1 /* SIP extension for IP connection tracking.
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_conntrack_ftp.c and other modules.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/ctype.h>
13 #include <linux/skbuff.h>
16 #include <linux/udp.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_ipv4.h>
20 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
21 #include <linux/netfilter_ipv4/ip_conntrack_sip.h>
26 #define DEBUGP(format, args...)
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
31 MODULE_DESCRIPTION("SIP connection tracking helper");
34 static unsigned short ports
[MAX_PORTS
];
36 module_param_array(ports
, ushort
, &ports_c
, 0400);
37 MODULE_PARM_DESC(ports
, "port numbers of sip servers");
39 static unsigned int sip_timeout
= SIP_TIMEOUT
;
40 module_param(sip_timeout
, uint
, 0600);
41 MODULE_PARM_DESC(sip_timeout
, "timeout for the master SIP session");
43 unsigned int (*ip_nat_sip_hook
)(struct sk_buff
**pskb
,
44 enum ip_conntrack_info ctinfo
,
45 struct ip_conntrack
*ct
,
47 EXPORT_SYMBOL_GPL(ip_nat_sip_hook
);
49 unsigned int (*ip_nat_sdp_hook
)(struct sk_buff
**pskb
,
50 enum ip_conntrack_info ctinfo
,
51 struct ip_conntrack_expect
*exp
,
53 EXPORT_SYMBOL_GPL(ip_nat_sdp_hook
);
55 static int digits_len(const char *dptr
, const char *limit
, int *shift
);
56 static int epaddr_len(const char *dptr
, const char *limit
, int *shift
);
57 static int skp_digits_len(const char *dptr
, const char *limit
, int *shift
);
58 static int skp_epaddr_len(const char *dptr
, const char *limit
, int *shift
);
60 struct sip_header_nfo
{
68 int (*match_len
)(const char *, const char *, int *);
71 static struct sip_header_nfo ct_sip_hdrs
[] = {
72 [POS_REG_REQ_URI
] = { /* SIP REGISTER request URI */
74 .lnlen
= sizeof("sip:") - 1,
76 .ln_strlen
= sizeof(":") - 1,
77 .match_len
= epaddr_len
79 [POS_REQ_URI
] = { /* SIP request URI */
81 .lnlen
= sizeof("sip:") - 1,
83 .ln_strlen
= sizeof("@") - 1,
84 .match_len
= epaddr_len
86 [POS_FROM
] = { /* SIP From header */
88 .lnlen
= sizeof("From:") - 1,
90 .snlen
= sizeof("\r\nf:") - 1,
92 .ln_strlen
= sizeof("sip:") - 1,
93 .match_len
= skp_epaddr_len
,
95 [POS_TO
] = { /* SIP To header */
97 .lnlen
= sizeof("To:") - 1,
99 .snlen
= sizeof("\r\nt:") - 1,
101 .ln_strlen
= sizeof("sip:") - 1,
102 .match_len
= skp_epaddr_len
,
104 [POS_VIA
] = { /* SIP Via header */
106 .lnlen
= sizeof("Via:") - 1,
108 .snlen
= sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
110 .ln_strlen
= sizeof("UDP ") - 1,
111 .match_len
= epaddr_len
,
113 [POS_CONTACT
] = { /* SIP Contact header */
115 .lnlen
= sizeof("Contact:") - 1,
117 .snlen
= sizeof("\r\nm:") - 1,
119 .ln_strlen
= sizeof("sip:") - 1,
120 .match_len
= skp_epaddr_len
122 [POS_CONTENT
] = { /* SIP Content length header */
123 .lname
= "Content-Length:",
124 .lnlen
= sizeof("Content-Length:") - 1,
126 .snlen
= sizeof("\r\nl:") - 1,
128 .ln_strlen
= sizeof(":") - 1,
129 .match_len
= skp_digits_len
131 [POS_MEDIA
] = { /* SDP media info */
134 .lnlen
= sizeof("\nm=") - 1,
136 .snlen
= sizeof("\rm=") - 1,
138 .ln_strlen
= sizeof("audio ") - 1,
139 .match_len
= digits_len
141 [POS_OWNER
] = { /* SDP owner address*/
144 .lnlen
= sizeof("\no=") - 1,
146 .snlen
= sizeof("\ro=") - 1,
148 .ln_strlen
= sizeof("IN IP4 ") - 1,
149 .match_len
= epaddr_len
151 [POS_CONNECTION
] = { /* SDP connection info */
154 .lnlen
= sizeof("\nc=") - 1,
156 .snlen
= sizeof("\rc=") - 1,
158 .ln_strlen
= sizeof("IN IP4 ") - 1,
159 .match_len
= epaddr_len
161 [POS_SDP_HEADER
] = { /* SDP version header */
164 .lnlen
= sizeof("\nv=") - 1,
166 .snlen
= sizeof("\rv=") - 1,
168 .ln_strlen
= sizeof("=") - 1,
169 .match_len
= digits_len
173 /* get line lenght until first CR or LF seen. */
174 int ct_sip_lnlen(const char *line
, const char *limit
)
176 const char *k
= line
;
178 while ((line
<= limit
) && (*line
== '\r' || *line
== '\n'))
181 while (line
<= limit
) {
182 if (*line
== '\r' || *line
== '\n')
188 EXPORT_SYMBOL_GPL(ct_sip_lnlen
);
190 /* Linear string search, case sensitive. */
191 const char *ct_sip_search(const char *needle
, const char *haystack
,
192 size_t needle_len
, size_t haystack_len
,
195 const char *limit
= haystack
+ (haystack_len
- needle_len
);
197 while (haystack
<= limit
) {
198 if (case_sensitive
) {
199 if (strncmp(haystack
, needle
, needle_len
) == 0)
202 if (strnicmp(haystack
, needle
, needle_len
) == 0)
209 EXPORT_SYMBOL_GPL(ct_sip_search
);
211 static int digits_len(const char *dptr
, const char *limit
, int *shift
)
214 while (dptr
<= limit
&& isdigit(*dptr
)) {
221 /* get digits lenght, skiping blank spaces. */
222 static int skp_digits_len(const char *dptr
, const char *limit
, int *shift
)
224 for (; dptr
<= limit
&& *dptr
== ' '; dptr
++)
227 return digits_len(dptr
, limit
, shift
);
230 /* Simple ipaddr parser.. */
231 static int parse_ipaddr(const char *cp
, const char **endp
,
232 __be32
*ipaddr
, const char *limit
)
234 unsigned long int val
;
237 for (i
= 0, *ipaddr
= 0; cp
<= limit
&& i
< 4; i
++) {
242 val
= simple_strtoul(cp
, (char **)&cp
, 10);
246 ((u_int8_t
*)ipaddr
)[i
] = val
;
262 /* skip ip address. returns it lenght. */
263 static int epaddr_len(const char *dptr
, const char *limit
, int *shift
)
265 const char *aux
= dptr
;
268 if (parse_ipaddr(dptr
, &dptr
, &ip
, limit
) < 0) {
269 DEBUGP("ip: %s parse failed.!\n", dptr
);
276 dptr
+= digits_len(dptr
, limit
, shift
);
281 /* get address length, skiping user info. */
282 static int skp_epaddr_len(const char *dptr
, const char *limit
, int *shift
)
286 /* Search for @, but stop at the end of the line.
287 * We are inside a sip: URI, so we don't need to worry about
288 * continuation lines. */
289 while (dptr
<= limit
&&
290 *dptr
!= '@' && *dptr
!= '\r' && *dptr
!= '\n') {
295 if (dptr
<= limit
&& *dptr
== '@') {
301 return epaddr_len(dptr
, limit
, shift
);
304 /* Returns 0 if not found, -1 error parsing. */
305 int ct_sip_get_info(const char *dptr
, size_t dlen
,
306 unsigned int *matchoff
,
307 unsigned int *matchlen
,
308 enum sip_header_pos pos
)
310 struct sip_header_nfo
*hnfo
= &ct_sip_hdrs
[pos
];
311 const char *limit
, *aux
, *k
= dptr
;
314 limit
= dptr
+ (dlen
- hnfo
->lnlen
);
316 while (dptr
<= limit
) {
317 if ((strncmp(dptr
, hnfo
->lname
, hnfo
->lnlen
) != 0) &&
318 (hnfo
->sname
== NULL
||
319 strncmp(dptr
, hnfo
->sname
, hnfo
->snlen
) != 0)) {
323 aux
= ct_sip_search(hnfo
->ln_str
, dptr
, hnfo
->ln_strlen
,
324 ct_sip_lnlen(dptr
, limit
),
325 hnfo
->case_sensitive
);
327 DEBUGP("'%s' not found in '%s'.\n", hnfo
->ln_str
,
331 aux
+= hnfo
->ln_strlen
;
333 *matchlen
= hnfo
->match_len(aux
, limit
, &shift
);
337 *matchoff
= (aux
- k
) + shift
;
339 DEBUGP("%s match succeeded! - len: %u\n", hnfo
->lname
,
343 DEBUGP("%s header not found.\n", hnfo
->lname
);
346 EXPORT_SYMBOL_GPL(ct_sip_get_info
);
348 static int set_expected_rtp(struct sk_buff
**pskb
,
349 struct ip_conntrack
*ct
,
350 enum ip_conntrack_info ctinfo
,
351 __be32 ipaddr
, u_int16_t port
,
354 struct ip_conntrack_expect
*exp
;
355 enum ip_conntrack_dir dir
= CTINFO2DIR(ctinfo
);
357 typeof(ip_nat_sdp_hook
) ip_nat_sdp
;
359 exp
= ip_conntrack_expect_alloc(ct
);
363 exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
364 exp
->tuple
.src
.u
.udp
.port
= 0;
365 exp
->tuple
.dst
.ip
= ipaddr
;
366 exp
->tuple
.dst
.u
.udp
.port
= htons(port
);
367 exp
->tuple
.dst
.protonum
= IPPROTO_UDP
;
369 exp
->mask
.src
.ip
= htonl(0xFFFFFFFF);
370 exp
->mask
.src
.u
.udp
.port
= 0;
371 exp
->mask
.dst
.ip
= htonl(0xFFFFFFFF);
372 exp
->mask
.dst
.u
.udp
.port
= htons(0xFFFF);
373 exp
->mask
.dst
.protonum
= 0xFF;
375 exp
->expectfn
= NULL
;
378 ip_nat_sdp
= rcu_dereference(ip_nat_sdp_hook
);
380 ret
= ip_nat_sdp(pskb
, ctinfo
, exp
, dptr
);
382 if (ip_conntrack_expect_related(exp
) != 0)
387 ip_conntrack_expect_put(exp
);
392 static int sip_help(struct sk_buff
**pskb
,
393 struct ip_conntrack
*ct
,
394 enum ip_conntrack_info ctinfo
)
396 unsigned int dataoff
, datalen
;
399 int matchoff
, matchlen
;
402 typeof(ip_nat_sip_hook
) ip_nat_sip
;
405 dataoff
= (*pskb
)->nh
.iph
->ihl
*4 + sizeof(struct udphdr
);
406 if (dataoff
>= (*pskb
)->len
) {
407 DEBUGP("skb->len = %u\n", (*pskb
)->len
);
411 ip_ct_refresh(ct
, *pskb
, sip_timeout
* HZ
);
413 if (!skb_is_nonlinear(*pskb
))
414 dptr
= (*pskb
)->data
+ dataoff
;
416 DEBUGP("Copy of skbuff not supported yet.\n");
420 ip_nat_sip
= rcu_dereference(ip_nat_sip_hook
);
422 if (!ip_nat_sip(pskb
, ctinfo
, ct
, &dptr
)) {
428 /* After this point NAT, could have mangled skb, so
429 we need to recalculate payload lenght. */
430 datalen
= (*pskb
)->len
- dataoff
;
432 if (datalen
< (sizeof("SIP/2.0 200") - 1))
435 /* RTP info only in some SDP pkts */
436 if (memcmp(dptr
, "INVITE", sizeof("INVITE") - 1) != 0 &&
437 memcmp(dptr
, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
440 /* Get ip and port address from SDP packet. */
441 if (ct_sip_get_info(dptr
, datalen
, &matchoff
, &matchlen
,
442 POS_CONNECTION
) > 0) {
444 /* We'll drop only if there are parse problems. */
445 if (parse_ipaddr(dptr
+ matchoff
, NULL
, &ipaddr
,
446 dptr
+ datalen
) < 0) {
450 if (ct_sip_get_info(dptr
, datalen
, &matchoff
, &matchlen
,
453 port
= simple_strtoul(dptr
+ matchoff
, NULL
, 10);
458 ret
= set_expected_rtp(pskb
, ct
, ctinfo
,
466 static struct ip_conntrack_helper sip
[MAX_PORTS
];
467 static char sip_names
[MAX_PORTS
][10];
469 static void fini(void)
472 for (i
= 0; i
< ports_c
; i
++) {
473 DEBUGP("unregistering helper for port %d\n", ports
[i
]);
474 ip_conntrack_helper_unregister(&sip
[i
]);
478 static int __init
init(void)
484 ports
[ports_c
++] = SIP_PORT
;
486 for (i
= 0; i
< ports_c
; i
++) {
487 /* Create helper structure */
488 memset(&sip
[i
], 0, sizeof(struct ip_conntrack_helper
));
490 sip
[i
].tuple
.dst
.protonum
= IPPROTO_UDP
;
491 sip
[i
].tuple
.src
.u
.udp
.port
= htons(ports
[i
]);
492 sip
[i
].mask
.src
.u
.udp
.port
= htons(0xFFFF);
493 sip
[i
].mask
.dst
.protonum
= 0xFF;
494 sip
[i
].max_expected
= 2;
495 sip
[i
].timeout
= 3 * 60; /* 3 minutes */
496 sip
[i
].me
= THIS_MODULE
;
497 sip
[i
].help
= sip_help
;
499 tmpname
= &sip_names
[i
][0];
500 if (ports
[i
] == SIP_PORT
)
501 sprintf(tmpname
, "sip");
503 sprintf(tmpname
, "sip-%d", i
);
504 sip
[i
].name
= tmpname
;
506 DEBUGP("port #%d: %d\n", i
, ports
[i
]);
508 ret
= ip_conntrack_helper_register(&sip
[i
]);
510 printk("ERROR registering helper for port %d\n",