]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: nf_conntrack_sip: extend request line validation
authorUlrich Weber <ulrich.weber@riverbed.com>
Mon, 24 Oct 2016 16:07:23 +0000 (18:07 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 31 Jan 2018 13:46:13 +0000 (14:46 +0100)
commitf1a49458d9ef2e02ad7163900eaa8cf15b083b78
tree9829df092c23acb2605145b62e9bb19c90fa91c1
parent64f94c222f630b2a407a36bac38c4f543edde668
netfilter: nf_conntrack_sip: extend request line validation

commit 444f901742d054a4cd5ff045871eac5131646cfb upstream.

on SIP requests, so a fragmented TCP SIP packet from an allow header starting with
 INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
 Content-Length: 0

will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character.

Confirm with RFC 3261
 Request-Line   =  Method SP Request-URI SP SIP-Version CRLF

Fixes: 30f33e6dee80 ("[NETFILTER]: nf_conntrack_sip: support method specific request/response handling")
Signed-off-by: Ulrich Weber <ulrich.weber@riverbed.com>
Acked-by: Marco Angaroni <marcoangaroni@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netfilter/nf_conntrack_sip.c