilter/nf_conntrack.h>
13	#include <net/netfilter/nf_conntrack_extend.h>	13	#include <net/netfilter/nf_conntrack_extend.h>
14		14
15	struct module;	15	struct module;
16		16
17	#define NF_CT_HELPER_NAME_LEN 16	17	#define NF_CT_HELPER_NAME_LEN 16
18		18
19	struct nf_conntrack_helper {	19	struct nf_conntrack_helper {
20	struct hlist_node hnode; /* Internal use. */	20	struct hlist_node hnode; /* Internal use. */
21		21
22	const char name; / name of the module */	22	char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
23	struct module me; / pointer to self */	23	struct module me; / pointer to self */
24	const struct nf_conntrack_expect_policy *expect_policy;	24	const struct nf_conntrack_expect_policy *expect_policy;
25		25
26	/* Tuple of things we will help (compared against server response) */	26	/* Tuple of things we will help (compared against server response) */
27	struct nf_conntrack_tuple tuple;	27	struct nf_conntrack_tuple tuple;
28		28
29	/* Function to call when data passes; return verdict, or -1 to	29	/* Function to call when data passes; return verdict, or -1 to
30	invalidate. */	30	invalidate. */
31	int (help)(struct sk_buff skb,	31	int (help)(struct sk_buff skb,
32	unsigned int protoff,	32	unsigned int protoff,
33	struct nf_conn *ct,	33	struct nf_conn *ct,
34	enum ip_conntrack_info conntrackinfo);	34	enum ip_conntrack_info conntrackinfo);
35		35
36	void (destroy)(struct nf_conn ct);	36	void (destroy)(struct nf_conn ct);
37		37
38	int (to_nlattr)(struct sk_buff skb, const struct nf_conn *ct);	38	int (to_nlattr)(struct sk_buff skb, const struct nf_conn *ct);
39	unsigned int expect_class_max;	39	unsigned int expect_class_max;
40	};	40	};
41		41
42	extern struct nf_conntrack_helper *	42	extern struct nf_conntrack_helper *
43	__nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum);	43	__nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum);
44		44
45	extern struct nf_conntrack_helper *	45	extern struct nf_conntrack_helper *
46	nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum);	46	nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum);
47		47
48	extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);	48	extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);
49	extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);	49	extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);
50		50
51	extern struct nf_conn_help nf_ct_helper_ext_add(struct nf_conn ct, gfp_t gfp);	51	extern struct nf_conn_help nf_ct_helper_ext_add(struct nf_conn ct, gfp_t gfp);
52		52
53	extern int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,	53	extern int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,
54	gfp_t flags);	54	gfp_t flags);
55		55
56	extern void nf_ct_helper_destroy(struct nf_conn *ct);	56	extern void nf_ct_helper_destroy(struct nf_conn *ct);
57		57
58	static inline struct nf_conn_help nfct_help(const struct nf_conn ct)	58	static inline struct nf_conn_help nfct_help(const struct nf_conn ct)
59	{	59	{
60	return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);	60	return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
61	}	61	}
62		62
63	extern int nf_conntrack_helper_init(struct net *net);	63	extern int nf_conntrack_helper_init(struct net *net);
64	extern void nf_conntrack_helper_fini(struct net *net);	64	extern void nf_conntrack_helper_fini(struct net *net);
65		65
66	extern int nf_conntrack_broadcast_help(struct sk_buff *skb,	66	extern int nf_conntrack_broadcast_help(struct sk_buff *skb,
67	unsigned int protoff,	67	unsigned int protoff,
68	struct nf_conn *ct,	68	struct nf_conn *ct,
69	enum ip_conntrack_info ctinfo,	69	enum ip_conntrack_info ctinfo,
70	unsigned int timeout);	70	unsigned int timeout);
71		71
72	struct nf_ct_helper_expectfn {	72	struct nf_ct_helper_expectfn {
73	struct list_head head;	73	struct list_head head;
74	const char *name;	74	const char *name;
75	void (expectfn)(struct nf_conn ct, struct nf_conntrack_expect *exp);	75	void (expectfn)(struct nf_conn ct, struct nf_conntrack_expect *exp);
76	};	76	};
77		77
78	void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n);	78	void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n);
79	void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n);	79	void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n);
80	struct nf_ct_helper_expectfn *	80	struct nf_ct_helper_expectfn *
81	nf_ct_helper_expectfn_find_by_name(const char *name);	81	nf_ct_helper_expectfn_find_by_name(const char *name);
82	struct nf_ct_helper_expectfn *	82	struct nf_ct_helper_expectfn *
83	nf_ct_helper_expectfn_find_by_symbol(const void *symbol);	83	nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
84		84
85	#endif /_NF_CONNTRACK_HELPER_H/	85	#endif /_NF_CONNTRACK_HELPER_H/
86		86