?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[NETFILTER]: nf_conntrack: introduce expectation classes and policies, support inacti...
[tomato.git] / release / src-rt / linux / linux-2.6 / net / netfilter / nf_conntrack_sip.c
blob9dbc859f3ea446d21e325749d34b49097c7ffab7
1 /* SIP extension for IP connection tracking.
2 *
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_conntrack_ftp.c and other modules.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11 #include <linux/module.h>
12 #include <linux/ctype.h>
13 #include <linux/skbuff.h>
14 #include <linux/inet.h>
15 #include <linux/in.h>
16 #include <linux/udp.h>
17 #include <linux/netfilter.h>
18
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_expect.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <linux/netfilter/nf_conntrack_sip.h>
23
24 #if 0
25 #define DEBUGP printk
26 #else
27 #define DEBUGP(format, args...)
28 #endif
29
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
32 MODULE_DESCRIPTION("SIP connection tracking helper");
33 MODULE_ALIAS("ip_conntrack_sip");
34
35 #define MAX_PORTS 8
36 static unsigned short ports[MAX_PORTS];
37 static int ports_c;
38 module_param_array(ports, ushort, &ports_c, 0400);
39 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
40
41 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
42 module_param(sip_timeout, uint, 0600);
43 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
44
45 unsigned int (*nf_nat_sip_hook)(struct sk_buff **pskb,
46 enum ip_conntrack_info ctinfo,
47 struct nf_conn *ct,
48 const char **dptr) __read_mostly;
49 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
50
51 unsigned int (*nf_nat_sdp_hook)(struct sk_buff **pskb,
52 enum ip_conntrack_info ctinfo,
53 struct nf_conntrack_expect *exp,
54 const char *dptr) __read_mostly;
55 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
56
57 static int digits_len(struct nf_conn *, const char *, const char *, int *);
58 static int epaddr_len(struct nf_conn *, const char *, const char *, int *);
59 static int skp_digits_len(struct nf_conn *, const char *, const char *, int *);
60 static int skp_epaddr_len(struct nf_conn *, const char *, const char *, int *);
61
62 struct sip_header_nfo {
63 const char *lname;
64 const char *sname;
65 const char *ln_str;
66 size_t lnlen;
67 size_t snlen;
68 size_t ln_strlen;
69 int case_sensitive;
70 int (*match_len)(struct nf_conn *, const char *,
71 const char *, int *);
72 };
73
74 static const struct sip_header_nfo ct_sip_hdrs[] = {
75 [POS_REG_REQ_URI] = { /* SIP REGISTER request URI */
76 .lname = "sip:",
77 .lnlen = sizeof("sip:") - 1,
78 .ln_str = ":",
79 .ln_strlen = sizeof(":") - 1,
80 .match_len = epaddr_len,
81 },
82 [POS_REQ_URI] = { /* SIP request URI */
83 .lname = "sip:",
84 .lnlen = sizeof("sip:") - 1,
85 .ln_str = "@",
86 .ln_strlen = sizeof("@") - 1,
87 .match_len = epaddr_len,
88 },
89 [POS_FROM] = { /* SIP From header */
90 .lname = "From:",
91 .lnlen = sizeof("From:") - 1,
92 .sname = "\r\nf:",
93 .snlen = sizeof("\r\nf:") - 1,
94 .ln_str = "sip:",
95 .ln_strlen = sizeof("sip:") - 1,
96 .match_len = skp_epaddr_len,
97 },
98 [POS_TO] = { /* SIP To header */
99 .lname = "To:",
100 .lnlen = sizeof("To:") - 1,
101 .sname = "\r\nt:",
102 .snlen = sizeof("\r\nt:") - 1,
103 .ln_str = "sip:",
104 .ln_strlen = sizeof("sip:") - 1,
105 .match_len = skp_epaddr_len
106 },
107 [POS_VIA] = { /* SIP Via header */
108 .lname = "Via:",
109 .lnlen = sizeof("Via:") - 1,
110 .sname = "\r\nv:",
111 .snlen = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
112 .ln_str = "UDP ",
113 .ln_strlen = sizeof("UDP ") - 1,
114 .match_len = epaddr_len,
115 },
116 [POS_CONTACT] = { /* SIP Contact header */
117 .lname = "Contact:",
118 .lnlen = sizeof("Contact:") - 1,
119 .sname = "\r\nm:",
120 .snlen = sizeof("\r\nm:") - 1,
121 .ln_str = "sip:",
122 .ln_strlen = sizeof("sip:") - 1,
123 .match_len = skp_epaddr_len
124 },
125 [POS_CONTENT] = { /* SIP Content length header */
126 .lname = "Content-Length:",
127 .lnlen = sizeof("Content-Length:") - 1,
128 .sname = "\r\nl:",
129 .snlen = sizeof("\r\nl:") - 1,
130 .ln_str = ":",
131 .ln_strlen = sizeof(":") - 1,
132 .match_len = skp_digits_len
133 },
134 [POS_MEDIA] = { /* SDP media info */
135 .case_sensitive = 1,
136 .lname = "\nm=",
137 .lnlen = sizeof("\nm=") - 1,
138 .sname = "\rm=",
139 .snlen = sizeof("\rm=") - 1,
140 .ln_str = "audio ",
141 .ln_strlen = sizeof("audio ") - 1,
142 .match_len = digits_len
143 },
144 [POS_OWNER_IP4] = { /* SDP owner address*/
145 .case_sensitive = 1,
146 .lname = "\no=",
147 .lnlen = sizeof("\no=") - 1,
148 .sname = "\ro=",
149 .snlen = sizeof("\ro=") - 1,
150 .ln_str = "IN IP4 ",
151 .ln_strlen = sizeof("IN IP4 ") - 1,
152 .match_len = epaddr_len
153 },
154 [POS_CONNECTION_IP4] = {/* SDP connection info */
155 .case_sensitive = 1,
156 .lname = "\nc=",
157 .lnlen = sizeof("\nc=") - 1,
158 .sname = "\rc=",
159 .snlen = sizeof("\rc=") - 1,
160 .ln_str = "IN IP4 ",
161 .ln_strlen = sizeof("IN IP4 ") - 1,
162 .match_len = epaddr_len
163 },
164 [POS_OWNER_IP6] = { /* SDP owner address*/
165 .case_sensitive = 1,
166 .lname = "\no=",
167 .lnlen = sizeof("\no=") - 1,
168 .sname = "\ro=",
169 .snlen = sizeof("\ro=") - 1,
170 .ln_str = "IN IP6 ",
171 .ln_strlen = sizeof("IN IP6 ") - 1,
172 .match_len = epaddr_len
173 },
174 [POS_CONNECTION_IP6] = {/* SDP connection info */
175 .case_sensitive = 1,
176 .lname = "\nc=",
177 .lnlen = sizeof("\nc=") - 1,
178 .sname = "\rc=",
179 .snlen = sizeof("\rc=") - 1,
180 .ln_str = "IN IP6 ",
181 .ln_strlen = sizeof("IN IP6 ") - 1,
182 .match_len = epaddr_len
183 },
184 [POS_SDP_HEADER] = { /* SDP version header */
185 .case_sensitive = 1,
186 .lname = "\nv=",
187 .lnlen = sizeof("\nv=") - 1,
188 .sname = "\rv=",
189 .snlen = sizeof("\rv=") - 1,
190 .ln_str = "=",
191 .ln_strlen = sizeof("=") - 1,
192 .match_len = digits_len
193 }
194 };
195
196 /* get line lenght until first CR or LF seen. */
197 int ct_sip_lnlen(const char *line, const char *limit)
198 {
199 const char *k = line;
200
201 while ((line < limit) && (*line == '\r' || *line == '\n'))
202 line++;
203
204 while (line < limit) {
205 if (*line == '\r' || *line == '\n')
206 break;
207 line++;
208 }
209 return line - k;
210 }
211 EXPORT_SYMBOL_GPL(ct_sip_lnlen);
212
213 /* Linear string search, case sensitive. */
214 const char *ct_sip_search(const char *needle, const char *haystack,
215 size_t needle_len, size_t haystack_len,
216 int case_sensitive)
217 {
218 const char *limit = haystack + (haystack_len - needle_len);
219
220 while (haystack < limit) {
221 if (case_sensitive) {
222 if (strncmp(haystack, needle, needle_len) == 0)
223 return haystack;
224 } else {
225 if (strnicmp(haystack, needle, needle_len) == 0)
226 return haystack;
227 }
228 haystack++;
229 }
230 return NULL;
231 }
232 EXPORT_SYMBOL_GPL(ct_sip_search);
233
234 static int digits_len(struct nf_conn *ct, const char *dptr,
235 const char *limit, int *shift)
236 {
237 int len = 0;
238 while (dptr < limit && isdigit(*dptr)) {
239 dptr++;
240 len++;
241 }
242 return len;
243 }
244
245 /* get digits lenght, skiping blank spaces. */
246 static int skp_digits_len(struct nf_conn *ct, const char *dptr,
247 const char *limit, int *shift)
248 {
249 for (; dptr < limit && *dptr == ' '; dptr++)
250 (*shift)++;
251
252 return digits_len(ct, dptr, limit, shift);
253 }
254
255 static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
256 union nf_inet_addr *addr, const char *limit)
257 {
258 const char *end;
259 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
260 int ret = 0;
261
262 switch (family) {
263 case AF_INET:
264 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
265 break;
266 case AF_INET6:
267 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
268 break;
269 default:
270 BUG();
271 }
272
273 if (ret == 0 || end == cp)
274 return 0;
275 if (endp)
276 *endp = end;
277 return 1;
278 }
279
280 /* skip ip address. returns its length. */
281 static int epaddr_len(struct nf_conn *ct, const char *dptr,
282 const char *limit, int *shift)
283 {
284 union nf_inet_addr addr;
285 const char *aux = dptr;
286
287 if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
288 DEBUGP("ip: %s parse failed.!\n", dptr);
289 return 0;
290 }
291
292 /* Port number */
293 if (*dptr == ':') {
294 dptr++;
295 dptr += digits_len(ct, dptr, limit, shift);
296 }
297 return dptr - aux;
298 }
299
300 /* get address length, skiping user info. */
301 static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
302 const char *limit, int *shift)
303 {
304 const char *start = dptr;
305 int s = *shift;
306
307 /* Search for @, but stop at the end of the line.
308 * We are inside a sip: URI, so we don't need to worry about
309 * continuation lines. */
310 while (dptr < limit &&
311 *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
312 (*shift)++;
313 dptr++;
314 }
315
316 if (dptr < limit && *dptr == '@') {
317 dptr++;
318 (*shift)++;
319 } else {
320 dptr = start;
321 *shift = s;
322 }
323
324 return epaddr_len(ct, dptr, limit, shift);
325 }
326
327 /* Returns 0 if not found, -1 error parsing. */
328 int ct_sip_get_info(struct nf_conn *ct,
329 const char *dptr, size_t dlen,
330 unsigned int *matchoff,
331 unsigned int *matchlen,
332 enum sip_header_pos pos)
333 {
334 const struct sip_header_nfo *hnfo = &ct_sip_hdrs[pos];
335 const char *limit, *aux, *k = dptr;
336 int shift = 0;
337
338 limit = dptr + (dlen - hnfo->lnlen);
339
340 while (dptr < limit) {
341 if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
342 (hnfo->sname == NULL ||
343 strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
344 dptr++;
345 continue;
346 }
347 aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
348 ct_sip_lnlen(dptr, limit),
349 hnfo->case_sensitive);
350 if (!aux) {
351 DEBUGP("'%s' not found in '%s'.\n", hnfo->ln_str,
352 hnfo->lname);
353 return -1;
354 }
355 aux += hnfo->ln_strlen;
356
357 *matchlen = hnfo->match_len(ct, aux, limit, &shift);
358 if (!*matchlen)
359 return -1;
360
361 *matchoff = (aux - k) + shift;
362
363 DEBUGP("%s match succeeded! - len: %u\n", hnfo->lname,
364 *matchlen);
365 return 1;
366 }
367 DEBUGP("%s header not found.\n", hnfo->lname);
368 return 0;
369 }
370 EXPORT_SYMBOL_GPL(ct_sip_get_info);
371
372 static int set_expected_rtp(struct sk_buff **pskb,
373 struct nf_conn *ct,
374 enum ip_conntrack_info ctinfo,
375 union nf_inet_addr *addr,
376 __be16 port,
377 const char *dptr)
378 {
379 struct nf_conntrack_expect *exp;
380 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
381 int family = ct->tuplehash[!dir].tuple.src.l3num;
382 int ret;
383 typeof(nf_nat_sdp_hook) nf_nat_sdp;
384
385 exp = nf_conntrack_expect_alloc(ct);
386 if (exp == NULL)
387 return NF_DROP;
388 nf_conntrack_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, family,
389 &ct->tuplehash[!dir].tuple.src.u3, addr,
390 IPPROTO_UDP, NULL, &port);
391
392 nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
393 if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
394 ret = nf_nat_sdp(pskb, ctinfo, exp, dptr);
395 else {
396 if (nf_conntrack_expect_related(exp) != 0)
397 ret = NF_DROP;
398 else
399 ret = NF_ACCEPT;
400 }
401 nf_conntrack_expect_put(exp);
402
403 return ret;
404 }
405
406 static int sip_help(struct sk_buff **pskb,
407 unsigned int protoff,
408 struct nf_conn *ct,
409 enum ip_conntrack_info ctinfo)
410 {
411 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
412 union nf_inet_addr addr;
413 unsigned int dataoff, datalen;
414 const char *dptr;
415 int ret = NF_ACCEPT;
416 int matchoff, matchlen;
417 u_int16_t port;
418 enum sip_header_pos pos;
419 typeof(nf_nat_sip_hook) nf_nat_sip;
420
421 /* No Data ? */
422 dataoff = protoff + sizeof(struct udphdr);
423 if (dataoff >= (*pskb)->len)
424 return NF_ACCEPT;
425
426 nf_ct_refresh(ct, *pskb, sip_timeout * HZ);
427
428 if (!skb_is_nonlinear(*pskb))
429 dptr = (*pskb)->data + dataoff;
430 else {
431 DEBUGP("Copy of skbuff not supported yet.\n");
432 goto out;
433 }
434
435 nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
436 if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
437 if (!nf_nat_sip(pskb, ctinfo, ct, &dptr)) {
438 ret = NF_DROP;
439 goto out;
440 }
441 }
442
443 datalen = (*pskb)->len - dataoff;
444 if (datalen < strlen("SIP/2.0 200"))
445 goto out;
446
447 /* RTP info only in some SDP pkts */
448 if (strnicmp(dptr, "INVITE", strlen("INVITE")) != 0 &&
449 strnicmp(dptr, "UPDATE", strlen("UPDATE")) != 0 &&
450 strnicmp(dptr, "SIP/2.0 180", strlen("SIP/2.0 180")) != 0 &&
451 strnicmp(dptr, "SIP/2.0 183", strlen("SIP/2.0 183")) != 0 &&
452 strnicmp(dptr, "SIP/2.0 200", strlen("SIP/2.0 200")) != 0) {
453 goto out;
454 }
455 /* Get address and port from SDP packet. */
456 pos = family == AF_INET ? POS_CONNECTION_IP4 : POS_CONNECTION_IP6;
457 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen, pos) > 0) {
458
459 /* We'll drop only if there are parse problems. */
460 if (!parse_addr(ct, dptr + matchoff, NULL, &addr,
461 dptr + datalen)) {
462 ret = NF_DROP;
463 goto out;
464 }
465 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen,
466 POS_MEDIA) > 0) {
467
468 port = simple_strtoul(dptr + matchoff, NULL, 10);
469 if (port < 1024) {
470 ret = NF_DROP;
471 goto out;
472 }
473 ret = set_expected_rtp(pskb, ct, ctinfo, &addr,
474 htons(port), dptr);
475 }
476 }
477 out:
478 return ret;
479 }
480
481 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
482 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
483
484 static const struct nf_conntrack_expect_policy sip_exp_policy = {
485 .max_expected = 2,
486 .timeout = 3 * 60,
487 };
488
489 static void nf_conntrack_sip_fini(void)
490 {
491 int i, j;
492
493 for (i = 0; i < ports_c; i++) {
494 for (j = 0; j < 2; j++) {
495 if (sip[i][j].me == NULL)
496 continue;
497 nf_conntrack_helper_unregister(&sip[i][j]);
498 }
499 }
500 }
501
502 static int __init nf_conntrack_sip_init(void)
503 {
504 int i, j, ret;
505 char *tmpname;
506
507 if (ports_c == 0)
508 ports[ports_c++] = SIP_PORT;
509
510 for (i = 0; i < ports_c; i++) {
511 memset(&sip[i], 0, sizeof(sip[i]));
512
513 sip[i][0].tuple.src.l3num = AF_INET;
514 sip[i][1].tuple.src.l3num = AF_INET6;
515 for (j = 0; j < 2; j++) {
516 sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
517 sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
518 sip[i][j].mask.src.l3num = 0xFFFF;
519 sip[i][j].mask.src.u.udp.port = htons(0xFFFF);
520 sip[i][j].mask.dst.protonum = 0xFF;
521 sip[i][j].expect_policy = &sip_exp_policy;
522 sip[i][j].me = THIS_MODULE;
523 sip[i][j].help = sip_help;
524
525 tmpname = &sip_names[i][j][0];
526 if (ports[i] == SIP_PORT)
527 sprintf(tmpname, "sip");
528 else
529 sprintf(tmpname, "sip-%u", i);
530 sip[i][j].name = tmpname;
531
532 DEBUGP("port #%u: %u\n", i, ports[i]);
533
534 ret = nf_conntrack_helper_register(&sip[i][j]);
535 if (ret) {
536 printk("nf_ct_sip: failed to register helper "
537 "for pf: %u port: %u\n",
538 sip[i][j].tuple.src.l3num, ports[i]);
539 nf_conntrack_sip_fini();
540 return ret;
541 }
542 }
543 }
544 return 0;
545 }
546
547 module_init(nf_conntrack_sip_init);
548 module_exit(nf_conntrack_sip_fini);
Tomato firmware and modifications.