[NETFILTER]: H.323 helper: make get_h245_addr() static
[sfrench/cifs-2.6.git] / net / ipv4 / netfilter / ip_conntrack_helper_h323.c
1 /*
2  * H.323 connection tracking helper
3  *
4  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
5  *
6  * This source code is licensed under General Public License version 2.
7  *
8  * Based on the 'brute force' H.323 connection tracking module by
9  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
10  *
11  * For more information, please see http://nath323.sourceforge.net/
12  *
13  * Changes:
14  *      2006-02-01 - initial version 0.1
15  *
16  *      2006-02-20 - version 0.2
17  *        1. Changed source format to follow kernel conventions
18  *        2. Deleted some unnecessary structures
19  *        3. Minor fixes
20  *
21  *      2006-03-10 - version 0.3
22  *        1. Added support for multiple TPKTs in one packet (suggested by
23  *           Patrick McHardy)
24  *        2. Avoid excessive stack usage (based on Patrick McHardy's patch)
25  *        3. Added support for non-linear skb (based on Patrick McHardy's patch)
26  *        4. Fixed missing H.245 module owner (Patrick McHardy)
27  *        5. Avoid long RAS expectation chains (Patrick McHardy)
28  *        6. Fixed incorrect __exit attribute (Patrick McHardy)
29  *        7. Eliminated unnecessary return code
30  *        8. Fixed incorrect use of NAT data from conntrack code (suggested by
31  *           Patrick McHardy)
32  *        9. Fixed TTL calculation error in RCF
33  *        10. Added TTL support in RRQ
34  *        11. Better support for separate TPKT header and data
35  *
36  *      2006-03-15 - version 0.4
37  *        1. Added support for T.120 channels
38  *        2. Added parameter gkrouted_only (suggested by Patrick McHardy)
39  *        3. Splitted ASN.1 code and data (suggested by Patrick McHardy)
40  *        4. Sort ASN.1 data to avoid forwarding declarations (suggested by
41  *           Patrick McHardy)
42  *        5. Reset next TPKT data length in get_tpkt_data()
43  */
44
45 #include <linux/config.h>
46 #include <linux/module.h>
47 #include <linux/netfilter.h>
48 #include <linux/ip.h>
49 #include <net/tcp.h>
50 #include <linux/netfilter_ipv4/ip_conntrack.h>
51 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
52 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
53 #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
54 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
55 #include <linux/moduleparam.h>
56
57 #if 0
58 #define DEBUGP printk
59 #else
60 #define DEBUGP(format, args...)
61 #endif
62
63 /* Parameters */
64 static int gkrouted_only = 1;
65 module_param(gkrouted_only, int, 0600);
66 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
67
68 /* Hooks for NAT */
69 int (*set_h245_addr_hook) (struct sk_buff ** pskb,
70                            unsigned char **data, int dataoff,
71                            H245_TransportAddress * addr,
72                            u_int32_t ip, u_int16_t port);
73 int (*set_h225_addr_hook) (struct sk_buff ** pskb,
74                            unsigned char **data, int dataoff,
75                            TransportAddress * addr,
76                            u_int32_t ip, u_int16_t port);
77 int (*set_sig_addr_hook) (struct sk_buff ** pskb,
78                           struct ip_conntrack * ct,
79                           enum ip_conntrack_info ctinfo,
80                           unsigned char **data,
81                           TransportAddress * addr, int count);
82 int (*set_ras_addr_hook) (struct sk_buff ** pskb,
83                           struct ip_conntrack * ct,
84                           enum ip_conntrack_info ctinfo,
85                           unsigned char **data,
86                           TransportAddress * addr, int count);
87 int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
88                           struct ip_conntrack * ct,
89                           enum ip_conntrack_info ctinfo,
90                           unsigned char **data, int dataoff,
91                           H245_TransportAddress * addr,
92                           u_int16_t port, u_int16_t rtp_port,
93                           struct ip_conntrack_expect * rtp_exp,
94                           struct ip_conntrack_expect * rtcp_exp);
95 int (*nat_t120_hook) (struct sk_buff ** pskb,
96                       struct ip_conntrack * ct,
97                       enum ip_conntrack_info ctinfo,
98                       unsigned char **data, int dataoff,
99                       H245_TransportAddress * addr, u_int16_t port,
100                       struct ip_conntrack_expect * exp);
101 int (*nat_h245_hook) (struct sk_buff ** pskb,
102                       struct ip_conntrack * ct,
103                       enum ip_conntrack_info ctinfo,
104                       unsigned char **data, int dataoff,
105                       TransportAddress * addr, u_int16_t port,
106                       struct ip_conntrack_expect * exp);
107 int (*nat_q931_hook) (struct sk_buff ** pskb,
108                       struct ip_conntrack * ct,
109                       enum ip_conntrack_info ctinfo,
110                       unsigned char **data, TransportAddress * addr, int idx,
111                       u_int16_t port, struct ip_conntrack_expect * exp);
112
113
114 static DEFINE_SPINLOCK(ip_h323_lock);
115 static char *h323_buffer;
116
117 /****************************************************************************/
118 static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
119                          enum ip_conntrack_info ctinfo,
120                          unsigned char **data, int *datalen, int *dataoff)
121 {
122         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
123         int dir = CTINFO2DIR(ctinfo);
124         struct tcphdr _tcph, *th;
125         int tcpdatalen;
126         int tcpdataoff;
127         unsigned char *tpkt;
128         int tpktlen;
129         int tpktoff;
130
131         /* Get TCP header */
132         th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
133                                 sizeof(_tcph), &_tcph);
134         if (th == NULL)
135                 return 0;
136
137         /* Get TCP data offset */
138         tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
139
140         /* Get TCP data length */
141         tcpdatalen = (*pskb)->len - tcpdataoff;
142         if (tcpdatalen <= 0)    /* No TCP data */
143                 goto clear_out;
144
145         if (*data == NULL) {    /* first TPKT */
146                 /* Get first TPKT pointer */
147                 tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
148                                           h323_buffer);
149                 BUG_ON(tpkt == NULL);
150
151                 /* Validate TPKT identifier */
152                 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
153                         /* Netmeeting sends TPKT header and data separately */
154                         if (info->tpkt_len[dir] > 0) {
155                                 DEBUGP("ip_ct_h323: previous packet "
156                                        "indicated separate TPKT data of %hu "
157                                        "bytes\n", info->tpkt_len[dir]);
158                                 if (info->tpkt_len[dir] <= tcpdatalen) {
159                                         /* Yes, there was a TPKT header
160                                          * received */
161                                         *data = tpkt;
162                                         *datalen = info->tpkt_len[dir];
163                                         *dataoff = 0;
164                                         goto out;
165                                 }
166
167                                 /* Fragmented TPKT */
168                                 if (net_ratelimit())
169                                         printk("ip_ct_h323: "
170                                                "fragmented TPKT\n");
171                                 goto clear_out;
172                         }
173
174                         /* It is not even a TPKT */
175                         return 0;
176                 }
177                 tpktoff = 0;
178         } else {                /* Next TPKT */
179                 tpktoff = *dataoff + *datalen;
180                 tcpdatalen -= tpktoff;
181                 if (tcpdatalen <= 4)    /* No more TPKT */
182                         goto clear_out;
183                 tpkt = *data + *datalen;
184
185                 /* Validate TPKT identifier */
186                 if (tpkt[0] != 0x03 || tpkt[1] != 0)
187                         goto clear_out;
188         }
189
190         /* Validate TPKT length */
191         tpktlen = tpkt[2] * 256 + tpkt[3];
192         if (tpktlen > tcpdatalen) {
193                 if (tcpdatalen == 4) {  /* Separate TPKT header */
194                         /* Netmeeting sends TPKT header and data separately */
195                         DEBUGP("ip_ct_h323: separate TPKT header indicates "
196                                "there will be TPKT data of %hu bytes\n",
197                                tpktlen - 4);
198                         info->tpkt_len[dir] = tpktlen - 4;
199                         return 0;
200                 }
201
202                 if (net_ratelimit())
203                         printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
204                 goto clear_out;
205         }
206
207         /* This is the encapsulated data */
208         *data = tpkt + 4;
209         *datalen = tpktlen - 4;
210         *dataoff = tpktoff + 4;
211
212       out:
213         /* Clear TPKT length */
214         info->tpkt_len[dir] = 0;
215         return 1;
216
217       clear_out:
218         info->tpkt_len[dir] = 0;
219         return 0;
220 }
221
222 /****************************************************************************/
223 static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
224                          u_int32_t * ip, u_int16_t * port)
225 {
226         unsigned char *p;
227
228         if (addr->choice != eH245_TransportAddress_unicastAddress ||
229             addr->unicastAddress.choice != eUnicastAddress_iPAddress)
230                 return 0;
231
232         p = data + addr->unicastAddress.iPAddress.network;
233         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
234         *port = (p[4] << 8) | (p[5]);
235
236         return 1;
237 }
238
239 /****************************************************************************/
240 static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
241                            enum ip_conntrack_info ctinfo,
242                            unsigned char **data, int dataoff,
243                            H245_TransportAddress * addr)
244 {
245         int dir = CTINFO2DIR(ctinfo);
246         int ret = 0;
247         u_int32_t ip;
248         u_int16_t port;
249         u_int16_t rtp_port;
250         struct ip_conntrack_expect *rtp_exp;
251         struct ip_conntrack_expect *rtcp_exp;
252
253         /* Read RTP or RTCP address */
254         if (!get_h245_addr(*data, addr, &ip, &port) ||
255             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
256                 return 0;
257
258         /* RTP port is even */
259         rtp_port = port & (~1);
260
261         /* Create expect for RTP */
262         if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
263                 return -1;
264         rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
265         rtp_exp->tuple.src.u.udp.port = 0;
266         rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
267         rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
268         rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
269         rtp_exp->mask.src.ip = 0xFFFFFFFF;
270         rtp_exp->mask.src.u.udp.port = 0;
271         rtp_exp->mask.dst.ip = 0xFFFFFFFF;
272         rtp_exp->mask.dst.u.udp.port = 0xFFFF;
273         rtp_exp->mask.dst.protonum = 0xFF;
274         rtp_exp->flags = 0;
275
276         /* Create expect for RTCP */
277         if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
278                 ip_conntrack_expect_put(rtp_exp);
279                 return -1;
280         }
281         rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
282         rtcp_exp->tuple.src.u.udp.port = 0;
283         rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
284         rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
285         rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
286         rtcp_exp->mask.src.ip = 0xFFFFFFFF;
287         rtcp_exp->mask.src.u.udp.port = 0;
288         rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
289         rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
290         rtcp_exp->mask.dst.protonum = 0xFF;
291         rtcp_exp->flags = 0;
292
293         if (ct->tuplehash[dir].tuple.src.ip !=
294             ct->tuplehash[!dir].tuple.dst.ip && nat_rtp_rtcp_hook) {
295                 /* NAT needed */
296                 ret = nat_rtp_rtcp_hook(pskb, ct, ctinfo, data, dataoff,
297                                         addr, port, rtp_port, rtp_exp,
298                                         rtcp_exp);
299         } else {                /* Conntrack only */
300                 rtp_exp->expectfn = NULL;
301                 rtcp_exp->expectfn = NULL;
302
303                 if (ip_conntrack_expect_related(rtp_exp) == 0) {
304                         if (ip_conntrack_expect_related(rtcp_exp) == 0) {
305                                 DEBUGP("ip_ct_h323: expect RTP "
306                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
307                                        NIPQUAD(rtp_exp->tuple.src.ip),
308                                        ntohs(rtp_exp->tuple.src.u.udp.port),
309                                        NIPQUAD(rtp_exp->tuple.dst.ip),
310                                        ntohs(rtp_exp->tuple.dst.u.udp.port));
311                                 DEBUGP("ip_ct_h323: expect RTCP "
312                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
313                                        NIPQUAD(rtcp_exp->tuple.src.ip),
314                                        ntohs(rtcp_exp->tuple.src.u.udp.port),
315                                        NIPQUAD(rtcp_exp->tuple.dst.ip),
316                                        ntohs(rtcp_exp->tuple.dst.u.udp.port));
317                         } else {
318                                 ip_conntrack_unexpect_related(rtp_exp);
319                                 ret = -1;
320                         }
321                 } else
322                         ret = -1;
323         }
324
325         ip_conntrack_expect_put(rtp_exp);
326         ip_conntrack_expect_put(rtcp_exp);
327
328         return ret;
329 }
330
331 /****************************************************************************/
332 static int expect_t120(struct sk_buff **pskb,
333                        struct ip_conntrack *ct,
334                        enum ip_conntrack_info ctinfo,
335                        unsigned char **data, int dataoff,
336                        H245_TransportAddress * addr)
337 {
338         int dir = CTINFO2DIR(ctinfo);
339         int ret = 0;
340         u_int32_t ip;
341         u_int16_t port;
342         struct ip_conntrack_expect *exp = NULL;
343
344         /* Read T.120 address */
345         if (!get_h245_addr(*data, addr, &ip, &port) ||
346             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
347                 return 0;
348
349         /* Create expect for T.120 connections */
350         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
351                 return -1;
352         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
353         exp->tuple.src.u.tcp.port = 0;
354         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
355         exp->tuple.dst.u.tcp.port = htons(port);
356         exp->tuple.dst.protonum = IPPROTO_TCP;
357         exp->mask.src.ip = 0xFFFFFFFF;
358         exp->mask.src.u.tcp.port = 0;
359         exp->mask.dst.ip = 0xFFFFFFFF;
360         exp->mask.dst.u.tcp.port = 0xFFFF;
361         exp->mask.dst.protonum = 0xFF;
362         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple channels */
363
364         if (ct->tuplehash[dir].tuple.src.ip !=
365             ct->tuplehash[!dir].tuple.dst.ip && nat_t120_hook) {
366                 /* NAT needed */
367                 ret = nat_t120_hook(pskb, ct, ctinfo, data, dataoff, addr,
368                                     port, exp);
369         } else {                /* Conntrack only */
370                 exp->expectfn = NULL;
371                 if (ip_conntrack_expect_related(exp) == 0) {
372                         DEBUGP("ip_ct_h323: expect T.120 "
373                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
374                                NIPQUAD(exp->tuple.src.ip),
375                                ntohs(exp->tuple.src.u.tcp.port),
376                                NIPQUAD(exp->tuple.dst.ip),
377                                ntohs(exp->tuple.dst.u.tcp.port));
378                 } else
379                         ret = -1;
380         }
381
382         ip_conntrack_expect_put(exp);
383
384         return ret;
385 }
386
387 /****************************************************************************/
388 static int process_h245_channel(struct sk_buff **pskb,
389                                 struct ip_conntrack *ct,
390                                 enum ip_conntrack_info ctinfo,
391                                 unsigned char **data, int dataoff,
392                                 H2250LogicalChannelParameters * channel)
393 {
394         int ret;
395
396         if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
397                 /* RTP */
398                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
399                                       &channel->mediaChannel);
400                 if (ret < 0)
401                         return -1;
402         }
403
404         if (channel->
405             options & eH2250LogicalChannelParameters_mediaControlChannel) {
406                 /* RTCP */
407                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
408                                       &channel->mediaControlChannel);
409                 if (ret < 0)
410                         return -1;
411         }
412
413         return 0;
414 }
415
416 /****************************************************************************/
417 static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
418                        enum ip_conntrack_info ctinfo,
419                        unsigned char **data, int dataoff,
420                        OpenLogicalChannel * olc)
421 {
422         int ret;
423
424         DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
425
426         if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
427             eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
428         {
429                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
430                                            &olc->
431                                            forwardLogicalChannelParameters.
432                                            multiplexParameters.
433                                            h2250LogicalChannelParameters);
434                 if (ret < 0)
435                         return -1;
436         }
437
438         if ((olc->options &
439              eOpenLogicalChannel_reverseLogicalChannelParameters) &&
440             (olc->reverseLogicalChannelParameters.options &
441              eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
442             && (olc->reverseLogicalChannelParameters.multiplexParameters.
443                 choice ==
444                 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
445         {
446                 ret =
447                     process_h245_channel(pskb, ct, ctinfo, data, dataoff,
448                                          &olc->
449                                          reverseLogicalChannelParameters.
450                                          multiplexParameters.
451                                          h2250LogicalChannelParameters);
452                 if (ret < 0)
453                         return -1;
454         }
455
456         if ((olc->options & eOpenLogicalChannel_separateStack) &&
457             olc->forwardLogicalChannelParameters.dataType.choice ==
458             eDataType_data &&
459             olc->forwardLogicalChannelParameters.dataType.data.application.
460             choice == eDataApplicationCapability_application_t120 &&
461             olc->forwardLogicalChannelParameters.dataType.data.application.
462             t120.choice == eDataProtocolCapability_separateLANStack &&
463             olc->separateStack.networkAddress.choice ==
464             eNetworkAccessParameters_networkAddress_localAreaAddress) {
465                 ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
466                                   &olc->separateStack.networkAddress.
467                                   localAreaAddress);
468                 if (ret < 0)
469                         return -1;
470         }
471
472         return 0;
473 }
474
475 /****************************************************************************/
476 static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
477                         enum ip_conntrack_info ctinfo,
478                         unsigned char **data, int dataoff,
479                         OpenLogicalChannelAck * olca)
480 {
481         H2250LogicalChannelAckParameters *ack;
482         int ret;
483
484         DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
485
486         if ((olca->options &
487              eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
488             (olca->reverseLogicalChannelParameters.options &
489              eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
490             && (olca->reverseLogicalChannelParameters.multiplexParameters.
491                 choice ==
492                 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
493         {
494                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
495                                            &olca->
496                                            reverseLogicalChannelParameters.
497                                            multiplexParameters.
498                                            h2250LogicalChannelParameters);
499                 if (ret < 0)
500                         return -1;
501         }
502
503         if ((olca->options &
504              eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
505             (olca->forwardMultiplexAckParameters.choice ==
506              eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
507         {
508                 ack = &olca->forwardMultiplexAckParameters.
509                     h2250LogicalChannelAckParameters;
510                 if (ack->options &
511                     eH2250LogicalChannelAckParameters_mediaChannel) {
512                         /* RTP */
513                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
514                                               &ack->mediaChannel);
515                         if (ret < 0)
516                                 return -1;
517                 }
518
519                 if (ack->options &
520                     eH2250LogicalChannelAckParameters_mediaControlChannel) {
521                         /* RTCP */
522                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
523                                               &ack->mediaControlChannel);
524                         if (ret < 0)
525                                 return -1;
526                 }
527         }
528
529         return 0;
530 }
531
532 /****************************************************************************/
533 static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
534                         enum ip_conntrack_info ctinfo,
535                         unsigned char **data, int dataoff,
536                         MultimediaSystemControlMessage * mscm)
537 {
538         switch (mscm->choice) {
539         case eMultimediaSystemControlMessage_request:
540                 if (mscm->request.choice ==
541                     eRequestMessage_openLogicalChannel) {
542                         return process_olc(pskb, ct, ctinfo, data, dataoff,
543                                            &mscm->request.openLogicalChannel);
544                 }
545                 DEBUGP("ip_ct_h323: H.245 Request %d\n",
546                        mscm->request.choice);
547                 break;
548         case eMultimediaSystemControlMessage_response:
549                 if (mscm->response.choice ==
550                     eResponseMessage_openLogicalChannelAck) {
551                         return process_olca(pskb, ct, ctinfo, data, dataoff,
552                                             &mscm->response.
553                                             openLogicalChannelAck);
554                 }
555                 DEBUGP("ip_ct_h323: H.245 Response %d\n",
556                        mscm->response.choice);
557                 break;
558         default:
559                 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
560                 break;
561         }
562
563         return 0;
564 }
565
566 /****************************************************************************/
567 static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
568                      enum ip_conntrack_info ctinfo)
569 {
570         static MultimediaSystemControlMessage mscm;
571         unsigned char *data = NULL;
572         int datalen;
573         int dataoff;
574         int ret;
575
576         /* Until there's been traffic both ways, don't look in packets. */
577         if (ctinfo != IP_CT_ESTABLISHED
578             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
579                 return NF_ACCEPT;
580         }
581         DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
582
583         spin_lock_bh(&ip_h323_lock);
584
585         /* Process each TPKT */
586         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
587                 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
588                        NIPQUAD((*pskb)->nh.iph->saddr),
589                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
590
591                 /* Decode H.245 signal */
592                 ret = DecodeMultimediaSystemControlMessage(data, datalen,
593                                                            &mscm);
594                 if (ret < 0) {
595                         if (net_ratelimit())
596                                 printk("ip_ct_h245: decoding error: %s\n",
597                                        ret == H323_ERROR_BOUND ?
598                                        "out of bound" : "out of range");
599                         /* We don't drop when decoding error */
600                         break;
601                 }
602
603                 /* Process H.245 signal */
604                 if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
605                         goto drop;
606         }
607
608         spin_unlock_bh(&ip_h323_lock);
609         return NF_ACCEPT;
610
611       drop:
612         spin_unlock_bh(&ip_h323_lock);
613         if (net_ratelimit())
614                 printk("ip_ct_h245: packet dropped\n");
615         return NF_DROP;
616 }
617
618 /****************************************************************************/
619 static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
620         .name = "H.245",
621         .me = THIS_MODULE,
622         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
623         .timeout = 240,
624         .tuple = {.dst = {.protonum = IPPROTO_TCP}},
625         .mask = {.src = {.u = {0xFFFF}},
626                  .dst = {.protonum = 0xFF}},
627         .help = h245_help
628 };
629
630 /****************************************************************************/
631 void ip_conntrack_h245_expect(struct ip_conntrack *new,
632                               struct ip_conntrack_expect *this)
633 {
634         write_lock_bh(&ip_conntrack_lock);
635         new->helper = &ip_conntrack_helper_h245;
636         write_unlock_bh(&ip_conntrack_lock);
637 }
638
639 /****************************************************************************/
640 int get_h225_addr(unsigned char *data, TransportAddress * addr,
641                   u_int32_t * ip, u_int16_t * port)
642 {
643         unsigned char *p;
644
645         if (addr->choice != eTransportAddress_ipAddress)
646                 return 0;
647
648         p = data + addr->ipAddress.ip;
649         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
650         *port = (p[4] << 8) | (p[5]);
651
652         return 1;
653 }
654
655 /****************************************************************************/
656 static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
657                        enum ip_conntrack_info ctinfo,
658                        unsigned char **data, int dataoff,
659                        TransportAddress * addr)
660 {
661         int dir = CTINFO2DIR(ctinfo);
662         int ret = 0;
663         u_int32_t ip;
664         u_int16_t port;
665         struct ip_conntrack_expect *exp = NULL;
666
667         /* Read h245Address */
668         if (!get_h225_addr(*data, addr, &ip, &port) ||
669             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
670                 return 0;
671
672         /* Create expect for h245 connection */
673         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
674                 return -1;
675         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
676         exp->tuple.src.u.tcp.port = 0;
677         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
678         exp->tuple.dst.u.tcp.port = htons(port);
679         exp->tuple.dst.protonum = IPPROTO_TCP;
680         exp->mask.src.ip = 0xFFFFFFFF;
681         exp->mask.src.u.tcp.port = 0;
682         exp->mask.dst.ip = 0xFFFFFFFF;
683         exp->mask.dst.u.tcp.port = 0xFFFF;
684         exp->mask.dst.protonum = 0xFF;
685         exp->flags = 0;
686
687         if (ct->tuplehash[dir].tuple.src.ip !=
688             ct->tuplehash[!dir].tuple.dst.ip && nat_h245_hook) {
689                 /* NAT needed */
690                 ret = nat_h245_hook(pskb, ct, ctinfo, data, dataoff, addr,
691                                     port, exp);
692         } else {                /* Conntrack only */
693                 exp->expectfn = ip_conntrack_h245_expect;
694
695                 if (ip_conntrack_expect_related(exp) == 0) {
696                         DEBUGP("ip_ct_q931: expect H.245 "
697                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
698                                NIPQUAD(exp->tuple.src.ip),
699                                ntohs(exp->tuple.src.u.tcp.port),
700                                NIPQUAD(exp->tuple.dst.ip),
701                                ntohs(exp->tuple.dst.u.tcp.port));
702                 } else
703                         ret = -1;
704         }
705
706         ip_conntrack_expect_put(exp);
707
708         return ret;
709 }
710
711 /****************************************************************************/
712 static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
713                          enum ip_conntrack_info ctinfo,
714                          unsigned char **data, int dataoff,
715                          Setup_UUIE * setup)
716 {
717         int dir = CTINFO2DIR(ctinfo);
718         int ret;
719         int i;
720         u_int32_t ip;
721         u_int16_t port;
722
723         DEBUGP("ip_ct_q931: Setup\n");
724
725         if (setup->options & eSetup_UUIE_h245Address) {
726                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
727                                   &setup->h245Address);
728                 if (ret < 0)
729                         return -1;
730         }
731
732         if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
733             (set_h225_addr_hook) &&
734             get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
735             ip != ct->tuplehash[!dir].tuple.src.ip) {
736                 DEBUGP("ip_ct_q931: set destCallSignalAddress "
737                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
738                        NIPQUAD(ip), port,
739                        NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
740                        ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
741                 ret = set_h225_addr_hook(pskb, data, dataoff,
742                                          &setup->destCallSignalAddress,
743                                          ct->tuplehash[!dir].tuple.src.ip,
744                                          ntohs(ct->tuplehash[!dir].tuple.src.
745                                                u.tcp.port));
746                 if (ret < 0)
747                         return -1;
748         }
749
750         if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
751             (set_h225_addr_hook) &&
752             get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
753             && ip != ct->tuplehash[!dir].tuple.dst.ip) {
754                 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
755                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
756                        NIPQUAD(ip), port,
757                        NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
758                        ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
759                 ret = set_h225_addr_hook(pskb, data, dataoff,
760                                          &setup->sourceCallSignalAddress,
761                                          ct->tuplehash[!dir].tuple.dst.ip,
762                                          ntohs(ct->tuplehash[!dir].tuple.dst.
763                                                u.tcp.port));
764                 if (ret < 0)
765                         return -1;
766         }
767
768         if (setup->options & eSetup_UUIE_fastStart) {
769                 for (i = 0; i < setup->fastStart.count; i++) {
770                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
771                                           &setup->fastStart.item[i]);
772                         if (ret < 0)
773                                 return -1;
774                 }
775         }
776
777         return 0;
778 }
779
780 /****************************************************************************/
781 static int process_callproceeding(struct sk_buff **pskb,
782                                   struct ip_conntrack *ct,
783                                   enum ip_conntrack_info ctinfo,
784                                   unsigned char **data, int dataoff,
785                                   CallProceeding_UUIE * callproc)
786 {
787         int ret;
788         int i;
789
790         DEBUGP("ip_ct_q931: CallProceeding\n");
791
792         if (callproc->options & eCallProceeding_UUIE_h245Address) {
793                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
794                                   &callproc->h245Address);
795                 if (ret < 0)
796                         return -1;
797         }
798
799         if (callproc->options & eCallProceeding_UUIE_fastStart) {
800                 for (i = 0; i < callproc->fastStart.count; i++) {
801                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
802                                           &callproc->fastStart.item[i]);
803                         if (ret < 0)
804                                 return -1;
805                 }
806         }
807
808         return 0;
809 }
810
811 /****************************************************************************/
812 static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
813                            enum ip_conntrack_info ctinfo,
814                            unsigned char **data, int dataoff,
815                            Connect_UUIE * connect)
816 {
817         int ret;
818         int i;
819
820         DEBUGP("ip_ct_q931: Connect\n");
821
822         if (connect->options & eConnect_UUIE_h245Address) {
823                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
824                                   &connect->h245Address);
825                 if (ret < 0)
826                         return -1;
827         }
828
829         if (connect->options & eConnect_UUIE_fastStart) {
830                 for (i = 0; i < connect->fastStart.count; i++) {
831                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
832                                           &connect->fastStart.item[i]);
833                         if (ret < 0)
834                                 return -1;
835                 }
836         }
837
838         return 0;
839 }
840
841 /****************************************************************************/
842 static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
843                             enum ip_conntrack_info ctinfo,
844                             unsigned char **data, int dataoff,
845                             Alerting_UUIE * alert)
846 {
847         int ret;
848         int i;
849
850         DEBUGP("ip_ct_q931: Alerting\n");
851
852         if (alert->options & eAlerting_UUIE_h245Address) {
853                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
854                                   &alert->h245Address);
855                 if (ret < 0)
856                         return -1;
857         }
858
859         if (alert->options & eAlerting_UUIE_fastStart) {
860                 for (i = 0; i < alert->fastStart.count; i++) {
861                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
862                                           &alert->fastStart.item[i]);
863                         if (ret < 0)
864                                 return -1;
865                 }
866         }
867
868         return 0;
869 }
870
871 /****************************************************************************/
872 static int process_information(struct sk_buff **pskb,
873                                struct ip_conntrack *ct,
874                                enum ip_conntrack_info ctinfo,
875                                unsigned char **data, int dataoff,
876                                Information_UUIE * info)
877 {
878         int ret;
879         int i;
880
881         DEBUGP("ip_ct_q931: Information\n");
882
883         if (info->options & eInformation_UUIE_fastStart) {
884                 for (i = 0; i < info->fastStart.count; i++) {
885                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
886                                           &info->fastStart.item[i]);
887                         if (ret < 0)
888                                 return -1;
889                 }
890         }
891
892         return 0;
893 }
894
895 /****************************************************************************/
896 static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
897                             enum ip_conntrack_info ctinfo,
898                             unsigned char **data, int dataoff,
899                             Facility_UUIE * facility)
900 {
901         int ret;
902         int i;
903
904         DEBUGP("ip_ct_q931: Facility\n");
905
906         if (facility->options & eFacility_UUIE_h245Address) {
907                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
908                                   &facility->h245Address);
909                 if (ret < 0)
910                         return -1;
911         }
912
913         if (facility->options & eFacility_UUIE_fastStart) {
914                 for (i = 0; i < facility->fastStart.count; i++) {
915                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
916                                           &facility->fastStart.item[i]);
917                         if (ret < 0)
918                                 return -1;
919                 }
920         }
921
922         return 0;
923 }
924
925 /****************************************************************************/
926 static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
927                             enum ip_conntrack_info ctinfo,
928                             unsigned char **data, int dataoff,
929                             Progress_UUIE * progress)
930 {
931         int ret;
932         int i;
933
934         DEBUGP("ip_ct_q931: Progress\n");
935
936         if (progress->options & eProgress_UUIE_h245Address) {
937                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
938                                   &progress->h245Address);
939                 if (ret < 0)
940                         return -1;
941         }
942
943         if (progress->options & eProgress_UUIE_fastStart) {
944                 for (i = 0; i < progress->fastStart.count; i++) {
945                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
946                                           &progress->fastStart.item[i]);
947                         if (ret < 0)
948                                 return -1;
949                 }
950         }
951
952         return 0;
953 }
954
955 /****************************************************************************/
956 static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
957                         enum ip_conntrack_info ctinfo,
958                         unsigned char **data, int dataoff, Q931 * q931)
959 {
960         H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
961         int i;
962         int ret = 0;
963
964         switch (pdu->h323_message_body.choice) {
965         case eH323_UU_PDU_h323_message_body_setup:
966                 ret = process_setup(pskb, ct, ctinfo, data, dataoff,
967                                     &pdu->h323_message_body.setup);
968                 break;
969         case eH323_UU_PDU_h323_message_body_callProceeding:
970                 ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
971                                              &pdu->h323_message_body.
972                                              callProceeding);
973                 break;
974         case eH323_UU_PDU_h323_message_body_connect:
975                 ret = process_connect(pskb, ct, ctinfo, data, dataoff,
976                                       &pdu->h323_message_body.connect);
977                 break;
978         case eH323_UU_PDU_h323_message_body_alerting:
979                 ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
980                                        &pdu->h323_message_body.alerting);
981                 break;
982         case eH323_UU_PDU_h323_message_body_information:
983                 ret = process_information(pskb, ct, ctinfo, data, dataoff,
984                                           &pdu->h323_message_body.
985                                           information);
986                 break;
987         case eH323_UU_PDU_h323_message_body_facility:
988                 ret = process_facility(pskb, ct, ctinfo, data, dataoff,
989                                        &pdu->h323_message_body.facility);
990                 break;
991         case eH323_UU_PDU_h323_message_body_progress:
992                 ret = process_progress(pskb, ct, ctinfo, data, dataoff,
993                                        &pdu->h323_message_body.progress);
994                 break;
995         default:
996                 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
997                        pdu->h323_message_body.choice);
998                 break;
999         }
1000
1001         if (ret < 0)
1002                 return -1;
1003
1004         if (pdu->options & eH323_UU_PDU_h245Control) {
1005                 for (i = 0; i < pdu->h245Control.count; i++) {
1006                         ret = process_h245(pskb, ct, ctinfo, data, dataoff,
1007                                            &pdu->h245Control.item[i]);
1008                         if (ret < 0)
1009                                 return -1;
1010                 }
1011         }
1012
1013         return 0;
1014 }
1015
1016 /****************************************************************************/
1017 static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1018                      enum ip_conntrack_info ctinfo)
1019 {
1020         static Q931 q931;
1021         unsigned char *data = NULL;
1022         int datalen;
1023         int dataoff;
1024         int ret;
1025
1026         /* Until there's been traffic both ways, don't look in packets. */
1027         if (ctinfo != IP_CT_ESTABLISHED
1028             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
1029                 return NF_ACCEPT;
1030         }
1031         DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
1032
1033         spin_lock_bh(&ip_h323_lock);
1034
1035         /* Process each TPKT */
1036         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
1037                 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1038                        NIPQUAD((*pskb)->nh.iph->saddr),
1039                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1040
1041                 /* Decode Q.931 signal */
1042                 ret = DecodeQ931(data, datalen, &q931);
1043                 if (ret < 0) {
1044                         if (net_ratelimit())
1045                                 printk("ip_ct_q931: decoding error: %s\n",
1046                                        ret == H323_ERROR_BOUND ?
1047                                        "out of bound" : "out of range");
1048                         /* We don't drop when decoding error */
1049                         break;
1050                 }
1051
1052                 /* Process Q.931 signal */
1053                 if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
1054                         goto drop;
1055         }
1056
1057         spin_unlock_bh(&ip_h323_lock);
1058         return NF_ACCEPT;
1059
1060       drop:
1061         spin_unlock_bh(&ip_h323_lock);
1062         if (net_ratelimit())
1063                 printk("ip_ct_q931: packet dropped\n");
1064         return NF_DROP;
1065 }
1066
1067 /****************************************************************************/
1068 static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
1069         .name = "Q.931",
1070         .me = THIS_MODULE,
1071         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
1072         .timeout = 240,
1073         .tuple = {.src = {.u = {__constant_htons(Q931_PORT)}},
1074                   .dst = {.protonum = IPPROTO_TCP}},
1075         .mask = {.src = {.u = {0xFFFF}},
1076                  .dst = {.protonum = 0xFF}},
1077         .help = q931_help
1078 };
1079
1080 /****************************************************************************/
1081 void ip_conntrack_q931_expect(struct ip_conntrack *new,
1082                               struct ip_conntrack_expect *this)
1083 {
1084         write_lock_bh(&ip_conntrack_lock);
1085         new->helper = &ip_conntrack_helper_q931;
1086         write_unlock_bh(&ip_conntrack_lock);
1087 }
1088
1089 /****************************************************************************/
1090 static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
1091 {
1092         struct udphdr _uh, *uh;
1093         int dataoff;
1094
1095         uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
1096                                 &_uh);
1097         if (uh == NULL)
1098                 return NULL;
1099         dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
1100         if (dataoff >= (*pskb)->len)
1101                 return NULL;
1102         *datalen = (*pskb)->len - dataoff;
1103         return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
1104 }
1105
1106 /****************************************************************************/
1107 static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
1108                                                u_int32_t ip, u_int16_t port)
1109 {
1110         struct ip_conntrack_expect *exp;
1111         struct ip_conntrack_tuple tuple;
1112
1113         tuple.src.ip = 0;
1114         tuple.src.u.tcp.port = 0;
1115         tuple.dst.ip = ip;
1116         tuple.dst.u.tcp.port = htons(port);
1117         tuple.dst.protonum = IPPROTO_TCP;
1118
1119         exp = __ip_conntrack_expect_find(&tuple);
1120         if (exp->master == ct)
1121                 return exp;
1122         return NULL;
1123 }
1124
1125 /****************************************************************************/
1126 static int set_expect_timeout(struct ip_conntrack_expect *exp,
1127                               unsigned timeout)
1128 {
1129         if (!exp || !del_timer(&exp->timeout))
1130                 return 0;
1131
1132         exp->timeout.expires = jiffies + timeout * HZ;
1133         add_timer(&exp->timeout);
1134
1135         return 1;
1136 }
1137
1138 /****************************************************************************/
1139 static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
1140                        enum ip_conntrack_info ctinfo,
1141                        unsigned char **data,
1142                        TransportAddress * addr, int count)
1143 {
1144         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1145         int dir = CTINFO2DIR(ctinfo);
1146         int ret = 0;
1147         int i;
1148         u_int32_t ip;
1149         u_int16_t port;
1150         struct ip_conntrack_expect *exp;
1151
1152         /* Look for the first related address */
1153         for (i = 0; i < count; i++) {
1154                 if (get_h225_addr(*data, &addr[i], &ip, &port) &&
1155                     ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
1156                         break;
1157         }
1158
1159         if (i >= count)         /* Not found */
1160                 return 0;
1161
1162         /* Create expect for Q.931 */
1163         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1164                 return -1;
1165         exp->tuple.src.ip = gkrouted_only ?     /* only accept calls from GK? */
1166             ct->tuplehash[!dir].tuple.src.ip : 0;
1167         exp->tuple.src.u.tcp.port = 0;
1168         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
1169         exp->tuple.dst.u.tcp.port = htons(port);
1170         exp->tuple.dst.protonum = IPPROTO_TCP;
1171         exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
1172         exp->mask.src.u.tcp.port = 0;
1173         exp->mask.dst.ip = 0xFFFFFFFF;
1174         exp->mask.dst.u.tcp.port = 0xFFFF;
1175         exp->mask.dst.protonum = 0xFF;
1176         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
1177
1178         if (nat_q931_hook) {    /* Need NAT */
1179                 ret = nat_q931_hook(pskb, ct, ctinfo, data, addr, i,
1180                                     port, exp);
1181         } else {                /* Conntrack only */
1182                 exp->expectfn = ip_conntrack_q931_expect;
1183
1184                 if (ip_conntrack_expect_related(exp) == 0) {
1185                         DEBUGP("ip_ct_ras: expect Q.931 "
1186                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1187                                NIPQUAD(exp->tuple.src.ip),
1188                                ntohs(exp->tuple.src.u.tcp.port),
1189                                NIPQUAD(exp->tuple.dst.ip),
1190                                ntohs(exp->tuple.dst.u.tcp.port));
1191
1192                         /* Save port for looking up expect in processing RCF */
1193                         info->sig_port[dir] = port;
1194                 } else
1195                         ret = -1;
1196         }
1197
1198         ip_conntrack_expect_put(exp);
1199
1200         return ret;
1201 }
1202
1203 /****************************************************************************/
1204 static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
1205                        enum ip_conntrack_info ctinfo,
1206                        unsigned char **data, GatekeeperRequest * grq)
1207 {
1208         DEBUGP("ip_ct_ras: GRQ\n");
1209
1210         if (set_ras_addr_hook)  /* NATed */
1211                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1212                                          &grq->rasAddress, 1);
1213         return 0;
1214 }
1215
1216 /* Declare before using */
1217 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1218                                     struct ip_conntrack_expect *this);
1219
1220 /****************************************************************************/
1221 static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1222                        enum ip_conntrack_info ctinfo,
1223                        unsigned char **data, GatekeeperConfirm * gcf)
1224 {
1225         int dir = CTINFO2DIR(ctinfo);
1226         int ret = 0;
1227         u_int32_t ip;
1228         u_int16_t port;
1229         struct ip_conntrack_expect *exp;
1230
1231         DEBUGP("ip_ct_ras: GCF\n");
1232
1233         if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
1234                 return 0;
1235
1236         /* Registration port is the same as discovery port */
1237         if (ip == ct->tuplehash[dir].tuple.src.ip &&
1238             port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
1239                 return 0;
1240
1241         /* Avoid RAS expectation loops. A GCF is never expected. */
1242         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1243                 return 0;
1244
1245         /* Need new expect */
1246         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1247                 return -1;
1248         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1249         exp->tuple.src.u.tcp.port = 0;
1250         exp->tuple.dst.ip = ip;
1251         exp->tuple.dst.u.tcp.port = htons(port);
1252         exp->tuple.dst.protonum = IPPROTO_UDP;
1253         exp->mask.src.ip = 0xFFFFFFFF;
1254         exp->mask.src.u.tcp.port = 0;
1255         exp->mask.dst.ip = 0xFFFFFFFF;
1256         exp->mask.dst.u.tcp.port = 0xFFFF;
1257         exp->mask.dst.protonum = 0xFF;
1258         exp->flags = 0;
1259         exp->expectfn = ip_conntrack_ras_expect;
1260         if (ip_conntrack_expect_related(exp) == 0) {
1261                 DEBUGP("ip_ct_ras: expect RAS "
1262                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1263                        NIPQUAD(exp->tuple.src.ip),
1264                        ntohs(exp->tuple.src.u.tcp.port),
1265                        NIPQUAD(exp->tuple.dst.ip),
1266                        ntohs(exp->tuple.dst.u.tcp.port));
1267         } else
1268                 ret = -1;
1269
1270         ip_conntrack_expect_put(exp);
1271
1272         return ret;
1273 }
1274
1275 /****************************************************************************/
1276 static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1277                        enum ip_conntrack_info ctinfo,
1278                        unsigned char **data, RegistrationRequest * rrq)
1279 {
1280         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1281         int ret;
1282
1283         DEBUGP("ip_ct_ras: RRQ\n");
1284
1285         ret = expect_q931(pskb, ct, ctinfo, data,
1286                           rrq->callSignalAddress.item,
1287                           rrq->callSignalAddress.count);
1288         if (ret < 0)
1289                 return -1;
1290
1291         if (set_ras_addr_hook) {
1292                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1293                                         rrq->rasAddress.item,
1294                                         rrq->rasAddress.count);
1295                 if (ret < 0)
1296                         return -1;
1297         }
1298
1299         if (rrq->options & eRegistrationRequest_timeToLive) {
1300                 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1301                 info->timeout = rrq->timeToLive;
1302         } else
1303                 info->timeout = 0;
1304
1305         return 0;
1306 }
1307
1308 /****************************************************************************/
1309 static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1310                        enum ip_conntrack_info ctinfo,
1311                        unsigned char **data, RegistrationConfirm * rcf)
1312 {
1313         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1314         int dir = CTINFO2DIR(ctinfo);
1315         int ret;
1316         struct ip_conntrack_expect *exp;
1317
1318         DEBUGP("ip_ct_ras: RCF\n");
1319
1320         if (set_sig_addr_hook) {
1321                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1322                                         rcf->callSignalAddress.item,
1323                                         rcf->callSignalAddress.count);
1324                 if (ret < 0)
1325                         return -1;
1326         }
1327
1328         if (rcf->options & eRegistrationConfirm_timeToLive) {
1329                 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1330                 info->timeout = rcf->timeToLive;
1331         }
1332
1333         if (info->timeout > 0) {
1334                 DEBUGP
1335                     ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1336                      info->timeout);
1337                 ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
1338
1339                 /* Set expect timeout */
1340                 read_lock_bh(&ip_conntrack_lock);
1341                 exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
1342                                   info->sig_port[!dir]);
1343                 if (exp) {
1344                         DEBUGP("ip_ct_ras: set Q.931 expect "
1345                                "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1346                                "timeout to %u seconds\n",
1347                                NIPQUAD(exp->tuple.src.ip),
1348                                ntohs(exp->tuple.src.u.tcp.port),
1349                                NIPQUAD(exp->tuple.dst.ip),
1350                                ntohs(exp->tuple.dst.u.tcp.port),
1351                                info->timeout);
1352                         set_expect_timeout(exp, info->timeout);
1353                 }
1354                 read_unlock_bh(&ip_conntrack_lock);
1355         }
1356
1357         return 0;
1358 }
1359
1360 /****************************************************************************/
1361 static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
1362                        enum ip_conntrack_info ctinfo,
1363                        unsigned char **data, UnregistrationRequest * urq)
1364 {
1365         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1366         int dir = CTINFO2DIR(ctinfo);
1367         int ret;
1368
1369         DEBUGP("ip_ct_ras: URQ\n");
1370
1371         if (set_sig_addr_hook) {
1372                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1373                                         urq->callSignalAddress.item,
1374                                         urq->callSignalAddress.count);
1375                 if (ret < 0)
1376                         return -1;
1377         }
1378
1379         /* Clear old expect */
1380         ip_ct_remove_expectations(ct);
1381         info->sig_port[dir] = 0;
1382         info->sig_port[!dir] = 0;
1383
1384         /* Give it 30 seconds for UCF or URJ */
1385         ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
1386
1387         return 0;
1388 }
1389
1390 /****************************************************************************/
1391 static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
1392                        enum ip_conntrack_info ctinfo,
1393                        unsigned char **data, AdmissionRequest * arq)
1394 {
1395         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1396         int dir = CTINFO2DIR(ctinfo);
1397         u_int32_t ip;
1398         u_int16_t port;
1399
1400         DEBUGP("ip_ct_ras: ARQ\n");
1401
1402         if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1403             get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
1404             ip == ct->tuplehash[dir].tuple.src.ip &&
1405             port == info->sig_port[dir] && set_h225_addr_hook) {
1406                 /* Answering ARQ */
1407                 return set_h225_addr_hook(pskb, data, 0,
1408                                           &arq->destCallSignalAddress,
1409                                           ct->tuplehash[!dir].tuple.dst.ip,
1410                                           info->sig_port[!dir]);
1411         }
1412
1413         if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1414             get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
1415             ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr_hook) {
1416                 /* Calling ARQ */
1417                 return set_h225_addr_hook(pskb, data, 0,
1418                                           &arq->srcCallSignalAddress,
1419                                           ct->tuplehash[!dir].tuple.dst.ip,
1420                                           port);
1421         }
1422
1423         return 0;
1424 }
1425
1426 /****************************************************************************/
1427 static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
1428                        enum ip_conntrack_info ctinfo,
1429                        unsigned char **data, AdmissionConfirm * acf)
1430 {
1431         int dir = CTINFO2DIR(ctinfo);
1432         int ret = 0;
1433         u_int32_t ip;
1434         u_int16_t port;
1435         struct ip_conntrack_expect *exp;
1436
1437         DEBUGP("ip_ct_ras: ACF\n");
1438
1439         if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
1440                 return 0;
1441
1442         if (ip == ct->tuplehash[dir].tuple.dst.ip) {    /* Answering ACF */
1443                 if (set_sig_addr_hook)
1444                         return set_sig_addr_hook(pskb, ct, ctinfo, data,
1445                                                  &acf->destCallSignalAddress,
1446                                                  1);
1447                 return 0;
1448         }
1449
1450         /* Need new expect */
1451         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1452                 return -1;
1453         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1454         exp->tuple.src.u.tcp.port = 0;
1455         exp->tuple.dst.ip = ip;
1456         exp->tuple.dst.u.tcp.port = htons(port);
1457         exp->tuple.dst.protonum = IPPROTO_TCP;
1458         exp->mask.src.ip = 0xFFFFFFFF;
1459         exp->mask.src.u.tcp.port = 0;
1460         exp->mask.dst.ip = 0xFFFFFFFF;
1461         exp->mask.dst.u.tcp.port = 0xFFFF;
1462         exp->mask.dst.protonum = 0xFF;
1463         exp->flags = IP_CT_EXPECT_PERMANENT;
1464         exp->expectfn = ip_conntrack_q931_expect;
1465
1466         if (ip_conntrack_expect_related(exp) == 0) {
1467                 DEBUGP("ip_ct_ras: expect Q.931 "
1468                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1469                        NIPQUAD(exp->tuple.src.ip),
1470                        ntohs(exp->tuple.src.u.tcp.port),
1471                        NIPQUAD(exp->tuple.dst.ip),
1472                        ntohs(exp->tuple.dst.u.tcp.port));
1473         } else
1474                 ret = -1;
1475
1476         ip_conntrack_expect_put(exp);
1477
1478         return ret;
1479 }
1480
1481 /****************************************************************************/
1482 static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1483                        enum ip_conntrack_info ctinfo,
1484                        unsigned char **data, LocationRequest * lrq)
1485 {
1486         DEBUGP("ip_ct_ras: LRQ\n");
1487
1488         if (set_ras_addr_hook)
1489                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1490                                          &lrq->replyAddress, 1);
1491         return 0;
1492 }
1493
1494 /****************************************************************************/
1495 static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1496                        enum ip_conntrack_info ctinfo,
1497                        unsigned char **data, LocationConfirm * lcf)
1498 {
1499         int dir = CTINFO2DIR(ctinfo);
1500         int ret = 0;
1501         u_int32_t ip;
1502         u_int16_t port;
1503         struct ip_conntrack_expect *exp = NULL;
1504
1505         DEBUGP("ip_ct_ras: LCF\n");
1506
1507         if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
1508                 return 0;
1509
1510         /* Need new expect for call signal */
1511         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1512                 return -1;
1513         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1514         exp->tuple.src.u.tcp.port = 0;
1515         exp->tuple.dst.ip = ip;
1516         exp->tuple.dst.u.tcp.port = htons(port);
1517         exp->tuple.dst.protonum = IPPROTO_TCP;
1518         exp->mask.src.ip = 0xFFFFFFFF;
1519         exp->mask.src.u.tcp.port = 0;
1520         exp->mask.dst.ip = 0xFFFFFFFF;
1521         exp->mask.dst.u.tcp.port = 0xFFFF;
1522         exp->mask.dst.protonum = 0xFF;
1523         exp->flags = IP_CT_EXPECT_PERMANENT;
1524         exp->expectfn = ip_conntrack_q931_expect;
1525
1526         if (ip_conntrack_expect_related(exp) == 0) {
1527                 DEBUGP("ip_ct_ras: expect Q.931 "
1528                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1529                        NIPQUAD(exp->tuple.src.ip),
1530                        ntohs(exp->tuple.src.u.tcp.port),
1531                        NIPQUAD(exp->tuple.dst.ip),
1532                        ntohs(exp->tuple.dst.u.tcp.port));
1533         } else
1534                 ret = -1;
1535
1536         ip_conntrack_expect_put(exp);
1537
1538         /* Ignore rasAddress */
1539
1540         return ret;
1541 }
1542
1543 /****************************************************************************/
1544 static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
1545                        enum ip_conntrack_info ctinfo,
1546                        unsigned char **data, InfoRequestResponse * irr)
1547 {
1548         int ret;
1549
1550         DEBUGP("ip_ct_ras: IRR\n");
1551
1552         if (set_ras_addr_hook) {
1553                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1554                                         &irr->rasAddress, 1);
1555                 if (ret < 0)
1556                         return -1;
1557         }
1558
1559         if (set_sig_addr_hook) {
1560                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1561                                         irr->callSignalAddress.item,
1562                                         irr->callSignalAddress.count);
1563                 if (ret < 0)
1564                         return -1;
1565         }
1566
1567         return 0;
1568 }
1569
1570 /****************************************************************************/
1571 static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
1572                        enum ip_conntrack_info ctinfo,
1573                        unsigned char **data, RasMessage * ras)
1574 {
1575         switch (ras->choice) {
1576         case eRasMessage_gatekeeperRequest:
1577                 return process_grq(pskb, ct, ctinfo, data,
1578                                    &ras->gatekeeperRequest);
1579         case eRasMessage_gatekeeperConfirm:
1580                 return process_gcf(pskb, ct, ctinfo, data,
1581                                    &ras->gatekeeperConfirm);
1582         case eRasMessage_registrationRequest:
1583                 return process_rrq(pskb, ct, ctinfo, data,
1584                                    &ras->registrationRequest);
1585         case eRasMessage_registrationConfirm:
1586                 return process_rcf(pskb, ct, ctinfo, data,
1587                                    &ras->registrationConfirm);
1588         case eRasMessage_unregistrationRequest:
1589                 return process_urq(pskb, ct, ctinfo, data,
1590                                    &ras->unregistrationRequest);
1591         case eRasMessage_admissionRequest:
1592                 return process_arq(pskb, ct, ctinfo, data,
1593                                    &ras->admissionRequest);
1594         case eRasMessage_admissionConfirm:
1595                 return process_acf(pskb, ct, ctinfo, data,
1596                                    &ras->admissionConfirm);
1597         case eRasMessage_locationRequest:
1598                 return process_lrq(pskb, ct, ctinfo, data,
1599                                    &ras->locationRequest);
1600         case eRasMessage_locationConfirm:
1601                 return process_lcf(pskb, ct, ctinfo, data,
1602                                    &ras->locationConfirm);
1603         case eRasMessage_infoRequestResponse:
1604                 return process_irr(pskb, ct, ctinfo, data,
1605                                    &ras->infoRequestResponse);
1606         default:
1607                 DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
1608                 break;
1609         }
1610
1611         return 0;
1612 }
1613
1614 /****************************************************************************/
1615 static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1616                     enum ip_conntrack_info ctinfo)
1617 {
1618         static RasMessage ras;
1619         unsigned char *data;
1620         int datalen = 0;
1621         int ret;
1622
1623         DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
1624
1625         spin_lock_bh(&ip_h323_lock);
1626
1627         /* Get UDP data */
1628         data = get_udp_data(pskb, &datalen);
1629         if (data == NULL)
1630                 goto accept;
1631         DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1632                NIPQUAD((*pskb)->nh.iph->saddr),
1633                NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1634
1635         /* Decode RAS message */
1636         ret = DecodeRasMessage(data, datalen, &ras);
1637         if (ret < 0) {
1638                 if (net_ratelimit())
1639                         printk("ip_ct_ras: decoding error: %s\n",
1640                                ret == H323_ERROR_BOUND ?
1641                                "out of bound" : "out of range");
1642                 goto accept;
1643         }
1644
1645         /* Process RAS message */
1646         if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
1647                 goto drop;
1648
1649       accept:
1650         spin_unlock_bh(&ip_h323_lock);
1651         return NF_ACCEPT;
1652
1653       drop:
1654         spin_unlock_bh(&ip_h323_lock);
1655         if (net_ratelimit())
1656                 printk("ip_ct_ras: packet dropped\n");
1657         return NF_DROP;
1658 }
1659
1660 /****************************************************************************/
1661 static struct ip_conntrack_helper ip_conntrack_helper_ras = {
1662         .name = "RAS",
1663         .me = THIS_MODULE,
1664         .max_expected = 32,
1665         .timeout = 240,
1666         .tuple = {.src = {.u = {__constant_htons(RAS_PORT)}},
1667                   .dst = {.protonum = IPPROTO_UDP}},
1668         .mask = {.src = {.u = {0xFFFE}},
1669                  .dst = {.protonum = 0xFF}},
1670         .help = ras_help,
1671 };
1672
1673 /****************************************************************************/
1674 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1675                                     struct ip_conntrack_expect *this)
1676 {
1677         write_lock_bh(&ip_conntrack_lock);
1678         new->helper = &ip_conntrack_helper_ras;
1679         write_unlock_bh(&ip_conntrack_lock);
1680 }
1681
1682 /****************************************************************************/
1683 /* Not __exit - called from init() */
1684 static void fini(void)
1685 {
1686         ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
1687         ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
1688         kfree(h323_buffer);
1689         DEBUGP("ip_ct_h323: fini\n");
1690 }
1691
1692 /****************************************************************************/
1693 static int __init init(void)
1694 {
1695         int ret;
1696
1697         h323_buffer = kmalloc(65536, GFP_KERNEL);
1698         if (!h323_buffer)
1699                 return -ENOMEM;
1700         if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
1701             (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
1702                 fini();
1703                 return ret;
1704         }
1705
1706         DEBUGP("ip_ct_h323: init success\n");
1707         return 0;
1708 }
1709
1710 /****************************************************************************/
1711 module_init(init);
1712 module_exit(fini);
1713
1714 EXPORT_SYMBOL_GPL(get_h225_addr);
1715 EXPORT_SYMBOL_GPL(ip_conntrack_h245_expect);
1716 EXPORT_SYMBOL_GPL(ip_conntrack_q931_expect);
1717 EXPORT_SYMBOL_GPL(set_h245_addr_hook);
1718 EXPORT_SYMBOL_GPL(set_h225_addr_hook);
1719 EXPORT_SYMBOL_GPL(set_sig_addr_hook);
1720 EXPORT_SYMBOL_GPL(set_ras_addr_hook);
1721 EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
1722 EXPORT_SYMBOL_GPL(nat_t120_hook);
1723 EXPORT_SYMBOL_GPL(nat_h245_hook);
1724 EXPORT_SYMBOL_GPL(nat_q931_hook);
1725
1726 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1727 MODULE_DESCRIPTION("H.323 connection tracking helper");
1728 MODULE_LICENSE("GPL");