SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/netfilter/nf_conntrack_sip.c

   1 /* SIP extension for IP connection tracking.
   2  *
   3  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
   4  * based on RR's ip_conntrack_ftp.c and other modules.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/ctype.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/inet.h>
  15 #include <linux/in.h>
  16 #include <linux/udp.h>
  17 #include <linux/netfilter.h>
  18
  19 #include <net/netfilter/nf_conntrack.h>
  20 #include <net/netfilter/nf_conntrack_core.h>
  21 #include <net/netfilter/nf_conntrack_expect.h>
  22 #include <net/netfilter/nf_conntrack_helper.h>
  23 #include <linux/netfilter/nf_conntrack_sip.h>
  24
  25 MODULE_LICENSE("GPL");
  26 MODULE_AUTHOR("Christian Hentschel <chentschel@arnet.com.ar>");
  27 MODULE_DESCRIPTION("SIP connection tracking helper");
  28 MODULE_ALIAS("ip_conntrack_sip");
  29
  30 #define MAX_PORTS       8
  31 static unsigned short ports[MAX_PORTS];
  32 static unsigned int ports_c;
  33 module_param_array(ports, ushort, &ports_c, 0400);
  34 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
  35
  36 static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
  37 module_param(sip_timeout, uint, 0600);
  38 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
  39
  40 static int sip_direct_signalling __read_mostly = 1;
  41 module_param(sip_direct_signalling, int, 0600);
  42 MODULE_PARM_DESC(sip_direct_signalling, "expect incoming calls from registrar "
  43                                         "only (default 1)");
  44
  45 static int sip_direct_media __read_mostly = 1;
  46 module_param(sip_direct_media, int, 0600);
  47 MODULE_PARM_DESC(sip_direct_media, "Expect Media streams between signalling "
  48                                    "endpoints only (default 1)");
  49
  50 unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
  51                                 const char **dptr,
  52                                 unsigned int *datalen) __read_mostly;
  53 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
  54
  55 unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
  56                                        const char **dptr,
  57                                        unsigned int *datalen,
  58                                        struct nf_conntrack_expect *exp,
  59                                        unsigned int matchoff,
  60                                        unsigned int matchlen) __read_mostly;
  61 EXPORT_SYMBOL_GPL(nf_nat_sip_expect_hook);
  62
  63 unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb,
  64                                      const char **dptr,
  65                                      unsigned int dataoff,
  66                                      unsigned int *datalen,
  67                                      enum sdp_header_types type,
  68                                      enum sdp_header_types term,
  69                                      const union nf_inet_addr *addr)
  70                                      __read_mostly;
  71 EXPORT_SYMBOL_GPL(nf_nat_sdp_addr_hook);
  72
  73 unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
  74                                         const char **dptr,
  75                                         unsigned int dataoff,
  76                                         unsigned int *datalen,
  77                                         const union nf_inet_addr *addr)
  78                                         __read_mostly;
  79 EXPORT_SYMBOL_GPL(nf_nat_sdp_session_hook);
  80
  81 unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb,
  82                                       const char **dptr,
  83                                       unsigned int *datalen,
  84                                       struct nf_conntrack_expect *rtp_exp,
  85                                       struct nf_conntrack_expect *rtcp_exp,
  86                                       unsigned int mediaoff,
  87                                       unsigned int medialen,
  88                                       union nf_inet_addr *rtp_addr)
  89                                       __read_mostly;
  90 EXPORT_SYMBOL_GPL(nf_nat_sdp_media_hook);
  91
  92 static int string_len(const struct nf_conn *ct, const char *dptr,
  93                       const char *limit, int *shift)
  94 {
  95         int len = 0;
  96
  97         while (dptr < limit && isalpha(*dptr)) {
  98                 dptr++;
  99                 len++;
 100         }
 101         return len;
 102 }
 103
 104 static int digits_len(const struct nf_conn *ct, const char *dptr,
 105                       const char *limit, int *shift)
 106 {
 107         int len = 0;
 108         while (dptr < limit && isdigit(*dptr)) {
 109                 dptr++;
 110                 len++;
 111         }
 112         return len;
 113 }
 114
 115 /* get media type + port length */
 116 static int media_len(const struct nf_conn *ct, const char *dptr,
 117                      const char *limit, int *shift)
 118 {
 119         int len = string_len(ct, dptr, limit, shift);
 120
 121         dptr += len;
 122         if (dptr >= limit || *dptr != ' ')
 123                 return 0;
 124         len++;
 125         dptr++;
 126
 127         return len + digits_len(ct, dptr, limit, shift);
 128 }
 129
 130 static int parse_addr(const struct nf_conn *ct, const char *cp,
 131                       const char **endp, union nf_inet_addr *addr,
 132                       const char *limit)
 133 {
 134         const char *end;
 135         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 136         int ret = 0;
 137
 138         switch (family) {
 139         case AF_INET:
 140                 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
 141                 break;
 142         case AF_INET6:
 143                 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
 144                 break;
 145         default:
 146                 BUG();
 147         }
 148
 149         if (ret == 0 || end == cp)
 150                 return 0;
 151         if (endp)
 152                 *endp = end;
 153         return 1;
 154 }
 155
 156 /* skip ip address. returns its length. */
 157 static int epaddr_len(const struct nf_conn *ct, const char *dptr,
 158                       const char *limit, int *shift)
 159 {
 160         union nf_inet_addr addr;
 161         const char *aux = dptr;
 162
 163         if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
 164                 pr_debug("ip: %s parse failed.!\n", dptr);
 165                 return 0;
 166         }
 167
 168         /* Port number */
 169         if (*dptr == ':') {
 170                 dptr++;
 171                 dptr += digits_len(ct, dptr, limit, shift);
 172         }
 173         return dptr - aux;
 174 }
 175
 176 /* get address length, skiping user info. */
 177 static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
 178                           const char *limit, int *shift)
 179 {
 180         const char *start = dptr;
 181         int s = *shift;
 182
 183         /* Search for @, but stop at the end of the line.
 184          * We are inside a sip: URI, so we don't need to worry about
 185          * continuation lines. */
 186         while (dptr < limit &&
 187                *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
 188                 (*shift)++;
 189                 dptr++;
 190         }
 191
 192         if (dptr < limit && *dptr == '@') {
 193                 dptr++;
 194                 (*shift)++;
 195         } else {
 196                 dptr = start;
 197                 *shift = s;
 198         }
 199
 200         return epaddr_len(ct, dptr, limit, shift);
 201 }
 202
 203 /* Parse a SIP request line of the form:
 204  *
 205  * Request-Line = Method SP Request-URI SP SIP-Version CRLF
 206  *
 207  * and return the offset and length of the address contained in the Request-URI.
 208  */
 209 int ct_sip_parse_request(const struct nf_conn *ct,
 210                          const char *dptr, unsigned int datalen,
 211                          unsigned int *matchoff, unsigned int *matchlen,
 212                          union nf_inet_addr *addr, __be16 *port)
 213 {
 214         const char *start = dptr, *limit = dptr + datalen, *end;
 215         unsigned int mlen;
 216         unsigned int p;
 217         int shift = 0;
 218
 219         /* Skip method and following whitespace */
 220         mlen = string_len(ct, dptr, limit, NULL);
 221         if (!mlen)
 222                 return 0;
 223         dptr += mlen;
 224         if (++dptr >= limit)
 225                 return 0;
 226
 227         /* Find SIP URI */
 228         limit -= strlen("sip:");
 229         for (; dptr < limit; dptr++) {
 230                 if (*dptr == '\r' || *dptr == '\n')
 231                         return -1;
 232                 if (strnicmp(dptr, "sip:", strlen("sip:")) == 0)
 233                         break;
 234         }
 235         if (!skp_epaddr_len(ct, dptr, limit, &shift))
 236                 return 0;
 237         dptr += shift;
 238
 239         if (!parse_addr(ct, dptr, &end, addr, limit))
 240                 return -1;
 241         if (end < limit && *end == ':') {
 242                 end++;
 243                 p = simple_strtoul(end, (char **)&end, 10);
 244                 if (p < 1024 || p > 65535)
 245                         return -1;
 246                 *port = htons(p);
 247         } else
 248                 *port = htons(SIP_PORT);
 249
 250         if (end == dptr)
 251                 return 0;
 252         *matchoff = dptr - start;
 253         *matchlen = end - dptr;
 254         return 1;
 255 }
 256 EXPORT_SYMBOL_GPL(ct_sip_parse_request);
 257
 258 /* SIP header parsing: SIP headers are located at the beginning of a line, but
 259  * may span several lines, in which case the continuation lines begin with a
 260  * whitespace character. RFC 2543 allows lines to be terminated with CR, LF or
 261  * CRLF, RFC 3261 allows only CRLF, we support both.
 262  *
 263  * Headers are followed by (optionally) whitespace, a colon, again (optionally)
 264  * whitespace and the values. Whitespace in this context means any amount of
 265  * tabs, spaces and continuation lines, which are treated as a single whitespace
 266  * character.
 267  *
 268  * Some headers may appear multiple times. A comma seperated list of values is
 269  * equivalent to multiple headers.
 270  */
 271 static const struct sip_header ct_sip_hdrs[] = {
 272         [SIP_HDR_CSEQ]                  = SIP_HDR("CSeq", NULL, NULL, digits_len),
 273         [SIP_HDR_FROM]                  = SIP_HDR("From", "f", "sip:", skp_epaddr_len),
 274         [SIP_HDR_TO]                    = SIP_HDR("To", "t", "sip:", skp_epaddr_len),
 275         [SIP_HDR_CONTACT]               = SIP_HDR("Contact", "m", "sip:", skp_epaddr_len),
 276         [SIP_HDR_VIA]                   = SIP_HDR("Via", "v", "UDP ", epaddr_len),
 277         [SIP_HDR_EXPIRES]               = SIP_HDR("Expires", NULL, NULL, digits_len),
 278         [SIP_HDR_CONTENT_LENGTH]        = SIP_HDR("Content-Length", "l", NULL, digits_len),
 279 };
 280
 281 static const char *sip_follow_continuation(const char *dptr, const char *limit)
 282 {
 283         /* Walk past newline */
 284         if (++dptr >= limit)
 285                 return NULL;
 286
 287         /* Skip '\n' in CR LF */
 288         if (*(dptr - 1) == '\r' && *dptr == '\n') {
 289                 if (++dptr >= limit)
 290                         return NULL;
 291         }
 292
 293         /* Continuation line? */
 294         if (*dptr != ' ' && *dptr != '\t')
 295                 return NULL;
 296
 297         /* skip leading whitespace */
 298         for (; dptr < limit; dptr++) {
 299                 if (*dptr != ' ' && *dptr != '\t')
 300                         break;
 301         }
 302         return dptr;
 303 }
 304
 305 static const char *sip_skip_whitespace(const char *dptr, const char *limit)
 306 {
 307         for (; dptr < limit; dptr++) {
 308                 if (*dptr == ' ')
 309                         continue;
 310                 if (*dptr != '\r' && *dptr != '\n')
 311                         break;
 312                 dptr = sip_follow_continuation(dptr, limit);
 313                 if (dptr == NULL)
 314                         return NULL;
 315         }
 316         return dptr;
 317 }
 318
 319 /* Search within a SIP header value, dealing with continuation lines */
 320 static const char *ct_sip_header_search(const char *dptr, const char *limit,
 321                                         const char *needle, unsigned int len)
 322 {
 323         for (limit -= len; dptr < limit; dptr++) {
 324                 if (*dptr == '\r' || *dptr == '\n') {
 325                         dptr = sip_follow_continuation(dptr, limit);
 326                         if (dptr == NULL)
 327                                 break;
 328                         continue;
 329                 }
 330
 331                 if (strnicmp(dptr, needle, len) == 0)
 332                         return dptr;
 333         }
 334         return NULL;
 335 }
 336
 337 int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
 338                       unsigned int dataoff, unsigned int datalen,
 339                       enum sip_header_types type,
 340                       unsigned int *matchoff, unsigned int *matchlen)
 341 {
 342         const struct sip_header *hdr = &ct_sip_hdrs[type];
 343         const char *start = dptr, *limit = dptr + datalen;
 344         int shift = 0;
 345
 346         for (dptr += dataoff; dptr < limit; dptr++) {
 347                 /* Find beginning of line */
 348                 if (*dptr != '\r' && *dptr != '\n')
 349                         continue;
 350                 if (++dptr >= limit)
 351                         break;
 352                 if (*(dptr - 1) == '\r' && *dptr == '\n') {
 353                         if (++dptr >= limit)
 354                                 break;
 355                 }
 356
 357                 /* Skip continuation lines */
 358                 if (*dptr == ' ' || *dptr == '\t')
 359                         continue;
 360
 361                 /* Find header. Compact headers must be followed by a
 362                  * non-alphabetic character to avoid mismatches. */
 363                 if (limit - dptr >= hdr->len &&
 364                     strnicmp(dptr, hdr->name, hdr->len) == 0)
 365                         dptr += hdr->len;
 366                 else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
 367                          strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
 368                          !isalpha(*(dptr + hdr->clen + 1)))
 369                         dptr += hdr->clen;
 370                 else
 371                         continue;
 372
 373                 /* Find and skip colon */
 374                 dptr = sip_skip_whitespace(dptr, limit);
 375                 if (dptr == NULL)
 376                         break;
 377                 if (*dptr != ':' || ++dptr >= limit)
 378                         break;
 379
 380                 /* Skip whitespace after colon */
 381                 dptr = sip_skip_whitespace(dptr, limit);
 382                 if (dptr == NULL)
 383                         break;
 384
 385                 *matchoff = dptr - start;
 386                 if (hdr->search) {
 387                         dptr = ct_sip_header_search(dptr, limit, hdr->search,
 388                                                     hdr->slen);
 389                         if (!dptr)
 390                                 return -1;
 391                         dptr += hdr->slen;
 392                 }
 393
 394                 *matchlen = hdr->match_len(ct, dptr, limit, &shift);
 395                 if (!*matchlen)
 396                         return -1;
 397                 *matchoff = dptr - start + shift;
 398                 return 1;
 399         }
 400         return 0;
 401 }
 402 EXPORT_SYMBOL_GPL(ct_sip_get_header);
 403
 404 /* Get next header field in a list of comma seperated values */
 405 static int ct_sip_next_header(const struct nf_conn *ct, const char *dptr,
 406                               unsigned int dataoff, unsigned int datalen,
 407                               enum sip_header_types type,
 408                               unsigned int *matchoff, unsigned int *matchlen)
 409 {
 410         const struct sip_header *hdr = &ct_sip_hdrs[type];
 411         const char *start = dptr, *limit = dptr + datalen;
 412         int shift = 0;
 413
 414         dptr += dataoff;
 415
 416         dptr = ct_sip_header_search(dptr, limit, ",", strlen(","));
 417         if (!dptr)
 418                 return 0;
 419
 420         dptr = ct_sip_header_search(dptr, limit, hdr->search, hdr->slen);
 421         if (!dptr)
 422                 return 0;
 423         dptr += hdr->slen;
 424
 425         *matchoff = dptr - start;
 426         *matchlen = hdr->match_len(ct, dptr, limit, &shift);
 427         if (!*matchlen)
 428                 return -1;
 429         *matchoff += shift;
 430         return 1;
 431 }
 432
 433 /* Walk through headers until a parsable one is found or no header of the
 434  * given type is left. */
 435 static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
 436                                unsigned int dataoff, unsigned int datalen,
 437                                enum sip_header_types type, int *in_header,
 438                                unsigned int *matchoff, unsigned int *matchlen)
 439 {
 440         int ret;
 441
 442         if (in_header && *in_header) {
 443                 while (1) {
 444                         ret = ct_sip_next_header(ct, dptr, dataoff, datalen,
 445                                                  type, matchoff, matchlen);
 446                         if (ret > 0)
 447                                 return ret;
 448                         if (ret == 0)
 449                                 break;
 450                         dataoff += *matchoff;
 451                 }
 452                 *in_header = 0;
 453         }
 454
 455         while (1) {
 456                 ret = ct_sip_get_header(ct, dptr, dataoff, datalen,
 457                                         type, matchoff, matchlen);
 458                 if (ret > 0)
 459                         break;
 460                 if (ret == 0)
 461                         return ret;
 462                 dataoff += *matchoff;
 463         }
 464
 465         if (in_header)
 466                 *in_header = 1;
 467         return 1;
 468 }
 469
 470 /* Locate a SIP header, parse the URI and return the offset and length of
 471  * the address as well as the address and port themselves. A stream of
 472  * headers can be parsed by handing in a non-NULL datalen and in_header
 473  * pointer.
 474  */
 475 int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
 476                             unsigned int *dataoff, unsigned int datalen,
 477                             enum sip_header_types type, int *in_header,
 478                             unsigned int *matchoff, unsigned int *matchlen,
 479                             union nf_inet_addr *addr, __be16 *port)
 480 {
 481         const char *c, *limit = dptr + datalen;
 482         unsigned int p;
 483         int ret;
 484
 485         ret = ct_sip_walk_headers(ct, dptr, dataoff ? *dataoff : 0, datalen,
 486                                   type, in_header, matchoff, matchlen);
 487         WARN_ON(ret < 0);
 488         if (ret == 0)
 489                 return ret;
 490
 491         if (!parse_addr(ct, dptr + *matchoff, &c, addr, limit))
 492                 return -1;
 493         if (*c == ':') {
 494                 c++;
 495                 p = simple_strtoul(c, (char **)&c, 10);
 496                 if (p < 1024 || p > 65535)
 497                         return -1;
 498                 *port = htons(p);
 499         } else
 500                 *port = htons(SIP_PORT);
 501
 502         if (dataoff)
 503                 *dataoff = c - dptr;
 504         return 1;
 505 }
 506 EXPORT_SYMBOL_GPL(ct_sip_parse_header_uri);
 507
 508 /* Parse address from header parameter and return address, offset and length */
 509 int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
 510                                unsigned int dataoff, unsigned int datalen,
 511                                const char *name,
 512                                unsigned int *matchoff, unsigned int *matchlen,
 513                                union nf_inet_addr *addr)
 514 {
 515         const char *limit = dptr + datalen;
 516         const char *start, *end;
 517
 518         limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 519         if (!limit)
 520                 limit = dptr + datalen;
 521
 522         start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 523         if (!start)
 524                 return 0;
 525
 526         start += strlen(name);
 527         if (!parse_addr(ct, start, &end, addr, limit))
 528                 return 0;
 529         *matchoff = start - dptr;
 530         *matchlen = end - start;
 531         return 1;
 532 }
 533 EXPORT_SYMBOL_GPL(ct_sip_parse_address_param);
 534
 535 /* Parse numerical header parameter and return value, offset and length */
 536 int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
 537                                  unsigned int dataoff, unsigned int datalen,
 538                                  const char *name,
 539                                  unsigned int *matchoff, unsigned int *matchlen,
 540                                  unsigned int *val)
 541 {
 542         const char *limit = dptr + datalen;
 543         const char *start;
 544         char *end;
 545
 546         limit = ct_sip_header_search(dptr + dataoff, limit, ",", strlen(","));
 547         if (!limit)
 548                 limit = dptr + datalen;
 549
 550         start = ct_sip_header_search(dptr + dataoff, limit, name, strlen(name));
 551         if (!start)
 552                 return 0;
 553
 554         start += strlen(name);
 555         *val = simple_strtoul(start, &end, 0);
 556         if (start == end)
 557                 return 0;
 558         if (matchoff && matchlen) {
 559                 *matchoff = start - dptr;
 560                 *matchlen = end - start;
 561         }
 562         return 1;
 563 }
 564 EXPORT_SYMBOL_GPL(ct_sip_parse_numerical_param);
 565
 566 /* SDP header parsing: a SDP session description contains an ordered set of
 567  * headers, starting with a section containing general session parameters,
 568  * optionally followed by multiple media descriptions.
 569  *
 570  * SDP headers always start at the beginning of a line. According to RFC 2327:
 571  * "The sequence CRLF (0x0d0a) is used to end a record, although parsers should
 572  * be tolerant and also accept records terminated with a single newline
 573  * character". We handle both cases.
 574  */
 575 static const struct sip_header ct_sdp_hdrs[] = {
 576         [SDP_HDR_VERSION]               = SDP_HDR("v=", NULL, digits_len),
 577         [SDP_HDR_OWNER_IP4]             = SDP_HDR("o=", "IN IP4 ", epaddr_len),
 578         [SDP_HDR_CONNECTION_IP4]        = SDP_HDR("c=", "IN IP4 ", epaddr_len),
 579         [SDP_HDR_OWNER_IP6]             = SDP_HDR("o=", "IN IP6 ", epaddr_len),
 580         [SDP_HDR_CONNECTION_IP6]        = SDP_HDR("c=", "IN IP6 ", epaddr_len),
 581         [SDP_HDR_MEDIA]                 = SDP_HDR("m=", NULL, media_len),
 582 };
 583
 584 /* Linear string search within SDP header values */
 585 static const char *ct_sdp_header_search(const char *dptr, const char *limit,
 586                                         const char *needle, unsigned int len)
 587 {
 588         for (limit -= len; dptr < limit; dptr++) {
 589                 if (*dptr == '\r' || *dptr == '\n')
 590                         break;
 591                 if (strncmp(dptr, needle, len) == 0)
 592                         return dptr;
 593         }
 594         return NULL;
 595 }
 596
 597 /* Locate a SDP header (optionally a substring within the header value),
 598  * optionally stopping at the first occurence of the term header, parse
 599  * it and return the offset and length of the data we're interested in.
 600  */
 601 int ct_sip_get_sdp_header(const struct nf_conn *ct, const char *dptr,
 602                           unsigned int dataoff, unsigned int datalen,
 603                           enum sdp_header_types type,
 604                           enum sdp_header_types term,
 605                           unsigned int *matchoff, unsigned int *matchlen)
 606 {
 607         const struct sip_header *hdr = &ct_sdp_hdrs[type];
 608         const struct sip_header *thdr = &ct_sdp_hdrs[term];
 609         const char *start = dptr, *limit = dptr + datalen;
 610         int shift = 0;
 611
 612         for (dptr += dataoff; dptr < limit; dptr++) {
 613                 /* Find beginning of line */
 614                 if (*dptr != '\r' && *dptr != '\n')
 615                         continue;
 616                 if (++dptr >= limit)
 617                         break;
 618                 if (*(dptr - 1) == '\r' && *dptr == '\n') {
 619                         if (++dptr >= limit)
 620                                 break;
 621                 }
 622
 623                 if (term != SDP_HDR_UNSPEC &&
 624                     limit - dptr >= thdr->len &&
 625                     strnicmp(dptr, thdr->name, thdr->len) == 0)
 626                         break;
 627                 else if (limit - dptr >= hdr->len &&
 628                          strnicmp(dptr, hdr->name, hdr->len) == 0)
 629                         dptr += hdr->len;
 630                 else
 631                         continue;
 632
 633                 *matchoff = dptr - start;
 634                 if (hdr->search) {
 635                         dptr = ct_sdp_header_search(dptr, limit, hdr->search,
 636                                                     hdr->slen);
 637                         if (!dptr)
 638                                 return -1;
 639                         dptr += hdr->slen;
 640                 }
 641
 642                 *matchlen = hdr->match_len(ct, dptr, limit, &shift);
 643                 if (!*matchlen)
 644                         return -1;
 645                 *matchoff = dptr - start + shift;
 646                 return 1;
 647         }
 648         return 0;
 649 }
 650 EXPORT_SYMBOL_GPL(ct_sip_get_sdp_header);
 651
 652 static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr,
 653                                  unsigned int dataoff, unsigned int datalen,
 654                                  enum sdp_header_types type,
 655                                  enum sdp_header_types term,
 656                                  unsigned int *matchoff, unsigned int *matchlen,
 657                                  union nf_inet_addr *addr)
 658 {
 659         int ret;
 660
 661         ret = ct_sip_get_sdp_header(ct, dptr, dataoff, datalen, type, term,
 662                                     matchoff, matchlen);
 663         if (ret <= 0)
 664                 return ret;
 665
 666         if (!parse_addr(ct, dptr + *matchoff, NULL, addr,
 667                         dptr + *matchoff + *matchlen))
 668                 return -1;
 669         return 1;
 670 }
 671
 672 static int refresh_signalling_expectation(struct nf_conn *ct,
 673                                           union nf_inet_addr *addr,
 674                                           __be16 port,
 675                                           unsigned int expires)
 676 {
 677         struct nf_conn_help *help = nfct_help(ct);
 678         struct nf_conntrack_expect *exp;
 679         struct hlist_node *n, *next;
 680         int found = 0;
 681
 682         spin_lock_bh(&nf_conntrack_lock);
 683         hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
 684                 if (exp->class != SIP_EXPECT_SIGNALLING ||
 685                     !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
 686                     exp->tuple.dst.u.udp.port != port)
 687                         continue;
 688                 if (!del_timer(&exp->timeout))
 689                         continue;
 690                 exp->flags &= ~NF_CT_EXPECT_INACTIVE;
 691                 exp->timeout.expires = jiffies + expires * HZ;
 692                 add_timer(&exp->timeout);
 693                 found = 1;
 694                 break;
 695         }
 696         spin_unlock_bh(&nf_conntrack_lock);
 697         return found;
 698 }
 699
 700 static void flush_expectations(struct nf_conn *ct, bool media)
 701 {
 702         struct nf_conn_help *help = nfct_help(ct);
 703         struct nf_conntrack_expect *exp;
 704         struct hlist_node *n, *next;
 705
 706         spin_lock_bh(&nf_conntrack_lock);
 707         hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
 708                 if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
 709                         continue;
 710                 if (!del_timer(&exp->timeout))
 711                         continue;
 712                 nf_ct_unlink_expect(exp);
 713                 nf_ct_expect_put(exp);
 714                 if (!media)
 715                         break;
 716         }
 717         spin_unlock_bh(&nf_conntrack_lock);
 718 }
 719
 720 static int set_expected_rtp_rtcp(struct sk_buff *skb,
 721                                  const char **dptr, unsigned int *datalen,
 722                                  union nf_inet_addr *daddr, __be16 port,
 723                                  enum sip_expectation_classes class,
 724                                  unsigned int mediaoff, unsigned int medialen)
 725 {
 726         struct nf_conntrack_expect *exp, *rtp_exp, *rtcp_exp;
 727         enum ip_conntrack_info ctinfo;
 728         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 729         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 730         union nf_inet_addr *saddr;
 731         struct nf_conntrack_tuple tuple;
 732         int family = ct->tuplehash[!dir].tuple.src.l3num;
 733         int skip_expect = 0, ret = NF_DROP;
 734         u_int16_t base_port;
 735         __be16 rtp_port, rtcp_port;
 736         typeof(nf_nat_sdp_media_hook) nf_nat_sdp_media;
 737
 738         saddr = NULL;
 739         if (sip_direct_media) {
 740                 if (!nf_inet_addr_cmp(daddr, &ct->tuplehash[dir].tuple.src.u3))
 741                         return NF_ACCEPT;
 742                 saddr = &ct->tuplehash[!dir].tuple.src.u3;
 743         }
 744
 745         /* We need to check whether the registration exists before attempting
 746          * to register it since we can see the same media description multiple
 747          * times on different connections in case multiple endpoints receive
 748          * the same call.
 749          */
 750         memset(&tuple, 0, sizeof(tuple));
 751         if (saddr)
 752                 tuple.src.u3 = *saddr;
 753         tuple.src.l3num         = family;
 754         tuple.dst.protonum      = IPPROTO_UDP;
 755         tuple.dst.u3            = *daddr;
 756         tuple.dst.u.udp.port    = port;
 757
 758         rcu_read_lock();
 759         exp = __nf_ct_expect_find(&tuple);
 760         if (exp && exp->master != ct &&
 761             nfct_help(exp->master)->helper == nfct_help(ct)->helper &&
 762             exp->class == class)
 763                 skip_expect = 1;
 764         rcu_read_unlock();
 765
 766         if (skip_expect)
 767                 return NF_ACCEPT;
 768
 769         base_port = ntohs(tuple.dst.u.udp.port) & ~1;
 770         rtp_port = htons(base_port);
 771         rtcp_port = htons(base_port + 1);
 772
 773         rtp_exp = nf_ct_expect_alloc(ct);
 774         if (rtp_exp == NULL)
 775                 goto err1;
 776         nf_ct_expect_init(rtp_exp, class, family, saddr, daddr,
 777                           IPPROTO_UDP, NULL, &rtp_port);
 778
 779         rtcp_exp = nf_ct_expect_alloc(ct);
 780         if (rtcp_exp == NULL)
 781                 goto err2;
 782         nf_ct_expect_init(rtcp_exp, class, family, saddr, daddr,
 783                           IPPROTO_UDP, NULL, &rtcp_port);
 784
 785         nf_nat_sdp_media = rcu_dereference(nf_nat_sdp_media_hook);
 786         if (nf_nat_sdp_media && ct->status & IPS_NAT_MASK)
 787                 ret = nf_nat_sdp_media(skb, dptr, datalen, rtp_exp, rtcp_exp,
 788                                        mediaoff, medialen, daddr);
 789         else {
 790                 if (nf_ct_expect_related(rtp_exp) == 0) {
 791                         if (nf_ct_expect_related(rtcp_exp) != 0)
 792                                 nf_ct_unexpect_related(rtp_exp);
 793                         else
 794                                 ret = NF_ACCEPT;
 795                 }
 796         }
 797         nf_ct_expect_put(rtcp_exp);
 798 err2:
 799         nf_ct_expect_put(rtp_exp);
 800 err1:
 801         return ret;
 802 }
 803
 804 static const struct sdp_media_type sdp_media_types[] = {
 805         SDP_MEDIA_TYPE("audio ", SIP_EXPECT_AUDIO),
 806         SDP_MEDIA_TYPE("video ", SIP_EXPECT_VIDEO),
 807 };
 808
 809 static const struct sdp_media_type *sdp_media_type(const char *dptr,
 810                                                    unsigned int matchoff,
 811                                                    unsigned int matchlen)
 812 {
 813         const struct sdp_media_type *t;
 814         unsigned int i;
 815
 816         for (i = 0; i < ARRAY_SIZE(sdp_media_types); i++) {
 817                 t = &sdp_media_types[i];
 818                 if (matchlen < t->len ||
 819                     strncmp(dptr + matchoff, t->name, t->len))
 820                         continue;
 821                 return t;
 822         }
 823         return NULL;
 824 }
 825
 826 static int process_sdp(struct sk_buff *skb,
 827                        const char **dptr, unsigned int *datalen,
 828                        unsigned int cseq)
 829 {
 830         enum ip_conntrack_info ctinfo;
 831         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 832         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 833         unsigned int matchoff, matchlen;
 834         unsigned int mediaoff, medialen;
 835         unsigned int sdpoff;
 836         unsigned int caddr_len, maddr_len;
 837         unsigned int i;
 838         union nf_inet_addr caddr, maddr, rtp_addr;
 839         unsigned int port;
 840         enum sdp_header_types c_hdr;
 841         const struct sdp_media_type *t;
 842         int ret = NF_ACCEPT;
 843         typeof(nf_nat_sdp_addr_hook) nf_nat_sdp_addr;
 844         typeof(nf_nat_sdp_session_hook) nf_nat_sdp_session;
 845
 846         nf_nat_sdp_addr = rcu_dereference(nf_nat_sdp_addr_hook);
 847         c_hdr = family == AF_INET ? SDP_HDR_CONNECTION_IP4 :
 848                                     SDP_HDR_CONNECTION_IP6;
 849
 850         /* Find beginning of session description */
 851         if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
 852                                   SDP_HDR_VERSION, SDP_HDR_UNSPEC,
 853                                   &matchoff, &matchlen) <= 0)
 854                 return NF_ACCEPT;
 855         sdpoff = matchoff;
 856
 857         /* The connection information is contained in the session description
 858          * and/or once per media description. The first media description marks
 859          * the end of the session description. */
 860         caddr_len = 0;
 861         if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen,
 862                                   c_hdr, SDP_HDR_MEDIA,
 863                                   &matchoff, &matchlen, &caddr) > 0)
 864                 caddr_len = matchlen;
 865
 866         mediaoff = sdpoff;
 867         for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) {
 868                 if (ct_sip_get_sdp_header(ct, *dptr, mediaoff, *datalen,
 869                                           SDP_HDR_MEDIA, SDP_HDR_UNSPEC,
 870                                           &mediaoff, &medialen) <= 0)
 871                         break;
 872
 873                 /* Get media type and port number. A media port value of zero
 874                  * indicates an inactive stream. */
 875                 t = sdp_media_type(*dptr, mediaoff, medialen);
 876                 if (!t) {
 877                         mediaoff += medialen;
 878                         continue;
 879                 }
 880                 mediaoff += t->len;
 881                 medialen -= t->len;
 882
 883                 port = simple_strtoul(*dptr + mediaoff, NULL, 10);
 884                 if (port == 0)
 885                         continue;
 886                 if (port < 1024 || port > 65535)
 887                         return NF_DROP;
 888
 889                 /* The media description overrides the session description. */
 890                 maddr_len = 0;
 891                 if (ct_sip_parse_sdp_addr(ct, *dptr, mediaoff, *datalen,
 892                                           c_hdr, SDP_HDR_MEDIA,
 893                                           &matchoff, &matchlen, &maddr) > 0) {
 894                         maddr_len = matchlen;
 895                         memcpy(&rtp_addr, &maddr, sizeof(rtp_addr));
 896                 } else if (caddr_len)
 897                         memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
 898                 else
 899                         return NF_DROP;
 900
 901                 ret = set_expected_rtp_rtcp(skb, dptr, datalen,
 902                                             &rtp_addr, htons(port), t->class,
 903                                             mediaoff, medialen);
 904                 if (ret != NF_ACCEPT)
 905                         return ret;
 906
 907                 /* Update media connection address if present */
 908                 if (maddr_len && nf_nat_sdp_addr && ct->status & IPS_NAT_MASK) {
 909                         ret = nf_nat_sdp_addr(skb, dptr, mediaoff, datalen,
 910                                               c_hdr, SDP_HDR_MEDIA, &rtp_addr);
 911                         if (ret != NF_ACCEPT)
 912                                 return ret;
 913                 }
 914                 i++;
 915         }
 916
 917         /* Update session connection and owner addresses */
 918         nf_nat_sdp_session = rcu_dereference(nf_nat_sdp_session_hook);
 919         if (nf_nat_sdp_session && ct->status & IPS_NAT_MASK)
 920                 ret = nf_nat_sdp_session(skb, dptr, sdpoff, datalen, &rtp_addr);
 921
 922         return ret;
 923 }
 924 static int process_invite_response(struct sk_buff *skb,
 925                                    const char **dptr, unsigned int *datalen,
 926                                    unsigned int cseq, unsigned int code)
 927 {
 928         enum ip_conntrack_info ctinfo;
 929         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 930
 931         if ((code >= 100 && code <= 199) ||
 932             (code >= 200 && code <= 299))
 933                 return process_sdp(skb, dptr, datalen, cseq);
 934         else {
 935                 flush_expectations(ct, true);
 936                 return NF_ACCEPT;
 937         }
 938 }
 939
 940 static int process_update_response(struct sk_buff *skb,
 941                                    const char **dptr, unsigned int *datalen,
 942                                    unsigned int cseq, unsigned int code)
 943 {
 944         enum ip_conntrack_info ctinfo;
 945         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 946
 947         if ((code >= 100 && code <= 199) ||
 948             (code >= 200 && code <= 299))
 949                 return process_sdp(skb, dptr, datalen, cseq);
 950         else {
 951                 flush_expectations(ct, true);
 952                 return NF_ACCEPT;
 953         }
 954 }
 955
 956 static int process_prack_response(struct sk_buff *skb,
 957                                   const char **dptr, unsigned int *datalen,
 958                                   unsigned int cseq, unsigned int code)
 959 {
 960         enum ip_conntrack_info ctinfo;
 961         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 962
 963         if ((code >= 100 && code <= 199) ||
 964             (code >= 200 && code <= 299))
 965                 return process_sdp(skb, dptr, datalen, cseq);
 966         else {
 967                 flush_expectations(ct, true);
 968                 return NF_ACCEPT;
 969         }
 970 }
 971
 972 static int process_bye_request(struct sk_buff *skb,
 973                                const char **dptr, unsigned int *datalen,
 974                                unsigned int cseq)
 975 {
 976         enum ip_conntrack_info ctinfo;
 977         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 978
 979         flush_expectations(ct, true);
 980         return NF_ACCEPT;
 981 }
 982
 983 /* Parse a REGISTER request and create a permanent expectation for incoming
 984  * signalling connections. The expectation is marked inactive and is activated
 985  * when receiving a response indicating success from the registrar.
 986  */
 987 static int process_register_request(struct sk_buff *skb,
 988                                     const char **dptr, unsigned int *datalen,
 989                                     unsigned int cseq)
 990 {
 991         enum ip_conntrack_info ctinfo;
 992         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 993         struct nf_conn_help *help = nfct_help(ct);
 994         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 995         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 996         unsigned int matchoff, matchlen;
 997         struct nf_conntrack_expect *exp;
 998         union nf_inet_addr *saddr, daddr;
 999         __be16 port;
1000         unsigned int expires = 0;
1001         int ret;
1002         typeof(nf_nat_sip_expect_hook) nf_nat_sip_expect;
1003
1004         /* Expected connections can not register again. */
1005         if (ct->status & IPS_EXPECTED)
1006                 return NF_ACCEPT;
1007
1008         /* We must check the expiration time: a value of zero signals the
1009          * registrar to release the binding. We'll remove our expectation
1010          * when receiving the new bindings in the response, but we don't
1011          * want to create new ones.
1012          *
1013          * The expiration time may be contained in Expires: header, the
1014          * Contact: header parameters or the URI parameters.
1015          */
1016         if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
1017                               &matchoff, &matchlen) > 0)
1018                 expires = simple_strtoul(*dptr + matchoff, NULL, 10);
1019
1020         ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
1021                                       SIP_HDR_CONTACT, NULL,
1022                                       &matchoff, &matchlen, &daddr, &port);
1023         if (ret < 0)
1024                 return NF_DROP;
1025         else if (ret == 0)
1026                 return NF_ACCEPT;
1027
1028         /* We don't support third-party registrations */
1029         if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, &daddr))
1030                 return NF_ACCEPT;
1031
1032         if (ct_sip_parse_numerical_param(ct, *dptr,
1033                                          matchoff + matchlen, *datalen,
1034                                          "expires=", NULL, NULL, &expires) < 0)
1035                 return NF_DROP;
1036
1037         if (expires == 0) {
1038                 ret = NF_ACCEPT;
1039                 goto store_cseq;
1040         }
1041
1042         exp = nf_ct_expect_alloc(ct);
1043         if (!exp)
1044                 return NF_DROP;
1045
1046         saddr = NULL;
1047         if (sip_direct_signalling)
1048                 saddr = &ct->tuplehash[!dir].tuple.src.u3;
1049
1050         nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, family, saddr, &daddr,
1051                           IPPROTO_UDP, NULL, &port);
1052         exp->timeout.expires = sip_timeout * HZ;
1053         exp->helper = nfct_help(ct)->helper;
1054         exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
1055
1056         nf_nat_sip_expect = rcu_dereference(nf_nat_sip_expect_hook);
1057         if (nf_nat_sip_expect && ct->status & IPS_NAT_MASK)
1058                 ret = nf_nat_sip_expect(skb, dptr, datalen, exp,
1059                                         matchoff, matchlen);
1060         else {
1061                 if (nf_ct_expect_related(exp) != 0)
1062                         ret = NF_DROP;
1063                 else
1064                         ret = NF_ACCEPT;
1065         }
1066         nf_ct_expect_put(exp);
1067
1068 store_cseq:
1069         if (ret == NF_ACCEPT)
1070                 help->help.ct_sip_info.register_cseq = cseq;
1071         return ret;
1072 }
1073
1074 static int process_register_response(struct sk_buff *skb,
1075                                      const char **dptr, unsigned int *datalen,
1076                                      unsigned int cseq, unsigned int code)
1077 {
1078         enum ip_conntrack_info ctinfo;
1079         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1080         struct nf_conn_help *help = nfct_help(ct);
1081         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1082         union nf_inet_addr addr;
1083         __be16 port;
1084         unsigned int matchoff, matchlen, dataoff = 0;
1085         unsigned int expires = 0;
1086         int in_contact = 0, ret;
1087
1088         /* According to RFC 3261, "UAs MUST NOT send a new registration until
1089          * they have received a final response from the registrar for the
1090          * previous one or the previous REGISTER request has timed out".
1091          *
1092          * However, some servers fail to detect retransmissions and send late
1093          * responses, so we store the sequence number of the last valid
1094          * request and compare it here.
1095          */
1096         if (help->help.ct_sip_info.register_cseq != cseq)
1097                 return NF_ACCEPT;
1098
1099         if (code >= 100 && code <= 199)
1100                 return NF_ACCEPT;
1101         if (code < 200 || code > 299)
1102                 goto flush;
1103
1104         if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
1105                               &matchoff, &matchlen) > 0)
1106                 expires = simple_strtoul(*dptr + matchoff, NULL, 10);
1107
1108         while (1) {
1109                 unsigned int c_expires = expires;
1110
1111                 ret = ct_sip_parse_header_uri(ct, *dptr, &dataoff, *datalen,
1112                                               SIP_HDR_CONTACT, &in_contact,
1113                                               &matchoff, &matchlen,
1114                                               &addr, &port);
1115                 if (ret < 0)
1116                         return NF_DROP;
1117                 else if (ret == 0)
1118                         break;
1119
1120                 /* We don't support third-party registrations */
1121                 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, &addr))
1122                         continue;
1123
1124                 ret = ct_sip_parse_numerical_param(ct, *dptr,
1125                                                    matchoff + matchlen,
1126                                                    *datalen, "expires=",
1127                                                    NULL, NULL, &c_expires);
1128                 if (ret < 0)
1129                         return NF_DROP;
1130                 if (c_expires == 0)
1131                         break;
1132                 if (refresh_signalling_expectation(ct, &addr, port, c_expires))
1133                         return NF_ACCEPT;
1134         }
1135
1136 flush:
1137         flush_expectations(ct, false);
1138         return NF_ACCEPT;
1139 }
1140
1141 static const struct sip_handler sip_handlers[] = {
1142         SIP_HANDLER("INVITE", process_sdp, process_invite_response),
1143         SIP_HANDLER("UPDATE", process_sdp, process_update_response),
1144         SIP_HANDLER("ACK", process_sdp, NULL),
1145         SIP_HANDLER("PRACK", process_sdp, process_prack_response),
1146         SIP_HANDLER("BYE", process_bye_request, NULL),
1147         SIP_HANDLER("REGISTER", process_register_request, process_register_response),
1148 };
1149
1150 static int process_sip_response(struct sk_buff *skb,
1151                                 const char **dptr, unsigned int *datalen)
1152 {
1153         static const struct sip_handler *handler;
1154         enum ip_conntrack_info ctinfo;
1155         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1156         unsigned int matchoff, matchlen;
1157         unsigned int code, cseq, dataoff, i;
1158
1159         if (*datalen < strlen("SIP/2.0 200"))
1160                 return NF_ACCEPT;
1161         code = simple_strtoul(*dptr + strlen("SIP/2.0 "), NULL, 10);
1162         if (!code)
1163                 return NF_DROP;
1164
1165         if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
1166                               &matchoff, &matchlen) <= 0)
1167                 return NF_DROP;
1168         cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1169         if (!cseq)
1170                 return NF_DROP;
1171         dataoff = matchoff + matchlen + 1;
1172
1173         for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
1174                 handler = &sip_handlers[i];
1175                 if (handler->response == NULL)
1176                         continue;
1177                 if (*datalen < dataoff + handler->len ||
1178                     strnicmp(*dptr + dataoff, handler->method, handler->len))
1179                         continue;
1180                 return handler->response(skb, dptr, datalen, cseq, code);
1181         }
1182         return NF_ACCEPT;
1183 }
1184
1185 static int process_sip_request(struct sk_buff *skb,
1186                                const char **dptr, unsigned int *datalen)
1187 {
1188         static const struct sip_handler *handler;
1189         enum ip_conntrack_info ctinfo;
1190         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1191         unsigned int matchoff, matchlen;
1192         unsigned int cseq, i;
1193
1194         for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
1195                 handler = &sip_handlers[i];
1196                 if (handler->request == NULL)
1197                         continue;
1198                 if (*datalen < handler->len ||
1199                     strnicmp(*dptr, handler->method, handler->len))
1200                         continue;
1201
1202                 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
1203                                       &matchoff, &matchlen) <= 0)
1204                         return NF_DROP;
1205                 cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1206                 if (!cseq)
1207                         return NF_DROP;
1208
1209                 return handler->request(skb, dptr, datalen, cseq);
1210         }
1211         return NF_ACCEPT;
1212 }
1213
1214 static int sip_help(struct sk_buff *skb,
1215                     unsigned int protoff,
1216                     struct nf_conn *ct,
1217                     enum ip_conntrack_info ctinfo)
1218 {
1219         unsigned int dataoff, datalen;
1220         const char *dptr;
1221         int ret;
1222         typeof(nf_nat_sip_hook) nf_nat_sip;
1223
1224         /* No Data ? */
1225         dataoff = protoff + sizeof(struct udphdr);
1226         if (dataoff >= skb->len)
1227                 return NF_ACCEPT;
1228
1229         nf_ct_refresh(ct, skb, sip_timeout * HZ);
1230
1231         if (!skb_is_nonlinear(skb))
1232                 dptr = skb->data + dataoff;
1233         else {
1234                 pr_debug("Copy of skbuff not supported yet.\n");
1235                 return NF_ACCEPT;
1236         }
1237
1238         datalen = skb->len - dataoff;
1239         if (datalen < strlen("SIP/2.0 200"))
1240                 return NF_ACCEPT;
1241
1242         if (strnicmp(dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
1243                 ret = process_sip_request(skb, &dptr, &datalen);
1244         else
1245                 ret = process_sip_response(skb, &dptr, &datalen);
1246
1247         if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
1248                 nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
1249                 if (nf_nat_sip && !nf_nat_sip(skb, &dptr, &datalen))
1250                         ret = NF_DROP;
1251         }
1252
1253         return ret;
1254 }
1255
1256 static struct nf_conntrack_helper sip[MAX_PORTS][2] __read_mostly;
1257 static char sip_names[MAX_PORTS][2][sizeof("sip-65535")] __read_mostly;
1258
1259 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
1260         [SIP_EXPECT_SIGNALLING] = {
1261                 .max_expected   = 1,
1262                 .timeout        = 3 * 60,
1263         },
1264         [SIP_EXPECT_AUDIO] = {
1265                 .max_expected   = 2 * IP_CT_DIR_MAX,
1266                 .timeout        = 3 * 60,
1267         },
1268         [SIP_EXPECT_VIDEO] = {
1269                 .max_expected   = 2 * IP_CT_DIR_MAX,
1270                 .timeout        = 3 * 60,
1271         },
1272 };
1273
1274 static void nf_conntrack_sip_fini(void)
1275 {
1276         int i, j;
1277
1278         for (i = 0; i < ports_c; i++) {
1279                 for (j = 0; j < 2; j++) {
1280                         if (sip[i][j].me == NULL)
1281                                 continue;
1282                         nf_conntrack_helper_unregister(&sip[i][j]);
1283                 }
1284         }
1285 }
1286
1287 static int __init nf_conntrack_sip_init(void)
1288 {
1289         int i, j, ret;
1290         char *tmpname;
1291
1292         if (ports_c == 0)
1293                 ports[ports_c++] = SIP_PORT;
1294
1295         for (i = 0; i < ports_c; i++) {
1296                 memset(&sip[i], 0, sizeof(sip[i]));
1297
1298                 sip[i][0].tuple.src.l3num = AF_INET;
1299                 sip[i][1].tuple.src.l3num = AF_INET6;
1300                 for (j = 0; j < 2; j++) {
1301                         sip[i][j].tuple.dst.protonum = IPPROTO_UDP;
1302                         sip[i][j].tuple.src.u.udp.port = htons(ports[i]);
1303                         sip[i][j].expect_policy = sip_exp_policy;
1304                         sip[i][j].expect_class_max = SIP_EXPECT_MAX;
1305                         sip[i][j].me = THIS_MODULE;
1306                         sip[i][j].help = sip_help;
1307
1308                         tmpname = &sip_names[i][j][0];
1309                         if (ports[i] == SIP_PORT)
1310                                 sprintf(tmpname, "sip");
1311                         else
1312                                 sprintf(tmpname, "sip-%u", i);
1313                         sip[i][j].name = tmpname;
1314
1315                         pr_debug("port #%u: %u\n", i, ports[i]);
1316
1317                         ret = nf_conntrack_helper_register(&sip[i][j]);
1318                         if (ret) {
1319                                 printk("nf_ct_sip: failed to register helper "
1320                                        "for pf: %u port: %u\n",
1321                                        sip[i][j].tuple.src.l3num, ports[i]);
1322                                 nf_conntrack_sip_fini();
1323                                 return ret;
1324                         }
1325                 }
1326         }
1327         return 0;
1328 }
1329
1330 module_init(nf_conntrack_sip_init);
1331 module_exit(nf_conntrack_sip_fini);