?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "ACPI: EC: Handle IRQ storm on Acer laptops"
[wrt350n-kernel.git] / net / netfilter / nf_conntrack_sip.c
blobc521c891d35167d25369aa992d12ead46847db17
1 /* SIP extension for IP connection tracking.
2 *
3 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
4 * based on RR's ip_conntrack_ftp.c and other modules.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11 #include <linux/module.h>
12 #include <linux/ctype.h>
13 #include <linux/skbuff.h>
14 #include <linux/inet.h>
15 #include <linux/in.h>
16 #include <linux/udp.h>
17 #include <linux/netfilter.h>
18
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_expect.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <linux/netfilter/nf_conntrack_sip.h>
23
24 MODULE_LICENSE("GPL");
25 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
26 MODULE_DESCRIPTION("SIP connection tracking helper");
27 MODULE_ALIAS("ip_conntrack_sip");
28
29 #define MAX_PORTS 8
30 static unsigned short ports[MAX_PORTS];
31 static unsigned int ports_c;
32 module_param_array(ports, ushort, &ports_c, 0400);
33 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
34
35 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
36 module_param(sip_timeout, uint, 0600);
37 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
38
39 unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
40 enum ip_conntrack_info ctinfo,
41 struct nf_conn *ct,
42 const char **dptr) __read_mostly;
43 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
44
45 unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
46 enum ip_conntrack_info ctinfo,
47 struct nf_conntrack_expect *exp,
48 const char *dptr) __read_mostly;
49 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
50
51 static int digits_len(const struct nf_conn *, const char *, const char *, int *);
52 static int epaddr_len(const struct nf_conn *, const char *, const char *, int *);
53 static int skp_digits_len(const struct nf_conn *, const char *, const char *, int *);
54 static int skp_epaddr_len(const struct nf_conn *, const char *, const char *, int *);
55
56 struct sip_header_nfo {
57 const char *lname;
58 const char *sname;
59 const char *ln_str;
60 size_t lnlen;
61 size_t snlen;
62 size_t ln_strlen;
63 int case_sensitive;
64 int (*match_len)(const struct nf_conn *, const char *,
65 const char *, int *);
66 };
67
68 static const struct sip_header_nfo ct_sip_hdrs[] = {
69 [POS_REG_REQ_URI] = { /* SIP REGISTER request URI */
70 .lname = "sip:",
71 .lnlen = sizeof("sip:") - 1,
72 .ln_str = ":",
73 .ln_strlen = sizeof(":") - 1,
74 .match_len = epaddr_len,
75 },
76 [POS_REQ_URI] = { /* SIP request URI */
77 .lname = "sip:",
78 .lnlen = sizeof("sip:") - 1,
79 .ln_str = "@",
80 .ln_strlen = sizeof("@") - 1,
81 .match_len = epaddr_len,
82 },
83 [POS_FROM] = { /* SIP From header */
84 .lname = "From:",
85 .lnlen = sizeof("From:") - 1,
86 .sname = "\r\nf:",
87 .snlen = sizeof("\r\nf:") - 1,
88 .ln_str = "sip:",
89 .ln_strlen = sizeof("sip:") - 1,
90 .match_len = skp_epaddr_len,
91 },
92 [POS_TO] = { /* SIP To header */
93 .lname = "To:",
94 .lnlen = sizeof("To:") - 1,
95 .sname = "\r\nt:",
96 .snlen = sizeof("\r\nt:") - 1,
97 .ln_str = "sip:",
98 .ln_strlen = sizeof("sip:") - 1,
99 .match_len = skp_epaddr_len
100 },
101 [POS_VIA] = { /* SIP Via header */
102 .lname = "Via:",
103 .lnlen = sizeof("Via:") - 1,
104 .sname = "\r\nv:",
105 .snlen = sizeof("\r\nv:") - 1, /* rfc3261 "\r\n" */
106 .ln_str = "UDP ",
107 .ln_strlen = sizeof("UDP ") - 1,
108 .match_len = epaddr_len,
109 },
110 [POS_CONTACT] = { /* SIP Contact header */
111 .lname = "Contact:",
112 .lnlen = sizeof("Contact:") - 1,
113 .sname = "\r\nm:",
114 .snlen = sizeof("\r\nm:") - 1,
115 .ln_str = "sip:",
116 .ln_strlen = sizeof("sip:") - 1,
117 .match_len = skp_epaddr_len
118 },
119 [POS_CONTENT] = { /* SIP Content length header */
120 .lname = "Content-Length:",
121 .lnlen = sizeof("Content-Length:") - 1,
122 .sname = "\r\nl:",
123 .snlen = sizeof("\r\nl:") - 1,
124 .ln_str = ":",
125 .ln_strlen = sizeof(":") - 1,
126 .match_len = skp_digits_len
127 },
128 [POS_MEDIA] = { /* SDP media info */
129 .case_sensitive = 1,
130 .lname = "\nm=",
131 .lnlen = sizeof("\nm=") - 1,
132 .sname = "\rm=",
133 .snlen = sizeof("\rm=") - 1,
134 .ln_str = "audio ",
135 .ln_strlen = sizeof("audio ") - 1,
136 .match_len = digits_len
137 },
138 [POS_OWNER_IP4] = { /* SDP owner address*/
139 .case_sensitive = 1,
140 .lname = "\no=",
141 .lnlen = sizeof("\no=") - 1,
142 .sname = "\ro=",
143 .snlen = sizeof("\ro=") - 1,
144 .ln_str = "IN IP4 ",
145 .ln_strlen = sizeof("IN IP4 ") - 1,
146 .match_len = epaddr_len
147 },
148 [POS_CONNECTION_IP4] = {/* SDP connection info */
149 .case_sensitive = 1,
150 .lname = "\nc=",
151 .lnlen = sizeof("\nc=") - 1,
152 .sname = "\rc=",
153 .snlen = sizeof("\rc=") - 1,
154 .ln_str = "IN IP4 ",
155 .ln_strlen = sizeof("IN IP4 ") - 1,
156 .match_len = epaddr_len
157 },
158 [POS_OWNER_IP6] = { /* SDP owner address*/
159 .case_sensitive = 1,
160 .lname = "\no=",
161 .lnlen = sizeof("\no=") - 1,
162 .sname = "\ro=",
163 .snlen = sizeof("\ro=") - 1,
164 .ln_str = "IN IP6 ",
165 .ln_strlen = sizeof("IN IP6 ") - 1,
166 .match_len = epaddr_len
167 },
168 [POS_CONNECTION_IP6] = {/* SDP connection info */
169 .case_sensitive = 1,
170 .lname = "\nc=",
171 .lnlen = sizeof("\nc=") - 1,
172 .sname = "\rc=",
173 .snlen = sizeof("\rc=") - 1,
174 .ln_str = "IN IP6 ",
175 .ln_strlen = sizeof("IN IP6 ") - 1,
176 .match_len = epaddr_len
177 },
178 [POS_SDP_HEADER] = { /* SDP version header */
179 .case_sensitive = 1,
180 .lname = "\nv=",
181 .lnlen = sizeof("\nv=") - 1,
182 .sname = "\rv=",
183 .snlen = sizeof("\rv=") - 1,
184 .ln_str = "=",
185 .ln_strlen = sizeof("=") - 1,
186 .match_len = digits_len
187 }
188 };
189
190 /* get line length until first CR or LF seen. */
191 int ct_sip_lnlen(const char *line, const char *limit)
192 {
193 const char *k = line;
194
195 while ((line <= limit) && (*line == '\r' || *line == '\n'))
196 line++;
197
198 while (line <= limit) {
199 if (*line == '\r' || *line == '\n')
200 break;
201 line++;
202 }
203 return line - k;
204 }
205 EXPORT_SYMBOL_GPL(ct_sip_lnlen);
206
207 /* Linear string search, case sensitive. */
208 const char *ct_sip_search(const char *needle, const char *haystack,
209 size_t needle_len, size_t haystack_len,
210 int case_sensitive)
211 {
212 const char *limit = haystack + (haystack_len - needle_len);
213
214 while (haystack <= limit) {
215 if (case_sensitive) {
216 if (strncmp(haystack, needle, needle_len) == 0)
217 return haystack;
218 } else {
219 if (strnicmp(haystack, needle, needle_len) == 0)
220 return haystack;
221 }
222 haystack++;
223 }
224 return NULL;
225 }
226 EXPORT_SYMBOL_GPL(ct_sip_search);
227
228 static int digits_len(const struct nf_conn *ct, const char *dptr,
229 const char *limit, int *shift)
230 {
231 int len = 0;
232 while (dptr <= limit && isdigit(*dptr)) {
233 dptr++;
234 len++;
235 }
236 return len;
237 }
238
239 /* get digits length, skipping blank spaces. */
240 static int skp_digits_len(const struct nf_conn *ct, const char *dptr,
241 const char *limit, int *shift)
242 {
243 for (; dptr <= limit && *dptr == ' '; dptr++)
244 (*shift)++;
245
246 return digits_len(ct, dptr, limit, shift);
247 }
248
249 static int parse_addr(const struct nf_conn *ct, const char *cp,
250 const char **endp, union nf_inet_addr *addr,
251 const char *limit)
252 {
253 const char *end;
254 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
255 int ret = 0;
256
257 switch (family) {
258 case AF_INET:
259 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
260 break;
261 case AF_INET6:
262 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
263 break;
264 default:
265 BUG();
266 }
267
268 if (ret == 0 || end == cp)
269 return 0;
270 if (endp)
271 *endp = end;
272 return 1;
273 }
274
275 /* skip ip address. returns its length. */
276 static int epaddr_len(const struct nf_conn *ct, const char *dptr,
277 const char *limit, int *shift)
278 {
279 union nf_inet_addr addr;
280 const char *aux = dptr;
281
282 if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
283 pr_debug("ip: %s parse failed.!\n", dptr);
284 return 0;
285 }
286
287 /* Port number */
288 if (*dptr == ':') {
289 dptr++;
290 dptr += digits_len(ct, dptr, limit, shift);
291 }
292 return dptr - aux;
293 }
294
295 /* get address length, skiping user info. */
296 static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
297 const char *limit, int *shift)
298 {
299 const char *start = dptr;
300 int s = *shift;
301
302 /* Search for @, but stop at the end of the line.
303 * We are inside a sip: URI, so we don't need to worry about
304 * continuation lines. */
305 while (dptr <= limit &&
306 *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
307 (*shift)++;
308 dptr++;
309 }
310
311 if (dptr <= limit && *dptr == '@') {
312 dptr++;
313 (*shift)++;
314 } else {
315 dptr = start;
316 *shift = s;
317 }
318
319 return epaddr_len(ct, dptr, limit, shift);
320 }
321
322 /* Returns 0 if not found, -1 error parsing. */
323 int ct_sip_get_info(const struct nf_conn *ct,
324 const char *dptr, size_t dlen,
325 unsigned int *matchoff,
326 unsigned int *matchlen,
327 enum sip_header_pos pos)
328 {
329 const struct sip_header_nfo *hnfo = &ct_sip_hdrs[pos];
330 const char *limit, *aux, *k = dptr;
331 int shift = 0;
332
333 limit = dptr + (dlen - hnfo->lnlen);
334
335 while (dptr <= limit) {
336 if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
337 (hnfo->sname == NULL ||
338 strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
339 dptr++;
340 continue;
341 }
342 aux = ct_sip_search(hnfo->ln_str, dptr, hnfo->ln_strlen,
343 ct_sip_lnlen(dptr, limit),
344 hnfo->case_sensitive);
345 if (!aux) {
346 pr_debug("'%s' not found in '%s'.\n", hnfo->ln_str,
347 hnfo->lname);
348 return -1;
349 }
350 aux += hnfo->ln_strlen;
351
352 *matchlen = hnfo->match_len(ct, aux, limit, &shift);
353 if (!*matchlen)
354 return -1;
355
356 *matchoff = (aux - k) + shift;
357
358 pr_debug("%s match succeeded! - len: %u\n", hnfo->lname,
359 *matchlen);
360 return 1;
361 }
362 pr_debug("%s header not found.\n", hnfo->lname);
363 return 0;
364 }
365 EXPORT_SYMBOL_GPL(ct_sip_get_info);
366
367 static int set_expected_rtp(struct sk_buff *skb,
368 struct nf_conn *ct,
369 enum ip_conntrack_info ctinfo,
370 union nf_inet_addr *addr,
371 __be16 port,
372 const char *dptr)
373 {
374 struct nf_conntrack_expect *exp;
375 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
376 int family = ct->tuplehash[!dir].tuple.src.l3num;
377 int ret;
378 typeof(nf_nat_sdp_hook) nf_nat_sdp;
379
380 exp = nf_ct_expect_alloc(ct);
381 if (exp == NULL)
382 return NF_DROP;
383 nf_ct_expect_init(exp, family,
384 &ct->tuplehash[!dir].tuple.src.u3, addr,
385 IPPROTO_UDP, NULL, &port);
386
387 nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
388 if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
389 ret = nf_nat_sdp(skb, ctinfo, exp, dptr);
390 else {
391 if (nf_ct_expect_related(exp) != 0)
392 ret = NF_DROP;
393 else
394 ret = NF_ACCEPT;
395 }
396 nf_ct_expect_put(exp);
397
398 return ret;
399 }
400
401 static int sip_help(struct sk_buff *skb,
402 unsigned int protoff,
403 struct nf_conn *ct,
404 enum ip_conntrack_info ctinfo)
405 {
406 int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
407 union nf_inet_addr addr;
408 unsigned int dataoff, datalen;
409 const char *dptr;
410 int ret = NF_ACCEPT;
411 unsigned int matchoff, matchlen;
412 u_int16_t port;
413 enum sip_header_pos pos;
414 typeof(nf_nat_sip_hook) nf_nat_sip;
415
416 /* No Data ? */
417 dataoff = protoff + sizeof(struct udphdr);
418 if (dataoff >= skb->len)
419 return NF_ACCEPT;
420
421 nf_ct_refresh(ct, skb, sip_timeout * HZ);
422
423 if (!skb_is_nonlinear(skb))
424 dptr = skb->data + dataoff;
425 else {
426 pr_debug("Copy of skbuff not supported yet.\n");
427 goto out;
428 }
429
430 nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
431 if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
432 if (!nf_nat_sip(skb, ctinfo, ct, &dptr)) {
433 ret = NF_DROP;
434 goto out;
435 }
436 }
437
438 datalen = skb->len - dataoff;
439 if (datalen < sizeof("SIP/2.0 200") - 1)
440 goto out;
441
442 /* RTP info only in some SDP pkts */
443 if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
444 memcmp(dptr, "UPDATE", sizeof("UPDATE") - 1) != 0 &&
445 memcmp(dptr, "SIP/2.0 180", sizeof("SIP/2.0 180") - 1) != 0 &&
446 memcmp(dptr, "SIP/2.0 183", sizeof("SIP/2.0 183") - 1) != 0 &&
447 memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
448 goto out;
449 }
450 /* Get address and port from SDP packet. */
451 pos = family == AF_INET ? POS_CONNECTION_IP4 : POS_CONNECTION_IP6;
452 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen, pos) > 0) {
453
454 /* We'll drop only if there are parse problems. */
455 if (!parse_addr(ct, dptr + matchoff, NULL, &addr,
456 dptr + datalen)) {
457 ret = NF_DROP;
458 goto out;
459 }
460 if (ct_sip_get_info(ct, dptr, datalen, &matchoff, &matchlen,
461 POS_MEDIA) > 0) {
462
463 port = simple_strtoul(dptr + matchoff, NULL, 10);
464 if (port < 1024) {
465 ret = NF_DROP;
466 goto out;
467 }
468 ret = set_expected_rtp(skb, ct, ctinfo, &addr,
469 htons(port), dptr);
470 }
471 }
472 out:
473 return ret;
474 }
475
476 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
477 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
478
479 static void nf_conntrack_sip_fini(void)
480 {
481 int i, j;
482
483 for (i = 0; i < ports_c; i++) {
484 for (j = 0; j < 2; j++) {
485 if (sip[i][j].me == NULL)
486 continue;
487 nf_conntrack_helper_unregister(&sip[i][j]);
488 }
489 }
490 }
491
492 static int __init nf_conntrack_sip_init(void)
493 {
494 int i, j, ret;
495 char *tmpname;
496
497 if (ports_c == 0)
498 ports[ports_c++] = SIP_PORT;
499
500 for (i = 0; i < ports_c; i++) {
501 memset(&sip[i], 0, sizeof(sip[i]));
502
503 sip[i][0].tuple.src.l3num = AF_INET;
504 sip[i][1].tuple.src.l3num = AF_INET6;
505 for (j = 0; j < 2; j++) {
506 sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
507 sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
508 sip[i][j].max_expected = 2;
509 sip[i][j].timeout = 3 * 60; /* 3 minutes */
510 sip[i][j].me = THIS_MODULE;
511 sip[i][j].help = sip_help;
512
513 tmpname = &sip_names[i][j][0];
514 if (ports[i] == SIP_PORT)
515 sprintf(tmpname, "sip");
516 else
517 sprintf(tmpname, "sip-%u", i);
518 sip[i][j].name = tmpname;
519
520 pr_debug("port #%u: %u\n", i, ports[i]);
521
522 ret = nf_conntrack_helper_register(&sip[i][j]);
523 if (ret) {
524 printk("nf_ct_sip: failed to register helper "
525 "for pf: %u port: %u\n",
526 sip[i][j].tuple.src.l3num, ports[i]);
527 nf_conntrack_sip_fini();
528 return ret;
529 }
530 }
531 }
532 return 0;
533 }
534
535 module_init(nf_conntrack_sip_init);
536 module_exit(nf_conntrack_sip_fini);
WRT350N Kernel Patches