nf_conntrack_sip.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/* SIP extension for IP connection tracking.
   3 *
   4 * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
   5 * based on RR's ip_conntrack_ftp.c and other modules.
   6 * (C) 2007 United Security Providers
   7 * (C) 2007, 2008 Patrick McHardy <kaber@trash.net>
   8 */
   9
  10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  11
  12#include <linux/module.h>
  13#include <linux/ctype.h>
  14#include <linux/skbuff.h>
  15#include <linux/inet.h>
  16#include <linux/in.h>
  17#include <linux/udp.h>
  18#include <linux/tcp.h>
  19#include <linux/netfilter.h>
  20#include <linux/netfilter_ipv4.h>
  21#include <linux/netfilter_ipv6.h>
  22
  23#include <net/netfilter/nf_conntrack.h>
  24#include <net/netfilter/nf_conntrack_core.h>
  25#include <net/netfilter/nf_conntrack_expect.h>
  26#include <net/netfilter/nf_conntrack_helper.h>
  27#include <net/netfilter/nf_conntrack_zones.h>
  28#include <linux/netfilter/nf_conntrack_sip.h>
  29
  30#define HELPER_NAME "sip"
  31
  32MODULE_LICENSE("GPL");
  33MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  34MODULE_DESCRIPTION("SIP connection tracking helper");
  35MODULE_ALIAS("ip_conntrack_sip");
  36MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
  37
  38#define MAX_PORTS	8
  39static unsigned short ports[MAX_PORTS];
  40static unsigned int ports_c;
  41module_param_array(ports, ushort, &ports_c, 0400);
  42MODULE_PARM_DESC(ports, "port numbers of SIP servers");
  43
  44static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
  45module_param(sip_timeout, uint, 0600);
  46MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
  47
  48static int sip_direct_signalling __read_mostly = 1;
  49module_param(sip_direct_signalling, int, 0600);
  50MODULE_PARM_DESC(sip_direct_signalling, "expect incoming calls from registrar "
  51					"only (default 1)");
  52
  53static int sip_direct_media __read_mostly = 1;
  54module_param(sip_direct_media, int, 0600);
  55MODULE_PARM_DESC(sip_direct_media, "Expect Media streams between signalling "
  56				   "endpoints only (default 1)");
  57
  58static int sip_external_media __read_mostly = 0;
  59module_param(sip_external_media, int, 0600);
  60MODULE_PARM_DESC(sip_external_media, "Expect Media streams between external "
  61				     "endpoints (default 0)");
  62
  63const struct nf_nat_sip_hooks __rcu *nf_nat_sip_hooks;
  64EXPORT_SYMBOL_GPL(nf_nat_sip_hooks);
  65
  66static int string_len(const struct nf_conn *ct, const char *dptr,
  67		      const char *limit, int *shift)
  68{
  69	int len = 0;
  70
  71	while (dptr < limit && isalpha(*dptr)) {
  72		dptr++;
  73		len++;
  74	}
  75	return len;
  76}
  77
  78static int digits_len(const struct nf_conn *ct, const char *dptr,
  79		      const char *limit, int *shift)
  80{
  81	int len = 0;
  82	while (dptr < limit && isdigit(*dptr)) {
  83		dptr++;
  84		len++;
  85	}
  86	return len;
  87}
  88
  89static int iswordc(const char c)
  90{
  91	if (isalnum(c) || c == '!' || c == '"' || c == '%' ||
  92	    (c >= '(' && c <= '+') || c == ':' || c == '<' || c == '>' ||
  93	    c == '?' || (c >= '[' && c <= ']') || c == '_' || c == '`' ||
  94	    c == '{' || c == '}' || c == '~' || (c >= '-' && c <= '/') ||
  95	    c == '\'')
  96		return 1;
  97	return 0;
  98}
  99
 100static int word_len(const char *dptr, const char *limit)
 101{
 102	int len = 0;
 103	while (dptr < limit && iswordc(*dptr)) {
 104		dptr++;
 105		len++;
 106	}
 107	return len;
 108}
 109
 110static int callid_len(const struct nf_conn *ct, const char *dptr,
 111		      const char *limit, int *shift)
 112{
 113	int len, domain_len;
 114
 115	len = word_len(dptr, limit);
 116	dptr += len;
 117	if (!len || dptr == limit || *dptr != '@')
 118		return len;
 119	dptr++;
 120	len++;
 121
 122	domain_len = word_len(dptr, limit);
 123	if (!domain_len)
 124		return 0;
 125	return len + domain_len;
 126}
 127
 128/* get media type + port length */
 129static int media_len(const struct nf_conn *ct, const char *dptr,
 130		     const char *limit, int *shift)
 131{
 132	int len = string_len(ct, dptr, limit, shift);
 133
 134	dptr += len;
 135	if (dptr >= limit || *dptr != ' ')
 136		return 0;
 137	len++;
 138	dptr++;
 139
 140	return len + digits_len(ct, dptr, limit, shift);
 141}
 142
 143static int sip_parse_addr(const struct nf_conn *ct, const char *cp,
 144			  const char **endp, union nf_inet_addr *addr,
 145			  const char *limit, bool delim)
 146{
 147	const char *end;
 148	int ret;
 149
 150	if (!ct)
 151		return 0;
 152
 153	memset(addr, 0, sizeof(*addr));
 154	switch (nf_ct_l3num(ct)) {
 155	case AF_INET:
 156		ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
 157		if (ret == 0)
 158			return 0;
 159		break;
 160	case AF_INET6:
 161		if (cp < limit && *cp == '[')
 162			cp++;
 163		else if (delim)
 164			return 0;
 165
 166		ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
 167		if (ret == 0)
 168			return 0;
 169
 170		if (end < limit && *end == ']')
 171			end++;
 172		else if (delim)
 173			return 0;
 174		break;
 175	default:
 176		BUG();
 177	}
 178
 179	if (endp)
 180		*endp = end;
 181	return 1;
 182}
 183
 184/* skip ip address. returns its length. */
 185static int epaddr_len(const struct nf_conn *ct, const char *dptr,
 186		      const char *limit, int *shift)
 187{
 188	union nf_inet_addr addr;
 189	const char *aux = dptr;
 190
 191	if (!sip_parse_addr(ct, dptr, &dptr, &addr, limit, true)) {
 192		pr_debug("ip: %s parse failed.!\n", dptr);
 193		return 0;
 194	}
 195
 196	/* Port number */
 197	if (*dptr == ':') {
 198		dptr++;
 199		dptr += digits_len(ct, dptr, limit, shift);
 200	}
 201	return dptr - aux;
 202}
 203
 204/* get address length, skiping user info. */
 205static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
 206			  const char *limit, int *shift)
 207{
 208	const char *start = dptr;
 209	int s = *shift;
 210
 211	/* Search for @, but stop at the end of the line.
 212	 * We are inside a sip: URI, so we don't need to worry about
 213	 * continuation lines. */
 214	while (dptr < limit &&
 215	       *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
 216		(*shift)++;
 217		dptr++;
 218	}
 219
 220	if (dptr < limit && *dptr == '@') {
 221		dptr++;
 222		(*shift)++;
 223	} else {
 224		dptr = start;
 225		*shift = s;
 226	}
 227
 228	return epaddr_len(ct, dptr, limit, shift);
 229}
 230
 231/* Parse a SIP request line of the form:
 232 *
 233 * Request-Line = Method SP Request-URI SP SIP-Version CRLF
 234 *
 235 * and return the offset and length of the address contained in the Request-URI.
 236 */
 237int ct_sip_parse_request(const struct nf_conn *ct,
 238			 const char *dptr, unsigned int datalen,
 239			 unsigned int *matchoff, unsigned int *matchlen,
 240			 union nf_inet_addr *addr, __be16 *port)
 241{
 242	const char *start = dptr, *limit = dptr + datalen, *end;
 243	unsigned int mlen;
 244	unsigned int p;
 245	int shift = 0;
 246
 247	/* Skip method and following whitespace */
 248	mlen = string_len(ct, dptr, limit, NULL);
 249	if (!mlen)
 250		return 0;
 251	dptr += mlen;
 252	if (++dptr >= limit)
 253		return 0;
 254
 255	/* Find SIP URI */
 256	for (; dptr < limit - strlen("sip:"); dptr++) {
 257		if (*dptr == '\r' || *dptr == '\n')
 258			return -1;
 259		if (strncasecmp(dptr, "sip:", strlen("sip:")) == 0) {
 260			dptr += strlen("sip:");
 261			break;
 262		}
 263	}
 264	if (!skp_epaddr_len(ct, dptr, limit, &shift))
 265		return 0;
 266	dptr += shift;
 267
 268	if (!sip_parse_addr(ct, dptr, &end, addr, limit, true))
 269		return -1;
 270	if (end < limit && *end == ':') {
 271		end++;
 272		p = simple_strtoul(end, (char **)&end, 10);
 273		if (p < 1024 || p > 65535)
 274			return -1;
 275		*port = htons(p);
 276	} else
 277		*port = htons(SIP_PORT);
 278
 279	if (end == dptr)
 280		return 0;
 281	*matchoff = dptr - start;
 282	*matchlen = end - dptr;
 283	return 1;
 284}
 285EXPORT_SYMBOL_GPL(ct_sip_parse_request);
 286
 287/* SIP header parsing: SIP headers are located at the beginning of a line, but
 288 * may span several lines, in which case the continuation lines begin with a
 289 * whitespace character. RFC 2543 allows lines to be terminated with CR, LF or
 290 * CRLF, RFC 3261 allows only CRLF, we support both.
 291 *
 292 * Headers are followed by (optionally) whitespace, a colon, again (optionally)
 293 * whitespace and the values. Whitespace in this context means any amount of
 294 * tabs, spaces and continuation lines, which are treated as a single whitespace
 295 * character.
 296 *
 297 * Some headers may appear multiple times. A comma separated list of values is
 298 * equivalent to multiple headers.
 299 */
 300static const struct sip_header ct_sip_hdrs[] = {
 301	[SIP_HDR_CSEQ]			= SIP_HDR("CSeq", NULL, NULL, digits_len),
 302	[SIP_HDR_FROM]			= SIP_HDR("From", "f", "sip:", skp_epaddr_len),
 303	[SIP_HDR_TO]			= SIP_HDR("To", "t", "sip:", skp_epaddr_len),
 304	[SIP_HDR_CONTACT]		= SIP_HDR("Contact", "m", "sip:", skp_epaddr_len),
 305	[SIP_HDR_VIA_UDP]		= SIP_HDR("Via", "v", "UDP ", epaddr_len),
 306	[SIP_HDR_VIA_TCP]		= SIP_HDR("Via", "v", "TCP ", epaddr_len),
 307	[SIP_HDR_EXPIRES]		= SIP_HDR("Expires", NULL, NULL, digits_len),
 308	[SIP_HDR_CONTENT_LENGTH]	= SIP_HDR("Content-Length", "l", NULL, digits_len),
 309	[SIP_HDR_CALL_ID]		= SIP_HDR("Call-Id", "i", NULL, callid_len),
 310};
 311
 312static const char *sip_follow_continuation(const char *dptr, const char *limit)
 313{
 314	/* Walk past newline */
 315	if (++dptr >= limit)
 316		return NULL;
 317
 318	/* Skip '\n' in CR LF */
 319	if (*(dptr - 1) == '\r' && *dptr == '\n') {
 320		if (++dptr >= limit)
 321			return NULL;
 322	}
 323
 324	/* Continuation line? */
 325	if (*dptr != ' ' && *dptr != '\t')
 326		return NULL;
 327
 328	/* skip leading whitespace */
 329	for (; dptr < limit; dptr++) {
 330		if (*dptr != ' ' && *dptr != '\t')
 331			break;
 332	}
 333	return dptr;
 334}
 335
 336static const char *sip_skip_whitespace(const char *dptr, const char *limit)
 337{
 338	for (; dptr < limit; dptr++) {
 339		if (*dptr == ' ' || *dptr == '\t')
 340			continue;
 341		if (*dptr != '\r' && *dptr != '\n')
 342			break;
 343		dptr = sip_follow_continuation(dptr, limit);
 344		break;
 345	}
 346	return dptr;
 347}
 348
 349/* Search within a SIP header value, dealing with continuation lines */
 350static const char *ct_sip_header_search(const char *dptr, const char *limit,
 351					const char *needle, unsigned int len)
 352{
 353	for (limit -= len; dptr < limit; dptr++) {
 354		if (*dptr == '\r' || *dptr == '\n') {
 355			dptr = sip_follow_continuation(dptr, limit);
 356			if (dptr == NULL)
 357				break;
 358			continue;
 359		}
 360
 361		if (strncasecmp(dptr, needle, len) == 0)
 362			return dptr;
 363	}
 364	return NULL;
 365}
 366
 367int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
 368		      unsigned int dataoff, unsigned int datalen,
 369		      enum sip_header_types type,
 370		      unsigned int *matchoff, unsigned int *matchlen)
 371{
 372	const struct sip_header *hdr = &ct_sip_hdrs[type];
 373	const char *start = dptr, *limit = dptr + datalen;
 374	int shift = 0;
 375
 376	for (dptr += dataoff; dptr < limit; dptr++) {
 377		/* Find beginning of line */
 378		if (*dptr != '\r' && *dptr != '\n')
 379			continue;
 380		if (++dptr >= limit)
 381			break;
 382		if (*(dptr - 1) == '\r' && *dptr == '\n') {
 383			if (++dptr >= limit)
 384				break;
 385		}
 386
 387		/* Skip continuation lines */
 388		if (*dptr == ' ' || *dptr == '\t')
 389			continue;
 390
 391		/* Find header. Compact headers must be followed by a
 392		 * non-alphabetic character to avoid mismatches. */
 393		if (limit - dptr >= hdr->len &&
 394		    strncasecmp(dptr, hdr->name, hdr->len) == 0)
 395			dptr += hdr->len;
 396		else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
 397			 strncasecmp(dptr, hdr->cname, hdr->clen) == 0 &&
 398			 !isalpha(*(dptr + hdr->clen)))
 399			dptr += hdr->clen;
 400		else
 401			continue;
 402
 403		/* Find and skip colon */
 404		dptr = sip_skip_whitespace(dptr, limit);
 405		if (dptr == NULL)
 406			break;
 407		if (*dptr != ':' || ++dptr >= limit)
 408			break;
 409
 410		/* Skip whitespace after colon */
 411		dptr = sip_skip_whitespace(dptr, limit);
 412		if (dptr == NULL)
 413			break;
 414
 415		*matchoff = dptr - start;
 416		if (hdr->search) {
 417			dptr = ct_sip_header_search(dptr, limit, hdr->search,
 418						    hdr->slen);
 419			if (!dptr)
 420				return -1;
 421			dptr += hdr->slen;
 422		}
 423
 424		*matchlen = hdr->match_len(ct, dptr, limit, &shift);
 425		if (!*matchlen)
 426			return -1;
 427		*matchoff = dptr - start + shift;
 428		return 1;
 429	}
 430	return 0;
 431}
 432EXPORT_SYMBOL_GPL(ct_sip_get_header);
 433
 434/* Get next header field in a list of comma separated values */
 435static int ct_sip_next_header(const struct nf_conn *ct, const char *dptr,
 436			      unsigned int dataoff, unsigned int datalen,
 437			      enum sip_header_types type,
 438			      unsigned int *matchoff, unsigned int *matchlen)
 439{
 440	const struct sip_header *hdr = &ct_sip_hdrs[type];
 441	const char *start = dptr, *limit = dptr + datalen;
 442	int shift = 0;
 443
 444	dptr += dataoff;
 445
 446	dptr = ct_sip_header_search(dptr, limit, ",", strlen(","));
 447	if (!dptr)
 448		return 0;
 449
 450	dptr = ct_sip_header_search(dptr, limit, hdr->search, hdr->slen);
 451	if (!dptr)
 452		return 0;
 453	dptr += hdr->slen;
 454
 455	*matchoff = dptr - start;
 456	*matchlen = hdr->match_len(ct, dptr, limit, &shift);
 457	if (!*matchlen)
 458		return -1;
 459	*matchoff += shift;
 460	return 1;
 461}
 462
 463/* Walk through headers until a parsable one is found or no header of the
 464 * given type is left. */
 465static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
 466			       unsigned int dataoff, unsigned int datalen,
 467			       enum sip_header_types type, int *in_header,
 468			       unsigned int *matchoff, unsigned int *matchlen)
 469{
 470	int ret;
 471
 472	if (in_header && *in_header) {
 473		while (1) {
 474			ret = ct_sip_next_header(ct, dptr, dataoff, datalen,
 475						 type, matchoff, matchlen);
 476			if (ret > 0)
 477				return ret;
 478			if (ret == 0)
 479				break;
 480			dataoff = *matchoff;
 481		}
 482		*in_header = 0;
 483	}
 484
 485	while (1) {
 486		ret = ct_sip_get_header(ct, dptr, dataoff, datalen,
 487					type, matchoff, matchlen);
 488		if (ret > 0)
 489			break;
 490		if (ret == 0)
 491			return ret;
 492		dataoff = *matchoff;
 493	}
 494
 495	if (in_header)
 496		*in_header = 1;
 497	return 1;
 498}
 499
 500/* Locate a SIP header, parse the URI and return the offset and length of
 501 * the address as well as the address and port themselves. A stream of
 502 * headers can be parsed by handing in a non-NULL datalen and in_header
 503 * pointer.
 504 */
 505int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
 506			    unsigned int *dataoff, unsigned int datalen,
 507			    enum sip_header_types type, int *in_header,
 508			    unsigned int *matchoff, unsigned int *matchlen,
 509			    union nf_inet_addr *addr, __be16 *port)
 510{
 511	const char *c, *limit = dptr + datalen;
 512	unsigned int p;
 513	int ret;
 514
 515	ret = ct_sip_walk_headers(ct, dptr, dataoff ? *dataoff : 0, datalen,
 516				  type, in_header, matchoff, matchlen);
 517	WARN_ON(ret < 0);
 518	if (ret == 0)
 519		return ret;
 520
 521	if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true))
 522		return -1;
 523	if (*c == ':') {
 524		c++;
 525		p = simple_strtoul(c, (char **)&c, 10);
 526		if (p < 1024 || p > 65535)
 527			return -1;
 528		*port = htons(p);
 529	} else
 530		*port = htons(SIP_PORT);
 531
 532	if (dataoff)
 533		*dataoff = c - dptr;
 534	return 1;
 535}
 536EXPORT_SYMBOL_GPL(ct_sip_parse_header_uri);
 537
 538static int ct_sip_parse_param(const struct nf_conn *ct, const char *dptr,
 539			      unsigned int dataoff, unsigned int datalen,
 540			      const char *name,
 541			      unsigned int *matchoff, unsigned int *matchlen)
 542{
 543	const char *limit = dptr + datalen;
 544	const char *start;
 545	const char *end;
 546
 547	limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 548	if (!limit)
 549		limit = dptr + datalen;
 550
 551	start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 552	if (!start)
 553		return 0;
 554	start += strlen(name);
 555
 556	end = ct_sip_header_search(start, limit, ";", strlen(";"));
 557	if (!end)
 558		end = limit;
 559
 560	*matchoff = start - dptr;
 561	*matchlen = end - start;
 562	return 1;
 563}
 564
 565/* Parse address from header parameter and return address, offset and length */
 566int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
 567			       unsigned int dataoff, unsigned int datalen,
 568			       const char *name,
 569			       unsigned int *matchoff, unsigned int *matchlen,
 570			       union nf_inet_addr *addr, bool delim)
 571{
 572	const char *limit = dptr + datalen;
 573	const char *start, *end;
 574
 575	limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 576	if (!limit)
 577		limit = dptr + datalen;
 578
 579	start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 580	if (!start)
 581		return 0;
 582
 583	start += strlen(name);
 584	if (!sip_parse_addr(ct, start, &end, addr, limit, delim))
 585		return 0;
 586	*matchoff = start - dptr;
 587	*matchlen = end - start;
 588	return 1;
 589}
 590EXPORT_SYMBOL_GPL(ct_sip_parse_address_param);
 591
 592/* Parse numerical header parameter and return value, offset and length */
 593int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
 594				 unsigned int dataoff, unsigned int datalen,
 595				 const char *name,
 596				 unsigned int *matchoff, unsigned int *matchlen,
 597				 unsigned int *val)
 598{
 599	const char *limit = dptr + datalen;
 600	const char *start;
 601	char *end;
 602
 603	limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 604	if (!limit)
 605		limit = dptr + datalen;
 606
 607	start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 608	if (!start)
 609		return 0;
 610
 611	start += strlen(name);
 612	*val = simple_strtoul(start, &end, 0);
 613	if (start == end)
 614		return -1;
 615	if (matchoff && matchlen) {
 616		*matchoff = start - dptr;
 617		*matchlen = end - start;
 618	}
 619	return 1;
 620}
 621EXPORT_SYMBOL_GPL(ct_sip_parse_numerical_param);
 622
 623static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
 624				  unsigned int dataoff, unsigned int datalen,
 625				  u8 *proto)
 626{
 627	unsigned int matchoff, matchlen;
 628
 629	if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
 630			       &matchoff, &matchlen)) {
 631		if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP")))
 632			*proto = IPPROTO_TCP;
 633		else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP")))
 634			*proto = IPPROTO_UDP;
 635		else
 636			return 0;
 637
 638		if (*proto != nf_ct_protonum(ct))
 639			return 0;
 640	} else
 641		*proto = nf_ct_protonum(ct);
 642
 643	return 1;
 644}
 645
 646static int sdp_parse_addr(const struct nf_conn *ct, const char *cp,
 647			  const char **endp, union nf_inet_addr *addr,
 648			  const char *limit)
 649{
 650	const char *end;
 651	int ret;
 652
 653	memset(addr, 0, sizeof(*addr));
 654	switch (nf_ct_l3num(ct)) {
 655	case AF_INET:
 656		ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
 657		break;
 658	case AF_INET6:
 659		ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
 660		break;
 661	default:
 662		BUG();
 663	}
 664
 665	if (ret == 0)
 666		return 0;
 667	if (endp)
 668		*endp = end;
 669	return 1;
 670}
 671
 672/* skip ip address. returns its length. */
 673static int sdp_addr_len(const struct nf_conn *ct, const char *dptr,
 674			const char *limit, int *shift)
 675{
 676	union nf_inet_addr addr;
 677	const char *aux = dptr;
 678
 679	if (!sdp_parse_addr(ct, dptr, &dptr, &addr, limit)) {
 680		pr_debug("ip: %s parse failed.!\n", dptr);
 681		return 0;
 682	}
 683
 684	return dptr - aux;
 685}
 686
 687/* SDP header parsing: a SDP session description contains an ordered set of
 688 * headers, starting with a section containing general session parameters,
 689 * optionally followed by multiple media descriptions.
 690 *
 691 * SDP headers always start at the beginning of a line. According to RFC 2327:
 692 * "The sequence CRLF (0x0d0a) is used to end a record, although parsers should
 693 * be tolerant and also accept records terminated with a single newline
 694 * character". We handle both cases.
 695 */
 696static const struct sip_header ct_sdp_hdrs_v4[] = {
 697	[SDP_HDR_VERSION]	= SDP_HDR("v=", NULL, digits_len),
 698	[SDP_HDR_OWNER]		= SDP_HDR("o=", "IN IP4 ", sdp_addr_len),
 699	[SDP_HDR_CONNECTION]	= SDP_HDR("c=", "IN IP4 ", sdp_addr_len),
 700	[SDP_HDR_MEDIA]		= SDP_HDR("m=", NULL, media_len),
 701};
 702
 703static const struct sip_header ct_sdp_hdrs_v6[] = {
 704	[SDP_HDR_VERSION]	= SDP_HDR("v=", NULL, digits_len),
 705	[SDP_HDR_OWNER]		= SDP_HDR("o=", "IN IP6 ", sdp_addr_len),
 706	[SDP_HDR_CONNECTION]	= SDP_HDR("c=", "IN IP6 ", sdp_addr_len),
 707	[SDP_HDR_MEDIA]		= SDP_HDR("m=", NULL, media_len),
 708};
 709
 710/* Linear string search within SDP header values */
 711static const char *ct_sdp_header_search(const char *dptr, const char *limit,
 712					const char *needle, unsigned int len)
 713{
 714	for (limit -= len; dptr < limit; dptr++) {
 715		if (*dptr == '\r' || *dptr == '\n')
 716			break;
 717		if (strncmp(dptr, needle, len) == 0)
 718			return dptr;
 719	}
 720	return NULL;
 721}
 722
 723/* Locate a SDP header (optionally a substring within the header value),
 724 * optionally stopping at the first occurrence of the term header, parse
 725 * it and return the offset and length of the data we're interested in.
 726 */
 727int ct_sip_get_sdp_header(const struct nf_conn *ct, const char *dptr,
 728			  unsigned int dataoff, unsigned int datalen,
 729			  enum sdp_header_types type,
 730			  enum sdp_header_types term,
 731			  unsigned int *matchoff, unsigned int *matchlen)
 732{
 733	const struct sip_header *hdrs, *hdr, *thdr;
 734	const char *start = dptr, *limit = dptr + datalen;
 735	int shift = 0;
 736
 737	hdrs = nf_ct_l3num(ct) == NFPROTO_IPV4 ? ct_sdp_hdrs_v4 : ct_sdp_hdrs_v6;
 738	hdr = &hdrs[type];
 739	thdr = &hdrs[term];
 740
 741	for (dptr += dataoff; dptr < limit; dptr++) {
 742		/* Find beginning of line */
 743		if (*dptr != '\r' && *dptr != '\n')
 744			continue;
 745		if (++dptr >= limit)
 746			break;
 747		if (*(dptr - 1) == '\r' && *dptr == '\n') {
 748			if (++dptr >= limit)
 749				break;
 750		}
 751
 752		if (term != SDP_HDR_UNSPEC &&
 753		    limit - dptr >= thdr->len &&
 754		    strncasecmp(dptr, thdr->name, thdr->len) == 0)
 755			break;
 756		else if (limit - dptr >= hdr->len &&
 757			 strncasecmp(dptr, hdr->name, hdr->len) == 0)
 758			dptr += hdr->len;
 759		else
 760			continue;
 761
 762		*matchoff = dptr - start;
 763		if (hdr->search) {
 764			dptr = ct_sdp_header_search(dptr, limit, hdr->search,
 765						    hdr->slen);
 766			if (!dptr)
 767				return -1;
 768			dptr += hdr->slen;
 769		}
 770
 771		*matchlen = hdr->match_len(ct, dptr, limit, &shift);
 772		if (!*matchlen)
 773			return -1;
 774		*matchoff = dptr - start + shift;
 775		return 1;
 776	}
 777	return 0;
 778}
 779EXPORT_SYMBOL_GPL(ct_sip_get_sdp_header);
 780
 781static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr,
 782				 unsigned int dataoff, unsigned int datalen,
 783				 enum sdp_header_types type,
 784				 enum sdp_header_types term,
 785				 unsigned int *matchoff, unsigned int *matchlen,
 786				 union nf_inet_addr *addr)
 787{
 788	int ret;
 789
 790	ret = ct_sip_get_sdp_header(ct, dptr, dataoff, datalen, type, term,
 791				    matchoff, matchlen);
 792	if (ret <= 0)
 793		return ret;
 794
 795	if (!sdp_parse_addr(ct, dptr + *matchoff, NULL, addr,
 796			    dptr + *matchoff + *matchlen))
 797		return -1;
 798	return 1;
 799}
 800
 801static int refresh_signalling_expectation(struct nf_conn *ct,
 802					  union nf_inet_addr *addr,
 803					  u8 proto, __be16 port,
 804					  unsigned int expires)
 805{
 806	struct nf_conn_help *help = nfct_help(ct);
 807	struct nf_conntrack_expect *exp;
 808	struct hlist_node *next;
 809	int found = 0;
 810
 811	spin_lock_bh(&nf_conntrack_expect_lock);
 812	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
 813		if (exp->class != SIP_EXPECT_SIGNALLING ||
 814		    !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
 815		    exp->tuple.dst.protonum != proto ||
 816		    exp->tuple.dst.u.udp.port != port)
 817			continue;
 818		if (mod_timer_pending(&exp->timeout, jiffies + expires * HZ)) {
 819			exp->flags &= ~NF_CT_EXPECT_INACTIVE;
 820			found = 1;
 821			break;
 822		}
 823	}
 824	spin_unlock_bh(&nf_conntrack_expect_lock);
 825	return found;
 826}
 827
 828static void flush_expectations(struct nf_conn *ct, bool media)
 829{
 830	struct nf_conn_help *help = nfct_help(ct);
 831	struct nf_conntrack_expect *exp;
 832	struct hlist_node *next;
 833
 834	spin_lock_bh(&nf_conntrack_expect_lock);
 835	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
 836		if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
 837			continue;
 838		if (!nf_ct_remove_expect(exp))
 839			continue;
 840		if (!media)
 841			break;
 842	}
 843	spin_unlock_bh(&nf_conntrack_expect_lock);
 844}
 845
 846static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
 847				 unsigned int dataoff,
 848				 const char **dptr, unsigned int *datalen,
 849				 union nf_inet_addr *daddr, __be16 port,
 850				 enum sip_expectation_classes class,
 851				 unsigned int mediaoff, unsigned int medialen)
 852{
 853	struct nf_conntrack_expect *exp, *rtp_exp, *rtcp_exp;
 854	enum ip_conntrack_info ctinfo;
 855	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 856	struct net *net = nf_ct_net(ct);
 857	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 858	union nf_inet_addr *saddr;
 859	struct nf_conntrack_tuple tuple;
 860	int direct_rtp = 0, skip_expect = 0, ret = NF_DROP;
 861	u_int16_t base_port;
 862	__be16 rtp_port, rtcp_port;
 863	const struct nf_nat_sip_hooks *hooks;
 864
 865	saddr = NULL;
 866	if (sip_direct_media) {
 867		if (!nf_inet_addr_cmp(daddr, &ct->tuplehash[dir].tuple.src.u3))
 868			return NF_ACCEPT;
 869		saddr = &ct->tuplehash[!dir].tuple.src.u3;
 870	} else if (sip_external_media) {
 871		struct net_device *dev = skb_dst(skb)->dev;
 872		struct net *net = dev_net(dev);
 873		struct flowi fl;
 874		struct dst_entry *dst = NULL;
 875
 876		memset(&fl, 0, sizeof(fl));
 877
 878		switch (nf_ct_l3num(ct)) {
 879			case NFPROTO_IPV4:
 880				fl.u.ip4.daddr = daddr->ip;
 881				nf_ip_route(net, &dst, &fl, false);
 882				break;
 883
 884			case NFPROTO_IPV6:
 885				fl.u.ip6.daddr = daddr->in6;
 886				nf_ip6_route(net, &dst, &fl, false);
 887				break;
 888		}
 889
 890		/* Don't predict any conntracks when media endpoint is reachable
 891		 * through the same interface as the signalling peer.
 892		 */
 893		if (dst) {
 894			bool external_media = (dst->dev == dev);
 895
 896			dst_release(dst);
 897			if (external_media)
 898				return NF_ACCEPT;
 899		}
 900	}
 901
 902	/* We need to check whether the registration exists before attempting
 903	 * to register it since we can see the same media description multiple
 904	 * times on different connections in case multiple endpoints receive
 905	 * the same call.
 906	 *
 907	 * RTP optimization: if we find a matching media channel expectation
 908	 * and both the expectation and this connection are SNATed, we assume
 909	 * both sides can reach each other directly and use the final
 910	 * destination address from the expectation. We still need to keep
 911	 * the NATed expectations for media that might arrive from the
 912	 * outside, and additionally need to expect the direct RTP stream
 913	 * in case it passes through us even without NAT.
 914	 */
 915	memset(&tuple, 0, sizeof(tuple));
 916	if (saddr)
 917		tuple.src.u3 = *saddr;
 918	tuple.src.l3num		= nf_ct_l3num(ct);
 919	tuple.dst.protonum	= IPPROTO_UDP;
 920	tuple.dst.u3		= *daddr;
 921	tuple.dst.u.udp.port	= port;
 922
 923	do {
 924		exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
 925
 926		if (!exp || exp->master == ct ||
 927		    exp->helper != nfct_help(ct)->helper ||
 928		    exp->class != class)
 929			break;
 930#if IS_ENABLED(CONFIG_NF_NAT)
 931		if (!direct_rtp &&
 932		    (!nf_inet_addr_cmp(&exp->saved_addr, &exp->tuple.dst.u3) ||
 933		     exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) &&
 934		    ct->status & IPS_NAT_MASK) {
 935			*daddr			= exp->saved_addr;
 936			tuple.dst.u3		= exp->saved_addr;
 937			tuple.dst.u.udp.port	= exp->saved_proto.udp.port;
 938			direct_rtp = 1;
 939		} else
 940#endif
 941			skip_expect = 1;
 942	} while (!skip_expect);
 943
 944	base_port = ntohs(tuple.dst.u.udp.port) & ~1;
 945	rtp_port = htons(base_port);
 946	rtcp_port = htons(base_port + 1);
 947
 948	if (direct_rtp) {
 949		hooks = rcu_dereference(nf_nat_sip_hooks);
 950		if (hooks &&
 951		    !hooks->sdp_port(skb, protoff, dataoff, dptr, datalen,
 952				     mediaoff, medialen, ntohs(rtp_port)))
 953			goto err1;
 954	}
 955
 956	if (skip_expect)
 957		return NF_ACCEPT;
 958
 959	rtp_exp = nf_ct_expect_alloc(ct);
 960	if (rtp_exp == NULL)
 961		goto err1;
 962	nf_ct_expect_init(rtp_exp, class, nf_ct_l3num(ct), saddr, daddr,
 963			  IPPROTO_UDP, NULL, &rtp_port);
 964
 965	rtcp_exp = nf_ct_expect_alloc(ct);
 966	if (rtcp_exp == NULL)
 967		goto err2;
 968	nf_ct_expect_init(rtcp_exp, class, nf_ct_l3num(ct), saddr, daddr,
 969			  IPPROTO_UDP, NULL, &rtcp_port);
 970
 971	hooks = rcu_dereference(nf_nat_sip_hooks);
 972	if (hooks && ct->status & IPS_NAT_MASK && !direct_rtp)
 973		ret = hooks->sdp_media(skb, protoff, dataoff, dptr,
 974				       datalen, rtp_exp, rtcp_exp,
 975				       mediaoff, medialen, daddr);
 976	else {
 977		/* -EALREADY handling works around end-points that send
 978		 * SDP messages with identical port but different media type,
 979		 * we pretend expectation was set up.
 980		 * It also works in the case that SDP messages are sent with
 981		 * identical expect tuples but for different master conntracks.
 982		 */
 983		int errp = nf_ct_expect_related(rtp_exp,
 984						NF_CT_EXP_F_SKIP_MASTER);
 985
 986		if (errp == 0 || errp == -EALREADY) {
 987			int errcp = nf_ct_expect_related(rtcp_exp,
 988						NF_CT_EXP_F_SKIP_MASTER);
 989
 990			if (errcp == 0 || errcp == -EALREADY)
 991				ret = NF_ACCEPT;
 992			else if (errp == 0)
 993				nf_ct_unexpect_related(rtp_exp);
 994		}
 995	}
 996	nf_ct_expect_put(rtcp_exp);
 997err2:
 998	nf_ct_expect_put(rtp_exp);
 999err1:
1000	return ret;
1001}
1002
1003static const struct sdp_media_type sdp_media_types[] = {
1004	SDP_MEDIA_TYPE("audio ", SIP_EXPECT_AUDIO),
1005	SDP_MEDIA_TYPE("video ", SIP_EXPECT_VIDEO),
1006	SDP_MEDIA_TYPE("image ", SIP_EXPECT_IMAGE),
1007};
1008
1009static const struct sdp_media_type *sdp_media_type(const char *dptr,
1010						   unsigned int matchoff,
1011						   unsigned int matchlen)
1012{
1013	const struct sdp_media_type *t;
1014	unsigned int i;
1015
1016	for (i = 0; i < ARRAY_SIZE(sdp_media_types); i++) {
1017		t = &sdp_media_types[i];
1018		if (matchlen < t->len ||
1019		    strncmp(dptr + matchoff, t->name, t->len))
1020			continue;
1021		return t;
1022	}
1023	return NULL;
1024}
1025
1026static int process_sdp(struct sk_buff *skb, unsigned int protoff,
1027		       unsigned int dataoff,
1028		       const char **dptr, unsigned int *datalen,
1029		       unsigned int cseq)
1030{
1031	enum ip_conntrack_info ctinfo;
1032	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1033	unsigned int matchoff, matchlen;
1034	unsigned int mediaoff, medialen;
1035	unsigned int sdpoff;
1036	unsigned int caddr_len, maddr_len;
1037	unsigned int i;
1038	union nf_inet_addr caddr, maddr, rtp_addr;
1039	const struct nf_nat_sip_hooks *hooks;
1040	unsigned int port;
1041	const struct sdp_media_type *t;
1042	int ret = NF_ACCEPT;
1043	bool have_rtp_addr = false;
1044
1045	hooks = rcu_dereference(nf_nat_sip_hooks);
1046
1047	/* Find beginning of session description */
1048	if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
1049				  SDP_HDR_VERSION, SDP_HDR_UNSPEC,
1050				  &matchoff, &matchlen) <= 0)
1051		return NF_ACCEPT;
1052	sdpoff = matchoff;
1053
1054	/* The connection information is contained in the session description
1055	 * and/or once per media description. The first media description marks
1056	 * the end of the session description. */
1057	caddr_len = 0;
1058	if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen,
1059				  SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
1060				  &matchoff, &matchlen, &caddr) > 0) {
1061		caddr_len = matchlen;
1062		memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
1063		have_rtp_addr = true;
1064	}
1065
1066	mediaoff = sdpoff;
1067	for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) {
1068		if (ct_sip_get_sdp_header(ct, *dptr, mediaoff, *datalen,
1069					  SDP_HDR_MEDIA, SDP_HDR_UNSPEC,
1070					  &mediaoff, &medialen) <= 0)
1071			break;
1072
1073		/* Get media type and port number. A media port value of zero
1074		 * indicates an inactive stream. */
1075		t = sdp_media_type(*dptr, mediaoff, medialen);
1076		if (!t) {
1077			mediaoff += medialen;
1078			continue;
1079		}
1080		mediaoff += t->len;
1081		medialen -= t->len;
1082
1083		port = simple_strtoul(*dptr + mediaoff, NULL, 10);
1084		if (port == 0)
1085			continue;
1086		if (port < 1024 || port > 65535) {
1087			nf_ct_helper_log(skb, ct, "wrong port %u", port);
1088			return NF_DROP;
1089		}
1090
1091		/* The media description overrides the session description. */
1092		maddr_len = 0;
1093		if (ct_sip_parse_sdp_addr(ct, *dptr, mediaoff, *datalen,
1094					  SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
1095					  &matchoff, &matchlen, &maddr) > 0) {
1096			maddr_len = matchlen;
1097			memcpy(&rtp_addr, &maddr, sizeof(rtp_addr));
1098			have_rtp_addr = true;
1099		} else if (caddr_len) {
1100			memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
1101			have_rtp_addr = true;
1102		} else {
1103			nf_ct_helper_log(skb, ct, "cannot parse SDP message");
1104			return NF_DROP;
1105		}
1106
1107		ret = set_expected_rtp_rtcp(skb, protoff, dataoff,
1108					    dptr, datalen,
1109					    &rtp_addr, htons(port), t->class,
1110					    mediaoff, medialen);
1111		if (ret != NF_ACCEPT) {
1112			nf_ct_helper_log(skb, ct,
1113					 "cannot add expectation for voice");
1114			return ret;
1115		}
1116
1117		/* Update media connection address if present */
1118		if (maddr_len && hooks && ct->status & IPS_NAT_MASK) {
1119			ret = hooks->sdp_addr(skb, protoff, dataoff,
1120					      dptr, datalen, mediaoff,
1121					      SDP_HDR_CONNECTION,
1122					      SDP_HDR_MEDIA,
1123					      &rtp_addr);
1124			if (ret != NF_ACCEPT) {
1125				nf_ct_helper_log(skb, ct, "cannot mangle SDP");
1126				return ret;
1127			}
1128		}
1129		i++;
1130	}
1131
1132	/* Update session connection and owner addresses */
1133	hooks = rcu_dereference(nf_nat_sip_hooks);
1134	if (hooks && ct->status & IPS_NAT_MASK && have_rtp_addr)
1135		ret = hooks->sdp_session(skb, protoff, dataoff,
1136					 dptr, datalen, sdpoff,
1137					 &rtp_addr);
1138
1139	return ret;
1140}
1141static int process_invite_response(struct sk_buff *skb, unsigned int protoff,
1142				   unsigned int dataoff,
1143				   const char **dptr, unsigned int *datalen,
1144				   unsigned int cseq, unsigned int code)
1145{
1146	enum ip_conntrack_info ctinfo;
1147	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1148	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1149
1150	if ((code >= 100 && code <= 199) ||
1151	    (code >= 200 && code <= 299))
1152		return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
1153	else if (ct_sip_info->invite_cseq == cseq)
1154		flush_expectations(ct, true);
1155	return NF_ACCEPT;
1156}
1157
1158static int process_update_response(struct sk_buff *skb, unsigned int protoff,
1159				   unsigned int dataoff,
1160				   const char **dptr, unsigned int *datalen,
1161				   unsigned int cseq, unsigned int code)
1162{
1163	enum ip_conntrack_info ctinfo;
1164	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1165	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1166
1167	if ((code >= 100 && code <= 199) ||
1168	    (code >= 200 && code <= 299))
1169		return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
1170	else if (ct_sip_info->invite_cseq == cseq)
1171		flush_expectations(ct, true);
1172	return NF_ACCEPT;
1173}
1174
1175static int process_prack_response(struct sk_buff *skb, unsigned int protoff,
1176				  unsigned int dataoff,
1177				  const char **dptr, unsigned int *datalen,
1178				  unsigned int cseq, unsigned int code)
1179{
1180	enum ip_conntrack_info ctinfo;
1181	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1182	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1183
1184	if ((code >= 100 && code <= 199) ||
1185	    (code >= 200 && code <= 299))
1186		return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
1187	else if (ct_sip_info->invite_cseq == cseq)
1188		flush_expectations(ct, true);
1189	return NF_ACCEPT;
1190}
1191
1192static int process_invite_request(struct sk_buff *skb, unsigned int protoff,
1193				  unsigned int dataoff,
1194				  const char **dptr, unsigned int *datalen,
1195				  unsigned int cseq)
1196{
1197	enum ip_conntrack_info ctinfo;
1198	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1199	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1200	unsigned int ret;
1201
1202	flush_expectations(ct, true);
1203	ret = process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
1204	if (ret == NF_ACCEPT)
1205		ct_sip_info->invite_cseq = cseq;
1206	return ret;
1207}
1208
1209static int process_bye_request(struct sk_buff *skb, unsigned int protoff,
1210			       unsigned int dataoff,
1211			       const char **dptr, unsigned int *datalen,
1212			       unsigned int cseq)
1213{
1214	enum ip_conntrack_info ctinfo;
1215	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1216
1217	flush_expectations(ct, true);
1218	return NF_ACCEPT;
1219}
1220
1221/* Parse a REGISTER request and create a permanent expectation for incoming
1222 * signalling connections. The expectation is marked inactive and is activated
1223 * when receiving a response indicating success from the registrar.
1224 */
1225static int process_register_request(struct sk_buff *skb, unsigned int protoff,
1226				    unsigned int dataoff,
1227				    const char **dptr, unsigned int *datalen,
1228				    unsigned int cseq)
1229{
1230	enum ip_conntrack_info ctinfo;
1231	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1232	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1233	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1234	unsigned int matchoff, matchlen;
1235	struct nf_conntrack_expect *exp;
1236	union nf_inet_addr *saddr, daddr;
1237	const struct nf_nat_sip_hooks *hooks;
1238	struct nf_conntrack_helper *helper;
1239	__be16 port;
1240	u8 proto;
1241	unsigned int expires = 0;
1242	int ret;
1243
1244	/* Expected connections can not register again. */
1245	if (ct->status & IPS_EXPECTED)
1246		return NF_ACCEPT;
1247
1248	/* We must check the expiration time: a value of zero signals the
1249	 * registrar to release the binding. We'll remove our expectation
1250	 * when receiving the new bindings in the response, but we don't
1251	 * want to create new ones.
1252	 *
1253	 * The expiration time may be contained in Expires: header, the
1254	 * Contact: header parameters or the URI parameters.
1255	 */
1256	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
1257			      &matchoff, &matchlen) > 0)
1258		expires = simple_strtoul(*dptr + matchoff, NULL, 10);
1259
1260	ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
1261				      SIP_HDR_CONTACT, NULL,
1262				      &matchoff, &matchlen, &daddr, &port);
1263	if (ret < 0) {
1264		nf_ct_helper_log(skb, ct, "cannot parse contact");
1265		return NF_DROP;
1266	} else if (ret == 0)
1267		return NF_ACCEPT;
1268
1269	/* We don't support third-party registrations */
1270	if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, &daddr))
1271		return NF_ACCEPT;
1272
1273	if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen, *datalen,
1274				   &proto) == 0)
1275		return NF_ACCEPT;
1276
1277	if (ct_sip_parse_numerical_param(ct, *dptr,
1278					 matchoff + matchlen, *datalen,
1279					 "expires=", NULL, NULL, &expires) < 0) {
1280		nf_ct_helper_log(skb, ct, "cannot parse expires");
1281		return NF_DROP;
1282	}
1283
1284	if (expires == 0) {
1285		ret = NF_ACCEPT;
1286		goto store_cseq;
1287	}
1288
1289	exp = nf_ct_expect_alloc(ct);
1290	if (!exp) {
1291		nf_ct_helper_log(skb, ct, "cannot alloc expectation");
1292		return NF_DROP;
1293	}
1294
1295	saddr = NULL;
1296	if (sip_direct_signalling)
1297		saddr = &ct->tuplehash[!dir].tuple.src.u3;
1298
1299	helper = rcu_dereference(nfct_help(ct)->helper);
1300	if (!helper)
1301		return NF_DROP;
1302
1303	nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
1304			  saddr, &daddr, proto, NULL, &port);
1305	exp->timeout.expires = sip_timeout * HZ;
1306	rcu_assign_pointer(exp->helper, helper);
1307	exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
1308
1309	hooks = rcu_dereference(nf_nat_sip_hooks);
1310	if (hooks && ct->status & IPS_NAT_MASK)
1311		ret = hooks->expect(skb, protoff, dataoff, dptr, datalen,
1312				    exp, matchoff, matchlen);
1313	else {
1314		if (nf_ct_expect_related(exp, 0) != 0) {
1315			nf_ct_helper_log(skb, ct, "cannot add expectation");
1316			ret = NF_DROP;
1317		} else
1318			ret = NF_ACCEPT;
1319	}
1320	nf_ct_expect_put(exp);
1321
1322store_cseq:
1323	if (ret == NF_ACCEPT)
1324		ct_sip_info->register_cseq = cseq;
1325	return ret;
1326}
1327
1328static int process_register_response(struct sk_buff *skb, unsigned int protoff,
1329				     unsigned int dataoff,
1330				     const char **dptr, unsigned int *datalen,
1331				     unsigned int cseq, unsigned int code)
1332{
1333	enum ip_conntrack_info ctinfo;
1334	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1335	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1336	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1337	union nf_inet_addr addr;
1338	__be16 port;
1339	u8 proto;
1340	unsigned int matchoff, matchlen, coff = 0;
1341	unsigned int expires = 0;
1342	int in_contact = 0, ret;
1343
1344	/* According to RFC 3261, "UAs MUST NOT send a new registration until
1345	 * they have received a final response from the registrar for the
1346	 * previous one or the previous REGISTER request has timed out".
1347	 *
1348	 * However, some servers fail to detect retransmissions and send late
1349	 * responses, so we store the sequence number of the last valid
1350	 * request and compare it here.
1351	 */
1352	if (ct_sip_info->register_cseq != cseq)
1353		return NF_ACCEPT;
1354
1355	if (code >= 100 && code <= 199)
1356		return NF_ACCEPT;
1357	if (code < 200 || code > 299)
1358		goto flush;
1359
1360	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
1361			      &matchoff, &matchlen) > 0)
1362		expires = simple_strtoul(*dptr + matchoff, NULL, 10);
1363
1364	while (1) {
1365		unsigned int c_expires = expires;
1366
1367		ret = ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
1368					      SIP_HDR_CONTACT, &in_contact,
1369					      &matchoff, &matchlen,
1370					      &addr, &port);
1371		if (ret < 0) {
1372			nf_ct_helper_log(skb, ct, "cannot parse contact");
1373			return NF_DROP;
1374		} else if (ret == 0)
1375			break;
1376
1377		/* We don't support third-party registrations */
1378		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, &addr))
1379			continue;
1380
1381		if (ct_sip_parse_transport(ct, *dptr, matchoff + matchlen,
1382					   *datalen, &proto) == 0)
1383			continue;
1384
1385		ret = ct_sip_parse_numerical_param(ct, *dptr,
1386						   matchoff + matchlen,
1387						   *datalen, "expires=",
1388						   NULL, NULL, &c_expires);
1389		if (ret < 0) {
1390			nf_ct_helper_log(skb, ct, "cannot parse expires");
1391			return NF_DROP;
1392		}
1393		if (c_expires == 0)
1394			break;
1395		if (refresh_signalling_expectation(ct, &addr, proto, port,
1396						   c_expires))
1397			return NF_ACCEPT;
1398	}
1399
1400flush:
1401	flush_expectations(ct, false);
1402	return NF_ACCEPT;
1403}
1404
1405static const struct sip_handler sip_handlers[] = {
1406	SIP_HANDLER("INVITE", process_invite_request, process_invite_response),
1407	SIP_HANDLER("UPDATE", process_sdp, process_update_response),
1408	SIP_HANDLER("ACK", process_sdp, NULL),
1409	SIP_HANDLER("PRACK", process_sdp, process_prack_response),
1410	SIP_HANDLER("BYE", process_bye_request, NULL),
1411	SIP_HANDLER("REGISTER", process_register_request, process_register_response),
1412};
1413
1414static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
1415				unsigned int dataoff,
1416				const char **dptr, unsigned int *datalen)
1417{
1418	enum ip_conntrack_info ctinfo;
1419	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1420	unsigned int matchoff, matchlen, matchend;
1421	unsigned int code, cseq, i;
1422
1423	if (*datalen < strlen("SIP/2.0 200"))
1424		return NF_ACCEPT;
1425	code = simple_strtoul(*dptr + strlen("SIP/2.0 "), NULL, 10);
1426	if (!code) {
1427		nf_ct_helper_log(skb, ct, "cannot get code");
1428		return NF_DROP;
1429	}
1430
1431	if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
1432			      &matchoff, &matchlen) <= 0) {
1433		nf_ct_helper_log(skb, ct, "cannot parse cseq");
1434		return NF_DROP;
1435	}
1436	cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1437	if (!cseq && *(*dptr + matchoff) != '0') {
1438		nf_ct_helper_log(skb, ct, "cannot get cseq");
1439		return NF_DROP;
1440	}
1441	matchend = matchoff + matchlen + 1;
1442
1443	for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
1444		const struct sip_handler *handler;
1445
1446		handler = &sip_handlers[i];
1447		if (handler->response == NULL)
1448			continue;
1449		if (*datalen < matchend + handler->len ||
1450		    strncasecmp(*dptr + matchend, handler->method, handler->len))
1451			continue;
1452		return handler->response(skb, protoff, dataoff, dptr, datalen,
1453					 cseq, code);
1454	}
1455	return NF_ACCEPT;
1456}
1457
1458static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
1459			       unsigned int dataoff,
1460			       const char **dptr, unsigned int *datalen)
1461{
1462	enum ip_conntrack_info ctinfo;
1463	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1464	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
1465	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1466	unsigned int matchoff, matchlen;
1467	unsigned int cseq, i;
1468	union nf_inet_addr addr;
1469	__be16 port;
1470
1471	/* Many Cisco IP phones use a high source port for SIP requests, but
1472	 * listen for the response on port 5060.  If we are the local
1473	 * router for one of these phones, save the port number from the
1474	 * Via: header so that nf_nat_sip can redirect the responses to
1475	 * the correct port.
1476	 */
1477	if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
1478				    SIP_HDR_VIA_UDP, NULL, &matchoff,
1479				    &matchlen, &addr, &port) > 0 &&
1480	    port != ct->tuplehash[dir].tuple.src.u.udp.port &&
1481	    nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3))
1482		ct_sip_info->forced_dport = port;
1483
1484	for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
1485		const struct sip_handler *handler;
1486
1487		handler = &sip_handlers[i];
1488		if (handler->request == NULL)
1489			continue;
1490		if (*datalen < handler->len + 2 ||
1491		    strncasecmp(*dptr, handler->method, handler->len))
1492			continue;
1493		if ((*dptr)[handler->len] != ' ' ||
1494		    !isalpha((*dptr)[handler->len+1]))
1495			continue;
1496
1497		if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
1498				      &matchoff, &matchlen) <= 0) {
1499			nf_ct_helper_log(skb, ct, "cannot parse cseq");
1500			return NF_DROP;
1501		}
1502		cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1503		if (!cseq && *(*dptr + matchoff) != '0') {
1504			nf_ct_helper_log(skb, ct, "cannot get cseq");
1505			return NF_DROP;
1506		}
1507
1508		return handler->request(skb, protoff, dataoff, dptr, datalen,
1509					cseq);
1510	}
1511	return NF_ACCEPT;
1512}
1513
1514static int process_sip_msg(struct sk_buff *skb, struct nf_conn *ct,
1515			   unsigned int protoff, unsigned int dataoff,
1516			   const char **dptr, unsigned int *datalen)
1517{
1518	const struct nf_nat_sip_hooks *hooks;
1519	int ret;
1520
1521	if (strncasecmp(*dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
1522		ret = process_sip_request(skb, protoff, dataoff, dptr, datalen);
1523	else
1524		ret = process_sip_response(skb, protoff, dataoff, dptr, datalen);
1525
1526	if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
1527		hooks = rcu_dereference(nf_nat_sip_hooks);
1528		if (hooks && !hooks->msg(skb, protoff, dataoff,
1529					 dptr, datalen)) {
1530			nf_ct_helper_log(skb, ct, "cannot NAT SIP message");
1531			ret = NF_DROP;
1532		}
1533	}
1534
1535	return ret;
1536}
1537
1538static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
1539			struct nf_conn *ct, enum ip_conntrack_info ctinfo)
1540{
1541	struct tcphdr *th, _tcph;
1542	unsigned int dataoff, datalen;
1543	unsigned int matchoff, matchlen;
1544	unsigned int msglen, origlen;
1545	const char *dptr, *end;
1546	s16 diff, tdiff = 0;
1547	int ret = NF_ACCEPT;
1548	unsigned long clen;
1549	bool term;
1550
1551	if (ctinfo != IP_CT_ESTABLISHED &&
1552	    ctinfo != IP_CT_ESTABLISHED_REPLY)
1553		return NF_ACCEPT;
1554
1555	/* No Data ? */
1556	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
1557	if (th == NULL)
1558		return NF_ACCEPT;
1559	dataoff = protoff + th->doff * 4;
1560	if (dataoff >= skb->len)
1561		return NF_ACCEPT;
1562
1563	nf_ct_refresh(ct, sip_timeout * HZ);
1564
1565	if (unlikely(skb_linearize(skb)))
1566		return NF_DROP;
1567
1568	dptr = skb->data + dataoff;
1569	datalen = skb->len - dataoff;
1570	if (datalen < strlen("SIP/2.0 200"))
1571		return NF_ACCEPT;
1572
1573	while (1) {
1574		if (ct_sip_get_header(ct, dptr, 0, datalen,
1575				      SIP_HDR_CONTENT_LENGTH,
1576				      &matchoff, &matchlen) <= 0)
1577			break;
1578
1579		clen = simple_strtoul(dptr + matchoff, (char **)&end, 10);
1580		if (dptr + matchoff == end)
1581			break;
1582
1583		if (clen > datalen)
1584			break;
1585
1586		term = false;
1587		for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) {
1588			if (end[0] == '\r' && end[1] == '\n' &&
1589			    end[2] == '\r' && end[3] == '\n') {
1590				term = true;
1591				break;
1592			}
1593		}
1594		if (!term)
1595			break;
1596		end += strlen("\r\n\r\n") + clen;
1597
1598		msglen = origlen = end - dptr;
1599		if (msglen > datalen)
1600			return NF_ACCEPT;
1601
1602		ret = process_sip_msg(skb, ct, protoff, dataoff,
1603				      &dptr, &msglen);
1604		/* process_sip_* functions report why this packet is dropped */
1605		if (ret != NF_ACCEPT)
1606			break;
1607		diff     = msglen - origlen;
1608		tdiff   += diff;
1609
1610		dataoff += msglen;
1611		dptr    += msglen;
1612		datalen  = datalen + diff - msglen;
1613	}
1614
1615	if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
1616		const struct nf_nat_sip_hooks *hooks;
1617
1618		hooks = rcu_dereference(nf_nat_sip_hooks);
1619		if (hooks)
1620			hooks->seq_adjust(skb, protoff, tdiff);
1621	}
1622
1623	return ret;
1624}
1625
1626static int sip_help_udp(struct sk_buff *skb, unsigned int protoff,
1627			struct nf_conn *ct, enum ip_conntrack_info ctinfo)
1628{
1629	unsigned int dataoff, datalen;
1630	const char *dptr;
1631
1632	/* No Data ? */
1633	dataoff = protoff + sizeof(struct udphdr);
1634	if (dataoff >= skb->len)
1635		return NF_ACCEPT;
1636
1637	nf_ct_refresh(ct, sip_timeout * HZ);
1638
1639	if (unlikely(skb_linearize(skb)))
1640		return NF_DROP;
1641
1642	dptr = skb->data + dataoff;
1643	datalen = skb->len - dataoff;
1644	if (datalen < strlen("SIP/2.0 200"))
1645		return NF_ACCEPT;
1646
1647	return process_sip_msg(skb, ct, protoff, dataoff, &dptr, &datalen);
1648}
1649
1650static struct nf_conntrack_helper sip[MAX_PORTS * 4] __read_mostly;
1651
1652static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
1653	[SIP_EXPECT_SIGNALLING] = {
1654		.name		= "signalling",
1655		.max_expected	= 1,
1656		.timeout	= 3 * 60,
1657	},
1658	[SIP_EXPECT_AUDIO] = {
1659		.name		= "audio",
1660		.max_expected	= 2 * IP_CT_DIR_MAX,
1661		.timeout	= 3 * 60,
1662	},
1663	[SIP_EXPECT_VIDEO] = {
1664		.name		= "video",
1665		.max_expected	= 2 * IP_CT_DIR_MAX,
1666		.timeout	= 3 * 60,
1667	},
1668	[SIP_EXPECT_IMAGE] = {
1669		.name		= "image",
1670		.max_expected	= IP_CT_DIR_MAX,
1671		.timeout	= 3 * 60,
1672	},
1673};
1674
1675static void __exit nf_conntrack_sip_fini(void)
1676{
1677	nf_conntrack_helpers_unregister(sip, ports_c * 4);
1678}
1679
1680static int __init nf_conntrack_sip_init(void)
1681{
1682	int i, ret;
1683
1684	NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_sip_master));
1685
1686	if (ports_c == 0)
1687		ports[ports_c++] = SIP_PORT;
1688
1689	for (i = 0; i < ports_c; i++) {
1690		nf_ct_helper_init(&sip[4 * i], AF_INET, IPPROTO_UDP,
1691				  HELPER_NAME, SIP_PORT, ports[i], i,
1692				  sip_exp_policy, SIP_EXPECT_MAX, sip_help_udp,
1693				  NULL, THIS_MODULE);
1694		nf_ct_helper_init(&sip[4 * i + 1], AF_INET, IPPROTO_TCP,
1695				  HELPER_NAME, SIP_PORT, ports[i], i,
1696				  sip_exp_policy, SIP_EXPECT_MAX, sip_help_tcp,
1697				  NULL, THIS_MODULE);
1698		nf_ct_helper_init(&sip[4 * i + 2], AF_INET6, IPPROTO_UDP,
1699				  HELPER_NAME, SIP_PORT, ports[i], i,
1700				  sip_exp_policy, SIP_EXPECT_MAX, sip_help_udp,
1701				  NULL, THIS_MODULE);
1702		nf_ct_helper_init(&sip[4 * i + 3], AF_INET6, IPPROTO_TCP,
1703				  HELPER_NAME, SIP_PORT, ports[i], i,
1704				  sip_exp_policy, SIP_EXPECT_MAX, sip_help_tcp,
1705				  NULL, THIS_MODULE);
1706	}
1707
1708	ret = nf_conntrack_helpers_register(sip, ports_c * 4);
1709	if (ret < 0) {
1710		pr_err("failed to register helpers\n");
1711		return ret;
1712	}
1713	return 0;
1714}
1715
1716module_init(nf_conntrack_sip_init);
1717module_exit(nf_conntrack_sip_fini);