Skip to contentSkip to conversation

nf_conntrack_sip: extend request line validation

PATCH Applied Ulrich Weber 3 participants 3 messages Oct 24, 2016 – Oct 27, 2016

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Ulrich Weber

author
#0 lore raw

PATCH v2 1/1 nf_conntrack_sip: extend request line validation

on SIP requests, so a fragmented TCP SIP packet from an allow header starting with
INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 0

will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character.

Confirm with RFC 3261
Request-Line = Method SP Request-URI SP SIP-Version CRLF

Signed-off-by Ulrich Weber <[email protected]>
---
 net/netfilter/nf_conntrack_sip.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_sip.c +4 -1
index 7700556..df773d6 100644
@@ -1436,9 +1436,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
 		handler = &sip_handlers[i];
 		if (handler->request == NULL)
 			continue;
-		if (*datalen < handler->len ||
+		if (*datalen < handler->len + 2 ||
 		    strncasecmp(*dptr, handler->method, handler->len))
 			continue;
+		if ((*dptr)[handler->len] != ' ' ||
+		    !isalpha((*dptr)[handler->len+1]))
+			continue;
 
 		if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
 				      &matchoff, &matchlen) <= 0) {
Signature · 1 line
2.7.4
Acked-by on v2 1/1
#1 lore raw

Hello,

2016-10-24 18:07 GMT+02:00 Ulrich Weber <[email protected]>:

Quoted 10 lines

on SIP requests, so a fragmented TCP SIP packet from an allow header starting with
INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 0

will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character.

Confirm with RFC 3261
Request-Line = Method SP Request-URI SP SIP-Version CRLF

Signed-off-by Ulrich Weber <[email protected]>

Looks ok to me.

Acked-by Marco Angaroni <[email protected]>
Quoted 25 lines
---
 net/netfilter/nf_conntrack_sip.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_sip.c +4 -2
index 7700556..df773d6 100644
@@ -1436,9 +1436,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
                handler = &sip_handlers[i];
                if (handler->request == NULL)
                        continue;
-               if (*datalen < handler->len ||
+               if (*datalen < handler->len + 2 ||
                    strncasecmp(*dptr, handler->method, handler->len))
                        continue;
+               if ((*dptr)[handler->len] != ' ' ||
+                   !isalpha((*dptr)[handler->len+1]))
+                       continue;
 
                if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
                                      &matchoff, &matchlen) <= 0) {
--

2.7.4

maintainer Applied
#2 lore raw
Quoted 9 lines · Marco Angaroni

Hello,

2016-10-24 18:07 GMT+02:00 Ulrich Weber <[email protected]>:

Quoted 6 lines

on SIP requests, so a fragmented TCP SIP packet from an allow header starting with
INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 0

will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character.

Quoted 8 lines
Quoted 4 lines

Confirm with RFC 3261
Request-Line = Method SP Request-URI SP SIP-Version CRLF

Signed-off-by Ulrich Weber <[email protected]>

Looks ok to me.

Acked-by Marco Angaroni <[email protected]>

Applied, thanks!