Commit e01234be authored by Ulrich Weber's avatar Ulrich Weber Committed by Ben Hutchings

netfilter: nf_conntrack_sip: extend request line validation

commit 444f9017 upstream.

on SIP requests, so a fragmented TCP SIP packet from an allow header starting with
 INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
 Content-Length: 0

will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character.

Confirm with RFC 3261
 Request-Line   =  Method SP Request-URI SP SIP-Version CRLF

Fixes: 30f33e6d ("[NETFILTER]: nf_conntrack_sip: support method specific request/response handling")
Signed-off-by: default avatarUlrich Weber <ulrich.weber@riverbed.com>
Acked-by: default avatarMarco Angaroni <marcoangaroni@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent dbc3fd44
...@@ -1434,9 +1434,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff, ...@@ -1434,9 +1434,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
handler = &sip_handlers[i]; handler = &sip_handlers[i];
if (handler->request == NULL) if (handler->request == NULL)
continue; continue;
if (*datalen < handler->len || if (*datalen < handler->len + 2 ||
strnicmp(*dptr, handler->method, handler->len)) strnicmp(*dptr, handler->method, handler->len))
continue; continue;
if ((*dptr)[handler->len] != ' ' ||
!isalpha((*dptr)[handler->len+1]))
continue;
if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
&matchoff, &matchlen) <= 0) { &matchoff, &matchlen) <= 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment