[NETFILTER]: Fix undefined references to get_h225_addr
[linux-2.6.git] / net / ipv4 / netfilter / ip_conntrack_helper_h323.c
1 /*
2  * H.323 connection tracking helper
3  *
4  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
5  *
6  * This source code is licensed under General Public License version 2.
7  *
8  * Based on the 'brute force' H.323 connection tracking module by
9  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
10  *
11  * For more information, please see http://nath323.sourceforge.net/
12  *
13  * Changes:
14  *      2006-02-01 - initial version 0.1
15  *
16  *      2006-02-20 - version 0.2
17  *        1. Changed source format to follow kernel conventions
18  *        2. Deleted some unnecessary structures
19  *        3. Minor fixes
20  *
21  *      2006-03-10 - version 0.3
22  *        1. Added support for multiple TPKTs in one packet (suggested by
23  *           Patrick McHardy)
24  *        2. Avoid excessive stack usage (based on Patrick McHardy's patch)
25  *        3. Added support for non-linear skb (based on Patrick McHardy's patch)
26  *        4. Fixed missing H.245 module owner (Patrick McHardy)
27  *        5. Avoid long RAS expectation chains (Patrick McHardy)
28  *        6. Fixed incorrect __exit attribute (Patrick McHardy)
29  *        7. Eliminated unnecessary return code
30  *        8. Fixed incorrect use of NAT data from conntrack code (suggested by
31  *           Patrick McHardy)
32  *        9. Fixed TTL calculation error in RCF
33  *        10. Added TTL support in RRQ
34  *        11. Better support for separate TPKT header and data
35  *
36  *      2006-03-15 - version 0.4
37  *        1. Added support for T.120 channels
38  *        2. Added parameter gkrouted_only (suggested by Patrick McHardy)
39  *        3. Splitted ASN.1 code and data (suggested by Patrick McHardy)
40  *        4. Sort ASN.1 data to avoid forwarding declarations (suggested by
41  *           Patrick McHardy)
42  *        5. Reset next TPKT data length in get_tpkt_data()
43  */
44
45 #include <linux/config.h>
46 #include <linux/module.h>
47 #include <linux/netfilter.h>
48 #include <linux/ip.h>
49 #include <net/tcp.h>
50 #include <linux/netfilter_ipv4/ip_conntrack.h>
51 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
52 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
53 #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
54 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
55 #include <linux/moduleparam.h>
56
57 #include "ip_conntrack_helper_h323_asn1.h"
58
59 #if 0
60 #define DEBUGP printk
61 #else
62 #define DEBUGP(format, args...)
63 #endif
64
65 /* Parameters */
66 static int gkrouted_only = 1;
67 module_param(gkrouted_only, int, 0600);
68 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
69
70 /* Hooks for NAT */
71 int (*set_h245_addr_hook) (struct sk_buff ** pskb,
72                            unsigned char **data, int dataoff,
73                            H245_TransportAddress * addr,
74                            u_int32_t ip, u_int16_t port);
75 int (*set_h225_addr_hook) (struct sk_buff ** pskb,
76                            unsigned char **data, int dataoff,
77                            TransportAddress * addr,
78                            u_int32_t ip, u_int16_t port);
79 int (*set_sig_addr_hook) (struct sk_buff ** pskb,
80                           struct ip_conntrack * ct,
81                           enum ip_conntrack_info ctinfo,
82                           unsigned char **data,
83                           TransportAddress * addr, int count);
84 int (*set_ras_addr_hook) (struct sk_buff ** pskb,
85                           struct ip_conntrack * ct,
86                           enum ip_conntrack_info ctinfo,
87                           unsigned char **data,
88                           TransportAddress * addr, int count);
89 int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
90                           struct ip_conntrack * ct,
91                           enum ip_conntrack_info ctinfo,
92                           unsigned char **data, int dataoff,
93                           H245_TransportAddress * addr,
94                           u_int16_t port, u_int16_t rtp_port,
95                           struct ip_conntrack_expect * rtp_exp,
96                           struct ip_conntrack_expect * rtcp_exp);
97 int (*nat_t120_hook) (struct sk_buff ** pskb,
98                       struct ip_conntrack * ct,
99                       enum ip_conntrack_info ctinfo,
100                       unsigned char **data, int dataoff,
101                       H245_TransportAddress * addr, u_int16_t port,
102                       struct ip_conntrack_expect * exp);
103 int (*nat_h245_hook) (struct sk_buff ** pskb,
104                       struct ip_conntrack * ct,
105                       enum ip_conntrack_info ctinfo,
106                       unsigned char **data, int dataoff,
107                       TransportAddress * addr, u_int16_t port,
108                       struct ip_conntrack_expect * exp);
109 int (*nat_q931_hook) (struct sk_buff ** pskb,
110                       struct ip_conntrack * ct,
111                       enum ip_conntrack_info ctinfo,
112                       unsigned char **data, TransportAddress * addr, int idx,
113                       u_int16_t port, struct ip_conntrack_expect * exp);
114
115
116 static DEFINE_SPINLOCK(ip_h323_lock);
117 static char *h323_buffer;
118
119 /****************************************************************************/
120 static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
121                          enum ip_conntrack_info ctinfo,
122                          unsigned char **data, int *datalen, int *dataoff)
123 {
124         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
125         int dir = CTINFO2DIR(ctinfo);
126         struct tcphdr _tcph, *th;
127         int tcpdatalen;
128         int tcpdataoff;
129         unsigned char *tpkt;
130         int tpktlen;
131         int tpktoff;
132
133         /* Get TCP header */
134         th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
135                                 sizeof(_tcph), &_tcph);
136         if (th == NULL)
137                 return 0;
138
139         /* Get TCP data offset */
140         tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
141
142         /* Get TCP data length */
143         tcpdatalen = (*pskb)->len - tcpdataoff;
144         if (tcpdatalen <= 0)    /* No TCP data */
145                 goto clear_out;
146
147         if (*data == NULL) {    /* first TPKT */
148                 /* Get first TPKT pointer */
149                 tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
150                                           h323_buffer);
151                 BUG_ON(tpkt == NULL);
152
153                 /* Validate TPKT identifier */
154                 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
155                         /* Netmeeting sends TPKT header and data separately */
156                         if (info->tpkt_len[dir] > 0) {
157                                 DEBUGP("ip_ct_h323: previous packet "
158                                        "indicated separate TPKT data of %hu "
159                                        "bytes\n", info->tpkt_len[dir]);
160                                 if (info->tpkt_len[dir] <= tcpdatalen) {
161                                         /* Yes, there was a TPKT header
162                                          * received */
163                                         *data = tpkt;
164                                         *datalen = info->tpkt_len[dir];
165                                         *dataoff = 0;
166                                         goto out;
167                                 }
168
169                                 /* Fragmented TPKT */
170                                 if (net_ratelimit())
171                                         printk("ip_ct_h323: "
172                                                "fragmented TPKT\n");
173                                 goto clear_out;
174                         }
175
176                         /* It is not even a TPKT */
177                         return 0;
178                 }
179                 tpktoff = 0;
180         } else {                /* Next TPKT */
181                 tpktoff = *dataoff + *datalen;
182                 tcpdatalen -= tpktoff;
183                 if (tcpdatalen <= 4)    /* No more TPKT */
184                         goto clear_out;
185                 tpkt = *data + *datalen;
186
187                 /* Validate TPKT identifier */
188                 if (tpkt[0] != 0x03 || tpkt[1] != 0)
189                         goto clear_out;
190         }
191
192         /* Validate TPKT length */
193         tpktlen = tpkt[2] * 256 + tpkt[3];
194         if (tpktlen > tcpdatalen) {
195                 if (tcpdatalen == 4) {  /* Separate TPKT header */
196                         /* Netmeeting sends TPKT header and data separately */
197                         DEBUGP("ip_ct_h323: separate TPKT header indicates "
198                                "there will be TPKT data of %hu bytes\n",
199                                tpktlen - 4);
200                         info->tpkt_len[dir] = tpktlen - 4;
201                         return 0;
202                 }
203
204                 if (net_ratelimit())
205                         printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
206                 goto clear_out;
207         }
208
209         /* This is the encapsulated data */
210         *data = tpkt + 4;
211         *datalen = tpktlen - 4;
212         *dataoff = tpktoff + 4;
213
214       out:
215         /* Clear TPKT length */
216         info->tpkt_len[dir] = 0;
217         return 1;
218
219       clear_out:
220         info->tpkt_len[dir] = 0;
221         return 0;
222 }
223
224 /****************************************************************************/
225 int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
226                   u_int32_t * ip, u_int16_t * port)
227 {
228         unsigned char *p;
229
230         if (addr->choice != eH245_TransportAddress_unicastAddress ||
231             addr->unicastAddress.choice != eUnicastAddress_iPAddress)
232                 return 0;
233
234         p = data + addr->unicastAddress.iPAddress.network;
235         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
236         *port = (p[4] << 8) | (p[5]);
237
238         return 1;
239 }
240
241 /****************************************************************************/
242 static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
243                            enum ip_conntrack_info ctinfo,
244                            unsigned char **data, int dataoff,
245                            H245_TransportAddress * addr)
246 {
247         int dir = CTINFO2DIR(ctinfo);
248         int ret = 0;
249         u_int32_t ip;
250         u_int16_t port;
251         u_int16_t rtp_port;
252         struct ip_conntrack_expect *rtp_exp;
253         struct ip_conntrack_expect *rtcp_exp;
254
255         /* Read RTP or RTCP address */
256         if (!get_h245_addr(*data, addr, &ip, &port) ||
257             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
258                 return 0;
259
260         /* RTP port is even */
261         rtp_port = port & (~1);
262
263         /* Create expect for RTP */
264         if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
265                 return -1;
266         rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
267         rtp_exp->tuple.src.u.udp.port = 0;
268         rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
269         rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
270         rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
271         rtp_exp->mask.src.ip = 0xFFFFFFFF;
272         rtp_exp->mask.src.u.udp.port = 0;
273         rtp_exp->mask.dst.ip = 0xFFFFFFFF;
274         rtp_exp->mask.dst.u.udp.port = 0xFFFF;
275         rtp_exp->mask.dst.protonum = 0xFF;
276         rtp_exp->flags = 0;
277
278         /* Create expect for RTCP */
279         if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
280                 ip_conntrack_expect_put(rtp_exp);
281                 return -1;
282         }
283         rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
284         rtcp_exp->tuple.src.u.udp.port = 0;
285         rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
286         rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
287         rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
288         rtcp_exp->mask.src.ip = 0xFFFFFFFF;
289         rtcp_exp->mask.src.u.udp.port = 0;
290         rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
291         rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
292         rtcp_exp->mask.dst.protonum = 0xFF;
293         rtcp_exp->flags = 0;
294
295         if (ct->tuplehash[dir].tuple.src.ip !=
296             ct->tuplehash[!dir].tuple.dst.ip && nat_rtp_rtcp_hook) {
297                 /* NAT needed */
298                 ret = nat_rtp_rtcp_hook(pskb, ct, ctinfo, data, dataoff,
299                                         addr, port, rtp_port, rtp_exp,
300                                         rtcp_exp);
301         } else {                /* Conntrack only */
302                 rtp_exp->expectfn = NULL;
303                 rtcp_exp->expectfn = NULL;
304
305                 if (ip_conntrack_expect_related(rtp_exp) == 0) {
306                         if (ip_conntrack_expect_related(rtcp_exp) == 0) {
307                                 DEBUGP("ip_ct_h323: expect RTP "
308                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
309                                        NIPQUAD(rtp_exp->tuple.src.ip),
310                                        ntohs(rtp_exp->tuple.src.u.udp.port),
311                                        NIPQUAD(rtp_exp->tuple.dst.ip),
312                                        ntohs(rtp_exp->tuple.dst.u.udp.port));
313                                 DEBUGP("ip_ct_h323: expect RTCP "
314                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
315                                        NIPQUAD(rtcp_exp->tuple.src.ip),
316                                        ntohs(rtcp_exp->tuple.src.u.udp.port),
317                                        NIPQUAD(rtcp_exp->tuple.dst.ip),
318                                        ntohs(rtcp_exp->tuple.dst.u.udp.port));
319                         } else {
320                                 ip_conntrack_unexpect_related(rtp_exp);
321                                 ret = -1;
322                         }
323                 } else
324                         ret = -1;
325         }
326
327         ip_conntrack_expect_put(rtp_exp);
328         ip_conntrack_expect_put(rtcp_exp);
329
330         return ret;
331 }
332
333 /****************************************************************************/
334 static int expect_t120(struct sk_buff **pskb,
335                        struct ip_conntrack *ct,
336                        enum ip_conntrack_info ctinfo,
337                        unsigned char **data, int dataoff,
338                        H245_TransportAddress * addr)
339 {
340         int dir = CTINFO2DIR(ctinfo);
341         int ret = 0;
342         u_int32_t ip;
343         u_int16_t port;
344         struct ip_conntrack_expect *exp = NULL;
345
346         /* Read T.120 address */
347         if (!get_h245_addr(*data, addr, &ip, &port) ||
348             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
349                 return 0;
350
351         /* Create expect for T.120 connections */
352         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
353                 return -1;
354         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
355         exp->tuple.src.u.tcp.port = 0;
356         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
357         exp->tuple.dst.u.tcp.port = htons(port);
358         exp->tuple.dst.protonum = IPPROTO_TCP;
359         exp->mask.src.ip = 0xFFFFFFFF;
360         exp->mask.src.u.tcp.port = 0;
361         exp->mask.dst.ip = 0xFFFFFFFF;
362         exp->mask.dst.u.tcp.port = 0xFFFF;
363         exp->mask.dst.protonum = 0xFF;
364         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple channels */
365
366         if (ct->tuplehash[dir].tuple.src.ip !=
367             ct->tuplehash[!dir].tuple.dst.ip && nat_t120_hook) {
368                 /* NAT needed */
369                 ret = nat_t120_hook(pskb, ct, ctinfo, data, dataoff, addr,
370                                     port, exp);
371         } else {                /* Conntrack only */
372                 exp->expectfn = NULL;
373                 if (ip_conntrack_expect_related(exp) == 0) {
374                         DEBUGP("ip_ct_h323: expect T.120 "
375                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
376                                NIPQUAD(exp->tuple.src.ip),
377                                ntohs(exp->tuple.src.u.tcp.port),
378                                NIPQUAD(exp->tuple.dst.ip),
379                                ntohs(exp->tuple.dst.u.tcp.port));
380                 } else
381                         ret = -1;
382         }
383
384         ip_conntrack_expect_put(exp);
385
386         return ret;
387 }
388
389 /****************************************************************************/
390 static int process_h245_channel(struct sk_buff **pskb,
391                                 struct ip_conntrack *ct,
392                                 enum ip_conntrack_info ctinfo,
393                                 unsigned char **data, int dataoff,
394                                 H2250LogicalChannelParameters * channel)
395 {
396         int ret;
397
398         if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
399                 /* RTP */
400                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
401                                       &channel->mediaChannel);
402                 if (ret < 0)
403                         return -1;
404         }
405
406         if (channel->
407             options & eH2250LogicalChannelParameters_mediaControlChannel) {
408                 /* RTCP */
409                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
410                                       &channel->mediaControlChannel);
411                 if (ret < 0)
412                         return -1;
413         }
414
415         return 0;
416 }
417
418 /****************************************************************************/
419 static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
420                        enum ip_conntrack_info ctinfo,
421                        unsigned char **data, int dataoff,
422                        OpenLogicalChannel * olc)
423 {
424         int ret;
425
426         DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
427
428         if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
429             eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
430         {
431                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
432                                            &olc->
433                                            forwardLogicalChannelParameters.
434                                            multiplexParameters.
435                                            h2250LogicalChannelParameters);
436                 if (ret < 0)
437                         return -1;
438         }
439
440         if ((olc->options &
441              eOpenLogicalChannel_reverseLogicalChannelParameters) &&
442             (olc->reverseLogicalChannelParameters.options &
443              eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
444             && (olc->reverseLogicalChannelParameters.multiplexParameters.
445                 choice ==
446                 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
447         {
448                 ret =
449                     process_h245_channel(pskb, ct, ctinfo, data, dataoff,
450                                          &olc->
451                                          reverseLogicalChannelParameters.
452                                          multiplexParameters.
453                                          h2250LogicalChannelParameters);
454                 if (ret < 0)
455                         return -1;
456         }
457
458         if ((olc->options & eOpenLogicalChannel_separateStack) &&
459             olc->forwardLogicalChannelParameters.dataType.choice ==
460             eDataType_data &&
461             olc->forwardLogicalChannelParameters.dataType.data.application.
462             choice == eDataApplicationCapability_application_t120 &&
463             olc->forwardLogicalChannelParameters.dataType.data.application.
464             t120.choice == eDataProtocolCapability_separateLANStack &&
465             olc->separateStack.networkAddress.choice ==
466             eNetworkAccessParameters_networkAddress_localAreaAddress) {
467                 ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
468                                   &olc->separateStack.networkAddress.
469                                   localAreaAddress);
470                 if (ret < 0)
471                         return -1;
472         }
473
474         return 0;
475 }
476
477 /****************************************************************************/
478 static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
479                         enum ip_conntrack_info ctinfo,
480                         unsigned char **data, int dataoff,
481                         OpenLogicalChannelAck * olca)
482 {
483         H2250LogicalChannelAckParameters *ack;
484         int ret;
485
486         DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
487
488         if ((olca->options &
489              eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
490             (olca->reverseLogicalChannelParameters.options &
491              eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
492             && (olca->reverseLogicalChannelParameters.multiplexParameters.
493                 choice ==
494                 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
495         {
496                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
497                                            &olca->
498                                            reverseLogicalChannelParameters.
499                                            multiplexParameters.
500                                            h2250LogicalChannelParameters);
501                 if (ret < 0)
502                         return -1;
503         }
504
505         if ((olca->options &
506              eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
507             (olca->forwardMultiplexAckParameters.choice ==
508              eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
509         {
510                 ack = &olca->forwardMultiplexAckParameters.
511                     h2250LogicalChannelAckParameters;
512                 if (ack->options &
513                     eH2250LogicalChannelAckParameters_mediaChannel) {
514                         /* RTP */
515                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
516                                               &ack->mediaChannel);
517                         if (ret < 0)
518                                 return -1;
519                 }
520
521                 if (ack->options &
522                     eH2250LogicalChannelAckParameters_mediaControlChannel) {
523                         /* RTCP */
524                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
525                                               &ack->mediaControlChannel);
526                         if (ret < 0)
527                                 return -1;
528                 }
529         }
530
531         return 0;
532 }
533
534 /****************************************************************************/
535 static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
536                         enum ip_conntrack_info ctinfo,
537                         unsigned char **data, int dataoff,
538                         MultimediaSystemControlMessage * mscm)
539 {
540         switch (mscm->choice) {
541         case eMultimediaSystemControlMessage_request:
542                 if (mscm->request.choice ==
543                     eRequestMessage_openLogicalChannel) {
544                         return process_olc(pskb, ct, ctinfo, data, dataoff,
545                                            &mscm->request.openLogicalChannel);
546                 }
547                 DEBUGP("ip_ct_h323: H.245 Request %d\n",
548                        mscm->request.choice);
549                 break;
550         case eMultimediaSystemControlMessage_response:
551                 if (mscm->response.choice ==
552                     eResponseMessage_openLogicalChannelAck) {
553                         return process_olca(pskb, ct, ctinfo, data, dataoff,
554                                             &mscm->response.
555                                             openLogicalChannelAck);
556                 }
557                 DEBUGP("ip_ct_h323: H.245 Response %d\n",
558                        mscm->response.choice);
559                 break;
560         default:
561                 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
562                 break;
563         }
564
565         return 0;
566 }
567
568 /****************************************************************************/
569 static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
570                      enum ip_conntrack_info ctinfo)
571 {
572         static MultimediaSystemControlMessage mscm;
573         unsigned char *data = NULL;
574         int datalen;
575         int dataoff;
576         int ret;
577
578         /* Until there's been traffic both ways, don't look in packets. */
579         if (ctinfo != IP_CT_ESTABLISHED
580             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
581                 return NF_ACCEPT;
582         }
583         DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
584
585         spin_lock_bh(&ip_h323_lock);
586
587         /* Process each TPKT */
588         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
589                 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
590                        NIPQUAD((*pskb)->nh.iph->saddr),
591                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
592
593                 /* Decode H.245 signal */
594                 ret = DecodeMultimediaSystemControlMessage(data, datalen,
595                                                            &mscm);
596                 if (ret < 0) {
597                         if (net_ratelimit())
598                                 printk("ip_ct_h245: decoding error: %s\n",
599                                        ret == H323_ERROR_BOUND ?
600                                        "out of bound" : "out of range");
601                         /* We don't drop when decoding error */
602                         break;
603                 }
604
605                 /* Process H.245 signal */
606                 if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
607                         goto drop;
608         }
609
610         spin_unlock_bh(&ip_h323_lock);
611         return NF_ACCEPT;
612
613       drop:
614         spin_unlock_bh(&ip_h323_lock);
615         if (net_ratelimit())
616                 printk("ip_ct_h245: packet dropped\n");
617         return NF_DROP;
618 }
619
620 /****************************************************************************/
621 static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
622         .name = "H.245",
623         .me = THIS_MODULE,
624         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
625         .timeout = 240,
626         .tuple = {.dst = {.protonum = IPPROTO_TCP}},
627         .mask = {.src = {.u = {0xFFFF}},
628                  .dst = {.protonum = 0xFF}},
629         .help = h245_help
630 };
631
632 /****************************************************************************/
633 void ip_conntrack_h245_expect(struct ip_conntrack *new,
634                               struct ip_conntrack_expect *this)
635 {
636         write_lock_bh(&ip_conntrack_lock);
637         new->helper = &ip_conntrack_helper_h245;
638         write_unlock_bh(&ip_conntrack_lock);
639 }
640
641 /****************************************************************************/
642 int get_h225_addr(unsigned char *data, TransportAddress * addr,
643                   u_int32_t * ip, u_int16_t * port)
644 {
645         unsigned char *p;
646
647         if (addr->choice != eTransportAddress_ipAddress)
648                 return 0;
649
650         p = data + addr->ipAddress.ip;
651         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
652         *port = (p[4] << 8) | (p[5]);
653
654         return 1;
655 }
656
657 /****************************************************************************/
658 static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
659                        enum ip_conntrack_info ctinfo,
660                        unsigned char **data, int dataoff,
661                        TransportAddress * addr)
662 {
663         int dir = CTINFO2DIR(ctinfo);
664         int ret = 0;
665         u_int32_t ip;
666         u_int16_t port;
667         struct ip_conntrack_expect *exp = NULL;
668
669         /* Read h245Address */
670         if (!get_h225_addr(*data, addr, &ip, &port) ||
671             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
672                 return 0;
673
674         /* Create expect for h245 connection */
675         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
676                 return -1;
677         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
678         exp->tuple.src.u.tcp.port = 0;
679         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
680         exp->tuple.dst.u.tcp.port = htons(port);
681         exp->tuple.dst.protonum = IPPROTO_TCP;
682         exp->mask.src.ip = 0xFFFFFFFF;
683         exp->mask.src.u.tcp.port = 0;
684         exp->mask.dst.ip = 0xFFFFFFFF;
685         exp->mask.dst.u.tcp.port = 0xFFFF;
686         exp->mask.dst.protonum = 0xFF;
687         exp->flags = 0;
688
689         if (ct->tuplehash[dir].tuple.src.ip !=
690             ct->tuplehash[!dir].tuple.dst.ip && nat_h245_hook) {
691                 /* NAT needed */
692                 ret = nat_h245_hook(pskb, ct, ctinfo, data, dataoff, addr,
693                                     port, exp);
694         } else {                /* Conntrack only */
695                 exp->expectfn = ip_conntrack_h245_expect;
696
697                 if (ip_conntrack_expect_related(exp) == 0) {
698                         DEBUGP("ip_ct_q931: expect H.245 "
699                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
700                                NIPQUAD(exp->tuple.src.ip),
701                                ntohs(exp->tuple.src.u.tcp.port),
702                                NIPQUAD(exp->tuple.dst.ip),
703                                ntohs(exp->tuple.dst.u.tcp.port));
704                 } else
705                         ret = -1;
706         }
707
708         ip_conntrack_expect_put(exp);
709
710         return ret;
711 }
712
713 /****************************************************************************/
714 static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
715                          enum ip_conntrack_info ctinfo,
716                          unsigned char **data, int dataoff,
717                          Setup_UUIE * setup)
718 {
719         int dir = CTINFO2DIR(ctinfo);
720         int ret;
721         int i;
722         u_int32_t ip;
723         u_int16_t port;
724
725         DEBUGP("ip_ct_q931: Setup\n");
726
727         if (setup->options & eSetup_UUIE_h245Address) {
728                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
729                                   &setup->h245Address);
730                 if (ret < 0)
731                         return -1;
732         }
733
734         if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
735             (set_h225_addr_hook) &&
736             get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
737             ip != ct->tuplehash[!dir].tuple.src.ip) {
738                 DEBUGP("ip_ct_q931: set destCallSignalAddress "
739                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
740                        NIPQUAD(ip), port,
741                        NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
742                        ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
743                 ret = set_h225_addr_hook(pskb, data, dataoff,
744                                          &setup->destCallSignalAddress,
745                                          ct->tuplehash[!dir].tuple.src.ip,
746                                          ntohs(ct->tuplehash[!dir].tuple.src.
747                                                u.tcp.port));
748                 if (ret < 0)
749                         return -1;
750         }
751
752         if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
753             (set_h225_addr_hook) &&
754             get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
755             && ip != ct->tuplehash[!dir].tuple.dst.ip) {
756                 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
757                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
758                        NIPQUAD(ip), port,
759                        NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
760                        ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
761                 ret = set_h225_addr_hook(pskb, data, dataoff,
762                                          &setup->sourceCallSignalAddress,
763                                          ct->tuplehash[!dir].tuple.dst.ip,
764                                          ntohs(ct->tuplehash[!dir].tuple.dst.
765                                                u.tcp.port));
766                 if (ret < 0)
767                         return -1;
768         }
769
770         if (setup->options & eSetup_UUIE_fastStart) {
771                 for (i = 0; i < setup->fastStart.count; i++) {
772                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
773                                           &setup->fastStart.item[i]);
774                         if (ret < 0)
775                                 return -1;
776                 }
777         }
778
779         return 0;
780 }
781
782 /****************************************************************************/
783 static int process_callproceeding(struct sk_buff **pskb,
784                                   struct ip_conntrack *ct,
785                                   enum ip_conntrack_info ctinfo,
786                                   unsigned char **data, int dataoff,
787                                   CallProceeding_UUIE * callproc)
788 {
789         int ret;
790         int i;
791
792         DEBUGP("ip_ct_q931: CallProceeding\n");
793
794         if (callproc->options & eCallProceeding_UUIE_h245Address) {
795                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
796                                   &callproc->h245Address);
797                 if (ret < 0)
798                         return -1;
799         }
800
801         if (callproc->options & eCallProceeding_UUIE_fastStart) {
802                 for (i = 0; i < callproc->fastStart.count; i++) {
803                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
804                                           &callproc->fastStart.item[i]);
805                         if (ret < 0)
806                                 return -1;
807                 }
808         }
809
810         return 0;
811 }
812
813 /****************************************************************************/
814 static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
815                            enum ip_conntrack_info ctinfo,
816                            unsigned char **data, int dataoff,
817                            Connect_UUIE * connect)
818 {
819         int ret;
820         int i;
821
822         DEBUGP("ip_ct_q931: Connect\n");
823
824         if (connect->options & eConnect_UUIE_h245Address) {
825                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
826                                   &connect->h245Address);
827                 if (ret < 0)
828                         return -1;
829         }
830
831         if (connect->options & eConnect_UUIE_fastStart) {
832                 for (i = 0; i < connect->fastStart.count; i++) {
833                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
834                                           &connect->fastStart.item[i]);
835                         if (ret < 0)
836                                 return -1;
837                 }
838         }
839
840         return 0;
841 }
842
843 /****************************************************************************/
844 static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
845                             enum ip_conntrack_info ctinfo,
846                             unsigned char **data, int dataoff,
847                             Alerting_UUIE * alert)
848 {
849         int ret;
850         int i;
851
852         DEBUGP("ip_ct_q931: Alerting\n");
853
854         if (alert->options & eAlerting_UUIE_h245Address) {
855                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
856                                   &alert->h245Address);
857                 if (ret < 0)
858                         return -1;
859         }
860
861         if (alert->options & eAlerting_UUIE_fastStart) {
862                 for (i = 0; i < alert->fastStart.count; i++) {
863                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
864                                           &alert->fastStart.item[i]);
865                         if (ret < 0)
866                                 return -1;
867                 }
868         }
869
870         return 0;
871 }
872
873 /****************************************************************************/
874 static int process_information(struct sk_buff **pskb,
875                                struct ip_conntrack *ct,
876                                enum ip_conntrack_info ctinfo,
877                                unsigned char **data, int dataoff,
878                                Information_UUIE * info)
879 {
880         int ret;
881         int i;
882
883         DEBUGP("ip_ct_q931: Information\n");
884
885         if (info->options & eInformation_UUIE_fastStart) {
886                 for (i = 0; i < info->fastStart.count; i++) {
887                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
888                                           &info->fastStart.item[i]);
889                         if (ret < 0)
890                                 return -1;
891                 }
892         }
893
894         return 0;
895 }
896
897 /****************************************************************************/
898 static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
899                             enum ip_conntrack_info ctinfo,
900                             unsigned char **data, int dataoff,
901                             Facility_UUIE * facility)
902 {
903         int ret;
904         int i;
905
906         DEBUGP("ip_ct_q931: Facility\n");
907
908         if (facility->options & eFacility_UUIE_h245Address) {
909                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
910                                   &facility->h245Address);
911                 if (ret < 0)
912                         return -1;
913         }
914
915         if (facility->options & eFacility_UUIE_fastStart) {
916                 for (i = 0; i < facility->fastStart.count; i++) {
917                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
918                                           &facility->fastStart.item[i]);
919                         if (ret < 0)
920                                 return -1;
921                 }
922         }
923
924         return 0;
925 }
926
927 /****************************************************************************/
928 static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
929                             enum ip_conntrack_info ctinfo,
930                             unsigned char **data, int dataoff,
931                             Progress_UUIE * progress)
932 {
933         int ret;
934         int i;
935
936         DEBUGP("ip_ct_q931: Progress\n");
937
938         if (progress->options & eProgress_UUIE_h245Address) {
939                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
940                                   &progress->h245Address);
941                 if (ret < 0)
942                         return -1;
943         }
944
945         if (progress->options & eProgress_UUIE_fastStart) {
946                 for (i = 0; i < progress->fastStart.count; i++) {
947                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
948                                           &progress->fastStart.item[i]);
949                         if (ret < 0)
950                                 return -1;
951                 }
952         }
953
954         return 0;
955 }
956
957 /****************************************************************************/
958 static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
959                         enum ip_conntrack_info ctinfo,
960                         unsigned char **data, int dataoff, Q931 * q931)
961 {
962         H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
963         int i;
964         int ret = 0;
965
966         switch (pdu->h323_message_body.choice) {
967         case eH323_UU_PDU_h323_message_body_setup:
968                 ret = process_setup(pskb, ct, ctinfo, data, dataoff,
969                                     &pdu->h323_message_body.setup);
970                 break;
971         case eH323_UU_PDU_h323_message_body_callProceeding:
972                 ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
973                                              &pdu->h323_message_body.
974                                              callProceeding);
975                 break;
976         case eH323_UU_PDU_h323_message_body_connect:
977                 ret = process_connect(pskb, ct, ctinfo, data, dataoff,
978                                       &pdu->h323_message_body.connect);
979                 break;
980         case eH323_UU_PDU_h323_message_body_alerting:
981                 ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
982                                        &pdu->h323_message_body.alerting);
983                 break;
984         case eH323_UU_PDU_h323_message_body_information:
985                 ret = process_information(pskb, ct, ctinfo, data, dataoff,
986                                           &pdu->h323_message_body.
987                                           information);
988                 break;
989         case eH323_UU_PDU_h323_message_body_facility:
990                 ret = process_facility(pskb, ct, ctinfo, data, dataoff,
991                                        &pdu->h323_message_body.facility);
992                 break;
993         case eH323_UU_PDU_h323_message_body_progress:
994                 ret = process_progress(pskb, ct, ctinfo, data, dataoff,
995                                        &pdu->h323_message_body.progress);
996                 break;
997         default:
998                 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
999                        pdu->h323_message_body.choice);
1000                 break;
1001         }
1002
1003         if (ret < 0)
1004                 return -1;
1005
1006         if (pdu->options & eH323_UU_PDU_h245Control) {
1007                 for (i = 0; i < pdu->h245Control.count; i++) {
1008                         ret = process_h245(pskb, ct, ctinfo, data, dataoff,
1009                                            &pdu->h245Control.item[i]);
1010                         if (ret < 0)
1011                                 return -1;
1012                 }
1013         }
1014
1015         return 0;
1016 }
1017
1018 /****************************************************************************/
1019 static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1020                      enum ip_conntrack_info ctinfo)
1021 {
1022         static Q931 q931;
1023         unsigned char *data = NULL;
1024         int datalen;
1025         int dataoff;
1026         int ret;
1027
1028         /* Until there's been traffic both ways, don't look in packets. */
1029         if (ctinfo != IP_CT_ESTABLISHED
1030             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
1031                 return NF_ACCEPT;
1032         }
1033         DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
1034
1035         spin_lock_bh(&ip_h323_lock);
1036
1037         /* Process each TPKT */
1038         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
1039                 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1040                        NIPQUAD((*pskb)->nh.iph->saddr),
1041                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1042
1043                 /* Decode Q.931 signal */
1044                 ret = DecodeQ931(data, datalen, &q931);
1045                 if (ret < 0) {
1046                         if (net_ratelimit())
1047                                 printk("ip_ct_q931: decoding error: %s\n",
1048                                        ret == H323_ERROR_BOUND ?
1049                                        "out of bound" : "out of range");
1050                         /* We don't drop when decoding error */
1051                         break;
1052                 }
1053
1054                 /* Process Q.931 signal */
1055                 if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
1056                         goto drop;
1057         }
1058
1059         spin_unlock_bh(&ip_h323_lock);
1060         return NF_ACCEPT;
1061
1062       drop:
1063         spin_unlock_bh(&ip_h323_lock);
1064         if (net_ratelimit())
1065                 printk("ip_ct_q931: packet dropped\n");
1066         return NF_DROP;
1067 }
1068
1069 /****************************************************************************/
1070 static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
1071         .name = "Q.931",
1072         .me = THIS_MODULE,
1073         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
1074         .timeout = 240,
1075         .tuple = {.src = {.u = {__constant_htons(Q931_PORT)}},
1076                   .dst = {.protonum = IPPROTO_TCP}},
1077         .mask = {.src = {.u = {0xFFFF}},
1078                  .dst = {.protonum = 0xFF}},
1079         .help = q931_help
1080 };
1081
1082 /****************************************************************************/
1083 void ip_conntrack_q931_expect(struct ip_conntrack *new,
1084                               struct ip_conntrack_expect *this)
1085 {
1086         write_lock_bh(&ip_conntrack_lock);
1087         new->helper = &ip_conntrack_helper_q931;
1088         write_unlock_bh(&ip_conntrack_lock);
1089 }
1090
1091 /****************************************************************************/
1092 static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
1093 {
1094         struct udphdr _uh, *uh;
1095         int dataoff;
1096
1097         uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
1098                                 &_uh);
1099         if (uh == NULL)
1100                 return NULL;
1101         dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
1102         if (dataoff >= (*pskb)->len)
1103                 return NULL;
1104         *datalen = (*pskb)->len - dataoff;
1105         return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
1106 }
1107
1108 /****************************************************************************/
1109 static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
1110                                                u_int32_t ip, u_int16_t port)
1111 {
1112         struct ip_conntrack_expect *exp;
1113         struct ip_conntrack_tuple tuple;
1114
1115         tuple.src.ip = 0;
1116         tuple.src.u.tcp.port = 0;
1117         tuple.dst.ip = ip;
1118         tuple.dst.u.tcp.port = htons(port);
1119         tuple.dst.protonum = IPPROTO_TCP;
1120
1121         exp = __ip_conntrack_expect_find(&tuple);
1122         if (exp->master == ct)
1123                 return exp;
1124         return NULL;
1125 }
1126
1127 /****************************************************************************/
1128 static int set_expect_timeout(struct ip_conntrack_expect *exp,
1129                               unsigned timeout)
1130 {
1131         if (!exp || !del_timer(&exp->timeout))
1132                 return 0;
1133
1134         exp->timeout.expires = jiffies + timeout * HZ;
1135         add_timer(&exp->timeout);
1136
1137         return 1;
1138 }
1139
1140 /****************************************************************************/
1141 static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
1142                        enum ip_conntrack_info ctinfo,
1143                        unsigned char **data,
1144                        TransportAddress * addr, int count)
1145 {
1146         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1147         int dir = CTINFO2DIR(ctinfo);
1148         int ret = 0;
1149         int i;
1150         u_int32_t ip;
1151         u_int16_t port;
1152         struct ip_conntrack_expect *exp;
1153
1154         /* Look for the first related address */
1155         for (i = 0; i < count; i++) {
1156                 if (get_h225_addr(*data, &addr[i], &ip, &port) &&
1157                     ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
1158                         break;
1159         }
1160
1161         if (i >= count)         /* Not found */
1162                 return 0;
1163
1164         /* Create expect for Q.931 */
1165         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1166                 return -1;
1167         exp->tuple.src.ip = gkrouted_only ?     /* only accept calls from GK? */
1168             ct->tuplehash[!dir].tuple.src.ip : 0;
1169         exp->tuple.src.u.tcp.port = 0;
1170         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
1171         exp->tuple.dst.u.tcp.port = htons(port);
1172         exp->tuple.dst.protonum = IPPROTO_TCP;
1173         exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
1174         exp->mask.src.u.tcp.port = 0;
1175         exp->mask.dst.ip = 0xFFFFFFFF;
1176         exp->mask.dst.u.tcp.port = 0xFFFF;
1177         exp->mask.dst.protonum = 0xFF;
1178         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
1179
1180         if (nat_q931_hook) {    /* Need NAT */
1181                 ret = nat_q931_hook(pskb, ct, ctinfo, data, addr, i,
1182                                     port, exp);
1183         } else {                /* Conntrack only */
1184                 exp->expectfn = ip_conntrack_q931_expect;
1185
1186                 if (ip_conntrack_expect_related(exp) == 0) {
1187                         DEBUGP("ip_ct_ras: expect Q.931 "
1188                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1189                                NIPQUAD(exp->tuple.src.ip),
1190                                ntohs(exp->tuple.src.u.tcp.port),
1191                                NIPQUAD(exp->tuple.dst.ip),
1192                                ntohs(exp->tuple.dst.u.tcp.port));
1193
1194                         /* Save port for looking up expect in processing RCF */
1195                         info->sig_port[dir] = port;
1196                 } else
1197                         ret = -1;
1198         }
1199
1200         ip_conntrack_expect_put(exp);
1201
1202         return ret;
1203 }
1204
1205 /****************************************************************************/
1206 static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
1207                        enum ip_conntrack_info ctinfo,
1208                        unsigned char **data, GatekeeperRequest * grq)
1209 {
1210         DEBUGP("ip_ct_ras: GRQ\n");
1211
1212         if (set_ras_addr_hook)  /* NATed */
1213                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1214                                          &grq->rasAddress, 1);
1215         return 0;
1216 }
1217
1218 /* Declare before using */
1219 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1220                                     struct ip_conntrack_expect *this);
1221
1222 /****************************************************************************/
1223 static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1224                        enum ip_conntrack_info ctinfo,
1225                        unsigned char **data, GatekeeperConfirm * gcf)
1226 {
1227         int dir = CTINFO2DIR(ctinfo);
1228         int ret = 0;
1229         u_int32_t ip;
1230         u_int16_t port;
1231         struct ip_conntrack_expect *exp;
1232
1233         DEBUGP("ip_ct_ras: GCF\n");
1234
1235         if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
1236                 return 0;
1237
1238         /* Registration port is the same as discovery port */
1239         if (ip == ct->tuplehash[dir].tuple.src.ip &&
1240             port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
1241                 return 0;
1242
1243         /* Avoid RAS expectation loops. A GCF is never expected. */
1244         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1245                 return 0;
1246
1247         /* Need new expect */
1248         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1249                 return -1;
1250         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1251         exp->tuple.src.u.tcp.port = 0;
1252         exp->tuple.dst.ip = ip;
1253         exp->tuple.dst.u.tcp.port = htons(port);
1254         exp->tuple.dst.protonum = IPPROTO_UDP;
1255         exp->mask.src.ip = 0xFFFFFFFF;
1256         exp->mask.src.u.tcp.port = 0;
1257         exp->mask.dst.ip = 0xFFFFFFFF;
1258         exp->mask.dst.u.tcp.port = 0xFFFF;
1259         exp->mask.dst.protonum = 0xFF;
1260         exp->flags = 0;
1261         exp->expectfn = ip_conntrack_ras_expect;
1262         if (ip_conntrack_expect_related(exp) == 0) {
1263                 DEBUGP("ip_ct_ras: expect RAS "
1264                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1265                        NIPQUAD(exp->tuple.src.ip),
1266                        ntohs(exp->tuple.src.u.tcp.port),
1267                        NIPQUAD(exp->tuple.dst.ip),
1268                        ntohs(exp->tuple.dst.u.tcp.port));
1269         } else
1270                 ret = -1;
1271
1272         ip_conntrack_expect_put(exp);
1273
1274         return ret;
1275 }
1276
1277 /****************************************************************************/
1278 static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1279                        enum ip_conntrack_info ctinfo,
1280                        unsigned char **data, RegistrationRequest * rrq)
1281 {
1282         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1283         int ret;
1284
1285         DEBUGP("ip_ct_ras: RRQ\n");
1286
1287         ret = expect_q931(pskb, ct, ctinfo, data,
1288                           rrq->callSignalAddress.item,
1289                           rrq->callSignalAddress.count);
1290         if (ret < 0)
1291                 return -1;
1292
1293         if (set_ras_addr_hook) {
1294                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1295                                         rrq->rasAddress.item,
1296                                         rrq->rasAddress.count);
1297                 if (ret < 0)
1298                         return -1;
1299         }
1300
1301         if (rrq->options & eRegistrationRequest_timeToLive) {
1302                 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1303                 info->timeout = rrq->timeToLive;
1304         } else
1305                 info->timeout = 0;
1306
1307         return 0;
1308 }
1309
1310 /****************************************************************************/
1311 static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1312                        enum ip_conntrack_info ctinfo,
1313                        unsigned char **data, RegistrationConfirm * rcf)
1314 {
1315         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1316         int dir = CTINFO2DIR(ctinfo);
1317         int ret;
1318         struct ip_conntrack_expect *exp;
1319
1320         DEBUGP("ip_ct_ras: RCF\n");
1321
1322         if (set_sig_addr_hook) {
1323                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1324                                         rcf->callSignalAddress.item,
1325                                         rcf->callSignalAddress.count);
1326                 if (ret < 0)
1327                         return -1;
1328         }
1329
1330         if (rcf->options & eRegistrationConfirm_timeToLive) {
1331                 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1332                 info->timeout = rcf->timeToLive;
1333         }
1334
1335         if (info->timeout > 0) {
1336                 DEBUGP
1337                     ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1338                      info->timeout);
1339                 ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
1340
1341                 /* Set expect timeout */
1342                 read_lock_bh(&ip_conntrack_lock);
1343                 exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
1344                                   info->sig_port[!dir]);
1345                 if (exp) {
1346                         DEBUGP("ip_ct_ras: set Q.931 expect "
1347                                "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1348                                "timeout to %u seconds\n",
1349                                NIPQUAD(exp->tuple.src.ip),
1350                                ntohs(exp->tuple.src.u.tcp.port),
1351                                NIPQUAD(exp->tuple.dst.ip),
1352                                ntohs(exp->tuple.dst.u.tcp.port),
1353                                info->timeout);
1354                         set_expect_timeout(exp, info->timeout);
1355                 }
1356                 read_unlock_bh(&ip_conntrack_lock);
1357         }
1358
1359         return 0;
1360 }
1361
1362 /****************************************************************************/
1363 static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
1364                        enum ip_conntrack_info ctinfo,
1365                        unsigned char **data, UnregistrationRequest * urq)
1366 {
1367         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1368         int dir = CTINFO2DIR(ctinfo);
1369         int ret;
1370
1371         DEBUGP("ip_ct_ras: URQ\n");
1372
1373         if (set_sig_addr_hook) {
1374                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1375                                         urq->callSignalAddress.item,
1376                                         urq->callSignalAddress.count);
1377                 if (ret < 0)
1378                         return -1;
1379         }
1380
1381         /* Clear old expect */
1382         ip_ct_remove_expectations(ct);
1383         info->sig_port[dir] = 0;
1384         info->sig_port[!dir] = 0;
1385
1386         /* Give it 30 seconds for UCF or URJ */
1387         ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
1388
1389         return 0;
1390 }
1391
1392 /****************************************************************************/
1393 static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
1394                        enum ip_conntrack_info ctinfo,
1395                        unsigned char **data, AdmissionRequest * arq)
1396 {
1397         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1398         int dir = CTINFO2DIR(ctinfo);
1399         u_int32_t ip;
1400         u_int16_t port;
1401
1402         DEBUGP("ip_ct_ras: ARQ\n");
1403
1404         if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1405             get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
1406             ip == ct->tuplehash[dir].tuple.src.ip &&
1407             port == info->sig_port[dir] && set_h225_addr_hook) {
1408                 /* Answering ARQ */
1409                 return set_h225_addr_hook(pskb, data, 0,
1410                                           &arq->destCallSignalAddress,
1411                                           ct->tuplehash[!dir].tuple.dst.ip,
1412                                           info->sig_port[!dir]);
1413         }
1414
1415         if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1416             get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
1417             ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr_hook) {
1418                 /* Calling ARQ */
1419                 return set_h225_addr_hook(pskb, data, 0,
1420                                           &arq->srcCallSignalAddress,
1421                                           ct->tuplehash[!dir].tuple.dst.ip,
1422                                           port);
1423         }
1424
1425         return 0;
1426 }
1427
1428 /****************************************************************************/
1429 static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
1430                        enum ip_conntrack_info ctinfo,
1431                        unsigned char **data, AdmissionConfirm * acf)
1432 {
1433         int dir = CTINFO2DIR(ctinfo);
1434         int ret = 0;
1435         u_int32_t ip;
1436         u_int16_t port;
1437         struct ip_conntrack_expect *exp;
1438
1439         DEBUGP("ip_ct_ras: ACF\n");
1440
1441         if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
1442                 return 0;
1443
1444         if (ip == ct->tuplehash[dir].tuple.dst.ip) {    /* Answering ACF */
1445                 if (set_sig_addr_hook)
1446                         return set_sig_addr_hook(pskb, ct, ctinfo, data,
1447                                                  &acf->destCallSignalAddress,
1448                                                  1);
1449                 return 0;
1450         }
1451
1452         /* Need new expect */
1453         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1454                 return -1;
1455         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1456         exp->tuple.src.u.tcp.port = 0;
1457         exp->tuple.dst.ip = ip;
1458         exp->tuple.dst.u.tcp.port = htons(port);
1459         exp->tuple.dst.protonum = IPPROTO_TCP;
1460         exp->mask.src.ip = 0xFFFFFFFF;
1461         exp->mask.src.u.tcp.port = 0;
1462         exp->mask.dst.ip = 0xFFFFFFFF;
1463         exp->mask.dst.u.tcp.port = 0xFFFF;
1464         exp->mask.dst.protonum = 0xFF;
1465         exp->flags = IP_CT_EXPECT_PERMANENT;
1466         exp->expectfn = ip_conntrack_q931_expect;
1467
1468         if (ip_conntrack_expect_related(exp) == 0) {
1469                 DEBUGP("ip_ct_ras: expect Q.931 "
1470                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1471                        NIPQUAD(exp->tuple.src.ip),
1472                        ntohs(exp->tuple.src.u.tcp.port),
1473                        NIPQUAD(exp->tuple.dst.ip),
1474                        ntohs(exp->tuple.dst.u.tcp.port));
1475         } else
1476                 ret = -1;
1477
1478         ip_conntrack_expect_put(exp);
1479
1480         return ret;
1481 }
1482
1483 /****************************************************************************/
1484 static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1485                        enum ip_conntrack_info ctinfo,
1486                        unsigned char **data, LocationRequest * lrq)
1487 {
1488         DEBUGP("ip_ct_ras: LRQ\n");
1489
1490         if (set_ras_addr_hook)
1491                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1492                                          &lrq->replyAddress, 1);
1493         return 0;
1494 }
1495
1496 /****************************************************************************/
1497 static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1498                        enum ip_conntrack_info ctinfo,
1499                        unsigned char **data, LocationConfirm * lcf)
1500 {
1501         int dir = CTINFO2DIR(ctinfo);
1502         int ret = 0;
1503         u_int32_t ip;
1504         u_int16_t port;
1505         struct ip_conntrack_expect *exp = NULL;
1506
1507         DEBUGP("ip_ct_ras: LCF\n");
1508
1509         if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
1510                 return 0;
1511
1512         /* Need new expect for call signal */
1513         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1514                 return -1;
1515         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1516         exp->tuple.src.u.tcp.port = 0;
1517         exp->tuple.dst.ip = ip;
1518         exp->tuple.dst.u.tcp.port = htons(port);
1519         exp->tuple.dst.protonum = IPPROTO_TCP;
1520         exp->mask.src.ip = 0xFFFFFFFF;
1521         exp->mask.src.u.tcp.port = 0;
1522         exp->mask.dst.ip = 0xFFFFFFFF;
1523         exp->mask.dst.u.tcp.port = 0xFFFF;
1524         exp->mask.dst.protonum = 0xFF;
1525         exp->flags = IP_CT_EXPECT_PERMANENT;
1526         exp->expectfn = ip_conntrack_q931_expect;
1527
1528         if (ip_conntrack_expect_related(exp) == 0) {
1529                 DEBUGP("ip_ct_ras: expect Q.931 "
1530                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1531                        NIPQUAD(exp->tuple.src.ip),
1532                        ntohs(exp->tuple.src.u.tcp.port),
1533                        NIPQUAD(exp->tuple.dst.ip),
1534                        ntohs(exp->tuple.dst.u.tcp.port));
1535         } else
1536                 ret = -1;
1537
1538         ip_conntrack_expect_put(exp);
1539
1540         /* Ignore rasAddress */
1541
1542         return ret;
1543 }
1544
1545 /****************************************************************************/
1546 static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
1547                        enum ip_conntrack_info ctinfo,
1548                        unsigned char **data, InfoRequestResponse * irr)
1549 {
1550         int ret;
1551
1552         DEBUGP("ip_ct_ras: IRR\n");
1553
1554         if (set_ras_addr_hook) {
1555                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1556                                         &irr->rasAddress, 1);
1557                 if (ret < 0)
1558                         return -1;
1559         }
1560
1561         if (set_sig_addr_hook) {
1562                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1563                                         irr->callSignalAddress.item,
1564                                         irr->callSignalAddress.count);
1565                 if (ret < 0)
1566                         return -1;
1567         }
1568
1569         return 0;
1570 }
1571
1572 /****************************************************************************/
1573 static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
1574                        enum ip_conntrack_info ctinfo,
1575                        unsigned char **data, RasMessage * ras)
1576 {
1577         switch (ras->choice) {
1578         case eRasMessage_gatekeeperRequest:
1579                 return process_grq(pskb, ct, ctinfo, data,
1580                                    &ras->gatekeeperRequest);
1581         case eRasMessage_gatekeeperConfirm:
1582                 return process_gcf(pskb, ct, ctinfo, data,
1583                                    &ras->gatekeeperConfirm);
1584         case eRasMessage_registrationRequest:
1585                 return process_rrq(pskb, ct, ctinfo, data,
1586                                    &ras->registrationRequest);
1587         case eRasMessage_registrationConfirm:
1588                 return process_rcf(pskb, ct, ctinfo, data,
1589                                    &ras->registrationConfirm);
1590         case eRasMessage_unregistrationRequest:
1591                 return process_urq(pskb, ct, ctinfo, data,
1592                                    &ras->unregistrationRequest);
1593         case eRasMessage_admissionRequest:
1594                 return process_arq(pskb, ct, ctinfo, data,
1595                                    &ras->admissionRequest);
1596         case eRasMessage_admissionConfirm:
1597                 return process_acf(pskb, ct, ctinfo, data,
1598                                    &ras->admissionConfirm);
1599         case eRasMessage_locationRequest:
1600                 return process_lrq(pskb, ct, ctinfo, data,
1601                                    &ras->locationRequest);
1602         case eRasMessage_locationConfirm:
1603                 return process_lcf(pskb, ct, ctinfo, data,
1604                                    &ras->locationConfirm);
1605         case eRasMessage_infoRequestResponse:
1606                 return process_irr(pskb, ct, ctinfo, data,
1607                                    &ras->infoRequestResponse);
1608         default:
1609                 DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
1610                 break;
1611         }
1612
1613         return 0;
1614 }
1615
1616 /****************************************************************************/
1617 static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1618                     enum ip_conntrack_info ctinfo)
1619 {
1620         static RasMessage ras;
1621         unsigned char *data;
1622         int datalen = 0;
1623         int ret;
1624
1625         DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
1626
1627         spin_lock_bh(&ip_h323_lock);
1628
1629         /* Get UDP data */
1630         data = get_udp_data(pskb, &datalen);
1631         if (data == NULL)
1632                 goto accept;
1633         DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1634                NIPQUAD((*pskb)->nh.iph->saddr),
1635                NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1636
1637         /* Decode RAS message */
1638         ret = DecodeRasMessage(data, datalen, &ras);
1639         if (ret < 0) {
1640                 if (net_ratelimit())
1641                         printk("ip_ct_ras: decoding error: %s\n",
1642                                ret == H323_ERROR_BOUND ?
1643                                "out of bound" : "out of range");
1644                 goto accept;
1645         }
1646
1647         /* Process RAS message */
1648         if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
1649                 goto drop;
1650
1651       accept:
1652         spin_unlock_bh(&ip_h323_lock);
1653         return NF_ACCEPT;
1654
1655       drop:
1656         spin_unlock_bh(&ip_h323_lock);
1657         if (net_ratelimit())
1658                 printk("ip_ct_ras: packet dropped\n");
1659         return NF_DROP;
1660 }
1661
1662 /****************************************************************************/
1663 static struct ip_conntrack_helper ip_conntrack_helper_ras = {
1664         .name = "RAS",
1665         .me = THIS_MODULE,
1666         .max_expected = 32,
1667         .timeout = 240,
1668         .tuple = {.src = {.u = {__constant_htons(RAS_PORT)}},
1669                   .dst = {.protonum = IPPROTO_UDP}},
1670         .mask = {.src = {.u = {0xFFFE}},
1671                  .dst = {.protonum = 0xFF}},
1672         .help = ras_help,
1673 };
1674
1675 /****************************************************************************/
1676 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1677                                     struct ip_conntrack_expect *this)
1678 {
1679         write_lock_bh(&ip_conntrack_lock);
1680         new->helper = &ip_conntrack_helper_ras;
1681         write_unlock_bh(&ip_conntrack_lock);
1682 }
1683
1684 /****************************************************************************/
1685 /* Not __exit - called from init() */
1686 static void fini(void)
1687 {
1688         ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
1689         ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
1690         kfree(h323_buffer);
1691         DEBUGP("ip_ct_h323: fini\n");
1692 }
1693
1694 /****************************************************************************/
1695 static int __init init(void)
1696 {
1697         int ret;
1698
1699         h323_buffer = kmalloc(65536, GFP_KERNEL);
1700         if (!h323_buffer)
1701                 return -ENOMEM;
1702         if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
1703             (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
1704                 fini();
1705                 return ret;
1706         }
1707
1708         DEBUGP("ip_ct_h323: init success\n");
1709         return 0;
1710 }
1711
1712 /****************************************************************************/
1713 module_init(init);
1714 module_exit(fini);
1715
1716 EXPORT_SYMBOL(get_h245_addr);
1717 EXPORT_SYMBOL(get_h225_addr);
1718 EXPORT_SYMBOL(ip_conntrack_h245_expect);
1719 EXPORT_SYMBOL(ip_conntrack_q931_expect);
1720 EXPORT_SYMBOL(set_h245_addr_hook);
1721 EXPORT_SYMBOL(set_h225_addr_hook);
1722 EXPORT_SYMBOL(set_sig_addr_hook);
1723 EXPORT_SYMBOL(set_ras_addr_hook);
1724 EXPORT_SYMBOL(nat_rtp_rtcp_hook);
1725 EXPORT_SYMBOL(nat_t120_hook);
1726 EXPORT_SYMBOL(nat_h245_hook);
1727 EXPORT_SYMBOL(nat_q931_hook);
1728
1729 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1730 MODULE_DESCRIPTION("H.323 connection tracking helper");
1731 MODULE_LICENSE("GPL");