Gitiles
Code Review Sign In
gerrit-public.fairphone.software / kernel / msm-4.9 / 3145012c1c34a3504a2234bd2034ca6ea4767bc5 / . / net / ipv4 / netfilter / ip_conntrack_helper_h323.c
blob: 518f581d39ece6058670ad9efda9df57d2191e68 [file] [log] [blame]
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]1/*
2 * H.323 connection tracking helper
3 *
4 * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
5 *
6 * This source code is licensed under General Public License version 2.
7 *
8 * Based on the 'brute force' H.323 connection tracking module by
9 * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
10 *
11 * For more information, please see http://nath323.sourceforge.net/
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]12 */
13
14#include <linux/config.h>
15#include <linux/module.h>
16#include <linux/netfilter.h>
17#include <linux/ip.h>
18#include <net/tcp.h>
19#include <linux/netfilter_ipv4/ip_conntrack.h>
20#include <linux/netfilter_ipv4/ip_conntrack_core.h>
21#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
22#include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
23#include <linux/netfilter_ipv4/ip_conntrack_h323.h>
24#include <linux/moduleparam.h>
25
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]26#if 0
27#define DEBUGP printk
28#else
29#define DEBUGP(format, args...)
30#endif
31
32/* Parameters */
Jing Min Zhaoa0b7db52006-04-06 14:15:33 -0700[diff] [blame]33static unsigned int default_rrq_ttl = 300;
34module_param(default_rrq_ttl, uint, 0600);
35MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
36
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]37static int gkrouted_only = 1;
38module_param(gkrouted_only, int, 0600);
39MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
40
41/* Hooks for NAT */
42int (*set_h245_addr_hook) (struct sk_buff ** pskb,
43 unsigned char **data, int dataoff,
44 H245_TransportAddress * addr,
45 u_int32_t ip, u_int16_t port);
46int (*set_h225_addr_hook) (struct sk_buff ** pskb,
47 unsigned char **data, int dataoff,
48 TransportAddress * addr,
49 u_int32_t ip, u_int16_t port);
50int (*set_sig_addr_hook) (struct sk_buff ** pskb,
51 struct ip_conntrack * ct,
52 enum ip_conntrack_info ctinfo,
53 unsigned char **data,
54 TransportAddress * addr, int count);
55int (*set_ras_addr_hook) (struct sk_buff ** pskb,
56 struct ip_conntrack * ct,
57 enum ip_conntrack_info ctinfo,
58 unsigned char **data,
59 TransportAddress * addr, int count);
60int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
61 struct ip_conntrack * ct,
62 enum ip_conntrack_info ctinfo,
63 unsigned char **data, int dataoff,
64 H245_TransportAddress * addr,
65 u_int16_t port, u_int16_t rtp_port,
66 struct ip_conntrack_expect * rtp_exp,
67 struct ip_conntrack_expect * rtcp_exp);
68int (*nat_t120_hook) (struct sk_buff ** pskb,
69 struct ip_conntrack * ct,
70 enum ip_conntrack_info ctinfo,
71 unsigned char **data, int dataoff,
72 H245_TransportAddress * addr, u_int16_t port,
73 struct ip_conntrack_expect * exp);
74int (*nat_h245_hook) (struct sk_buff ** pskb,
75 struct ip_conntrack * ct,
76 enum ip_conntrack_info ctinfo,
77 unsigned char **data, int dataoff,
78 TransportAddress * addr, u_int16_t port,
79 struct ip_conntrack_expect * exp);
80int (*nat_q931_hook) (struct sk_buff ** pskb,
81 struct ip_conntrack * ct,
82 enum ip_conntrack_info ctinfo,
83 unsigned char **data, TransportAddress * addr, int idx,
84 u_int16_t port, struct ip_conntrack_expect * exp);
85
86
87static DEFINE_SPINLOCK(ip_h323_lock);
88static char *h323_buffer;
89
90/****************************************************************************/
91static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
92 enum ip_conntrack_info ctinfo,
93 unsigned char **data, int *datalen, int *dataoff)
94{
95 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
96 int dir = CTINFO2DIR(ctinfo);
97 struct tcphdr _tcph, *th;
98 int tcpdatalen;
99 int tcpdataoff;
100 unsigned char *tpkt;
101 int tpktlen;
102 int tpktoff;
103
104 /* Get TCP header */
105 th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
106 sizeof(_tcph), &_tcph);
107 if (th == NULL)
108 return 0;
109
110 /* Get TCP data offset */
111 tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
112
113 /* Get TCP data length */
114 tcpdatalen = (*pskb)->len - tcpdataoff;
115 if (tcpdatalen <= 0) /* No TCP data */
116 goto clear_out;
117
118 if (*data == NULL) { /* first TPKT */
119 /* Get first TPKT pointer */
120 tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
121 h323_buffer);
122 BUG_ON(tpkt == NULL);
123
124 /* Validate TPKT identifier */
125 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
126 /* Netmeeting sends TPKT header and data separately */
127 if (info->tpkt_len[dir] > 0) {
128 DEBUGP("ip_ct_h323: previous packet "
129 "indicated separate TPKT data of %hu "
130 "bytes\n", info->tpkt_len[dir]);
131 if (info->tpkt_len[dir] <= tcpdatalen) {
132 /* Yes, there was a TPKT header
133 * received */
134 *data = tpkt;
135 *datalen = info->tpkt_len[dir];
136 *dataoff = 0;
137 goto out;
138 }
139
140 /* Fragmented TPKT */
141 if (net_ratelimit())
142 printk("ip_ct_h323: "
143 "fragmented TPKT\n");
144 goto clear_out;
145 }
146
147 /* It is not even a TPKT */
148 return 0;
149 }
150 tpktoff = 0;
151 } else { /* Next TPKT */
152 tpktoff = *dataoff + *datalen;
153 tcpdatalen -= tpktoff;
154 if (tcpdatalen <= 4) /* No more TPKT */
155 goto clear_out;
156 tpkt = *data + *datalen;
157
158 /* Validate TPKT identifier */
159 if (tpkt[0] != 0x03 || tpkt[1] != 0)
160 goto clear_out;
161 }
162
163 /* Validate TPKT length */
164 tpktlen = tpkt[2] * 256 + tpkt[3];
Patrick McHardy6fd73702006-05-03 23:16:29 -0700[diff] [blame]165 if (tpktlen < 4)
166 goto clear_out;
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]167 if (tpktlen > tcpdatalen) {
168 if (tcpdatalen == 4) { /* Separate TPKT header */
169 /* Netmeeting sends TPKT header and data separately */
170 DEBUGP("ip_ct_h323: separate TPKT header indicates "
171 "there will be TPKT data of %hu bytes\n",
172 tpktlen - 4);
173 info->tpkt_len[dir] = tpktlen - 4;
174 return 0;
175 }
176
177 if (net_ratelimit())
178 printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
179 goto clear_out;
180 }
181
182 /* This is the encapsulated data */
183 *data = tpkt + 4;
184 *datalen = tpktlen - 4;
185 *dataoff = tpktoff + 4;
186
187 out:
188 /* Clear TPKT length */
189 info->tpkt_len[dir] = 0;
190 return 1;
191
192 clear_out:
193 info->tpkt_len[dir] = 0;
194 return 0;
195}
196
197/****************************************************************************/
Jing Min Zhao51d42f52006-04-06 14:14:59 -0700[diff] [blame]198static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
199 u_int32_t * ip, u_int16_t * port)
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]200{
201 unsigned char *p;
202
203 if (addr->choice != eH245_TransportAddress_unicastAddress ||
204 addr->unicastAddress.choice != eUnicastAddress_iPAddress)
205 return 0;
206
207 p = data + addr->unicastAddress.iPAddress.network;
208 *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
209 *port = (p[4] << 8) | (p[5]);
210
211 return 1;
212}
213
214/****************************************************************************/
215static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
216 enum ip_conntrack_info ctinfo,
217 unsigned char **data, int dataoff,
218 H245_TransportAddress * addr)
219{
220 int dir = CTINFO2DIR(ctinfo);
221 int ret = 0;
222 u_int32_t ip;
223 u_int16_t port;
224 u_int16_t rtp_port;
225 struct ip_conntrack_expect *rtp_exp;
226 struct ip_conntrack_expect *rtcp_exp;
227
228 /* Read RTP or RTCP address */
229 if (!get_h245_addr(*data, addr, &ip, &port) ||
230 ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
231 return 0;
232
233 /* RTP port is even */
234 rtp_port = port & (~1);
235
236 /* Create expect for RTP */
237 if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
238 return -1;
239 rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
240 rtp_exp->tuple.src.u.udp.port = 0;
241 rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
242 rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
243 rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
244 rtp_exp->mask.src.ip = 0xFFFFFFFF;
245 rtp_exp->mask.src.u.udp.port = 0;
246 rtp_exp->mask.dst.ip = 0xFFFFFFFF;
247 rtp_exp->mask.dst.u.udp.port = 0xFFFF;
248 rtp_exp->mask.dst.protonum = 0xFF;
249 rtp_exp->flags = 0;
250
251 /* Create expect for RTCP */
252 if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
253 ip_conntrack_expect_put(rtp_exp);
254 return -1;
255 }
256 rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
257 rtcp_exp->tuple.src.u.udp.port = 0;
258 rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
259 rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
260 rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
261 rtcp_exp->mask.src.ip = 0xFFFFFFFF;
262 rtcp_exp->mask.src.u.udp.port = 0;
263 rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
264 rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
265 rtcp_exp->mask.dst.protonum = 0xFF;
266 rtcp_exp->flags = 0;
267
268 if (ct->tuplehash[dir].tuple.src.ip !=
269 ct->tuplehash[!dir].tuple.dst.ip && nat_rtp_rtcp_hook) {
270 /* NAT needed */
271 ret = nat_rtp_rtcp_hook(pskb, ct, ctinfo, data, dataoff,
272 addr, port, rtp_port, rtp_exp,
273 rtcp_exp);
274 } else { /* Conntrack only */
275 rtp_exp->expectfn = NULL;
276 rtcp_exp->expectfn = NULL;
277
278 if (ip_conntrack_expect_related(rtp_exp) == 0) {
279 if (ip_conntrack_expect_related(rtcp_exp) == 0) {
280 DEBUGP("ip_ct_h323: expect RTP "
281 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
282 NIPQUAD(rtp_exp->tuple.src.ip),
283 ntohs(rtp_exp->tuple.src.u.udp.port),
284 NIPQUAD(rtp_exp->tuple.dst.ip),
285 ntohs(rtp_exp->tuple.dst.u.udp.port));
286 DEBUGP("ip_ct_h323: expect RTCP "
287 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
288 NIPQUAD(rtcp_exp->tuple.src.ip),
289 ntohs(rtcp_exp->tuple.src.u.udp.port),
290 NIPQUAD(rtcp_exp->tuple.dst.ip),
291 ntohs(rtcp_exp->tuple.dst.u.udp.port));
292 } else {
293 ip_conntrack_unexpect_related(rtp_exp);
294 ret = -1;
295 }
296 } else
297 ret = -1;
298 }
299
300 ip_conntrack_expect_put(rtp_exp);
301 ip_conntrack_expect_put(rtcp_exp);
302
303 return ret;
304}
305
306/****************************************************************************/
307static int expect_t120(struct sk_buff **pskb,
308 struct ip_conntrack *ct,
309 enum ip_conntrack_info ctinfo,
310 unsigned char **data, int dataoff,
311 H245_TransportAddress * addr)
312{
313 int dir = CTINFO2DIR(ctinfo);
314 int ret = 0;
315 u_int32_t ip;
316 u_int16_t port;
317 struct ip_conntrack_expect *exp = NULL;
318
319 /* Read T.120 address */
320 if (!get_h245_addr(*data, addr, &ip, &port) ||
321 ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
322 return 0;
323
324 /* Create expect for T.120 connections */
325 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
326 return -1;
327 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
328 exp->tuple.src.u.tcp.port = 0;
329 exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
330 exp->tuple.dst.u.tcp.port = htons(port);
331 exp->tuple.dst.protonum = IPPROTO_TCP;
332 exp->mask.src.ip = 0xFFFFFFFF;
333 exp->mask.src.u.tcp.port = 0;
334 exp->mask.dst.ip = 0xFFFFFFFF;
335 exp->mask.dst.u.tcp.port = 0xFFFF;
336 exp->mask.dst.protonum = 0xFF;
337 exp->flags = IP_CT_EXPECT_PERMANENT; /* Accept multiple channels */
338
339 if (ct->tuplehash[dir].tuple.src.ip !=
340 ct->tuplehash[!dir].tuple.dst.ip && nat_t120_hook) {
341 /* NAT needed */
342 ret = nat_t120_hook(pskb, ct, ctinfo, data, dataoff, addr,
343 port, exp);
344 } else { /* Conntrack only */
345 exp->expectfn = NULL;
346 if (ip_conntrack_expect_related(exp) == 0) {
347 DEBUGP("ip_ct_h323: expect T.120 "
348 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
349 NIPQUAD(exp->tuple.src.ip),
350 ntohs(exp->tuple.src.u.tcp.port),
351 NIPQUAD(exp->tuple.dst.ip),
352 ntohs(exp->tuple.dst.u.tcp.port));
353 } else
354 ret = -1;
355 }
356
357 ip_conntrack_expect_put(exp);
358
359 return ret;
360}
361
362/****************************************************************************/
363static int process_h245_channel(struct sk_buff **pskb,
364 struct ip_conntrack *ct,
365 enum ip_conntrack_info ctinfo,
366 unsigned char **data, int dataoff,
367 H2250LogicalChannelParameters * channel)
368{
369 int ret;
370
371 if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
372 /* RTP */
373 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
374 &channel->mediaChannel);
375 if (ret < 0)
376 return -1;
377 }
378
379 if (channel->
380 options & eH2250LogicalChannelParameters_mediaControlChannel) {
381 /* RTCP */
382 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
383 &channel->mediaControlChannel);
384 if (ret < 0)
385 return -1;
386 }
387
388 return 0;
389}
390
391/****************************************************************************/
392static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
393 enum ip_conntrack_info ctinfo,
394 unsigned char **data, int dataoff,
395 OpenLogicalChannel * olc)
396{
397 int ret;
398
399 DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
400
401 if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
402 eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
403 {
404 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
405 &olc->
406 forwardLogicalChannelParameters.
407 multiplexParameters.
408 h2250LogicalChannelParameters);
409 if (ret < 0)
410 return -1;
411 }
412
413 if ((olc->options &
414 eOpenLogicalChannel_reverseLogicalChannelParameters) &&
415 (olc->reverseLogicalChannelParameters.options &
416 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
417 && (olc->reverseLogicalChannelParameters.multiplexParameters.
418 choice ==
419 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
420 {
421 ret =
422 process_h245_channel(pskb, ct, ctinfo, data, dataoff,
423 &olc->
424 reverseLogicalChannelParameters.
425 multiplexParameters.
426 h2250LogicalChannelParameters);
427 if (ret < 0)
428 return -1;
429 }
430
431 if ((olc->options & eOpenLogicalChannel_separateStack) &&
432 olc->forwardLogicalChannelParameters.dataType.choice ==
433 eDataType_data &&
434 olc->forwardLogicalChannelParameters.dataType.data.application.
435 choice == eDataApplicationCapability_application_t120 &&
436 olc->forwardLogicalChannelParameters.dataType.data.application.
437 t120.choice == eDataProtocolCapability_separateLANStack &&
438 olc->separateStack.networkAddress.choice ==
439 eNetworkAccessParameters_networkAddress_localAreaAddress) {
440 ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
441 &olc->separateStack.networkAddress.
442 localAreaAddress);
443 if (ret < 0)
444 return -1;
445 }
446
447 return 0;
448}
449
450/****************************************************************************/
451static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
452 enum ip_conntrack_info ctinfo,
453 unsigned char **data, int dataoff,
454 OpenLogicalChannelAck * olca)
455{
456 H2250LogicalChannelAckParameters *ack;
457 int ret;
458
459 DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
460
461 if ((olca->options &
462 eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
463 (olca->reverseLogicalChannelParameters.options &
464 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
465 && (olca->reverseLogicalChannelParameters.multiplexParameters.
466 choice ==
467 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
468 {
469 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
470 &olca->
471 reverseLogicalChannelParameters.
472 multiplexParameters.
473 h2250LogicalChannelParameters);
474 if (ret < 0)
475 return -1;
476 }
477
478 if ((olca->options &
479 eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
480 (olca->forwardMultiplexAckParameters.choice ==
481 eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
482 {
483 ack = &olca->forwardMultiplexAckParameters.
484 h2250LogicalChannelAckParameters;
485 if (ack->options &
486 eH2250LogicalChannelAckParameters_mediaChannel) {
487 /* RTP */
488 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
489 &ack->mediaChannel);
490 if (ret < 0)
491 return -1;
492 }
493
494 if (ack->options &
495 eH2250LogicalChannelAckParameters_mediaControlChannel) {
496 /* RTCP */
497 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
498 &ack->mediaControlChannel);
499 if (ret < 0)
500 return -1;
501 }
502 }
503
504 return 0;
505}
506
507/****************************************************************************/
508static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
509 enum ip_conntrack_info ctinfo,
510 unsigned char **data, int dataoff,
511 MultimediaSystemControlMessage * mscm)
512{
513 switch (mscm->choice) {
514 case eMultimediaSystemControlMessage_request:
515 if (mscm->request.choice ==
516 eRequestMessage_openLogicalChannel) {
517 return process_olc(pskb, ct, ctinfo, data, dataoff,
518 &mscm->request.openLogicalChannel);
519 }
520 DEBUGP("ip_ct_h323: H.245 Request %d\n",
521 mscm->request.choice);
522 break;
523 case eMultimediaSystemControlMessage_response:
524 if (mscm->response.choice ==
525 eResponseMessage_openLogicalChannelAck) {
526 return process_olca(pskb, ct, ctinfo, data, dataoff,
527 &mscm->response.
528 openLogicalChannelAck);
529 }
530 DEBUGP("ip_ct_h323: H.245 Response %d\n",
531 mscm->response.choice);
532 break;
533 default:
534 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
535 break;
536 }
537
538 return 0;
539}
540
541/****************************************************************************/
542static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
543 enum ip_conntrack_info ctinfo)
544{
545 static MultimediaSystemControlMessage mscm;
546 unsigned char *data = NULL;
547 int datalen;
548 int dataoff;
549 int ret;
550
551 /* Until there's been traffic both ways, don't look in packets. */
552 if (ctinfo != IP_CT_ESTABLISHED
553 && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
554 return NF_ACCEPT;
555 }
556 DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
557
558 spin_lock_bh(&ip_h323_lock);
559
560 /* Process each TPKT */
561 while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
562 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
563 NIPQUAD((*pskb)->nh.iph->saddr),
564 NIPQUAD((*pskb)->nh.iph->daddr), datalen);
565
566 /* Decode H.245 signal */
567 ret = DecodeMultimediaSystemControlMessage(data, datalen,
568 &mscm);
569 if (ret < 0) {
570 if (net_ratelimit())
571 printk("ip_ct_h245: decoding error: %s\n",
572 ret == H323_ERROR_BOUND ?
573 "out of bound" : "out of range");
574 /* We don't drop when decoding error */
575 break;
576 }
577
578 /* Process H.245 signal */
579 if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
580 goto drop;
581 }
582
583 spin_unlock_bh(&ip_h323_lock);
584 return NF_ACCEPT;
585
586 drop:
587 spin_unlock_bh(&ip_h323_lock);
588 if (net_ratelimit())
589 printk("ip_ct_h245: packet dropped\n");
590 return NF_DROP;
591}
592
593/****************************************************************************/
594static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
595 .name = "H.245",
596 .me = THIS_MODULE,
597 .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
598 .timeout = 240,
599 .tuple = {.dst = {.protonum = IPPROTO_TCP}},
600 .mask = {.src = {.u = {0xFFFF}},
601 .dst = {.protonum = 0xFF}},
602 .help = h245_help
603};
604
605/****************************************************************************/
606void ip_conntrack_h245_expect(struct ip_conntrack *new,
607 struct ip_conntrack_expect *this)
608{
609 write_lock_bh(&ip_conntrack_lock);
610 new->helper = &ip_conntrack_helper_h245;
611 write_unlock_bh(&ip_conntrack_lock);
612}
613
614/****************************************************************************/
Patrick McHardy6a534ee2006-03-22 13:57:25 -0800[diff] [blame]615int get_h225_addr(unsigned char *data, TransportAddress * addr,
616 u_int32_t * ip, u_int16_t * port)
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]617{
618 unsigned char *p;
619
620 if (addr->choice != eTransportAddress_ipAddress)
621 return 0;
622
623 p = data + addr->ipAddress.ip;
624 *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
625 *port = (p[4] << 8) | (p[5]);
626
627 return 1;
628}
629
630/****************************************************************************/
631static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
632 enum ip_conntrack_info ctinfo,
633 unsigned char **data, int dataoff,
634 TransportAddress * addr)
635{
636 int dir = CTINFO2DIR(ctinfo);
637 int ret = 0;
638 u_int32_t ip;
639 u_int16_t port;
640 struct ip_conntrack_expect *exp = NULL;
641
642 /* Read h245Address */
643 if (!get_h225_addr(*data, addr, &ip, &port) ||
644 ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
645 return 0;
646
647 /* Create expect for h245 connection */
648 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
649 return -1;
650 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
651 exp->tuple.src.u.tcp.port = 0;
652 exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
653 exp->tuple.dst.u.tcp.port = htons(port);
654 exp->tuple.dst.protonum = IPPROTO_TCP;
655 exp->mask.src.ip = 0xFFFFFFFF;
656 exp->mask.src.u.tcp.port = 0;
657 exp->mask.dst.ip = 0xFFFFFFFF;
658 exp->mask.dst.u.tcp.port = 0xFFFF;
659 exp->mask.dst.protonum = 0xFF;
660 exp->flags = 0;
661
662 if (ct->tuplehash[dir].tuple.src.ip !=
663 ct->tuplehash[!dir].tuple.dst.ip && nat_h245_hook) {
664 /* NAT needed */
665 ret = nat_h245_hook(pskb, ct, ctinfo, data, dataoff, addr,
666 port, exp);
667 } else { /* Conntrack only */
668 exp->expectfn = ip_conntrack_h245_expect;
669
670 if (ip_conntrack_expect_related(exp) == 0) {
671 DEBUGP("ip_ct_q931: expect H.245 "
672 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
673 NIPQUAD(exp->tuple.src.ip),
674 ntohs(exp->tuple.src.u.tcp.port),
675 NIPQUAD(exp->tuple.dst.ip),
676 ntohs(exp->tuple.dst.u.tcp.port));
677 } else
678 ret = -1;
679 }
680
681 ip_conntrack_expect_put(exp);
682
683 return ret;
684}
685
686/****************************************************************************/
687static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
688 enum ip_conntrack_info ctinfo,
689 unsigned char **data, int dataoff,
690 Setup_UUIE * setup)
691{
692 int dir = CTINFO2DIR(ctinfo);
693 int ret;
694 int i;
695 u_int32_t ip;
696 u_int16_t port;
697
698 DEBUGP("ip_ct_q931: Setup\n");
699
700 if (setup->options & eSetup_UUIE_h245Address) {
701 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
702 &setup->h245Address);
703 if (ret < 0)
704 return -1;
705 }
706
707 if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
708 (set_h225_addr_hook) &&
709 get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
710 ip != ct->tuplehash[!dir].tuple.src.ip) {
711 DEBUGP("ip_ct_q931: set destCallSignalAddress "
712 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
713 NIPQUAD(ip), port,
714 NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
715 ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
716 ret = set_h225_addr_hook(pskb, data, dataoff,
717 &setup->destCallSignalAddress,
718 ct->tuplehash[!dir].tuple.src.ip,
719 ntohs(ct->tuplehash[!dir].tuple.src.
720 u.tcp.port));
721 if (ret < 0)
722 return -1;
723 }
724
725 if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
726 (set_h225_addr_hook) &&
727 get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
728 && ip != ct->tuplehash[!dir].tuple.dst.ip) {
729 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
730 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
731 NIPQUAD(ip), port,
732 NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
733 ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
734 ret = set_h225_addr_hook(pskb, data, dataoff,
735 &setup->sourceCallSignalAddress,
736 ct->tuplehash[!dir].tuple.dst.ip,
737 ntohs(ct->tuplehash[!dir].tuple.dst.
738 u.tcp.port));
739 if (ret < 0)
740 return -1;
741 }
742
743 if (setup->options & eSetup_UUIE_fastStart) {
744 for (i = 0; i < setup->fastStart.count; i++) {
745 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
746 &setup->fastStart.item[i]);
747 if (ret < 0)
748 return -1;
749 }
750 }
751
752 return 0;
753}
754
755/****************************************************************************/
756static int process_callproceeding(struct sk_buff **pskb,
757 struct ip_conntrack *ct,
758 enum ip_conntrack_info ctinfo,
759 unsigned char **data, int dataoff,
760 CallProceeding_UUIE * callproc)
761{
762 int ret;
763 int i;
764
765 DEBUGP("ip_ct_q931: CallProceeding\n");
766
767 if (callproc->options & eCallProceeding_UUIE_h245Address) {
768 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
769 &callproc->h245Address);
770 if (ret < 0)
771 return -1;
772 }
773
774 if (callproc->options & eCallProceeding_UUIE_fastStart) {
775 for (i = 0; i < callproc->fastStart.count; i++) {
776 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
777 &callproc->fastStart.item[i]);
778 if (ret < 0)
779 return -1;
780 }
781 }
782
783 return 0;
784}
785
786/****************************************************************************/
787static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
788 enum ip_conntrack_info ctinfo,
789 unsigned char **data, int dataoff,
790 Connect_UUIE * connect)
791{
792 int ret;
793 int i;
794
795 DEBUGP("ip_ct_q931: Connect\n");
796
797 if (connect->options & eConnect_UUIE_h245Address) {
798 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
799 &connect->h245Address);
800 if (ret < 0)
801 return -1;
802 }
803
804 if (connect->options & eConnect_UUIE_fastStart) {
805 for (i = 0; i < connect->fastStart.count; i++) {
806 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
807 &connect->fastStart.item[i]);
808 if (ret < 0)
809 return -1;
810 }
811 }
812
813 return 0;
814}
815
816/****************************************************************************/
817static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
818 enum ip_conntrack_info ctinfo,
819 unsigned char **data, int dataoff,
820 Alerting_UUIE * alert)
821{
822 int ret;
823 int i;
824
825 DEBUGP("ip_ct_q931: Alerting\n");
826
827 if (alert->options & eAlerting_UUIE_h245Address) {
828 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
829 &alert->h245Address);
830 if (ret < 0)
831 return -1;
832 }
833
834 if (alert->options & eAlerting_UUIE_fastStart) {
835 for (i = 0; i < alert->fastStart.count; i++) {
836 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
837 &alert->fastStart.item[i]);
838 if (ret < 0)
839 return -1;
840 }
841 }
842
843 return 0;
844}
845
846/****************************************************************************/
847static int process_information(struct sk_buff **pskb,
848 struct ip_conntrack *ct,
849 enum ip_conntrack_info ctinfo,
850 unsigned char **data, int dataoff,
851 Information_UUIE * info)
852{
853 int ret;
854 int i;
855
856 DEBUGP("ip_ct_q931: Information\n");
857
858 if (info->options & eInformation_UUIE_fastStart) {
859 for (i = 0; i < info->fastStart.count; i++) {
860 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
861 &info->fastStart.item[i]);
862 if (ret < 0)
863 return -1;
864 }
865 }
866
867 return 0;
868}
869
870/****************************************************************************/
871static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
872 enum ip_conntrack_info ctinfo,
873 unsigned char **data, int dataoff,
874 Facility_UUIE * facility)
875{
876 int ret;
877 int i;
878
879 DEBUGP("ip_ct_q931: Facility\n");
880
881 if (facility->options & eFacility_UUIE_h245Address) {
882 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
883 &facility->h245Address);
884 if (ret < 0)
885 return -1;
886 }
887
888 if (facility->options & eFacility_UUIE_fastStart) {
889 for (i = 0; i < facility->fastStart.count; i++) {
890 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
891 &facility->fastStart.item[i]);
892 if (ret < 0)
893 return -1;
894 }
895 }
896
897 return 0;
898}
899
900/****************************************************************************/
901static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
902 enum ip_conntrack_info ctinfo,
903 unsigned char **data, int dataoff,
904 Progress_UUIE * progress)
905{
906 int ret;
907 int i;
908
909 DEBUGP("ip_ct_q931: Progress\n");
910
911 if (progress->options & eProgress_UUIE_h245Address) {
912 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
913 &progress->h245Address);
914 if (ret < 0)
915 return -1;
916 }
917
918 if (progress->options & eProgress_UUIE_fastStart) {
919 for (i = 0; i < progress->fastStart.count; i++) {
920 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
921 &progress->fastStart.item[i]);
922 if (ret < 0)
923 return -1;
924 }
925 }
926
927 return 0;
928}
929
930/****************************************************************************/
931static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
932 enum ip_conntrack_info ctinfo,
933 unsigned char **data, int dataoff, Q931 * q931)
934{
935 H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
936 int i;
937 int ret = 0;
938
939 switch (pdu->h323_message_body.choice) {
940 case eH323_UU_PDU_h323_message_body_setup:
941 ret = process_setup(pskb, ct, ctinfo, data, dataoff,
942 &pdu->h323_message_body.setup);
943 break;
944 case eH323_UU_PDU_h323_message_body_callProceeding:
945 ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
946 &pdu->h323_message_body.
947 callProceeding);
948 break;
949 case eH323_UU_PDU_h323_message_body_connect:
950 ret = process_connect(pskb, ct, ctinfo, data, dataoff,
951 &pdu->h323_message_body.connect);
952 break;
953 case eH323_UU_PDU_h323_message_body_alerting:
954 ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
955 &pdu->h323_message_body.alerting);
956 break;
957 case eH323_UU_PDU_h323_message_body_information:
958 ret = process_information(pskb, ct, ctinfo, data, dataoff,
959 &pdu->h323_message_body.
960 information);
961 break;
962 case eH323_UU_PDU_h323_message_body_facility:
963 ret = process_facility(pskb, ct, ctinfo, data, dataoff,
964 &pdu->h323_message_body.facility);
965 break;
966 case eH323_UU_PDU_h323_message_body_progress:
967 ret = process_progress(pskb, ct, ctinfo, data, dataoff,
968 &pdu->h323_message_body.progress);
969 break;
970 default:
971 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
972 pdu->h323_message_body.choice);
973 break;
974 }
975
976 if (ret < 0)
977 return -1;
978
979 if (pdu->options & eH323_UU_PDU_h245Control) {
980 for (i = 0; i < pdu->h245Control.count; i++) {
981 ret = process_h245(pskb, ct, ctinfo, data, dataoff,
982 &pdu->h245Control.item[i]);
983 if (ret < 0)
984 return -1;
985 }
986 }
987
988 return 0;
989}
990
991/****************************************************************************/
992static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
993 enum ip_conntrack_info ctinfo)
994{
995 static Q931 q931;
996 unsigned char *data = NULL;
997 int datalen;
998 int dataoff;
999 int ret;
1000
1001 /* Until there's been traffic both ways, don't look in packets. */
1002 if (ctinfo != IP_CT_ESTABLISHED
1003 && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
1004 return NF_ACCEPT;
1005 }
1006 DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
1007
1008 spin_lock_bh(&ip_h323_lock);
1009
1010 /* Process each TPKT */
1011 while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
1012 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1013 NIPQUAD((*pskb)->nh.iph->saddr),
1014 NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1015
1016 /* Decode Q.931 signal */
1017 ret = DecodeQ931(data, datalen, &q931);
1018 if (ret < 0) {
1019 if (net_ratelimit())
1020 printk("ip_ct_q931: decoding error: %s\n",
1021 ret == H323_ERROR_BOUND ?
1022 "out of bound" : "out of range");
1023 /* We don't drop when decoding error */
1024 break;
1025 }
1026
1027 /* Process Q.931 signal */
1028 if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
1029 goto drop;
1030 }
1031
1032 spin_unlock_bh(&ip_h323_lock);
1033 return NF_ACCEPT;
1034
1035 drop:
1036 spin_unlock_bh(&ip_h323_lock);
1037 if (net_ratelimit())
1038 printk("ip_ct_q931: packet dropped\n");
1039 return NF_DROP;
1040}
1041
1042/****************************************************************************/
1043static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
1044 .name = "Q.931",
1045 .me = THIS_MODULE,
1046 .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
1047 .timeout = 240,
1048 .tuple = {.src = {.u = {__constant_htons(Q931_PORT)}},
1049 .dst = {.protonum = IPPROTO_TCP}},
1050 .mask = {.src = {.u = {0xFFFF}},
1051 .dst = {.protonum = 0xFF}},
1052 .help = q931_help
1053};
1054
1055/****************************************************************************/
1056void ip_conntrack_q931_expect(struct ip_conntrack *new,
1057 struct ip_conntrack_expect *this)
1058{
1059 write_lock_bh(&ip_conntrack_lock);
1060 new->helper = &ip_conntrack_helper_q931;
1061 write_unlock_bh(&ip_conntrack_lock);
1062}
1063
1064/****************************************************************************/
1065static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
1066{
1067 struct udphdr _uh, *uh;
1068 int dataoff;
1069
1070 uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
1071 &_uh);
1072 if (uh == NULL)
1073 return NULL;
1074 dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
1075 if (dataoff >= (*pskb)->len)
1076 return NULL;
1077 *datalen = (*pskb)->len - dataoff;
1078 return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
1079}
1080
1081/****************************************************************************/
1082static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
1083 u_int32_t ip, u_int16_t port)
1084{
1085 struct ip_conntrack_expect *exp;
1086 struct ip_conntrack_tuple tuple;
1087
1088 tuple.src.ip = 0;
1089 tuple.src.u.tcp.port = 0;
1090 tuple.dst.ip = ip;
1091 tuple.dst.u.tcp.port = htons(port);
1092 tuple.dst.protonum = IPPROTO_TCP;
1093
1094 exp = __ip_conntrack_expect_find(&tuple);
1095 if (exp->master == ct)
1096 return exp;
1097 return NULL;
1098}
1099
1100/****************************************************************************/
1101static int set_expect_timeout(struct ip_conntrack_expect *exp,
1102 unsigned timeout)
1103{
1104 if (!exp || !del_timer(&exp->timeout))
1105 return 0;
1106
1107 exp->timeout.expires = jiffies + timeout * HZ;
1108 add_timer(&exp->timeout);
1109
1110 return 1;
1111}
1112
1113/****************************************************************************/
1114static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
1115 enum ip_conntrack_info ctinfo,
1116 unsigned char **data,
1117 TransportAddress * addr, int count)
1118{
1119 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1120 int dir = CTINFO2DIR(ctinfo);
1121 int ret = 0;
1122 int i;
1123 u_int32_t ip;
1124 u_int16_t port;
1125 struct ip_conntrack_expect *exp;
1126
1127 /* Look for the first related address */
1128 for (i = 0; i < count; i++) {
1129 if (get_h225_addr(*data, &addr[i], &ip, &port) &&
1130 ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
1131 break;
1132 }
1133
1134 if (i >= count) /* Not found */
1135 return 0;
1136
1137 /* Create expect for Q.931 */
1138 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1139 return -1;
1140 exp->tuple.src.ip = gkrouted_only ? /* only accept calls from GK? */
1141 ct->tuplehash[!dir].tuple.src.ip : 0;
1142 exp->tuple.src.u.tcp.port = 0;
1143 exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
1144 exp->tuple.dst.u.tcp.port = htons(port);
1145 exp->tuple.dst.protonum = IPPROTO_TCP;
1146 exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
1147 exp->mask.src.u.tcp.port = 0;
1148 exp->mask.dst.ip = 0xFFFFFFFF;
1149 exp->mask.dst.u.tcp.port = 0xFFFF;
1150 exp->mask.dst.protonum = 0xFF;
1151 exp->flags = IP_CT_EXPECT_PERMANENT; /* Accept multiple calls */
1152
1153 if (nat_q931_hook) { /* Need NAT */
1154 ret = nat_q931_hook(pskb, ct, ctinfo, data, addr, i,
1155 port, exp);
1156 } else { /* Conntrack only */
1157 exp->expectfn = ip_conntrack_q931_expect;
1158
1159 if (ip_conntrack_expect_related(exp) == 0) {
1160 DEBUGP("ip_ct_ras: expect Q.931 "
1161 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1162 NIPQUAD(exp->tuple.src.ip),
1163 ntohs(exp->tuple.src.u.tcp.port),
1164 NIPQUAD(exp->tuple.dst.ip),
1165 ntohs(exp->tuple.dst.u.tcp.port));
1166
1167 /* Save port for looking up expect in processing RCF */
1168 info->sig_port[dir] = port;
1169 } else
1170 ret = -1;
1171 }
1172
1173 ip_conntrack_expect_put(exp);
1174
1175 return ret;
1176}
1177
1178/****************************************************************************/
1179static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
1180 enum ip_conntrack_info ctinfo,
1181 unsigned char **data, GatekeeperRequest * grq)
1182{
1183 DEBUGP("ip_ct_ras: GRQ\n");
1184
1185 if (set_ras_addr_hook) /* NATed */
1186 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1187 &grq->rasAddress, 1);
1188 return 0;
1189}
1190
1191/* Declare before using */
1192static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1193 struct ip_conntrack_expect *this);
1194
1195/****************************************************************************/
1196static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1197 enum ip_conntrack_info ctinfo,
1198 unsigned char **data, GatekeeperConfirm * gcf)
1199{
1200 int dir = CTINFO2DIR(ctinfo);
1201 int ret = 0;
1202 u_int32_t ip;
1203 u_int16_t port;
1204 struct ip_conntrack_expect *exp;
1205
1206 DEBUGP("ip_ct_ras: GCF\n");
1207
1208 if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
1209 return 0;
1210
1211 /* Registration port is the same as discovery port */
1212 if (ip == ct->tuplehash[dir].tuple.src.ip &&
1213 port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
1214 return 0;
1215
1216 /* Avoid RAS expectation loops. A GCF is never expected. */
1217 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1218 return 0;
1219
1220 /* Need new expect */
1221 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1222 return -1;
1223 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1224 exp->tuple.src.u.tcp.port = 0;
1225 exp->tuple.dst.ip = ip;
1226 exp->tuple.dst.u.tcp.port = htons(port);
1227 exp->tuple.dst.protonum = IPPROTO_UDP;
1228 exp->mask.src.ip = 0xFFFFFFFF;
1229 exp->mask.src.u.tcp.port = 0;
1230 exp->mask.dst.ip = 0xFFFFFFFF;
1231 exp->mask.dst.u.tcp.port = 0xFFFF;
1232 exp->mask.dst.protonum = 0xFF;
1233 exp->flags = 0;
1234 exp->expectfn = ip_conntrack_ras_expect;
1235 if (ip_conntrack_expect_related(exp) == 0) {
1236 DEBUGP("ip_ct_ras: expect RAS "
1237 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1238 NIPQUAD(exp->tuple.src.ip),
1239 ntohs(exp->tuple.src.u.tcp.port),
1240 NIPQUAD(exp->tuple.dst.ip),
1241 ntohs(exp->tuple.dst.u.tcp.port));
1242 } else
1243 ret = -1;
1244
1245 ip_conntrack_expect_put(exp);
1246
1247 return ret;
1248}
1249
1250/****************************************************************************/
1251static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1252 enum ip_conntrack_info ctinfo,
1253 unsigned char **data, RegistrationRequest * rrq)
1254{
1255 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1256 int ret;
1257
1258 DEBUGP("ip_ct_ras: RRQ\n");
1259
1260 ret = expect_q931(pskb, ct, ctinfo, data,
1261 rrq->callSignalAddress.item,
1262 rrq->callSignalAddress.count);
1263 if (ret < 0)
1264 return -1;
1265
1266 if (set_ras_addr_hook) {
1267 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1268 rrq->rasAddress.item,
1269 rrq->rasAddress.count);
1270 if (ret < 0)
1271 return -1;
1272 }
1273
1274 if (rrq->options & eRegistrationRequest_timeToLive) {
1275 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1276 info->timeout = rrq->timeToLive;
1277 } else
Jing Min Zhaoa0b7db52006-04-06 14:15:33 -0700[diff] [blame]1278 info->timeout = default_rrq_ttl;
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]1279
1280 return 0;
1281}
1282
1283/****************************************************************************/
1284static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1285 enum ip_conntrack_info ctinfo,
1286 unsigned char **data, RegistrationConfirm * rcf)
1287{
1288 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1289 int dir = CTINFO2DIR(ctinfo);
1290 int ret;
1291 struct ip_conntrack_expect *exp;
1292
1293 DEBUGP("ip_ct_ras: RCF\n");
1294
1295 if (set_sig_addr_hook) {
1296 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1297 rcf->callSignalAddress.item,
1298 rcf->callSignalAddress.count);
1299 if (ret < 0)
1300 return -1;
1301 }
1302
1303 if (rcf->options & eRegistrationConfirm_timeToLive) {
1304 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1305 info->timeout = rcf->timeToLive;
1306 }
1307
1308 if (info->timeout > 0) {
1309 DEBUGP
1310 ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1311 info->timeout);
1312 ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
1313
1314 /* Set expect timeout */
1315 read_lock_bh(&ip_conntrack_lock);
1316 exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
1317 info->sig_port[!dir]);
1318 if (exp) {
1319 DEBUGP("ip_ct_ras: set Q.931 expect "
1320 "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1321 "timeout to %u seconds\n",
1322 NIPQUAD(exp->tuple.src.ip),
1323 ntohs(exp->tuple.src.u.tcp.port),
1324 NIPQUAD(exp->tuple.dst.ip),
1325 ntohs(exp->tuple.dst.u.tcp.port),
1326 info->timeout);
1327 set_expect_timeout(exp, info->timeout);
1328 }
1329 read_unlock_bh(&ip_conntrack_lock);
1330 }
1331
1332 return 0;
1333}
1334
1335/****************************************************************************/
1336static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
1337 enum ip_conntrack_info ctinfo,
1338 unsigned char **data, UnregistrationRequest * urq)
1339{
1340 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1341 int dir = CTINFO2DIR(ctinfo);
1342 int ret;
1343
1344 DEBUGP("ip_ct_ras: URQ\n");
1345
1346 if (set_sig_addr_hook) {
1347 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1348 urq->callSignalAddress.item,
1349 urq->callSignalAddress.count);
1350 if (ret < 0)
1351 return -1;
1352 }
1353
1354 /* Clear old expect */
1355 ip_ct_remove_expectations(ct);
1356 info->sig_port[dir] = 0;
1357 info->sig_port[!dir] = 0;
1358
1359 /* Give it 30 seconds for UCF or URJ */
1360 ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
1361
1362 return 0;
1363}
1364
1365/****************************************************************************/
1366static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
1367 enum ip_conntrack_info ctinfo,
1368 unsigned char **data, AdmissionRequest * arq)
1369{
1370 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1371 int dir = CTINFO2DIR(ctinfo);
1372 u_int32_t ip;
1373 u_int16_t port;
1374
1375 DEBUGP("ip_ct_ras: ARQ\n");
1376
1377 if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1378 get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
1379 ip == ct->tuplehash[dir].tuple.src.ip &&
1380 port == info->sig_port[dir] && set_h225_addr_hook) {
1381 /* Answering ARQ */
1382 return set_h225_addr_hook(pskb, data, 0,
1383 &arq->destCallSignalAddress,
1384 ct->tuplehash[!dir].tuple.dst.ip,
1385 info->sig_port[!dir]);
1386 }
1387
1388 if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1389 get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
1390 ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr_hook) {
1391 /* Calling ARQ */
1392 return set_h225_addr_hook(pskb, data, 0,
1393 &arq->srcCallSignalAddress,
1394 ct->tuplehash[!dir].tuple.dst.ip,
1395 port);
1396 }
1397
1398 return 0;
1399}
1400
1401/****************************************************************************/
1402static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
1403 enum ip_conntrack_info ctinfo,
1404 unsigned char **data, AdmissionConfirm * acf)
1405{
1406 int dir = CTINFO2DIR(ctinfo);
1407 int ret = 0;
1408 u_int32_t ip;
1409 u_int16_t port;
1410 struct ip_conntrack_expect *exp;
1411
1412 DEBUGP("ip_ct_ras: ACF\n");
1413
1414 if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
1415 return 0;
1416
1417 if (ip == ct->tuplehash[dir].tuple.dst.ip) { /* Answering ACF */
1418 if (set_sig_addr_hook)
1419 return set_sig_addr_hook(pskb, ct, ctinfo, data,
1420 &acf->destCallSignalAddress,
1421 1);
1422 return 0;
1423 }
1424
1425 /* Need new expect */
1426 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1427 return -1;
1428 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1429 exp->tuple.src.u.tcp.port = 0;
1430 exp->tuple.dst.ip = ip;
1431 exp->tuple.dst.u.tcp.port = htons(port);
1432 exp->tuple.dst.protonum = IPPROTO_TCP;
1433 exp->mask.src.ip = 0xFFFFFFFF;
1434 exp->mask.src.u.tcp.port = 0;
1435 exp->mask.dst.ip = 0xFFFFFFFF;
1436 exp->mask.dst.u.tcp.port = 0xFFFF;
1437 exp->mask.dst.protonum = 0xFF;
1438 exp->flags = IP_CT_EXPECT_PERMANENT;
1439 exp->expectfn = ip_conntrack_q931_expect;
1440
1441 if (ip_conntrack_expect_related(exp) == 0) {
1442 DEBUGP("ip_ct_ras: expect Q.931 "
1443 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1444 NIPQUAD(exp->tuple.src.ip),
1445 ntohs(exp->tuple.src.u.tcp.port),
1446 NIPQUAD(exp->tuple.dst.ip),
1447 ntohs(exp->tuple.dst.u.tcp.port));
1448 } else
1449 ret = -1;
1450
1451 ip_conntrack_expect_put(exp);
1452
1453 return ret;
1454}
1455
1456/****************************************************************************/
1457static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1458 enum ip_conntrack_info ctinfo,
1459 unsigned char **data, LocationRequest * lrq)
1460{
1461 DEBUGP("ip_ct_ras: LRQ\n");
1462
1463 if (set_ras_addr_hook)
1464 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1465 &lrq->replyAddress, 1);
1466 return 0;
1467}
1468
1469/****************************************************************************/
1470static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1471 enum ip_conntrack_info ctinfo,
1472 unsigned char **data, LocationConfirm * lcf)
1473{
1474 int dir = CTINFO2DIR(ctinfo);
1475 int ret = 0;
1476 u_int32_t ip;
1477 u_int16_t port;
1478 struct ip_conntrack_expect *exp = NULL;
1479
1480 DEBUGP("ip_ct_ras: LCF\n");
1481
1482 if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
1483 return 0;
1484
1485 /* Need new expect for call signal */
1486 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1487 return -1;
1488 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1489 exp->tuple.src.u.tcp.port = 0;
1490 exp->tuple.dst.ip = ip;
1491 exp->tuple.dst.u.tcp.port = htons(port);
1492 exp->tuple.dst.protonum = IPPROTO_TCP;
1493 exp->mask.src.ip = 0xFFFFFFFF;
1494 exp->mask.src.u.tcp.port = 0;
1495 exp->mask.dst.ip = 0xFFFFFFFF;
1496 exp->mask.dst.u.tcp.port = 0xFFFF;
1497 exp->mask.dst.protonum = 0xFF;
1498 exp->flags = IP_CT_EXPECT_PERMANENT;
1499 exp->expectfn = ip_conntrack_q931_expect;
1500
1501 if (ip_conntrack_expect_related(exp) == 0) {
1502 DEBUGP("ip_ct_ras: expect Q.931 "
1503 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1504 NIPQUAD(exp->tuple.src.ip),
1505 ntohs(exp->tuple.src.u.tcp.port),
1506 NIPQUAD(exp->tuple.dst.ip),
1507 ntohs(exp->tuple.dst.u.tcp.port));
1508 } else
1509 ret = -1;
1510
1511 ip_conntrack_expect_put(exp);
1512
1513 /* Ignore rasAddress */
1514
1515 return ret;
1516}
1517
1518/****************************************************************************/
1519static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
1520 enum ip_conntrack_info ctinfo,
1521 unsigned char **data, InfoRequestResponse * irr)
1522{
1523 int ret;
1524
1525 DEBUGP("ip_ct_ras: IRR\n");
1526
1527 if (set_ras_addr_hook) {
1528 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1529 &irr->rasAddress, 1);
1530 if (ret < 0)
1531 return -1;
1532 }
1533
1534 if (set_sig_addr_hook) {
1535 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1536 irr->callSignalAddress.item,
1537 irr->callSignalAddress.count);
1538 if (ret < 0)
1539 return -1;
1540 }
1541
1542 return 0;
1543}
1544
1545/****************************************************************************/
1546static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
1547 enum ip_conntrack_info ctinfo,
1548 unsigned char **data, RasMessage * ras)
1549{
1550 switch (ras->choice) {
1551 case eRasMessage_gatekeeperRequest:
1552 return process_grq(pskb, ct, ctinfo, data,
1553 &ras->gatekeeperRequest);
1554 case eRasMessage_gatekeeperConfirm:
1555 return process_gcf(pskb, ct, ctinfo, data,
1556 &ras->gatekeeperConfirm);
1557 case eRasMessage_registrationRequest:
1558 return process_rrq(pskb, ct, ctinfo, data,
1559 &ras->registrationRequest);
1560 case eRasMessage_registrationConfirm:
1561 return process_rcf(pskb, ct, ctinfo, data,
1562 &ras->registrationConfirm);
1563 case eRasMessage_unregistrationRequest:
1564 return process_urq(pskb, ct, ctinfo, data,
1565 &ras->unregistrationRequest);
1566 case eRasMessage_admissionRequest:
1567 return process_arq(pskb, ct, ctinfo, data,
1568 &ras->admissionRequest);
1569 case eRasMessage_admissionConfirm:
1570 return process_acf(pskb, ct, ctinfo, data,
1571 &ras->admissionConfirm);
1572 case eRasMessage_locationRequest:
1573 return process_lrq(pskb, ct, ctinfo, data,
1574 &ras->locationRequest);
1575 case eRasMessage_locationConfirm:
1576 return process_lcf(pskb, ct, ctinfo, data,
1577 &ras->locationConfirm);
1578 case eRasMessage_infoRequestResponse:
1579 return process_irr(pskb, ct, ctinfo, data,
1580 &ras->infoRequestResponse);
1581 default:
1582 DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
1583 break;
1584 }
1585
1586 return 0;
1587}
1588
1589/****************************************************************************/
1590static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1591 enum ip_conntrack_info ctinfo)
1592{
1593 static RasMessage ras;
1594 unsigned char *data;
1595 int datalen = 0;
1596 int ret;
1597
1598 DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
1599
1600 spin_lock_bh(&ip_h323_lock);
1601
1602 /* Get UDP data */
1603 data = get_udp_data(pskb, &datalen);
1604 if (data == NULL)
1605 goto accept;
1606 DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1607 NIPQUAD((*pskb)->nh.iph->saddr),
1608 NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1609
1610 /* Decode RAS message */
1611 ret = DecodeRasMessage(data, datalen, &ras);
1612 if (ret < 0) {
1613 if (net_ratelimit())
1614 printk("ip_ct_ras: decoding error: %s\n",
1615 ret == H323_ERROR_BOUND ?
1616 "out of bound" : "out of range");
1617 goto accept;
1618 }
1619
1620 /* Process RAS message */
1621 if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
1622 goto drop;
1623
1624 accept:
1625 spin_unlock_bh(&ip_h323_lock);
1626 return NF_ACCEPT;
1627
1628 drop:
1629 spin_unlock_bh(&ip_h323_lock);
1630 if (net_ratelimit())
1631 printk("ip_ct_ras: packet dropped\n");
1632 return NF_DROP;
1633}
1634
1635/****************************************************************************/
1636static struct ip_conntrack_helper ip_conntrack_helper_ras = {
1637 .name = "RAS",
1638 .me = THIS_MODULE,
1639 .max_expected = 32,
1640 .timeout = 240,
1641 .tuple = {.src = {.u = {__constant_htons(RAS_PORT)}},
1642 .dst = {.protonum = IPPROTO_UDP}},
1643 .mask = {.src = {.u = {0xFFFE}},
1644 .dst = {.protonum = 0xFF}},
1645 .help = ras_help,
1646};
1647
1648/****************************************************************************/
1649static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1650 struct ip_conntrack_expect *this)
1651{
1652 write_lock_bh(&ip_conntrack_lock);
1653 new->helper = &ip_conntrack_helper_ras;
1654 write_unlock_bh(&ip_conntrack_lock);
1655}
1656
1657/****************************************************************************/
1658/* Not __exit - called from init() */
1659static void fini(void)
1660{
1661 ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
1662 ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
1663 kfree(h323_buffer);
1664 DEBUGP("ip_ct_h323: fini\n");
1665}
1666
1667/****************************************************************************/
1668static int __init init(void)
1669{
1670 int ret;
1671
1672 h323_buffer = kmalloc(65536, GFP_KERNEL);
1673 if (!h323_buffer)
1674 return -ENOMEM;
1675 if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
1676 (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
1677 fini();
1678 return ret;
1679 }
1680
1681 DEBUGP("ip_ct_h323: init success\n");
1682 return 0;
1683}
1684
1685/****************************************************************************/
1686module_init(init);
1687module_exit(fini);
1688
Jing Min Zhao0f249682006-04-06 14:14:11 -0700[diff] [blame]1689EXPORT_SYMBOL_GPL(get_h225_addr);
1690EXPORT_SYMBOL_GPL(ip_conntrack_h245_expect);
1691EXPORT_SYMBOL_GPL(ip_conntrack_q931_expect);
1692EXPORT_SYMBOL_GPL(set_h245_addr_hook);
1693EXPORT_SYMBOL_GPL(set_h225_addr_hook);
1694EXPORT_SYMBOL_GPL(set_sig_addr_hook);
1695EXPORT_SYMBOL_GPL(set_ras_addr_hook);
1696EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
1697EXPORT_SYMBOL_GPL(nat_t120_hook);
1698EXPORT_SYMBOL_GPL(nat_h245_hook);
1699EXPORT_SYMBOL_GPL(nat_q931_hook);
Jing Min Zhao5e35941d2006-03-20 23:41:17 -0800[diff] [blame]1700
1701MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1702MODULE_DESCRIPTION("H.323 connection tracking helper");
1703MODULE_LICENSE("GPL");