nat: Make rewrite work on string, read to a string first, copy to msgb
The MGCP protocol parsing is adding '\0' to make sure we do not
parse beyond where we should parse. This does not mix with strtok
or similiar routines.
For now we will read the msg into a global array first, then copy
it to the msgb for mgcp protocol handling and if we are required
to forward it to the MGCP we have a untouched copy we will modify
into our own msgb.
diff --git a/openbsc/src/nat/bsc_mgcp_utils.c b/openbsc/src/nat/bsc_mgcp_utils.c
index 0899cec..0965f1f 100644
--- a/openbsc/src/nat/bsc_mgcp_utils.c
+++ b/openbsc/src/nat/bsc_mgcp_utils.c
@@ -163,7 +163,8 @@
}
/* we need to generate a new and patched message */
- bsc_msg = bsc_mgcp_rewrite(nat->mgcp_msg, nat->mgcp_cfg->source_addr, mgcp_endp->rtp_port);
+ bsc_msg = bsc_mgcp_rewrite((char *) nat->mgcp_msg, nat->mgcp_length,
+ nat->mgcp_cfg->source_addr, mgcp_endp->rtp_port);
if (!bsc_msg) {
LOGP(DMGCP, LOGL_ERROR, "Failed to patch the msg.\n");
return MGCP_POLICY_CONT;
@@ -222,7 +223,8 @@
/* make it point to our endpoint */
endp->ci = bsc_mgcp_extract_ci((const char *) msg->l2h);
- output = bsc_mgcp_rewrite(msg, bsc->nat->mgcp_cfg->source_addr, endp->rtp_port);
+ output = bsc_mgcp_rewrite((char * ) msg->l2h, msgb_l2len(msg),
+ bsc->nat->mgcp_cfg->source_addr, endp->rtp_port);
if (!output) {
LOGP(DMGCP, LOGL_ERROR, "Failed to rewrite MGCP msg.\n");
return;
@@ -253,7 +255,7 @@
}
/* we need to replace some strings... */
-struct msgb *bsc_mgcp_rewrite(struct msgb *input, const char *ip, int port)
+struct msgb *bsc_mgcp_rewrite(char *input, int length, const char *ip, int port)
{
static const char *ip_str = "c=IN IP4 ";
static const char *aud_str = "m=audio ";
@@ -262,7 +264,7 @@
char *running, *token;
struct msgb *output;
- if (msgb_l2len(input) > 4096 - 128) {
+ if (length > 4096 - 128) {
LOGP(DMGCP, LOGL_ERROR, "Input is too long.\n");
return NULL;
}
@@ -273,7 +275,7 @@
return NULL;
}
- running = (char *) input->l2h;
+ running = input;
output->l2h = output->data;
for (token = strsep(&running, "\n"); token; token = strsep(&running, "\n")) {
int len = strlen(token);
@@ -319,26 +321,27 @@
struct msgb *msg, *resp;
int rc;
- msg = msgb_alloc(4096, "MGCP GW Read");
+ nat = fd->data;
+
+ rc = read(fd->fd, nat->mgcp_msg, sizeof(nat->mgcp_msg) - 1);
+ if (rc <= 0) {
+ LOGP(DMGCP, LOGL_ERROR, "Failed to read errno: %d\n", errno);
+ return -1;
+ }
+
+ nat->mgcp_msg[rc] = '\0';
+ nat->mgcp_length = rc;
+
+ msg = msgb_alloc(sizeof(nat->mgcp_msg), "MGCP GW Read");
if (!msg) {
LOGP(DMGCP, LOGL_ERROR, "Failed to create buffer.\n");
return -1;
}
-
- rc = read(fd->fd, msg->data, msg->data_len);
- if (rc <= 0) {
- LOGP(DMGCP, LOGL_ERROR, "Failed to read errno: %d\n", errno);
- msgb_free(msg);
- return -1;
- }
-
- nat = fd->data;
- nat->mgcp_msg = msg;
msg->l2h = msgb_put(msg, rc);
+ memcpy(msg->l2h, nat->mgcp_msg, msgb_l2len(msg));
resp = mgcp_handle_message(nat->mgcp_cfg, msg);
msgb_free(msg);
- nat->mgcp_msg = NULL;
/* we do have a direct answer... e.g. AUEP */
if (resp) {