aboutsummaryrefslogtreecommitdiff
path: root/include/linux/netfilter_ipv4
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-11-29 02:35:30 +0100
committerDavid S. Miller <davem@sunset.davemloft.net>2006-12-02 21:31:26 -0800
commit1b683b551209ca46ae59b29572018001db5af078 (patch)
tree8d88690faf3d819e42719165cae62e9953555140 /include/linux/netfilter_ipv4
parent77a78dec48386ce958196bf69f192ee76537c07d (diff)
[NETFILTER]: sip conntrack: better NAT handling
The NAT handling of the SIP helper has a few problems: - Request headers are only mangled in the reply direction, From/To headers not at all, which can lead to authentication failures with DNAT in case the authentication domain is the IP address - Contact headers in responses are only mangled for REGISTER responses - Headers may be mangled even though they contain addresses not participating in the connection, like alternative addresses - Packets are droppen when domain names are used where the helper expects IP addresses This patch takes a different approach, instead of fixed rules what field to mangle to what content, it adds symetric mapping of From/To/Via/Contact headers, which allows to deal properly with echoed addresses in responses and foreign addresses not belonging to the connection. Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'include/linux/netfilter_ipv4')
-rw-r--r--include/linux/netfilter_ipv4/ip_conntrack_sip.h5
1 files changed, 4 insertions, 1 deletions
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_sip.h b/include/linux/netfilter_ipv4/ip_conntrack_sip.h
index 51c65ac18c5..bef6c646def 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_sip.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_sip.h
@@ -6,7 +6,10 @@
#define SIP_TIMEOUT 3600
enum sip_header_pos {
- POS_REQ_HEADER,
+ POS_REG_REQ_URI,
+ POS_REQ_URI,
+ POS_FROM,
+ POS_TO,
POS_VIA,
POS_CONTACT,
POS_CONTENT,