?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
inotify: fix race
[linux-2.6.22.y-op.git] / net / netfilter / nf_conntrack_sip.c
blob1b5c6c1055f75edb03e1b5c42d1777e5ac311b81
1 /* SIP extension for IP connection tracking.
2 *
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_conntrack_ftp.c and other modules.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11 #include <linux/module.h>
12 #include <linux/ctype.h>
13 #include <linux/skbuff.h>
14 #include <linux/inet.h>
15 #include <linux/in.h>
16 #include <linux/udp.h>
17 #include <linux/netfilter.h>
18
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_expect.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <linux/netfilter/nf_conntrack_sip.h>
23
24 #if 0
25 #define DEBUGP printk
26 #else
27 #define DEBUGP(format, args...)
28 #endif
29
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
32 MODULE_DESCRIPTION("SIP connection tracking helper");
33 MODULE_ALIAS("ip_conntrack_sip");
34
35 #define MAX_PORTS 8
36 static unsigned short ports[MAX_PORTS];
37 static int ports_c;
38 module_param_array(ports, ushort, &ports_c, 0400);
39 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
40
41 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
42 module_param(sip_timeout, uint, 0600);
43 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
44
45 unsigned int (*nf_nat_sip_hook)(struct sk_buff **pskb,
46 enum ip_conntrack_info ctinfo,
47 struct nf_conn *ct,
48 const char **dptr) __read_mostly;
49 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
50
51 unsigned int (*nf_nat_sdp_hook)(struct sk_buff **pskb,
52 enum ip_conntrack_info ctinfo,
53 struct nf_conntrack_expect *exp,
54 const char *dptr) __read_mostly;
55 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
56
57 static int digits_len(struct nf_conn *, const char *, const char *, int *);
58 static int epaddr_len(struct nf_conn *, const char *, const char *, int *);
59 static int skp_digits_len(struct nf_conn *, const char *, const char *, int *);
60 static int skp_epaddr_len(struct nf_conn *, const char *, const char *, int *);
61
62 struct sip_header_nfo {
63 const char *lname;
64 const char *sname;
65 const char *ln_str;
66 size_t lnlen;
67 size_t snlen;
68 size_t ln_strlen;
69 int case_sensitive;
70 int (*match_len)(struct nf_conn *, const char *,
71 const char *, int *);
72 };
73
74 static const struct sip_header_nfo ct_sip_hdrs[] = {
75 [POS_REG_REQ_URI] = { /* SIP REGISTER request URI */
76 .lname = "sip:",
77 .lnlen = sizeof("sip:") - 1,
78 .ln_str = ":",
79 .ln_strlen = sizeof(":") - 1,
80 .match_len = epaddr_len,
81 },
82 [POS_REQ_URI] = { /* SIP request URI */
83 .lname = "sip:",
84 .lnlen = sizeof("sip:") - 1,
85 .ln_str = "@",
86 .ln_strlen = sizeof("@") - 1,
87 .match_len = epaddr_len,
88 },
89 [POS_FROM] = { /* SIP From header */
90 .lname = "From:",
91 .lnlen = sizeof("From:") - 1,
92 .sname = "\r\nf:",
93 .snlen = sizeof("\r\nf:") - 1,
94 .ln_str = "sip:",
95 .ln_strlen = sizeof("sip:") - 1,
96 .match_len = skp_epaddr_len,
97 },
98 [POS_TO] = { /* SIP To header */
99 .lname = "To:",
100 .lnlen = sizeof("To:") - 1,
101 .sname = "\r\nt:",
102 .snlen = sizeof("\r\nt:") - 1,
103 .ln_str = "sip:",
104 .ln_strlen = sizeof("sip:") - 1,
105 .match_len = skp_epaddr_len
106 },
107 [POS_VIA] = { /* SIP Via header */
108 .lname = "Via:",
109 .lnlen = sizeof("Via:") - 1,
110 .sname = "\r\nv:",
111 .snlen = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
112 .ln_str = "UDP ",
113 .ln_strlen = sizeof("UDP ") - 1,
114 .match_len = epaddr_len,
115 },
116 [POS_CONTACT] = { /* SIP Contact header */
117 .lname = "Contact:",
118 .lnlen = sizeof("Contact:") - 1,
119 .sname = "\r\nm:",
120 .snlen = sizeof("\r\nm:") - 1,
121 .ln_str = "sip:",
122 .ln_strlen = sizeof("sip:") - 1,
123 .match_len = skp_epaddr_len
124 },
125 [POS_CONTENT] = { /* SIP Content length header */
126 .lname = "Content-Length:",
127 .lnlen = sizeof("Content-Length:") - 1,
128 .sname = "\r\nl:",
129 .snlen = sizeof("\r\nl:") - 1,
130 .ln_str = ":",
131 .ln_strlen = sizeof(":") - 1,
132 .match_len = skp_digits_len
133 },
134 [POS_MEDIA] = { /* SDP media info */
135 .case_sensitive = 1,
136 .lname = "\nm=",
137 .lnlen = sizeof("\nm=") - 1,
138 .sname = "\rm=",
139 .snlen = sizeof("\rm=") - 1,
140 .ln_str = "audio ",
141 .ln_strlen = sizeof("audio ") - 1,
142 .match_len = digits_len
143 },
144 [POS_OWNER_IP4] = { /* SDP owner address*/
145 .case_sensitive = 1,
146 .lname = "\no=",
147 .lnlen = sizeof("\no=") - 1,
148 .sname = "\ro=",
149 .snlen = sizeof("\ro=") - 1,
150 .ln_str = "IN IP4 ",
151 .ln_strlen = sizeof("IN IP4 ") - 1,
152 .match_len = epaddr_len
153 },
154 [POS_CONNECTION_IP4] = {/* SDP connection info */
155 .case_sensitive = 1,
156 .lname = "\nc=",
157 .lnlen = sizeof("\nc=") - 1,
158 .sname = "\rc=",
159 .snlen = sizeof("\rc=") - 1,
160 .ln_str = "IN IP4 ",
161 .ln_strlen = sizeof("IN IP4 ") - 1,
162 .match_len = epaddr_len
163 },
164 [POS_OWNER_IP6] = { /* SDP owner address*/
165 .case_sensitive = 1,
166 .lname = "\no=",
167 .lnlen = sizeof("\no=") - 1,
168 .sname = "\ro=",
169 .snlen = sizeof("\ro=") - 1,
170 .ln_str = "IN IP6 ",
171 .ln_strlen = sizeof("IN IP6 ") - 1,
172 .match_len = epaddr_len
173 },
174 [POS_CONNECTION_IP6] = {/* SDP connection info */
175 .case_sensitive = 1,
176 .lname = "\nc=",
177 .lnlen = sizeof("\nc=") - 1,
178 .sname = "\rc=",
179 .snlen = sizeof("\rc=") - 1,
180 .ln_str = "IN IP6 ",
181 .ln_strlen = sizeof("IN IP6 ") - 1,
182 .match_len = epaddr_len
183 },
184 [POS_SDP_HEADER] = { /* SDP version header */
185 .case_sensitive = 1,
186 .lname = "\nv=",
187 .lnlen = sizeof("\nv=") - 1,
188 .sname = "\rv=",
189 .snlen = sizeof("\rv=") - 1,
190 .ln_str = "=",
191 .ln_strlen = sizeof("=") - 1,
192 .match_len = digits_len
193 }
194 };
195
196 /* get line lenght until first CR or LF seen. */
197 int ct_sip_lnlen(const char *line, const char *limit)
198 {
199 const char *k = line;
200
201 while ((line <= limit) && (*line == '\r' || *line == '\n'))
202 line++;
203
204 while (line <= limit) {
205 if (*line == '\r' || *line == '\n')
206 break;
207 line++;
208 }
209 return line - k;
210 }
211 EXPORT_SYMBOL_GPL(ct_sip_lnlen);
212
213 /* Linear string search, case sensitive. */
214 const char *ct_sip_search(const char *needle, const char *haystack,
215 size_t needle_len, size_t haystack_len,
216 int case_sensitive)
217 {
218 const char *limit = haystack + (haystack_len - needle_len);
219
220 while (haystack <= limit) {
221 if (case_sensitive) {
222 if (strncmp(haystack, needle, needle_len) == 0)
223 return haystack;
224 } else {
225 if (strnicmp(haystack, needle, needle_len) == 0)
226 return haystack;
227 }
228 haystack++;
229 }
230 return NULL;
231 }
232 EXPORT_SYMBOL_GPL(ct_sip_search);
233
234 static int digits_len(struct nf_conn *ct, const char *dptr,
235 const char *limit, int *shift)
236 {
237 int len = 0;
238 while (dptr <= limit && isdigit(*dptr)) {
239 dptr++;
240 len++;
241 }
242 return len;
243 }
244
245 /* get digits lenght, skiping blank spaces. */
246 static int skp_digits_len(struct nf_conn *ct, const char *dptr,
247 const char *limit, int *shift)
248 {
249 for (; dptr <= limit && *dptr == ' '; dptr++)
250 (*shift)++;
251
252 return digits_len(ct, dptr, limit, shift);
253 }
254
255 static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
256 union nf_conntrack_address *addr, const char *limit)
257 {
258 const char *end;
259 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
260 int ret = 0;
261
262 switch (family) {
263 case AF_INET:
264 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
265 break;
266 case AF_INET6:
267 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
268 break;
269 default:
270 BUG();
271 }
272
273 if (ret == 0 || end == cp)
274 return 0;
275 if (endp)
276 *endp = end;
277 return 1;
278 }
279
280 /* skip ip address. returns its length. */
281 static int epaddr_len(struct nf_conn *ct, const char *dptr,
282 const char *limit, int *shift)
283 {
284 union nf_conntrack_address addr;
285 const char *aux = dptr;
286
287 if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
288 DEBUGP("ip: %s parse failed.!\n", dptr);
289 return 0;
290 }
291
292 /* Port number */
293 if (*dptr == ':') {
294 dptr++;
295 dptr += digits_len(ct, dptr, limit, shift);
296 }
297 return dptr - aux;
298 }
299
300 /* get address length, skiping user info. */
301 static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
302 const char *limit, int *shift)
303 {
304 int s = *shift;
305
306 /* Search for @, but stop at the end of the line.
307 * We are inside a sip: URI, so we don't need to worry about
308 * continuation lines. */
309 while (dptr <= limit &&
310 *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
311 (*shift)++;
312 dptr++;
313 }
314
315 if (dptr <= limit && *dptr == '@') {
316 dptr++;
317 (*shift)++;
318 } else
319 *shift = s;
320
321 return epaddr_len(ct, dptr, limit, shift);
322 }
323
324 /* Returns 0 if not found, -1 error parsing. */
325 int ct_sip_get_info(struct nf_conn *ct,
326 const char *dptr, size_t dlen,
327 unsigned int *matchoff,
328 unsigned int *matchlen,
329 enum sip_header_pos pos)
330 {
331 const struct sip_header_nfo *hnfo = &ct_sip_hdrs[pos];
332 const char *limit, *aux, *k = dptr;
333 int shift = 0;
334
335 limit = dptr + (dlen - hnfo->lnlen);
336
337 while (dptr <= limit) {
338 if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
339 (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
340 dptr++;
341 continue;
342 }
343 aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
344 ct_sip_lnlen(dptr, limit),
345 hnfo->case_sensitive);
346 if (!aux) {
347 DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str,
348 hnfo->lname);
349 return -1;
350 }
351 aux += hnfo->ln_strlen;
352
353 *matchlen = hnfo->match_len(ct, aux, limit, &shift);
354 if (!*matchlen)
355 return -1;
356
357 *matchoff = (aux - k) + shift;
358
359 DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname,
360 *matchlen);
361 return 1;
362 }
363 DEBUGP("%s header not found.\n", hnfo->lname);
364 return 0;
365 }
366 EXPORT_SYMBOL_GPL(ct_sip_get_info);
367
368 static int set_expected_rtp(struct sk_buff **pskb,
369 struct nf_conn *ct,
370 enum ip_conntrack_info ctinfo,
371 union nf_conntrack_address *addr,
372 __be16 port,
373 const char *dptr)
374 {
375 struct nf_conntrack_expect *exp;
376 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
377 int family = ct->tuplehash[!dir].tuple.src.l3num;
378 int ret;
379 typeof(nf_nat_sdp_hook) nf_nat_sdp;
380
381 exp = nf_conntrack_expect_alloc(ct);
382 if (exp == NULL)
383 return NF_DROP;
384 nf_conntrack_expect_init(exp, family,
385 &ct->tuplehash[!dir].tuple.src.u3, addr,
386 IPPROTO_UDP, NULL, &port);
387
388 nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
389 if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
390 ret = nf_nat_sdp(pskb, ctinfo, exp, dptr);
391 else {
392 if (nf_conntrack_expect_related(exp) != 0)
393 ret = NF_DROP;
394 else
395 ret = NF_ACCEPT;
396 }
397 nf_conntrack_expect_put(exp);
398
399 return ret;
400 }
401
402 static int sip_help(struct sk_buff **pskb,
403 unsigned int protoff,
404 struct nf_conn *ct,
405 enum ip_conntrack_info ctinfo)
406 {
407 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
408 union nf_conntrack_address addr;
409 unsigned int dataoff, datalen;
410 const char *dptr;
411 int ret = NF_ACCEPT;
412 int matchoff, matchlen;
413 u_int16_t port;
414 enum sip_header_pos pos;
415 typeof(nf_nat_sip_hook) nf_nat_sip;
416
417 /* No Data ? */
418 dataoff = protoff + sizeof(struct udphdr);
419 if (dataoff >= (*pskb)->len)
420 return NF_ACCEPT;
421
422 nf_ct_refresh(ct, *pskb, sip_timeout * HZ);
423
424 if (!skb_is_nonlinear(*pskb))
425 dptr = (*pskb)->data + dataoff;
426 else {
427 DEBUGP("Copy of skbuff not supported yet.\n");
428 goto out;
429 }
430
431 nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
432 if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
433 if (!nf_nat_sip(pskb, ctinfo, ct, &dptr)) {
434 ret = NF_DROP;
435 goto out;
436 }
437 }
438
439 datalen = (*pskb)->len - dataoff;
440 if (datalen < sizeof("SIP/2.0 200") - 1)
441 goto out;
442
443 /* RTP info only in some SDP pkts */
444 if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
445 memcmp(dptr, "UPDATE", sizeof("UPDATE") - 1) != 0 &&
446 memcmp(dptr, "SIP/2.0 180", sizeof("SIP/2.0 180") - 1) != 0 &&
447 memcmp(dptr, "SIP/2.0 183", sizeof("SIP/2.0 183") - 1) != 0 &&
448 memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
449 goto out;
450 }
451 /* Get address and port from SDP packet. */
452 pos = family == AF_INET ? POS_CONNECTION_IP4 : POS_CONNECTION_IP6;
453 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen, pos) > 0) {
454
455 /* We'll drop only if there are parse problems. */
456 if (!parse_addr(ct, dptr + matchoff, NULL, &addr,
457 dptr + datalen)) {
458 ret = NF_DROP;
459 goto out;
460 }
461 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen,
462 POS_MEDIA) > 0) {
463
464 port = simple_strtoul(dptr + matchoff, NULL, 10);
465 if (port < 1024) {
466 ret = NF_DROP;
467 goto out;
468 }
469 ret = set_expected_rtp(pskb, ct, ctinfo, &addr,
470 htons(port), dptr);
471 }
472 }
473 out:
474 return ret;
475 }
476
477 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
478 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
479
480 static void nf_conntrack_sip_fini(void)
481 {
482 int i, j;
483
484 for (i = 0; i < ports_c; i++) {
485 for (j = 0; j < 2; j++) {
486 if (sip[i][j].me == NULL)
487 continue;
488 nf_conntrack_helper_unregister(&sip[i][j]);
489 }
490 }
491 }
492
493 static int __init nf_conntrack_sip_init(void)
494 {
495 int i, j, ret;
496 char *tmpname;
497
498 if (ports_c == 0)
499 ports[ports_c++] = SIP_PORT;
500
501 for (i = 0; i < ports_c; i++) {
502 memset(&sip[i], 0, sizeof(sip[i]));
503
504 sip[i][0].tuple.src.l3num = AF_INET;
505 sip[i][1].tuple.src.l3num = AF_INET6;
506 for (j = 0; j < 2; j++) {
507 sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
508 sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
509 sip[i][j].mask.src.l3num = 0xFFFF;
510 sip[i][j].mask.src.u.udp.port = htons(0xFFFF);
511 sip[i][j].mask.dst.protonum = 0xFF;
512 sip[i][j].max_expected = 2;
513 sip[i][j].timeout = 3 * 60; /* 3 minutes */
514 sip[i][j].me = THIS_MODULE;
515 sip[i][j].help = sip_help;
516
517 tmpname = &sip_names[i][j][0];
518 if (ports[i] == SIP_PORT)
519 sprintf(tmpname, "sip");
520 else
521 sprintf(tmpname, "sip-%u", i);
522 sip[i][j].name = tmpname;
523
524 DEBUGP("port #%u: %u\n", i, ports[i]);
525
526 ret = nf_conntrack_helper_register(&sip[i][j]);
527 if (ret) {
528 printk("nf_ct_sip: failed to register helper "
529 "for pf: %u port: %u\n",
530 sip[i][j].tuple.src.l3num, ports[i]);
531 nf_conntrack_sip_fini();
532 return ret;
533 }
534 }
535 }
536 return 0;
537 }
538
539 module_init(nf_conntrack_sip_init);
540 module_exit(nf_conntrack_sip_fini);
linux v2.6.22.y-op