wanted: testers for ip_nat_cuseeme module

Hi,

(cross-post to netfilter-devel & netfilter)

As per James' request, I've written a cuseeme nat module for netfilter/iptables.

Since I am not a CuSeeMe user (and I don't even have a webcam or any other video conferencing hardware), I'd like some more people to test it out and report their success/failure stories to me privately, before I submit this code for patch-o-matic. Discussions about the code are best kept on netfilter-devel though, etc...

At the very least, the module should allow SNAT/MASQUERADE like the 2.2 ip_masq_cuseeme module. DNAT should also work.

Some points of attention:

- My patch requires the newnat-udp-helper.patch written by Brian J. Murrell that is currently pending for kernel inclusion, as it makes use of "ip_nat_mangle_udp_packet()". I guess that patch won't make it in 2.4.20, so you'll have to get it from CVS (patch-o-matic/pending/newnat-udp-helper.patch) or here:
http://cvs.netfilter.org/cgi-bin/cvsweb/netfilter/patch-o-matic/pending/newnat-udp-helper.patch

and apply it manually.

- You will find that there is only an ip_nat_cuseeme module. Since there are no random ports being opened, but payloads do contain embedded IP addresses, there is only a need for packet payload "mangling" in NAT scenarios.
I was quite happy to find out that netfilter/iptables happily supports this!

- If you're running into problems, please let me know. I will ask you to recompile with debugging enabled (change the "#if 0" to "#if 1" in ip_nat_cuseeme.c), and capture traffic on both sides of the NAT box, so you know ahead.
I am curious if a lot of people will be getting many messages like this in their system logs:

    expected incoming client 195.162.210.199:7648, but got 0.0.0.0:7648

This shouldn't happen, but from what I get from the specs, it's not always strictly necessary to follow the specs to get a working implementation.

Regards,
Filip

ps. Unless someone else has started working on this, I will probably end up writing a conntrack/nat helper for Microsoft MSN Messenger, now that I still have a Windows partition on a test box, so feel free to volunteer as a tester for that too :-)

-----Original Message-----
From: James Bryan [mailto:[email protected]]
Sent: Sun 27/10/2002 5:47
To: Sneppe Filip
Cc:
Subject: RE: Question about Porting the cu-seeme ipchains module to
iptables.

Filip,
I haven't found anyone else yet who's ported the module or is working
on it. I'd be delighted if you could port it over to a conntrack/nat module.

Regards,
James

diff -urN -X dontdiff linux-2.4.20-pre11/Documentation/Configure.help linux-2.4.20-pre11-msn/Documentation/Configure.help
@@ -2508,6 +2508,17 @@
   If you want to compile it as a module, say M here and read
   <file:Documentation/modules.txt>.  If unsure, say `N'.
 
+CuSeeMe protocol support
+CONFIG_IP_NF_CUSEEME
+  The CuSeeMe conferencing protocol is problematic when used in
+  conjunction with NAT; even though there are no random ports used for
+  extra connections, the messages contain IP addresses inside them.
+  This NAT helper mangles the IP address inside packets so both
+  parties don't get confused.
+
+  If you want to compile it as a module, say M here and read
+  <file:Documentation/modules.txt>.  If unsure, say `Y'.
+
 IRC Send/Chat protocol support
 CONFIG_IP_NF_IRC
   There is a commonly-used extension to IRC called

diff -urN -X dontdiff linux-2.4.20-pre11/net/ipv4/netfilter/Config.in linux-2.4.20-pre11-msn/net/ipv4/netfilter/Config.in
@@ -8,6 +8,7 @@
 if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; then
   dep_tristate '  FTP protocol support' CONFIG_IP_NF_FTP $CONFIG_IP_NF_CONNTRACK
   dep_tristate '  IRC protocol support' CONFIG_IP_NF_IRC $CONFIG_IP_NF_CONNTRACK
+  dep_tristate '  CuSeeMe protocol support' CONFIG_IP_NF_CUSEEME $CONFIG_IP_NF_CONNTRACK
 fi
 
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then

@@ -67,6 +69,13 @@
           define_tristate CONFIG_IP_NF_NAT_IRC $CONFIG_IP_NF_NAT
         fi
       fi
+      if [ "$CONFIG_IP_NF_CUSEEME" = "m" ]; then
+        define_tristate CONFIG_IP_NF_NAT_CUSEEME m
+      else
+        if [ "$CONFIG_IP_NF_CUSEEME" = "y" ]; then
+         define_tristate CONFIG_IP_NF_NAT_CUSEEME $CONFIG_IP_NF_NAT
+        fi
+      fi
       # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y), 
       # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.  Argh.
       if [ "$CONFIG_IP_NF_FTP" = "m" ]; then

diff -urN -X dontdiff linux-2.4.20-pre11/net/ipv4/netfilter/Makefile linux-2.4.20-pre11-msn/net/ipv4/netfilter/Makefile
@@ -45,6 +53,7 @@
 # NAT helpers 
 obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
 obj-$(CONFIG_IP_NF_NAT_IRC) += ip_nat_irc.o
+obj-$(CONFIG_IP_NF_NAT_CUSEEME) += ip_nat_cuseeme.o
 
 # generic IP tables 
 obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o

--- "Filip Sneppe (Cronos)" <[email protected]>

So did you add your module into the CVS repository or where can we get it from? Is this particular module in addition to the H323 patches or or is it in place of?

I would be happy to test out both modules. Where is the first one available and when will the second be available?

=====
Kevin C. McConnell --RHCE-- <Red Hat Certified Engineer>

__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/