1/* 2 * H.323 connection tracking helper 3 * 4 * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net> 5 * 6 * This source code is licensed under General Public License version 2. 7 * 8 * Based on the 'brute force' H.323 connection tracking module by 9 * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 10 * 11 * For more information, please see http://nath323.sourceforge.net/ 12 */ 13 14#include <linux/module.h> 15#include <linux/moduleparam.h> 16#include <linux/ctype.h> 17#include <linux/inet.h> 18#include <linux/in.h> 19#include <linux/ip.h> 20#include <linux/slab.h> 21#include <linux/udp.h> 22#include <linux/tcp.h> 23#include <linux/skbuff.h> 24#include <net/route.h> 25#include <net/ip6_route.h> 26 27#include <net/netfilter/nf_conntrack.h> 28#include <net/netfilter/nf_conntrack_core.h> 29#include <net/netfilter/nf_conntrack_tuple.h> 30#include <net/netfilter/nf_conntrack_expect.h> 31#include <net/netfilter/nf_conntrack_ecache.h> 32#include <net/netfilter/nf_conntrack_helper.h> 33#include <net/netfilter/nf_conntrack_zones.h> 34#include <linux/netfilter/nf_conntrack_h323.h> 35 36/* Parameters */ 37static unsigned int default_rrq_ttl __read_mostly = 300; 38module_param(default_rrq_ttl, uint, 0600); 39MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ"); 40 41static int gkrouted_only __read_mostly = 1; 42module_param(gkrouted_only, int, 0600); 43MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper"); 44 45static int callforward_filter __read_mostly = 1; 46module_param(callforward_filter, bool, 0600); 47MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations " 48 "if both endpoints are on different sides " 49 "(determined by routing information)"); 50 51/* Hooks for NAT */ 52int (*set_h245_addr_hook) (struct sk_buff *skb, 53 unsigned char **data, int dataoff, 54 H245_TransportAddress *taddr, 55 union nf_inet_addr *addr, __be16 port) 56 __read_mostly; 57int (*set_h225_addr_hook) (struct sk_buff *skb, 58 unsigned char **data, int dataoff, 59 TransportAddress *taddr, 60 union nf_inet_addr *addr, __be16 port) 61 __read_mostly; 62int (*set_sig_addr_hook) (struct sk_buff *skb, 63 struct nf_conn *ct, 64 enum ip_conntrack_info ctinfo, 65 unsigned char **data, 66 TransportAddress *taddr, int count) __read_mostly; 67int (*set_ras_addr_hook) (struct sk_buff *skb, 68 struct nf_conn *ct, 69 enum ip_conntrack_info ctinfo, 70 unsigned char **data, 71 TransportAddress *taddr, int count) __read_mostly; 72int (*nat_rtp_rtcp_hook) (struct sk_buff *skb, 73 struct nf_conn *ct, 74 enum ip_conntrack_info ctinfo, 75 unsigned char **data, int dataoff, 76 H245_TransportAddress *taddr, 77 __be16 port, __be16 rtp_port, 78 struct nf_conntrack_expect *rtp_exp, 79 struct nf_conntrack_expect *rtcp_exp) __read_mostly; 80int (*nat_t120_hook) (struct sk_buff *skb, 81 struct nf_conn *ct, 82 enum ip_conntrack_info ctinfo, 83 unsigned char **data, int dataoff, 84 H245_TransportAddress *taddr, __be16 port, 85 struct nf_conntrack_expect *exp) __read_mostly; 86int (*nat_h245_hook) (struct sk_buff *skb, 87 struct nf_conn *ct, 88 enum ip_conntrack_info ctinfo, 89 unsigned char **data, int dataoff, 90 TransportAddress *taddr, __be16 port, 91 struct nf_conntrack_expect *exp) __read_mostly; 92int (*nat_callforwarding_hook) (struct sk_buff *skb, 93 struct nf_conn *ct, 94 enum ip_conntrack_info ctinfo, 95 unsigned char **data, int dataoff, 96 TransportAddress *taddr, __be16 port, 97 struct nf_conntrack_expect *exp) __read_mostly; 98int (*nat_q931_hook) (struct sk_buff *skb, 99 struct nf_conn *ct, 100 enum ip_conntrack_info ctinfo, 101 unsigned char **data, TransportAddress *taddr, int idx, 102 __be16 port, struct nf_conntrack_expect *exp) 103 __read_mostly; 104 105static DEFINE_SPINLOCK(nf_h323_lock); 106static char *h323_buffer; 107 108static struct nf_conntrack_helper nf_conntrack_helper_h245; 109static struct nf_conntrack_helper nf_conntrack_helper_q931[]; 110static struct nf_conntrack_helper nf_conntrack_helper_ras[]; 111 112/****************************************************************************/ 113static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff, 114 struct nf_conn *ct, enum ip_conntrack_info ctinfo, 115 unsigned char **data, int *datalen, int *dataoff) 116{ 117 struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info; 118 int dir = CTINFO2DIR(ctinfo); 119 const struct tcphdr *th; 120 struct tcphdr _tcph; 121 int tcpdatalen; 122 int tcpdataoff; 123 unsigned char *tpkt; 124 int tpktlen; 125 int tpktoff; 126 127 /* Get TCP header */ 128 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph); 129 if (th == NULL) 130 return 0; 131 132 /* Get TCP data offset */ 133 tcpdataoff = protoff + th->doff * 4; 134 135 /* Get TCP data length */ 136 tcpdatalen = skb->len - tcpdataoff; 137 if (tcpdatalen <= 0) /* No TCP data */ 138 goto clear_out; 139 140 if (*data == NULL) { /* first TPKT */ 141 /* Get first TPKT pointer */ 142 tpkt = skb_header_pointer(skb, tcpdataoff, tcpdatalen, 143 h323_buffer); 144 BUG_ON(tpkt == NULL); 145 146 /* Validate TPKT identifier */ 147 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) { 148 /* Netmeeting sends TPKT header and data separately */ 149 if (info->tpkt_len[dir] > 0) { 150 pr_debug("nf_ct_h323: previous packet " 151 "indicated separate TPKT data of %hu " 152 "bytes\n", info->tpkt_len[dir]); 153 if (info->tpkt_len[dir] <= tcpdatalen) { 154 /* Yes, there was a TPKT header 155 * received */ 156 *data = tpkt; 157 *datalen = info->tpkt_len[dir]; 158 *dataoff = 0; 159 goto out; 160 } 161 162 /* Fragmented TPKT */ 163 pr_debug("nf_ct_h323: fragmented TPKT\n"); 164 goto clear_out; 165 } 166 167 /* It is not even a TPKT */ 168 return 0; 169 } 170 tpktoff = 0; 171 } else { /* Next TPKT */ 172 tpktoff = *dataoff + *datalen; 173 tcpdatalen -= tpktoff; 174 if (tcpdatalen <= 4) /* No more TPKT */ 175 goto clear_out; 176 tpkt = *data + *datalen; 177 178 /* Validate TPKT identifier */ 179 if (tpkt[0] != 0x03 || tpkt[1] != 0) 180 goto clear_out; 181 } 182 183 /* Validate TPKT length */ 184 tpktlen = tpkt[2] * 256 + tpkt[3]; 185 if (tpktlen < 4) 186 goto clear_out; 187 if (tpktlen > tcpdatalen) { 188 if (tcpdatalen == 4) { /* Separate TPKT header */ 189 /* Netmeeting sends TPKT header and data separately */ 190 pr_debug("nf_ct_h323: separate TPKT header indicates " 191 "there will be TPKT data of %hu bytes\n", 192 tpktlen - 4); 193 info->tpkt_len[dir] = tpktlen - 4; 194 return 0; 195 } 196 197 pr_debug("nf_ct_h323: incomplete TPKT (fragmented?)\n"); 198 goto clear_out; 199 } 200 201 /* This is the encapsulated data */ 202 *data = tpkt + 4; 203 *datalen = tpktlen - 4; 204 *dataoff = tpktoff + 4; 205 206 out: 207 /* Clear TPKT length */ 208 info->tpkt_len[dir] = 0; 209 return 1; 210 211 clear_out: 212 info->tpkt_len[dir] = 0; 213 return 0; 214} 215 216/****************************************************************************/ 217static int get_h245_addr(struct nf_conn *ct, const unsigned char *data, 218 H245_TransportAddress *taddr, 219 union nf_inet_addr *addr, __be16 *port) 220{ 221 const unsigned char *p; 222 int len; 223 224 if (taddr->choice != eH245_TransportAddress_unicastAddress) 225 return 0; 226 227 switch (taddr->unicastAddress.choice) { 228 case eUnicastAddress_iPAddress: 229 if (nf_ct_l3num(ct) != AF_INET) 230 return 0; 231 p = data + taddr->unicastAddress.iPAddress.network; 232 len = 4; 233 break; 234 case eUnicastAddress_iP6Address: 235 if (nf_ct_l3num(ct) != AF_INET6) 236 return 0; 237 p = data + taddr->unicastAddress.iP6Address.network; 238 len = 16; 239 break; 240 default: 241 return 0; 242 } 243 244 memcpy(addr, p, len); 245 memset((void *)addr + len, 0, sizeof(*addr) - len); 246 memcpy(port, p + len, sizeof(__be16)); 247 248 return 1; 249} 250 251/****************************************************************************/ 252static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct, 253 enum ip_conntrack_info ctinfo, 254 unsigned char **data, int dataoff, 255 H245_TransportAddress *taddr) 256{ 257 int dir = CTINFO2DIR(ctinfo); 258 int ret = 0; 259 __be16 port; 260 __be16 rtp_port, rtcp_port; 261 union nf_inet_addr addr; 262 struct nf_conntrack_expect *rtp_exp; 263 struct nf_conntrack_expect *rtcp_exp; 264 typeof(nat_rtp_rtcp_hook) nat_rtp_rtcp; 265 266 /* Read RTP or RTCP address */ 267 if (!get_h245_addr(ct, *data, taddr, &addr, &port) || 268 memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) || 269 port == 0) 270 return 0; 271 272 /* RTP port is even */ 273 port &= htons(~1); 274 rtp_port = port; 275 rtcp_port = htons(ntohs(port) + 1); 276 277 /* Create expect for RTP */ 278 if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL) 279 return -1; 280 nf_ct_expect_init(rtp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 281 &ct->tuplehash[!dir].tuple.src.u3, 282 &ct->tuplehash[!dir].tuple.dst.u3, 283 IPPROTO_UDP, NULL, &rtp_port); 284 285 /* Create expect for RTCP */ 286 if ((rtcp_exp = nf_ct_expect_alloc(ct)) == NULL) { 287 nf_ct_expect_put(rtp_exp); 288 return -1; 289 } 290 nf_ct_expect_init(rtcp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 291 &ct->tuplehash[!dir].tuple.src.u3, 292 &ct->tuplehash[!dir].tuple.dst.u3, 293 IPPROTO_UDP, NULL, &rtcp_port); 294 295 if (memcmp(&ct->tuplehash[dir].tuple.src.u3, 296 &ct->tuplehash[!dir].tuple.dst.u3, 297 sizeof(ct->tuplehash[dir].tuple.src.u3)) && 298 (nat_rtp_rtcp = rcu_dereference(nat_rtp_rtcp_hook)) && 299 ct->status & IPS_NAT_MASK) { 300 /* NAT needed */ 301 ret = nat_rtp_rtcp(skb, ct, ctinfo, data, dataoff, 302 taddr, port, rtp_port, rtp_exp, rtcp_exp); 303 } else { /* Conntrack only */ 304 if (nf_ct_expect_related(rtp_exp) == 0) { 305 if (nf_ct_expect_related(rtcp_exp) == 0) { 306 pr_debug("nf_ct_h323: expect RTP "); 307 nf_ct_dump_tuple(&rtp_exp->tuple); 308 pr_debug("nf_ct_h323: expect RTCP "); 309 nf_ct_dump_tuple(&rtcp_exp->tuple); 310 } else { 311 nf_ct_unexpect_related(rtp_exp); 312 ret = -1; 313 } 314 } else 315 ret = -1; 316 } 317 318 nf_ct_expect_put(rtp_exp); 319 nf_ct_expect_put(rtcp_exp); 320 321 return ret; 322} 323 324/****************************************************************************/ 325static int expect_t120(struct sk_buff *skb, 326 struct nf_conn *ct, 327 enum ip_conntrack_info ctinfo, 328 unsigned char **data, int dataoff, 329 H245_TransportAddress *taddr) 330{ 331 int dir = CTINFO2DIR(ctinfo); 332 int ret = 0; 333 __be16 port; 334 union nf_inet_addr addr; 335 struct nf_conntrack_expect *exp; 336 typeof(nat_t120_hook) nat_t120; 337 338 /* Read T.120 address */ 339 if (!get_h245_addr(ct, *data, taddr, &addr, &port) || 340 memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) || 341 port == 0) 342 return 0; 343 344 /* Create expect for T.120 connections */ 345 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 346 return -1; 347 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 348 &ct->tuplehash[!dir].tuple.src.u3, 349 &ct->tuplehash[!dir].tuple.dst.u3, 350 IPPROTO_TCP, NULL, &port); 351 exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple channels */ 352 353 if (memcmp(&ct->tuplehash[dir].tuple.src.u3, 354 &ct->tuplehash[!dir].tuple.dst.u3, 355 sizeof(ct->tuplehash[dir].tuple.src.u3)) && 356 (nat_t120 = rcu_dereference(nat_t120_hook)) && 357 ct->status & IPS_NAT_MASK) { 358 /* NAT needed */ 359 ret = nat_t120(skb, ct, ctinfo, data, dataoff, taddr, 360 port, exp); 361 } else { /* Conntrack only */ 362 if (nf_ct_expect_related(exp) == 0) { 363 pr_debug("nf_ct_h323: expect T.120 "); 364 nf_ct_dump_tuple(&exp->tuple); 365 } else 366 ret = -1; 367 } 368 369 nf_ct_expect_put(exp); 370 371 return ret; 372} 373 374/****************************************************************************/ 375static int process_h245_channel(struct sk_buff *skb, 376 struct nf_conn *ct, 377 enum ip_conntrack_info ctinfo, 378 unsigned char **data, int dataoff, 379 H2250LogicalChannelParameters *channel) 380{ 381 int ret; 382 383 if (channel->options & eH2250LogicalChannelParameters_mediaChannel) { 384 /* RTP */ 385 ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff, 386 &channel->mediaChannel); 387 if (ret < 0) 388 return -1; 389 } 390 391 if (channel-> 392 options & eH2250LogicalChannelParameters_mediaControlChannel) { 393 /* RTCP */ 394 ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff, 395 &channel->mediaControlChannel); 396 if (ret < 0) 397 return -1; 398 } 399 400 return 0; 401} 402 403/****************************************************************************/ 404static int process_olc(struct sk_buff *skb, struct nf_conn *ct, 405 enum ip_conntrack_info ctinfo, 406 unsigned char **data, int dataoff, 407 OpenLogicalChannel *olc) 408{ 409 int ret; 410 411 pr_debug("nf_ct_h323: OpenLogicalChannel\n"); 412 413 if (olc->forwardLogicalChannelParameters.multiplexParameters.choice == 414 eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters) 415 { 416 ret = process_h245_channel(skb, ct, ctinfo, data, dataoff, 417 &olc-> 418 forwardLogicalChannelParameters. 419 multiplexParameters. 420 h2250LogicalChannelParameters); 421 if (ret < 0) 422 return -1; 423 } 424 425 if ((olc->options & 426 eOpenLogicalChannel_reverseLogicalChannelParameters) && 427 (olc->reverseLogicalChannelParameters.options & 428 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters) 429 && (olc->reverseLogicalChannelParameters.multiplexParameters. 430 choice == 431 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)) 432 { 433 ret = 434 process_h245_channel(skb, ct, ctinfo, data, dataoff, 435 &olc-> 436 reverseLogicalChannelParameters. 437 multiplexParameters. 438 h2250LogicalChannelParameters); 439 if (ret < 0) 440 return -1; 441 } 442 443 if ((olc->options & eOpenLogicalChannel_separateStack) && 444 olc->forwardLogicalChannelParameters.dataType.choice == 445 eDataType_data && 446 olc->forwardLogicalChannelParameters.dataType.data.application. 447 choice == eDataApplicationCapability_application_t120 && 448 olc->forwardLogicalChannelParameters.dataType.data.application. 449 t120.choice == eDataProtocolCapability_separateLANStack && 450 olc->separateStack.networkAddress.choice == 451 eNetworkAccessParameters_networkAddress_localAreaAddress) { 452 ret = expect_t120(skb, ct, ctinfo, data, dataoff, 453 &olc->separateStack.networkAddress. 454 localAreaAddress); 455 if (ret < 0) 456 return -1; 457 } 458 459 return 0; 460} 461 462/****************************************************************************/ 463static int process_olca(struct sk_buff *skb, struct nf_conn *ct, 464 enum ip_conntrack_info ctinfo, 465 unsigned char **data, int dataoff, 466 OpenLogicalChannelAck *olca) 467{ 468 H2250LogicalChannelAckParameters *ack; 469 int ret; 470 471 pr_debug("nf_ct_h323: OpenLogicalChannelAck\n"); 472 473 if ((olca->options & 474 eOpenLogicalChannelAck_reverseLogicalChannelParameters) && 475 (olca->reverseLogicalChannelParameters.options & 476 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters) 477 && (olca->reverseLogicalChannelParameters.multiplexParameters. 478 choice == 479 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)) 480 { 481 ret = process_h245_channel(skb, ct, ctinfo, data, dataoff, 482 &olca-> 483 reverseLogicalChannelParameters. 484 multiplexParameters. 485 h2250LogicalChannelParameters); 486 if (ret < 0) 487 return -1; 488 } 489 490 if ((olca->options & 491 eOpenLogicalChannelAck_forwardMultiplexAckParameters) && 492 (olca->forwardMultiplexAckParameters.choice == 493 eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters)) 494 { 495 ack = &olca->forwardMultiplexAckParameters. 496 h2250LogicalChannelAckParameters; 497 if (ack->options & 498 eH2250LogicalChannelAckParameters_mediaChannel) { 499 /* RTP */ 500 ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff, 501 &ack->mediaChannel); 502 if (ret < 0) 503 return -1; 504 } 505 506 if (ack->options & 507 eH2250LogicalChannelAckParameters_mediaControlChannel) { 508 /* RTCP */ 509 ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff, 510 &ack->mediaControlChannel); 511 if (ret < 0) 512 return -1; 513 } 514 } 515 516 if ((olca->options & eOpenLogicalChannelAck_separateStack) && 517 olca->separateStack.networkAddress.choice == 518 eNetworkAccessParameters_networkAddress_localAreaAddress) { 519 ret = expect_t120(skb, ct, ctinfo, data, dataoff, 520 &olca->separateStack.networkAddress. 521 localAreaAddress); 522 if (ret < 0) 523 return -1; 524 } 525 526 return 0; 527} 528 529/****************************************************************************/ 530static int process_h245(struct sk_buff *skb, struct nf_conn *ct, 531 enum ip_conntrack_info ctinfo, 532 unsigned char **data, int dataoff, 533 MultimediaSystemControlMessage *mscm) 534{ 535 switch (mscm->choice) { 536 case eMultimediaSystemControlMessage_request: 537 if (mscm->request.choice == 538 eRequestMessage_openLogicalChannel) { 539 return process_olc(skb, ct, ctinfo, data, dataoff, 540 &mscm->request.openLogicalChannel); 541 } 542 pr_debug("nf_ct_h323: H.245 Request %d\n", 543 mscm->request.choice); 544 break; 545 case eMultimediaSystemControlMessage_response: 546 if (mscm->response.choice == 547 eResponseMessage_openLogicalChannelAck) { 548 return process_olca(skb, ct, ctinfo, data, dataoff, 549 &mscm->response. 550 openLogicalChannelAck); 551 } 552 pr_debug("nf_ct_h323: H.245 Response %d\n", 553 mscm->response.choice); 554 break; 555 default: 556 pr_debug("nf_ct_h323: H.245 signal %d\n", mscm->choice); 557 break; 558 } 559 560 return 0; 561} 562 563/****************************************************************************/ 564static int h245_help(struct sk_buff *skb, unsigned int protoff, 565 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 566{ 567 static MultimediaSystemControlMessage mscm; 568 unsigned char *data = NULL; 569 int datalen; 570 int dataoff; 571 int ret; 572 573 /* Until there's been traffic both ways, don't look in packets. */ 574 if (ctinfo != IP_CT_ESTABLISHED && 575 ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) { 576 return NF_ACCEPT; 577 } 578 pr_debug("nf_ct_h245: skblen = %u\n", skb->len); 579 580 spin_lock_bh(&nf_h323_lock); 581 582 /* Process each TPKT */ 583 while (get_tpkt_data(skb, protoff, ct, ctinfo, 584 &data, &datalen, &dataoff)) { 585 pr_debug("nf_ct_h245: TPKT len=%d ", datalen); 586 nf_ct_dump_tuple(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple); 587 588 /* Decode H.245 signal */ 589 ret = DecodeMultimediaSystemControlMessage(data, datalen, 590 &mscm); 591 if (ret < 0) { 592 pr_debug("nf_ct_h245: decoding error: %s\n", 593 ret == H323_ERROR_BOUND ? 594 "out of bound" : "out of range"); 595 /* We don't drop when decoding error */ 596 break; 597 } 598 599 /* Process H.245 signal */ 600 if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0) 601 goto drop; 602 } 603 604 spin_unlock_bh(&nf_h323_lock); 605 return NF_ACCEPT; 606 607 drop: 608 spin_unlock_bh(&nf_h323_lock); 609 if (net_ratelimit()) 610 pr_info("nf_ct_h245: packet dropped\n"); 611 return NF_DROP; 612} 613 614/****************************************************************************/ 615static const struct nf_conntrack_expect_policy h245_exp_policy = { 616 .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */, 617 .timeout = 240, 618}; 619 620static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = { 621 .name = "H.245", 622 .me = THIS_MODULE, 623 .tuple.src.l3num = AF_UNSPEC, 624 .tuple.dst.protonum = IPPROTO_UDP, 625 .help = h245_help, 626 .expect_policy = &h245_exp_policy, 627}; 628 629/****************************************************************************/ 630int get_h225_addr(struct nf_conn *ct, unsigned char *data, 631 TransportAddress *taddr, 632 union nf_inet_addr *addr, __be16 *port) 633{ 634 const unsigned char *p; 635 int len; 636 637 switch (taddr->choice) { 638 case eTransportAddress_ipAddress: 639 if (nf_ct_l3num(ct) != AF_INET) 640 return 0; 641 p = data + taddr->ipAddress.ip; 642 len = 4; 643 break; 644 case eTransportAddress_ip6Address: 645 if (nf_ct_l3num(ct) != AF_INET6) 646 return 0; 647 p = data + taddr->ip6Address.ip; 648 len = 16; 649 break; 650 default: 651 return 0; 652 } 653 654 memcpy(addr, p, len); 655 memset((void *)addr + len, 0, sizeof(*addr) - len); 656 memcpy(port, p + len, sizeof(__be16)); 657 658 return 1; 659} 660 661/****************************************************************************/ 662static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, 663 enum ip_conntrack_info ctinfo, 664 unsigned char **data, int dataoff, 665 TransportAddress *taddr) 666{ 667 int dir = CTINFO2DIR(ctinfo); 668 int ret = 0; 669 __be16 port; 670 union nf_inet_addr addr; 671 struct nf_conntrack_expect *exp; 672 typeof(nat_h245_hook) nat_h245; 673 674 /* Read h245Address */ 675 if (!get_h225_addr(ct, *data, taddr, &addr, &port) || 676 memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) || 677 port == 0) 678 return 0; 679 680 /* Create expect for h245 connection */ 681 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 682 return -1; 683 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 684 &ct->tuplehash[!dir].tuple.src.u3, 685 &ct->tuplehash[!dir].tuple.dst.u3, 686 IPPROTO_TCP, NULL, &port); 687 exp->helper = &nf_conntrack_helper_h245; 688 689 if (memcmp(&ct->tuplehash[dir].tuple.src.u3, 690 &ct->tuplehash[!dir].tuple.dst.u3, 691 sizeof(ct->tuplehash[dir].tuple.src.u3)) && 692 (nat_h245 = rcu_dereference(nat_h245_hook)) && 693 ct->status & IPS_NAT_MASK) { 694 /* NAT needed */ 695 ret = nat_h245(skb, ct, ctinfo, data, dataoff, taddr, 696 port, exp); 697 } else { /* Conntrack only */ 698 if (nf_ct_expect_related(exp) == 0) { 699 pr_debug("nf_ct_q931: expect H.245 "); 700 nf_ct_dump_tuple(&exp->tuple); 701 } else 702 ret = -1; 703 } 704 705 nf_ct_expect_put(exp); 706 707 return ret; 708} 709 710/* If the calling party is on the same side of the forward-to party, 711 * we don't need to track the second call */ 712static int callforward_do_filter(const union nf_inet_addr *src, 713 const union nf_inet_addr *dst, 714 u_int8_t family) 715{ 716 const struct nf_afinfo *afinfo; 717 struct flowi fl1, fl2; 718 int ret = 0; 719 720 /* rcu_read_lock()ed by nf_hook_slow() */ 721 afinfo = nf_get_afinfo(family); 722 if (!afinfo) 723 return 0; 724 725 memset(&fl1, 0, sizeof(fl1)); 726 memset(&fl2, 0, sizeof(fl2)); 727 728 switch (family) { 729 case AF_INET: { 730 struct rtable *rt1, *rt2; 731 732 fl1.fl4_dst = src->ip; 733 fl2.fl4_dst = dst->ip; 734 if (!afinfo->route((struct dst_entry **)&rt1, &fl1)) { 735 if (!afinfo->route((struct dst_entry **)&rt2, &fl2)) { 736 if (rt1->rt_gateway == rt2->rt_gateway && 737 rt1->dst.dev == rt2->dst.dev) 738 ret = 1; 739 dst_release(&rt2->dst); 740 } 741 dst_release(&rt1->dst); 742 } 743 break; 744 } 745#if defined(CONFIG_NF_CONNTRACK_IPV6) || defined(CONFIG_NF_CONNTRACK_IPV6_MODULE) 746 case AF_INET6: { 747 struct rt6_info *rt1, *rt2; 748 749 memcpy(&fl1.fl6_dst, src, sizeof(fl1.fl6_dst)); 750 memcpy(&fl2.fl6_dst, dst, sizeof(fl2.fl6_dst)); 751 if (!afinfo->route((struct dst_entry **)&rt1, &fl1)) { 752 if (!afinfo->route((struct dst_entry **)&rt2, &fl2)) { 753 if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway, 754 sizeof(rt1->rt6i_gateway)) && 755 rt1->dst.dev == rt2->dst.dev) 756 ret = 1; 757 dst_release(&rt2->dst); 758 } 759 dst_release(&rt1->dst); 760 } 761 break; 762 } 763#endif 764 } 765 return ret; 766 767} 768 769/****************************************************************************/ 770static int expect_callforwarding(struct sk_buff *skb, 771 struct nf_conn *ct, 772 enum ip_conntrack_info ctinfo, 773 unsigned char **data, int dataoff, 774 TransportAddress *taddr) 775{ 776 int dir = CTINFO2DIR(ctinfo); 777 int ret = 0; 778 __be16 port; 779 union nf_inet_addr addr; 780 struct nf_conntrack_expect *exp; 781 typeof(nat_callforwarding_hook) nat_callforwarding; 782 783 /* Read alternativeAddress */ 784 if (!get_h225_addr(ct, *data, taddr, &addr, &port) || port == 0) 785 return 0; 786 787 /* If the calling party is on the same side of the forward-to party, 788 * we don't need to track the second call */ 789 if (callforward_filter && 790 callforward_do_filter(&addr, &ct->tuplehash[!dir].tuple.src.u3, 791 nf_ct_l3num(ct))) { 792 pr_debug("nf_ct_q931: Call Forwarding not tracked\n"); 793 return 0; 794 } 795 796 /* Create expect for the second call leg */ 797 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 798 return -1; 799 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 800 &ct->tuplehash[!dir].tuple.src.u3, &addr, 801 IPPROTO_TCP, NULL, &port); 802 exp->helper = nf_conntrack_helper_q931; 803 804 if (memcmp(&ct->tuplehash[dir].tuple.src.u3, 805 &ct->tuplehash[!dir].tuple.dst.u3, 806 sizeof(ct->tuplehash[dir].tuple.src.u3)) && 807 (nat_callforwarding = rcu_dereference(nat_callforwarding_hook)) && 808 ct->status & IPS_NAT_MASK) { 809 /* Need NAT */ 810 ret = nat_callforwarding(skb, ct, ctinfo, data, dataoff, 811 taddr, port, exp); 812 } else { /* Conntrack only */ 813 if (nf_ct_expect_related(exp) == 0) { 814 pr_debug("nf_ct_q931: expect Call Forwarding "); 815 nf_ct_dump_tuple(&exp->tuple); 816 } else 817 ret = -1; 818 } 819 820 nf_ct_expect_put(exp); 821 822 return ret; 823} 824 825/****************************************************************************/ 826static int process_setup(struct sk_buff *skb, struct nf_conn *ct, 827 enum ip_conntrack_info ctinfo, 828 unsigned char **data, int dataoff, 829 Setup_UUIE *setup) 830{ 831 int dir = CTINFO2DIR(ctinfo); 832 int ret; 833 int i; 834 __be16 port; 835 union nf_inet_addr addr; 836 typeof(set_h225_addr_hook) set_h225_addr; 837 838 pr_debug("nf_ct_q931: Setup\n"); 839 840 if (setup->options & eSetup_UUIE_h245Address) { 841 ret = expect_h245(skb, ct, ctinfo, data, dataoff, 842 &setup->h245Address); 843 if (ret < 0) 844 return -1; 845 } 846 847 set_h225_addr = rcu_dereference(set_h225_addr_hook); 848 if ((setup->options & eSetup_UUIE_destCallSignalAddress) && 849 (set_h225_addr) && ct->status & IPS_NAT_MASK && 850 get_h225_addr(ct, *data, &setup->destCallSignalAddress, 851 &addr, &port) && 852 memcmp(&addr, &ct->tuplehash[!dir].tuple.src.u3, sizeof(addr))) { 853 pr_debug("nf_ct_q931: set destCallSignalAddress %pI6:%hu->%pI6:%hu\n", 854 &addr, ntohs(port), &ct->tuplehash[!dir].tuple.src.u3, 855 ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port)); 856 ret = set_h225_addr(skb, data, dataoff, 857 &setup->destCallSignalAddress, 858 &ct->tuplehash[!dir].tuple.src.u3, 859 ct->tuplehash[!dir].tuple.src.u.tcp.port); 860 if (ret < 0) 861 return -1; 862 } 863 864 if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) && 865 (set_h225_addr) && ct->status & IPS_NAT_MASK && 866 get_h225_addr(ct, *data, &setup->sourceCallSignalAddress, 867 &addr, &port) && 868 memcmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3, sizeof(addr))) { 869 pr_debug("nf_ct_q931: set sourceCallSignalAddress %pI6:%hu->%pI6:%hu\n", 870 &addr, ntohs(port), &ct->tuplehash[!dir].tuple.dst.u3, 871 ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port)); 872 ret = set_h225_addr(skb, data, dataoff, 873 &setup->sourceCallSignalAddress, 874 &ct->tuplehash[!dir].tuple.dst.u3, 875 ct->tuplehash[!dir].tuple.dst.u.tcp.port); 876 if (ret < 0) 877 return -1; 878 } 879 880 if (setup->options & eSetup_UUIE_fastStart) { 881 for (i = 0; i < setup->fastStart.count; i++) { 882 ret = process_olc(skb, ct, ctinfo, data, dataoff, 883 &setup->fastStart.item[i]); 884 if (ret < 0) 885 return -1; 886 } 887 } 888 889 return 0; 890} 891 892/****************************************************************************/ 893static int process_callproceeding(struct sk_buff *skb, 894 struct nf_conn *ct, 895 enum ip_conntrack_info ctinfo, 896 unsigned char **data, int dataoff, 897 CallProceeding_UUIE *callproc) 898{ 899 int ret; 900 int i; 901 902 pr_debug("nf_ct_q931: CallProceeding\n"); 903 904 if (callproc->options & eCallProceeding_UUIE_h245Address) { 905 ret = expect_h245(skb, ct, ctinfo, data, dataoff, 906 &callproc->h245Address); 907 if (ret < 0) 908 return -1; 909 } 910 911 if (callproc->options & eCallProceeding_UUIE_fastStart) { 912 for (i = 0; i < callproc->fastStart.count; i++) { 913 ret = process_olc(skb, ct, ctinfo, data, dataoff, 914 &callproc->fastStart.item[i]); 915 if (ret < 0) 916 return -1; 917 } 918 } 919 920 return 0; 921} 922 923/****************************************************************************/ 924static int process_connect(struct sk_buff *skb, struct nf_conn *ct, 925 enum ip_conntrack_info ctinfo, 926 unsigned char **data, int dataoff, 927 Connect_UUIE *connect) 928{ 929 int ret; 930 int i; 931 932 pr_debug("nf_ct_q931: Connect\n"); 933 934 if (connect->options & eConnect_UUIE_h245Address) { 935 ret = expect_h245(skb, ct, ctinfo, data, dataoff, 936 &connect->h245Address); 937 if (ret < 0) 938 return -1; 939 } 940 941 if (connect->options & eConnect_UUIE_fastStart) { 942 for (i = 0; i < connect->fastStart.count; i++) { 943 ret = process_olc(skb, ct, ctinfo, data, dataoff, 944 &connect->fastStart.item[i]); 945 if (ret < 0) 946 return -1; 947 } 948 } 949 950 return 0; 951} 952 953/****************************************************************************/ 954static int process_alerting(struct sk_buff *skb, struct nf_conn *ct, 955 enum ip_conntrack_info ctinfo, 956 unsigned char **data, int dataoff, 957 Alerting_UUIE *alert) 958{ 959 int ret; 960 int i; 961 962 pr_debug("nf_ct_q931: Alerting\n"); 963 964 if (alert->options & eAlerting_UUIE_h245Address) { 965 ret = expect_h245(skb, ct, ctinfo, data, dataoff, 966 &alert->h245Address); 967 if (ret < 0) 968 return -1; 969 } 970 971 if (alert->options & eAlerting_UUIE_fastStart) { 972 for (i = 0; i < alert->fastStart.count; i++) { 973 ret = process_olc(skb, ct, ctinfo, data, dataoff, 974 &alert->fastStart.item[i]); 975 if (ret < 0) 976 return -1; 977 } 978 } 979 980 return 0; 981} 982 983/****************************************************************************/ 984static int process_facility(struct sk_buff *skb, struct nf_conn *ct, 985 enum ip_conntrack_info ctinfo, 986 unsigned char **data, int dataoff, 987 Facility_UUIE *facility) 988{ 989 int ret; 990 int i; 991 992 pr_debug("nf_ct_q931: Facility\n"); 993 994 if (facility->reason.choice == eFacilityReason_callForwarded) { 995 if (facility->options & eFacility_UUIE_alternativeAddress) 996 return expect_callforwarding(skb, ct, ctinfo, data, 997 dataoff, 998 &facility-> 999 alternativeAddress); 1000 return 0; 1001 } 1002 1003 if (facility->options & eFacility_UUIE_h245Address) { 1004 ret = expect_h245(skb, ct, ctinfo, data, dataoff, 1005 &facility->h245Address); 1006 if (ret < 0) 1007 return -1; 1008 } 1009 1010 if (facility->options & eFacility_UUIE_fastStart) { 1011 for (i = 0; i < facility->fastStart.count; i++) { 1012 ret = process_olc(skb, ct, ctinfo, data, dataoff, 1013 &facility->fastStart.item[i]); 1014 if (ret < 0) 1015 return -1; 1016 } 1017 } 1018 1019 return 0; 1020} 1021 1022/****************************************************************************/ 1023static int process_progress(struct sk_buff *skb, struct nf_conn *ct, 1024 enum ip_conntrack_info ctinfo, 1025 unsigned char **data, int dataoff, 1026 Progress_UUIE *progress) 1027{ 1028 int ret; 1029 int i; 1030 1031 pr_debug("nf_ct_q931: Progress\n"); 1032 1033 if (progress->options & eProgress_UUIE_h245Address) { 1034 ret = expect_h245(skb, ct, ctinfo, data, dataoff, 1035 &progress->h245Address); 1036 if (ret < 0) 1037 return -1; 1038 } 1039 1040 if (progress->options & eProgress_UUIE_fastStart) { 1041 for (i = 0; i < progress->fastStart.count; i++) { 1042 ret = process_olc(skb, ct, ctinfo, data, dataoff, 1043 &progress->fastStart.item[i]); 1044 if (ret < 0) 1045 return -1; 1046 } 1047 } 1048 1049 return 0; 1050} 1051 1052/****************************************************************************/ 1053static int process_q931(struct sk_buff *skb, struct nf_conn *ct, 1054 enum ip_conntrack_info ctinfo, 1055 unsigned char **data, int dataoff, Q931 *q931) 1056{ 1057 H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu; 1058 int i; 1059 int ret = 0; 1060 1061 switch (pdu->h323_message_body.choice) { 1062 case eH323_UU_PDU_h323_message_body_setup: 1063 ret = process_setup(skb, ct, ctinfo, data, dataoff, 1064 &pdu->h323_message_body.setup); 1065 break; 1066 case eH323_UU_PDU_h323_message_body_callProceeding: 1067 ret = process_callproceeding(skb, ct, ctinfo, data, dataoff, 1068 &pdu->h323_message_body. 1069 callProceeding); 1070 break; 1071 case eH323_UU_PDU_h323_message_body_connect: 1072 ret = process_connect(skb, ct, ctinfo, data, dataoff, 1073 &pdu->h323_message_body.connect); 1074 break; 1075 case eH323_UU_PDU_h323_message_body_alerting: 1076 ret = process_alerting(skb, ct, ctinfo, data, dataoff, 1077 &pdu->h323_message_body.alerting); 1078 break; 1079 case eH323_UU_PDU_h323_message_body_facility: 1080 ret = process_facility(skb, ct, ctinfo, data, dataoff, 1081 &pdu->h323_message_body.facility); 1082 break; 1083 case eH323_UU_PDU_h323_message_body_progress: 1084 ret = process_progress(skb, ct, ctinfo, data, dataoff, 1085 &pdu->h323_message_body.progress); 1086 break; 1087 default: 1088 pr_debug("nf_ct_q931: Q.931 signal %d\n", 1089 pdu->h323_message_body.choice); 1090 break; 1091 } 1092 1093 if (ret < 0) 1094 return -1; 1095 1096 if (pdu->options & eH323_UU_PDU_h245Control) { 1097 for (i = 0; i < pdu->h245Control.count; i++) { 1098 ret = process_h245(skb, ct, ctinfo, data, dataoff, 1099 &pdu->h245Control.item[i]); 1100 if (ret < 0) 1101 return -1; 1102 } 1103 } 1104 1105 return 0; 1106} 1107 1108/****************************************************************************/ 1109static int q931_help(struct sk_buff *skb, unsigned int protoff, 1110 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 1111{ 1112 static Q931 q931; 1113 unsigned char *data = NULL; 1114 int datalen; 1115 int dataoff; 1116 int ret; 1117 1118 /* Until there's been traffic both ways, don't look in packets. */ 1119 if (ctinfo != IP_CT_ESTABLISHED && 1120 ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) { 1121 return NF_ACCEPT; 1122 } 1123 pr_debug("nf_ct_q931: skblen = %u\n", skb->len); 1124 1125 spin_lock_bh(&nf_h323_lock); 1126 1127 /* Process each TPKT */ 1128 while (get_tpkt_data(skb, protoff, ct, ctinfo, 1129 &data, &datalen, &dataoff)) { 1130 pr_debug("nf_ct_q931: TPKT len=%d ", datalen); 1131 nf_ct_dump_tuple(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple); 1132 1133 /* Decode Q.931 signal */ 1134 ret = DecodeQ931(data, datalen, &q931); 1135 if (ret < 0) { 1136 pr_debug("nf_ct_q931: decoding error: %s\n", 1137 ret == H323_ERROR_BOUND ? 1138 "out of bound" : "out of range"); 1139 /* We don't drop when decoding error */ 1140 break; 1141 } 1142 1143 /* Process Q.931 signal */ 1144 if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0) 1145 goto drop; 1146 } 1147 1148 spin_unlock_bh(&nf_h323_lock); 1149 return NF_ACCEPT; 1150 1151 drop: 1152 spin_unlock_bh(&nf_h323_lock); 1153 if (net_ratelimit()) 1154 pr_info("nf_ct_q931: packet dropped\n"); 1155 return NF_DROP; 1156} 1157 1158/****************************************************************************/ 1159static const struct nf_conntrack_expect_policy q931_exp_policy = { 1160 /* T.120 and H.245 */ 1161 .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4, 1162 .timeout = 240, 1163}; 1164 1165static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = { 1166 { 1167 .name = "Q.931", 1168 .me = THIS_MODULE, 1169 .tuple.src.l3num = AF_INET, 1170 .tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT), 1171 .tuple.dst.protonum = IPPROTO_TCP, 1172 .help = q931_help, 1173 .expect_policy = &q931_exp_policy, 1174 }, 1175 { 1176 .name = "Q.931", 1177 .me = THIS_MODULE, 1178 .tuple.src.l3num = AF_INET6, 1179 .tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT), 1180 .tuple.dst.protonum = IPPROTO_TCP, 1181 .help = q931_help, 1182 .expect_policy = &q931_exp_policy, 1183 }, 1184}; 1185 1186/****************************************************************************/ 1187static unsigned char *get_udp_data(struct sk_buff *skb, unsigned int protoff, 1188 int *datalen) 1189{ 1190 const struct udphdr *uh; 1191 struct udphdr _uh; 1192 int dataoff; 1193 1194 uh = skb_header_pointer(skb, protoff, sizeof(_uh), &_uh); 1195 if (uh == NULL) 1196 return NULL; 1197 dataoff = protoff + sizeof(_uh); 1198 if (dataoff >= skb->len) 1199 return NULL; 1200 *datalen = skb->len - dataoff; 1201 return skb_header_pointer(skb, dataoff, *datalen, h323_buffer); 1202} 1203 1204/****************************************************************************/ 1205static struct nf_conntrack_expect *find_expect(struct nf_conn *ct, 1206 union nf_inet_addr *addr, 1207 __be16 port) 1208{ 1209 struct net *net = nf_ct_net(ct); 1210 struct nf_conntrack_expect *exp; 1211 struct nf_conntrack_tuple tuple; 1212 1213 memset(&tuple.src.u3, 0, sizeof(tuple.src.u3)); 1214 tuple.src.u.tcp.port = 0; 1215 memcpy(&tuple.dst.u3, addr, sizeof(tuple.dst.u3)); 1216 tuple.dst.u.tcp.port = port; 1217 tuple.dst.protonum = IPPROTO_TCP; 1218 1219 exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple); 1220 if (exp && exp->master == ct) 1221 return exp; 1222 return NULL; 1223} 1224 1225/****************************************************************************/ 1226static int set_expect_timeout(struct nf_conntrack_expect *exp, 1227 unsigned timeout) 1228{ 1229 if (!exp || !del_timer(&exp->timeout)) 1230 return 0; 1231 1232 exp->timeout.expires = jiffies + timeout * HZ; 1233 add_timer(&exp->timeout); 1234 1235 return 1; 1236} 1237 1238/****************************************************************************/ 1239static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, 1240 enum ip_conntrack_info ctinfo, 1241 unsigned char **data, 1242 TransportAddress *taddr, int count) 1243{ 1244 struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info; 1245 int dir = CTINFO2DIR(ctinfo); 1246 int ret = 0; 1247 int i; 1248 __be16 port; 1249 union nf_inet_addr addr; 1250 struct nf_conntrack_expect *exp; 1251 typeof(nat_q931_hook) nat_q931; 1252 1253 /* Look for the first related address */ 1254 for (i = 0; i < count; i++) { 1255 if (get_h225_addr(ct, *data, &taddr[i], &addr, &port) && 1256 memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, 1257 sizeof(addr)) == 0 && port != 0) 1258 break; 1259 } 1260 1261 if (i >= count) /* Not found */ 1262 return 0; 1263 1264 /* Create expect for Q.931 */ 1265 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 1266 return -1; 1267 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 1268 gkrouted_only ? /* only accept calls from GK? */ 1269 &ct->tuplehash[!dir].tuple.src.u3 : NULL, 1270 &ct->tuplehash[!dir].tuple.dst.u3, 1271 IPPROTO_TCP, NULL, &port); 1272 exp->helper = nf_conntrack_helper_q931; 1273 exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple calls */ 1274 1275 nat_q931 = rcu_dereference(nat_q931_hook); 1276 if (nat_q931 && ct->status & IPS_NAT_MASK) { /* Need NAT */ 1277 ret = nat_q931(skb, ct, ctinfo, data, taddr, i, port, exp); 1278 } else { /* Conntrack only */ 1279 if (nf_ct_expect_related(exp) == 0) { 1280 pr_debug("nf_ct_ras: expect Q.931 "); 1281 nf_ct_dump_tuple(&exp->tuple); 1282 1283 /* Save port for looking up expect in processing RCF */ 1284 info->sig_port[dir] = port; 1285 } else 1286 ret = -1; 1287 } 1288 1289 nf_ct_expect_put(exp); 1290 1291 return ret; 1292} 1293 1294/****************************************************************************/ 1295static int process_grq(struct sk_buff *skb, struct nf_conn *ct, 1296 enum ip_conntrack_info ctinfo, 1297 unsigned char **data, GatekeeperRequest *grq) 1298{ 1299 typeof(set_ras_addr_hook) set_ras_addr; 1300 1301 pr_debug("nf_ct_ras: GRQ\n"); 1302 1303 set_ras_addr = rcu_dereference(set_ras_addr_hook); 1304 if (set_ras_addr && ct->status & IPS_NAT_MASK) /* NATed */ 1305 return set_ras_addr(skb, ct, ctinfo, data, 1306 &grq->rasAddress, 1); 1307 return 0; 1308} 1309 1310/****************************************************************************/ 1311static int process_gcf(struct sk_buff *skb, struct nf_conn *ct, 1312 enum ip_conntrack_info ctinfo, 1313 unsigned char **data, GatekeeperConfirm *gcf) 1314{ 1315 int dir = CTINFO2DIR(ctinfo); 1316 int ret = 0; 1317 __be16 port; 1318 union nf_inet_addr addr; 1319 struct nf_conntrack_expect *exp; 1320 1321 pr_debug("nf_ct_ras: GCF\n"); 1322 1323 if (!get_h225_addr(ct, *data, &gcf->rasAddress, &addr, &port)) 1324 return 0; 1325 1326 /* Registration port is the same as discovery port */ 1327 if (!memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) && 1328 port == ct->tuplehash[dir].tuple.src.u.udp.port) 1329 return 0; 1330 1331 /* Avoid RAS expectation loops. A GCF is never expected. */ 1332 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 1333 return 0; 1334 1335 /* Need new expect */ 1336 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 1337 return -1; 1338 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 1339 &ct->tuplehash[!dir].tuple.src.u3, &addr, 1340 IPPROTO_UDP, NULL, &port); 1341 exp->helper = nf_conntrack_helper_ras; 1342 1343 if (nf_ct_expect_related(exp) == 0) { 1344 pr_debug("nf_ct_ras: expect RAS "); 1345 nf_ct_dump_tuple(&exp->tuple); 1346 } else 1347 ret = -1; 1348 1349 nf_ct_expect_put(exp); 1350 1351 return ret; 1352} 1353 1354/****************************************************************************/ 1355static int process_rrq(struct sk_buff *skb, struct nf_conn *ct, 1356 enum ip_conntrack_info ctinfo, 1357 unsigned char **data, RegistrationRequest *rrq) 1358{ 1359 struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info; 1360 int ret; 1361 typeof(set_ras_addr_hook) set_ras_addr; 1362 1363 pr_debug("nf_ct_ras: RRQ\n"); 1364 1365 ret = expect_q931(skb, ct, ctinfo, data, 1366 rrq->callSignalAddress.item, 1367 rrq->callSignalAddress.count); 1368 if (ret < 0) 1369 return -1; 1370 1371 set_ras_addr = rcu_dereference(set_ras_addr_hook); 1372 if (set_ras_addr && ct->status & IPS_NAT_MASK) { 1373 ret = set_ras_addr(skb, ct, ctinfo, data, 1374 rrq->rasAddress.item, 1375 rrq->rasAddress.count); 1376 if (ret < 0) 1377 return -1; 1378 } 1379 1380 if (rrq->options & eRegistrationRequest_timeToLive) { 1381 pr_debug("nf_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive); 1382 info->timeout = rrq->timeToLive; 1383 } else 1384 info->timeout = default_rrq_ttl; 1385 1386 return 0; 1387} 1388 1389/****************************************************************************/ 1390static int process_rcf(struct sk_buff *skb, struct nf_conn *ct, 1391 enum ip_conntrack_info ctinfo, 1392 unsigned char **data, RegistrationConfirm *rcf) 1393{ 1394 struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info; 1395 int dir = CTINFO2DIR(ctinfo); 1396 int ret; 1397 struct nf_conntrack_expect *exp; 1398 typeof(set_sig_addr_hook) set_sig_addr; 1399 1400 pr_debug("nf_ct_ras: RCF\n"); 1401 1402 set_sig_addr = rcu_dereference(set_sig_addr_hook); 1403 if (set_sig_addr && ct->status & IPS_NAT_MASK) { 1404 ret = set_sig_addr(skb, ct, ctinfo, data, 1405 rcf->callSignalAddress.item, 1406 rcf->callSignalAddress.count); 1407 if (ret < 0) 1408 return -1; 1409 } 1410 1411 if (rcf->options & eRegistrationConfirm_timeToLive) { 1412 pr_debug("nf_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive); 1413 info->timeout = rcf->timeToLive; 1414 } 1415 1416 if (info->timeout > 0) { 1417 pr_debug("nf_ct_ras: set RAS connection timeout to " 1418 "%u seconds\n", info->timeout); 1419 nf_ct_refresh(ct, skb, info->timeout * HZ); 1420 1421 /* Set expect timeout */ 1422 spin_lock_bh(&nf_conntrack_lock); 1423 exp = find_expect(ct, &ct->tuplehash[dir].tuple.dst.u3, 1424 info->sig_port[!dir]); 1425 if (exp) { 1426 pr_debug("nf_ct_ras: set Q.931 expect " 1427 "timeout to %u seconds for", 1428 info->timeout); 1429 nf_ct_dump_tuple(&exp->tuple); 1430 set_expect_timeout(exp, info->timeout); 1431 } 1432 spin_unlock_bh(&nf_conntrack_lock); 1433 } 1434 1435 return 0; 1436} 1437 1438/****************************************************************************/ 1439static int process_urq(struct sk_buff *skb, struct nf_conn *ct, 1440 enum ip_conntrack_info ctinfo, 1441 unsigned char **data, UnregistrationRequest *urq) 1442{ 1443 struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info; 1444 int dir = CTINFO2DIR(ctinfo); 1445 int ret; 1446 typeof(set_sig_addr_hook) set_sig_addr; 1447 1448 pr_debug("nf_ct_ras: URQ\n"); 1449 1450 set_sig_addr = rcu_dereference(set_sig_addr_hook); 1451 if (set_sig_addr && ct->status & IPS_NAT_MASK) { 1452 ret = set_sig_addr(skb, ct, ctinfo, data, 1453 urq->callSignalAddress.item, 1454 urq->callSignalAddress.count); 1455 if (ret < 0) 1456 return -1; 1457 } 1458 1459 /* Clear old expect */ 1460 nf_ct_remove_expectations(ct); 1461 info->sig_port[dir] = 0; 1462 info->sig_port[!dir] = 0; 1463 1464 /* Give it 30 seconds for UCF or URJ */ 1465 nf_ct_refresh(ct, skb, 30 * HZ); 1466 1467 return 0; 1468} 1469 1470/****************************************************************************/ 1471static int process_arq(struct sk_buff *skb, struct nf_conn *ct, 1472 enum ip_conntrack_info ctinfo, 1473 unsigned char **data, AdmissionRequest *arq) 1474{ 1475 const struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info; 1476 int dir = CTINFO2DIR(ctinfo); 1477 __be16 port; 1478 union nf_inet_addr addr; 1479 typeof(set_h225_addr_hook) set_h225_addr; 1480 1481 pr_debug("nf_ct_ras: ARQ\n"); 1482 1483 set_h225_addr = rcu_dereference(set_h225_addr_hook); 1484 if ((arq->options & eAdmissionRequest_destCallSignalAddress) && 1485 get_h225_addr(ct, *data, &arq->destCallSignalAddress, 1486 &addr, &port) && 1487 !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) && 1488 port == info->sig_port[dir] && 1489 set_h225_addr && ct->status & IPS_NAT_MASK) { 1490 /* Answering ARQ */ 1491 return set_h225_addr(skb, data, 0, 1492 &arq->destCallSignalAddress, 1493 &ct->tuplehash[!dir].tuple.dst.u3, 1494 info->sig_port[!dir]); 1495 } 1496 1497 if ((arq->options & eAdmissionRequest_srcCallSignalAddress) && 1498 get_h225_addr(ct, *data, &arq->srcCallSignalAddress, 1499 &addr, &port) && 1500 !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) && 1501 set_h225_addr && ct->status & IPS_NAT_MASK) { 1502 /* Calling ARQ */ 1503 return set_h225_addr(skb, data, 0, 1504 &arq->srcCallSignalAddress, 1505 &ct->tuplehash[!dir].tuple.dst.u3, 1506 port); 1507 } 1508 1509 return 0; 1510} 1511 1512/****************************************************************************/ 1513static int process_acf(struct sk_buff *skb, struct nf_conn *ct, 1514 enum ip_conntrack_info ctinfo, 1515 unsigned char **data, AdmissionConfirm *acf) 1516{ 1517 int dir = CTINFO2DIR(ctinfo); 1518 int ret = 0; 1519 __be16 port; 1520 union nf_inet_addr addr; 1521 struct nf_conntrack_expect *exp; 1522 typeof(set_sig_addr_hook) set_sig_addr; 1523 1524 pr_debug("nf_ct_ras: ACF\n"); 1525 1526 if (!get_h225_addr(ct, *data, &acf->destCallSignalAddress, 1527 &addr, &port)) 1528 return 0; 1529 1530 if (!memcmp(&addr, &ct->tuplehash[dir].tuple.dst.u3, sizeof(addr))) { 1531 /* Answering ACF */ 1532 set_sig_addr = rcu_dereference(set_sig_addr_hook); 1533 if (set_sig_addr && ct->status & IPS_NAT_MASK) 1534 return set_sig_addr(skb, ct, ctinfo, data, 1535 &acf->destCallSignalAddress, 1); 1536 return 0; 1537 } 1538 1539 /* Need new expect */ 1540 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 1541 return -1; 1542 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 1543 &ct->tuplehash[!dir].tuple.src.u3, &addr, 1544 IPPROTO_TCP, NULL, &port); 1545 exp->flags = NF_CT_EXPECT_PERMANENT; 1546 exp->helper = nf_conntrack_helper_q931; 1547 1548 if (nf_ct_expect_related(exp) == 0) { 1549 pr_debug("nf_ct_ras: expect Q.931 "); 1550 nf_ct_dump_tuple(&exp->tuple); 1551 } else 1552 ret = -1; 1553 1554 nf_ct_expect_put(exp); 1555 1556 return ret; 1557} 1558 1559/****************************************************************************/ 1560static int process_lrq(struct sk_buff *skb, struct nf_conn *ct, 1561 enum ip_conntrack_info ctinfo, 1562 unsigned char **data, LocationRequest *lrq) 1563{ 1564 typeof(set_ras_addr_hook) set_ras_addr; 1565 1566 pr_debug("nf_ct_ras: LRQ\n"); 1567 1568 set_ras_addr = rcu_dereference(set_ras_addr_hook); 1569 if (set_ras_addr && ct->status & IPS_NAT_MASK) 1570 return set_ras_addr(skb, ct, ctinfo, data, 1571 &lrq->replyAddress, 1); 1572 return 0; 1573} 1574 1575/****************************************************************************/ 1576static int process_lcf(struct sk_buff *skb, struct nf_conn *ct, 1577 enum ip_conntrack_info ctinfo, 1578 unsigned char **data, LocationConfirm *lcf) 1579{ 1580 int dir = CTINFO2DIR(ctinfo); 1581 int ret = 0; 1582 __be16 port; 1583 union nf_inet_addr addr; 1584 struct nf_conntrack_expect *exp; 1585 1586 pr_debug("nf_ct_ras: LCF\n"); 1587 1588 if (!get_h225_addr(ct, *data, &lcf->callSignalAddress, 1589 &addr, &port)) 1590 return 0; 1591 1592 /* Need new expect for call signal */ 1593 if ((exp = nf_ct_expect_alloc(ct)) == NULL) 1594 return -1; 1595 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), 1596 &ct->tuplehash[!dir].tuple.src.u3, &addr, 1597 IPPROTO_TCP, NULL, &port); 1598 exp->flags = NF_CT_EXPECT_PERMANENT; 1599 exp->helper = nf_conntrack_helper_q931; 1600 1601 if (nf_ct_expect_related(exp) == 0) { 1602 pr_debug("nf_ct_ras: expect Q.931 "); 1603 nf_ct_dump_tuple(&exp->tuple); 1604 } else 1605 ret = -1; 1606 1607 nf_ct_expect_put(exp); 1608 1609 /* Ignore rasAddress */ 1610 1611 return ret; 1612} 1613 1614/****************************************************************************/ 1615static int process_irr(struct sk_buff *skb, struct nf_conn *ct, 1616 enum ip_conntrack_info ctinfo, 1617 unsigned char **data, InfoRequestResponse *irr) 1618{ 1619 int ret; 1620 typeof(set_ras_addr_hook) set_ras_addr; 1621 typeof(set_sig_addr_hook) set_sig_addr; 1622 1623 pr_debug("nf_ct_ras: IRR\n"); 1624 1625 set_ras_addr = rcu_dereference(set_ras_addr_hook); 1626 if (set_ras_addr && ct->status & IPS_NAT_MASK) { 1627 ret = set_ras_addr(skb, ct, ctinfo, data, 1628 &irr->rasAddress, 1); 1629 if (ret < 0) 1630 return -1; 1631 } 1632 1633 set_sig_addr = rcu_dereference(set_sig_addr_hook); 1634 if (set_sig_addr && ct->status & IPS_NAT_MASK) { 1635 ret = set_sig_addr(skb, ct, ctinfo, data, 1636 irr->callSignalAddress.item, 1637 irr->callSignalAddress.count); 1638 if (ret < 0) 1639 return -1; 1640 } 1641 1642 return 0; 1643} 1644 1645/****************************************************************************/ 1646static int process_ras(struct sk_buff *skb, struct nf_conn *ct, 1647 enum ip_conntrack_info ctinfo, 1648 unsigned char **data, RasMessage *ras) 1649{ 1650 switch (ras->choice) { 1651 case eRasMessage_gatekeeperRequest: 1652 return process_grq(skb, ct, ctinfo, data, 1653 &ras->gatekeeperRequest); 1654 case eRasMessage_gatekeeperConfirm: 1655 return process_gcf(skb, ct, ctinfo, data, 1656 &ras->gatekeeperConfirm); 1657 case eRasMessage_registrationRequest: 1658 return process_rrq(skb, ct, ctinfo, data, 1659 &ras->registrationRequest); 1660 case eRasMessage_registrationConfirm: 1661 return process_rcf(skb, ct, ctinfo, data, 1662 &ras->registrationConfirm); 1663 case eRasMessage_unregistrationRequest: 1664 return process_urq(skb, ct, ctinfo, data, 1665 &ras->unregistrationRequest); 1666 case eRasMessage_admissionRequest: 1667 return process_arq(skb, ct, ctinfo, data, 1668 &ras->admissionRequest); 1669 case eRasMessage_admissionConfirm: 1670 return process_acf(skb, ct, ctinfo, data, 1671 &ras->admissionConfirm); 1672 case eRasMessage_locationRequest: 1673 return process_lrq(skb, ct, ctinfo, data, 1674 &ras->locationRequest); 1675 case eRasMessage_locationConfirm: 1676 return process_lcf(skb, ct, ctinfo, data, 1677 &ras->locationConfirm); 1678 case eRasMessage_infoRequestResponse: 1679 return process_irr(skb, ct, ctinfo, data, 1680 &ras->infoRequestResponse); 1681 default: 1682 pr_debug("nf_ct_ras: RAS message %d\n", ras->choice); 1683 break; 1684 } 1685 1686 return 0; 1687} 1688 1689/****************************************************************************/ 1690static int ras_help(struct sk_buff *skb, unsigned int protoff, 1691 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 1692{ 1693 static RasMessage ras; 1694 unsigned char *data; 1695 int datalen = 0; 1696 int ret; 1697 1698 pr_debug("nf_ct_ras: skblen = %u\n", skb->len); 1699 1700 spin_lock_bh(&nf_h323_lock); 1701 1702 /* Get UDP data */ 1703 data = get_udp_data(skb, protoff, &datalen); 1704 if (data == NULL) 1705 goto accept; 1706 pr_debug("nf_ct_ras: RAS message len=%d ", datalen); 1707 nf_ct_dump_tuple(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple); 1708 1709 /* Decode RAS message */ 1710 ret = DecodeRasMessage(data, datalen, &ras); 1711 if (ret < 0) { 1712 pr_debug("nf_ct_ras: decoding error: %s\n", 1713 ret == H323_ERROR_BOUND ? 1714 "out of bound" : "out of range"); 1715 goto accept; 1716 } 1717 1718 /* Process RAS message */ 1719 if (process_ras(skb, ct, ctinfo, &data, &ras) < 0) 1720 goto drop; 1721 1722 accept: 1723 spin_unlock_bh(&nf_h323_lock); 1724 return NF_ACCEPT; 1725 1726 drop: 1727 spin_unlock_bh(&nf_h323_lock); 1728 if (net_ratelimit()) 1729 pr_info("nf_ct_ras: packet dropped\n"); 1730 return NF_DROP; 1731} 1732 1733/****************************************************************************/ 1734static const struct nf_conntrack_expect_policy ras_exp_policy = { 1735 .max_expected = 32, 1736 .timeout = 240, 1737}; 1738 1739static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = { 1740 { 1741 .name = "RAS", 1742 .me = THIS_MODULE, 1743 .tuple.src.l3num = AF_INET, 1744 .tuple.src.u.udp.port = cpu_to_be16(RAS_PORT), 1745 .tuple.dst.protonum = IPPROTO_UDP, 1746 .help = ras_help, 1747 .expect_policy = &ras_exp_policy, 1748 }, 1749 { 1750 .name = "RAS", 1751 .me = THIS_MODULE, 1752 .tuple.src.l3num = AF_INET6, 1753 .tuple.src.u.udp.port = cpu_to_be16(RAS_PORT), 1754 .tuple.dst.protonum = IPPROTO_UDP, 1755 .help = ras_help, 1756 .expect_policy = &ras_exp_policy, 1757 }, 1758}; 1759 1760/****************************************************************************/ 1761static void __exit nf_conntrack_h323_fini(void) 1762{ 1763 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[1]); 1764 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]); 1765 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]); 1766 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]); 1767 nf_conntrack_helper_unregister(&nf_conntrack_helper_h245); 1768 kfree(h323_buffer); 1769 pr_debug("nf_ct_h323: fini\n"); 1770} 1771 1772/****************************************************************************/ 1773static int __init nf_conntrack_h323_init(void) 1774{ 1775 int ret; 1776 1777 h323_buffer = kmalloc(65536, GFP_KERNEL); 1778 if (!h323_buffer) 1779 return -ENOMEM; 1780 ret = nf_conntrack_helper_register(&nf_conntrack_helper_h245); 1781 if (ret < 0) 1782 goto err1; 1783 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]); 1784 if (ret < 0) 1785 goto err2; 1786 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]); 1787 if (ret < 0) 1788 goto err3; 1789 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]); 1790 if (ret < 0) 1791 goto err4; 1792 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]); 1793 if (ret < 0) 1794 goto err5; 1795 pr_debug("nf_ct_h323: init success\n"); 1796 return 0; 1797 1798err5: 1799 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]); 1800err4: 1801 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]); 1802err3: 1803 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]); 1804err2: 1805 nf_conntrack_helper_unregister(&nf_conntrack_helper_h245); 1806err1: 1807 kfree(h323_buffer); 1808 return ret; 1809} 1810 1811/****************************************************************************/ 1812module_init(nf_conntrack_h323_init); 1813module_exit(nf_conntrack_h323_fini); 1814 1815EXPORT_SYMBOL_GPL(get_h225_addr); 1816EXPORT_SYMBOL_GPL(set_h245_addr_hook); 1817EXPORT_SYMBOL_GPL(set_h225_addr_hook); 1818EXPORT_SYMBOL_GPL(set_sig_addr_hook); 1819EXPORT_SYMBOL_GPL(set_ras_addr_hook); 1820EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook); 1821EXPORT_SYMBOL_GPL(nat_t120_hook); 1822EXPORT_SYMBOL_GPL(nat_h245_hook); 1823EXPORT_SYMBOL_GPL(nat_callforwarding_hook); 1824EXPORT_SYMBOL_GPL(nat_q931_hook); 1825 1826MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>"); 1827MODULE_DESCRIPTION("H.323 connection tracking helper"); 1828MODULE_LICENSE("GPL"); 1829MODULE_ALIAS("ip_conntrack_h323"); 1830MODULE_ALIAS_NFCT_HELPER("h323"); 1831