net/netfilter/nf_conntrack_sip.c

   1 /* SIP extension for IP connection tracking.
   2  *
   3  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
   4  * based on RR's ip_conntrack_ftp.c and other modules.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/ctype.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/inet.h>
  15 #include <linux/in.h>
  16 #include <linux/udp.h>
  17 #include <linux/netfilter.h>
  18
  19 #include <net/netfilter/nf_conntrack.h>
  20 #include <net/netfilter/nf_conntrack_expect.h>
  21 #include <net/netfilter/nf_conntrack_helper.h>
  22 #include <linux/netfilter/nf_conntrack_sip.h>
  23
  24 MODULE_LICENSE("GPL");
  25 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  26 MODULE_DESCRIPTION("SIP connection tracking helper");
  27 MODULE_ALIAS("ip_conntrack_sip");
  28
  29 #define MAX_PORTS       8
  30 static unsigned short ports[MAX_PORTS];
  31 static int ports_c;
  32 module_param_array(ports, ushort, &ports_c, 0400);
  33 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
  34
  35 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
  36 module_param(sip_timeout, uint, 0600);
  37 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
  38
  39 unsigned int (*nf_nat_sip_hook)(struct sk_buff **pskb,
  40                                 enum ip_conntrack_info ctinfo,
  41                                 struct nf_conn *ct,
  42                                 const char **dptr) __read_mostly;
  43 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
  44
  45 unsigned int (*nf_nat_sdp_hook)(struct sk_buff **pskb,
  46                                 enum ip_conntrack_info ctinfo,
  47                                 struct nf_conntrack_expect *exp,
  48                                 const char *dptr) __read_mostly;
  49 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
  50
  51 static int digits_len(struct nf_conn *, const char *, const char *, int *);
  52 static int epaddr_len(struct nf_conn *, const char *, const char *, int *);
  53 static int skp_digits_len(struct nf_conn *, const char *, const char *, int *);
  54 static int skp_epaddr_len(struct nf_conn *, const char *, const char *, int *);
  55
  56 struct sip_header_nfo {
  57         const char      *lname;
  58         const char      *sname;
  59         const char      *ln_str;
  60         size_t          lnlen;
  61         size_t          snlen;
  62         size_t          ln_strlen;
  63         int             case_sensitive;
  64         int             (*match_len)(struct nf_conn *, const char *,
  65                                      const char *, int *);
  66 };
  67
  68 static const struct sip_header_nfo ct_sip_hdrs[] = {
  69         [POS_REG_REQ_URI] = {   /* SIP REGISTER request URI */
  70                 .lname          = "sip:",
  71                 .lnlen          = sizeof("sip:") - 1,
  72                 .ln_str         = ":",
  73                 .ln_strlen      = sizeof(":") - 1,
  74                 .match_len      = epaddr_len,
  75         },
  76         [POS_REQ_URI] = {       /* SIP request URI */
  77                 .lname          = "sip:",
  78                 .lnlen          = sizeof("sip:") - 1,
  79                 .ln_str         = "@",
  80                 .ln_strlen      = sizeof("@") - 1,
  81                 .match_len      = epaddr_len,
  82         },
  83         [POS_FROM] = {          /* SIP From header */
  84                 .lname          = "From:",
  85                 .lnlen          = sizeof("From:") - 1,
  86                 .sname          = "\r\nf:",
  87                 .snlen          = sizeof("\r\nf:") - 1,
  88                 .ln_str         = "sip:",
  89                 .ln_strlen      = sizeof("sip:") - 1,
  90                 .match_len      = skp_epaddr_len,
  91         },
  92         [POS_TO] = {            /* SIP To header */
  93                 .lname          = "To:",
  94                 .lnlen          = sizeof("To:") - 1,
  95                 .sname          = "\r\nt:",
  96                 .snlen          = sizeof("\r\nt:") - 1,
  97                 .ln_str         = "sip:",
  98                 .ln_strlen      = sizeof("sip:") - 1,
  99                 .match_len      = skp_epaddr_len
 100         },
 101         [POS_VIA] = {           /* SIP Via header */
 102                 .lname          = "Via:",
 103                 .lnlen          = sizeof("Via:") - 1,
 104                 .sname          = "\r\nv:",
 105                 .snlen          = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
 106                 .ln_str         = "UDP ",
 107                 .ln_strlen      = sizeof("UDP ") - 1,
 108                 .match_len      = epaddr_len,
 109         },
 110         [POS_CONTACT] = {       /* SIP Contact header */
 111                 .lname          = "Contact:",
 112                 .lnlen          = sizeof("Contact:") - 1,
 113                 .sname          = "\r\nm:",
 114                 .snlen          = sizeof("\r\nm:") - 1,
 115                 .ln_str         = "sip:",
 116                 .ln_strlen      = sizeof("sip:") - 1,
 117                 .match_len      = skp_epaddr_len
 118         },
 119         [POS_CONTENT] = {       /* SIP Content length header */
 120                 .lname          = "Content-Length:",
 121                 .lnlen          = sizeof("Content-Length:") - 1,
 122                 .sname          = "\r\nl:",
 123                 .snlen          = sizeof("\r\nl:") - 1,
 124                 .ln_str         = ":",
 125                 .ln_strlen      = sizeof(":") - 1,
 126                 .match_len      = skp_digits_len
 127         },
 128         [POS_MEDIA] = {         /* SDP media info */
 129                 .case_sensitive = 1,
 130                 .lname          = "\nm=",
 131                 .lnlen          = sizeof("\nm=") - 1,
 132                 .sname          = "\rm=",
 133                 .snlen          = sizeof("\rm=") - 1,
 134                 .ln_str         = "audio ",
 135                 .ln_strlen      = sizeof("audio ") - 1,
 136                 .match_len      = digits_len
 137         },
 138         [POS_OWNER_IP4] = {     /* SDP owner address*/
 139                 .case_sensitive = 1,
 140                 .lname          = "\no=",
 141                 .lnlen          = sizeof("\no=") - 1,
 142                 .sname          = "\ro=",
 143                 .snlen          = sizeof("\ro=") - 1,
 144                 .ln_str         = "IN IP4 ",
 145                 .ln_strlen      = sizeof("IN IP4 ") - 1,
 146                 .match_len      = epaddr_len
 147         },
 148         [POS_CONNECTION_IP4] = {/* SDP connection info */
 149                 .case_sensitive = 1,
 150                 .lname          = "\nc=",
 151                 .lnlen          = sizeof("\nc=") - 1,
 152                 .sname          = "\rc=",
 153                 .snlen          = sizeof("\rc=") - 1,
 154                 .ln_str         = "IN IP4 ",
 155                 .ln_strlen      = sizeof("IN IP4 ") - 1,
 156                 .match_len      = epaddr_len
 157         },
 158         [POS_OWNER_IP6] = {     /* SDP owner address*/
 159                 .case_sensitive = 1,
 160                 .lname          = "\no=",
 161                 .lnlen          = sizeof("\no=") - 1,
 162                 .sname          = "\ro=",
 163                 .snlen          = sizeof("\ro=") - 1,
 164                 .ln_str         = "IN IP6 ",
 165                 .ln_strlen      = sizeof("IN IP6 ") - 1,
 166                 .match_len      = epaddr_len
 167         },
 168         [POS_CONNECTION_IP6] = {/* SDP connection info */
 169                 .case_sensitive = 1,
 170                 .lname          = "\nc=",
 171                 .lnlen          = sizeof("\nc=") - 1,
 172                 .sname          = "\rc=",
 173                 .snlen          = sizeof("\rc=") - 1,
 174                 .ln_str         = "IN IP6 ",
 175                 .ln_strlen      = sizeof("IN IP6 ") - 1,
 176                 .match_len      = epaddr_len
 177         },
 178         [POS_SDP_HEADER] = {    /* SDP version header */
 179                 .case_sensitive = 1,
 180                 .lname          = "\nv=",
 181                 .lnlen          = sizeof("\nv=") - 1,
 182                 .sname          = "\rv=",
 183                 .snlen          = sizeof("\rv=") - 1,
 184                 .ln_str         = "=",
 185                 .ln_strlen      = sizeof("=") - 1,
 186                 .match_len      = digits_len
 187         }
 188 };
 189
 190 /* get line lenght until first CR or LF seen. */
 191 int ct_sip_lnlen(const char *line, const char *limit)
 192 {
 193         const char *k = line;
 194
 195         while ((line <= limit) && (*line == '\r' || *line == '\n'))
 196                 line++;
 197
 198         while (line <= limit) {
 199                 if (*line == '\r' || *line == '\n')
 200                         break;
 201                 line++;
 202         }
 203         return line - k;
 204 }
 205 EXPORT_SYMBOL_GPL(ct_sip_lnlen);
 206
 207 /* Linear string search, case sensitive. */
 208 const char *ct_sip_search(const char *needle, const char *haystack,
 209                           size_t needle_len, size_t haystack_len,
 210                           int case_sensitive)
 211 {
 212         const char *limit = haystack + (haystack_len - needle_len);
 213
 214         while (haystack <= limit) {
 215                 if (case_sensitive) {
 216                         if (strncmp(haystack, needle, needle_len) == 0)
 217                                 return haystack;
 218                 } else {
 219                         if (strnicmp(haystack, needle, needle_len) == 0)
 220                                 return haystack;
 221                 }
 222                 haystack++;
 223         }
 224         return NULL;
 225 }
 226 EXPORT_SYMBOL_GPL(ct_sip_search);
 227
 228 static int digits_len(struct nf_conn *ct, const char *dptr,
 229                       const char *limit, int *shift)
 230 {
 231         int len = 0;
 232         while (dptr <= limit && isdigit(*dptr)) {
 233                 dptr++;
 234                 len++;
 235         }
 236         return len;
 237 }
 238
 239 /* get digits lenght, skiping blank spaces. */
 240 static int skp_digits_len(struct nf_conn *ct, const char *dptr,
 241                           const char *limit, int *shift)
 242 {
 243         for (; dptr <= limit && *dptr == ' '; dptr++)
 244                 (*shift)++;
 245
 246         return digits_len(ct, dptr, limit, shift);
 247 }
 248
 249 static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
 250                       union nf_conntrack_address *addr, const char *limit)
 251 {
 252         const char *end;
 253         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 254         int ret = 0;
 255
 256         switch (family) {
 257         case AF_INET:
 258                 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
 259                 break;
 260         case AF_INET6:
 261                 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
 262                 break;
 263         default:
 264                 BUG();
 265         }
 266
 267         if (ret == 0 || end == cp)
 268                 return 0;
 269         if (endp)
 270                 *endp = end;
 271         return 1;
 272 }
 273
 274 /* skip ip address. returns its length. */
 275 static int epaddr_len(struct nf_conn *ct, const char *dptr,
 276                       const char *limit, int *shift)
 277 {
 278         union nf_conntrack_address addr;
 279         const char *aux = dptr;
 280
 281         if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
 282                 pr_debug("ip: %s parse failed.!\n", dptr);
 283                 return 0;
 284         }
 285
 286         /* Port number */
 287         if (*dptr == ':') {
 288                 dptr++;
 289                 dptr += digits_len(ct, dptr, limit, shift);
 290         }
 291         return dptr - aux;
 292 }
 293
 294 /* get address length, skiping user info. */
 295 static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
 296                           const char *limit, int *shift)
 297 {
 298         int s = *shift;
 299
 300         /* Search for @, but stop at the end of the line.
 301          * We are inside a sip: URI, so we don't need to worry about
 302          * continuation lines. */
 303         while (dptr <= limit &&
 304                *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
 305                 (*shift)++;
 306                 dptr++;
 307         }
 308
 309         if (dptr <= limit && *dptr == '@') {
 310                 dptr++;
 311                 (*shift)++;
 312         } else
 313                 *shift = s;
 314
 315         return epaddr_len(ct, dptr, limit, shift);
 316 }
 317
 318 /* Returns 0 if not found, -1 error parsing. */
 319 int ct_sip_get_info(struct nf_conn *ct,
 320                     const char *dptr, size_t dlen,
 321                     unsigned int *matchoff,
 322                     unsigned int *matchlen,
 323                     enum sip_header_pos pos)
 324 {
 325         const struct sip_header_nfo *hnfo = &ct_sip_hdrs[pos];
 326         const char *limit, *aux, *k = dptr;
 327         int shift = 0;
 328
 329         limit = dptr + (dlen - hnfo->lnlen);
 330
 331         while (dptr <= limit) {
 332                 if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
 333                     (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
 334                         dptr++;
 335                         continue;
 336                 }
 337                 aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
 338                                     ct_sip_lnlen(dptr, limit),
 339                                     hnfo->case_sensitive);
 340                 if (!aux) {
 341                         pr_debug("'%s' not found in '%s'.\n", hnfo->ln_str,
 342                                  hnfo->lname);
 343                         return -1;
 344                 }
 345                 aux += hnfo->ln_strlen;
 346
 347                 *matchlen = hnfo->match_len(ct, aux, limit, &shift);
 348                 if (!*matchlen)
 349                         return -1;
 350
 351                 *matchoff = (aux - k) + shift;
 352
 353                 pr_debug("%s match succeeded! - len: %u\n", hnfo->lname,
 354                          *matchlen);
 355                 return 1;
 356         }
 357         pr_debug("%s header not found.\n", hnfo->lname);
 358         return 0;
 359 }
 360 EXPORT_SYMBOL_GPL(ct_sip_get_info);
 361
 362 static int set_expected_rtp(struct sk_buff **pskb,
 363                             struct nf_conn *ct,
 364                             enum ip_conntrack_info ctinfo,
 365                             union nf_conntrack_address *addr,
 366                             __be16 port,
 367                             const char *dptr)
 368 {
 369         struct nf_conntrack_expect *exp;
 370         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 371         int family = ct->tuplehash[!dir].tuple.src.l3num;
 372         int ret;
 373         typeof(nf_nat_sdp_hook) nf_nat_sdp;
 374
 375         exp = nf_ct_expect_alloc(ct);
 376         if (exp == NULL)
 377                 return NF_DROP;
 378         nf_ct_expect_init(exp, family,
 379                           &ct->tuplehash[!dir].tuple.src.u3, addr,
 380                           IPPROTO_UDP, NULL, &port);
 381
 382         nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
 383         if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
 384                 ret = nf_nat_sdp(pskb, ctinfo, exp, dptr);
 385         else {
 386                 if (nf_ct_expect_related(exp) != 0)
 387                         ret = NF_DROP;
 388                 else
 389                         ret = NF_ACCEPT;
 390         }
 391         nf_ct_expect_put(exp);
 392
 393         return ret;
 394 }
 395
 396 static int sip_help(struct sk_buff **pskb,
 397                     unsigned int protoff,
 398                     struct nf_conn *ct,
 399                     enum ip_conntrack_info ctinfo)
 400 {
 401         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 402         union nf_conntrack_address addr;
 403         unsigned int dataoff, datalen;
 404         const char *dptr;
 405         int ret = NF_ACCEPT;
 406         int matchoff, matchlen;
 407         u_int16_t port;
 408         enum sip_header_pos pos;
 409         typeof(nf_nat_sip_hook) nf_nat_sip;
 410
 411         /* No Data ? */
 412         dataoff = protoff + sizeof(struct udphdr);
 413         if (dataoff >= (*pskb)->len)
 414                 return NF_ACCEPT;
 415
 416         nf_ct_refresh(ct, *pskb, sip_timeout * HZ);
 417
 418         if (!skb_is_nonlinear(*pskb))
 419                 dptr = (*pskb)->data + dataoff;
 420         else {
 421                 pr_debug("Copy of skbuff not supported yet.\n");
 422                 goto out;
 423         }
 424
 425         nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
 426         if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
 427                 if (!nf_nat_sip(pskb, ctinfo, ct, &dptr)) {
 428                         ret = NF_DROP;
 429                         goto out;
 430                 }
 431         }
 432
 433         datalen = (*pskb)->len - dataoff;
 434         if (datalen < sizeof("SIP/2.0 200") - 1)
 435                 goto out;
 436
 437         /* RTP info only in some SDP pkts */
 438         if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
 439             memcmp(dptr, "UPDATE", sizeof("UPDATE") - 1) != 0 &&
 440             memcmp(dptr, "SIP/2.0 180", sizeof("SIP/2.0 180") - 1) != 0 &&
 441             memcmp(dptr, "SIP/2.0 183", sizeof("SIP/2.0 183") - 1) != 0 &&
 442             memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
 443                 goto out;
 444         }
 445         /* Get address and port from SDP packet. */
 446         pos = family == AF_INET ? POS_CONNECTION_IP4 : POS_CONNECTION_IP6;
 447         if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen, pos) > 0) {
 448
 449                 /* We'll drop only if there are parse problems. */
 450                 if (!parse_addr(ct, dptr + matchoff, NULL, &addr,
 451                                 dptr + datalen)) {
 452                         ret = NF_DROP;
 453                         goto out;
 454                 }
 455                 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen,
 456                                     POS_MEDIA) > 0) {
 457
 458                         port = simple_strtoul(dptr + matchoff, NULL, 10);
 459                         if (port < 1024) {
 460                                 ret = NF_DROP;
 461                                 goto out;
 462                         }
 463                         ret = set_expected_rtp(pskb, ct, ctinfo, &addr,
 464                                                htons(port), dptr);
 465                 }
 466         }
 467 out:
 468         return ret;
 469 }
 470
 471 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
 472 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
 473
 474 static void nf_conntrack_sip_fini(void)
 475 {
 476         int i, j;
 477
 478         for (i = 0; i < ports_c; i++) {
 479                 for (j = 0; j < 2; j++) {
 480                         if (sip[i][j].me == NULL)
 481                                 continue;
 482                         nf_conntrack_helper_unregister(&sip[i][j]);
 483                 }
 484         }
 485 }
 486
 487 static int __init nf_conntrack_sip_init(void)
 488 {
 489         int i, j, ret;
 490         char *tmpname;
 491
 492         if (ports_c == 0)
 493                 ports[ports_c++] = SIP_PORT;
 494
 495         for (i = 0; i < ports_c; i++) {
 496                 memset(&sip[i], 0, sizeof(sip[i]));
 497
 498                 sip[i][0].tuple.src.l3num = AF_INET;
 499                 sip[i][1].tuple.src.l3num = AF_INET6;
 500                 for (j = 0; j < 2; j++) {
 501                         sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
 502                         sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
 503                         sip[i][j].max_expected = 2;
 504                         sip[i][j].timeout = 3 * 60; /* 3 minutes */
 505                         sip[i][j].me = THIS_MODULE;
 506                         sip[i][j].help = sip_help;
 507
 508                         tmpname = &sip_names[i][j][0];
 509                         if (ports[i] == SIP_PORT)
 510                                 sprintf(tmpname, "sip");
 511                         else
 512                                 sprintf(tmpname, "sip-%u", i);
 513                         sip[i][j].name = tmpname;
 514
 515                         pr_debug("port #%u: %u\n", i, ports[i]);
 516
 517                         ret = nf_conntrack_helper_register(&sip[i][j]);
 518                         if (ret) {
 519                                 printk("nf_ct_sip: failed to register helper "
 520                                        "for pf: %u port: %u\n",
 521                                        sip[i][j].tuple.src.l3num, ports[i]);
 522                                 nf_conntrack_sip_fini();
 523                                 return ret;
 524                         }
 525                 }
 526         }
 527         return 0;
 528 }
 529
 530 module_init(nf_conntrack_sip_init);
 531 module_exit(nf_conntrack_sip_fini);