1 /* SIP extension for IP connection tracking.
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_conntrack_ftp.c and other modules.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/ctype.h>
13 #include <linux/skbuff.h>
14 #include <linux/inet.h>
16 #include <linux/udp.h>
17 #include <linux/netfilter.h>
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_core.h>
21 #include <net/netfilter/nf_conntrack_expect.h>
22 #include <net/netfilter/nf_conntrack_helper.h>
23 #include <linux/netfilter/nf_conntrack_sip.h>
25 MODULE_LICENSE("GPL");
26 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
27 MODULE_DESCRIPTION("SIP connection tracking helper");
28 MODULE_ALIAS("ip_conntrack_sip");
31 static unsigned short ports[MAX_PORTS];
32 static unsigned int ports_c;
33 module_param_array(ports, ushort, &ports_c, 0400);
34 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
36 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
37 module_param(sip_timeout, uint, 0600);
38 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
40 static int sip_direct_signalling __read_mostly = 1;
41 module_param(sip_direct_signalling, int, 0600);
42 MODULE_PARM_DESC(sip_direct_signalling, "expect incoming calls from registrar "
45 unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
47 unsigned int *datalen) __read_mostly;
48 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
50 unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
52 unsigned int *datalen,
53 struct nf_conntrack_expect *exp,
54 unsigned int matchoff,
55 unsigned int matchlen) __read_mostly;
56 EXPORT_SYMBOL_GPL(nf_nat_sip_expect_hook);
58 unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
60 unsigned int *datalen,
61 struct nf_conntrack_expect *exp) __read_mostly;
62 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
64 static int string_len(const struct nf_conn *ct, const char *dptr,
65 const char *limit, int *shift)
69 while (dptr < limit && isalpha(*dptr)) {
76 static int digits_len(const struct nf_conn *ct, const char *dptr,
77 const char *limit, int *shift)
80 while (dptr < limit && isdigit(*dptr)) {
87 static int parse_addr(const struct nf_conn *ct, const char *cp,
88 const char **endp, union nf_inet_addr *addr,
92 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
97 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
100 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
106 if (ret == 0 || end == cp)
113 /* skip ip address. returns its length. */
114 static int epaddr_len(const struct nf_conn *ct, const char *dptr,
115 const char *limit, int *shift)
117 union nf_inet_addr addr;
118 const char *aux = dptr;
120 if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
121 pr_debug("ip: %s parse failed.!\n", dptr);
128 dptr += digits_len(ct, dptr, limit, shift);
133 /* get address length, skiping user info. */
134 static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
135 const char *limit, int *shift)
137 const char *start = dptr;
140 /* Search for @, but stop at the end of the line.
141 * We are inside a sip: URI, so we don't need to worry about
142 * continuation lines. */
143 while (dptr < limit &&
144 *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
149 if (dptr < limit && *dptr == '@') {
157 return epaddr_len(ct, dptr, limit, shift);
160 /* Parse a SIP request line of the form:
162 * Request-Line = Method SP Request-URI SP SIP-Version CRLF
164 * and return the offset and length of the address contained in the Request-URI.
166 int ct_sip_parse_request(const struct nf_conn *ct,
167 const char *dptr, unsigned int datalen,
168 unsigned int *matchoff, unsigned int *matchlen,
169 union nf_inet_addr *addr, __be16 *port)
171 const char *start = dptr, *limit = dptr + datalen, *end;
176 /* Skip method and following whitespace */
177 mlen = string_len(ct, dptr, limit, NULL);
185 limit -= strlen("sip:");
186 for (; dptr < limit; dptr++) {
187 if (*dptr == '\r' || *dptr == '\n')
189 if (strnicmp(dptr, "sip:", strlen("sip:")) == 0)
192 if (!skp_epaddr_len(ct, dptr, limit, &shift))
196 if (!parse_addr(ct, dptr, &end, addr, limit))
198 if (end < limit && *end == ':') {
200 p = simple_strtoul(end, (char **)&end, 10);
201 if (p < 1024 || p > 65535)
205 *port = htons(SIP_PORT);
209 *matchoff = dptr - start;
210 *matchlen = end - dptr;
213 EXPORT_SYMBOL_GPL(ct_sip_parse_request);
215 /* SIP header parsing: SIP headers are located at the beginning of a line, but
216 * may span several lines, in which case the continuation lines begin with a
217 * whitespace character. RFC 2543 allows lines to be terminated with CR, LF or
218 * CRLF, RFC 3261 allows only CRLF, we support both.
220 * Headers are followed by (optionally) whitespace, a colon, again (optionally)
221 * whitespace and the values. Whitespace in this context means any amount of
222 * tabs, spaces and continuation lines, which are treated as a single whitespace
225 * Some headers may appear multiple times. A comma seperated list of values is
226 * equivalent to multiple headers.
228 static const struct sip_header ct_sip_hdrs[] = {
229 [SIP_HDR_CSEQ] = SIP_HDR("CSeq", NULL, NULL, digits_len),
230 [SIP_HDR_FROM] = SIP_HDR("From", "f", "sip:", skp_epaddr_len),
231 [SIP_HDR_TO] = SIP_HDR("To", "t", "sip:", skp_epaddr_len),
232 [SIP_HDR_CONTACT] = SIP_HDR("Contact", "m", "sip:", skp_epaddr_len),
233 [SIP_HDR_VIA] = SIP_HDR("Via", "v", "UDP ", epaddr_len),
234 [SIP_HDR_EXPIRES] = SIP_HDR("Expires", NULL, NULL, digits_len),
235 [SIP_HDR_CONTENT_LENGTH] = SIP_HDR("Content-Length", "l", NULL, digits_len),
238 static const char *sip_follow_continuation(const char *dptr, const char *limit)
240 /* Walk past newline */
244 /* Skip '\n' in CR LF */
245 if (*(dptr - 1) == '\r' && *dptr == '\n') {
250 /* Continuation line? */
251 if (*dptr != ' ' && *dptr != '\t')
254 /* skip leading whitespace */
255 for (; dptr < limit; dptr++) {
256 if (*dptr != ' ' && *dptr != '\t')
262 static const char *sip_skip_whitespace(const char *dptr, const char *limit)
264 for (; dptr < limit; dptr++) {
267 if (*dptr != '\r' && *dptr != '\n')
269 dptr = sip_follow_continuation(dptr, limit);
276 /* Search within a SIP header value, dealing with continuation lines */
277 static const char *ct_sip_header_search(const char *dptr, const char *limit,
278 const char *needle, unsigned int len)
280 for (limit -= len; dptr < limit; dptr++) {
281 if (*dptr == '\r' || *dptr == '\n') {
282 dptr = sip_follow_continuation(dptr, limit);
288 if (strnicmp(dptr, needle, len) == 0)
294 int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
295 unsigned int dataoff, unsigned int datalen,
296 enum sip_header_types type,
297 unsigned int *matchoff, unsigned int *matchlen)
299 const struct sip_header *hdr = &ct_sip_hdrs[type];
300 const char *start = dptr, *limit = dptr + datalen;
303 for (dptr += dataoff; dptr < limit; dptr++) {
304 /* Find beginning of line */
305 if (*dptr != '\r' && *dptr != '\n')
309 if (*(dptr - 1) == '\r' && *dptr == '\n') {
314 /* Skip continuation lines */
315 if (*dptr == ' ' || *dptr == '\t')
318 /* Find header. Compact headers must be followed by a
319 * non-alphabetic character to avoid mismatches. */
320 if (limit - dptr >= hdr->len &&
321 strnicmp(dptr, hdr->name, hdr->len) == 0)
323 else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
324 strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
325 !isalpha(*(dptr + hdr->clen + 1)))
330 /* Find and skip colon */
331 dptr = sip_skip_whitespace(dptr, limit);
334 if (*dptr != ':' || ++dptr >= limit)
337 /* Skip whitespace after colon */
338 dptr = sip_skip_whitespace(dptr, limit);
342 *matchoff = dptr - start;
344 dptr = ct_sip_header_search(dptr, limit, hdr->search,
351 *matchlen = hdr->match_len(ct, dptr, limit, &shift);
354 *matchoff = dptr - start + shift;
359 EXPORT_SYMBOL_GPL(ct_sip_get_header);
361 /* Get next header field in a list of comma seperated values */
362 static int ct_sip_next_header(const struct nf_conn *ct, const char *dptr,
363 unsigned int dataoff, unsigned int datalen,
364 enum sip_header_types type,
365 unsigned int *matchoff, unsigned int *matchlen)
367 const struct sip_header *hdr = &ct_sip_hdrs[type];
368 const char *start = dptr, *limit = dptr + datalen;
373 dptr = ct_sip_header_search(dptr, limit, ",", strlen(","));
377 dptr = ct_sip_header_search(dptr, limit, hdr->search, hdr->slen);
382 *matchoff = dptr - start;
383 *matchlen = hdr->match_len(ct, dptr, limit, &shift);
390 /* Walk through headers until a parsable one is found or no header of the
391 * given type is left. */
392 static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
393 unsigned int dataoff, unsigned int datalen,
394 enum sip_header_types type, int *in_header,
395 unsigned int *matchoff, unsigned int *matchlen)
399 if (in_header && *in_header) {
401 ret = ct_sip_next_header(ct, dptr, dataoff, datalen,
402 type, matchoff, matchlen);
407 dataoff += *matchoff;
413 ret = ct_sip_get_header(ct, dptr, dataoff, datalen,
414 type, matchoff, matchlen);
419 dataoff += *matchoff;
427 /* Locate a SIP header, parse the URI and return the offset and length of
428 * the address as well as the address and port themselves. A stream of
429 * headers can be parsed by handing in a non-NULL datalen and in_header
432 int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
433 unsigned int *dataoff, unsigned int datalen,
434 enum sip_header_types type, int *in_header,
435 unsigned int *matchoff, unsigned int *matchlen,
436 union nf_inet_addr *addr, __be16 *port)
438 const char *c, *limit = dptr + datalen;
442 ret = ct_sip_walk_headers(ct, dptr, dataoff ? *dataoff : 0, datalen,
443 type, in_header, matchoff, matchlen);
448 if (!parse_addr(ct, dptr + *matchoff, &c, addr, limit))
452 p = simple_strtoul(c, (char **)&c, 10);
453 if (p < 1024 || p > 65535)
457 *port = htons(SIP_PORT);
463 EXPORT_SYMBOL_GPL(ct_sip_parse_header_uri);
465 /* Parse address from header parameter and return address, offset and length */
466 int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
467 unsigned int dataoff, unsigned int datalen,
469 unsigned int *matchoff, unsigned int *matchlen,
470 union nf_inet_addr *addr)
472 const char *limit = dptr + datalen;
473 const char *start, *end;
475 limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
477 limit = dptr + datalen;
479 start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
483 start += strlen(name);
484 if (!parse_addr(ct, start, &end, addr, limit))
486 *matchoff = start - dptr;
487 *matchlen = end - start;
490 EXPORT_SYMBOL_GPL(ct_sip_parse_address_param);
492 /* Parse numerical header parameter and return value, offset and length */
493 int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
494 unsigned int dataoff, unsigned int datalen,
496 unsigned int *matchoff, unsigned int *matchlen,
499 const char *limit = dptr + datalen;
503 limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
505 limit = dptr + datalen;
507 start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
511 start += strlen(name);
512 *val = simple_strtoul(start, &end, 0);
515 if (matchoff && matchlen) {
516 *matchoff = start - dptr;
517 *matchlen = end - start;
521 EXPORT_SYMBOL_GPL(ct_sip_parse_numerical_param);
523 /* SDP header parsing: a SDP session description contains an ordered set of
524 * headers, starting with a section containing general session parameters,
525 * optionally followed by multiple media descriptions.
527 * SDP headers always start at the beginning of a line. According to RFC 2327:
528 * "The sequence CRLF (0x0d0a) is used to end a record, although parsers should
529 * be tolerant and also accept records terminated with a single newline
530 * character". We handle both cases.
532 static const struct sip_header ct_sdp_hdrs[] = {
533 [SDP_HDR_VERSION] = SDP_HDR("v=", NULL, digits_len),
534 [SDP_HDR_OWNER_IP4] = SDP_HDR("o=", "IN IP4 ", epaddr_len),
535 [SDP_HDR_CONNECTION_IP4] = SDP_HDR("c=", "IN IP4 ", epaddr_len),
536 [SDP_HDR_OWNER_IP6] = SDP_HDR("o=", "IN IP6 ", epaddr_len),
537 [SDP_HDR_CONNECTION_IP6] = SDP_HDR("c=", "IN IP6 ", epaddr_len),
538 [SDP_HDR_MEDIA] = SDP_HDR("m=", "audio ", digits_len),
541 /* Linear string search within SDP header values */
542 static const char *ct_sdp_header_search(const char *dptr, const char *limit,
543 const char *needle, unsigned int len)
545 for (limit -= len; dptr < limit; dptr++) {
546 if (*dptr == '\r' || *dptr == '\n')
548 if (strncmp(dptr, needle, len) == 0)
554 /* Locate a SDP header (optionally a substring within the header value),
555 * optionally stopping at the first occurence of the term header, parse
556 * it and return the offset and length of the data we're interested in.
558 int ct_sip_get_sdp_header(const struct nf_conn *ct, const char *dptr,
559 unsigned int dataoff, unsigned int datalen,
560 enum sdp_header_types type,
561 enum sdp_header_types term,
562 unsigned int *matchoff, unsigned int *matchlen)
564 const struct sip_header *hdr = &ct_sdp_hdrs[type];
565 const struct sip_header *thdr = &ct_sdp_hdrs[term];
566 const char *start = dptr, *limit = dptr + datalen;
569 for (dptr += dataoff; dptr < limit; dptr++) {
570 /* Find beginning of line */
571 if (*dptr != '\r' && *dptr != '\n')
575 if (*(dptr - 1) == '\r' && *dptr == '\n') {
580 if (term != SDP_HDR_UNSPEC &&
581 limit - dptr >= thdr->len &&
582 strnicmp(dptr, thdr->name, thdr->len) == 0)
584 else if (limit - dptr >= hdr->len &&
585 strnicmp(dptr, hdr->name, hdr->len) == 0)
590 *matchoff = dptr - start;
592 dptr = ct_sdp_header_search(dptr, limit, hdr->search,
599 *matchlen = hdr->match_len(ct, dptr, limit, &shift);
602 *matchoff = dptr - start + shift;
607 EXPORT_SYMBOL_GPL(ct_sip_get_sdp_header);
609 static int refresh_signalling_expectation(struct nf_conn *ct,
610 union nf_inet_addr *addr,
612 unsigned int expires)
614 struct nf_conn_help *help = nfct_help(ct);
615 struct nf_conntrack_expect *exp;
616 struct hlist_node *n, *next;
619 spin_lock_bh(&nf_conntrack_lock);
620 hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
621 if (exp->class != SIP_EXPECT_SIGNALLING ||
622 !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
623 exp->tuple.dst.u.udp.port != port)
625 if (!del_timer(&exp->timeout))
627 exp->flags &= ~NF_CT_EXPECT_INACTIVE;
628 exp->timeout.expires = jiffies + expires * HZ;
629 add_timer(&exp->timeout);
633 spin_unlock_bh(&nf_conntrack_lock);
637 static void flush_expectations(struct nf_conn *ct, bool media)
639 struct nf_conn_help *help = nfct_help(ct);
640 struct nf_conntrack_expect *exp;
641 struct hlist_node *n, *next;
643 spin_lock_bh(&nf_conntrack_lock);
644 hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
645 if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
647 if (!del_timer(&exp->timeout))
649 nf_ct_unlink_expect(exp);
650 nf_ct_expect_put(exp);
654 spin_unlock_bh(&nf_conntrack_lock);
657 static int set_expected_rtp(struct sk_buff *skb,
658 const char **dptr, unsigned int *datalen,
659 union nf_inet_addr *addr, __be16 port)
661 struct nf_conntrack_expect *exp;
662 enum ip_conntrack_info ctinfo;
663 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
664 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
665 int family = ct->tuplehash[!dir].tuple.src.l3num;
667 typeof(nf_nat_sdp_hook) nf_nat_sdp;
669 exp = nf_ct_expect_alloc(ct);
672 nf_ct_expect_init(exp, SIP_EXPECT_AUDIO, family,
673 &ct->tuplehash[!dir].tuple.src.u3, addr,
674 IPPROTO_UDP, NULL, &port);
676 nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
677 if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
678 ret = nf_nat_sdp(skb, dptr, datalen, exp);
680 if (nf_ct_expect_related(exp) != 0)
685 nf_ct_expect_put(exp);
690 static int process_sdp(struct sk_buff *skb,
691 const char **dptr, unsigned int *datalen,
694 enum ip_conntrack_info ctinfo;
695 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
696 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
697 unsigned int matchoff, matchlen;
698 union nf_inet_addr addr;
700 enum sdp_header_types type;
702 /* Get address and port from SDP packet. */
703 type = family == AF_INET ? SDP_HDR_CONNECTION_IP4 :
704 SDP_HDR_CONNECTION_IP6;
706 if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
707 type, SDP_HDR_UNSPEC,
708 &matchoff, &matchlen) <= 0)
711 /* We'll drop only if there are parse problems. */
712 if (!parse_addr(ct, *dptr + matchoff, NULL, &addr, *dptr + *datalen))
715 if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
716 SDP_HDR_MEDIA, SDP_HDR_UNSPEC,
717 &matchoff, &matchlen) <= 0)
720 port = simple_strtoul(*dptr + matchoff, NULL, 10);
721 if (port < 1024 || port > 65535)
724 return set_expected_rtp(skb, dptr, datalen, &addr, htons(port));
726 static int process_invite_response(struct sk_buff *skb,
727 const char **dptr, unsigned int *datalen,
728 unsigned int cseq, unsigned int code)
730 enum ip_conntrack_info ctinfo;
731 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
733 if ((code >= 100 && code <= 199) ||
734 (code >= 200 && code <= 299))
735 return process_sdp(skb, dptr, datalen, cseq);
737 flush_expectations(ct, true);
742 static int process_update_response(struct sk_buff *skb,
743 const char **dptr, unsigned int *datalen,
744 unsigned int cseq, unsigned int code)
746 enum ip_conntrack_info ctinfo;
747 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
749 if ((code >= 100 && code <= 199) ||
750 (code >= 200 && code <= 299))
751 return process_sdp(skb, dptr, datalen, cseq);
753 flush_expectations(ct, true);
758 static int process_prack_response(struct sk_buff *skb,
759 const char **dptr, unsigned int *datalen,
760 unsigned int cseq, unsigned int code)
762 enum ip_conntrack_info ctinfo;
763 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
765 if ((code >= 100 && code <= 199) ||
766 (code >= 200 && code <= 299))
767 return process_sdp(skb, dptr, datalen, cseq);
769 flush_expectations(ct, true);
774 static int process_bye_request(struct sk_buff *skb,
775 const char **dptr, unsigned int *datalen,
778 enum ip_conntrack_info ctinfo;
779 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
781 flush_expectations(ct, true);
785 /* Parse a REGISTER request and create a permanent expectation for incoming
786 * signalling connections. The expectation is marked inactive and is activated
787 * when receiving a response indicating success from the registrar.
789 static int process_register_request(struct sk_buff *skb,
790 const char **dptr, unsigned int *datalen,
793 enum ip_conntrack_info ctinfo;
794 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
795 struct nf_conn_help *help = nfct_help(ct);
796 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
797 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
798 unsigned int matchoff, matchlen;
799 struct nf_conntrack_expect *exp;
800 union nf_inet_addr *saddr, daddr;
802 unsigned int expires = 0;
804 typeof(nf_nat_sip_expect_hook) nf_nat_sip_expect;
806 /* Expected connections can not register again. */
807 if (ct->status & IPS_EXPECTED)
810 /* We must check the expiration time: a value of zero signals the
811 * registrar to release the binding. We'll remove our expectation
812 * when receiving the new bindings in the response, but we don't
813 * want to create new ones.
815 * The expiration time may be contained in Expires: header, the
816 * Contact: header parameters or the URI parameters.
818 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
819 &matchoff, &matchlen) > 0)
820 expires = simple_strtoul(*dptr + matchoff, NULL, 10);
822 ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
823 SIP_HDR_CONTACT, NULL,
824 &matchoff, &matchlen, &daddr, &port);
830 /* We don't support third-party registrations */
831 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, &daddr))
834 if (ct_sip_parse_numerical_param(ct, *dptr,
835 matchoff + matchlen, *datalen,
836 "expires=", NULL, NULL, &expires) < 0)
844 exp = nf_ct_expect_alloc(ct);
849 if (sip_direct_signalling)
850 saddr = &ct->tuplehash[!dir].tuple.src.u3;
852 nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, family, saddr, &daddr,
853 IPPROTO_UDP, NULL, &port);
854 exp->timeout.expires = sip_timeout * HZ;
855 exp->helper = nfct_help(ct)->helper;
856 exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
858 nf_nat_sip_expect = rcu_dereference(nf_nat_sip_expect_hook);
859 if (nf_nat_sip_expect && ct->status & IPS_NAT_MASK)
860 ret = nf_nat_sip_expect(skb, dptr, datalen, exp,
863 if (nf_ct_expect_related(exp) != 0)
868 nf_ct_expect_put(exp);
871 if (ret == NF_ACCEPT)
872 help->help.ct_sip_info.register_cseq = cseq;
876 static int process_register_response(struct sk_buff *skb,
877 const char **dptr, unsigned int *datalen,
878 unsigned int cseq, unsigned int code)
880 enum ip_conntrack_info ctinfo;
881 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
882 struct nf_conn_help *help = nfct_help(ct);
883 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
884 union nf_inet_addr addr;
886 unsigned int matchoff, matchlen, dataoff = 0;
887 unsigned int expires = 0;
888 int in_contact = 0, ret;
890 /* According to RFC 3261, "UAs MUST NOT send a new registration until
891 * they have received a final response from the registrar for the
892 * previous one or the previous REGISTER request has timed out".
894 * However, some servers fail to detect retransmissions and send late
895 * responses, so we store the sequence number of the last valid
896 * request and compare it here.
898 if (help->help.ct_sip_info.register_cseq != cseq)
901 if (code >= 100 && code <= 199)
903 if (code < 200 || code > 299)
906 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
907 &matchoff, &matchlen) > 0)
908 expires = simple_strtoul(*dptr + matchoff, NULL, 10);
911 unsigned int c_expires = expires;
913 ret = ct_sip_parse_header_uri(ct, *dptr, &dataoff, *datalen,
914 SIP_HDR_CONTACT, &in_contact,
915 &matchoff, &matchlen,
922 /* We don't support third-party registrations */
923 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, &addr))
926 ret = ct_sip_parse_numerical_param(ct, *dptr,
928 *datalen, "expires=",
929 NULL, NULL, &c_expires);
934 if (refresh_signalling_expectation(ct, &addr, port, c_expires))
939 flush_expectations(ct, false);
943 static const struct sip_handler sip_handlers[] = {
944 SIP_HANDLER("INVITE", process_sdp, process_invite_response),
945 SIP_HANDLER("UPDATE", process_sdp, process_update_response),
946 SIP_HANDLER("ACK", process_sdp, NULL),
947 SIP_HANDLER("PRACK", process_sdp, process_prack_response),
948 SIP_HANDLER("BYE", process_bye_request, NULL),
949 SIP_HANDLER("REGISTER", process_register_request, process_register_response),
952 static int process_sip_response(struct sk_buff *skb,
953 const char **dptr, unsigned int *datalen)
955 static const struct sip_handler *handler;
956 enum ip_conntrack_info ctinfo;
957 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
958 unsigned int matchoff, matchlen;
959 unsigned int code, cseq, dataoff, i;
961 if (*datalen < strlen("SIP/2.0 200"))
963 code = simple_strtoul(*dptr + strlen("SIP/2.0 "), NULL, 10);
967 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
968 &matchoff, &matchlen) <= 0)
970 cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
973 dataoff = matchoff + matchlen + 1;
975 for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
976 handler = &sip_handlers[i];
977 if (handler->response == NULL)
979 if (*datalen < dataoff + handler->len ||
980 strnicmp(*dptr + dataoff, handler->method, handler->len))
982 return handler->response(skb, dptr, datalen, cseq, code);
987 static int process_sip_request(struct sk_buff *skb,
988 const char **dptr, unsigned int *datalen)
990 static const struct sip_handler *handler;
991 enum ip_conntrack_info ctinfo;
992 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
993 unsigned int matchoff, matchlen;
994 unsigned int cseq, i;
996 for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
997 handler = &sip_handlers[i];
998 if (handler->request == NULL)
1000 if (*datalen < handler->len ||
1001 strnicmp(*dptr, handler->method, handler->len))
1004 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
1005 &matchoff, &matchlen) <= 0)
1007 cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1011 return handler->request(skb, dptr, datalen, cseq);
1016 static int sip_help(struct sk_buff *skb,
1017 unsigned int protoff,
1019 enum ip_conntrack_info ctinfo)
1021 unsigned int dataoff, datalen;
1024 typeof(nf_nat_sip_hook) nf_nat_sip;
1027 dataoff = protoff + sizeof(struct udphdr);
1028 if (dataoff >= skb->len)
1031 nf_ct_refresh(ct, skb, sip_timeout * HZ);
1033 if (!skb_is_nonlinear(skb))
1034 dptr = skb->data + dataoff;
1036 pr_debug("Copy of skbuff not supported yet.\n");
1040 datalen = skb->len - dataoff;
1041 if (datalen < strlen("SIP/2.0 200"))
1044 if (strnicmp(dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
1045 ret = process_sip_request(skb, &dptr, &datalen);
1047 ret = process_sip_response(skb, &dptr, &datalen);
1049 if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
1050 nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
1051 if (nf_nat_sip && !nf_nat_sip(skb, &dptr, &datalen))
1058 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
1059 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
1061 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
1062 [SIP_EXPECT_SIGNALLING] = {
1066 [SIP_EXPECT_AUDIO] = {
1067 .max_expected = IP_CT_DIR_MAX,
1072 static void nf_conntrack_sip_fini(void)
1076 for (i = 0; i < ports_c; i++) {
1077 for (j = 0; j < 2; j++) {
1078 if (sip[i][j].me == NULL)
1080 nf_conntrack_helper_unregister(&sip[i][j]);
1085 static int __init nf_conntrack_sip_init(void)
1091 ports[ports_c++] = SIP_PORT;
1093 for (i = 0; i < ports_c; i++) {
1094 memset(&sip[i], 0, sizeof(sip[i]));
1096 sip[i][0].tuple.src.l3num = AF_INET;
1097 sip[i][1].tuple.src.l3num = AF_INET6;
1098 for (j = 0; j < 2; j++) {
1099 sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
1100 sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
1101 sip[i][j].expect_policy = sip_exp_policy;
1102 sip[i][j].expect_class_max = SIP_EXPECT_MAX;
1103 sip[i][j].me = THIS_MODULE;
1104 sip[i][j].help = sip_help;
1106 tmpname = &sip_names[i][j][0];
1107 if (ports[i] == SIP_PORT)
1108 sprintf(tmpname, "sip");
1110 sprintf(tmpname, "sip-%u", i);
1111 sip[i][j].name = tmpname;
1113 pr_debug("port #%u: %u\n", i, ports[i]);
1115 ret = nf_conntrack_helper_register(&sip[i][j]);
1117 printk("nf_ct_sip: failed to register helper "
1118 "for pf: %u port: %u\n",
1119 sip[i][j].tuple.src.l3num, ports[i]);
1120 nf_conntrack_sip_fini();
1128 module_init(nf_conntrack_sip_init);
1129 module_exit(nf_conntrack_sip_fini);