2 * H.323 connection tracking helper
4 * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
6 * This source code is licensed under General Public License version 2.
8 * Based on the 'brute force' H.323 connection tracking module by
9 * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
11 * For more information, please see http://nath323.sourceforge.net/
14 * 2006-02-01 - initial version 0.1
16 * 2006-02-20 - version 0.2
17 * 1. Changed source format to follow kernel conventions
18 * 2. Deleted some unnecessary structures
21 * 2006-03-10 - version 0.3
22 * 1. Added support for multiple TPKTs in one packet (suggested by
24 * 2. Avoid excessive stack usage (based on Patrick McHardy's patch)
25 * 3. Added support for non-linear skb (based on Patrick McHardy's patch)
26 * 4. Fixed missing H.245 module owner (Patrick McHardy)
27 * 5. Avoid long RAS expectation chains (Patrick McHardy)
28 * 6. Fixed incorrect __exit attribute (Patrick McHardy)
29 * 7. Eliminated unnecessary return code
30 * 8. Fixed incorrect use of NAT data from conntrack code (suggested by
32 * 9. Fixed TTL calculation error in RCF
33 * 10. Added TTL support in RRQ
34 * 11. Better support for separate TPKT header and data
36 * 2006-03-15 - version 0.4
37 * 1. Added support for T.120 channels
38 * 2. Added parameter gkrouted_only (suggested by Patrick McHardy)
39 * 3. Splitted ASN.1 code and data (suggested by Patrick McHardy)
40 * 4. Sort ASN.1 data to avoid forwarding declarations (suggested by
42 * 5. Reset next TPKT data length in get_tpkt_data()
45 #include <linux/config.h>
46 #include <linux/module.h>
47 #include <linux/netfilter.h>
50 #include <linux/netfilter_ipv4/ip_conntrack.h>
51 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
52 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
53 #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
54 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
55 #include <linux/moduleparam.h>
57 #include "ip_conntrack_helper_h323_asn1.h"
62 #define DEBUGP(format, args...)
66 static int gkrouted_only
= 1;
67 module_param(gkrouted_only
, int, 0600);
68 MODULE_PARM_DESC(gkrouted_only
, "only accept calls from gatekeeper");
71 int (*set_h245_addr_hook
) (struct sk_buff
** pskb
,
72 unsigned char **data
, int dataoff
,
73 H245_TransportAddress
* addr
,
74 u_int32_t ip
, u_int16_t port
);
75 int (*set_h225_addr_hook
) (struct sk_buff
** pskb
,
76 unsigned char **data
, int dataoff
,
77 TransportAddress
* addr
,
78 u_int32_t ip
, u_int16_t port
);
79 int (*set_sig_addr_hook
) (struct sk_buff
** pskb
,
80 struct ip_conntrack
* ct
,
81 enum ip_conntrack_info ctinfo
,
83 TransportAddress
* addr
, int count
);
84 int (*set_ras_addr_hook
) (struct sk_buff
** pskb
,
85 struct ip_conntrack
* ct
,
86 enum ip_conntrack_info ctinfo
,
88 TransportAddress
* addr
, int count
);
89 int (*nat_rtp_rtcp_hook
) (struct sk_buff
** pskb
,
90 struct ip_conntrack
* ct
,
91 enum ip_conntrack_info ctinfo
,
92 unsigned char **data
, int dataoff
,
93 H245_TransportAddress
* addr
,
94 u_int16_t port
, u_int16_t rtp_port
,
95 struct ip_conntrack_expect
* rtp_exp
,
96 struct ip_conntrack_expect
* rtcp_exp
);
97 int (*nat_t120_hook
) (struct sk_buff
** pskb
,
98 struct ip_conntrack
* ct
,
99 enum ip_conntrack_info ctinfo
,
100 unsigned char **data
, int dataoff
,
101 H245_TransportAddress
* addr
, u_int16_t port
,
102 struct ip_conntrack_expect
* exp
);
103 int (*nat_h245_hook
) (struct sk_buff
** pskb
,
104 struct ip_conntrack
* ct
,
105 enum ip_conntrack_info ctinfo
,
106 unsigned char **data
, int dataoff
,
107 TransportAddress
* addr
, u_int16_t port
,
108 struct ip_conntrack_expect
* exp
);
109 int (*nat_q931_hook
) (struct sk_buff
** pskb
,
110 struct ip_conntrack
* ct
,
111 enum ip_conntrack_info ctinfo
,
112 unsigned char **data
, TransportAddress
* addr
, int idx
,
113 u_int16_t port
, struct ip_conntrack_expect
* exp
);
116 static DEFINE_SPINLOCK(ip_h323_lock
);
117 static char *h323_buffer
;
119 /****************************************************************************/
120 static int get_tpkt_data(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
121 enum ip_conntrack_info ctinfo
,
122 unsigned char **data
, int *datalen
, int *dataoff
)
124 struct ip_ct_h323_master
*info
= &ct
->help
.ct_h323_info
;
125 int dir
= CTINFO2DIR(ctinfo
);
126 struct tcphdr _tcph
, *th
;
134 th
= skb_header_pointer(*pskb
, (*pskb
)->nh
.iph
->ihl
* 4,
135 sizeof(_tcph
), &_tcph
);
139 /* Get TCP data offset */
140 tcpdataoff
= (*pskb
)->nh
.iph
->ihl
* 4 + th
->doff
* 4;
142 /* Get TCP data length */
143 tcpdatalen
= (*pskb
)->len
- tcpdataoff
;
144 if (tcpdatalen
<= 0) /* No TCP data */
147 if (*data
== NULL
) { /* first TPKT */
148 /* Get first TPKT pointer */
149 tpkt
= skb_header_pointer(*pskb
, tcpdataoff
, tcpdatalen
,
151 BUG_ON(tpkt
== NULL
);
153 /* Validate TPKT identifier */
154 if (tcpdatalen
< 4 || tpkt
[0] != 0x03 || tpkt
[1] != 0) {
155 /* Netmeeting sends TPKT header and data separately */
156 if (info
->tpkt_len
[dir
] > 0) {
157 DEBUGP("ip_ct_h323: previous packet "
158 "indicated separate TPKT data of %hu "
159 "bytes\n", info
->tpkt_len
[dir
]);
160 if (info
->tpkt_len
[dir
] <= tcpdatalen
) {
161 /* Yes, there was a TPKT header
164 *datalen
= info
->tpkt_len
[dir
];
169 /* Fragmented TPKT */
171 printk("ip_ct_h323: "
172 "fragmented TPKT\n");
176 /* It is not even a TPKT */
180 } else { /* Next TPKT */
181 tpktoff
= *dataoff
+ *datalen
;
182 tcpdatalen
-= tpktoff
;
183 if (tcpdatalen
<= 4) /* No more TPKT */
185 tpkt
= *data
+ *datalen
;
187 /* Validate TPKT identifier */
188 if (tpkt
[0] != 0x03 || tpkt
[1] != 0)
192 /* Validate TPKT length */
193 tpktlen
= tpkt
[2] * 256 + tpkt
[3];
194 if (tpktlen
> tcpdatalen
) {
195 if (tcpdatalen
== 4) { /* Separate TPKT header */
196 /* Netmeeting sends TPKT header and data separately */
197 DEBUGP("ip_ct_h323: separate TPKT header indicates "
198 "there will be TPKT data of %hu bytes\n",
200 info
->tpkt_len
[dir
] = tpktlen
- 4;
205 printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
209 /* This is the encapsulated data */
211 *datalen
= tpktlen
- 4;
212 *dataoff
= tpktoff
+ 4;
215 /* Clear TPKT length */
216 info
->tpkt_len
[dir
] = 0;
220 info
->tpkt_len
[dir
] = 0;
224 /****************************************************************************/
225 int get_h245_addr(unsigned char *data
, H245_TransportAddress
* addr
,
226 u_int32_t
* ip
, u_int16_t
* port
)
230 if (addr
->choice
!= eH245_TransportAddress_unicastAddress
||
231 addr
->unicastAddress
.choice
!= eUnicastAddress_iPAddress
)
234 p
= data
+ addr
->unicastAddress
.iPAddress
.network
;
235 *ip
= htonl((p
[0] << 24) | (p
[1] << 16) | (p
[2] << 8) | (p
[3]));
236 *port
= (p
[4] << 8) | (p
[5]);
241 /****************************************************************************/
242 static int expect_rtp_rtcp(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
243 enum ip_conntrack_info ctinfo
,
244 unsigned char **data
, int dataoff
,
245 H245_TransportAddress
* addr
)
247 int dir
= CTINFO2DIR(ctinfo
);
252 struct ip_conntrack_expect
*rtp_exp
;
253 struct ip_conntrack_expect
*rtcp_exp
;
255 /* Read RTP or RTCP address */
256 if (!get_h245_addr(*data
, addr
, &ip
, &port
) ||
257 ip
!= ct
->tuplehash
[dir
].tuple
.src
.ip
|| port
== 0)
260 /* RTP port is even */
261 rtp_port
= port
& (~1);
263 /* Create expect for RTP */
264 if ((rtp_exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
266 rtp_exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
267 rtp_exp
->tuple
.src
.u
.udp
.port
= 0;
268 rtp_exp
->tuple
.dst
.ip
= ct
->tuplehash
[!dir
].tuple
.dst
.ip
;
269 rtp_exp
->tuple
.dst
.u
.udp
.port
= htons(rtp_port
);
270 rtp_exp
->tuple
.dst
.protonum
= IPPROTO_UDP
;
271 rtp_exp
->mask
.src
.ip
= 0xFFFFFFFF;
272 rtp_exp
->mask
.src
.u
.udp
.port
= 0;
273 rtp_exp
->mask
.dst
.ip
= 0xFFFFFFFF;
274 rtp_exp
->mask
.dst
.u
.udp
.port
= 0xFFFF;
275 rtp_exp
->mask
.dst
.protonum
= 0xFF;
278 /* Create expect for RTCP */
279 if ((rtcp_exp
= ip_conntrack_expect_alloc(ct
)) == NULL
) {
280 ip_conntrack_expect_put(rtp_exp
);
283 rtcp_exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
284 rtcp_exp
->tuple
.src
.u
.udp
.port
= 0;
285 rtcp_exp
->tuple
.dst
.ip
= ct
->tuplehash
[!dir
].tuple
.dst
.ip
;
286 rtcp_exp
->tuple
.dst
.u
.udp
.port
= htons(rtp_port
+ 1);
287 rtcp_exp
->tuple
.dst
.protonum
= IPPROTO_UDP
;
288 rtcp_exp
->mask
.src
.ip
= 0xFFFFFFFF;
289 rtcp_exp
->mask
.src
.u
.udp
.port
= 0;
290 rtcp_exp
->mask
.dst
.ip
= 0xFFFFFFFF;
291 rtcp_exp
->mask
.dst
.u
.udp
.port
= 0xFFFF;
292 rtcp_exp
->mask
.dst
.protonum
= 0xFF;
295 if (ct
->tuplehash
[dir
].tuple
.src
.ip
!=
296 ct
->tuplehash
[!dir
].tuple
.dst
.ip
&& nat_rtp_rtcp_hook
) {
298 ret
= nat_rtp_rtcp_hook(pskb
, ct
, ctinfo
, data
, dataoff
,
299 addr
, port
, rtp_port
, rtp_exp
,
301 } else { /* Conntrack only */
302 rtp_exp
->expectfn
= NULL
;
303 rtcp_exp
->expectfn
= NULL
;
305 if (ip_conntrack_expect_related(rtp_exp
) == 0) {
306 if (ip_conntrack_expect_related(rtcp_exp
) == 0) {
307 DEBUGP("ip_ct_h323: expect RTP "
308 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
309 NIPQUAD(rtp_exp
->tuple
.src
.ip
),
310 ntohs(rtp_exp
->tuple
.src
.u
.udp
.port
),
311 NIPQUAD(rtp_exp
->tuple
.dst
.ip
),
312 ntohs(rtp_exp
->tuple
.dst
.u
.udp
.port
));
313 DEBUGP("ip_ct_h323: expect RTCP "
314 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
315 NIPQUAD(rtcp_exp
->tuple
.src
.ip
),
316 ntohs(rtcp_exp
->tuple
.src
.u
.udp
.port
),
317 NIPQUAD(rtcp_exp
->tuple
.dst
.ip
),
318 ntohs(rtcp_exp
->tuple
.dst
.u
.udp
.port
));
320 ip_conntrack_unexpect_related(rtp_exp
);
327 ip_conntrack_expect_put(rtp_exp
);
328 ip_conntrack_expect_put(rtcp_exp
);
333 /****************************************************************************/
334 static int expect_t120(struct sk_buff
**pskb
,
335 struct ip_conntrack
*ct
,
336 enum ip_conntrack_info ctinfo
,
337 unsigned char **data
, int dataoff
,
338 H245_TransportAddress
* addr
)
340 int dir
= CTINFO2DIR(ctinfo
);
344 struct ip_conntrack_expect
*exp
= NULL
;
346 /* Read T.120 address */
347 if (!get_h245_addr(*data
, addr
, &ip
, &port
) ||
348 ip
!= ct
->tuplehash
[dir
].tuple
.src
.ip
|| port
== 0)
351 /* Create expect for T.120 connections */
352 if ((exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
354 exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
355 exp
->tuple
.src
.u
.tcp
.port
= 0;
356 exp
->tuple
.dst
.ip
= ct
->tuplehash
[!dir
].tuple
.dst
.ip
;
357 exp
->tuple
.dst
.u
.tcp
.port
= htons(port
);
358 exp
->tuple
.dst
.protonum
= IPPROTO_TCP
;
359 exp
->mask
.src
.ip
= 0xFFFFFFFF;
360 exp
->mask
.src
.u
.tcp
.port
= 0;
361 exp
->mask
.dst
.ip
= 0xFFFFFFFF;
362 exp
->mask
.dst
.u
.tcp
.port
= 0xFFFF;
363 exp
->mask
.dst
.protonum
= 0xFF;
364 exp
->flags
= IP_CT_EXPECT_PERMANENT
; /* Accept multiple channels */
366 if (ct
->tuplehash
[dir
].tuple
.src
.ip
!=
367 ct
->tuplehash
[!dir
].tuple
.dst
.ip
&& nat_t120_hook
) {
369 ret
= nat_t120_hook(pskb
, ct
, ctinfo
, data
, dataoff
, addr
,
371 } else { /* Conntrack only */
372 exp
->expectfn
= NULL
;
373 if (ip_conntrack_expect_related(exp
) == 0) {
374 DEBUGP("ip_ct_h323: expect T.120 "
375 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
376 NIPQUAD(exp
->tuple
.src
.ip
),
377 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
378 NIPQUAD(exp
->tuple
.dst
.ip
),
379 ntohs(exp
->tuple
.dst
.u
.tcp
.port
));
384 ip_conntrack_expect_put(exp
);
389 /****************************************************************************/
390 static int process_h245_channel(struct sk_buff
**pskb
,
391 struct ip_conntrack
*ct
,
392 enum ip_conntrack_info ctinfo
,
393 unsigned char **data
, int dataoff
,
394 H2250LogicalChannelParameters
* channel
)
398 if (channel
->options
& eH2250LogicalChannelParameters_mediaChannel
) {
400 ret
= expect_rtp_rtcp(pskb
, ct
, ctinfo
, data
, dataoff
,
401 &channel
->mediaChannel
);
407 options
& eH2250LogicalChannelParameters_mediaControlChannel
) {
409 ret
= expect_rtp_rtcp(pskb
, ct
, ctinfo
, data
, dataoff
,
410 &channel
->mediaControlChannel
);
418 /****************************************************************************/
419 static int process_olc(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
420 enum ip_conntrack_info ctinfo
,
421 unsigned char **data
, int dataoff
,
422 OpenLogicalChannel
* olc
)
426 DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
428 if (olc
->forwardLogicalChannelParameters
.multiplexParameters
.choice
==
429 eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters
)
431 ret
= process_h245_channel(pskb
, ct
, ctinfo
, data
, dataoff
,
433 forwardLogicalChannelParameters
.
435 h2250LogicalChannelParameters
);
441 eOpenLogicalChannel_reverseLogicalChannelParameters
) &&
442 (olc
->reverseLogicalChannelParameters
.options
&
443 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters
)
444 && (olc
->reverseLogicalChannelParameters
.multiplexParameters
.
446 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters
))
449 process_h245_channel(pskb
, ct
, ctinfo
, data
, dataoff
,
451 reverseLogicalChannelParameters
.
453 h2250LogicalChannelParameters
);
458 if ((olc
->options
& eOpenLogicalChannel_separateStack
) &&
459 olc
->forwardLogicalChannelParameters
.dataType
.choice
==
461 olc
->forwardLogicalChannelParameters
.dataType
.data
.application
.
462 choice
== eDataApplicationCapability_application_t120
&&
463 olc
->forwardLogicalChannelParameters
.dataType
.data
.application
.
464 t120
.choice
== eDataProtocolCapability_separateLANStack
&&
465 olc
->separateStack
.networkAddress
.choice
==
466 eNetworkAccessParameters_networkAddress_localAreaAddress
) {
467 ret
= expect_t120(pskb
, ct
, ctinfo
, data
, dataoff
,
468 &olc
->separateStack
.networkAddress
.
477 /****************************************************************************/
478 static int process_olca(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
479 enum ip_conntrack_info ctinfo
,
480 unsigned char **data
, int dataoff
,
481 OpenLogicalChannelAck
* olca
)
483 H2250LogicalChannelAckParameters
*ack
;
486 DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
489 eOpenLogicalChannelAck_reverseLogicalChannelParameters
) &&
490 (olca
->reverseLogicalChannelParameters
.options
&
491 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters
)
492 && (olca
->reverseLogicalChannelParameters
.multiplexParameters
.
494 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters
))
496 ret
= process_h245_channel(pskb
, ct
, ctinfo
, data
, dataoff
,
498 reverseLogicalChannelParameters
.
500 h2250LogicalChannelParameters
);
506 eOpenLogicalChannelAck_forwardMultiplexAckParameters
) &&
507 (olca
->forwardMultiplexAckParameters
.choice
==
508 eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters
))
510 ack
= &olca
->forwardMultiplexAckParameters
.
511 h2250LogicalChannelAckParameters
;
513 eH2250LogicalChannelAckParameters_mediaChannel
) {
515 ret
= expect_rtp_rtcp(pskb
, ct
, ctinfo
, data
, dataoff
,
522 eH2250LogicalChannelAckParameters_mediaControlChannel
) {
524 ret
= expect_rtp_rtcp(pskb
, ct
, ctinfo
, data
, dataoff
,
525 &ack
->mediaControlChannel
);
534 /****************************************************************************/
535 static int process_h245(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
536 enum ip_conntrack_info ctinfo
,
537 unsigned char **data
, int dataoff
,
538 MultimediaSystemControlMessage
* mscm
)
540 switch (mscm
->choice
) {
541 case eMultimediaSystemControlMessage_request
:
542 if (mscm
->request
.choice
==
543 eRequestMessage_openLogicalChannel
) {
544 return process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
545 &mscm
->request
.openLogicalChannel
);
547 DEBUGP("ip_ct_h323: H.245 Request %d\n",
548 mscm
->request
.choice
);
550 case eMultimediaSystemControlMessage_response
:
551 if (mscm
->response
.choice
==
552 eResponseMessage_openLogicalChannelAck
) {
553 return process_olca(pskb
, ct
, ctinfo
, data
, dataoff
,
555 openLogicalChannelAck
);
557 DEBUGP("ip_ct_h323: H.245 Response %d\n",
558 mscm
->response
.choice
);
561 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm
->choice
);
568 /****************************************************************************/
569 static int h245_help(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
570 enum ip_conntrack_info ctinfo
)
572 static MultimediaSystemControlMessage mscm
;
573 unsigned char *data
= NULL
;
578 /* Until there's been traffic both ways, don't look in packets. */
579 if (ctinfo
!= IP_CT_ESTABLISHED
580 && ctinfo
!= IP_CT_ESTABLISHED
+ IP_CT_IS_REPLY
) {
583 DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb
)->len
);
585 spin_lock_bh(&ip_h323_lock
);
587 /* Process each TPKT */
588 while (get_tpkt_data(pskb
, ct
, ctinfo
, &data
, &datalen
, &dataoff
)) {
589 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
590 NIPQUAD((*pskb
)->nh
.iph
->saddr
),
591 NIPQUAD((*pskb
)->nh
.iph
->daddr
), datalen
);
593 /* Decode H.245 signal */
594 ret
= DecodeMultimediaSystemControlMessage(data
, datalen
,
598 printk("ip_ct_h245: decoding error: %s\n",
599 ret
== H323_ERROR_BOUND
?
600 "out of bound" : "out of range");
601 /* We don't drop when decoding error */
605 /* Process H.245 signal */
606 if (process_h245(pskb
, ct
, ctinfo
, &data
, dataoff
, &mscm
) < 0)
610 spin_unlock_bh(&ip_h323_lock
);
614 spin_unlock_bh(&ip_h323_lock
);
616 printk("ip_ct_h245: packet dropped\n");
620 /****************************************************************************/
621 static struct ip_conntrack_helper ip_conntrack_helper_h245
= {
624 .max_expected
= H323_RTP_CHANNEL_MAX
* 4 + 2 /* T.120 */ ,
626 .tuple
= {.dst
= {.protonum
= IPPROTO_TCP
}},
627 .mask
= {.src
= {.u
= {0xFFFF}},
628 .dst
= {.protonum
= 0xFF}},
632 /****************************************************************************/
633 void ip_conntrack_h245_expect(struct ip_conntrack
*new,
634 struct ip_conntrack_expect
*this)
636 write_lock_bh(&ip_conntrack_lock
);
637 new->helper
= &ip_conntrack_helper_h245
;
638 write_unlock_bh(&ip_conntrack_lock
);
641 /****************************************************************************/
642 int get_h225_addr(unsigned char *data
, TransportAddress
* addr
,
643 u_int32_t
* ip
, u_int16_t
* port
)
647 if (addr
->choice
!= eTransportAddress_ipAddress
)
650 p
= data
+ addr
->ipAddress
.ip
;
651 *ip
= htonl((p
[0] << 24) | (p
[1] << 16) | (p
[2] << 8) | (p
[3]));
652 *port
= (p
[4] << 8) | (p
[5]);
657 /****************************************************************************/
658 static int expect_h245(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
659 enum ip_conntrack_info ctinfo
,
660 unsigned char **data
, int dataoff
,
661 TransportAddress
* addr
)
663 int dir
= CTINFO2DIR(ctinfo
);
667 struct ip_conntrack_expect
*exp
= NULL
;
669 /* Read h245Address */
670 if (!get_h225_addr(*data
, addr
, &ip
, &port
) ||
671 ip
!= ct
->tuplehash
[dir
].tuple
.src
.ip
|| port
== 0)
674 /* Create expect for h245 connection */
675 if ((exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
677 exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
678 exp
->tuple
.src
.u
.tcp
.port
= 0;
679 exp
->tuple
.dst
.ip
= ct
->tuplehash
[!dir
].tuple
.dst
.ip
;
680 exp
->tuple
.dst
.u
.tcp
.port
= htons(port
);
681 exp
->tuple
.dst
.protonum
= IPPROTO_TCP
;
682 exp
->mask
.src
.ip
= 0xFFFFFFFF;
683 exp
->mask
.src
.u
.tcp
.port
= 0;
684 exp
->mask
.dst
.ip
= 0xFFFFFFFF;
685 exp
->mask
.dst
.u
.tcp
.port
= 0xFFFF;
686 exp
->mask
.dst
.protonum
= 0xFF;
689 if (ct
->tuplehash
[dir
].tuple
.src
.ip
!=
690 ct
->tuplehash
[!dir
].tuple
.dst
.ip
&& nat_h245_hook
) {
692 ret
= nat_h245_hook(pskb
, ct
, ctinfo
, data
, dataoff
, addr
,
694 } else { /* Conntrack only */
695 exp
->expectfn
= ip_conntrack_h245_expect
;
697 if (ip_conntrack_expect_related(exp
) == 0) {
698 DEBUGP("ip_ct_q931: expect H.245 "
699 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
700 NIPQUAD(exp
->tuple
.src
.ip
),
701 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
702 NIPQUAD(exp
->tuple
.dst
.ip
),
703 ntohs(exp
->tuple
.dst
.u
.tcp
.port
));
708 ip_conntrack_expect_put(exp
);
713 /****************************************************************************/
714 static int process_setup(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
715 enum ip_conntrack_info ctinfo
,
716 unsigned char **data
, int dataoff
,
719 int dir
= CTINFO2DIR(ctinfo
);
725 DEBUGP("ip_ct_q931: Setup\n");
727 if (setup
->options
& eSetup_UUIE_h245Address
) {
728 ret
= expect_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
729 &setup
->h245Address
);
734 if ((setup
->options
& eSetup_UUIE_destCallSignalAddress
) &&
735 (set_h225_addr_hook
) &&
736 get_h225_addr(*data
, &setup
->destCallSignalAddress
, &ip
, &port
) &&
737 ip
!= ct
->tuplehash
[!dir
].tuple
.src
.ip
) {
738 DEBUGP("ip_ct_q931: set destCallSignalAddress "
739 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
741 NIPQUAD(ct
->tuplehash
[!dir
].tuple
.src
.ip
),
742 ntohs(ct
->tuplehash
[!dir
].tuple
.src
.u
.tcp
.port
));
743 ret
= set_h225_addr_hook(pskb
, data
, dataoff
,
744 &setup
->destCallSignalAddress
,
745 ct
->tuplehash
[!dir
].tuple
.src
.ip
,
746 ntohs(ct
->tuplehash
[!dir
].tuple
.src
.
752 if ((setup
->options
& eSetup_UUIE_sourceCallSignalAddress
) &&
753 (set_h225_addr_hook
) &&
754 get_h225_addr(*data
, &setup
->sourceCallSignalAddress
, &ip
, &port
)
755 && ip
!= ct
->tuplehash
[!dir
].tuple
.dst
.ip
) {
756 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
757 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
759 NIPQUAD(ct
->tuplehash
[!dir
].tuple
.dst
.ip
),
760 ntohs(ct
->tuplehash
[!dir
].tuple
.dst
.u
.tcp
.port
));
761 ret
= set_h225_addr_hook(pskb
, data
, dataoff
,
762 &setup
->sourceCallSignalAddress
,
763 ct
->tuplehash
[!dir
].tuple
.dst
.ip
,
764 ntohs(ct
->tuplehash
[!dir
].tuple
.dst
.
770 if (setup
->options
& eSetup_UUIE_fastStart
) {
771 for (i
= 0; i
< setup
->fastStart
.count
; i
++) {
772 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
773 &setup
->fastStart
.item
[i
]);
782 /****************************************************************************/
783 static int process_callproceeding(struct sk_buff
**pskb
,
784 struct ip_conntrack
*ct
,
785 enum ip_conntrack_info ctinfo
,
786 unsigned char **data
, int dataoff
,
787 CallProceeding_UUIE
* callproc
)
792 DEBUGP("ip_ct_q931: CallProceeding\n");
794 if (callproc
->options
& eCallProceeding_UUIE_h245Address
) {
795 ret
= expect_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
796 &callproc
->h245Address
);
801 if (callproc
->options
& eCallProceeding_UUIE_fastStart
) {
802 for (i
= 0; i
< callproc
->fastStart
.count
; i
++) {
803 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
804 &callproc
->fastStart
.item
[i
]);
813 /****************************************************************************/
814 static int process_connect(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
815 enum ip_conntrack_info ctinfo
,
816 unsigned char **data
, int dataoff
,
817 Connect_UUIE
* connect
)
822 DEBUGP("ip_ct_q931: Connect\n");
824 if (connect
->options
& eConnect_UUIE_h245Address
) {
825 ret
= expect_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
826 &connect
->h245Address
);
831 if (connect
->options
& eConnect_UUIE_fastStart
) {
832 for (i
= 0; i
< connect
->fastStart
.count
; i
++) {
833 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
834 &connect
->fastStart
.item
[i
]);
843 /****************************************************************************/
844 static int process_alerting(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
845 enum ip_conntrack_info ctinfo
,
846 unsigned char **data
, int dataoff
,
847 Alerting_UUIE
* alert
)
852 DEBUGP("ip_ct_q931: Alerting\n");
854 if (alert
->options
& eAlerting_UUIE_h245Address
) {
855 ret
= expect_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
856 &alert
->h245Address
);
861 if (alert
->options
& eAlerting_UUIE_fastStart
) {
862 for (i
= 0; i
< alert
->fastStart
.count
; i
++) {
863 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
864 &alert
->fastStart
.item
[i
]);
873 /****************************************************************************/
874 static int process_information(struct sk_buff
**pskb
,
875 struct ip_conntrack
*ct
,
876 enum ip_conntrack_info ctinfo
,
877 unsigned char **data
, int dataoff
,
878 Information_UUIE
* info
)
883 DEBUGP("ip_ct_q931: Information\n");
885 if (info
->options
& eInformation_UUIE_fastStart
) {
886 for (i
= 0; i
< info
->fastStart
.count
; i
++) {
887 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
888 &info
->fastStart
.item
[i
]);
897 /****************************************************************************/
898 static int process_facility(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
899 enum ip_conntrack_info ctinfo
,
900 unsigned char **data
, int dataoff
,
901 Facility_UUIE
* facility
)
906 DEBUGP("ip_ct_q931: Facility\n");
908 if (facility
->options
& eFacility_UUIE_h245Address
) {
909 ret
= expect_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
910 &facility
->h245Address
);
915 if (facility
->options
& eFacility_UUIE_fastStart
) {
916 for (i
= 0; i
< facility
->fastStart
.count
; i
++) {
917 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
918 &facility
->fastStart
.item
[i
]);
927 /****************************************************************************/
928 static int process_progress(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
929 enum ip_conntrack_info ctinfo
,
930 unsigned char **data
, int dataoff
,
931 Progress_UUIE
* progress
)
936 DEBUGP("ip_ct_q931: Progress\n");
938 if (progress
->options
& eProgress_UUIE_h245Address
) {
939 ret
= expect_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
940 &progress
->h245Address
);
945 if (progress
->options
& eProgress_UUIE_fastStart
) {
946 for (i
= 0; i
< progress
->fastStart
.count
; i
++) {
947 ret
= process_olc(pskb
, ct
, ctinfo
, data
, dataoff
,
948 &progress
->fastStart
.item
[i
]);
957 /****************************************************************************/
958 static int process_q931(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
959 enum ip_conntrack_info ctinfo
,
960 unsigned char **data
, int dataoff
, Q931
* q931
)
962 H323_UU_PDU
*pdu
= &q931
->UUIE
.h323_uu_pdu
;
966 switch (pdu
->h323_message_body
.choice
) {
967 case eH323_UU_PDU_h323_message_body_setup
:
968 ret
= process_setup(pskb
, ct
, ctinfo
, data
, dataoff
,
969 &pdu
->h323_message_body
.setup
);
971 case eH323_UU_PDU_h323_message_body_callProceeding
:
972 ret
= process_callproceeding(pskb
, ct
, ctinfo
, data
, dataoff
,
973 &pdu
->h323_message_body
.
976 case eH323_UU_PDU_h323_message_body_connect
:
977 ret
= process_connect(pskb
, ct
, ctinfo
, data
, dataoff
,
978 &pdu
->h323_message_body
.connect
);
980 case eH323_UU_PDU_h323_message_body_alerting
:
981 ret
= process_alerting(pskb
, ct
, ctinfo
, data
, dataoff
,
982 &pdu
->h323_message_body
.alerting
);
984 case eH323_UU_PDU_h323_message_body_information
:
985 ret
= process_information(pskb
, ct
, ctinfo
, data
, dataoff
,
986 &pdu
->h323_message_body
.
989 case eH323_UU_PDU_h323_message_body_facility
:
990 ret
= process_facility(pskb
, ct
, ctinfo
, data
, dataoff
,
991 &pdu
->h323_message_body
.facility
);
993 case eH323_UU_PDU_h323_message_body_progress
:
994 ret
= process_progress(pskb
, ct
, ctinfo
, data
, dataoff
,
995 &pdu
->h323_message_body
.progress
);
998 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
999 pdu
->h323_message_body
.choice
);
1006 if (pdu
->options
& eH323_UU_PDU_h245Control
) {
1007 for (i
= 0; i
< pdu
->h245Control
.count
; i
++) {
1008 ret
= process_h245(pskb
, ct
, ctinfo
, data
, dataoff
,
1009 &pdu
->h245Control
.item
[i
]);
1018 /****************************************************************************/
1019 static int q931_help(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1020 enum ip_conntrack_info ctinfo
)
1023 unsigned char *data
= NULL
;
1028 /* Until there's been traffic both ways, don't look in packets. */
1029 if (ctinfo
!= IP_CT_ESTABLISHED
1030 && ctinfo
!= IP_CT_ESTABLISHED
+ IP_CT_IS_REPLY
) {
1033 DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb
)->len
);
1035 spin_lock_bh(&ip_h323_lock
);
1037 /* Process each TPKT */
1038 while (get_tpkt_data(pskb
, ct
, ctinfo
, &data
, &datalen
, &dataoff
)) {
1039 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1040 NIPQUAD((*pskb
)->nh
.iph
->saddr
),
1041 NIPQUAD((*pskb
)->nh
.iph
->daddr
), datalen
);
1043 /* Decode Q.931 signal */
1044 ret
= DecodeQ931(data
, datalen
, &q931
);
1046 if (net_ratelimit())
1047 printk("ip_ct_q931: decoding error: %s\n",
1048 ret
== H323_ERROR_BOUND
?
1049 "out of bound" : "out of range");
1050 /* We don't drop when decoding error */
1054 /* Process Q.931 signal */
1055 if (process_q931(pskb
, ct
, ctinfo
, &data
, dataoff
, &q931
) < 0)
1059 spin_unlock_bh(&ip_h323_lock
);
1063 spin_unlock_bh(&ip_h323_lock
);
1064 if (net_ratelimit())
1065 printk("ip_ct_q931: packet dropped\n");
1069 /****************************************************************************/
1070 static struct ip_conntrack_helper ip_conntrack_helper_q931
= {
1073 .max_expected
= H323_RTP_CHANNEL_MAX
* 4 + 4 /* T.120 and H.245 */ ,
1075 .tuple
= {.src
= {.u
= {__constant_htons(Q931_PORT
)}},
1076 .dst
= {.protonum
= IPPROTO_TCP
}},
1077 .mask
= {.src
= {.u
= {0xFFFF}},
1078 .dst
= {.protonum
= 0xFF}},
1082 /****************************************************************************/
1083 void ip_conntrack_q931_expect(struct ip_conntrack
*new,
1084 struct ip_conntrack_expect
*this)
1086 write_lock_bh(&ip_conntrack_lock
);
1087 new->helper
= &ip_conntrack_helper_q931
;
1088 write_unlock_bh(&ip_conntrack_lock
);
1091 /****************************************************************************/
1092 static unsigned char *get_udp_data(struct sk_buff
**pskb
, int *datalen
)
1094 struct udphdr _uh
, *uh
;
1097 uh
= skb_header_pointer(*pskb
, (*pskb
)->nh
.iph
->ihl
* 4, sizeof(_uh
),
1101 dataoff
= (*pskb
)->nh
.iph
->ihl
* 4 + sizeof(_uh
);
1102 if (dataoff
>= (*pskb
)->len
)
1104 *datalen
= (*pskb
)->len
- dataoff
;
1105 return skb_header_pointer(*pskb
, dataoff
, *datalen
, h323_buffer
);
1108 /****************************************************************************/
1109 static struct ip_conntrack_expect
*find_expect(struct ip_conntrack
*ct
,
1110 u_int32_t ip
, u_int16_t port
)
1112 struct ip_conntrack_expect
*exp
;
1113 struct ip_conntrack_tuple tuple
;
1116 tuple
.src
.u
.tcp
.port
= 0;
1118 tuple
.dst
.u
.tcp
.port
= htons(port
);
1119 tuple
.dst
.protonum
= IPPROTO_TCP
;
1121 exp
= __ip_conntrack_expect_find(&tuple
);
1122 if (exp
->master
== ct
)
1127 /****************************************************************************/
1128 static int set_expect_timeout(struct ip_conntrack_expect
*exp
,
1131 if (!exp
|| !del_timer(&exp
->timeout
))
1134 exp
->timeout
.expires
= jiffies
+ timeout
* HZ
;
1135 add_timer(&exp
->timeout
);
1140 /****************************************************************************/
1141 static int expect_q931(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1142 enum ip_conntrack_info ctinfo
,
1143 unsigned char **data
,
1144 TransportAddress
* addr
, int count
)
1146 struct ip_ct_h323_master
*info
= &ct
->help
.ct_h323_info
;
1147 int dir
= CTINFO2DIR(ctinfo
);
1152 struct ip_conntrack_expect
*exp
;
1154 /* Look for the first related address */
1155 for (i
= 0; i
< count
; i
++) {
1156 if (get_h225_addr(*data
, &addr
[i
], &ip
, &port
) &&
1157 ip
== ct
->tuplehash
[dir
].tuple
.src
.ip
&& port
!= 0)
1161 if (i
>= count
) /* Not found */
1164 /* Create expect for Q.931 */
1165 if ((exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
1167 exp
->tuple
.src
.ip
= gkrouted_only
? /* only accept calls from GK? */
1168 ct
->tuplehash
[!dir
].tuple
.src
.ip
: 0;
1169 exp
->tuple
.src
.u
.tcp
.port
= 0;
1170 exp
->tuple
.dst
.ip
= ct
->tuplehash
[!dir
].tuple
.dst
.ip
;
1171 exp
->tuple
.dst
.u
.tcp
.port
= htons(port
);
1172 exp
->tuple
.dst
.protonum
= IPPROTO_TCP
;
1173 exp
->mask
.src
.ip
= gkrouted_only
? 0xFFFFFFFF : 0;
1174 exp
->mask
.src
.u
.tcp
.port
= 0;
1175 exp
->mask
.dst
.ip
= 0xFFFFFFFF;
1176 exp
->mask
.dst
.u
.tcp
.port
= 0xFFFF;
1177 exp
->mask
.dst
.protonum
= 0xFF;
1178 exp
->flags
= IP_CT_EXPECT_PERMANENT
; /* Accept multiple calls */
1180 if (nat_q931_hook
) { /* Need NAT */
1181 ret
= nat_q931_hook(pskb
, ct
, ctinfo
, data
, addr
, i
,
1183 } else { /* Conntrack only */
1184 exp
->expectfn
= ip_conntrack_q931_expect
;
1186 if (ip_conntrack_expect_related(exp
) == 0) {
1187 DEBUGP("ip_ct_ras: expect Q.931 "
1188 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1189 NIPQUAD(exp
->tuple
.src
.ip
),
1190 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
1191 NIPQUAD(exp
->tuple
.dst
.ip
),
1192 ntohs(exp
->tuple
.dst
.u
.tcp
.port
));
1194 /* Save port for looking up expect in processing RCF */
1195 info
->sig_port
[dir
] = port
;
1200 ip_conntrack_expect_put(exp
);
1205 /****************************************************************************/
1206 static int process_grq(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1207 enum ip_conntrack_info ctinfo
,
1208 unsigned char **data
, GatekeeperRequest
* grq
)
1210 DEBUGP("ip_ct_ras: GRQ\n");
1212 if (set_ras_addr_hook
) /* NATed */
1213 return set_ras_addr_hook(pskb
, ct
, ctinfo
, data
,
1214 &grq
->rasAddress
, 1);
1218 /* Declare before using */
1219 static void ip_conntrack_ras_expect(struct ip_conntrack
*new,
1220 struct ip_conntrack_expect
*this);
1222 /****************************************************************************/
1223 static int process_gcf(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1224 enum ip_conntrack_info ctinfo
,
1225 unsigned char **data
, GatekeeperConfirm
* gcf
)
1227 int dir
= CTINFO2DIR(ctinfo
);
1231 struct ip_conntrack_expect
*exp
;
1233 DEBUGP("ip_ct_ras: GCF\n");
1235 if (!get_h225_addr(*data
, &gcf
->rasAddress
, &ip
, &port
))
1238 /* Registration port is the same as discovery port */
1239 if (ip
== ct
->tuplehash
[dir
].tuple
.src
.ip
&&
1240 port
== ntohs(ct
->tuplehash
[dir
].tuple
.src
.u
.udp
.port
))
1243 /* Avoid RAS expectation loops. A GCF is never expected. */
1244 if (test_bit(IPS_EXPECTED_BIT
, &ct
->status
))
1247 /* Need new expect */
1248 if ((exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
1250 exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
1251 exp
->tuple
.src
.u
.tcp
.port
= 0;
1252 exp
->tuple
.dst
.ip
= ip
;
1253 exp
->tuple
.dst
.u
.tcp
.port
= htons(port
);
1254 exp
->tuple
.dst
.protonum
= IPPROTO_UDP
;
1255 exp
->mask
.src
.ip
= 0xFFFFFFFF;
1256 exp
->mask
.src
.u
.tcp
.port
= 0;
1257 exp
->mask
.dst
.ip
= 0xFFFFFFFF;
1258 exp
->mask
.dst
.u
.tcp
.port
= 0xFFFF;
1259 exp
->mask
.dst
.protonum
= 0xFF;
1261 exp
->expectfn
= ip_conntrack_ras_expect
;
1262 if (ip_conntrack_expect_related(exp
) == 0) {
1263 DEBUGP("ip_ct_ras: expect RAS "
1264 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1265 NIPQUAD(exp
->tuple
.src
.ip
),
1266 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
1267 NIPQUAD(exp
->tuple
.dst
.ip
),
1268 ntohs(exp
->tuple
.dst
.u
.tcp
.port
));
1272 ip_conntrack_expect_put(exp
);
1277 /****************************************************************************/
1278 static int process_rrq(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1279 enum ip_conntrack_info ctinfo
,
1280 unsigned char **data
, RegistrationRequest
* rrq
)
1282 struct ip_ct_h323_master
*info
= &ct
->help
.ct_h323_info
;
1285 DEBUGP("ip_ct_ras: RRQ\n");
1287 ret
= expect_q931(pskb
, ct
, ctinfo
, data
,
1288 rrq
->callSignalAddress
.item
,
1289 rrq
->callSignalAddress
.count
);
1293 if (set_ras_addr_hook
) {
1294 ret
= set_ras_addr_hook(pskb
, ct
, ctinfo
, data
,
1295 rrq
->rasAddress
.item
,
1296 rrq
->rasAddress
.count
);
1301 if (rrq
->options
& eRegistrationRequest_timeToLive
) {
1302 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq
->timeToLive
);
1303 info
->timeout
= rrq
->timeToLive
;
1310 /****************************************************************************/
1311 static int process_rcf(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1312 enum ip_conntrack_info ctinfo
,
1313 unsigned char **data
, RegistrationConfirm
* rcf
)
1315 struct ip_ct_h323_master
*info
= &ct
->help
.ct_h323_info
;
1316 int dir
= CTINFO2DIR(ctinfo
);
1318 struct ip_conntrack_expect
*exp
;
1320 DEBUGP("ip_ct_ras: RCF\n");
1322 if (set_sig_addr_hook
) {
1323 ret
= set_sig_addr_hook(pskb
, ct
, ctinfo
, data
,
1324 rcf
->callSignalAddress
.item
,
1325 rcf
->callSignalAddress
.count
);
1330 if (rcf
->options
& eRegistrationConfirm_timeToLive
) {
1331 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf
->timeToLive
);
1332 info
->timeout
= rcf
->timeToLive
;
1335 if (info
->timeout
> 0) {
1337 ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1339 ip_ct_refresh_acct(ct
, ctinfo
, NULL
, info
->timeout
* HZ
);
1341 /* Set expect timeout */
1342 read_lock_bh(&ip_conntrack_lock
);
1343 exp
= find_expect(ct
, ct
->tuplehash
[dir
].tuple
.dst
.ip
,
1344 info
->sig_port
[!dir
]);
1346 DEBUGP("ip_ct_ras: set Q.931 expect "
1347 "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1348 "timeout to %u seconds\n",
1349 NIPQUAD(exp
->tuple
.src
.ip
),
1350 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
1351 NIPQUAD(exp
->tuple
.dst
.ip
),
1352 ntohs(exp
->tuple
.dst
.u
.tcp
.port
),
1354 set_expect_timeout(exp
, info
->timeout
);
1356 read_unlock_bh(&ip_conntrack_lock
);
1362 /****************************************************************************/
1363 static int process_urq(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1364 enum ip_conntrack_info ctinfo
,
1365 unsigned char **data
, UnregistrationRequest
* urq
)
1367 struct ip_ct_h323_master
*info
= &ct
->help
.ct_h323_info
;
1368 int dir
= CTINFO2DIR(ctinfo
);
1371 DEBUGP("ip_ct_ras: URQ\n");
1373 if (set_sig_addr_hook
) {
1374 ret
= set_sig_addr_hook(pskb
, ct
, ctinfo
, data
,
1375 urq
->callSignalAddress
.item
,
1376 urq
->callSignalAddress
.count
);
1381 /* Clear old expect */
1382 ip_ct_remove_expectations(ct
);
1383 info
->sig_port
[dir
] = 0;
1384 info
->sig_port
[!dir
] = 0;
1386 /* Give it 30 seconds for UCF or URJ */
1387 ip_ct_refresh_acct(ct
, ctinfo
, NULL
, 30 * HZ
);
1392 /****************************************************************************/
1393 static int process_arq(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1394 enum ip_conntrack_info ctinfo
,
1395 unsigned char **data
, AdmissionRequest
* arq
)
1397 struct ip_ct_h323_master
*info
= &ct
->help
.ct_h323_info
;
1398 int dir
= CTINFO2DIR(ctinfo
);
1402 DEBUGP("ip_ct_ras: ARQ\n");
1404 if ((arq
->options
& eAdmissionRequest_destCallSignalAddress
) &&
1405 get_h225_addr(*data
, &arq
->destCallSignalAddress
, &ip
, &port
) &&
1406 ip
== ct
->tuplehash
[dir
].tuple
.src
.ip
&&
1407 port
== info
->sig_port
[dir
] && set_h225_addr_hook
) {
1409 return set_h225_addr_hook(pskb
, data
, 0,
1410 &arq
->destCallSignalAddress
,
1411 ct
->tuplehash
[!dir
].tuple
.dst
.ip
,
1412 info
->sig_port
[!dir
]);
1415 if ((arq
->options
& eAdmissionRequest_srcCallSignalAddress
) &&
1416 get_h225_addr(*data
, &arq
->srcCallSignalAddress
, &ip
, &port
) &&
1417 ip
== ct
->tuplehash
[dir
].tuple
.src
.ip
&& set_h225_addr_hook
) {
1419 return set_h225_addr_hook(pskb
, data
, 0,
1420 &arq
->srcCallSignalAddress
,
1421 ct
->tuplehash
[!dir
].tuple
.dst
.ip
,
1428 /****************************************************************************/
1429 static int process_acf(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1430 enum ip_conntrack_info ctinfo
,
1431 unsigned char **data
, AdmissionConfirm
* acf
)
1433 int dir
= CTINFO2DIR(ctinfo
);
1437 struct ip_conntrack_expect
*exp
;
1439 DEBUGP("ip_ct_ras: ACF\n");
1441 if (!get_h225_addr(*data
, &acf
->destCallSignalAddress
, &ip
, &port
))
1444 if (ip
== ct
->tuplehash
[dir
].tuple
.dst
.ip
) { /* Answering ACF */
1445 if (set_sig_addr_hook
)
1446 return set_sig_addr_hook(pskb
, ct
, ctinfo
, data
,
1447 &acf
->destCallSignalAddress
,
1452 /* Need new expect */
1453 if ((exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
1455 exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
1456 exp
->tuple
.src
.u
.tcp
.port
= 0;
1457 exp
->tuple
.dst
.ip
= ip
;
1458 exp
->tuple
.dst
.u
.tcp
.port
= htons(port
);
1459 exp
->tuple
.dst
.protonum
= IPPROTO_TCP
;
1460 exp
->mask
.src
.ip
= 0xFFFFFFFF;
1461 exp
->mask
.src
.u
.tcp
.port
= 0;
1462 exp
->mask
.dst
.ip
= 0xFFFFFFFF;
1463 exp
->mask
.dst
.u
.tcp
.port
= 0xFFFF;
1464 exp
->mask
.dst
.protonum
= 0xFF;
1465 exp
->flags
= IP_CT_EXPECT_PERMANENT
;
1466 exp
->expectfn
= ip_conntrack_q931_expect
;
1468 if (ip_conntrack_expect_related(exp
) == 0) {
1469 DEBUGP("ip_ct_ras: expect Q.931 "
1470 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1471 NIPQUAD(exp
->tuple
.src
.ip
),
1472 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
1473 NIPQUAD(exp
->tuple
.dst
.ip
),
1474 ntohs(exp
->tuple
.dst
.u
.tcp
.port
));
1478 ip_conntrack_expect_put(exp
);
1483 /****************************************************************************/
1484 static int process_lrq(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1485 enum ip_conntrack_info ctinfo
,
1486 unsigned char **data
, LocationRequest
* lrq
)
1488 DEBUGP("ip_ct_ras: LRQ\n");
1490 if (set_ras_addr_hook
)
1491 return set_ras_addr_hook(pskb
, ct
, ctinfo
, data
,
1492 &lrq
->replyAddress
, 1);
1496 /****************************************************************************/
1497 static int process_lcf(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1498 enum ip_conntrack_info ctinfo
,
1499 unsigned char **data
, LocationConfirm
* lcf
)
1501 int dir
= CTINFO2DIR(ctinfo
);
1505 struct ip_conntrack_expect
*exp
= NULL
;
1507 DEBUGP("ip_ct_ras: LCF\n");
1509 if (!get_h225_addr(*data
, &lcf
->callSignalAddress
, &ip
, &port
))
1512 /* Need new expect for call signal */
1513 if ((exp
= ip_conntrack_expect_alloc(ct
)) == NULL
)
1515 exp
->tuple
.src
.ip
= ct
->tuplehash
[!dir
].tuple
.src
.ip
;
1516 exp
->tuple
.src
.u
.tcp
.port
= 0;
1517 exp
->tuple
.dst
.ip
= ip
;
1518 exp
->tuple
.dst
.u
.tcp
.port
= htons(port
);
1519 exp
->tuple
.dst
.protonum
= IPPROTO_TCP
;
1520 exp
->mask
.src
.ip
= 0xFFFFFFFF;
1521 exp
->mask
.src
.u
.tcp
.port
= 0;
1522 exp
->mask
.dst
.ip
= 0xFFFFFFFF;
1523 exp
->mask
.dst
.u
.tcp
.port
= 0xFFFF;
1524 exp
->mask
.dst
.protonum
= 0xFF;
1525 exp
->flags
= IP_CT_EXPECT_PERMANENT
;
1526 exp
->expectfn
= ip_conntrack_q931_expect
;
1528 if (ip_conntrack_expect_related(exp
) == 0) {
1529 DEBUGP("ip_ct_ras: expect Q.931 "
1530 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1531 NIPQUAD(exp
->tuple
.src
.ip
),
1532 ntohs(exp
->tuple
.src
.u
.tcp
.port
),
1533 NIPQUAD(exp
->tuple
.dst
.ip
),
1534 ntohs(exp
->tuple
.dst
.u
.tcp
.port
));
1538 ip_conntrack_expect_put(exp
);
1540 /* Ignore rasAddress */
1545 /****************************************************************************/
1546 static int process_irr(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1547 enum ip_conntrack_info ctinfo
,
1548 unsigned char **data
, InfoRequestResponse
* irr
)
1552 DEBUGP("ip_ct_ras: IRR\n");
1554 if (set_ras_addr_hook
) {
1555 ret
= set_ras_addr_hook(pskb
, ct
, ctinfo
, data
,
1556 &irr
->rasAddress
, 1);
1561 if (set_sig_addr_hook
) {
1562 ret
= set_sig_addr_hook(pskb
, ct
, ctinfo
, data
,
1563 irr
->callSignalAddress
.item
,
1564 irr
->callSignalAddress
.count
);
1572 /****************************************************************************/
1573 static int process_ras(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1574 enum ip_conntrack_info ctinfo
,
1575 unsigned char **data
, RasMessage
* ras
)
1577 switch (ras
->choice
) {
1578 case eRasMessage_gatekeeperRequest
:
1579 return process_grq(pskb
, ct
, ctinfo
, data
,
1580 &ras
->gatekeeperRequest
);
1581 case eRasMessage_gatekeeperConfirm
:
1582 return process_gcf(pskb
, ct
, ctinfo
, data
,
1583 &ras
->gatekeeperConfirm
);
1584 case eRasMessage_registrationRequest
:
1585 return process_rrq(pskb
, ct
, ctinfo
, data
,
1586 &ras
->registrationRequest
);
1587 case eRasMessage_registrationConfirm
:
1588 return process_rcf(pskb
, ct
, ctinfo
, data
,
1589 &ras
->registrationConfirm
);
1590 case eRasMessage_unregistrationRequest
:
1591 return process_urq(pskb
, ct
, ctinfo
, data
,
1592 &ras
->unregistrationRequest
);
1593 case eRasMessage_admissionRequest
:
1594 return process_arq(pskb
, ct
, ctinfo
, data
,
1595 &ras
->admissionRequest
);
1596 case eRasMessage_admissionConfirm
:
1597 return process_acf(pskb
, ct
, ctinfo
, data
,
1598 &ras
->admissionConfirm
);
1599 case eRasMessage_locationRequest
:
1600 return process_lrq(pskb
, ct
, ctinfo
, data
,
1601 &ras
->locationRequest
);
1602 case eRasMessage_locationConfirm
:
1603 return process_lcf(pskb
, ct
, ctinfo
, data
,
1604 &ras
->locationConfirm
);
1605 case eRasMessage_infoRequestResponse
:
1606 return process_irr(pskb
, ct
, ctinfo
, data
,
1607 &ras
->infoRequestResponse
);
1609 DEBUGP("ip_ct_ras: RAS message %d\n", ras
->choice
);
1616 /****************************************************************************/
1617 static int ras_help(struct sk_buff
**pskb
, struct ip_conntrack
*ct
,
1618 enum ip_conntrack_info ctinfo
)
1620 static RasMessage ras
;
1621 unsigned char *data
;
1625 DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb
)->len
);
1627 spin_lock_bh(&ip_h323_lock
);
1630 data
= get_udp_data(pskb
, &datalen
);
1633 DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1634 NIPQUAD((*pskb
)->nh
.iph
->saddr
),
1635 NIPQUAD((*pskb
)->nh
.iph
->daddr
), datalen
);
1637 /* Decode RAS message */
1638 ret
= DecodeRasMessage(data
, datalen
, &ras
);
1640 if (net_ratelimit())
1641 printk("ip_ct_ras: decoding error: %s\n",
1642 ret
== H323_ERROR_BOUND
?
1643 "out of bound" : "out of range");
1647 /* Process RAS message */
1648 if (process_ras(pskb
, ct
, ctinfo
, &data
, &ras
) < 0)
1652 spin_unlock_bh(&ip_h323_lock
);
1656 spin_unlock_bh(&ip_h323_lock
);
1657 if (net_ratelimit())
1658 printk("ip_ct_ras: packet dropped\n");
1662 /****************************************************************************/
1663 static struct ip_conntrack_helper ip_conntrack_helper_ras
= {
1668 .tuple
= {.src
= {.u
= {__constant_htons(RAS_PORT
)}},
1669 .dst
= {.protonum
= IPPROTO_UDP
}},
1670 .mask
= {.src
= {.u
= {0xFFFE}},
1671 .dst
= {.protonum
= 0xFF}},
1675 /****************************************************************************/
1676 static void ip_conntrack_ras_expect(struct ip_conntrack
*new,
1677 struct ip_conntrack_expect
*this)
1679 write_lock_bh(&ip_conntrack_lock
);
1680 new->helper
= &ip_conntrack_helper_ras
;
1681 write_unlock_bh(&ip_conntrack_lock
);
1684 /****************************************************************************/
1685 /* Not __exit - called from init() */
1686 static void fini(void)
1688 ip_conntrack_helper_unregister(&ip_conntrack_helper_ras
);
1689 ip_conntrack_helper_unregister(&ip_conntrack_helper_q931
);
1691 DEBUGP("ip_ct_h323: fini\n");
1694 /****************************************************************************/
1695 static int __init
init(void)
1699 h323_buffer
= kmalloc(65536, GFP_KERNEL
);
1702 if ((ret
= ip_conntrack_helper_register(&ip_conntrack_helper_q931
)) ||
1703 (ret
= ip_conntrack_helper_register(&ip_conntrack_helper_ras
))) {
1708 DEBUGP("ip_ct_h323: init success\n");
1712 /****************************************************************************/
1716 EXPORT_SYMBOL(get_h245_addr
);
1717 EXPORT_SYMBOL(get_h225_addr
);
1718 EXPORT_SYMBOL(ip_conntrack_h245_expect
);
1719 EXPORT_SYMBOL(ip_conntrack_q931_expect
);
1720 EXPORT_SYMBOL(set_h245_addr_hook
);
1721 EXPORT_SYMBOL(set_h225_addr_hook
);
1722 EXPORT_SYMBOL(set_sig_addr_hook
);
1723 EXPORT_SYMBOL(set_ras_addr_hook
);
1724 EXPORT_SYMBOL(nat_rtp_rtcp_hook
);
1725 EXPORT_SYMBOL(nat_t120_hook
);
1726 EXPORT_SYMBOL(nat_h245_hook
);
1727 EXPORT_SYMBOL(nat_q931_hook
);
1729 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1730 MODULE_DESCRIPTION("H.323 connection tracking helper");
1731 MODULE_LICENSE("GPL");