nds.c

Go to the documentation of this file.

#include "nds.h"

#include "../../parser/hf.h"
#include "../../parser/msg_parser.h"
#include "../../parser/parse_via.h"
#include "../../mem/shm_mem.h"

#include "mod.h"
#include "sip.h"
#include "db.h"


extern int (*sl_reply)(struct sip_msg* _msg, char* _str1, char* _str2); 
str untrusted_headers[]={
    {"P-Asserted-Identity",19},
    {"P-Access-Network-Info",21},
    {"P-Charging-Vector",17},
    {"P-Charging-Function-Addresses",29},
    {0,0}   
}; 

static str *trusted_domains=0;



int I_NDS_check_trusted(struct sip_msg* msg, char* str1, char* str2)
{
    int result;
    LOG(L_ERR,"DBG:"M_NAME":I_NDS_check_trusted: Starting ...\n");
    if (msg->first_line.type!=SIP_REQUEST) {
        LOG(L_ERR,"ERR:"M_NAME":I_NDS_check_trusted: The message is not a request\n");
        result = CSCF_RETURN_TRUE;  
        goto done;
    }
    if (I_NDS_is_trusted(msg,str1,str2)){
        LOG(L_INFO,"INF:"M_NAME":I_NDS_check_trusted: Message comes from a trusted domain\n");
        result = CSCF_RETURN_TRUE;  
        goto done;
    } else {
        LOG(L_INFO,"INF:"M_NAME":I_NDS_check_trusted: Message comes from an untrusted domain\n");
        result = CSCF_RETURN_FALSE;                 
        if (msg->first_line.u.request.method.len==8 &&
            memcmp(msg->first_line.u.request.method.s,"REGISTER",8)==0){
            sl_reply(msg,(char*)403,MSG_403);
            LOG(L_INFO,"INF:"M_NAME":I_NDS_check_trusted: REGISTER request terminated.\n");
        } else {
            if (!I_NDS_strip_headers(msg,str1,str2)){
                result = CSCF_RETURN_ERROR;
                sl_reply(msg,(char*)500,MSG_500);
                LOG(L_INFO,"INF:"M_NAME":I_NDS_check_trusted: Stripping untrusted headers failed, Responding with 500.\n");             
            }
        }                   
    }
    
done:   
    LOG(L_ERR,"DBG:"M_NAME":I_NDS_check_trusted: ... Done\n");
    return result;
}

int I_NDS_is_trusted(struct sip_msg *msg, char* str1, char* str2)
{
    struct via_body *vb;
    str subdomain;
    int i;
    
    vb = msg->via1;
    if (!vb) {
        LOG(L_ERR,"ERR:"M_NAME":I_NDS_is_trusted: Error VIA1 hdr not found\n");
        return 0;
    }
    subdomain=vb->host;
    LOG(L_DBG,"DBG:"M_NAME":I_NDS_is_trusted: Message comes from <%.*s>\n",
        subdomain.len,subdomain.s);
        
    i=0;
    while(trusted_domains[i].len){
        if (trusted_domains[i].len<=subdomain.len){
            if (strncasecmp(subdomain.s+subdomain.len-trusted_domains[i].len,
                trusted_domains[i].s,
                trusted_domains[i].len)==0 &&
                    (trusted_domains[i].len==subdomain.len ||
                     subdomain.s[subdomain.len-trusted_domains[i].len-1]=='.'))
            {                   
                LOG(L_DBG,"DBG:"M_NAME":I_NDS_is_trusted: <%.*s> matches <%.*s>\n",
                    subdomain.len,subdomain.s,trusted_domains[i].len,trusted_domains[i].s);
                return CSCF_RETURN_TRUE;
            } else {
//              LOG(L_DBG,"DBG:"M_NAME":I_NDS_is_trusted: <%.*s> !matches <%.*s>\n",
//                  subdomain.len,subdomain.s,trusted_domains[i].len,trusted_domains[i].s);
            }                   
        }
        i++;
    }
    return CSCF_RETURN_FALSE;
}



int I_NDS_strip_headers(struct sip_msg *msg, char* str1, char* str2)
{
    struct hdr_field *hdr;
    int i,cnt=0;
    if (parse_headers(msg,HDR_EOH_F,0)<0) return 0;
    for (hdr = msg->headers;hdr;hdr = hdr->next)
        for (i=0;untrusted_headers[i].len;i++)
            if (hdr->name.len == untrusted_headers[i].len &&
                strncasecmp(hdr->name.s,untrusted_headers[i].s,hdr->name.len)==0){              
                if (!cscf_del_header(msg,hdr)) return 0;
                cnt++;
            }
    LOG(L_DBG,"DBG:"M_NAME":I_NDS_strip_headers: Deleted %d headers\n",cnt);            
    return cnt;
}



int I_NDS_get_trusted_domains()
{
    int i;
    /* free the old cache */
    if (trusted_domains!=0){
        i=0;
        while(trusted_domains[i].s){
            shm_free(trusted_domains[i].s);
            i++;
        }
        shm_free(trusted_domains);
    }
    return icscf_db_get_nds(&trusted_domains);
}

---