net/netfilter/nf_conntrack_sip.c

   1 /* SIP extension for IP connection tracking.
   2  *
   3  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
   4  * based on RR's ip_conntrack_ftp.c and other modules.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/ctype.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/inet.h>
  15 #include <linux/in.h>
  16 #include <linux/udp.h>
  17 #include <linux/netfilter.h>
  18
  19 #include <net/netfilter/nf_conntrack.h>
  20 #include <net/netfilter/nf_conntrack_expect.h>
  21 #include <net/netfilter/nf_conntrack_helper.h>
  22 #include <linux/netfilter/nf_conntrack_sip.h>
  23
  24 MODULE_LICENSE("GPL");
  25 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  26 MODULE_DESCRIPTION("SIP connection tracking helper");
  27 MODULE_ALIAS("ip_conntrack_sip");
  28
  29 #define MAX_PORTS       8
  30 static unsigned short ports[MAX_PORTS];
  31 static unsigned int ports_c;
  32 module_param_array(ports, ushort, &ports_c, 0400);
  33 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
  34
  35 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
  36 module_param(sip_timeout, uint, 0600);
  37 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
  38
  39 unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
  40                                 enum ip_conntrack_info ctinfo,
  41                                 struct nf_conn *ct,
  42                                 const char **dptr) __read_mostly;
  43 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
  44
  45 unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
  46                                 enum ip_conntrack_info ctinfo,
  47                                 struct nf_conntrack_expect *exp,
  48                                 const char *dptr) __read_mostly;
  49 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
  50
  51 static int digits_len(const struct nf_conn *, const char *, const char *, int *);
  52 static int epaddr_len(const struct nf_conn *, const char *, const char *, int *);
  53 static int skp_digits_len(const struct nf_conn *, const char *, const char *, int *);
  54 static int skp_epaddr_len(const struct nf_conn *, const char *, const char *, int *);
  55
  56 struct sip_header_nfo {
  57         const char      *lname;
  58         const char      *sname;
  59         const char      *ln_str;
  60         size_t          lnlen;
  61         size_t          snlen;
  62         size_t          ln_strlen;
  63         int             case_sensitive;
  64         int             (*match_len)(const struct nf_conn *, const char *,
  65                                      const char *, int *);
  66 };
  67
  68 static const struct sip_header_nfo ct_sip_hdrs[] = {
  69         [POS_REG_REQ_URI] = {   /* SIP REGISTER request URI */
  70                 .lname          = "sip:",
  71                 .lnlen          = sizeof("sip:") - 1,
  72                 .ln_str         = ":",
  73                 .ln_strlen      = sizeof(":") - 1,
  74                 .match_len      = epaddr_len,
  75         },
  76         [POS_REQ_URI] = {       /* SIP request URI */
  77                 .lname          = "sip:",
  78                 .lnlen          = sizeof("sip:") - 1,
  79                 .ln_str         = "@",
  80                 .ln_strlen      = sizeof("@") - 1,
  81                 .match_len      = epaddr_len,
  82         },
  83         [POS_FROM] = {          /* SIP From header */
  84                 .lname          = "From:",
  85                 .lnlen          = sizeof("From:") - 1,
  86                 .sname          = "\r\nf:",
  87                 .snlen          = sizeof("\r\nf:") - 1,
  88                 .ln_str         = "sip:",
  89                 .ln_strlen      = sizeof("sip:") - 1,
  90                 .match_len      = skp_epaddr_len,
  91         },
  92         [POS_TO] = {            /* SIP To header */
  93                 .lname          = "To:",
  94                 .lnlen          = sizeof("To:") - 1,
  95                 .sname          = "\r\nt:",
  96                 .snlen          = sizeof("\r\nt:") - 1,
  97                 .ln_str         = "sip:",
  98                 .ln_strlen      = sizeof("sip:") - 1,
  99                 .match_len      = skp_epaddr_len
 100         },
 101         [POS_VIA] = {           /* SIP Via header */
 102                 .lname          = "Via:",
 103                 .lnlen          = sizeof("Via:") - 1,
 104                 .sname          = "\r\nv:",
 105                 .snlen          = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
 106                 .ln_str         = "UDP ",
 107                 .ln_strlen      = sizeof("UDP ") - 1,
 108                 .match_len      = epaddr_len,
 109         },
 110         [POS_CONTACT] = {       /* SIP Contact header */
 111                 .lname          = "Contact:",
 112                 .lnlen          = sizeof("Contact:") - 1,
 113                 .sname          = "\r\nm:",
 114                 .snlen          = sizeof("\r\nm:") - 1,
 115                 .ln_str         = "sip:",
 116                 .ln_strlen      = sizeof("sip:") - 1,
 117                 .match_len      = skp_epaddr_len
 118         },
 119         [POS_CONTENT] = {       /* SIP Content length header */
 120                 .lname          = "Content-Length:",
 121                 .lnlen          = sizeof("Content-Length:") - 1,
 122                 .sname          = "\r\nl:",
 123                 .snlen          = sizeof("\r\nl:") - 1,
 124                 .ln_str         = ":",
 125                 .ln_strlen      = sizeof(":") - 1,
 126                 .match_len      = skp_digits_len
 127         },
 128         [POS_MEDIA] = {         /* SDP media info */
 129                 .case_sensitive = 1,
 130                 .lname          = "\nm=",
 131                 .lnlen          = sizeof("\nm=") - 1,
 132                 .sname          = "\rm=",
 133                 .snlen          = sizeof("\rm=") - 1,
 134                 .ln_str         = "audio ",
 135                 .ln_strlen      = sizeof("audio ") - 1,
 136                 .match_len      = digits_len
 137         },
 138         [POS_OWNER_IP4] = {     /* SDP owner address*/
 139                 .case_sensitive = 1,
 140                 .lname          = "\no=",
 141                 .lnlen          = sizeof("\no=") - 1,
 142                 .sname          = "\ro=",
 143                 .snlen          = sizeof("\ro=") - 1,
 144                 .ln_str         = "IN IP4 ",
 145                 .ln_strlen      = sizeof("IN IP4 ") - 1,
 146                 .match_len      = epaddr_len
 147         },
 148         [POS_CONNECTION_IP4] = {/* SDP connection info */
 149                 .case_sensitive = 1,
 150                 .lname          = "\nc=",
 151                 .lnlen          = sizeof("\nc=") - 1,
 152                 .sname          = "\rc=",
 153                 .snlen          = sizeof("\rc=") - 1,
 154                 .ln_str         = "IN IP4 ",
 155                 .ln_strlen      = sizeof("IN IP4 ") - 1,
 156                 .match_len      = epaddr_len
 157         },
 158         [POS_OWNER_IP6] = {     /* SDP owner address*/
 159                 .case_sensitive = 1,
 160                 .lname          = "\no=",
 161                 .lnlen          = sizeof("\no=") - 1,
 162                 .sname          = "\ro=",
 163                 .snlen          = sizeof("\ro=") - 1,
 164                 .ln_str         = "IN IP6 ",
 165                 .ln_strlen      = sizeof("IN IP6 ") - 1,
 166                 .match_len      = epaddr_len
 167         },
 168         [POS_CONNECTION_IP6] = {/* SDP connection info */
 169                 .case_sensitive = 1,
 170                 .lname          = "\nc=",
 171                 .lnlen          = sizeof("\nc=") - 1,
 172                 .sname          = "\rc=",
 173                 .snlen          = sizeof("\rc=") - 1,
 174                 .ln_str         = "IN IP6 ",
 175                 .ln_strlen      = sizeof("IN IP6 ") - 1,
 176                 .match_len      = epaddr_len
 177         },
 178         [POS_SDP_HEADER] = {    /* SDP version header */
 179                 .case_sensitive = 1,
 180                 .lname          = "\nv=",
 181                 .lnlen          = sizeof("\nv=") - 1,
 182                 .sname          = "\rv=",
 183                 .snlen          = sizeof("\rv=") - 1,
 184                 .ln_str         = "=",
 185                 .ln_strlen      = sizeof("=") - 1,
 186                 .match_len      = digits_len
 187         }
 188 };
 189
 190 /* get line length until first CR or LF seen. */
 191 int ct_sip_lnlen(const char *line, const char *limit)
 192 {
 193         const char *k = line;
 194
 195         while ((line <= limit) && (*line == '\r' || *line == '\n'))
 196                 line++;
 197
 198         while (line <= limit) {
 199                 if (*line == '\r' || *line == '\n')
 200                         break;
 201                 line++;
 202         }
 203         return line - k;
 204 }
 205 EXPORT_SYMBOL_GPL(ct_sip_lnlen);
 206
 207 /* Linear string search, case sensitive. */
 208 const char *ct_sip_search(const char *needle, const char *haystack,
 209                           size_t needle_len, size_t haystack_len,
 210                           int case_sensitive)
 211 {
 212         const char *limit = haystack + (haystack_len - needle_len);
 213
 214         while (haystack <= limit) {
 215                 if (case_sensitive) {
 216                         if (strncmp(haystack, needle, needle_len) == 0)
 217                                 return haystack;
 218                 } else {
 219                         if (strnicmp(haystack, needle, needle_len) == 0)
 220                                 return haystack;
 221                 }
 222                 haystack++;
 223         }
 224         return NULL;
 225 }
 226 EXPORT_SYMBOL_GPL(ct_sip_search);
 227
 228 static int digits_len(const struct nf_conn *ct, const char *dptr,
 229                       const char *limit, int *shift)
 230 {
 231         int len = 0;
 232         while (dptr <= limit && isdigit(*dptr)) {
 233                 dptr++;
 234                 len++;
 235         }
 236         return len;
 237 }
 238
 239 /* get digits length, skipping blank spaces. */
 240 static int skp_digits_len(const struct nf_conn *ct, const char *dptr,
 241                           const char *limit, int *shift)
 242 {
 243         for (; dptr <= limit && *dptr == ' '; dptr++)
 244                 (*shift)++;
 245
 246         return digits_len(ct, dptr, limit, shift);
 247 }
 248
 249 static int parse_addr(const struct nf_conn *ct, const char *cp,
 250                       const char **endp, union nf_inet_addr *addr,
 251                       const char *limit)
 252 {
 253         const char *end;
 254         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 255         int ret = 0;
 256
 257         switch (family) {
 258         case AF_INET:
 259                 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
 260                 break;
 261         case AF_INET6:
 262                 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
 263                 break;
 264         default:
 265                 BUG();
 266         }
 267
 268         if (ret == 0 || end == cp)
 269                 return 0;
 270         if (endp)
 271                 *endp = end;
 272         return 1;
 273 }
 274
 275 /* skip ip address. returns its length. */
 276 static int epaddr_len(const struct nf_conn *ct, const char *dptr,
 277                       const char *limit, int *shift)
 278 {
 279         union nf_inet_addr addr;
 280         const char *aux = dptr;
 281
 282         if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
 283                 pr_debug("ip: %s parse failed.!\n", dptr);
 284                 return 0;
 285         }
 286
 287         /* Port number */
 288         if (*dptr == ':') {
 289                 dptr++;
 290                 dptr += digits_len(ct, dptr, limit, shift);
 291         }
 292         return dptr - aux;
 293 }
 294
 295 /* get address length, skiping user info. */
 296 static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
 297                           const char *limit, int *shift)
 298 {
 299         const char *start = dptr;
 300         int s = *shift;
 301
 302         /* Search for @, but stop at the end of the line.
 303          * We are inside a sip: URI, so we don't need to worry about
 304          * continuation lines. */
 305         while (dptr <= limit &&
 306                *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
 307                 (*shift)++;
 308                 dptr++;
 309         }
 310
 311         if (dptr <= limit && *dptr == '@') {
 312                 dptr++;
 313                 (*shift)++;
 314         } else {
 315                 dptr = start;
 316                 *shift = s;
 317         }
 318
 319         return epaddr_len(ct, dptr, limit, shift);
 320 }
 321
 322 /* Returns 0 if not found, -1 error parsing. */
 323 int ct_sip_get_info(const struct nf_conn *ct,
 324                     const char *dptr, size_t dlen,
 325                     unsigned int *matchoff,
 326                     unsigned int *matchlen,
 327                     enum sip_header_pos pos)
 328 {
 329         const struct sip_header_nfo *hnfo = &ct_sip_hdrs[pos];
 330         const char *limit, *aux, *k = dptr;
 331         int shift = 0;
 332
 333         limit = dptr + (dlen - hnfo->lnlen);
 334
 335         while (dptr <= limit) {
 336                 if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
 337                     (hnfo->sname == NULL ||
 338                      strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
 339                         dptr++;
 340                         continue;
 341                 }
 342                 aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
 343                                     ct_sip_lnlen(dptr, limit),
 344                                     hnfo->case_sensitive);
 345                 if (!aux) {
 346                         pr_debug("'%s' not found in '%s'.\n", hnfo->ln_str,
 347                                  hnfo->lname);
 348                         return -1;
 349                 }
 350                 aux += hnfo->ln_strlen;
 351
 352                 *matchlen = hnfo->match_len(ct, aux, limit, &shift);
 353                 if (!*matchlen)
 354                         return -1;
 355
 356                 *matchoff = (aux - k) + shift;
 357
 358                 pr_debug("%s match succeeded! - len: %u\n", hnfo->lname,
 359                          *matchlen);
 360                 return 1;
 361         }
 362         pr_debug("%s header not found.\n", hnfo->lname);
 363         return 0;
 364 }
 365 EXPORT_SYMBOL_GPL(ct_sip_get_info);
 366
 367 static int set_expected_rtp(struct sk_buff *skb,
 368                             struct nf_conn *ct,
 369                             enum ip_conntrack_info ctinfo,
 370                             union nf_inet_addr *addr,
 371                             __be16 port,
 372                             const char *dptr)
 373 {
 374         struct nf_conntrack_expect *exp;
 375         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 376         int family = ct->tuplehash[!dir].tuple.src.l3num;
 377         int ret;
 378         typeof(nf_nat_sdp_hook) nf_nat_sdp;
 379
 380         exp = nf_ct_expect_alloc(ct);
 381         if (exp == NULL)
 382                 return NF_DROP;
 383         nf_ct_expect_init(exp, family,
 384                           &ct->tuplehash[!dir].tuple.src.u3, addr,
 385                           IPPROTO_UDP, NULL, &port);
 386
 387         nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
 388         if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
 389                 ret = nf_nat_sdp(skb, ctinfo, exp, dptr);
 390         else {
 391                 if (nf_ct_expect_related(exp) != 0)
 392                         ret = NF_DROP;
 393                 else
 394                         ret = NF_ACCEPT;
 395         }
 396         nf_ct_expect_put(exp);
 397
 398         return ret;
 399 }
 400
 401 static int sip_help(struct sk_buff *skb,
 402                     unsigned int protoff,
 403                     struct nf_conn *ct,
 404                     enum ip_conntrack_info ctinfo)
 405 {
 406         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 407         union nf_inet_addr addr;
 408         unsigned int dataoff, datalen;
 409         const char *dptr;
 410         int ret = NF_ACCEPT;
 411         unsigned int matchoff, matchlen;
 412         u_int16_t port;
 413         enum sip_header_pos pos;
 414         typeof(nf_nat_sip_hook) nf_nat_sip;
 415
 416         /* No Data ? */
 417         dataoff = protoff + sizeof(struct udphdr);
 418         if (dataoff >= skb->len)
 419                 return NF_ACCEPT;
 420
 421         nf_ct_refresh(ct, skb, sip_timeout * HZ);
 422
 423         if (!skb_is_nonlinear(skb))
 424                 dptr = skb->data + dataoff;
 425         else {
 426                 pr_debug("Copy of skbuff not supported yet.\n");
 427                 goto out;
 428         }
 429
 430         nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
 431         if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
 432                 if (!nf_nat_sip(skb, ctinfo, ct, &dptr)) {
 433                         ret = NF_DROP;
 434                         goto out;
 435                 }
 436         }
 437
 438         datalen = skb->len - dataoff;
 439         if (datalen < sizeof("SIP/2.0 200") - 1)
 440                 goto out;
 441
 442         /* RTP info only in some SDP pkts */
 443         if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
 444             memcmp(dptr, "UPDATE", sizeof("UPDATE") - 1) != 0 &&
 445             memcmp(dptr, "SIP/2.0 180", sizeof("SIP/2.0 180") - 1) != 0 &&
 446             memcmp(dptr, "SIP/2.0 183", sizeof("SIP/2.0 183") - 1) != 0 &&
 447             memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
 448                 goto out;
 449         }
 450         /* Get address and port from SDP packet. */
 451         pos = family == AF_INET ? POS_CONNECTION_IP4 : POS_CONNECTION_IP6;
 452         if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen, pos) > 0) {
 453
 454                 /* We'll drop only if there are parse problems. */
 455                 if (!parse_addr(ct, dptr + matchoff, NULL, &addr,
 456                                 dptr + datalen)) {
 457                         ret = NF_DROP;
 458                         goto out;
 459                 }
 460                 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen,
 461                                     POS_MEDIA) > 0) {
 462
 463                         port = simple_strtoul(dptr + matchoff, NULL, 10);
 464                         if (port < 1024) {
 465                                 ret = NF_DROP;
 466                                 goto out;
 467                         }
 468                         ret = set_expected_rtp(skb, ct, ctinfo, &addr,
 469                                                htons(port), dptr);
 470                 }
 471         }
 472 out:
 473         return ret;
 474 }
 475
 476 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
 477 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
 478
 479 static void nf_conntrack_sip_fini(void)
 480 {
 481         int i, j;
 482
 483         for (i = 0; i < ports_c; i++) {
 484                 for (j = 0; j < 2; j++) {
 485                         if (sip[i][j].me == NULL)
 486                                 continue;
 487                         nf_conntrack_helper_unregister(&sip[i][j]);
 488                 }
 489         }
 490 }
 491
 492 static int __init nf_conntrack_sip_init(void)
 493 {
 494         int i, j, ret;
 495         char *tmpname;
 496
 497         if (ports_c == 0)
 498                 ports[ports_c++] = SIP_PORT;
 499
 500         for (i = 0; i < ports_c; i++) {
 501                 memset(&sip[i], 0, sizeof(sip[i]));
 502
 503                 sip[i][0].tuple.src.l3num = AF_INET;
 504                 sip[i][1].tuple.src.l3num = AF_INET6;
 505                 for (j = 0; j < 2; j++) {
 506                         sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
 507                         sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
 508                         sip[i][j].max_expected = 2;
 509                         sip[i][j].timeout = 3 * 60; /* 3 minutes */
 510                         sip[i][j].me = THIS_MODULE;
 511                         sip[i][j].help = sip_help;
 512
 513                         tmpname = &sip_names[i][j][0];
 514                         if (ports[i] == SIP_PORT)
 515                                 sprintf(tmpname, "sip");
 516                         else
 517                                 sprintf(tmpname, "sip-%u", i);
 518                         sip[i][j].name = tmpname;
 519
 520                         pr_debug("port #%u: %u\n", i, ports[i]);
 521
 522                         ret = nf_conntrack_helper_register(&sip[i][j]);
 523                         if (ret) {
 524                                 printk("nf_ct_sip: failed to register helper "
 525                                        "for pf: %u port: %u\n",
 526                                        sip[i][j].tuple.src.l3num, ports[i]);
 527                                 nf_conntrack_sip_fini();
 528                                 return ret;
 529                         }
 530                 }
 531         }
 532         return 0;
 533 }
 534
 535 module_init(nf_conntrack_sip_init);
 536 module_exit(nf_conntrack_sip_fini);