1 #define KMSG_COMPONENT "IPVS" 2 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 3 4 #include <linux/module.h> 5 #include <linux/kernel.h> 6 7 #include <net/ip_vs.h> 8 #include <net/netfilter/nf_conntrack.h> 9 #include <linux/netfilter/nf_conntrack_sip.h> 10 11 #ifdef CONFIG_IP_VS_DEBUG 12 static const char *ip_vs_dbg_callid(char *buf, size_t buf_len, 13 const char *callid, size_t callid_len, 14 int *idx) 15 { 16 size_t len = min(min(callid_len, (size_t)64), buf_len - *idx - 1); 17 memcpy(buf + *idx, callid, len); 18 buf[*idx+len] = '\0'; 19 *idx += len + 1; 20 return buf + *idx - len; 21 } 22 23 #define IP_VS_DEBUG_CALLID(callid, len) \ 24 ip_vs_dbg_callid(ip_vs_dbg_buf, sizeof(ip_vs_dbg_buf), \ 25 callid, len, &ip_vs_dbg_idx) 26 #endif 27 28 static int get_callid(const char *dptr, unsigned int dataoff, 29 unsigned int datalen, 30 unsigned int *matchoff, unsigned int *matchlen) 31 { 32 /* Find callid */ 33 while (1) { 34 int ret = ct_sip_get_header(NULL, dptr, dataoff, datalen, 35 SIP_HDR_CALL_ID, matchoff, 36 matchlen); 37 if (ret > 0) 38 break; 39 if (!ret) 40 return 0; 41 dataoff += *matchoff; 42 } 43 44 /* Empty callid is useless */ 45 if (!*matchlen) 46 return -EINVAL; 47 48 /* Too large is useless */ 49 if (*matchlen > IP_VS_PEDATA_MAXLEN) 50 return -EINVAL; 51 52 /* SIP headers are always followed by a line terminator */ 53 if (*matchoff + *matchlen == datalen) 54 return -EINVAL; 55 56 /* RFC 2543 allows lines to be terminated with CR, LF or CRLF, 57 * RFC 3261 allows only CRLF, we support both. */ 58 if (*(dptr + *matchoff + *matchlen) != '\r' && 59 *(dptr + *matchoff + *matchlen) != '\n') 60 return -EINVAL; 61 62 IP_VS_DBG_BUF(9, "SIP callid %s (%d bytes)\n", 63 IP_VS_DEBUG_CALLID(dptr + *matchoff, *matchlen), 64 *matchlen); 65 return 0; 66 } 67 68 static int 69 ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct sk_buff *skb) 70 { 71 struct sk_buff *reasm = skb_nfct_reasm(skb); 72 struct ip_vs_iphdr iph; 73 unsigned int dataoff, datalen, matchoff, matchlen; 74 const char *dptr; 75 int retc; 76 77 ip_vs_fill_iph_skb(p->af, skb, &iph); 78 79 /* Only useful with UDP */ 80 if (iph.protocol != IPPROTO_UDP) 81 return -EINVAL; 82 /* todo: IPv6 fragments: 83 * I think this only should be done for the first fragment. /HS 84 */ 85 if (reasm) { 86 skb = reasm; 87 dataoff = iph.thoff_reasm + sizeof(struct udphdr); 88 } else 89 dataoff = iph.len + sizeof(struct udphdr); 90 91 if (dataoff >= skb->len) 92 return -EINVAL; 93 /* todo: Check if this will mess-up the reasm skb !!! /HS */ 94 retc = skb_linearize(skb); 95 if (retc < 0) 96 return retc; 97 dptr = skb->data + dataoff; 98 datalen = skb->len - dataoff; 99 100 if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen)) 101 return -EINVAL; 102 103 /* N.B: pe_data is only set on success, 104 * this allows fallback to the default persistence logic on failure 105 */ 106 p->pe_data = kmemdup(dptr + matchoff, matchlen, GFP_ATOMIC); 107 if (!p->pe_data) 108 return -ENOMEM; 109 110 p->pe_data_len = matchlen; 111 112 return 0; 113 } 114 115 static bool ip_vs_sip_ct_match(const struct ip_vs_conn_param *p, 116 struct ip_vs_conn *ct) 117 118 { 119 bool ret = false; 120 121 if (ct->af == p->af && 122 ip_vs_addr_equal(p->af, p->caddr, &ct->caddr) && 123 /* protocol should only be IPPROTO_IP if 124 * d_addr is a fwmark */ 125 ip_vs_addr_equal(p->protocol == IPPROTO_IP ? AF_UNSPEC : p->af, 126 p->vaddr, &ct->vaddr) && 127 ct->vport == p->vport && 128 ct->flags & IP_VS_CONN_F_TEMPLATE && 129 ct->protocol == p->protocol && 130 ct->pe_data && ct->pe_data_len == p->pe_data_len && 131 !memcmp(ct->pe_data, p->pe_data, p->pe_data_len)) 132 ret = true; 133 134 IP_VS_DBG_BUF(9, "SIP template match %s %s->%s:%d %s\n", 135 ip_vs_proto_name(p->protocol), 136 IP_VS_DEBUG_CALLID(p->pe_data, p->pe_data_len), 137 IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport), 138 ret ? "hit" : "not hit"); 139 140 return ret; 141 } 142 143 static u32 ip_vs_sip_hashkey_raw(const struct ip_vs_conn_param *p, 144 u32 initval, bool inverse) 145 { 146 return jhash(p->pe_data, p->pe_data_len, initval); 147 } 148 149 static int ip_vs_sip_show_pe_data(const struct ip_vs_conn *cp, char *buf) 150 { 151 memcpy(buf, cp->pe_data, cp->pe_data_len); 152 return cp->pe_data_len; 153 } 154 155 static struct ip_vs_pe ip_vs_sip_pe = 156 { 157 .name = "sip", 158 .refcnt = ATOMIC_INIT(0), 159 .module = THIS_MODULE, 160 .n_list = LIST_HEAD_INIT(ip_vs_sip_pe.n_list), 161 .fill_param = ip_vs_sip_fill_param, 162 .ct_match = ip_vs_sip_ct_match, 163 .hashkey_raw = ip_vs_sip_hashkey_raw, 164 .show_pe_data = ip_vs_sip_show_pe_data, 165 }; 166 167 static int __init ip_vs_sip_init(void) 168 { 169 return register_ip_vs_pe(&ip_vs_sip_pe); 170 } 171 172 static void __exit ip_vs_sip_cleanup(void) 173 { 174 unregister_ip_vs_pe(&ip_vs_sip_pe); 175 } 176 177 module_init(ip_vs_sip_init); 178 module_exit(ip_vs_sip_cleanup); 179 MODULE_LICENSE("GPL"); 180