Commit d109e9af authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nf_ct_h323: fix bug in rtcp natting

The nat_rtp_rtcp hook takes two separate parameters port and rtp_port.

port is expected to be the real h245 address (found inside the packet).
rtp_port is the even number closest to port (RTP ports are even and
RTCP ports are odd).

However currently, both port and rtp_port are having same value (both are
rounded to nearest even numbers).

This works well in case of openlogicalchannel with media (RTP/even) port.

But in case of openlogicalchannel for media control (RTCP/odd) port,
h245 address in the packet is wrongly modified to have an even port.

I am attaching a pcap demonstrating the problem, for any further analysis.

This behavior was introduced around v2.6.19 while rewriting the helper.
Signed-off-by: default avatarJagdish Motwani <jagdish.motwani@elitecore.com>
Signed-off-by: default avatarSanket Shah <sanket.shah@elitecore.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d1992b16
...@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct, ...@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
return 0; return 0;
/* RTP port is even */ /* RTP port is even */
port &= htons(~1); rtp_port = port & ~htons(1);
rtp_port = port; rtcp_port = port | htons(1);
rtcp_port = htons(ntohs(port) + 1);
/* Create expect for RTP */ /* Create expect for RTP */
if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL) if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment