conntracker/nat helper for Microsoft Media Services

PATCH Applied Filip Sneppe (Cronos) 3 participants 6 messages Sep 22, 2002 – Oct 14, 2002

Subsystems (3)

Networking Documentation netfilter

lore

Share & tools

lore

Filip Sneppe (Cronos)

author

2002-09-22 22:15 UTC #0 lore raw

PATCH 1/1 conntracker/nat helper for Microsoft Media Services

Hi,

This is a connection tracking/nat helper for Microsoft (Streaming) Media Services, both in patch-o-matic format and as a diff against 2.4.20-pre7 (the patch requires newnat).

By default, an MMS client connects to TCP port 1755 of the server, and client and server determine whether to stream the content over UDP or TCP. This is discussed here:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwmt/html/MMSFirewall.asp

This link points to some Open Source people who are in the process of reverse engineering this MS proprietary protocol, and a link to a Linux MMS client:

http://get.to/sdp

Furthermore, I would like to publicly thank Martin Josefsson for answering my netfilter programming related questions on IRC many moons ago (#lartc on irc.oftc.net). He may already have forgotten about it but his advise was most helpful to me.

Note that ip_conntrack_mms and ip_nat_mms has got *nothing* to do with ip_masq_mms from 2.2 kernels.

Regards,
Filip

Documentation/Configure.help +10 -0

diff -urN -X dontdiff linux-2.4.20-pre7/Documentation/Configure.help linux-2.4.20-pre7-mms/Documentation/Configure.help
@@ -2499,6 +2499,16 @@
   If you want to compile it as a module, say M here and read
   <file:Documentation/modules.txt>.  If unsure, say `Y'.
 
+MMS protocol support
+CONFIG_IP_NF_MMS
+  Tracking MMS (Microsoft Windows Media Services) connections
+  could be problematic if random ports are used to send the
+  streaming content. This option allows users to track streaming
+  connections over random UDP or TCP ports.
+
+  If you want to compile it as a module, say M here and read
+  <file:Documentation/modules.txt>.  If unsure, say `Y'.
+
 User space queueing via NETLINK
 CONFIG_IP_NF_QUEUE
   Netfilter has the ability to queue packets to user space: the

include/linux/netfilter_ipv4/ip_conntrack.h +3 -0

diff -urN -X dontdiff linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -60,12 +60,14 @@
 /* Add protocol helper include file here */
 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
+#include <linux/netfilter_ipv4/ip_conntrack_mms.h>
 
 /* per expectation: application helper private data */
 union ip_conntrack_expect_help {
 	/* insert conntrack helper private data (expect) here */
 	struct ip_ct_ftp_expect exp_ftp_info;
 	struct ip_ct_irc_expect exp_irc_info;
+	struct ip_ct_mms_expect exp_mms_info;
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 	union {

@@ -79,6 +81,7 @@
 	/* insert conntrack helper private data (master) here */
 	struct ip_ct_ftp_master ct_ftp_info;
 	struct ip_ct_irc_master ct_irc_info;
+	struct ip_ct_mms_master ct_mms_info;
 };
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED

include/linux/netfilter_ipv4/ip_conntrack_mms.h +33 -0

diff -urN -X dontdiff linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack_mms.h linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack_mms.h
@@ -0,0 +1,33 @@
+#ifndef _IP_CONNTRACK_MMS_H
+#define _IP_CONNTRACK_MMS_H
+/* MMS tracking. */
+
+#ifndef __KERNEL__
+#error Only in kernel.
+#endif
+
+#include <linux/netfilter_ipv4/lockhelp.h>
+
+DECLARE_LOCK_EXTERN(ip_mms_lock);
+
+#define MMS_PORT                         1755
+#define MMS_SRV_MSG_ID                   196610
+
+#define MMS_SRV_MSG_OFFSET               36
+#define MMS_SRV_UNICODE_STRING_OFFSET    60
+#define MMS_SRV_CHUNKLENLV_OFFSET        16
+#define MMS_SRV_CHUNKLENLM_OFFSET        32
+#define MMS_SRV_MESSAGELENGTH_OFFSET     8
+
+/* This structure is per expected connection */
+struct ip_ct_mms_expect {
+	u_int32_t len;
+	u_int32_t padding;
+	u_int16_t port;
+};
+
+/* This structure exists only once per master */
+struct ip_ct_mms_master {
+};
+
+#endif /* _IP_CONNTRACK_MMS_H */

net/ipv4/netfilter/Config.in +8 -0

diff -urN -X dontdiff linux-2.4.20-pre7/net/ipv4/netfilter/Config.in linux-2.4.20-pre7-mms/net/ipv4/netfilter/Config.in
@@ -8,6 +8,7 @@
 if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; then
   dep_tristate '  FTP protocol support' CONFIG_IP_NF_FTP $CONFIG_IP_NF_CONNTRACK
   dep_tristate '  IRC protocol support' CONFIG_IP_NF_IRC $CONFIG_IP_NF_CONNTRACK
+  dep_tristate '  MMS protocol support' CONFIG_IP_NF_MMS $CONFIG_IP_NF_CONNTRACK
 fi
 
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then

@@ -60,6 +61,13 @@
       if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
         dep_tristate '    Basic SNMP-ALG support (EXPERIMENTAL)' CONFIG_IP_NF_NAT_SNMP_BASIC $CONFIG_IP_NF_NAT
       fi
+      if [ "$CONFIG_IP_NF_MMS" = "m" ]; then
+        define_tristate CONFIG_IP_NF_NAT_MMS m
+      else
+        if [ "$CONFIG_IP_NF_MMS" = "y" ]; then
+          define_tristate CONFIG_IP_NF_NAT_MMS $CONFIG_IP_NF_NAT
+        fi
+      fi
       if [ "$CONFIG_IP_NF_IRC" = "m" ]; then
         define_tristate CONFIG_IP_NF_NAT_IRC m
       else

net/ipv4/netfilter/Makefile +6 -0

diff -urN -X dontdiff linux-2.4.20-pre7/net/ipv4/netfilter/Makefile linux-2.4.20-pre7-mms/net/ipv4/netfilter/Makefile
@@ -42,9 +42,15 @@
 	export-objs += ip_conntrack_irc.o
 endif
 
+obj-$(CONFIG_IP_NF_MMS) += ip_conntrack_mms.o
+ifdef CONFIG_IP_NF_NAT_MMS
+	export-objs += ip_conntrack_mms.o
+endif
+
 # NAT helpers 
 obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
 obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
+obj-$(CONFIG_IP_NF_NAT_MMS) += ip_nat_mms.o
 
 # generic IP tables 
 obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o

net/ipv4/netfilter/ip_conntrack_mms.c +310 -0

310 lines not on this page · raw message

net/ipv4/netfilter/ip_nat_mms.c +350 -0

350 lines not on this page · raw message

include/linux/netfilter_ipv4/ip_conntrack.h +3 -0

diff -urN -X dontdiff linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -60,12 +60,14 @@
 /* Add protocol helper include file here */
 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
+#include <linux/netfilter_ipv4/ip_conntrack_mms.h>
 
 /* per expectation: application helper private data */
 union ip_conntrack_expect_help {
 	/* insert conntrack helper private data (expect) here */
 	struct ip_ct_ftp_expect exp_ftp_info;
 	struct ip_ct_irc_expect exp_irc_info;
+	struct ip_ct_mms_expect exp_mms_info;
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 	union {

@@ -79,6 +81,7 @@
 	/* insert conntrack helper private data (master) here */
 	struct ip_ct_ftp_master ct_ftp_info;
 	struct ip_ct_irc_master ct_irc_info;
+	struct ip_ct_mms_master ct_mms_info;
 };
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED

include/linux/netfilter_ipv4/ip_conntrack_mms.h +33 -0

diff -urN -X dontdiff linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack_mms.h linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack_mms.h
@@ -0,0 +1,33 @@
+#ifndef _IP_CONNTRACK_MMS_H
+#define _IP_CONNTRACK_MMS_H
+/* MMS tracking. */
+
+#ifndef __KERNEL__
+#error Only in kernel.
+#endif
+
+#include <linux/netfilter_ipv4/lockhelp.h>
+
+DECLARE_LOCK_EXTERN(ip_mms_lock);
+
+#define MMS_PORT                         1755
+#define MMS_SRV_MSG_ID                   196610
+
+#define MMS_SRV_MSG_OFFSET               36
+#define MMS_SRV_UNICODE_STRING_OFFSET    60
+#define MMS_SRV_CHUNKLENLV_OFFSET        16
+#define MMS_SRV_CHUNKLENLM_OFFSET        32
+#define MMS_SRV_MESSAGELENGTH_OFFSET     8
+
+/* This structure is per expected connection */
+struct ip_ct_mms_expect {
+	u_int32_t len;
+	u_int32_t padding;
+	u_int16_t port;
+};
+
+/* This structure exists only once per master */
+struct ip_ct_mms_master {
+};
+
+#endif /* _IP_CONNTRACK_MMS_H */

net/ipv4/netfilter/ip_conntrack_mms.c +310 -0

310 lines not on this page · raw message

net/ipv4/netfilter/ip_nat_mms.c +350 -0

350 lines not on this page · raw message

dep_tristate ' IRC protocol support' CONFIG_IP_NF_IRC $CONFIG_IP_NF_CONNTRACK dep_tristate ' MMS protocol support' CONFIG_IP_NF_MMS $CONFIG_IP_NF_CONNTRACK

define_tristate CONFIG_IP_NF_NAT_IRC $CONFIG_IP_NF_NAT
fi
fi
if [ "$CONFIG_IP_NF_MMS" = "m" ]; then
define_tristate CONFIG_IP_NF_NAT_MMS m
else
if [ "$CONFIG_IP_NF_MMS" = "y" ]; then
define_tristate CONFIG_IP_NF_NAT_MMS $CONFIG_IP_NF_NAT

CONFIG_IP_NF_IRC
MMS protocol support
CONFIG_IP_NF_MMS
Tracking MMS (Microsoft Windows Media Services) connections could be problematic if random ports are used to send the streaming content. This option allows users to track streaming connections over random UDP or TCP ports.

If you want to compile it as a module, say M here and read <file:Documentation/modules.txt>. If unsure, say `Y'.

Author: Filip Sneppe <[email protected]>
Status: WorksForMe(tm)

This adds CONFIG_IP_NF_MMS: support for Microsoft Streaming Media Services. This allows client (Windows Media Player) and server to negotiate protocol (UDP, TCP) and port for the media stream.

A partially reverse engineered protocol analysis is available from http://get.to/sdp, together with a link to a Linux client.

By default, the helper module tracks TCP traffic over port 1755 and adds the necessary UPD or TCP expectation. It is recommended to also open UDP port 1755 to the server, as this port is used for retransmission requests.

This helper has been tested in SNAT and DNAT setups.

Note that this helper has *nothing* to do with ip_masq_mms for 2.2 kernels!

# connection tracking helpers
obj-$(CONFIG_IP_NF_MMS) += ip_conntrack_mms.o
ifdef CONFIG_IP_NF_NAT_MMS
	export-objs += ip_conntrack_mms.o
endif

obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
obj-$(CONFIG_IP_NF_NAT_MMS) += ip_nat_mms.o

Harald Welte

2002-09-24 11:39 UTC #1 lore raw

Quoted 5 lines · Filip Sneppe (Cronos)

Hi,
This is a connection tracking/nat helper for Microsoft (Streaming) Media Services, both in patch-o-matic format and as a diff against 2.4.20-pre7 (the patch requires newnat).

Thanks a lot for contributing this helper to the netfilter project, I have committed your patch to CVS right now.

However, there is a small remaining issue:

@@ -60,12 +60,14 @@
/* Add protocol helper include file here */ #include <linux/netfilter_ipv4/ip_conntrack_ftp.h> #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
+#include <linux/netfilter_ipv4/ip_conntrack_mms.h>

/* per expectation: application helper private data */

 union ip_conntrack_expect_help {                                               
        /* insert conntrack helper private data (expect) here */                
        struct ip_ct_ftp_expect exp_ftp_info;                                   
        struct ip_ct_irc_expect exp_irc_info;

+ struct ip_ct_mms_expect exp_mms_info;

 #ifdef CONFIG_IP_NF_NAT_NEEDED                                                 
        union {                                                                 
@@ -79,6 +81,7 @@                                                               
        /* insert conntrack helper private data (master) here */                
        struct ip_ct_ftp_master ct_ftp_info;                                    
        struct ip_ct_irc_master ct_irc_info;

+ struct ip_ct_mms_master ct_mms_info;
};

#ifdef CONFIG_IP_NF_NAT_NEEDED

Those hunks should not be part of the .patch itself, but seperate pom-files, since this clashes with other helpers. See netfilter/patch-o-matic/talk-conntrack-nat.patch.ip_conntrack.h*

Please submit an incremental diff against the code which is now in CVS. Thanks.

Quoted 2 lines

Regards,
Filip

Signature · 5 lines

Live long and prosper
- Harald Welte / [email protected]               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long as
 I'm the dictator."  --  George W. Bush Dec 18, 2000

Filip Sneppe (Cronos)

author

2002-09-24 12:35 UTC #2 lore raw

Quoted 5 lines · Harald Welte

Thanks a lot for contributing this helper to the netfilter project, I have committed your patch to CVS right now.
However, there is a small remaining issue:

...

Quoted 8 lines

Those hunks should not be part of the .patch itself, but seperate pom-files, since this clashes with other helpers. See netfilter/patch-o-matic/talk-conntrack-nat.patch.ip_conntrack.h*
Please submit an incremental diff against the code which is now in CVS. Thanks.

My mistake. Patch attached. Sorry for the inconvenience.

Regards,
Filip

patch-o-matic/extra/mms-conntrack-nat.patch +0 ~~-26~~

diff -urN netfilter-orig/patch-o-matic/extra/mms-conntrack-nat.patch netfilter-changed/patch-o-matic/extra/mms-conntrack-nat.patch
@@ -1,29 +1,3 @@
-diff -urN -X dontdiff linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack.h
---- linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack.h	2002-09-22 19:50:53.000000000 +0200
-+++ linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack.h	2002-09-17 04:08:25.000000000 +0200
-@@ -60,12 +60,14 @@
- /* Add protocol helper include file here */
- #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
- #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
-+#include <linux/netfilter_ipv4/ip_conntrack_mms.h>
- 
- /* per expectation: application helper private data */
- union ip_conntrack_expect_help {
- 	/* insert conntrack helper private data (expect) here */
- 	struct ip_ct_ftp_expect exp_ftp_info;
- 	struct ip_ct_irc_expect exp_irc_info;
-+	struct ip_ct_mms_expect exp_mms_info;
- 
- #ifdef CONFIG_IP_NF_NAT_NEEDED
- 	union {
-@@ -79,6 +81,7 @@
- 	/* insert conntrack helper private data (master) here */
- 	struct ip_ct_ftp_master ct_ftp_info;
- 	struct ip_ct_irc_master ct_irc_info;
-+	struct ip_ct_mms_master ct_mms_info;
- };
- 
- #ifdef CONFIG_IP_NF_NAT_NEEDED
 diff -urN -X dontdiff linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack_mms.h linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack_mms.h
 --- linux-2.4.20-pre7/include/linux/netfilter_ipv4/ip_conntrack_mms.h	1970-01-01 01:00:00.000000000 +0100
 +++ linux-2.4.20-pre7-mms/include/linux/netfilter_ipv4/ip_conntrack_mms.h	2002-09-17 04:08:25.000000000 +0200

patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h +2 -0

diff -urN netfilter-orig/patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h netfilter-changed/patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h
@@ -0,0 +1,2 @@
+/* Add protocol helper include file here */
+#include <linux/netfilter_ipv4/ip_conntrack_mms.h>

patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h-2 +2 -0

diff -urN netfilter-orig/patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h-2 netfilter-changed/patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h-2
@@ -0,0 +1,2 @@
+	/* insert conntrack helper private data (expect) here */
+	struct ip_ct_mms_expect exp_mms_info;

patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h-3 +2 -0

diff -urN netfilter-orig/patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h-3 netfilter-changed/patch-o-matic/extra/mms-conntrack-nat.patch.ip_conntrack.h-3
@@ -0,0 +1,2 @@
+	/* insert conntrack helper private data (master) here */
+	struct ip_ct_mms_master ct_mms_info;

Martin Josefsson

Applied

2002-09-25 11:32 UTC #3 lore raw

Quoted 9 lines · Filip Sneppe (Cronos)

Quoted 7 lines
Those hunks should not be part of the .patch itself, but seperate pom-files, since this clashes with other helpers. See netfilter/patch-o-matic/talk-conntrack-nat.patch.ip_conntrack.h*
Please submit an incremental diff against the code which is now in CVS. Thanks.
My mistake. Patch attached. Sorry for the inconvenience.

Applied.

Signature · 4 lines

/Martin

Never argue with an idiot. They drag you down to their level, then beat
you with experience.

Martin Josefsson

2002-10-10 14:55 UTC #4 lore raw

In reply to Filip Sneppe (Cronos)

Hi,

I just committed a small change to cvs.
http://cvs.netfilter.org/cgi-bin/cvsweb/netfilter/patch-o-matic/extra/mms-conntrack-nat.patch?r1=1.2&r2=1.3&f=u

Without this change nfnetlink-stuff won't compile in userspace, all other helpers have been changed over to this format.

Signature · 4 lines

/Martin

Never argue with an idiot. They drag you down to their level, then beat
you with experience.

Harald Welte

2002-10-14 11:02 UTC #5 lore raw

Quoted 7 lines · Martin Josefsson

Hi,
I just committed a small change to cvs.
http://cvs.netfilter.org/cgi-bin/cvsweb/netfilter/patch-o-matic/extra/mms-conntrack-nat.patch?r1=1.2&r2=1.3&f=u
Without this change nfnetlink-stuff won't compile in userspace, all other helpers have been changed over to this format.

thanks, martin.

Quoted 1 line

/Martin

Signature · 5 lines

Live long and prosper
- Harald Welte / [email protected]               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
 as I'm the dictator."  --  George W. Bush Dec 18, 2000