Skip to content
  • Patrick McHardy's avatar
    [NETFILTER]: sip conntrack: better NAT handling · 1b683b55
    Patrick McHardy authored
    
    
    The NAT handling of the SIP helper has a few problems:
    
    - Request headers are only mangled in the reply direction, From/To headers
      not at all, which can lead to authentication failures with DNAT in case
      the authentication domain is the IP address
    
    - Contact headers in responses are only mangled for REGISTER responses
    
    - Headers may be mangled even though they contain addresses not
      participating in the connection, like alternative addresses
    
    - Packets are droppen when domain names are used where the helper expects
      IP addresses
    
    This patch takes a different approach, instead of fixed rules what field
    to mangle to what content, it adds symetric mapping of From/To/Via/Contact
    headers, which allows to deal properly with echoed addresses in responses
    and foreign addresses not belonging to the connection.
    
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    1b683b55