1 /* SIP extension for IP connection tracking.
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_conntrack_ftp.c and other modules.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/ctype.h>
13 #include <linux/skbuff.h>
14 #include <linux/inet.h>
16 #include <linux/udp.h>
17 #include <linux/netfilter.h>
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_expect.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <linux/netfilter/nf_conntrack_sip.h>
27 #define DEBUGP(format, args...)
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
32 MODULE_DESCRIPTION("SIP connection tracking helper");
33 MODULE_ALIAS("ip_conntrack_sip");
36 static unsigned short ports
[MAX_PORTS
];
38 module_param_array(ports
, ushort
, &ports_c
, 0400);
39 MODULE_PARM_DESC(ports
, "port numbers of SIP servers");
41 static unsigned int sip_timeout __read_mostly
= SIP_TIMEOUT
;
42 module_param(sip_timeout
, uint
, 0600);
43 MODULE_PARM_DESC(sip_timeout
, "timeout for the master SIP session");
45 unsigned int (*nf_nat_sip_hook
)(struct sk_buff
**pskb
,
46 enum ip_conntrack_info ctinfo
,
48 const char **dptr
) __read_mostly
;
49 EXPORT_SYMBOL_GPL(nf_nat_sip_hook
);
51 unsigned int (*nf_nat_sdp_hook
)(struct sk_buff
**pskb
,
52 enum ip_conntrack_info ctinfo
,
53 struct nf_conntrack_expect
*exp
,
54 const char *dptr
) __read_mostly
;
55 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook
);
57 static int digits_len(struct nf_conn
*, const char *, const char *, int *);
58 static int epaddr_len(struct nf_conn
*, const char *, const char *, int *);
59 static int skp_digits_len(struct nf_conn
*, const char *, const char *, int *);
60 static int skp_epaddr_len(struct nf_conn
*, const char *, const char *, int *);
62 struct sip_header_nfo
{
70 int (*match_len
)(struct nf_conn
*, const char *,
74 static const struct sip_header_nfo ct_sip_hdrs
[] = {
75 [POS_REG_REQ_URI
] = { /* SIP REGISTER request URI */
77 .lnlen
= sizeof("sip:") - 1,
79 .ln_strlen
= sizeof(":") - 1,
80 .match_len
= epaddr_len
,
82 [POS_REQ_URI
] = { /* SIP request URI */
84 .lnlen
= sizeof("sip:") - 1,
86 .ln_strlen
= sizeof("@") - 1,
87 .match_len
= epaddr_len
,
89 [POS_FROM
] = { /* SIP From header */
91 .lnlen
= sizeof("From:") - 1,
93 .snlen
= sizeof("\r\nf:") - 1,
95 .ln_strlen
= sizeof("sip:") - 1,
96 .match_len
= skp_epaddr_len
,
98 [POS_TO
] = { /* SIP To header */
100 .lnlen
= sizeof("To:") - 1,
102 .snlen
= sizeof("\r\nt:") - 1,
104 .ln_strlen
= sizeof("sip:") - 1,
105 .match_len
= skp_epaddr_len
107 [POS_VIA
] = { /* SIP Via header */
109 .lnlen
= sizeof("Via:") - 1,
111 .snlen
= sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
113 .ln_strlen
= sizeof("UDP ") - 1,
114 .match_len
= epaddr_len
,
116 [POS_CONTACT
] = { /* SIP Contact header */
118 .lnlen
= sizeof("Contact:") - 1,
120 .snlen
= sizeof("\r\nm:") - 1,
122 .ln_strlen
= sizeof("sip:") - 1,
123 .match_len
= skp_epaddr_len
125 [POS_CONTENT
] = { /* SIP Content length header */
126 .lname
= "Content-Length:",
127 .lnlen
= sizeof("Content-Length:") - 1,
129 .snlen
= sizeof("\r\nl:") - 1,
131 .ln_strlen
= sizeof(":") - 1,
132 .match_len
= skp_digits_len
134 [POS_MEDIA
] = { /* SDP media info */
137 .lnlen
= sizeof("\nm=") - 1,
139 .snlen
= sizeof("\rm=") - 1,
141 .ln_strlen
= sizeof("audio ") - 1,
142 .match_len
= digits_len
144 [POS_OWNER_IP4
] = { /* SDP owner address*/
147 .lnlen
= sizeof("\no=") - 1,
149 .snlen
= sizeof("\ro=") - 1,
151 .ln_strlen
= sizeof("IN IP4 ") - 1,
152 .match_len
= epaddr_len
154 [POS_CONNECTION_IP4
] = {/* SDP connection info */
157 .lnlen
= sizeof("\nc=") - 1,
159 .snlen
= sizeof("\rc=") - 1,
161 .ln_strlen
= sizeof("IN IP4 ") - 1,
162 .match_len
= epaddr_len
164 [POS_OWNER_IP6
] = { /* SDP owner address*/
167 .lnlen
= sizeof("\no=") - 1,
169 .snlen
= sizeof("\ro=") - 1,
171 .ln_strlen
= sizeof("IN IP6 ") - 1,
172 .match_len
= epaddr_len
174 [POS_CONNECTION_IP6
] = {/* SDP connection info */
177 .lnlen
= sizeof("\nc=") - 1,
179 .snlen
= sizeof("\rc=") - 1,
181 .ln_strlen
= sizeof("IN IP6 ") - 1,
182 .match_len
= epaddr_len
184 [POS_SDP_HEADER
] = { /* SDP version header */
187 .lnlen
= sizeof("\nv=") - 1,
189 .snlen
= sizeof("\rv=") - 1,
191 .ln_strlen
= sizeof("=") - 1,
192 .match_len
= digits_len
196 /* get line lenght until first CR or LF seen. */
197 int ct_sip_lnlen(const char *line
, const char *limit
)
199 const char *k
= line
;
201 while ((line
< limit
) && (*line
== '\r' || *line
== '\n'))
204 while (line
< limit
) {
205 if (*line
== '\r' || *line
== '\n')
211 EXPORT_SYMBOL_GPL(ct_sip_lnlen
);
213 /* Linear string search, case sensitive. */
214 const char *ct_sip_search(const char *needle
, const char *haystack
,
215 size_t needle_len
, size_t haystack_len
,
218 const char *limit
= haystack
+ (haystack_len
- needle_len
);
220 while (haystack
< limit
) {
221 if (case_sensitive
) {
222 if (strncmp(haystack
, needle
, needle_len
) == 0)
225 if (strnicmp(haystack
, needle
, needle_len
) == 0)
232 EXPORT_SYMBOL_GPL(ct_sip_search
);
234 static int digits_len(struct nf_conn
*ct
, const char *dptr
,
235 const char *limit
, int *shift
)
238 while (dptr
< limit
&& isdigit(*dptr
)) {
245 /* get digits lenght, skiping blank spaces. */
246 static int skp_digits_len(struct nf_conn
*ct
, const char *dptr
,
247 const char *limit
, int *shift
)
249 for (; dptr
< limit
&& *dptr
== ' '; dptr
++)
252 return digits_len(ct
, dptr
, limit
, shift
);
255 static int parse_addr(struct nf_conn
*ct
, const char *cp
, const char **endp
,
256 union nf_inet_addr
*addr
, const char *limit
)
259 int family
= ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.l3num
;
264 ret
= in4_pton(cp
, limit
- cp
, (u8
*)&addr
->ip
, -1, &end
);
267 ret
= in6_pton(cp
, limit
- cp
, (u8
*)&addr
->ip6
, -1, &end
);
273 if (ret
== 0 || end
== cp
)
280 /* skip ip address. returns its length. */
281 static int epaddr_len(struct nf_conn
*ct
, const char *dptr
,
282 const char *limit
, int *shift
)
284 union nf_inet_addr addr
;
285 const char *aux
= dptr
;
287 if (!parse_addr(ct
, dptr
, &dptr
, &addr
, limit
)) {
288 DEBUGP("ip: %s parse failed.!\n", dptr
);
295 dptr
+= digits_len(ct
, dptr
, limit
, shift
);
300 /* get address length, skiping user info. */
301 static int skp_epaddr_len(struct nf_conn
*ct
, const char *dptr
,
302 const char *limit
, int *shift
)
304 const char *start
= dptr
;
307 /* Search for @, but stop at the end of the line.
308 * We are inside a sip: URI, so we don't need to worry about
309 * continuation lines. */
310 while (dptr
< limit
&&
311 *dptr
!= '@' && *dptr
!= '\r' && *dptr
!= '\n') {
316 if (dptr
< limit
&& *dptr
== '@') {
324 return epaddr_len(ct
, dptr
, limit
, shift
);
327 /* Returns 0 if not found, -1 error parsing. */
328 int ct_sip_get_info(struct nf_conn
*ct
,
329 const char *dptr
, size_t dlen
,
330 unsigned int *matchoff
,
331 unsigned int *matchlen
,
332 enum sip_header_pos pos
)
334 const struct sip_header_nfo
*hnfo
= &ct_sip_hdrs
[pos
];
335 const char *limit
, *aux
, *k
= dptr
;
338 limit
= dptr
+ (dlen
- hnfo
->lnlen
);
340 while (dptr
< limit
) {
341 if ((strncmp(dptr
, hnfo
->lname
, hnfo
->lnlen
) != 0) &&
342 (hnfo
->sname
== NULL
||
343 strncmp(dptr
, hnfo
->sname
, hnfo
->snlen
) != 0)) {
347 aux
= ct_sip_search(hnfo
->ln_str
, dptr
, hnfo
->ln_strlen
,
348 ct_sip_lnlen(dptr
, limit
),
349 hnfo
->case_sensitive
);
351 DEBUGP("'%s' not found in '%s'.\n", hnfo
->ln_str
,
355 aux
+= hnfo
->ln_strlen
;
357 *matchlen
= hnfo
->match_len(ct
, aux
, limit
, &shift
);
361 *matchoff
= (aux
- k
) + shift
;
363 DEBUGP("%s match succeeded! - len: %u\n", hnfo
->lname
,
367 DEBUGP("%s header not found.\n", hnfo
->lname
);
370 EXPORT_SYMBOL_GPL(ct_sip_get_info
);
372 static int set_expected_rtp(struct sk_buff
**pskb
,
374 enum ip_conntrack_info ctinfo
,
375 union nf_inet_addr
*addr
,
379 struct nf_conntrack_expect
*exp
;
380 enum ip_conntrack_dir dir
= CTINFO2DIR(ctinfo
);
381 int family
= ct
->tuplehash
[!dir
].tuple
.src
.l3num
;
383 typeof(nf_nat_sdp_hook
) nf_nat_sdp
;
385 exp
= nf_conntrack_expect_alloc(ct
);
388 nf_conntrack_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
, family
,
389 &ct
->tuplehash
[!dir
].tuple
.src
.u3
, addr
,
390 IPPROTO_UDP
, NULL
, &port
);
392 nf_nat_sdp
= rcu_dereference(nf_nat_sdp_hook
);
393 if (nf_nat_sdp
&& ct
->status
& IPS_NAT_MASK
)
394 ret
= nf_nat_sdp(pskb
, ctinfo
, exp
, dptr
);
396 if (nf_conntrack_expect_related(exp
) != 0)
401 nf_conntrack_expect_put(exp
);
406 static int sip_help(struct sk_buff
**pskb
,
407 unsigned int protoff
,
409 enum ip_conntrack_info ctinfo
)
411 int family
= ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.l3num
;
412 union nf_inet_addr addr
;
413 unsigned int dataoff
, datalen
;
416 int matchoff
, matchlen
;
418 enum sip_header_pos pos
;
419 typeof(nf_nat_sip_hook
) nf_nat_sip
;
422 dataoff
= protoff
+ sizeof(struct udphdr
);
423 if (dataoff
>= (*pskb
)->len
)
426 nf_ct_refresh(ct
, *pskb
, sip_timeout
* HZ
);
428 if (!skb_is_nonlinear(*pskb
))
429 dptr
= (*pskb
)->data
+ dataoff
;
431 DEBUGP("Copy of skbuff not supported yet.\n");
435 nf_nat_sip
= rcu_dereference(nf_nat_sip_hook
);
436 if (nf_nat_sip
&& ct
->status
& IPS_NAT_MASK
) {
437 if (!nf_nat_sip(pskb
, ctinfo
, ct
, &dptr
)) {
443 datalen
= (*pskb
)->len
- dataoff
;
444 if (datalen
< strlen("SIP/2.0 200"))
447 /* RTP info only in some SDP pkts */
448 if (strnicmp(dptr
, "INVITE", strlen("INVITE")) != 0 &&
449 strnicmp(dptr
, "UPDATE", strlen("UPDATE")) != 0 &&
450 strnicmp(dptr
, "SIP/2.0 180", strlen("SIP/2.0 180")) != 0 &&
451 strnicmp(dptr
, "SIP/2.0 183", strlen("SIP/2.0 183")) != 0 &&
452 strnicmp(dptr
, "SIP/2.0 200", strlen("SIP/2.0 200")) != 0) {
455 /* Get address and port from SDP packet. */
456 pos
= family
== AF_INET
? POS_CONNECTION_IP4
: POS_CONNECTION_IP6
;
457 if (ct_sip_get_info(ct
, dptr
, datalen
, &matchoff
, &matchlen
, pos
) > 0) {
459 /* We'll drop only if there are parse problems. */
460 if (!parse_addr(ct
, dptr
+ matchoff
, NULL
, &addr
,
465 if (ct_sip_get_info(ct
, dptr
, datalen
, &matchoff
, &matchlen
,
468 port
= simple_strtoul(dptr
+ matchoff
, NULL
, 10);
473 ret
= set_expected_rtp(pskb
, ct
, ctinfo
, &addr
,
481 static struct nf_conntrack_helper sip
[MAX_PORTS
][2] __read_mostly
;
482 static char sip_names
[MAX_PORTS
][2][sizeof("sip-65535")] __read_mostly
;
484 static const struct nf_conntrack_expect_policy sip_exp_policy
= {
489 static void nf_conntrack_sip_fini(void)
493 for (i
= 0; i
< ports_c
; i
++) {
494 for (j
= 0; j
< 2; j
++) {
495 if (sip
[i
][j
].me
== NULL
)
497 nf_conntrack_helper_unregister(&sip
[i
][j
]);
502 static int __init
nf_conntrack_sip_init(void)
508 ports
[ports_c
++] = SIP_PORT
;
510 for (i
= 0; i
< ports_c
; i
++) {
511 memset(&sip
[i
], 0, sizeof(sip
[i
]));
513 sip
[i
][0].tuple
.src
.l3num
= AF_INET
;
514 sip
[i
][1].tuple
.src
.l3num
= AF_INET6
;
515 for (j
= 0; j
< 2; j
++) {
516 sip
[i
][j
].tuple
.dst
.protonum
= IPPROTO_UDP
;
517 sip
[i
][j
].tuple
.src
.u
.udp
.port
= htons(ports
[i
]);
518 sip
[i
][j
].mask
.src
.l3num
= 0xFFFF;
519 sip
[i
][j
].mask
.src
.u
.udp
.port
= htons(0xFFFF);
520 sip
[i
][j
].mask
.dst
.protonum
= 0xFF;
521 sip
[i
][j
].expect_policy
= &sip_exp_policy
;
522 sip
[i
][j
].me
= THIS_MODULE
;
523 sip
[i
][j
].help
= sip_help
;
525 tmpname
= &sip_names
[i
][j
][0];
526 if (ports
[i
] == SIP_PORT
)
527 sprintf(tmpname
, "sip");
529 sprintf(tmpname
, "sip-%u", i
);
530 sip
[i
][j
].name
= tmpname
;
532 DEBUGP("port #%u: %u\n", i
, ports
[i
]);
534 ret
= nf_conntrack_helper_register(&sip
[i
][j
]);
536 printk("nf_ct_sip: failed to register helper "
537 "for pf: %u port: %u\n",
538 sip
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
539 nf_conntrack_sip_fini();
547 module_init(nf_conntrack_sip_init
);
548 module_exit(nf_conntrack_sip_fini
);