Category: Computing

All I.T. related rants/posts.

Avast! SIP IPTables in mainline kernel

Well, following all the change logs out there for 2.6.18 Linux Kernel release shows that:

Add SIP protocol support to Netfilter (commit), a statistic match which is a combination of the nth and random matches (commit), a quota match (commit), and support for Call Forwarding to the H.323 netfilter module (commit)

Pretty obscure, so let me describe a problem with SIP.

SIP packets, like any other packet, has a header. This header has the standard IPv4 options, of which source address, source port, destination address and destination port are the most blindingly obvious ones. NAT is pretty well performed by most firewall boxes at tweaking these values and replaceing them on traversal of the gateway, and putting things back for responses. No surprises here.

However, the payload of a SIP packet by its design, has the IP address embedded in it. For example, the payload may have:


INVITE sip:3103 at 10.0.0.173 SIP/2.0
Via: SIP/2.0/UDP
10.21.99.221:5060;branch=z9hG4bK6caf7db4
From: "Someone"
<sip:3151 at 10.0.0.221>;tag=as23c4523c
To: <sip:3103 at 10.0.0.173>

The design is so that intermediate gateways can tack on their ‘Via’ headers and the call can be switched virtually between a chain of gateways, each one doing their bit. All well and good until you want to intrduce NAT, as the ‘Via’ then has information for networks the destination cannot necessarily get to.

This patch, I think, does the necessary bits to update the payload to make the payload be corrected as it passes through a NAT.

So, this will probably start to mean that Asterisk people will no longer have to set localnet definitions to be able to correctly operate their internal and external SIP connectivity behind their firewalls.

The implications are even bigger when hard ware vendors of DSL gateways that run Linux kernels also have this enabled – suddenly the Mom and Pop crowd can just plug SIP devices in at home and hey bringo, there goes the Telecomunications industry as we know it (is that good or bad?).

Juniper, hello, Netscreen product line? Your SIP ALG should be doing this?

Viva la revolution!

SNOM and XML

I recently noticed that SNOM have released version 6 of their firmware, which includes their MiniBrowser app in it. This can read XML and follow links, and is perfect for delivering mini apps, such as a phone book, to the display.

So, given an Active directory populated with entries, try this

SIP and Netscreen Firewalls

VoIP using SIP and RTP is a cool thing, but can be somewhat of a pain to get working from behind a firewall (NAT) device. First, an overview of the protocol:

SIP
TCP port 5060 (typically) to set up calls – Session Initalisation Protocol
RTP
UDP random ports 10,000 – 30,000 for call data (audio, video, etc) – Real Time Protocol

The problem is thus: when an RTP packet is sent from a gateway (eg, an Asterisk box) to a register from behind a NAT, then naturally the packet headers need modification as normal for a NAT. However, the SIP protocol contains data in the payload – including IP addres(es) (the ‘Via’ option).

For perfect use, this would need to update the packet payload to be modified. Looks like Netfilter in Linux is on the way to doing this with two kernel modules: ip_conntrack_sip and ip_nat_sip: see here.

However, pay lots of money for a Netscreen, and it doesn’t do this, despite having a ‘SIP ALG’ – according to Juniper support, the manufacturers of the Netscreen.

*sigh*