ip_conntrack_helper_h323.c 53 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841
  1. /*
  2. * H.323 connection tracking helper
  3. *
  4. * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
  5. *
  6. * This source code is licensed under General Public License version 2.
  7. *
  8. * Based on the 'brute force' H.323 connection tracking module by
  9. * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  10. *
  11. * For more information, please see http://nath323.sourceforge.net/
  12. */
  13. #include <linux/module.h>
  14. #include <linux/netfilter.h>
  15. #include <linux/ip.h>
  16. #include <net/tcp.h>
  17. #include <linux/netfilter_ipv4/ip_conntrack.h>
  18. #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  19. #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  20. #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
  21. #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
  22. #include <linux/moduleparam.h>
  23. #include <linux/ctype.h>
  24. #include <linux/inet.h>
  25. #if 0
  26. #define DEBUGP printk
  27. #else
  28. #define DEBUGP(format, args...)
  29. #endif
  30. /* Parameters */
  31. static unsigned int default_rrq_ttl = 300;
  32. module_param(default_rrq_ttl, uint, 0600);
  33. MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
  34. static int gkrouted_only = 1;
  35. module_param(gkrouted_only, int, 0600);
  36. MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
  37. static int callforward_filter = 1;
  38. module_param(callforward_filter, bool, 0600);
  39. MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations "
  40. "if both endpoints are on different sides "
  41. "(determined by routing information)");
  42. /* Hooks for NAT */
  43. int (*set_h245_addr_hook) (struct sk_buff ** pskb,
  44. unsigned char **data, int dataoff,
  45. H245_TransportAddress * addr,
  46. __be32 ip, u_int16_t port);
  47. int (*set_h225_addr_hook) (struct sk_buff ** pskb,
  48. unsigned char **data, int dataoff,
  49. TransportAddress * addr,
  50. __be32 ip, u_int16_t port);
  51. int (*set_sig_addr_hook) (struct sk_buff ** pskb,
  52. struct ip_conntrack * ct,
  53. enum ip_conntrack_info ctinfo,
  54. unsigned char **data,
  55. TransportAddress * addr, int count);
  56. int (*set_ras_addr_hook) (struct sk_buff ** pskb,
  57. struct ip_conntrack * ct,
  58. enum ip_conntrack_info ctinfo,
  59. unsigned char **data,
  60. TransportAddress * addr, int count);
  61. int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
  62. struct ip_conntrack * ct,
  63. enum ip_conntrack_info ctinfo,
  64. unsigned char **data, int dataoff,
  65. H245_TransportAddress * addr,
  66. u_int16_t port, u_int16_t rtp_port,
  67. struct ip_conntrack_expect * rtp_exp,
  68. struct ip_conntrack_expect * rtcp_exp);
  69. int (*nat_t120_hook) (struct sk_buff ** pskb,
  70. struct ip_conntrack * ct,
  71. enum ip_conntrack_info ctinfo,
  72. unsigned char **data, int dataoff,
  73. H245_TransportAddress * addr, u_int16_t port,
  74. struct ip_conntrack_expect * exp);
  75. int (*nat_h245_hook) (struct sk_buff ** pskb,
  76. struct ip_conntrack * ct,
  77. enum ip_conntrack_info ctinfo,
  78. unsigned char **data, int dataoff,
  79. TransportAddress * addr, u_int16_t port,
  80. struct ip_conntrack_expect * exp);
  81. int (*nat_callforwarding_hook) (struct sk_buff ** pskb,
  82. struct ip_conntrack * ct,
  83. enum ip_conntrack_info ctinfo,
  84. unsigned char **data, int dataoff,
  85. TransportAddress * addr, u_int16_t port,
  86. struct ip_conntrack_expect * exp);
  87. int (*nat_q931_hook) (struct sk_buff ** pskb,
  88. struct ip_conntrack * ct,
  89. enum ip_conntrack_info ctinfo,
  90. unsigned char **data, TransportAddress * addr, int idx,
  91. u_int16_t port, struct ip_conntrack_expect * exp);
  92. static DEFINE_SPINLOCK(ip_h323_lock);
  93. static char *h323_buffer;
  94. /****************************************************************************/
  95. static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
  96. enum ip_conntrack_info ctinfo,
  97. unsigned char **data, int *datalen, int *dataoff)
  98. {
  99. struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
  100. int dir = CTINFO2DIR(ctinfo);
  101. struct tcphdr _tcph, *th;
  102. int tcpdatalen;
  103. int tcpdataoff;
  104. unsigned char *tpkt;
  105. int tpktlen;
  106. int tpktoff;
  107. /* Get TCP header */
  108. th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
  109. sizeof(_tcph), &_tcph);
  110. if (th == NULL)
  111. return 0;
  112. /* Get TCP data offset */
  113. tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
  114. /* Get TCP data length */
  115. tcpdatalen = (*pskb)->len - tcpdataoff;
  116. if (tcpdatalen <= 0) /* No TCP data */
  117. goto clear_out;
  118. if (*data == NULL) { /* first TPKT */
  119. /* Get first TPKT pointer */
  120. tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
  121. h323_buffer);
  122. BUG_ON(tpkt == NULL);
  123. /* Validate TPKT identifier */
  124. if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
  125. /* Netmeeting sends TPKT header and data separately */
  126. if (info->tpkt_len[dir] > 0) {
  127. DEBUGP("ip_ct_h323: previous packet "
  128. "indicated separate TPKT data of %hu "
  129. "bytes\n", info->tpkt_len[dir]);
  130. if (info->tpkt_len[dir] <= tcpdatalen) {
  131. /* Yes, there was a TPKT header
  132. * received */
  133. *data = tpkt;
  134. *datalen = info->tpkt_len[dir];
  135. *dataoff = 0;
  136. goto out;
  137. }
  138. /* Fragmented TPKT */
  139. if (net_ratelimit())
  140. printk("ip_ct_h323: "
  141. "fragmented TPKT\n");
  142. goto clear_out;
  143. }
  144. /* It is not even a TPKT */
  145. return 0;
  146. }
  147. tpktoff = 0;
  148. } else { /* Next TPKT */
  149. tpktoff = *dataoff + *datalen;
  150. tcpdatalen -= tpktoff;
  151. if (tcpdatalen <= 4) /* No more TPKT */
  152. goto clear_out;
  153. tpkt = *data + *datalen;
  154. /* Validate TPKT identifier */
  155. if (tpkt[0] != 0x03 || tpkt[1] != 0)
  156. goto clear_out;
  157. }
  158. /* Validate TPKT length */
  159. tpktlen = tpkt[2] * 256 + tpkt[3];
  160. if (tpktlen < 4)
  161. goto clear_out;
  162. if (tpktlen > tcpdatalen) {
  163. if (tcpdatalen == 4) { /* Separate TPKT header */
  164. /* Netmeeting sends TPKT header and data separately */
  165. DEBUGP("ip_ct_h323: separate TPKT header indicates "
  166. "there will be TPKT data of %hu bytes\n",
  167. tpktlen - 4);
  168. info->tpkt_len[dir] = tpktlen - 4;
  169. return 0;
  170. }
  171. if (net_ratelimit())
  172. printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
  173. goto clear_out;
  174. }
  175. /* This is the encapsulated data */
  176. *data = tpkt + 4;
  177. *datalen = tpktlen - 4;
  178. *dataoff = tpktoff + 4;
  179. out:
  180. /* Clear TPKT length */
  181. info->tpkt_len[dir] = 0;
  182. return 1;
  183. clear_out:
  184. info->tpkt_len[dir] = 0;
  185. return 0;
  186. }
  187. /****************************************************************************/
  188. static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
  189. __be32 * ip, u_int16_t * port)
  190. {
  191. unsigned char *p;
  192. if (addr->choice != eH245_TransportAddress_unicastAddress ||
  193. addr->unicastAddress.choice != eUnicastAddress_iPAddress)
  194. return 0;
  195. p = data + addr->unicastAddress.iPAddress.network;
  196. *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
  197. *port = (p[4] << 8) | (p[5]);
  198. return 1;
  199. }
  200. /****************************************************************************/
  201. static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
  202. enum ip_conntrack_info ctinfo,
  203. unsigned char **data, int dataoff,
  204. H245_TransportAddress * addr)
  205. {
  206. int dir = CTINFO2DIR(ctinfo);
  207. int ret = 0;
  208. __be32 ip;
  209. u_int16_t port;
  210. u_int16_t rtp_port;
  211. struct ip_conntrack_expect *rtp_exp;
  212. struct ip_conntrack_expect *rtcp_exp;
  213. typeof(nat_rtp_rtcp_hook) nat_rtp_rtcp;
  214. /* Read RTP or RTCP address */
  215. if (!get_h245_addr(*data, addr, &ip, &port) ||
  216. ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
  217. return 0;
  218. /* RTP port is even */
  219. rtp_port = port & (~1);
  220. /* Create expect for RTP */
  221. if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
  222. return -1;
  223. rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  224. rtp_exp->tuple.src.u.udp.port = 0;
  225. rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
  226. rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
  227. rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
  228. rtp_exp->mask.src.ip = htonl(0xFFFFFFFF);
  229. rtp_exp->mask.src.u.udp.port = 0;
  230. rtp_exp->mask.dst.ip = htonl(0xFFFFFFFF);
  231. rtp_exp->mask.dst.u.udp.port = htons(0xFFFF);
  232. rtp_exp->mask.dst.protonum = 0xFF;
  233. rtp_exp->flags = 0;
  234. /* Create expect for RTCP */
  235. if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
  236. ip_conntrack_expect_put(rtp_exp);
  237. return -1;
  238. }
  239. rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  240. rtcp_exp->tuple.src.u.udp.port = 0;
  241. rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
  242. rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
  243. rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
  244. rtcp_exp->mask.src.ip = htonl(0xFFFFFFFF);
  245. rtcp_exp->mask.src.u.udp.port = 0;
  246. rtcp_exp->mask.dst.ip = htonl(0xFFFFFFFF);
  247. rtcp_exp->mask.dst.u.udp.port = htons(0xFFFF);
  248. rtcp_exp->mask.dst.protonum = 0xFF;
  249. rtcp_exp->flags = 0;
  250. if (ct->tuplehash[dir].tuple.src.ip !=
  251. ct->tuplehash[!dir].tuple.dst.ip &&
  252. (nat_rtp_rtcp = rcu_dereference(nat_rtp_rtcp_hook))) {
  253. /* NAT needed */
  254. ret = nat_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
  255. addr, port, rtp_port, rtp_exp, rtcp_exp);
  256. } else { /* Conntrack only */
  257. rtp_exp->expectfn = NULL;
  258. rtcp_exp->expectfn = NULL;
  259. if (ip_conntrack_expect_related(rtp_exp) == 0) {
  260. if (ip_conntrack_expect_related(rtcp_exp) == 0) {
  261. DEBUGP("ip_ct_h323: expect RTP "
  262. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  263. NIPQUAD(rtp_exp->tuple.src.ip),
  264. ntohs(rtp_exp->tuple.src.u.udp.port),
  265. NIPQUAD(rtp_exp->tuple.dst.ip),
  266. ntohs(rtp_exp->tuple.dst.u.udp.port));
  267. DEBUGP("ip_ct_h323: expect RTCP "
  268. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  269. NIPQUAD(rtcp_exp->tuple.src.ip),
  270. ntohs(rtcp_exp->tuple.src.u.udp.port),
  271. NIPQUAD(rtcp_exp->tuple.dst.ip),
  272. ntohs(rtcp_exp->tuple.dst.u.udp.port));
  273. } else {
  274. ip_conntrack_unexpect_related(rtp_exp);
  275. ret = -1;
  276. }
  277. } else
  278. ret = -1;
  279. }
  280. ip_conntrack_expect_put(rtp_exp);
  281. ip_conntrack_expect_put(rtcp_exp);
  282. return ret;
  283. }
  284. /****************************************************************************/
  285. static int expect_t120(struct sk_buff **pskb,
  286. struct ip_conntrack *ct,
  287. enum ip_conntrack_info ctinfo,
  288. unsigned char **data, int dataoff,
  289. H245_TransportAddress * addr)
  290. {
  291. int dir = CTINFO2DIR(ctinfo);
  292. int ret = 0;
  293. __be32 ip;
  294. u_int16_t port;
  295. struct ip_conntrack_expect *exp = NULL;
  296. typeof(nat_t120_hook) nat_t120;
  297. /* Read T.120 address */
  298. if (!get_h245_addr(*data, addr, &ip, &port) ||
  299. ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
  300. return 0;
  301. /* Create expect for T.120 connections */
  302. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  303. return -1;
  304. exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  305. exp->tuple.src.u.tcp.port = 0;
  306. exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
  307. exp->tuple.dst.u.tcp.port = htons(port);
  308. exp->tuple.dst.protonum = IPPROTO_TCP;
  309. exp->mask.src.ip = htonl(0xFFFFFFFF);
  310. exp->mask.src.u.tcp.port = 0;
  311. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  312. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  313. exp->mask.dst.protonum = 0xFF;
  314. exp->flags = IP_CT_EXPECT_PERMANENT; /* Accept multiple channels */
  315. if (ct->tuplehash[dir].tuple.src.ip !=
  316. ct->tuplehash[!dir].tuple.dst.ip &&
  317. (nat_t120 = rcu_dereference(nat_t120_hook))) {
  318. /* NAT needed */
  319. ret = nat_t120(pskb, ct, ctinfo, data, dataoff, addr,
  320. port, exp);
  321. } else { /* Conntrack only */
  322. exp->expectfn = NULL;
  323. if (ip_conntrack_expect_related(exp) == 0) {
  324. DEBUGP("ip_ct_h323: expect T.120 "
  325. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  326. NIPQUAD(exp->tuple.src.ip),
  327. ntohs(exp->tuple.src.u.tcp.port),
  328. NIPQUAD(exp->tuple.dst.ip),
  329. ntohs(exp->tuple.dst.u.tcp.port));
  330. } else
  331. ret = -1;
  332. }
  333. ip_conntrack_expect_put(exp);
  334. return ret;
  335. }
  336. /****************************************************************************/
  337. static int process_h245_channel(struct sk_buff **pskb,
  338. struct ip_conntrack *ct,
  339. enum ip_conntrack_info ctinfo,
  340. unsigned char **data, int dataoff,
  341. H2250LogicalChannelParameters * channel)
  342. {
  343. int ret;
  344. if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
  345. /* RTP */
  346. ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
  347. &channel->mediaChannel);
  348. if (ret < 0)
  349. return -1;
  350. }
  351. if (channel->
  352. options & eH2250LogicalChannelParameters_mediaControlChannel) {
  353. /* RTCP */
  354. ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
  355. &channel->mediaControlChannel);
  356. if (ret < 0)
  357. return -1;
  358. }
  359. return 0;
  360. }
  361. /****************************************************************************/
  362. static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
  363. enum ip_conntrack_info ctinfo,
  364. unsigned char **data, int dataoff,
  365. OpenLogicalChannel * olc)
  366. {
  367. int ret;
  368. DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
  369. if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
  370. eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
  371. {
  372. ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
  373. &olc->
  374. forwardLogicalChannelParameters.
  375. multiplexParameters.
  376. h2250LogicalChannelParameters);
  377. if (ret < 0)
  378. return -1;
  379. }
  380. if ((olc->options &
  381. eOpenLogicalChannel_reverseLogicalChannelParameters) &&
  382. (olc->reverseLogicalChannelParameters.options &
  383. eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
  384. && (olc->reverseLogicalChannelParameters.multiplexParameters.
  385. choice ==
  386. eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
  387. {
  388. ret =
  389. process_h245_channel(pskb, ct, ctinfo, data, dataoff,
  390. &olc->
  391. reverseLogicalChannelParameters.
  392. multiplexParameters.
  393. h2250LogicalChannelParameters);
  394. if (ret < 0)
  395. return -1;
  396. }
  397. if ((olc->options & eOpenLogicalChannel_separateStack) &&
  398. olc->forwardLogicalChannelParameters.dataType.choice ==
  399. eDataType_data &&
  400. olc->forwardLogicalChannelParameters.dataType.data.application.
  401. choice == eDataApplicationCapability_application_t120 &&
  402. olc->forwardLogicalChannelParameters.dataType.data.application.
  403. t120.choice == eDataProtocolCapability_separateLANStack &&
  404. olc->separateStack.networkAddress.choice ==
  405. eNetworkAccessParameters_networkAddress_localAreaAddress) {
  406. ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
  407. &olc->separateStack.networkAddress.
  408. localAreaAddress);
  409. if (ret < 0)
  410. return -1;
  411. }
  412. return 0;
  413. }
  414. /****************************************************************************/
  415. static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
  416. enum ip_conntrack_info ctinfo,
  417. unsigned char **data, int dataoff,
  418. OpenLogicalChannelAck * olca)
  419. {
  420. H2250LogicalChannelAckParameters *ack;
  421. int ret;
  422. DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
  423. if ((olca->options &
  424. eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
  425. (olca->reverseLogicalChannelParameters.options &
  426. eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
  427. && (olca->reverseLogicalChannelParameters.multiplexParameters.
  428. choice ==
  429. eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
  430. {
  431. ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
  432. &olca->
  433. reverseLogicalChannelParameters.
  434. multiplexParameters.
  435. h2250LogicalChannelParameters);
  436. if (ret < 0)
  437. return -1;
  438. }
  439. if ((olca->options &
  440. eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
  441. (olca->forwardMultiplexAckParameters.choice ==
  442. eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
  443. {
  444. ack = &olca->forwardMultiplexAckParameters.
  445. h2250LogicalChannelAckParameters;
  446. if (ack->options &
  447. eH2250LogicalChannelAckParameters_mediaChannel) {
  448. /* RTP */
  449. ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
  450. &ack->mediaChannel);
  451. if (ret < 0)
  452. return -1;
  453. }
  454. if (ack->options &
  455. eH2250LogicalChannelAckParameters_mediaControlChannel) {
  456. /* RTCP */
  457. ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
  458. &ack->mediaControlChannel);
  459. if (ret < 0)
  460. return -1;
  461. }
  462. }
  463. return 0;
  464. }
  465. /****************************************************************************/
  466. static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
  467. enum ip_conntrack_info ctinfo,
  468. unsigned char **data, int dataoff,
  469. MultimediaSystemControlMessage * mscm)
  470. {
  471. switch (mscm->choice) {
  472. case eMultimediaSystemControlMessage_request:
  473. if (mscm->request.choice ==
  474. eRequestMessage_openLogicalChannel) {
  475. return process_olc(pskb, ct, ctinfo, data, dataoff,
  476. &mscm->request.openLogicalChannel);
  477. }
  478. DEBUGP("ip_ct_h323: H.245 Request %d\n",
  479. mscm->request.choice);
  480. break;
  481. case eMultimediaSystemControlMessage_response:
  482. if (mscm->response.choice ==
  483. eResponseMessage_openLogicalChannelAck) {
  484. return process_olca(pskb, ct, ctinfo, data, dataoff,
  485. &mscm->response.
  486. openLogicalChannelAck);
  487. }
  488. DEBUGP("ip_ct_h323: H.245 Response %d\n",
  489. mscm->response.choice);
  490. break;
  491. default:
  492. DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
  493. break;
  494. }
  495. return 0;
  496. }
  497. /****************************************************************************/
  498. static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
  499. enum ip_conntrack_info ctinfo)
  500. {
  501. static MultimediaSystemControlMessage mscm;
  502. unsigned char *data = NULL;
  503. int datalen;
  504. int dataoff;
  505. int ret;
  506. /* Until there's been traffic both ways, don't look in packets. */
  507. if (ctinfo != IP_CT_ESTABLISHED
  508. && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
  509. return NF_ACCEPT;
  510. }
  511. DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
  512. spin_lock_bh(&ip_h323_lock);
  513. /* Process each TPKT */
  514. while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
  515. DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
  516. NIPQUAD((*pskb)->nh.iph->saddr),
  517. NIPQUAD((*pskb)->nh.iph->daddr), datalen);
  518. /* Decode H.245 signal */
  519. ret = DecodeMultimediaSystemControlMessage(data, datalen,
  520. &mscm);
  521. if (ret < 0) {
  522. if (net_ratelimit())
  523. printk("ip_ct_h245: decoding error: %s\n",
  524. ret == H323_ERROR_BOUND ?
  525. "out of bound" : "out of range");
  526. /* We don't drop when decoding error */
  527. break;
  528. }
  529. /* Process H.245 signal */
  530. if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
  531. goto drop;
  532. }
  533. spin_unlock_bh(&ip_h323_lock);
  534. return NF_ACCEPT;
  535. drop:
  536. spin_unlock_bh(&ip_h323_lock);
  537. if (net_ratelimit())
  538. printk("ip_ct_h245: packet dropped\n");
  539. return NF_DROP;
  540. }
  541. /****************************************************************************/
  542. static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
  543. .name = "H.245",
  544. .me = THIS_MODULE,
  545. .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
  546. .timeout = 240,
  547. .tuple = {.dst = {.protonum = IPPROTO_TCP}},
  548. .mask = {.src = {.u = {0xFFFF}},
  549. .dst = {.protonum = 0xFF}},
  550. .help = h245_help
  551. };
  552. /****************************************************************************/
  553. void ip_conntrack_h245_expect(struct ip_conntrack *new,
  554. struct ip_conntrack_expect *this)
  555. {
  556. write_lock_bh(&ip_conntrack_lock);
  557. new->helper = &ip_conntrack_helper_h245;
  558. write_unlock_bh(&ip_conntrack_lock);
  559. }
  560. /****************************************************************************/
  561. int get_h225_addr(unsigned char *data, TransportAddress * addr,
  562. __be32 * ip, u_int16_t * port)
  563. {
  564. unsigned char *p;
  565. if (addr->choice != eTransportAddress_ipAddress)
  566. return 0;
  567. p = data + addr->ipAddress.ip;
  568. *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
  569. *port = (p[4] << 8) | (p[5]);
  570. return 1;
  571. }
  572. /****************************************************************************/
  573. static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
  574. enum ip_conntrack_info ctinfo,
  575. unsigned char **data, int dataoff,
  576. TransportAddress * addr)
  577. {
  578. int dir = CTINFO2DIR(ctinfo);
  579. int ret = 0;
  580. __be32 ip;
  581. u_int16_t port;
  582. struct ip_conntrack_expect *exp = NULL;
  583. typeof(nat_h245_hook) nat_h245;
  584. /* Read h245Address */
  585. if (!get_h225_addr(*data, addr, &ip, &port) ||
  586. ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
  587. return 0;
  588. /* Create expect for h245 connection */
  589. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  590. return -1;
  591. exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  592. exp->tuple.src.u.tcp.port = 0;
  593. exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
  594. exp->tuple.dst.u.tcp.port = htons(port);
  595. exp->tuple.dst.protonum = IPPROTO_TCP;
  596. exp->mask.src.ip = htonl(0xFFFFFFFF);
  597. exp->mask.src.u.tcp.port = 0;
  598. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  599. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  600. exp->mask.dst.protonum = 0xFF;
  601. exp->flags = 0;
  602. if (ct->tuplehash[dir].tuple.src.ip !=
  603. ct->tuplehash[!dir].tuple.dst.ip &&
  604. (nat_h245 = rcu_dereference(nat_h245_hook))) {
  605. /* NAT needed */
  606. ret = nat_h245(pskb, ct, ctinfo, data, dataoff, addr,
  607. port, exp);
  608. } else { /* Conntrack only */
  609. exp->expectfn = ip_conntrack_h245_expect;
  610. if (ip_conntrack_expect_related(exp) == 0) {
  611. DEBUGP("ip_ct_q931: expect H.245 "
  612. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  613. NIPQUAD(exp->tuple.src.ip),
  614. ntohs(exp->tuple.src.u.tcp.port),
  615. NIPQUAD(exp->tuple.dst.ip),
  616. ntohs(exp->tuple.dst.u.tcp.port));
  617. } else
  618. ret = -1;
  619. }
  620. ip_conntrack_expect_put(exp);
  621. return ret;
  622. }
  623. /* Forwarding declaration */
  624. void ip_conntrack_q931_expect(struct ip_conntrack *new,
  625. struct ip_conntrack_expect *this);
  626. /****************************************************************************/
  627. static int expect_callforwarding(struct sk_buff **pskb,
  628. struct ip_conntrack *ct,
  629. enum ip_conntrack_info ctinfo,
  630. unsigned char **data, int dataoff,
  631. TransportAddress * addr)
  632. {
  633. int dir = CTINFO2DIR(ctinfo);
  634. int ret = 0;
  635. __be32 ip;
  636. u_int16_t port;
  637. struct ip_conntrack_expect *exp = NULL;
  638. typeof(nat_callforwarding_hook) nat_callforwarding;
  639. /* Read alternativeAddress */
  640. if (!get_h225_addr(*data, addr, &ip, &port) || port == 0)
  641. return 0;
  642. /* If the calling party is on the same side of the forward-to party,
  643. * we don't need to track the second call */
  644. if (callforward_filter) {
  645. struct rtable *rt1, *rt2;
  646. struct flowi fl1 = {
  647. .fl4_dst = ip,
  648. };
  649. struct flowi fl2 = {
  650. .fl4_dst = ct->tuplehash[!dir].tuple.src.ip,
  651. };
  652. if (ip_route_output_key(&rt1, &fl1) == 0) {
  653. if (ip_route_output_key(&rt2, &fl2) == 0) {
  654. if (rt1->rt_gateway == rt2->rt_gateway &&
  655. rt1->u.dst.dev == rt2->u.dst.dev)
  656. ret = 1;
  657. dst_release(&rt2->u.dst);
  658. }
  659. dst_release(&rt1->u.dst);
  660. }
  661. if (ret) {
  662. DEBUGP("ip_ct_q931: Call Forwarding not tracked\n");
  663. return 0;
  664. }
  665. }
  666. /* Create expect for the second call leg */
  667. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  668. return -1;
  669. exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  670. exp->tuple.src.u.tcp.port = 0;
  671. exp->tuple.dst.ip = ip;
  672. exp->tuple.dst.u.tcp.port = htons(port);
  673. exp->tuple.dst.protonum = IPPROTO_TCP;
  674. exp->mask.src.ip = htonl(0xFFFFFFFF);
  675. exp->mask.src.u.tcp.port = 0;
  676. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  677. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  678. exp->mask.dst.protonum = 0xFF;
  679. exp->flags = 0;
  680. if (ct->tuplehash[dir].tuple.src.ip !=
  681. ct->tuplehash[!dir].tuple.dst.ip &&
  682. (nat_callforwarding = rcu_dereference(nat_callforwarding_hook))) {
  683. /* Need NAT */
  684. ret = nat_callforwarding(pskb, ct, ctinfo, data, dataoff,
  685. addr, port, exp);
  686. } else { /* Conntrack only */
  687. exp->expectfn = ip_conntrack_q931_expect;
  688. if (ip_conntrack_expect_related(exp) == 0) {
  689. DEBUGP("ip_ct_q931: expect Call Forwarding "
  690. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  691. NIPQUAD(exp->tuple.src.ip),
  692. ntohs(exp->tuple.src.u.tcp.port),
  693. NIPQUAD(exp->tuple.dst.ip),
  694. ntohs(exp->tuple.dst.u.tcp.port));
  695. } else
  696. ret = -1;
  697. }
  698. ip_conntrack_expect_put(exp);
  699. return ret;
  700. }
  701. /****************************************************************************/
  702. static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
  703. enum ip_conntrack_info ctinfo,
  704. unsigned char **data, int dataoff,
  705. Setup_UUIE * setup)
  706. {
  707. int dir = CTINFO2DIR(ctinfo);
  708. int ret;
  709. int i;
  710. __be32 ip;
  711. u_int16_t port;
  712. typeof(set_h225_addr_hook) set_h225_addr;
  713. DEBUGP("ip_ct_q931: Setup\n");
  714. if (setup->options & eSetup_UUIE_h245Address) {
  715. ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
  716. &setup->h245Address);
  717. if (ret < 0)
  718. return -1;
  719. }
  720. set_h225_addr = rcu_dereference(set_h225_addr_hook);
  721. if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
  722. (set_h225_addr) &&
  723. get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
  724. ip != ct->tuplehash[!dir].tuple.src.ip) {
  725. DEBUGP("ip_ct_q931: set destCallSignalAddress "
  726. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  727. NIPQUAD(ip), port,
  728. NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
  729. ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
  730. ret = set_h225_addr(pskb, data, dataoff,
  731. &setup->destCallSignalAddress,
  732. ct->tuplehash[!dir].tuple.src.ip,
  733. ntohs(ct->tuplehash[!dir].tuple.src.
  734. u.tcp.port));
  735. if (ret < 0)
  736. return -1;
  737. }
  738. if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
  739. (set_h225_addr) &&
  740. get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
  741. && ip != ct->tuplehash[!dir].tuple.dst.ip) {
  742. DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
  743. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  744. NIPQUAD(ip), port,
  745. NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
  746. ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
  747. ret = set_h225_addr(pskb, data, dataoff,
  748. &setup->sourceCallSignalAddress,
  749. ct->tuplehash[!dir].tuple.dst.ip,
  750. ntohs(ct->tuplehash[!dir].tuple.dst.
  751. u.tcp.port));
  752. if (ret < 0)
  753. return -1;
  754. }
  755. if (setup->options & eSetup_UUIE_fastStart) {
  756. for (i = 0; i < setup->fastStart.count; i++) {
  757. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  758. &setup->fastStart.item[i]);
  759. if (ret < 0)
  760. return -1;
  761. }
  762. }
  763. return 0;
  764. }
  765. /****************************************************************************/
  766. static int process_callproceeding(struct sk_buff **pskb,
  767. struct ip_conntrack *ct,
  768. enum ip_conntrack_info ctinfo,
  769. unsigned char **data, int dataoff,
  770. CallProceeding_UUIE * callproc)
  771. {
  772. int ret;
  773. int i;
  774. DEBUGP("ip_ct_q931: CallProceeding\n");
  775. if (callproc->options & eCallProceeding_UUIE_h245Address) {
  776. ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
  777. &callproc->h245Address);
  778. if (ret < 0)
  779. return -1;
  780. }
  781. if (callproc->options & eCallProceeding_UUIE_fastStart) {
  782. for (i = 0; i < callproc->fastStart.count; i++) {
  783. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  784. &callproc->fastStart.item[i]);
  785. if (ret < 0)
  786. return -1;
  787. }
  788. }
  789. return 0;
  790. }
  791. /****************************************************************************/
  792. static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
  793. enum ip_conntrack_info ctinfo,
  794. unsigned char **data, int dataoff,
  795. Connect_UUIE * connect)
  796. {
  797. int ret;
  798. int i;
  799. DEBUGP("ip_ct_q931: Connect\n");
  800. if (connect->options & eConnect_UUIE_h245Address) {
  801. ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
  802. &connect->h245Address);
  803. if (ret < 0)
  804. return -1;
  805. }
  806. if (connect->options & eConnect_UUIE_fastStart) {
  807. for (i = 0; i < connect->fastStart.count; i++) {
  808. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  809. &connect->fastStart.item[i]);
  810. if (ret < 0)
  811. return -1;
  812. }
  813. }
  814. return 0;
  815. }
  816. /****************************************************************************/
  817. static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
  818. enum ip_conntrack_info ctinfo,
  819. unsigned char **data, int dataoff,
  820. Alerting_UUIE * alert)
  821. {
  822. int ret;
  823. int i;
  824. DEBUGP("ip_ct_q931: Alerting\n");
  825. if (alert->options & eAlerting_UUIE_h245Address) {
  826. ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
  827. &alert->h245Address);
  828. if (ret < 0)
  829. return -1;
  830. }
  831. if (alert->options & eAlerting_UUIE_fastStart) {
  832. for (i = 0; i < alert->fastStart.count; i++) {
  833. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  834. &alert->fastStart.item[i]);
  835. if (ret < 0)
  836. return -1;
  837. }
  838. }
  839. return 0;
  840. }
  841. /****************************************************************************/
  842. static int process_information(struct sk_buff **pskb,
  843. struct ip_conntrack *ct,
  844. enum ip_conntrack_info ctinfo,
  845. unsigned char **data, int dataoff,
  846. Information_UUIE * info)
  847. {
  848. int ret;
  849. int i;
  850. DEBUGP("ip_ct_q931: Information\n");
  851. if (info->options & eInformation_UUIE_fastStart) {
  852. for (i = 0; i < info->fastStart.count; i++) {
  853. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  854. &info->fastStart.item[i]);
  855. if (ret < 0)
  856. return -1;
  857. }
  858. }
  859. return 0;
  860. }
  861. /****************************************************************************/
  862. static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
  863. enum ip_conntrack_info ctinfo,
  864. unsigned char **data, int dataoff,
  865. Facility_UUIE * facility)
  866. {
  867. int ret;
  868. int i;
  869. DEBUGP("ip_ct_q931: Facility\n");
  870. if (facility->reason.choice == eFacilityReason_callForwarded) {
  871. if (facility->options & eFacility_UUIE_alternativeAddress)
  872. return expect_callforwarding(pskb, ct, ctinfo, data,
  873. dataoff,
  874. &facility->
  875. alternativeAddress);
  876. return 0;
  877. }
  878. if (facility->options & eFacility_UUIE_h245Address) {
  879. ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
  880. &facility->h245Address);
  881. if (ret < 0)
  882. return -1;
  883. }
  884. if (facility->options & eFacility_UUIE_fastStart) {
  885. for (i = 0; i < facility->fastStart.count; i++) {
  886. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  887. &facility->fastStart.item[i]);
  888. if (ret < 0)
  889. return -1;
  890. }
  891. }
  892. return 0;
  893. }
  894. /****************************************************************************/
  895. static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
  896. enum ip_conntrack_info ctinfo,
  897. unsigned char **data, int dataoff,
  898. Progress_UUIE * progress)
  899. {
  900. int ret;
  901. int i;
  902. DEBUGP("ip_ct_q931: Progress\n");
  903. if (progress->options & eProgress_UUIE_h245Address) {
  904. ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
  905. &progress->h245Address);
  906. if (ret < 0)
  907. return -1;
  908. }
  909. if (progress->options & eProgress_UUIE_fastStart) {
  910. for (i = 0; i < progress->fastStart.count; i++) {
  911. ret = process_olc(pskb, ct, ctinfo, data, dataoff,
  912. &progress->fastStart.item[i]);
  913. if (ret < 0)
  914. return -1;
  915. }
  916. }
  917. return 0;
  918. }
  919. /****************************************************************************/
  920. static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
  921. enum ip_conntrack_info ctinfo,
  922. unsigned char **data, int dataoff, Q931 * q931)
  923. {
  924. H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
  925. int i;
  926. int ret = 0;
  927. switch (pdu->h323_message_body.choice) {
  928. case eH323_UU_PDU_h323_message_body_setup:
  929. ret = process_setup(pskb, ct, ctinfo, data, dataoff,
  930. &pdu->h323_message_body.setup);
  931. break;
  932. case eH323_UU_PDU_h323_message_body_callProceeding:
  933. ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
  934. &pdu->h323_message_body.
  935. callProceeding);
  936. break;
  937. case eH323_UU_PDU_h323_message_body_connect:
  938. ret = process_connect(pskb, ct, ctinfo, data, dataoff,
  939. &pdu->h323_message_body.connect);
  940. break;
  941. case eH323_UU_PDU_h323_message_body_alerting:
  942. ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
  943. &pdu->h323_message_body.alerting);
  944. break;
  945. case eH323_UU_PDU_h323_message_body_information:
  946. ret = process_information(pskb, ct, ctinfo, data, dataoff,
  947. &pdu->h323_message_body.
  948. information);
  949. break;
  950. case eH323_UU_PDU_h323_message_body_facility:
  951. ret = process_facility(pskb, ct, ctinfo, data, dataoff,
  952. &pdu->h323_message_body.facility);
  953. break;
  954. case eH323_UU_PDU_h323_message_body_progress:
  955. ret = process_progress(pskb, ct, ctinfo, data, dataoff,
  956. &pdu->h323_message_body.progress);
  957. break;
  958. default:
  959. DEBUGP("ip_ct_q931: Q.931 signal %d\n",
  960. pdu->h323_message_body.choice);
  961. break;
  962. }
  963. if (ret < 0)
  964. return -1;
  965. if (pdu->options & eH323_UU_PDU_h245Control) {
  966. for (i = 0; i < pdu->h245Control.count; i++) {
  967. ret = process_h245(pskb, ct, ctinfo, data, dataoff,
  968. &pdu->h245Control.item[i]);
  969. if (ret < 0)
  970. return -1;
  971. }
  972. }
  973. return 0;
  974. }
  975. /****************************************************************************/
  976. static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
  977. enum ip_conntrack_info ctinfo)
  978. {
  979. static Q931 q931;
  980. unsigned char *data = NULL;
  981. int datalen;
  982. int dataoff;
  983. int ret;
  984. /* Until there's been traffic both ways, don't look in packets. */
  985. if (ctinfo != IP_CT_ESTABLISHED
  986. && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
  987. return NF_ACCEPT;
  988. }
  989. DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
  990. spin_lock_bh(&ip_h323_lock);
  991. /* Process each TPKT */
  992. while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
  993. DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
  994. NIPQUAD((*pskb)->nh.iph->saddr),
  995. NIPQUAD((*pskb)->nh.iph->daddr), datalen);
  996. /* Decode Q.931 signal */
  997. ret = DecodeQ931(data, datalen, &q931);
  998. if (ret < 0) {
  999. if (net_ratelimit())
  1000. printk("ip_ct_q931: decoding error: %s\n",
  1001. ret == H323_ERROR_BOUND ?
  1002. "out of bound" : "out of range");
  1003. /* We don't drop when decoding error */
  1004. break;
  1005. }
  1006. /* Process Q.931 signal */
  1007. if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
  1008. goto drop;
  1009. }
  1010. spin_unlock_bh(&ip_h323_lock);
  1011. return NF_ACCEPT;
  1012. drop:
  1013. spin_unlock_bh(&ip_h323_lock);
  1014. if (net_ratelimit())
  1015. printk("ip_ct_q931: packet dropped\n");
  1016. return NF_DROP;
  1017. }
  1018. /****************************************************************************/
  1019. static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
  1020. .name = "Q.931",
  1021. .me = THIS_MODULE,
  1022. .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
  1023. .timeout = 240,
  1024. .tuple = {.src = {.u = {.tcp = {.port = __constant_htons(Q931_PORT)}}},
  1025. .dst = {.protonum = IPPROTO_TCP}},
  1026. .mask = {.src = {.u = {0xFFFF}},
  1027. .dst = {.protonum = 0xFF}},
  1028. .help = q931_help
  1029. };
  1030. /****************************************************************************/
  1031. void ip_conntrack_q931_expect(struct ip_conntrack *new,
  1032. struct ip_conntrack_expect *this)
  1033. {
  1034. write_lock_bh(&ip_conntrack_lock);
  1035. new->helper = &ip_conntrack_helper_q931;
  1036. write_unlock_bh(&ip_conntrack_lock);
  1037. }
  1038. /****************************************************************************/
  1039. static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
  1040. {
  1041. struct udphdr _uh, *uh;
  1042. int dataoff;
  1043. uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
  1044. &_uh);
  1045. if (uh == NULL)
  1046. return NULL;
  1047. dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
  1048. if (dataoff >= (*pskb)->len)
  1049. return NULL;
  1050. *datalen = (*pskb)->len - dataoff;
  1051. return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
  1052. }
  1053. /****************************************************************************/
  1054. static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
  1055. __be32 ip, u_int16_t port)
  1056. {
  1057. struct ip_conntrack_expect *exp;
  1058. struct ip_conntrack_tuple tuple;
  1059. tuple.src.ip = 0;
  1060. tuple.src.u.tcp.port = 0;
  1061. tuple.dst.ip = ip;
  1062. tuple.dst.u.tcp.port = htons(port);
  1063. tuple.dst.protonum = IPPROTO_TCP;
  1064. exp = __ip_conntrack_expect_find(&tuple);
  1065. if (exp && exp->master == ct)
  1066. return exp;
  1067. return NULL;
  1068. }
  1069. /****************************************************************************/
  1070. static int set_expect_timeout(struct ip_conntrack_expect *exp,
  1071. unsigned timeout)
  1072. {
  1073. if (!exp || !del_timer(&exp->timeout))
  1074. return 0;
  1075. exp->timeout.expires = jiffies + timeout * HZ;
  1076. add_timer(&exp->timeout);
  1077. return 1;
  1078. }
  1079. /****************************************************************************/
  1080. static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
  1081. enum ip_conntrack_info ctinfo,
  1082. unsigned char **data,
  1083. TransportAddress * addr, int count)
  1084. {
  1085. struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
  1086. int dir = CTINFO2DIR(ctinfo);
  1087. int ret = 0;
  1088. int i;
  1089. __be32 ip;
  1090. u_int16_t port;
  1091. struct ip_conntrack_expect *exp;
  1092. typeof(nat_q931_hook) nat_q931;
  1093. /* Look for the first related address */
  1094. for (i = 0; i < count; i++) {
  1095. if (get_h225_addr(*data, &addr[i], &ip, &port) &&
  1096. ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
  1097. break;
  1098. }
  1099. if (i >= count) /* Not found */
  1100. return 0;
  1101. /* Create expect for Q.931 */
  1102. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  1103. return -1;
  1104. exp->tuple.src.ip = gkrouted_only ? /* only accept calls from GK? */
  1105. ct->tuplehash[!dir].tuple.src.ip : 0;
  1106. exp->tuple.src.u.tcp.port = 0;
  1107. exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
  1108. exp->tuple.dst.u.tcp.port = htons(port);
  1109. exp->tuple.dst.protonum = IPPROTO_TCP;
  1110. exp->mask.src.ip = gkrouted_only ? htonl(0xFFFFFFFF) : 0;
  1111. exp->mask.src.u.tcp.port = 0;
  1112. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  1113. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  1114. exp->mask.dst.protonum = 0xFF;
  1115. exp->flags = IP_CT_EXPECT_PERMANENT; /* Accept multiple calls */
  1116. nat_q931 = rcu_dereference(nat_q931_hook);
  1117. if (nat_q931) { /* Need NAT */
  1118. ret = nat_q931(pskb, ct, ctinfo, data, addr, i, port, exp);
  1119. } else { /* Conntrack only */
  1120. exp->expectfn = ip_conntrack_q931_expect;
  1121. if (ip_conntrack_expect_related(exp) == 0) {
  1122. DEBUGP("ip_ct_ras: expect Q.931 "
  1123. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  1124. NIPQUAD(exp->tuple.src.ip),
  1125. ntohs(exp->tuple.src.u.tcp.port),
  1126. NIPQUAD(exp->tuple.dst.ip),
  1127. ntohs(exp->tuple.dst.u.tcp.port));
  1128. /* Save port for looking up expect in processing RCF */
  1129. info->sig_port[dir] = port;
  1130. } else
  1131. ret = -1;
  1132. }
  1133. ip_conntrack_expect_put(exp);
  1134. return ret;
  1135. }
  1136. /****************************************************************************/
  1137. static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
  1138. enum ip_conntrack_info ctinfo,
  1139. unsigned char **data, GatekeeperRequest * grq)
  1140. {
  1141. typeof(set_ras_addr_hook) set_ras_addr;
  1142. DEBUGP("ip_ct_ras: GRQ\n");
  1143. set_ras_addr = rcu_dereference(set_ras_addr_hook);
  1144. if (set_ras_addr) /* NATed */
  1145. return set_ras_addr(pskb, ct, ctinfo, data,
  1146. &grq->rasAddress, 1);
  1147. return 0;
  1148. }
  1149. /* Declare before using */
  1150. static void ip_conntrack_ras_expect(struct ip_conntrack *new,
  1151. struct ip_conntrack_expect *this);
  1152. /****************************************************************************/
  1153. static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
  1154. enum ip_conntrack_info ctinfo,
  1155. unsigned char **data, GatekeeperConfirm * gcf)
  1156. {
  1157. int dir = CTINFO2DIR(ctinfo);
  1158. int ret = 0;
  1159. __be32 ip;
  1160. u_int16_t port;
  1161. struct ip_conntrack_expect *exp;
  1162. DEBUGP("ip_ct_ras: GCF\n");
  1163. if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
  1164. return 0;
  1165. /* Registration port is the same as discovery port */
  1166. if (ip == ct->tuplehash[dir].tuple.src.ip &&
  1167. port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
  1168. return 0;
  1169. /* Avoid RAS expectation loops. A GCF is never expected. */
  1170. if (test_bit(IPS_EXPECTED_BIT, &ct->status))
  1171. return 0;
  1172. /* Need new expect */
  1173. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  1174. return -1;
  1175. exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  1176. exp->tuple.src.u.tcp.port = 0;
  1177. exp->tuple.dst.ip = ip;
  1178. exp->tuple.dst.u.tcp.port = htons(port);
  1179. exp->tuple.dst.protonum = IPPROTO_UDP;
  1180. exp->mask.src.ip = htonl(0xFFFFFFFF);
  1181. exp->mask.src.u.tcp.port = 0;
  1182. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  1183. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  1184. exp->mask.dst.protonum = 0xFF;
  1185. exp->flags = 0;
  1186. exp->expectfn = ip_conntrack_ras_expect;
  1187. if (ip_conntrack_expect_related(exp) == 0) {
  1188. DEBUGP("ip_ct_ras: expect RAS "
  1189. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  1190. NIPQUAD(exp->tuple.src.ip),
  1191. ntohs(exp->tuple.src.u.tcp.port),
  1192. NIPQUAD(exp->tuple.dst.ip),
  1193. ntohs(exp->tuple.dst.u.tcp.port));
  1194. } else
  1195. ret = -1;
  1196. ip_conntrack_expect_put(exp);
  1197. return ret;
  1198. }
  1199. /****************************************************************************/
  1200. static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
  1201. enum ip_conntrack_info ctinfo,
  1202. unsigned char **data, RegistrationRequest * rrq)
  1203. {
  1204. struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
  1205. int ret;
  1206. typeof(set_ras_addr_hook) set_ras_addr;
  1207. DEBUGP("ip_ct_ras: RRQ\n");
  1208. ret = expect_q931(pskb, ct, ctinfo, data,
  1209. rrq->callSignalAddress.item,
  1210. rrq->callSignalAddress.count);
  1211. if (ret < 0)
  1212. return -1;
  1213. set_ras_addr = rcu_dereference(set_ras_addr_hook);
  1214. if (set_ras_addr) {
  1215. ret = set_ras_addr(pskb, ct, ctinfo, data,
  1216. rrq->rasAddress.item,
  1217. rrq->rasAddress.count);
  1218. if (ret < 0)
  1219. return -1;
  1220. }
  1221. if (rrq->options & eRegistrationRequest_timeToLive) {
  1222. DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
  1223. info->timeout = rrq->timeToLive;
  1224. } else
  1225. info->timeout = default_rrq_ttl;
  1226. return 0;
  1227. }
  1228. /****************************************************************************/
  1229. static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
  1230. enum ip_conntrack_info ctinfo,
  1231. unsigned char **data, RegistrationConfirm * rcf)
  1232. {
  1233. struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
  1234. int dir = CTINFO2DIR(ctinfo);
  1235. int ret;
  1236. struct ip_conntrack_expect *exp;
  1237. typeof(set_sig_addr_hook) set_sig_addr;
  1238. DEBUGP("ip_ct_ras: RCF\n");
  1239. set_sig_addr = rcu_dereference(set_sig_addr_hook);
  1240. if (set_sig_addr) {
  1241. ret = set_sig_addr(pskb, ct, ctinfo, data,
  1242. rcf->callSignalAddress.item,
  1243. rcf->callSignalAddress.count);
  1244. if (ret < 0)
  1245. return -1;
  1246. }
  1247. if (rcf->options & eRegistrationConfirm_timeToLive) {
  1248. DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
  1249. info->timeout = rcf->timeToLive;
  1250. }
  1251. if (info->timeout > 0) {
  1252. DEBUGP
  1253. ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
  1254. info->timeout);
  1255. ip_ct_refresh(ct, *pskb, info->timeout * HZ);
  1256. /* Set expect timeout */
  1257. read_lock_bh(&ip_conntrack_lock);
  1258. exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
  1259. info->sig_port[!dir]);
  1260. if (exp) {
  1261. DEBUGP("ip_ct_ras: set Q.931 expect "
  1262. "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
  1263. "timeout to %u seconds\n",
  1264. NIPQUAD(exp->tuple.src.ip),
  1265. ntohs(exp->tuple.src.u.tcp.port),
  1266. NIPQUAD(exp->tuple.dst.ip),
  1267. ntohs(exp->tuple.dst.u.tcp.port),
  1268. info->timeout);
  1269. set_expect_timeout(exp, info->timeout);
  1270. }
  1271. read_unlock_bh(&ip_conntrack_lock);
  1272. }
  1273. return 0;
  1274. }
  1275. /****************************************************************************/
  1276. static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
  1277. enum ip_conntrack_info ctinfo,
  1278. unsigned char **data, UnregistrationRequest * urq)
  1279. {
  1280. struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
  1281. int dir = CTINFO2DIR(ctinfo);
  1282. int ret;
  1283. typeof(set_sig_addr_hook) set_sig_addr;
  1284. DEBUGP("ip_ct_ras: URQ\n");
  1285. set_sig_addr = rcu_dereference(set_sig_addr_hook);
  1286. if (set_sig_addr) {
  1287. ret = set_sig_addr(pskb, ct, ctinfo, data,
  1288. urq->callSignalAddress.item,
  1289. urq->callSignalAddress.count);
  1290. if (ret < 0)
  1291. return -1;
  1292. }
  1293. /* Clear old expect */
  1294. ip_ct_remove_expectations(ct);
  1295. info->sig_port[dir] = 0;
  1296. info->sig_port[!dir] = 0;
  1297. /* Give it 30 seconds for UCF or URJ */
  1298. ip_ct_refresh(ct, *pskb, 30 * HZ);
  1299. return 0;
  1300. }
  1301. /****************************************************************************/
  1302. static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
  1303. enum ip_conntrack_info ctinfo,
  1304. unsigned char **data, AdmissionRequest * arq)
  1305. {
  1306. struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
  1307. int dir = CTINFO2DIR(ctinfo);
  1308. __be32 ip;
  1309. u_int16_t port;
  1310. typeof(set_h225_addr_hook) set_h225_addr;
  1311. DEBUGP("ip_ct_ras: ARQ\n");
  1312. set_h225_addr = rcu_dereference(set_h225_addr_hook);
  1313. if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
  1314. get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
  1315. ip == ct->tuplehash[dir].tuple.src.ip &&
  1316. port == info->sig_port[dir] && set_h225_addr) {
  1317. /* Answering ARQ */
  1318. return set_h225_addr(pskb, data, 0,
  1319. &arq->destCallSignalAddress,
  1320. ct->tuplehash[!dir].tuple.dst.ip,
  1321. info->sig_port[!dir]);
  1322. }
  1323. if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
  1324. get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
  1325. ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr) {
  1326. /* Calling ARQ */
  1327. return set_h225_addr(pskb, data, 0,
  1328. &arq->srcCallSignalAddress,
  1329. ct->tuplehash[!dir].tuple.dst.ip,
  1330. port);
  1331. }
  1332. return 0;
  1333. }
  1334. /****************************************************************************/
  1335. static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
  1336. enum ip_conntrack_info ctinfo,
  1337. unsigned char **data, AdmissionConfirm * acf)
  1338. {
  1339. int dir = CTINFO2DIR(ctinfo);
  1340. int ret = 0;
  1341. __be32 ip;
  1342. u_int16_t port;
  1343. struct ip_conntrack_expect *exp;
  1344. typeof(set_sig_addr_hook) set_sig_addr;
  1345. DEBUGP("ip_ct_ras: ACF\n");
  1346. if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
  1347. return 0;
  1348. if (ip == ct->tuplehash[dir].tuple.dst.ip) { /* Answering ACF */
  1349. set_sig_addr = rcu_dereference(set_sig_addr_hook);
  1350. if (set_sig_addr)
  1351. return set_sig_addr(pskb, ct, ctinfo, data,
  1352. &acf->destCallSignalAddress, 1);
  1353. return 0;
  1354. }
  1355. /* Need new expect */
  1356. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  1357. return -1;
  1358. exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  1359. exp->tuple.src.u.tcp.port = 0;
  1360. exp->tuple.dst.ip = ip;
  1361. exp->tuple.dst.u.tcp.port = htons(port);
  1362. exp->tuple.dst.protonum = IPPROTO_TCP;
  1363. exp->mask.src.ip = htonl(0xFFFFFFFF);
  1364. exp->mask.src.u.tcp.port = 0;
  1365. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  1366. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  1367. exp->mask.dst.protonum = 0xFF;
  1368. exp->flags = IP_CT_EXPECT_PERMANENT;
  1369. exp->expectfn = ip_conntrack_q931_expect;
  1370. if (ip_conntrack_expect_related(exp) == 0) {
  1371. DEBUGP("ip_ct_ras: expect Q.931 "
  1372. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  1373. NIPQUAD(exp->tuple.src.ip),
  1374. ntohs(exp->tuple.src.u.tcp.port),
  1375. NIPQUAD(exp->tuple.dst.ip),
  1376. ntohs(exp->tuple.dst.u.tcp.port));
  1377. } else
  1378. ret = -1;
  1379. ip_conntrack_expect_put(exp);
  1380. return ret;
  1381. }
  1382. /****************************************************************************/
  1383. static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
  1384. enum ip_conntrack_info ctinfo,
  1385. unsigned char **data, LocationRequest * lrq)
  1386. {
  1387. typeof(set_ras_addr_hook) set_ras_addr;
  1388. DEBUGP("ip_ct_ras: LRQ\n");
  1389. set_ras_addr = rcu_dereference(set_ras_addr_hook);
  1390. if (set_ras_addr)
  1391. return set_ras_addr(pskb, ct, ctinfo, data,
  1392. &lrq->replyAddress, 1);
  1393. return 0;
  1394. }
  1395. /****************************************************************************/
  1396. static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
  1397. enum ip_conntrack_info ctinfo,
  1398. unsigned char **data, LocationConfirm * lcf)
  1399. {
  1400. int dir = CTINFO2DIR(ctinfo);
  1401. int ret = 0;
  1402. __be32 ip;
  1403. u_int16_t port;
  1404. struct ip_conntrack_expect *exp = NULL;
  1405. DEBUGP("ip_ct_ras: LCF\n");
  1406. if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
  1407. return 0;
  1408. /* Need new expect for call signal */
  1409. if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
  1410. return -1;
  1411. exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
  1412. exp->tuple.src.u.tcp.port = 0;
  1413. exp->tuple.dst.ip = ip;
  1414. exp->tuple.dst.u.tcp.port = htons(port);
  1415. exp->tuple.dst.protonum = IPPROTO_TCP;
  1416. exp->mask.src.ip = htonl(0xFFFFFFFF);
  1417. exp->mask.src.u.tcp.port = 0;
  1418. exp->mask.dst.ip = htonl(0xFFFFFFFF);
  1419. exp->mask.dst.u.tcp.port = htons(0xFFFF);
  1420. exp->mask.dst.protonum = 0xFF;
  1421. exp->flags = IP_CT_EXPECT_PERMANENT;
  1422. exp->expectfn = ip_conntrack_q931_expect;
  1423. if (ip_conntrack_expect_related(exp) == 0) {
  1424. DEBUGP("ip_ct_ras: expect Q.931 "
  1425. "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
  1426. NIPQUAD(exp->tuple.src.ip),
  1427. ntohs(exp->tuple.src.u.tcp.port),
  1428. NIPQUAD(exp->tuple.dst.ip),
  1429. ntohs(exp->tuple.dst.u.tcp.port));
  1430. } else
  1431. ret = -1;
  1432. ip_conntrack_expect_put(exp);
  1433. /* Ignore rasAddress */
  1434. return ret;
  1435. }
  1436. /****************************************************************************/
  1437. static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
  1438. enum ip_conntrack_info ctinfo,
  1439. unsigned char **data, InfoRequestResponse * irr)
  1440. {
  1441. int ret;
  1442. typeof(set_ras_addr_hook) set_ras_addr;
  1443. typeof(set_sig_addr_hook) set_sig_addr;
  1444. DEBUGP("ip_ct_ras: IRR\n");
  1445. set_ras_addr = rcu_dereference(set_ras_addr_hook);
  1446. if (set_ras_addr) {
  1447. ret = set_ras_addr(pskb, ct, ctinfo, data,
  1448. &irr->rasAddress, 1);
  1449. if (ret < 0)
  1450. return -1;
  1451. }
  1452. set_sig_addr = rcu_dereference(set_sig_addr_hook);
  1453. if (set_sig_addr) {
  1454. ret = set_sig_addr(pskb, ct, ctinfo, data,
  1455. irr->callSignalAddress.item,
  1456. irr->callSignalAddress.count);
  1457. if (ret < 0)
  1458. return -1;
  1459. }
  1460. return 0;
  1461. }
  1462. /****************************************************************************/
  1463. static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
  1464. enum ip_conntrack_info ctinfo,
  1465. unsigned char **data, RasMessage * ras)
  1466. {
  1467. switch (ras->choice) {
  1468. case eRasMessage_gatekeeperRequest:
  1469. return process_grq(pskb, ct, ctinfo, data,
  1470. &ras->gatekeeperRequest);
  1471. case eRasMessage_gatekeeperConfirm:
  1472. return process_gcf(pskb, ct, ctinfo, data,
  1473. &ras->gatekeeperConfirm);
  1474. case eRasMessage_registrationRequest:
  1475. return process_rrq(pskb, ct, ctinfo, data,
  1476. &ras->registrationRequest);
  1477. case eRasMessage_registrationConfirm:
  1478. return process_rcf(pskb, ct, ctinfo, data,
  1479. &ras->registrationConfirm);
  1480. case eRasMessage_unregistrationRequest:
  1481. return process_urq(pskb, ct, ctinfo, data,
  1482. &ras->unregistrationRequest);
  1483. case eRasMessage_admissionRequest:
  1484. return process_arq(pskb, ct, ctinfo, data,
  1485. &ras->admissionRequest);
  1486. case eRasMessage_admissionConfirm:
  1487. return process_acf(pskb, ct, ctinfo, data,
  1488. &ras->admissionConfirm);
  1489. case eRasMessage_locationRequest:
  1490. return process_lrq(pskb, ct, ctinfo, data,
  1491. &ras->locationRequest);
  1492. case eRasMessage_locationConfirm:
  1493. return process_lcf(pskb, ct, ctinfo, data,
  1494. &ras->locationConfirm);
  1495. case eRasMessage_infoRequestResponse:
  1496. return process_irr(pskb, ct, ctinfo, data,
  1497. &ras->infoRequestResponse);
  1498. default:
  1499. DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
  1500. break;
  1501. }
  1502. return 0;
  1503. }
  1504. /****************************************************************************/
  1505. static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
  1506. enum ip_conntrack_info ctinfo)
  1507. {
  1508. static RasMessage ras;
  1509. unsigned char *data;
  1510. int datalen = 0;
  1511. int ret;
  1512. DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
  1513. spin_lock_bh(&ip_h323_lock);
  1514. /* Get UDP data */
  1515. data = get_udp_data(pskb, &datalen);
  1516. if (data == NULL)
  1517. goto accept;
  1518. DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
  1519. NIPQUAD((*pskb)->nh.iph->saddr),
  1520. NIPQUAD((*pskb)->nh.iph->daddr), datalen);
  1521. /* Decode RAS message */
  1522. ret = DecodeRasMessage(data, datalen, &ras);
  1523. if (ret < 0) {
  1524. if (net_ratelimit())
  1525. printk("ip_ct_ras: decoding error: %s\n",
  1526. ret == H323_ERROR_BOUND ?
  1527. "out of bound" : "out of range");
  1528. goto accept;
  1529. }
  1530. /* Process RAS message */
  1531. if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
  1532. goto drop;
  1533. accept:
  1534. spin_unlock_bh(&ip_h323_lock);
  1535. return NF_ACCEPT;
  1536. drop:
  1537. spin_unlock_bh(&ip_h323_lock);
  1538. if (net_ratelimit())
  1539. printk("ip_ct_ras: packet dropped\n");
  1540. return NF_DROP;
  1541. }
  1542. /****************************************************************************/
  1543. static struct ip_conntrack_helper ip_conntrack_helper_ras = {
  1544. .name = "RAS",
  1545. .me = THIS_MODULE,
  1546. .max_expected = 32,
  1547. .timeout = 240,
  1548. .tuple = {.src = {.u = {.tcp = {.port = __constant_htons(RAS_PORT)}}},
  1549. .dst = {.protonum = IPPROTO_UDP}},
  1550. .mask = {.src = {.u = {0xFFFE}},
  1551. .dst = {.protonum = 0xFF}},
  1552. .help = ras_help,
  1553. };
  1554. /****************************************************************************/
  1555. static void ip_conntrack_ras_expect(struct ip_conntrack *new,
  1556. struct ip_conntrack_expect *this)
  1557. {
  1558. write_lock_bh(&ip_conntrack_lock);
  1559. new->helper = &ip_conntrack_helper_ras;
  1560. write_unlock_bh(&ip_conntrack_lock);
  1561. }
  1562. /****************************************************************************/
  1563. /* Not __exit - called from init() */
  1564. static void fini(void)
  1565. {
  1566. ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
  1567. ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
  1568. kfree(h323_buffer);
  1569. DEBUGP("ip_ct_h323: fini\n");
  1570. }
  1571. /****************************************************************************/
  1572. static int __init init(void)
  1573. {
  1574. int ret;
  1575. h323_buffer = kmalloc(65536, GFP_KERNEL);
  1576. if (!h323_buffer)
  1577. return -ENOMEM;
  1578. if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
  1579. (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
  1580. fini();
  1581. return ret;
  1582. }
  1583. DEBUGP("ip_ct_h323: init success\n");
  1584. return 0;
  1585. }
  1586. /****************************************************************************/
  1587. module_init(init);
  1588. module_exit(fini);
  1589. EXPORT_SYMBOL_GPL(get_h225_addr);
  1590. EXPORT_SYMBOL_GPL(ip_conntrack_h245_expect);
  1591. EXPORT_SYMBOL_GPL(ip_conntrack_q931_expect);
  1592. EXPORT_SYMBOL_GPL(set_h245_addr_hook);
  1593. EXPORT_SYMBOL_GPL(set_h225_addr_hook);
  1594. EXPORT_SYMBOL_GPL(set_sig_addr_hook);
  1595. EXPORT_SYMBOL_GPL(set_ras_addr_hook);
  1596. EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
  1597. EXPORT_SYMBOL_GPL(nat_t120_hook);
  1598. EXPORT_SYMBOL_GPL(nat_h245_hook);
  1599. EXPORT_SYMBOL_GPL(nat_callforwarding_hook);
  1600. EXPORT_SYMBOL_GPL(nat_q931_hook);
  1601. MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
  1602. MODULE_DESCRIPTION("H.323 connection tracking helper");
  1603. MODULE_LICENSE("GPL");