nf_conntrack_sip.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537
  1. /* SIP extension for IP connection tracking.
  2. *
  3. * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  4. * based on RR's ip_conntrack_ftp.c and other modules.
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License version 2 as
  8. * published by the Free Software Foundation.
  9. */
  10. #include <linux/module.h>
  11. #include <linux/ctype.h>
  12. #include <linux/skbuff.h>
  13. #include <linux/inet.h>
  14. #include <linux/in.h>
  15. #include <linux/udp.h>
  16. #include <linux/netfilter.h>
  17. #include <net/netfilter/nf_conntrack.h>
  18. #include <net/netfilter/nf_conntrack_expect.h>
  19. #include <net/netfilter/nf_conntrack_helper.h>
  20. #include <linux/netfilter/nf_conntrack_sip.h>
  21. #if 0
  22. #define DEBUGP printk
  23. #else
  24. #define DEBUGP(format, args...)
  25. #endif
  26. MODULE_LICENSE("GPL");
  27. MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  28. MODULE_DESCRIPTION("SIP connection tracking helper");
  29. MODULE_ALIAS("ip_conntrack_sip");
  30. #define MAX_PORTS 8
  31. static unsigned short ports[MAX_PORTS];
  32. static int ports_c;
  33. module_param_array(ports, ushort, &ports_c, 0400);
  34. MODULE_PARM_DESC(ports, "port numbers of SIP servers");
  35. static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
  36. module_param(sip_timeout, uint, 0600);
  37. MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
  38. unsigned int (*nf_nat_sip_hook)(struct sk_buff **pskb,
  39. enum ip_conntrack_info ctinfo,
  40. struct nf_conn *ct,
  41. const char **dptr) __read_mostly;
  42. EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
  43. unsigned int (*nf_nat_sdp_hook)(struct sk_buff **pskb,
  44. enum ip_conntrack_info ctinfo,
  45. struct nf_conntrack_expect *exp,
  46. const char *dptr) __read_mostly;
  47. EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
  48. static int digits_len(struct nf_conn *, const char *, const char *, int *);
  49. static int epaddr_len(struct nf_conn *, const char *, const char *, int *);
  50. static int skp_digits_len(struct nf_conn *, const char *, const char *, int *);
  51. static int skp_epaddr_len(struct nf_conn *, const char *, const char *, int *);
  52. struct sip_header_nfo {
  53. const char *lname;
  54. const char *sname;
  55. const char *ln_str;
  56. size_t lnlen;
  57. size_t snlen;
  58. size_t ln_strlen;
  59. int case_sensitive;
  60. int (*match_len)(struct nf_conn *, const char *,
  61. const char *, int *);
  62. };
  63. static const struct sip_header_nfo ct_sip_hdrs[] = {
  64. [POS_REG_REQ_URI] = { /* SIP REGISTER request URI */
  65. .lname = "sip:",
  66. .lnlen = sizeof("sip:") - 1,
  67. .ln_str = ":",
  68. .ln_strlen = sizeof(":") - 1,
  69. .match_len = epaddr_len,
  70. },
  71. [POS_REQ_URI] = { /* SIP request URI */
  72. .lname = "sip:",
  73. .lnlen = sizeof("sip:") - 1,
  74. .ln_str = "@",
  75. .ln_strlen = sizeof("@") - 1,
  76. .match_len = epaddr_len,
  77. },
  78. [POS_FROM] = { /* SIP From header */
  79. .lname = "From:",
  80. .lnlen = sizeof("From:") - 1,
  81. .sname = "\r\nf:",
  82. .snlen = sizeof("\r\nf:") - 1,
  83. .ln_str = "sip:",
  84. .ln_strlen = sizeof("sip:") - 1,
  85. .match_len = skp_epaddr_len,
  86. },
  87. [POS_TO] = { /* SIP To header */
  88. .lname = "To:",
  89. .lnlen = sizeof("To:") - 1,
  90. .sname = "\r\nt:",
  91. .snlen = sizeof("\r\nt:") - 1,
  92. .ln_str = "sip:",
  93. .ln_strlen = sizeof("sip:") - 1,
  94. .match_len = skp_epaddr_len
  95. },
  96. [POS_VIA] = { /* SIP Via header */
  97. .lname = "Via:",
  98. .lnlen = sizeof("Via:") - 1,
  99. .sname = "\r\nv:",
  100. .snlen = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
  101. .ln_str = "UDP ",
  102. .ln_strlen = sizeof("UDP ") - 1,
  103. .match_len = epaddr_len,
  104. },
  105. [POS_CONTACT] = { /* SIP Contact header */
  106. .lname = "Contact:",
  107. .lnlen = sizeof("Contact:") - 1,
  108. .sname = "\r\nm:",
  109. .snlen = sizeof("\r\nm:") - 1,
  110. .ln_str = "sip:",
  111. .ln_strlen = sizeof("sip:") - 1,
  112. .match_len = skp_epaddr_len
  113. },
  114. [POS_CONTENT] = { /* SIP Content length header */
  115. .lname = "Content-Length:",
  116. .lnlen = sizeof("Content-Length:") - 1,
  117. .sname = "\r\nl:",
  118. .snlen = sizeof("\r\nl:") - 1,
  119. .ln_str = ":",
  120. .ln_strlen = sizeof(":") - 1,
  121. .match_len = skp_digits_len
  122. },
  123. [POS_MEDIA] = { /* SDP media info */
  124. .case_sensitive = 1,
  125. .lname = "\nm=",
  126. .lnlen = sizeof("\nm=") - 1,
  127. .sname = "\rm=",
  128. .snlen = sizeof("\rm=") - 1,
  129. .ln_str = "audio ",
  130. .ln_strlen = sizeof("audio ") - 1,
  131. .match_len = digits_len
  132. },
  133. [POS_OWNER_IP4] = { /* SDP owner address*/
  134. .case_sensitive = 1,
  135. .lname = "\no=",
  136. .lnlen = sizeof("\no=") - 1,
  137. .sname = "\ro=",
  138. .snlen = sizeof("\ro=") - 1,
  139. .ln_str = "IN IP4 ",
  140. .ln_strlen = sizeof("IN IP4 ") - 1,
  141. .match_len = epaddr_len
  142. },
  143. [POS_CONNECTION_IP4] = {/* SDP connection info */
  144. .case_sensitive = 1,
  145. .lname = "\nc=",
  146. .lnlen = sizeof("\nc=") - 1,
  147. .sname = "\rc=",
  148. .snlen = sizeof("\rc=") - 1,
  149. .ln_str = "IN IP4 ",
  150. .ln_strlen = sizeof("IN IP4 ") - 1,
  151. .match_len = epaddr_len
  152. },
  153. [POS_OWNER_IP6] = { /* SDP owner address*/
  154. .case_sensitive = 1,
  155. .lname = "\no=",
  156. .lnlen = sizeof("\no=") - 1,
  157. .sname = "\ro=",
  158. .snlen = sizeof("\ro=") - 1,
  159. .ln_str = "IN IP6 ",
  160. .ln_strlen = sizeof("IN IP6 ") - 1,
  161. .match_len = epaddr_len
  162. },
  163. [POS_CONNECTION_IP6] = {/* SDP connection info */
  164. .case_sensitive = 1,
  165. .lname = "\nc=",
  166. .lnlen = sizeof("\nc=") - 1,
  167. .sname = "\rc=",
  168. .snlen = sizeof("\rc=") - 1,
  169. .ln_str = "IN IP6 ",
  170. .ln_strlen = sizeof("IN IP6 ") - 1,
  171. .match_len = epaddr_len
  172. },
  173. [POS_SDP_HEADER] = { /* SDP version header */
  174. .case_sensitive = 1,
  175. .lname = "\nv=",
  176. .lnlen = sizeof("\nv=") - 1,
  177. .sname = "\rv=",
  178. .snlen = sizeof("\rv=") - 1,
  179. .ln_str = "=",
  180. .ln_strlen = sizeof("=") - 1,
  181. .match_len = digits_len
  182. }
  183. };
  184. /* get line lenght until first CR or LF seen. */
  185. int ct_sip_lnlen(const char *line, const char *limit)
  186. {
  187. const char *k = line;
  188. while ((line <= limit) && (*line == '\r' || *line == '\n'))
  189. line++;
  190. while (line <= limit) {
  191. if (*line == '\r' || *line == '\n')
  192. break;
  193. line++;
  194. }
  195. return line - k;
  196. }
  197. EXPORT_SYMBOL_GPL(ct_sip_lnlen);
  198. /* Linear string search, case sensitive. */
  199. const char *ct_sip_search(const char *needle, const char *haystack,
  200. size_t needle_len, size_t haystack_len,
  201. int case_sensitive)
  202. {
  203. const char *limit = haystack + (haystack_len - needle_len);
  204. while (haystack <= limit) {
  205. if (case_sensitive) {
  206. if (strncmp(haystack, needle, needle_len) == 0)
  207. return haystack;
  208. } else {
  209. if (strnicmp(haystack, needle, needle_len) == 0)
  210. return haystack;
  211. }
  212. haystack++;
  213. }
  214. return NULL;
  215. }
  216. EXPORT_SYMBOL_GPL(ct_sip_search);
  217. static int digits_len(struct nf_conn *ct, const char *dptr,
  218. const char *limit, int *shift)
  219. {
  220. int len = 0;
  221. while (dptr <= limit && isdigit(*dptr)) {
  222. dptr++;
  223. len++;
  224. }
  225. return len;
  226. }
  227. /* get digits lenght, skiping blank spaces. */
  228. static int skp_digits_len(struct nf_conn *ct, const char *dptr,
  229. const char *limit, int *shift)
  230. {
  231. for (; dptr <= limit && *dptr == ' '; dptr++)
  232. (*shift)++;
  233. return digits_len(ct, dptr, limit, shift);
  234. }
  235. static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
  236. union nf_conntrack_address *addr, const char *limit)
  237. {
  238. const char *end;
  239. int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
  240. int ret = 0;
  241. switch (family) {
  242. case AF_INET:
  243. ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
  244. break;
  245. case AF_INET6:
  246. ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
  247. break;
  248. default:
  249. BUG();
  250. }
  251. if (ret == 0 || end == cp)
  252. return 0;
  253. if (endp)
  254. *endp = end;
  255. return 1;
  256. }
  257. /* skip ip address. returns its length. */
  258. static int epaddr_len(struct nf_conn *ct, const char *dptr,
  259. const char *limit, int *shift)
  260. {
  261. union nf_conntrack_address addr;
  262. const char *aux = dptr;
  263. if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
  264. DEBUGP("ip: %s parse failed.!\n", dptr);
  265. return 0;
  266. }
  267. /* Port number */
  268. if (*dptr == ':') {
  269. dptr++;
  270. dptr += digits_len(ct, dptr, limit, shift);
  271. }
  272. return dptr - aux;
  273. }
  274. /* get address length, skiping user info. */
  275. static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
  276. const char *limit, int *shift)
  277. {
  278. int s = *shift;
  279. /* Search for @, but stop at the end of the line.
  280. * We are inside a sip: URI, so we don't need to worry about
  281. * continuation lines. */
  282. while (dptr <= limit &&
  283. *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
  284. (*shift)++;
  285. dptr++;
  286. }
  287. if (dptr <= limit && *dptr == '@') {
  288. dptr++;
  289. (*shift)++;
  290. } else
  291. *shift = s;
  292. return epaddr_len(ct, dptr, limit, shift);
  293. }
  294. /* Returns 0 if not found, -1 error parsing. */
  295. int ct_sip_get_info(struct nf_conn *ct,
  296. const char *dptr, size_t dlen,
  297. unsigned int *matchoff,
  298. unsigned int *matchlen,
  299. enum sip_header_pos pos)
  300. {
  301. const struct sip_header_nfo *hnfo = &ct_sip_hdrs[pos];
  302. const char *limit, *aux, *k = dptr;
  303. int shift = 0;
  304. limit = dptr + (dlen - hnfo->lnlen);
  305. while (dptr <= limit) {
  306. if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
  307. (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
  308. dptr++;
  309. continue;
  310. }
  311. aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
  312. ct_sip_lnlen(dptr, limit),
  313. hnfo->case_sensitive);
  314. if (!aux) {
  315. DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str,
  316. hnfo->lname);
  317. return -1;
  318. }
  319. aux += hnfo->ln_strlen;
  320. *matchlen = hnfo->match_len(ct, aux, limit, &shift);
  321. if (!*matchlen)
  322. return -1;
  323. *matchoff = (aux - k) + shift;
  324. DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname,
  325. *matchlen);
  326. return 1;
  327. }
  328. DEBUGP("%s header not found.\n", hnfo->lname);
  329. return 0;
  330. }
  331. EXPORT_SYMBOL_GPL(ct_sip_get_info);
  332. static int set_expected_rtp(struct sk_buff **pskb,
  333. struct nf_conn *ct,
  334. enum ip_conntrack_info ctinfo,
  335. union nf_conntrack_address *addr,
  336. __be16 port,
  337. const char *dptr)
  338. {
  339. struct nf_conntrack_expect *exp;
  340. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  341. int family = ct->tuplehash[!dir].tuple.src.l3num;
  342. int ret;
  343. typeof(nf_nat_sdp_hook) nf_nat_sdp;
  344. exp = nf_conntrack_expect_alloc(ct);
  345. if (exp == NULL)
  346. return NF_DROP;
  347. nf_conntrack_expect_init(exp, family,
  348. &ct->tuplehash[!dir].tuple.src.u3, addr,
  349. IPPROTO_UDP, NULL, &port);
  350. nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
  351. if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
  352. ret = nf_nat_sdp(pskb, ctinfo, exp, dptr);
  353. else {
  354. if (nf_conntrack_expect_related(exp) != 0)
  355. ret = NF_DROP;
  356. else
  357. ret = NF_ACCEPT;
  358. }
  359. nf_conntrack_expect_put(exp);
  360. return ret;
  361. }
  362. static int sip_help(struct sk_buff **pskb,
  363. unsigned int protoff,
  364. struct nf_conn *ct,
  365. enum ip_conntrack_info ctinfo)
  366. {
  367. int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
  368. union nf_conntrack_address addr;
  369. unsigned int dataoff, datalen;
  370. const char *dptr;
  371. int ret = NF_ACCEPT;
  372. int matchoff, matchlen;
  373. u_int16_t port;
  374. enum sip_header_pos pos;
  375. typeof(nf_nat_sip_hook) nf_nat_sip;
  376. /* No Data ? */
  377. dataoff = protoff + sizeof(struct udphdr);
  378. if (dataoff >= (*pskb)->len)
  379. return NF_ACCEPT;
  380. nf_ct_refresh(ct, *pskb, sip_timeout * HZ);
  381. if (!skb_is_nonlinear(*pskb))
  382. dptr = (*pskb)->data + dataoff;
  383. else {
  384. DEBUGP("Copy of skbuff not supported yet.\n");
  385. goto out;
  386. }
  387. nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
  388. if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
  389. if (!nf_nat_sip(pskb, ctinfo, ct, &dptr)) {
  390. ret = NF_DROP;
  391. goto out;
  392. }
  393. }
  394. datalen = (*pskb)->len - dataoff;
  395. if (datalen < sizeof("SIP/2.0 200") - 1)
  396. goto out;
  397. /* RTP info only in some SDP pkts */
  398. if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
  399. memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
  400. goto out;
  401. }
  402. /* Get address and port from SDP packet. */
  403. pos = family == AF_INET ? POS_CONNECTION_IP4 : POS_CONNECTION_IP6;
  404. if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen, pos) > 0) {
  405. /* We'll drop only if there are parse problems. */
  406. if (!parse_addr(ct, dptr + matchoff, NULL, &addr,
  407. dptr + datalen)) {
  408. ret = NF_DROP;
  409. goto out;
  410. }
  411. if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen,
  412. POS_MEDIA) > 0) {
  413. port = simple_strtoul(dptr + matchoff, NULL, 10);
  414. if (port < 1024) {
  415. ret = NF_DROP;
  416. goto out;
  417. }
  418. ret = set_expected_rtp(pskb, ct, ctinfo, &addr,
  419. htons(port), dptr);
  420. }
  421. }
  422. out:
  423. return ret;
  424. }
  425. static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
  426. static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
  427. static void nf_conntrack_sip_fini(void)
  428. {
  429. int i, j;
  430. for (i = 0; i < ports_c; i++) {
  431. for (j = 0; j < 2; j++) {
  432. if (sip[i][j].me == NULL)
  433. continue;
  434. nf_conntrack_helper_unregister(&sip[i][j]);
  435. }
  436. }
  437. }
  438. static int __init nf_conntrack_sip_init(void)
  439. {
  440. int i, j, ret;
  441. char *tmpname;
  442. if (ports_c == 0)
  443. ports[ports_c++] = SIP_PORT;
  444. for (i = 0; i < ports_c; i++) {
  445. memset(&sip[i], 0, sizeof(sip[i]));
  446. sip[i][0].tuple.src.l3num = AF_INET;
  447. sip[i][1].tuple.src.l3num = AF_INET6;
  448. for (j = 0; j < 2; j++) {
  449. sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
  450. sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
  451. sip[i][j].mask.src.l3num = 0xFFFF;
  452. sip[i][j].mask.src.u.udp.port = htons(0xFFFF);
  453. sip[i][j].mask.dst.protonum = 0xFF;
  454. sip[i][j].max_expected = 2;
  455. sip[i][j].timeout = 3 * 60; /* 3 minutes */
  456. sip[i][j].me = THIS_MODULE;
  457. sip[i][j].help = sip_help;
  458. tmpname = &sip_names[i][j][0];
  459. if (ports[i] == SIP_PORT)
  460. sprintf(tmpname, "sip");
  461. else
  462. sprintf(tmpname, "sip-%u", i);
  463. sip[i][j].name = tmpname;
  464. DEBUGP("port #%u: %u\n", i, ports[i]);
  465. ret = nf_conntrack_helper_register(&sip[i][j]);
  466. if (ret) {
  467. printk("nf_ct_sip: failed to register helper "
  468. "for pf: %u port: %u\n",
  469. sip[i][j].tuple.src.l3num, ports[i]);
  470. nf_conntrack_sip_fini();
  471. return ret;
  472. }
  473. }
  474. }
  475. return 0;
  476. }
  477. module_init(nf_conntrack_sip_init);
  478. module_exit(nf_conntrack_sip_fini);