1 /* SIP extension for IP connection tracking. 2 * 3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar> 4 * based on RR's ip_conntrack_ftp.c and other modules. 5 * (C) 2007 United Security Providers 6 * (C) 2007, 2008 Patrick McHardy <kaber@trash.net> 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License version 2 as 10 * published by the Free Software Foundation. 11 */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/module.h> 16 #include <linux/ctype.h> 17 #include <linux/skbuff.h> 18 #include <linux/inet.h> 19 #include <linux/in.h> 20 #include <linux/udp.h> 21 #include <linux/tcp.h> 22 #include <linux/netfilter.h> 23 24 #include <net/netfilter/nf_conntrack.h> 25 #include <net/netfilter/nf_conntrack_core.h> 26 #include <net/netfilter/nf_conntrack_expect.h> 27 #include <net/netfilter/nf_conntrack_helper.h> 28 #include <net/netfilter/nf_conntrack_zones.h> 29 #include <linux/netfilter/nf_conntrack_sip.h> 30 31 MODULE_LICENSE("GPL"); 32 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>"); 33 MODULE_DESCRIPTION("SIP connection tracking helper"); 34 MODULE_ALIAS("ip_conntrack_sip"); 35 MODULE_ALIAS_NFCT_HELPER("sip"); 36 37 #define MAX_PORTS 8 38 static unsigned short ports[MAX_PORTS]; 39 static unsigned int ports_c; 40 module_param_array(ports, ushort, &ports_c, 0400); 41 MODULE_PARM_DESC(ports, "port numbers of SIP servers"); 42 43 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT; 44 module_param(sip_timeout, uint, 0600); 45 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session"); 46 47 static int sip_direct_signalling __read_mostly = 1; 48 module_param(sip_direct_signalling, int, 0600); 49 MODULE_PARM_DESC(sip_direct_signalling, "expect incoming calls from registrar " 50 "only (default 1)"); 51 52 static int sip_direct_media __read_mostly = 1; 53 module_param(sip_direct_media, int, 0600); 54 MODULE_PARM_DESC(sip_direct_media, "Expect Media streams between signalling " 55 "endpoints only (default 1)"); 56 57 const struct nf_nat_sip_hooks *nf_nat_sip_hooks; 58 EXPORT_SYMBOL_GPL(nf_nat_sip_hooks); 59 60 static int string_len(const struct nf_conn *ct, const char *dptr, 61 const char *limit, int *shift) 62 { 63 int len = 0; 64 65 while (dptr < limit && isalpha(*dptr)) { 66 dptr++; 67 len++; 68 } 69 return len; 70 } 71 72 static int digits_len(const struct nf_conn *ct, const char *dptr, 73 const char *limit, int *shift) 74 { 75 int len = 0; 76 while (dptr < limit && isdigit(*dptr)) { 77 dptr++; 78 len++; 79 } 80 return len; 81 } 82 83 static int iswordc(const char c) 84 { 85 if (isalnum(c) || c == '!' || c == '"' || c == '%' || 86 (c >= '(' && c <= '+') || c == ':' || c == '<' || c == '>' || 87 c == '?' || (c >= '[' && c <= ']') || c == '_' || c == '`' || 88 c == '{' || c == '}' || c == '~' || (c >= '-' && c <= '/') || 89 c == '\'') 90 return 1; 91 return 0; 92 } 93 94 static int word_len(const char *dptr, const char *limit) 95 { 96 int len = 0; 97 while (dptr < limit && iswordc(*dptr)) { 98 dptr++; 99 len++; 100 } 101 return len; 102 } 103 104 static int callid_len(const struct nf_conn *ct, const char *dptr, 105 const char *limit, int *shift) 106 { 107 int len, domain_len; 108 109 len = word_len(dptr, limit); 110 dptr += len; 111 if (!len || dptr == limit || *dptr != '@') 112 return len; 113 dptr++; 114 len++; 115 116 domain_len = word_len(dptr, limit); 117 if (!domain_len) 118 return 0; 119 return len + domain_len; 120 } 121 122 /* get media type + port length */ 123 static int media_len(const struct nf_conn *ct, const char *dptr, 124 const char *limit, int *shift) 125 { 126 int len = string_len(ct, dptr, limit, shift); 127 128 dptr += len; 129 if (dptr >= limit || *dptr != ' ') 130 return 0; 131 len++; 132 dptr++; 133 134 return len + digits_len(ct, dptr, limit, shift); 135 } 136 137 static int sip_parse_addr(const struct nf_conn *ct, const char *cp, 138 const char **endp, union nf_inet_addr *addr, 139 const char *limit, bool delim) 140 { 141 const char *end; 142 int ret; 143 144 if (!ct) 145 return 0; 146 147 memset(addr, 0, sizeof(*addr)); 148 switch (nf_ct_l3num(ct)) { 149 case AF_INET: 150 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end); 151 if (ret == 0) 152 return 0; 153 break; 154 case AF_INET6: 155 if (cp < limit && *cp == '[') 156 cp++; 157 else if (delim) 158 return 0; 159 160 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end); 161 if (ret == 0) 162 return 0; 163 164 if (end < limit && *end == ']') 165 end++; 166 else if (delim) 167 return 0; 168 break; 169 default: 170 BUG(); 171 } 172 173 if (endp) 174 *endp = end; 175 return 1; 176 } 177 178 /* skip ip address. returns its length. */ 179 static int epaddr_len(const struct nf_conn *ct, const char *dptr, 180 const char *limit, int *shift) 181 { 182 union nf_inet_addr addr; 183 const char *aux = dptr; 184 185 if (!sip_parse_addr(ct, dptr, &dptr, &addr, limit, true)) { 186 pr_debug("ip: %s parse failed.!\n", dptr); 187 return 0; 188 } 189 190 /* Port number */ 191 if (*dptr == ':') { 192 dptr++; 193 dptr += digits_len(ct, dptr, limit, shift); 194 } 195 return dptr - aux; 196 } 197 198 /* get address length, skiping user info. */ 199 static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr, 200 const char *limit, int *shift) 201 { 202 const char *start = dptr; 203 int s = *shift; 204 205 /* Search for @, but stop at the end of the line. 206 * We are inside a sip: URI, so we don't need to worry about 207 * continuation lines. */ 208 while (dptr < limit && 209 *dptr != '@' && *dptr != '\r' && *dptr != '\n') { 210 (*shift)++; 211 dptr++; 212 } 213 214 if (dptr < limit && *dptr == '@') { 215 dptr++; 216 (*shift)++; 217 } else { 218 dptr = start; 219 *shift = s; 220 } 221 222 return epaddr_len(ct, dptr, limit, shift); 223 } 224 225 /* Parse a SIP request line of the form: 226 * 227 * Request-Line = Method SP Request-URI SP SIP-Version CRLF 228 * 229 * and return the offset and length of the address contained in the Request-URI. 230 */ 231 int ct_sip_parse_request(const struct nf_conn *ct, 232 const char *dptr, unsigned int datalen, 233 unsigned int *matchoff, unsigned int *matchlen, 234 union nf_inet_addr *addr, __be16 *port) 235 { 236 const char *start = dptr, *limit = dptr + datalen, *end; 237 unsigned int mlen; 238 unsigned int p; 239 int shift = 0; 240 241 /* Skip method and following whitespace */ 242 mlen = string_len(ct, dptr, limit, NULL); 243 if (!mlen) 244 return 0; 245 dptr += mlen; 246 if (++dptr >= limit) 247 return 0; 248 249 /* Find SIP URI */ 250 for (; dptr < limit - strlen("sip:"); dptr++) { 251 if (*dptr == '\r' || *dptr == '\n') 252 return -1; 253 if (strncasecmp(dptr, "sip:", strlen("sip:")) == 0) { 254 dptr += strlen("sip:"); 255 break; 256 } 257 } 258 if (!skp_epaddr_len(ct, dptr, limit, &shift)) 259 return 0; 260 dptr += shift; 261 262 if (!sip_parse_addr(ct, dptr, &end, addr, limit, true)) 263 return -1; 264 if (end < limit && *end == ':') { 265 end++; 266 p = simple_strtoul(end, (char **)&end, 10); 267 if (p < 1024 || p > 65535) 268 return -1; 269 *port = htons(p); 270 } else 271 *port = htons(SIP_PORT); 272 273 if (end == dptr) 274 return 0; 275 *matchoff = dptr - start; 276 *matchlen = end - dptr; 277 return 1; 278 } 279 EXPORT_SYMBOL_GPL(ct_sip_parse_request); 280 281 /* SIP header parsing: SIP headers are located at the beginning of a line, but 282 * may span several lines, in which case the continuation lines begin with a 283 * whitespace character. RFC 2543 allows lines to be terminated with CR, LF or 284 * CRLF, RFC 3261 allows only CRLF, we support both. 285 * 286 * Headers are followed by (optionally) whitespace, a colon, again (optionally) 287 * whitespace and the values. Whitespace in this context means any amount of 288 * tabs, spaces and continuation lines, which are treated as a single whitespace 289 * character. 290 * 291 * Some headers may appear multiple times. A comma separated list of values is 292 * equivalent to multiple headers. 293 */ 294 static const struct sip_header ct_sip_hdrs[] = { 295 [SIP_HDR_CSEQ] = SIP_HDR("CSeq", NULL, NULL, digits_len), 296 [SIP_HDR_FROM] = SIP_HDR("From", "f", "sip:", skp_epaddr_len), 297 [SIP_HDR_TO] = SIP_HDR("To", "t", "sip:", skp_epaddr_len), 298 [SIP_HDR_CONTACT] = SIP_HDR("Contact", "m", "sip:", skp_epaddr_len), 299 [SIP_HDR_VIA_UDP] = SIP_HDR("Via", "v", "UDP ", epaddr_len), 300 [SIP_HDR_VIA_TCP] = SIP_HDR("Via", "v", "TCP ", epaddr_len), 301 [SIP_HDR_EXPIRES] = SIP_HDR("Expires", NULL, NULL, digits_len), 302 [SIP_HDR_CONTENT_LENGTH] = SIP_HDR("Content-Length", "l", NULL, digits_len), 303 [SIP_HDR_CALL_ID] = SIP_HDR("Call-Id", "i", NULL, callid_len), 304 }; 305 306 static const char *sip_follow_continuation(const char *dptr, const char *limit) 307 { 308 /* Walk past newline */ 309 if (++dptr >= limit) 310 return NULL; 311 312 /* Skip '\n' in CR LF */ 313 if (*(dptr - 1) == '\r' && *dptr == '\n') { 314 if (++dptr >= limit) 315 return NULL; 316 } 317 318 /* Continuation line? */ 319 if (*dptr != ' ' && *dptr != '\t') 320 return NULL; 321 322 /* skip leading whitespace */ 323 for (; dptr < limit; dptr++) { 324 if (*dptr != ' ' && *dptr != '\t') 325 break; 326 } 327 return dptr; 328 } 329 330 static const char *sip_skip_whitespace(const char *dptr, const char *limit) 331 { 332 for (; dptr < limit; dptr++) { 333 if (*dptr == ' ' || *dptr == '\t') 334 continue; 335 if (*dptr != '\r' && *dptr != '\n') 336 break; 337 dptr = sip_follow_continuation(dptr, limit); 338 break; 339 } 340 return dptr; 341 } 342 343 /* Search within a SIP header value, dealing with continuation lines */ 344 static const char *ct_sip_header_search(const char *dptr, const char *limit, 345 const char *needle, unsigned int len) 346 { 347 for (limit -= len; dptr < limit; dptr++) { 348 if (*dptr == '\r' || *dptr == '\n') { 349 dptr = sip_follow_continuation(dptr, limit); 350 if (dptr == NULL) 351 break; 352 continue; 353 } 354 355 if (strncasecmp(dptr, needle, len) == 0) 356 return dptr; 357 } 358 return NULL; 359 } 360 361 int ct_sip_get_header(const struct nf_conn *ct, const char *dptr, 362 unsigned int dataoff, unsigned int datalen, 363 enum sip_header_types type, 364 unsigned int *matchoff, unsigned int *matchlen) 365 { 366 const struct sip_header *hdr = &ct_sip_hdrs[type]; 367 const char *start = dptr, *limit = dptr + datalen; 368 int shift = 0; 369 370 for (dptr += dataoff; dptr < limit; dptr++) { 371 /* Find beginning of line */ 372 if (*dptr != '\r' && *dptr != '\n') 373 continue; 374 if (++dptr >= limit) 375 break; 376 if (*(dptr - 1) == '\r' && *dptr == '\n') { 377 if (++dptr >= limit) 378 break; 379 } 380 381 /* Skip continuation lines */ 382 if (*dptr == ' ' || *dptr == '\t') 383 continue; 384 385 /* Find header. Compact headers must be followed by a 386 * non-alphabetic character to avoid mismatches. */ 387 if (limit - dptr >= hdr->len && 388 strncasecmp(dptr, hdr->name, hdr->len) == 0) 389 dptr += hdr->len; 390 else if (hdr->cname && limit - dptr >= hdr->clen + 1 && 391 strncasecmp(dptr, hdr->cname, hdr->clen) == 0 && 392 !isalpha(*(dptr + hdr->clen))) 393 dptr += hdr->clen; 394 else 395 continue; 396 397 /* Find and skip colon */ 398 dptr = sip_skip_whitespace(dptr, limit); 399 if (dptr == NULL) 400 break; 401 if (*dptr != ':' || ++dptr >= limit) 402 break; 403 404 /* Skip whitespace after colon */ 405 dptr = sip_skip_whitespace(dptr, limit); 406 if (dptr == NULL) 407 break; 408 409 *matchoff = dptr - start; 410 if (hdr->search) { 411 dptr = ct_sip_header_search(dptr, limit, hdr->search, 412 hdr->slen); 413 if (!dptr) 414 return -1; 415 dptr += hdr->slen; 416 } 417 418 *matchlen = hdr->match_len(ct, dptr, limit, &shift); 419 if (!*matchlen) 420 return -1; 421 *matchoff = dptr - start + shift; 422 return 1; 423 } 424 return 0; 425 } 426 EXPORT_SYMBOL_GPL(ct_sip_get_header); 427 428 /* Get next header field in a list of comma separated values */ 429 static int ct_sip_next_header(const struct nf_conn *ct, const char *dptr, 430 unsigned int dataoff, unsigned int datalen, 431 enum sip_header_types type, 432 unsigned int *matchoff, unsigned int *matchlen) 433 { 434 const struct sip_header *hdr = &ct_sip_hdrs[type]; 435 const char *start = dptr, *limit = dptr + datalen; 436 int shift = 0; 437 438 dptr += dataoff; 439 440 dptr = ct_sip_header_search(dptr, limit, ",", strlen(",")); 441 if (!dptr) 442 return 0; 443 444 dptr = ct_sip_header_search(dptr, limit, hdr->search, hdr->slen); 445 if (!dptr) 446 return 0; 447 dptr += hdr->slen; 448 449 *matchoff = dptr - start; 450 *matchlen = hdr->match_len(ct, dptr, limit, &shift); 451 if (!*matchlen) 452 return -1; 453 *matchoff += shift; 454 return 1; 455 } 456 457 /* Walk through headers until a parsable one is found or no header of the 458 * given type is left. */ 459 static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr, 460 unsigned int dataoff, unsigned int datalen, 461 enum sip_header_types type, int *in_header, 462 unsigned int *matchoff, unsigned int *matchlen) 463 { 464 int ret; 465 466 if (in_header && *in_header) { 467 while (1) { 468 ret = ct_sip_next_header(ct, dptr, dataoff, datalen, 469 type, matchoff, matchlen); 470 if (ret > 0) 471 return ret; 472 if (ret == 0) 473 break; 474 dataoff += *matchoff; 475 } 476 *in_header = 0; 477 } 478 479 while (1) { 480 ret = ct_sip_get_header(ct, dptr, dataoff, datalen, 481 type, matchoff, matchlen); 482 if (ret > 0) 483 break; 484 if (ret == 0) 485 return ret; 486 dataoff += *matchoff; 487 } 488 489 if (in_header) 490 *in_header = 1; 491 return 1; 492 } 493 494 /* Locate a SIP header, parse the URI and return the offset and length of 495 * the address as well as the address and port themselves. A stream of 496 * headers can be parsed by handing in a non-NULL datalen and in_header 497 * pointer. 498 */ 499 int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr, 500 unsigned int *dataoff, unsigned int datalen, 501 enum sip_header_types type, int *in_header, 502 unsigned int *matchoff, unsigned int *matchlen, 503 union nf_inet_addr *addr, __be16 *port) 504 { 505 const char *c, *limit = dptr + datalen; 506 unsigned int p; 507 int ret; 508 509 ret = ct_sip_walk_headers(ct, dptr, dataoff ? *dataoff : 0, datalen, 510 type, in_header, matchoff, matchlen); 511 WARN_ON(ret < 0); 512 if (ret == 0) 513 return ret; 514 515 if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true)) 516 return -1; 517 if (*c == ':') { 518 c++; 519 p = simple_strtoul(c, (char **)&c, 10); 520 if (p < 1024 || p > 65535) 521 return -1; 522 *port = htons(p); 523 } else 524 *port = htons(SIP_PORT); 525 526 if (dataoff) 527 *dataoff = c - dptr; 528 return 1; 529 } 530 EXPORT_SYMBOL_GPL(ct_sip_parse_header_uri); 531 532 static int ct_sip_parse_param(const struct nf_conn *ct, const char *dptr, 533 unsigned int dataoff, unsigned int datalen, 534 const char *name, 535 unsigned int *matchoff, unsigned int *matchlen) 536 { 537 const char *limit = dptr + datalen; 538 const char *start; 539 const char *end; 540 541 limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(",")); 542 if (!limit) 543 limit = dptr + datalen; 544 545 start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name)); 546 if (!start) 547 return 0; 548 start += strlen(name); 549 550 end = ct_sip_header_search(start, limit, ";", strlen(";")); 551 if (!end) 552 end = limit; 553 554 *matchoff = start - dptr; 555 *matchlen = end - start; 556 return 1; 557 } 558 559 /* Parse address from header parameter and return address, offset and length */ 560 int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr, 561 unsigned int dataoff, unsigned int datalen, 562 const char *name, 563 unsigned int *matchoff, unsigned int *matchlen, 564 union nf_inet_addr *addr, bool delim) 565 { 566 const char *limit = dptr + datalen; 567 const char *start, *end; 568 569 limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(",")); 570 if (!limit) 571 limit = dptr + datalen; 572 573 start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name)); 574 if (!start) 575 return 0; 576 577 start += strlen(name); 578 if (!sip_parse_addr(ct, start, &end, addr, limit, delim)) 579 return 0; 580 *matchoff = start - dptr; 581 *matchlen = end - start; 582 return 1; 583 } 584 EXPORT_SYMBOL_GPL(ct_sip_parse_address_param); 585 586 /* Parse numerical header parameter and return value, offset and length */ 587 int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr, 588 unsigned int dataoff, unsigned int datalen, 589 const char *name, 590 unsigned int *matchoff, unsigned int *matchlen, 591 unsigned int *val) 592 { 593 const char *limit = dptr + datalen; 594 const char *start; 595 char *end; 596 597 limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(",")); 598 if (!limit) 599 limit = dptr + datalen; 600 601 start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name)); 602 if (!start) 603 return 0; 604 605 start += strlen(name); 606 *val = simple_strtoul(start, &end, 0); 607 if (start == end) 608 return 0; 609 if (matchoff && matchlen) { 610 *matchoff = start - dptr; 611 *matchlen = end - start; 612 } 613 return 1; 614 } 615 EXPORT_SYMBOL_GPL(ct_sip_parse_numerical_param); 616 617 static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr, 618 unsigned int dataoff, unsigned int datalen, 619 u8 *proto) 620 { 621 unsigned int matchoff, matchlen; 622 623 if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=", 624 &matchoff, &matchlen)) { 625 if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP"))) 626 *proto = IPPROTO_TCP; 627 else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP"))) 628 *proto = IPPROTO_UDP; 629 else 630 return 0; 631 632 if (*proto != nf_ct_protonum(ct)) 633 return 0; 634 } else 635 *proto = nf_ct_protonum(ct); 636 637 return 1; 638 } 639 640 static int sdp_parse_addr(const struct nf_conn *ct, const char *cp, 641 const char **endp, union nf_inet_addr *addr, 642 const char *limit) 643 { 644 const char *end; 645 int ret; 646 647 memset(addr, 0, sizeof(*addr)); 648 switch (nf_ct_l3num(ct)) { 649 case AF_INET: 650 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end); 651 break; 652 case AF_INET6: 653 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end); 654 break; 655 default: 656 BUG(); 657 } 658 659 if (ret == 0) 660 return 0; 661 if (endp) 662 *endp = end; 663 return 1; 664 } 665 666 /* skip ip address. returns its length. */ 667 static int sdp_addr_len(const struct nf_conn *ct, const char *dptr, 668 const char *limit, int *shift) 669 { 670 union nf_inet_addr addr; 671 const char *aux = dptr; 672 673 if (!sdp_parse_addr(ct, dptr, &dptr, &addr, limit)) { 674 pr_debug("ip: %s parse failed.!\n", dptr); 675 return 0; 676 } 677 678 return dptr - aux; 679 } 680 681 /* SDP header parsing: a SDP session description contains an ordered set of 682 * headers, starting with a section containing general session parameters, 683 * optionally followed by multiple media descriptions. 684 * 685 * SDP headers always start at the beginning of a line. According to RFC 2327: 686 * "The sequence CRLF (0x0d0a) is used to end a record, although parsers should 687 * be tolerant and also accept records terminated with a single newline 688 * character". We handle both cases. 689 */ 690 static const struct sip_header ct_sdp_hdrs_v4[] = { 691 [SDP_HDR_VERSION] = SDP_HDR("v=", NULL, digits_len), 692 [SDP_HDR_OWNER] = SDP_HDR("o=", "IN IP4 ", sdp_addr_len), 693 [SDP_HDR_CONNECTION] = SDP_HDR("c=", "IN IP4 ", sdp_addr_len), 694 [SDP_HDR_MEDIA] = SDP_HDR("m=", NULL, media_len), 695 }; 696 697 static const struct sip_header ct_sdp_hdrs_v6[] = { 698 [SDP_HDR_VERSION] = SDP_HDR("v=", NULL, digits_len), 699 [SDP_HDR_OWNER] = SDP_HDR("o=", "IN IP6 ", sdp_addr_len), 700 [SDP_HDR_CONNECTION] = SDP_HDR("c=", "IN IP6 ", sdp_addr_len), 701 [SDP_HDR_MEDIA] = SDP_HDR("m=", NULL, media_len), 702 }; 703 704 /* Linear string search within SDP header values */ 705 static const char *ct_sdp_header_search(const char *dptr, const char *limit, 706 const char *needle, unsigned int len) 707 { 708 for (limit -= len; dptr < limit; dptr++) { 709 if (*dptr == '\r' || *dptr == '\n') 710 break; 711 if (strncmp(dptr, needle, len) == 0) 712 return dptr; 713 } 714 return NULL; 715 } 716 717 /* Locate a SDP header (optionally a substring within the header value), 718 * optionally stopping at the first occurrence of the term header, parse 719 * it and return the offset and length of the data we're interested in. 720 */ 721 int ct_sip_get_sdp_header(const struct nf_conn *ct, const char *dptr, 722 unsigned int dataoff, unsigned int datalen, 723 enum sdp_header_types type, 724 enum sdp_header_types term, 725 unsigned int *matchoff, unsigned int *matchlen) 726 { 727 const struct sip_header *hdrs, *hdr, *thdr; 728 const char *start = dptr, *limit = dptr + datalen; 729 int shift = 0; 730 731 hdrs = nf_ct_l3num(ct) == NFPROTO_IPV4 ? ct_sdp_hdrs_v4 : ct_sdp_hdrs_v6; 732 hdr = &hdrs[type]; 733 thdr = &hdrs[term]; 734 735 for (dptr += dataoff; dptr < limit; dptr++) { 736 /* Find beginning of line */ 737 if (*dptr != '\r' && *dptr != '\n') 738 continue; 739 if (++dptr >= limit) 740 break; 741 if (*(dptr - 1) == '\r' && *dptr == '\n') { 742 if (++dptr >= limit) 743 break; 744 } 745 746 if (term != SDP_HDR_UNSPEC && 747 limit - dptr >= thdr->len && 748 strncasecmp(dptr, thdr->name, thdr->len) == 0) 749 break; 750 else if (limit - dptr >= hdr->len && 751 strncasecmp(dptr, hdr->name, hdr->len) == 0) 752 dptr += hdr->len; 753 else 754 continue; 755 756 *matchoff = dptr - start; 757 if (hdr->search) { 758 dptr = ct_sdp_header_search(dptr, limit, hdr->search, 759 hdr->slen); 760 if (!dptr) 761 return -1; 762 dptr += hdr->slen; 763 } 764 765 *matchlen = hdr->match_len(ct, dptr, limit, &shift); 766 if (!*matchlen) 767 return -1; 768 *matchoff = dptr - start + shift; 769 return 1; 770 } 771 return 0; 772 } 773 EXPORT_SYMBOL_GPL(ct_sip_get_sdp_header); 774 775 static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr, 776 unsigned int dataoff, unsigned int datalen, 777 enum sdp_header_types type, 778 enum sdp_header_types term, 779 unsigned int *matchoff, unsigned int *matchlen, 780 union nf_inet_addr *addr) 781 { 782 int ret; 783 784 ret = ct_sip_get_sdp_header(ct, dptr, dataoff, datalen, type, term, 785 matchoff, matchlen); 786 if (ret <= 0) 787 return ret; 788 789 if (!sdp_parse_addr(ct, dptr + *matchoff, NULL, addr, 790 dptr + *matchoff + *matchlen)) 791 return -1; 792 return 1; 793 } 794 795 static int refresh_signalling_expectation(struct nf_conn *ct, 796 union nf_inet_addr *addr, 797 u8 proto, __be16 port, 798 unsigned int expires) 799 { 800 struct nf_conn_help *help = nfct_help(ct); 801 struct nf_conntrack_expect *exp; 802 struct hlist_node *next; 803 int found = 0; 804 805 spin_lock_bh(&nf_conntrack_expect_lock); 806 hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) { 807 if (exp->class != SIP_EXPECT_SIGNALLING || 808 !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) || 809 exp->tuple.dst.protonum != proto || 810 exp->tuple.dst.u.udp.port != port) 811 continue; 812 if (mod_timer_pending(&exp->timeout, jiffies + expires * HZ)) { 813 exp->flags &= ~NF_CT_EXPECT_INACTIVE; 814 found = 1; 815 break; 816 } 817 } 818 spin_unlock_bh(&nf_conntrack_expect_lock); 819 return found; 820 } 821 822 static void flush_expectations(struct nf_conn *ct, bool media) 823 { 824 struct nf_conn_help *help = nfct_help(ct); 825 struct nf_conntrack_expect *exp; 826 struct hlist_node *next; 827 828 spin_lock_bh(&nf_conntrack_expect_lock); 829 hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) { 830 if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media) 831 continue; 832 if (!nf_ct_remove_expect(exp)) 833 continue; 834 if (!media) 835 break; 836 } 837 spin_unlock_bh(&nf_conntrack_expect_lock); 838 } 839 840 static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff, 841 unsigned int dataoff, 842 const char **dptr, unsigned int *datalen, 843 union nf_inet_addr *daddr, __be16 port, 844 enum sip_expectation_classes class, 845 unsigned int mediaoff, unsigned int medialen) 846 { 847 struct nf_conntrack_expect *exp, *rtp_exp, *rtcp_exp; 848 enum ip_conntrack_info ctinfo; 849 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 850 struct net *net = nf_ct_net(ct); 851 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 852 union nf_inet_addr *saddr; 853 struct nf_conntrack_tuple tuple; 854 int direct_rtp = 0, skip_expect = 0, ret = NF_DROP; 855 u_int16_t base_port; 856 __be16 rtp_port, rtcp_port; 857 const struct nf_nat_sip_hooks *hooks; 858 859 saddr = NULL; 860 if (sip_direct_media) { 861 if (!nf_inet_addr_cmp(daddr, &ct->tuplehash[dir].tuple.src.u3)) 862 return NF_ACCEPT; 863 saddr = &ct->tuplehash[!dir].tuple.src.u3; 864 } 865 866 /* We need to check whether the registration exists before attempting 867 * to register it since we can see the same media description multiple 868 * times on different connections in case multiple endpoints receive 869 * the same call. 870 * 871 * RTP optimization: if we find a matching media channel expectation 872 * and both the expectation and this connection are SNATed, we assume 873 * both sides can reach each other directly and use the final 874 * destination address from the expectation. We still need to keep 875 * the NATed expectations for media that might arrive from the 876 * outside, and additionally need to expect the direct RTP stream 877 * in case it passes through us even without NAT. 878 */ 879 memset(&tuple, 0, sizeof(tuple)); 880 if (saddr) 881 tuple.src.u3 = *saddr; 882 tuple.src.l3num = nf_ct_l3num(ct); 883 tuple.dst.protonum = IPPROTO_UDP; 884 tuple.dst.u3 = *daddr; 885 tuple.dst.u.udp.port = port; 886 887 do { 888 exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple); 889 890 if (!exp || exp->master == ct || 891 nfct_help(exp->master)->helper != nfct_help(ct)->helper || 892 exp->class != class) 893 break; 894 #ifdef CONFIG_NF_NAT_NEEDED 895 if (!direct_rtp && 896 (!nf_inet_addr_cmp(&exp->saved_addr, &exp->tuple.dst.u3) || 897 exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) && 898 ct->status & IPS_NAT_MASK) { 899 *daddr = exp->saved_addr; 900 tuple.dst.u3 = exp->saved_addr; 901 tuple.dst.u.udp.port = exp->saved_proto.udp.port; 902 direct_rtp = 1; 903 } else 904 #endif 905 skip_expect = 1; 906 } while (!skip_expect); 907 908 base_port = ntohs(tuple.dst.u.udp.port) & ~1; 909 rtp_port = htons(base_port); 910 rtcp_port = htons(base_port + 1); 911 912 if (direct_rtp) { 913 hooks = rcu_dereference(nf_nat_sip_hooks); 914 if (hooks && 915 !hooks->sdp_port(skb, protoff, dataoff, dptr, datalen, 916 mediaoff, medialen, ntohs(rtp_port))) 917 goto err1; 918 } 919 920 if (skip_expect) 921 return NF_ACCEPT; 922 923 rtp_exp = nf_ct_expect_alloc(ct); 924 if (rtp_exp == NULL) 925 goto err1; 926 nf_ct_expect_init(rtp_exp, class, nf_ct_l3num(ct), saddr, daddr, 927 IPPROTO_UDP, NULL, &rtp_port); 928 929 rtcp_exp = nf_ct_expect_alloc(ct); 930 if (rtcp_exp == NULL) 931 goto err2; 932 nf_ct_expect_init(rtcp_exp, class, nf_ct_l3num(ct), saddr, daddr, 933 IPPROTO_UDP, NULL, &rtcp_port); 934 935 hooks = rcu_dereference(nf_nat_sip_hooks); 936 if (hooks && ct->status & IPS_NAT_MASK && !direct_rtp) 937 ret = hooks->sdp_media(skb, protoff, dataoff, dptr, 938 datalen, rtp_exp, rtcp_exp, 939 mediaoff, medialen, daddr); 940 else { 941 if (nf_ct_expect_related(rtp_exp) == 0) { 942 if (nf_ct_expect_related(rtcp_exp) != 0) 943 nf_ct_unexpect_related(rtp_exp); 944 else 945 ret = NF_ACCEPT; 946 } 947 } 948 nf_ct_expect_put(rtcp_exp); 949 err2: 950 nf_ct_expect_put(rtp_exp); 951 err1: 952 return ret; 953 } 954 955 static const struct sdp_media_type sdp_media_types[] = { 956 SDP_MEDIA_TYPE("audio ", SIP_EXPECT_AUDIO), 957 SDP_MEDIA_TYPE("video ", SIP_EXPECT_VIDEO), 958 SDP_MEDIA_TYPE("image ", SIP_EXPECT_IMAGE), 959 }; 960 961 static const struct sdp_media_type *sdp_media_type(const char *dptr, 962 unsigned int matchoff, 963 unsigned int matchlen) 964 { 965 const struct sdp_media_type *t; 966 unsigned int i; 967 968 for (i = 0; i < ARRAY_SIZE(sdp_media_types); i++) { 969 t = &sdp_media_types[i]; 970 if (matchlen < t->len || 971 strncmp(dptr + matchoff, t->name, t->len)) 972 continue; 973 return t; 974 } 975 return NULL; 976 } 977 978 static int process_sdp(struct sk_buff *skb, unsigned int protoff, 979 unsigned int dataoff, 980 const char **dptr, unsigned int *datalen, 981 unsigned int cseq) 982 { 983 enum ip_conntrack_info ctinfo; 984 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 985 unsigned int matchoff, matchlen; 986 unsigned int mediaoff, medialen; 987 unsigned int sdpoff; 988 unsigned int caddr_len, maddr_len; 989 unsigned int i; 990 union nf_inet_addr caddr, maddr, rtp_addr; 991 const struct nf_nat_sip_hooks *hooks; 992 unsigned int port; 993 const struct sdp_media_type *t; 994 int ret = NF_ACCEPT; 995 996 hooks = rcu_dereference(nf_nat_sip_hooks); 997 998 /* Find beginning of session description */ 999 if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen, 1000 SDP_HDR_VERSION, SDP_HDR_UNSPEC, 1001 &matchoff, &matchlen) <= 0) 1002 return NF_ACCEPT; 1003 sdpoff = matchoff; 1004 1005 /* The connection information is contained in the session description 1006 * and/or once per media description. The first media description marks 1007 * the end of the session description. */ 1008 caddr_len = 0; 1009 if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen, 1010 SDP_HDR_CONNECTION, SDP_HDR_MEDIA, 1011 &matchoff, &matchlen, &caddr) > 0) 1012 caddr_len = matchlen; 1013 1014 mediaoff = sdpoff; 1015 for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) { 1016 if (ct_sip_get_sdp_header(ct, *dptr, mediaoff, *datalen, 1017 SDP_HDR_MEDIA, SDP_HDR_UNSPEC, 1018 &mediaoff, &medialen) <= 0) 1019 break; 1020 1021 /* Get media type and port number. A media port value of zero 1022 * indicates an inactive stream. */ 1023 t = sdp_media_type(*dptr, mediaoff, medialen); 1024 if (!t) { 1025 mediaoff += medialen; 1026 continue; 1027 } 1028 mediaoff += t->len; 1029 medialen -= t->len; 1030 1031 port = simple_strtoul(*dptr + mediaoff, NULL, 10); 1032 if (port == 0) 1033 continue; 1034 if (port < 1024 || port > 65535) { 1035 nf_ct_helper_log(skb, ct, "wrong port %u", port); 1036 return NF_DROP; 1037 } 1038 1039 /* The media description overrides the session description. */ 1040 maddr_len = 0; 1041 if (ct_sip_parse_sdp_addr(ct, *dptr, mediaoff, *datalen, 1042 SDP_HDR_CONNECTION, SDP_HDR_MEDIA, 1043 &matchoff, &matchlen, &maddr) > 0) { 1044 maddr_len = matchlen; 1045 memcpy(&rtp_addr, &maddr, sizeof(rtp_addr)); 1046 } else if (caddr_len) 1047 memcpy(&rtp_addr, &caddr, sizeof(rtp_addr)); 1048 else { 1049 nf_ct_helper_log(skb, ct, "cannot parse SDP message"); 1050 return NF_DROP; 1051 } 1052 1053 ret = set_expected_rtp_rtcp(skb, protoff, dataoff, 1054 dptr, datalen, 1055 &rtp_addr, htons(port), t->class, 1056 mediaoff, medialen); 1057 if (ret != NF_ACCEPT) { 1058 nf_ct_helper_log(skb, ct, 1059 "cannot add expectation for voice"); 1060 return ret; 1061 } 1062 1063 /* Update media connection address if present */ 1064 if (maddr_len && hooks && ct->status & IPS_NAT_MASK) { 1065 ret = hooks->sdp_addr(skb, protoff, dataoff, 1066 dptr, datalen, mediaoff, 1067 SDP_HDR_CONNECTION, 1068 SDP_HDR_MEDIA, 1069 &rtp_addr); 1070 if (ret != NF_ACCEPT) { 1071 nf_ct_helper_log(skb, ct, "cannot mangle SDP"); 1072 return ret; 1073 } 1074 } 1075 i++; 1076 } 1077 1078 /* Update session connection and owner addresses */ 1079 hooks = rcu_dereference(nf_nat_sip_hooks); 1080 if (hooks && ct->status & IPS_NAT_MASK) 1081 ret = hooks->sdp_session(skb, protoff, dataoff, 1082 dptr, datalen, sdpoff, 1083 &rtp_addr); 1084 1085 return ret; 1086 } 1087 static int process_invite_response(struct sk_buff *skb, unsigned int protoff, 1088 unsigned int dataoff, 1089 const char **dptr, unsigned int *datalen, 1090 unsigned int cseq, unsigned int code) 1091 { 1092 enum ip_conntrack_info ctinfo; 1093 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1094 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1095 1096 if ((code >= 100 && code <= 199) || 1097 (code >= 200 && code <= 299)) 1098 return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq); 1099 else if (ct_sip_info->invite_cseq == cseq) 1100 flush_expectations(ct, true); 1101 return NF_ACCEPT; 1102 } 1103 1104 static int process_update_response(struct sk_buff *skb, unsigned int protoff, 1105 unsigned int dataoff, 1106 const char **dptr, unsigned int *datalen, 1107 unsigned int cseq, unsigned int code) 1108 { 1109 enum ip_conntrack_info ctinfo; 1110 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1111 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1112 1113 if ((code >= 100 && code <= 199) || 1114 (code >= 200 && code <= 299)) 1115 return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq); 1116 else if (ct_sip_info->invite_cseq == cseq) 1117 flush_expectations(ct, true); 1118 return NF_ACCEPT; 1119 } 1120 1121 static int process_prack_response(struct sk_buff *skb, unsigned int protoff, 1122 unsigned int dataoff, 1123 const char **dptr, unsigned int *datalen, 1124 unsigned int cseq, unsigned int code) 1125 { 1126 enum ip_conntrack_info ctinfo; 1127 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1128 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1129 1130 if ((code >= 100 && code <= 199) || 1131 (code >= 200 && code <= 299)) 1132 return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq); 1133 else if (ct_sip_info->invite_cseq == cseq) 1134 flush_expectations(ct, true); 1135 return NF_ACCEPT; 1136 } 1137 1138 static int process_invite_request(struct sk_buff *skb, unsigned int protoff, 1139 unsigned int dataoff, 1140 const char **dptr, unsigned int *datalen, 1141 unsigned int cseq) 1142 { 1143 enum ip_conntrack_info ctinfo; 1144 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1145 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1146 unsigned int ret; 1147 1148 flush_expectations(ct, true); 1149 ret = process_sdp(skb, protoff, dataoff, dptr, datalen, cseq); 1150 if (ret == NF_ACCEPT) 1151 ct_sip_info->invite_cseq = cseq; 1152 return ret; 1153 } 1154 1155 static int process_bye_request(struct sk_buff *skb, unsigned int protoff, 1156 unsigned int dataoff, 1157 const char **dptr, unsigned int *datalen, 1158 unsigned int cseq) 1159 { 1160 enum ip_conntrack_info ctinfo; 1161 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1162 1163 flush_expectations(ct, true); 1164 return NF_ACCEPT; 1165 } 1166 1167 /* Parse a REGISTER request and create a permanent expectation for incoming 1168 * signalling connections. The expectation is marked inactive and is activated 1169 * when receiving a response indicating success from the registrar. 1170 */ 1171 static int process_register_request(struct sk_buff *skb, unsigned int protoff, 1172 unsigned int dataoff, 1173 const char **dptr, unsigned int *datalen, 1174 unsigned int cseq) 1175 { 1176 enum ip_conntrack_info ctinfo; 1177 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1178 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1179 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 1180 unsigned int matchoff, matchlen; 1181 struct nf_conntrack_expect *exp; 1182 union nf_inet_addr *saddr, daddr; 1183 const struct nf_nat_sip_hooks *hooks; 1184 __be16 port; 1185 u8 proto; 1186 unsigned int expires = 0; 1187 int ret; 1188 1189 /* Expected connections can not register again. */ 1190 if (ct->status & IPS_EXPECTED) 1191 return NF_ACCEPT; 1192 1193 /* We must check the expiration time: a value of zero signals the 1194 * registrar to release the binding. We'll remove our expectation 1195 * when receiving the new bindings in the response, but we don't 1196 * want to create new ones. 1197 * 1198 * The expiration time may be contained in Expires: header, the 1199 * Contact: header parameters or the URI parameters. 1200 */ 1201 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES, 1202 &matchoff, &matchlen) > 0) 1203 expires = simple_strtoul(*dptr + matchoff, NULL, 10); 1204 1205 ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, 1206 SIP_HDR_CONTACT, NULL, 1207 &matchoff, &matchlen, &daddr, &port); 1208 if (ret < 0) { 1209 nf_ct_helper_log(skb, ct, "cannot parse contact"); 1210 return NF_DROP; 1211 } else if (ret == 0) 1212 return NF_ACCEPT; 1213 1214 /* We don't support third-party registrations */ 1215 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, &daddr)) 1216 return NF_ACCEPT; 1217 1218 if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen, *datalen, 1219 &proto) == 0) 1220 return NF_ACCEPT; 1221 1222 if (ct_sip_parse_numerical_param(ct, *dptr, 1223 matchoff + matchlen, *datalen, 1224 "expires=", NULL, NULL, &expires) < 0) { 1225 nf_ct_helper_log(skb, ct, "cannot parse expires"); 1226 return NF_DROP; 1227 } 1228 1229 if (expires == 0) { 1230 ret = NF_ACCEPT; 1231 goto store_cseq; 1232 } 1233 1234 exp = nf_ct_expect_alloc(ct); 1235 if (!exp) { 1236 nf_ct_helper_log(skb, ct, "cannot alloc expectation"); 1237 return NF_DROP; 1238 } 1239 1240 saddr = NULL; 1241 if (sip_direct_signalling) 1242 saddr = &ct->tuplehash[!dir].tuple.src.u3; 1243 1244 nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct), 1245 saddr, &daddr, proto, NULL, &port); 1246 exp->timeout.expires = sip_timeout * HZ; 1247 exp->helper = nfct_help(ct)->helper; 1248 exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE; 1249 1250 hooks = rcu_dereference(nf_nat_sip_hooks); 1251 if (hooks && ct->status & IPS_NAT_MASK) 1252 ret = hooks->expect(skb, protoff, dataoff, dptr, datalen, 1253 exp, matchoff, matchlen); 1254 else { 1255 if (nf_ct_expect_related(exp) != 0) { 1256 nf_ct_helper_log(skb, ct, "cannot add expectation"); 1257 ret = NF_DROP; 1258 } else 1259 ret = NF_ACCEPT; 1260 } 1261 nf_ct_expect_put(exp); 1262 1263 store_cseq: 1264 if (ret == NF_ACCEPT) 1265 ct_sip_info->register_cseq = cseq; 1266 return ret; 1267 } 1268 1269 static int process_register_response(struct sk_buff *skb, unsigned int protoff, 1270 unsigned int dataoff, 1271 const char **dptr, unsigned int *datalen, 1272 unsigned int cseq, unsigned int code) 1273 { 1274 enum ip_conntrack_info ctinfo; 1275 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1276 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1277 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 1278 union nf_inet_addr addr; 1279 __be16 port; 1280 u8 proto; 1281 unsigned int matchoff, matchlen, coff = 0; 1282 unsigned int expires = 0; 1283 int in_contact = 0, ret; 1284 1285 /* According to RFC 3261, "UAs MUST NOT send a new registration until 1286 * they have received a final response from the registrar for the 1287 * previous one or the previous REGISTER request has timed out". 1288 * 1289 * However, some servers fail to detect retransmissions and send late 1290 * responses, so we store the sequence number of the last valid 1291 * request and compare it here. 1292 */ 1293 if (ct_sip_info->register_cseq != cseq) 1294 return NF_ACCEPT; 1295 1296 if (code >= 100 && code <= 199) 1297 return NF_ACCEPT; 1298 if (code < 200 || code > 299) 1299 goto flush; 1300 1301 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES, 1302 &matchoff, &matchlen) > 0) 1303 expires = simple_strtoul(*dptr + matchoff, NULL, 10); 1304 1305 while (1) { 1306 unsigned int c_expires = expires; 1307 1308 ret = ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen, 1309 SIP_HDR_CONTACT, &in_contact, 1310 &matchoff, &matchlen, 1311 &addr, &port); 1312 if (ret < 0) { 1313 nf_ct_helper_log(skb, ct, "cannot parse contact"); 1314 return NF_DROP; 1315 } else if (ret == 0) 1316 break; 1317 1318 /* We don't support third-party registrations */ 1319 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, &addr)) 1320 continue; 1321 1322 if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen, 1323 *datalen, &proto) == 0) 1324 continue; 1325 1326 ret = ct_sip_parse_numerical_param(ct, *dptr, 1327 matchoff + matchlen, 1328 *datalen, "expires=", 1329 NULL, NULL, &c_expires); 1330 if (ret < 0) { 1331 nf_ct_helper_log(skb, ct, "cannot parse expires"); 1332 return NF_DROP; 1333 } 1334 if (c_expires == 0) 1335 break; 1336 if (refresh_signalling_expectation(ct, &addr, proto, port, 1337 c_expires)) 1338 return NF_ACCEPT; 1339 } 1340 1341 flush: 1342 flush_expectations(ct, false); 1343 return NF_ACCEPT; 1344 } 1345 1346 static const struct sip_handler sip_handlers[] = { 1347 SIP_HANDLER("INVITE", process_invite_request, process_invite_response), 1348 SIP_HANDLER("UPDATE", process_sdp, process_update_response), 1349 SIP_HANDLER("ACK", process_sdp, NULL), 1350 SIP_HANDLER("PRACK", process_sdp, process_prack_response), 1351 SIP_HANDLER("BYE", process_bye_request, NULL), 1352 SIP_HANDLER("REGISTER", process_register_request, process_register_response), 1353 }; 1354 1355 static int process_sip_response(struct sk_buff *skb, unsigned int protoff, 1356 unsigned int dataoff, 1357 const char **dptr, unsigned int *datalen) 1358 { 1359 enum ip_conntrack_info ctinfo; 1360 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1361 unsigned int matchoff, matchlen, matchend; 1362 unsigned int code, cseq, i; 1363 1364 if (*datalen < strlen("SIP/2.0 200")) 1365 return NF_ACCEPT; 1366 code = simple_strtoul(*dptr + strlen("SIP/2.0 "), NULL, 10); 1367 if (!code) { 1368 nf_ct_helper_log(skb, ct, "cannot get code"); 1369 return NF_DROP; 1370 } 1371 1372 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, 1373 &matchoff, &matchlen) <= 0) { 1374 nf_ct_helper_log(skb, ct, "cannot parse cseq"); 1375 return NF_DROP; 1376 } 1377 cseq = simple_strtoul(*dptr + matchoff, NULL, 10); 1378 if (!cseq && *(*dptr + matchoff) != '0') { 1379 nf_ct_helper_log(skb, ct, "cannot get cseq"); 1380 return NF_DROP; 1381 } 1382 matchend = matchoff + matchlen + 1; 1383 1384 for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) { 1385 const struct sip_handler *handler; 1386 1387 handler = &sip_handlers[i]; 1388 if (handler->response == NULL) 1389 continue; 1390 if (*datalen < matchend + handler->len || 1391 strncasecmp(*dptr + matchend, handler->method, handler->len)) 1392 continue; 1393 return handler->response(skb, protoff, dataoff, dptr, datalen, 1394 cseq, code); 1395 } 1396 return NF_ACCEPT; 1397 } 1398 1399 static int process_sip_request(struct sk_buff *skb, unsigned int protoff, 1400 unsigned int dataoff, 1401 const char **dptr, unsigned int *datalen) 1402 { 1403 enum ip_conntrack_info ctinfo; 1404 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1405 struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct); 1406 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 1407 unsigned int matchoff, matchlen; 1408 unsigned int cseq, i; 1409 union nf_inet_addr addr; 1410 __be16 port; 1411 1412 /* Many Cisco IP phones use a high source port for SIP requests, but 1413 * listen for the response on port 5060. If we are the local 1414 * router for one of these phones, save the port number from the 1415 * Via: header so that nf_nat_sip can redirect the responses to 1416 * the correct port. 1417 */ 1418 if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, 1419 SIP_HDR_VIA_UDP, NULL, &matchoff, 1420 &matchlen, &addr, &port) > 0 && 1421 port != ct->tuplehash[dir].tuple.src.u.udp.port && 1422 nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3)) 1423 ct_sip_info->forced_dport = port; 1424 1425 for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) { 1426 const struct sip_handler *handler; 1427 1428 handler = &sip_handlers[i]; 1429 if (handler->request == NULL) 1430 continue; 1431 if (*datalen < handler->len + 2 || 1432 strncasecmp(*dptr, handler->method, handler->len)) 1433 continue; 1434 if ((*dptr)[handler->len] != ' ' || 1435 !isalpha((*dptr)[handler->len+1])) 1436 continue; 1437 1438 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, 1439 &matchoff, &matchlen) <= 0) { 1440 nf_ct_helper_log(skb, ct, "cannot parse cseq"); 1441 return NF_DROP; 1442 } 1443 cseq = simple_strtoul(*dptr + matchoff, NULL, 10); 1444 if (!cseq && *(*dptr + matchoff) != '0') { 1445 nf_ct_helper_log(skb, ct, "cannot get cseq"); 1446 return NF_DROP; 1447 } 1448 1449 return handler->request(skb, protoff, dataoff, dptr, datalen, 1450 cseq); 1451 } 1452 return NF_ACCEPT; 1453 } 1454 1455 static int process_sip_msg(struct sk_buff *skb, struct nf_conn *ct, 1456 unsigned int protoff, unsigned int dataoff, 1457 const char **dptr, unsigned int *datalen) 1458 { 1459 const struct nf_nat_sip_hooks *hooks; 1460 int ret; 1461 1462 if (strncasecmp(*dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0) 1463 ret = process_sip_request(skb, protoff, dataoff, dptr, datalen); 1464 else 1465 ret = process_sip_response(skb, protoff, dataoff, dptr, datalen); 1466 1467 if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) { 1468 hooks = rcu_dereference(nf_nat_sip_hooks); 1469 if (hooks && !hooks->msg(skb, protoff, dataoff, 1470 dptr, datalen)) { 1471 nf_ct_helper_log(skb, ct, "cannot NAT SIP message"); 1472 ret = NF_DROP; 1473 } 1474 } 1475 1476 return ret; 1477 } 1478 1479 static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, 1480 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 1481 { 1482 struct tcphdr *th, _tcph; 1483 unsigned int dataoff, datalen; 1484 unsigned int matchoff, matchlen, clen; 1485 unsigned int msglen, origlen; 1486 const char *dptr, *end; 1487 s16 diff, tdiff = 0; 1488 int ret = NF_ACCEPT; 1489 bool term; 1490 1491 if (ctinfo != IP_CT_ESTABLISHED && 1492 ctinfo != IP_CT_ESTABLISHED_REPLY) 1493 return NF_ACCEPT; 1494 1495 /* No Data ? */ 1496 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph); 1497 if (th == NULL) 1498 return NF_ACCEPT; 1499 dataoff = protoff + th->doff * 4; 1500 if (dataoff >= skb->len) 1501 return NF_ACCEPT; 1502 1503 nf_ct_refresh(ct, skb, sip_timeout * HZ); 1504 1505 if (unlikely(skb_linearize(skb))) 1506 return NF_DROP; 1507 1508 dptr = skb->data + dataoff; 1509 datalen = skb->len - dataoff; 1510 if (datalen < strlen("SIP/2.0 200")) 1511 return NF_ACCEPT; 1512 1513 while (1) { 1514 if (ct_sip_get_header(ct, dptr, 0, datalen, 1515 SIP_HDR_CONTENT_LENGTH, 1516 &matchoff, &matchlen) <= 0) 1517 break; 1518 1519 clen = simple_strtoul(dptr + matchoff, (char **)&end, 10); 1520 if (dptr + matchoff == end) 1521 break; 1522 1523 term = false; 1524 for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) { 1525 if (end[0] == '\r' && end[1] == '\n' && 1526 end[2] == '\r' && end[3] == '\n') { 1527 term = true; 1528 break; 1529 } 1530 } 1531 if (!term) 1532 break; 1533 end += strlen("\r\n\r\n") + clen; 1534 1535 msglen = origlen = end - dptr; 1536 if (msglen > datalen) 1537 return NF_ACCEPT; 1538 1539 ret = process_sip_msg(skb, ct, protoff, dataoff, 1540 &dptr, &msglen); 1541 /* process_sip_* functions report why this packet is dropped */ 1542 if (ret != NF_ACCEPT) 1543 break; 1544 diff = msglen - origlen; 1545 tdiff += diff; 1546 1547 dataoff += msglen; 1548 dptr += msglen; 1549 datalen = datalen + diff - msglen; 1550 } 1551 1552 if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) { 1553 const struct nf_nat_sip_hooks *hooks; 1554 1555 hooks = rcu_dereference(nf_nat_sip_hooks); 1556 if (hooks) 1557 hooks->seq_adjust(skb, protoff, tdiff); 1558 } 1559 1560 return ret; 1561 } 1562 1563 static int sip_help_udp(struct sk_buff *skb, unsigned int protoff, 1564 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 1565 { 1566 unsigned int dataoff, datalen; 1567 const char *dptr; 1568 1569 /* No Data ? */ 1570 dataoff = protoff + sizeof(struct udphdr); 1571 if (dataoff >= skb->len) 1572 return NF_ACCEPT; 1573 1574 nf_ct_refresh(ct, skb, sip_timeout * HZ); 1575 1576 if (unlikely(skb_linearize(skb))) 1577 return NF_DROP; 1578 1579 dptr = skb->data + dataoff; 1580 datalen = skb->len - dataoff; 1581 if (datalen < strlen("SIP/2.0 200")) 1582 return NF_ACCEPT; 1583 1584 return process_sip_msg(skb, ct, protoff, dataoff, &dptr, &datalen); 1585 } 1586 1587 static struct nf_conntrack_helper sip[MAX_PORTS * 4] __read_mostly; 1588 1589 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = { 1590 [SIP_EXPECT_SIGNALLING] = { 1591 .name = "signalling", 1592 .max_expected = 1, 1593 .timeout = 3 * 60, 1594 }, 1595 [SIP_EXPECT_AUDIO] = { 1596 .name = "audio", 1597 .max_expected = 2 * IP_CT_DIR_MAX, 1598 .timeout = 3 * 60, 1599 }, 1600 [SIP_EXPECT_VIDEO] = { 1601 .name = "video", 1602 .max_expected = 2 * IP_CT_DIR_MAX, 1603 .timeout = 3 * 60, 1604 }, 1605 [SIP_EXPECT_IMAGE] = { 1606 .name = "image", 1607 .max_expected = IP_CT_DIR_MAX, 1608 .timeout = 3 * 60, 1609 }, 1610 }; 1611 1612 static void nf_conntrack_sip_fini(void) 1613 { 1614 nf_conntrack_helpers_unregister(sip, ports_c * 4); 1615 } 1616 1617 static int __init nf_conntrack_sip_init(void) 1618 { 1619 int i, ret; 1620 1621 NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_sip_master)); 1622 1623 if (ports_c == 0) 1624 ports[ports_c++] = SIP_PORT; 1625 1626 for (i = 0; i < ports_c; i++) { 1627 nf_ct_helper_init(&sip[4 * i], AF_INET, IPPROTO_UDP, "sip", 1628 SIP_PORT, ports[i], i, sip_exp_policy, 1629 SIP_EXPECT_MAX, sip_help_udp, 1630 NULL, THIS_MODULE); 1631 nf_ct_helper_init(&sip[4 * i + 1], AF_INET, IPPROTO_TCP, "sip", 1632 SIP_PORT, ports[i], i, sip_exp_policy, 1633 SIP_EXPECT_MAX, sip_help_tcp, 1634 NULL, THIS_MODULE); 1635 nf_ct_helper_init(&sip[4 * i + 2], AF_INET6, IPPROTO_UDP, "sip", 1636 SIP_PORT, ports[i], i, sip_exp_policy, 1637 SIP_EXPECT_MAX, sip_help_udp, 1638 NULL, THIS_MODULE); 1639 nf_ct_helper_init(&sip[4 * i + 3], AF_INET6, IPPROTO_TCP, "sip", 1640 SIP_PORT, ports[i], i, sip_exp_policy, 1641 SIP_EXPECT_MAX, sip_help_tcp, 1642 NULL, THIS_MODULE); 1643 } 1644 1645 ret = nf_conntrack_helpers_register(sip, ports_c * 4); 1646 if (ret < 0) { 1647 pr_err("failed to register helpers\n"); 1648 return ret; 1649 } 1650 return 0; 1651 } 1652 1653 module_init(nf_conntrack_sip_init); 1654 module_exit(nf_conntrack_sip_fini); 1655