1/*-
2 * alias_skinny.c
3 *
4 * Copyright (c) 2002, 2003 MarcusCom, Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * Author: Joe Marcus Clarke <marcus@FreeBSD.org>
29 *
30 * $FreeBSD$
31 */
32
33#ifdef _KERNEL
34#include <sys/param.h>
35#include <sys/kernel.h>
36#include <sys/module.h>
37#else
38#include <errno.h>
39#include <stdio.h>
40#include <unistd.h>
41#endif
42
43#include <netinet/in_systm.h>
44#include <netinet/in.h>
45#include <netinet/ip.h>
46#include <netinet/tcp.h>
47
48#ifdef _KERNEL
49#include <netinet/libalias/alias_local.h>
50#include <netinet/libalias/alias_mod.h>
51#else
52#include "alias_local.h"
53#include "alias_mod.h"
54#endif
55
56static void
57AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *);
58
59static int
60fingerprint(struct libalias *la, struct alias_data *ah)
61{
62
63	if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL)
64		return (-1);
65	if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort ||
66				    ntohs(*ah->dport) == la->skinnyPort))
67		return (0);
68	return (-1);
69}
70
71static int
72protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah)
73{
74
75        AliasHandleSkinny(la, pip, ah->lnk);
76	return (0);
77}
78
79struct proto_handler handlers[] = {
80	{
81	  .pri = 110,
82	  .dir = IN|OUT,
83	  .proto = TCP,
84	  .fingerprint = &fingerprint,
85	  .protohandler = &protohandler
86	},
87	{ EOH }
88};
89
90static int
91mod_handler(module_t mod, int type, void *data)
92{
93	int error;
94
95	switch (type) {
96	case MOD_LOAD:
97		error = 0;
98		LibAliasAttachHandlers(handlers);
99		break;
100	case MOD_UNLOAD:
101		error = 0;
102		LibAliasDetachHandlers(handlers);
103		break;
104	default:
105		error = EINVAL;
106	}
107	return (error);
108}
109
110#ifdef _KERNEL
111static
112#endif
113moduledata_t alias_mod = {
114       "alias_skinny", mod_handler, NULL
115};
116
117#ifdef	_KERNEL
118DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
119MODULE_VERSION(alias_skinny, 1);
120MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1);
121#endif
122
123/*
124 * alias_skinny.c handles the translation for the Cisco Skinny Station
125 * protocol.  Skinny typically uses TCP port 2000 to set up calls between
126 * a Cisco Call Manager and a Cisco IP phone.  When a phone comes on line,
127 * it first needs to register with the Call Manager.  To do this it sends
128 * a registration message.  This message contains the IP address of the
129 * IP phone.  This message must then be translated to reflect our global
130 * IP address.  Along with the registration message (and usually in the
131 * same packet), the phone sends an IP port message.  This message indicates
132 * the TCP port over which it will communicate.
133 *
134 * When a call is placed from the phone, the Call Manager will send an
135 * Open Receive Channel message to the phone to let the caller know someone
136 * has answered.  The phone then sends back an Open Receive Channel
137 * Acknowledgement.  In this packet, the phone sends its IP address again,
138 * and the UDP port over which the voice traffic should flow.  These values
139 * need translation.  Right after the Open Receive Channel Acknowledgement,
140 * the Call Manager sends a Start Media Transmission message indicating the
141 * call is connected.  This message contains the IP address and UDP port
142 * number of the remote (called) party.  Once this message is translated, the
143 * call can commence.  The called part sends the first UDP packet to the
144 * calling phone at the pre-arranged UDP port in the Open Receive Channel
145 * Acknowledgement.
146 *
147 * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems,
148 * Inc.  All rights reserved.
149*/
150
151/* #define LIBALIAS_DEBUG 1 */
152
153/* Message types that need translating */
154#define REG_MSG         0x00000001
155#define IP_PORT_MSG     0x00000002
156#define OPNRCVCH_ACK    0x00000022
157#define START_MEDIATX   0x0000008a
158
159struct skinny_header {
160	u_int32_t	len;
161	u_int32_t	reserved;
162	u_int32_t	msgId;
163};
164
165struct RegisterMessage {
166	u_int32_t	msgId;
167	char		devName   [16];
168	u_int32_t	uid;
169	u_int32_t	instance;
170	u_int32_t	ipAddr;
171	u_char		devType;
172	u_int32_t	maxStreams;
173};
174
175struct IpPortMessage {
176	u_int32_t	msgId;
177	u_int32_t	stationIpPort;	/* Note: Skinny uses 32-bit port
178					 * numbers */
179};
180
181struct OpenReceiveChannelAck {
182	u_int32_t	msgId;
183	u_int32_t	status;
184	u_int32_t	ipAddr;
185	u_int32_t	port;
186	u_int32_t	passThruPartyID;
187};
188
189struct StartMediaTransmission {
190	u_int32_t	msgId;
191	u_int32_t	conferenceID;
192	u_int32_t	passThruPartyID;
193	u_int32_t	remoteIpAddr;
194	u_int32_t	remotePort;
195	u_int32_t	MSPacket;
196	u_int32_t	payloadCap;
197	u_int32_t	precedence;
198	u_int32_t	silenceSuppression;
199	u_short		maxFramesPerPacket;
200	u_int32_t	G723BitRate;
201};
202
203typedef enum {
204	ClientToServer = 0,
205	ServerToClient = 1
206} ConvDirection;
207
208
209static int
210alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip,
211    struct tcphdr *tc, struct alias_link *lnk,
212    ConvDirection direction)
213{
214	(void)direction;
215
216	reg_msg->ipAddr = (u_int32_t) GetAliasAddress(lnk).s_addr;
217
218	tc->th_sum = 0;
219#ifdef _KERNEL
220	tc->th_x2 = 1;
221#else
222	tc->th_sum = TcpChecksum(pip);
223#endif
224
225	return (0);
226}
227
228static int
229alias_skinny_startmedia(struct StartMediaTransmission *start_media,
230    struct ip *pip, struct tcphdr *tc,
231    struct alias_link *lnk, u_int32_t localIpAddr,
232    ConvDirection direction)
233{
234	struct in_addr dst, src;
235
236	(void)pip;
237	(void)tc;
238	(void)lnk;
239	(void)direction;
240
241	dst.s_addr = start_media->remoteIpAddr;
242	src.s_addr = localIpAddr;
243
244	/*
245	 * XXX I should probably handle in bound global translations as
246	 * well.
247	 */
248
249	return (0);
250}
251
252static int
253alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip,
254    struct tcphdr *tc, struct alias_link *lnk,
255    ConvDirection direction)
256{
257	(void)direction;
258
259	port_msg->stationIpPort = (u_int32_t) ntohs(GetAliasPort(lnk));
260
261	tc->th_sum = 0;
262#ifdef _KERNEL
263	tc->th_x2 = 1;
264#else
265	tc->th_sum = TcpChecksum(pip);
266#endif
267	return (0);
268}
269
270static int
271alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack,
272    struct ip *pip, struct tcphdr *tc,
273    struct alias_link *lnk, u_int32_t * localIpAddr,
274    ConvDirection direction)
275{
276	struct in_addr null_addr;
277	struct alias_link *opnrcv_lnk;
278	u_int32_t localPort;
279
280	(void)lnk;
281	(void)direction;
282
283	*localIpAddr = (u_int32_t) opnrcvch_ack->ipAddr;
284	localPort = opnrcvch_ack->port;
285
286	null_addr.s_addr = INADDR_ANY;
287	opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr,
288	    htons((u_short) opnrcvch_ack->port), 0,
289	    IPPROTO_UDP, 1);
290	opnrcvch_ack->ipAddr = (u_int32_t) GetAliasAddress(opnrcv_lnk).s_addr;
291	opnrcvch_ack->port = (u_int32_t) ntohs(GetAliasPort(opnrcv_lnk));
292
293	tc->th_sum = 0;
294#ifdef _KERNEL
295	tc->th_x2 = 1;
296#else
297	tc->th_sum = TcpChecksum(pip);
298#endif
299	return (0);
300}
301
302static void
303AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk)
304{
305	size_t hlen, tlen, dlen;
306	struct tcphdr *tc;
307	u_int32_t msgId, t, len, lip;
308	struct skinny_header *sd;
309	size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header);
310	ConvDirection direction;
311
312	lip = -1;
313	tc = (struct tcphdr *)ip_next(pip);
314	hlen = (pip->ip_hl + tc->th_off) << 2;
315	tlen = ntohs(pip->ip_len);
316	dlen = tlen - hlen;
317
318	sd = (struct skinny_header *)tcp_next(tc);
319
320	/*
321	 * XXX This direction is reserved for future use.  I still need to
322	 * handle the scenario where the call manager is on the inside, and
323	 * the calling phone is on the global outside.
324	 */
325	if (ntohs(tc->th_dport) == la->skinnyPort) {
326		direction = ClientToServer;
327	} else if (ntohs(tc->th_sport) == la->skinnyPort) {
328		direction = ServerToClient;
329	} else {
330#ifdef LIBALIAS_DEBUG
331		fprintf(stderr,
332		    "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n");
333#endif
334		return;
335	}
336
337	orig_len = dlen;
338	/*
339	 * Skinny packets can contain many messages.  We need to loop
340	 * through the packet using len to determine message boundaries.
341	 * This comes into play big time with port messages being in the
342	 * same packet as register messages.  Also, open receive channel
343	 * acks are usually buried in a packet some 400 bytes long.
344	 */
345	while (dlen >= skinny_hdr_len) {
346		len = (sd->len);
347		msgId = (sd->msgId);
348		t = len;
349
350		if (t > orig_len || t > dlen) {
351#ifdef LIBALIAS_DEBUG
352			fprintf(stderr,
353			    "PacketAlias/Skinny: Not a skinny packet, invalid length \n");
354#endif
355			return;
356		}
357		switch (msgId) {
358		case REG_MSG: {
359			struct RegisterMessage *reg_mesg;
360
361			if (len < (int)sizeof(struct RegisterMessage)) {
362#ifdef LIBALIAS_DEBUG
363				fprintf(stderr,
364				    "PacketAlias/Skinny: Not a skinny packet, bad registration message\n");
365#endif
366				return;
367			}
368			reg_mesg = (struct RegisterMessage *)&sd->msgId;
369#ifdef LIBALIAS_DEBUG
370			fprintf(stderr,
371			    "PacketAlias/Skinny: Received a register message");
372#endif
373			alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction);
374			break;
375		}
376		case IP_PORT_MSG: {
377			struct IpPortMessage *port_mesg;
378
379			if (len < (int)sizeof(struct IpPortMessage)) {
380#ifdef LIBALIAS_DEBUG
381				fprintf(stderr,
382				    "PacketAlias/Skinny: Not a skinny packet, port message\n");
383#endif
384				return;
385			}
386#ifdef LIBALIAS_DEBUG
387			fprintf(stderr,
388			    "PacketAlias/Skinny: Received ipport message\n");
389#endif
390			port_mesg = (struct IpPortMessage *)&sd->msgId;
391			alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction);
392			break;
393		}
394		case OPNRCVCH_ACK: {
395			struct OpenReceiveChannelAck *opnrcvchn_ack;
396
397			if (len < (int)sizeof(struct OpenReceiveChannelAck)) {
398#ifdef LIBALIAS_DEBUG
399				fprintf(stderr,
400				    "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n");
401#endif
402				return;
403			}
404#ifdef LIBALIAS_DEBUG
405			fprintf(stderr,
406			    "PacketAlias/Skinny: Received open rcv channel msg\n");
407#endif
408			opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId;
409			alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction);
410			break;
411		}
412		case START_MEDIATX: {
413			struct StartMediaTransmission *startmedia_tx;
414
415			if (len < (int)sizeof(struct StartMediaTransmission)) {
416#ifdef LIBALIAS_DEBUG
417				fprintf(stderr,
418				    "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n");
419#endif
420				return;
421			}
422			if (lip == -1) {
423#ifdef LIBALIAS_DEBUG
424				fprintf(stderr,
425				    "PacketAlias/Skinny: received a"
426				    " packet,StartMediaTx Message before"
427				    " packet,OpnRcvChnAckMsg\n"
428#endif
429				return;
430			}
431
432#ifdef LIBALIAS_DEBUG
433			fprintf(stderr,
434			    "PacketAlias/Skinny: Received start media trans msg\n");
435#endif
436			startmedia_tx = (struct StartMediaTransmission *)&sd->msgId;
437			alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction);
438			break;
439		}
440		default:
441			break;
442		}
443		/* Place the pointer at the next message in the packet. */
444		dlen -= len + (skinny_hdr_len - sizeof(msgId));
445		sd = (struct skinny_header *)(((char *)&sd->msgId) + len);
446	}
447}
448