2 * H.323 connection tracking helper
4 * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
6 * This source code is licensed under General Public License version 2.
8 * Based on the 'brute force' H.323 connection tracking module by
9 * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
11 * For more information, please see http://nath323.sourceforge.net/
14 #include <linux/config.h>
15 #include <linux/module.h>
16 #include <linux/netfilter.h>
19 #include <linux/netfilter_ipv4/ip_conntrack.h>
20 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
21 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
22 #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
23 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
24 #include <linux/moduleparam.h>
29 #define DEBUGP(format, args...)
33 static unsigned int default_rrq_ttl = 300;
34 module_param(default_rrq_ttl, uint, 0600);
35 MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
37 static int gkrouted_only = 1;
38 module_param(gkrouted_only, int, 0600);
39 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
42 int (*set_h245_addr_hook) (struct sk_buff ** pskb,
43 unsigned char **data, int dataoff,
44 H245_TransportAddress * addr,
45 u_int32_t ip, u_int16_t port);
46 int (*set_h225_addr_hook) (struct sk_buff ** pskb,
47 unsigned char **data, int dataoff,
48 TransportAddress * addr,
49 u_int32_t ip, u_int16_t port);
50 int (*set_sig_addr_hook) (struct sk_buff ** pskb,
51 struct ip_conntrack * ct,
52 enum ip_conntrack_info ctinfo,
54 TransportAddress * addr, int count);
55 int (*set_ras_addr_hook) (struct sk_buff ** pskb,
56 struct ip_conntrack * ct,
57 enum ip_conntrack_info ctinfo,
59 TransportAddress * addr, int count);
60 int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
61 struct ip_conntrack * ct,
62 enum ip_conntrack_info ctinfo,
63 unsigned char **data, int dataoff,
64 H245_TransportAddress * addr,
65 u_int16_t port, u_int16_t rtp_port,
66 struct ip_conntrack_expect * rtp_exp,
67 struct ip_conntrack_expect * rtcp_exp);
68 int (*nat_t120_hook) (struct sk_buff ** pskb,
69 struct ip_conntrack * ct,
70 enum ip_conntrack_info ctinfo,
71 unsigned char **data, int dataoff,
72 H245_TransportAddress * addr, u_int16_t port,
73 struct ip_conntrack_expect * exp);
74 int (*nat_h245_hook) (struct sk_buff ** pskb,
75 struct ip_conntrack * ct,
76 enum ip_conntrack_info ctinfo,
77 unsigned char **data, int dataoff,
78 TransportAddress * addr, u_int16_t port,
79 struct ip_conntrack_expect * exp);
80 int (*nat_q931_hook) (struct sk_buff ** pskb,
81 struct ip_conntrack * ct,
82 enum ip_conntrack_info ctinfo,
83 unsigned char **data, TransportAddress * addr, int idx,
84 u_int16_t port, struct ip_conntrack_expect * exp);
87 static DEFINE_SPINLOCK(ip_h323_lock);
88 static char *h323_buffer;
90 /****************************************************************************/
91 static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
92 enum ip_conntrack_info ctinfo,
93 unsigned char **data, int *datalen, int *dataoff)
95 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
96 int dir = CTINFO2DIR(ctinfo);
97 struct tcphdr _tcph, *th;
105 th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
106 sizeof(_tcph), &_tcph);
110 /* Get TCP data offset */
111 tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
113 /* Get TCP data length */
114 tcpdatalen = (*pskb)->len - tcpdataoff;
115 if (tcpdatalen <= 0) /* No TCP data */
118 if (*data == NULL) { /* first TPKT */
119 /* Get first TPKT pointer */
120 tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
122 BUG_ON(tpkt == NULL);
124 /* Validate TPKT identifier */
125 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
126 /* Netmeeting sends TPKT header and data separately */
127 if (info->tpkt_len[dir] > 0) {
128 DEBUGP("ip_ct_h323: previous packet "
129 "indicated separate TPKT data of %hu "
130 "bytes\n", info->tpkt_len[dir]);
131 if (info->tpkt_len[dir] <= tcpdatalen) {
132 /* Yes, there was a TPKT header
135 *datalen = info->tpkt_len[dir];
140 /* Fragmented TPKT */
142 printk("ip_ct_h323: "
143 "fragmented TPKT\n");
147 /* It is not even a TPKT */
151 } else { /* Next TPKT */
152 tpktoff = *dataoff + *datalen;
153 tcpdatalen -= tpktoff;
154 if (tcpdatalen <= 4) /* No more TPKT */
156 tpkt = *data + *datalen;
158 /* Validate TPKT identifier */
159 if (tpkt[0] != 0x03 || tpkt[1] != 0)
163 /* Validate TPKT length */
164 tpktlen = tpkt[2] * 256 + tpkt[3];
167 if (tpktlen > tcpdatalen) {
168 if (tcpdatalen == 4) { /* Separate TPKT header */
169 /* Netmeeting sends TPKT header and data separately */
170 DEBUGP("ip_ct_h323: separate TPKT header indicates "
171 "there will be TPKT data of %hu bytes\n",
173 info->tpkt_len[dir] = tpktlen - 4;
178 printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
182 /* This is the encapsulated data */
184 *datalen = tpktlen - 4;
185 *dataoff = tpktoff + 4;
188 /* Clear TPKT length */
189 info->tpkt_len[dir] = 0;
193 info->tpkt_len[dir] = 0;
197 /****************************************************************************/
198 static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
199 u_int32_t * ip, u_int16_t * port)
203 if (addr->choice != eH245_TransportAddress_unicastAddress ||
204 addr->unicastAddress.choice != eUnicastAddress_iPAddress)
207 p = data + addr->unicastAddress.iPAddress.network;
208 *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
209 *port = (p[4] << 8) | (p[5]);
214 /****************************************************************************/
215 static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
216 enum ip_conntrack_info ctinfo,
217 unsigned char **data, int dataoff,
218 H245_TransportAddress * addr)
220 int dir = CTINFO2DIR(ctinfo);
225 struct ip_conntrack_expect *rtp_exp;
226 struct ip_conntrack_expect *rtcp_exp;
228 /* Read RTP or RTCP address */
229 if (!get_h245_addr(*data, addr, &ip, &port) ||
230 ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
233 /* RTP port is even */
234 rtp_port = port & (~1);
236 /* Create expect for RTP */
237 if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
239 rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
240 rtp_exp->tuple.src.u.udp.port = 0;
241 rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
242 rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
243 rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
244 rtp_exp->mask.src.ip = 0xFFFFFFFF;
245 rtp_exp->mask.src.u.udp.port = 0;
246 rtp_exp->mask.dst.ip = 0xFFFFFFFF;
247 rtp_exp->mask.dst.u.udp.port = 0xFFFF;
248 rtp_exp->mask.dst.protonum = 0xFF;
251 /* Create expect for RTCP */
252 if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
253 ip_conntrack_expect_put(rtp_exp);
256 rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
257 rtcp_exp->tuple.src.u.udp.port = 0;
258 rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
259 rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
260 rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
261 rtcp_exp->mask.src.ip = 0xFFFFFFFF;
262 rtcp_exp->mask.src.u.udp.port = 0;
263 rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
264 rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
265 rtcp_exp->mask.dst.protonum = 0xFF;
268 if (ct->tuplehash[dir].tuple.src.ip !=
269 ct->tuplehash[!dir].tuple.dst.ip && nat_rtp_rtcp_hook) {
271 ret = nat_rtp_rtcp_hook(pskb, ct, ctinfo, data, dataoff,
272 addr, port, rtp_port, rtp_exp,
274 } else { /* Conntrack only */
275 rtp_exp->expectfn = NULL;
276 rtcp_exp->expectfn = NULL;
278 if (ip_conntrack_expect_related(rtp_exp) == 0) {
279 if (ip_conntrack_expect_related(rtcp_exp) == 0) {
280 DEBUGP("ip_ct_h323: expect RTP "
281 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
282 NIPQUAD(rtp_exp->tuple.src.ip),
283 ntohs(rtp_exp->tuple.src.u.udp.port),
284 NIPQUAD(rtp_exp->tuple.dst.ip),
285 ntohs(rtp_exp->tuple.dst.u.udp.port));
286 DEBUGP("ip_ct_h323: expect RTCP "
287 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
288 NIPQUAD(rtcp_exp->tuple.src.ip),
289 ntohs(rtcp_exp->tuple.src.u.udp.port),
290 NIPQUAD(rtcp_exp->tuple.dst.ip),
291 ntohs(rtcp_exp->tuple.dst.u.udp.port));
293 ip_conntrack_unexpect_related(rtp_exp);
300 ip_conntrack_expect_put(rtp_exp);
301 ip_conntrack_expect_put(rtcp_exp);
306 /****************************************************************************/
307 static int expect_t120(struct sk_buff **pskb,
308 struct ip_conntrack *ct,
309 enum ip_conntrack_info ctinfo,
310 unsigned char **data, int dataoff,
311 H245_TransportAddress * addr)
313 int dir = CTINFO2DIR(ctinfo);
317 struct ip_conntrack_expect *exp = NULL;
319 /* Read T.120 address */
320 if (!get_h245_addr(*data, addr, &ip, &port) ||
321 ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
324 /* Create expect for T.120 connections */
325 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
327 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
328 exp->tuple.src.u.tcp.port = 0;
329 exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
330 exp->tuple.dst.u.tcp.port = htons(port);
331 exp->tuple.dst.protonum = IPPROTO_TCP;
332 exp->mask.src.ip = 0xFFFFFFFF;
333 exp->mask.src.u.tcp.port = 0;
334 exp->mask.dst.ip = 0xFFFFFFFF;
335 exp->mask.dst.u.tcp.port = 0xFFFF;
336 exp->mask.dst.protonum = 0xFF;
337 exp->flags = IP_CT_EXPECT_PERMANENT; /* Accept multiple channels */
339 if (ct->tuplehash[dir].tuple.src.ip !=
340 ct->tuplehash[!dir].tuple.dst.ip && nat_t120_hook) {
342 ret = nat_t120_hook(pskb, ct, ctinfo, data, dataoff, addr,
344 } else { /* Conntrack only */
345 exp->expectfn = NULL;
346 if (ip_conntrack_expect_related(exp) == 0) {
347 DEBUGP("ip_ct_h323: expect T.120 "
348 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
349 NIPQUAD(exp->tuple.src.ip),
350 ntohs(exp->tuple.src.u.tcp.port),
351 NIPQUAD(exp->tuple.dst.ip),
352 ntohs(exp->tuple.dst.u.tcp.port));
357 ip_conntrack_expect_put(exp);
362 /****************************************************************************/
363 static int process_h245_channel(struct sk_buff **pskb,
364 struct ip_conntrack *ct,
365 enum ip_conntrack_info ctinfo,
366 unsigned char **data, int dataoff,
367 H2250LogicalChannelParameters * channel)
371 if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
373 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
374 &channel->mediaChannel);
380 options & eH2250LogicalChannelParameters_mediaControlChannel) {
382 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
383 &channel->mediaControlChannel);
391 /****************************************************************************/
392 static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
393 enum ip_conntrack_info ctinfo,
394 unsigned char **data, int dataoff,
395 OpenLogicalChannel * olc)
399 DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
401 if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
402 eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
404 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
406 forwardLogicalChannelParameters.
408 h2250LogicalChannelParameters);
414 eOpenLogicalChannel_reverseLogicalChannelParameters) &&
415 (olc->reverseLogicalChannelParameters.options &
416 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
417 && (olc->reverseLogicalChannelParameters.multiplexParameters.
419 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
422 process_h245_channel(pskb, ct, ctinfo, data, dataoff,
424 reverseLogicalChannelParameters.
426 h2250LogicalChannelParameters);
431 if ((olc->options & eOpenLogicalChannel_separateStack) &&
432 olc->forwardLogicalChannelParameters.dataType.choice ==
434 olc->forwardLogicalChannelParameters.dataType.data.application.
435 choice == eDataApplicationCapability_application_t120 &&
436 olc->forwardLogicalChannelParameters.dataType.data.application.
437 t120.choice == eDataProtocolCapability_separateLANStack &&
438 olc->separateStack.networkAddress.choice ==
439 eNetworkAccessParameters_networkAddress_localAreaAddress) {
440 ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
441 &olc->separateStack.networkAddress.
450 /****************************************************************************/
451 static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
452 enum ip_conntrack_info ctinfo,
453 unsigned char **data, int dataoff,
454 OpenLogicalChannelAck * olca)
456 H2250LogicalChannelAckParameters *ack;
459 DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
462 eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
463 (olca->reverseLogicalChannelParameters.options &
464 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
465 && (olca->reverseLogicalChannelParameters.multiplexParameters.
467 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
469 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
471 reverseLogicalChannelParameters.
473 h2250LogicalChannelParameters);
479 eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
480 (olca->forwardMultiplexAckParameters.choice ==
481 eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
483 ack = &olca->forwardMultiplexAckParameters.
484 h2250LogicalChannelAckParameters;
486 eH2250LogicalChannelAckParameters_mediaChannel) {
488 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
495 eH2250LogicalChannelAckParameters_mediaControlChannel) {
497 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
498 &ack->mediaControlChannel);
507 /****************************************************************************/
508 static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
509 enum ip_conntrack_info ctinfo,
510 unsigned char **data, int dataoff,
511 MultimediaSystemControlMessage * mscm)
513 switch (mscm->choice) {
514 case eMultimediaSystemControlMessage_request:
515 if (mscm->request.choice ==
516 eRequestMessage_openLogicalChannel) {
517 return process_olc(pskb, ct, ctinfo, data, dataoff,
518 &mscm->request.openLogicalChannel);
520 DEBUGP("ip_ct_h323: H.245 Request %d\n",
521 mscm->request.choice);
523 case eMultimediaSystemControlMessage_response:
524 if (mscm->response.choice ==
525 eResponseMessage_openLogicalChannelAck) {
526 return process_olca(pskb, ct, ctinfo, data, dataoff,
528 openLogicalChannelAck);
530 DEBUGP("ip_ct_h323: H.245 Response %d\n",
531 mscm->response.choice);
534 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
541 /****************************************************************************/
542 static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
543 enum ip_conntrack_info ctinfo)
545 static MultimediaSystemControlMessage mscm;
546 unsigned char *data = NULL;
551 /* Until there's been traffic both ways, don't look in packets. */
552 if (ctinfo != IP_CT_ESTABLISHED
553 && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
556 DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
558 spin_lock_bh(&ip_h323_lock);
560 /* Process each TPKT */
561 while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
562 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
563 NIPQUAD((*pskb)->nh.iph->saddr),
564 NIPQUAD((*pskb)->nh.iph->daddr), datalen);
566 /* Decode H.245 signal */
567 ret = DecodeMultimediaSystemControlMessage(data, datalen,
571 printk("ip_ct_h245: decoding error: %s\n",
572 ret == H323_ERROR_BOUND ?
573 "out of bound" : "out of range");
574 /* We don't drop when decoding error */
578 /* Process H.245 signal */
579 if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
583 spin_unlock_bh(&ip_h323_lock);
587 spin_unlock_bh(&ip_h323_lock);
589 printk("ip_ct_h245: packet dropped\n");
593 /****************************************************************************/
594 static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
597 .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
599 .tuple = {.dst = {.protonum = IPPROTO_TCP}},
600 .mask = {.src = {.u = {0xFFFF}},
601 .dst = {.protonum = 0xFF}},
605 /****************************************************************************/
606 void ip_conntrack_h245_expect(struct ip_conntrack *new,
607 struct ip_conntrack_expect *this)
609 write_lock_bh(&ip_conntrack_lock);
610 new->helper = &ip_conntrack_helper_h245;
611 write_unlock_bh(&ip_conntrack_lock);
614 /****************************************************************************/
615 int get_h225_addr(unsigned char *data, TransportAddress * addr,
616 u_int32_t * ip, u_int16_t * port)
620 if (addr->choice != eTransportAddress_ipAddress)
623 p = data + addr->ipAddress.ip;
624 *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
625 *port = (p[4] << 8) | (p[5]);
630 /****************************************************************************/
631 static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
632 enum ip_conntrack_info ctinfo,
633 unsigned char **data, int dataoff,
634 TransportAddress * addr)
636 int dir = CTINFO2DIR(ctinfo);
640 struct ip_conntrack_expect *exp = NULL;
642 /* Read h245Address */
643 if (!get_h225_addr(*data, addr, &ip, &port) ||
644 ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
647 /* Create expect for h245 connection */
648 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
650 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
651 exp->tuple.src.u.tcp.port = 0;
652 exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
653 exp->tuple.dst.u.tcp.port = htons(port);
654 exp->tuple.dst.protonum = IPPROTO_TCP;
655 exp->mask.src.ip = 0xFFFFFFFF;
656 exp->mask.src.u.tcp.port = 0;
657 exp->mask.dst.ip = 0xFFFFFFFF;
658 exp->mask.dst.u.tcp.port = 0xFFFF;
659 exp->mask.dst.protonum = 0xFF;
662 if (ct->tuplehash[dir].tuple.src.ip !=
663 ct->tuplehash[!dir].tuple.dst.ip && nat_h245_hook) {
665 ret = nat_h245_hook(pskb, ct, ctinfo, data, dataoff, addr,
667 } else { /* Conntrack only */
668 exp->expectfn = ip_conntrack_h245_expect;
670 if (ip_conntrack_expect_related(exp) == 0) {
671 DEBUGP("ip_ct_q931: expect H.245 "
672 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
673 NIPQUAD(exp->tuple.src.ip),
674 ntohs(exp->tuple.src.u.tcp.port),
675 NIPQUAD(exp->tuple.dst.ip),
676 ntohs(exp->tuple.dst.u.tcp.port));
681 ip_conntrack_expect_put(exp);
686 /****************************************************************************/
687 static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
688 enum ip_conntrack_info ctinfo,
689 unsigned char **data, int dataoff,
692 int dir = CTINFO2DIR(ctinfo);
698 DEBUGP("ip_ct_q931: Setup\n");
700 if (setup->options & eSetup_UUIE_h245Address) {
701 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
702 &setup->h245Address);
707 if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
708 (set_h225_addr_hook) &&
709 get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
710 ip != ct->tuplehash[!dir].tuple.src.ip) {
711 DEBUGP("ip_ct_q931: set destCallSignalAddress "
712 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
714 NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
715 ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
716 ret = set_h225_addr_hook(pskb, data, dataoff,
717 &setup->destCallSignalAddress,
718 ct->tuplehash[!dir].tuple.src.ip,
719 ntohs(ct->tuplehash[!dir].tuple.src.
725 if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
726 (set_h225_addr_hook) &&
727 get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
728 && ip != ct->tuplehash[!dir].tuple.dst.ip) {
729 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
730 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
732 NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
733 ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
734 ret = set_h225_addr_hook(pskb, data, dataoff,
735 &setup->sourceCallSignalAddress,
736 ct->tuplehash[!dir].tuple.dst.ip,
737 ntohs(ct->tuplehash[!dir].tuple.dst.
743 if (setup->options & eSetup_UUIE_fastStart) {
744 for (i = 0; i < setup->fastStart.count; i++) {
745 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
746 &setup->fastStart.item[i]);
755 /****************************************************************************/
756 static int process_callproceeding(struct sk_buff **pskb,
757 struct ip_conntrack *ct,
758 enum ip_conntrack_info ctinfo,
759 unsigned char **data, int dataoff,
760 CallProceeding_UUIE * callproc)
765 DEBUGP("ip_ct_q931: CallProceeding\n");
767 if (callproc->options & eCallProceeding_UUIE_h245Address) {
768 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
769 &callproc->h245Address);
774 if (callproc->options & eCallProceeding_UUIE_fastStart) {
775 for (i = 0; i < callproc->fastStart.count; i++) {
776 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
777 &callproc->fastStart.item[i]);
786 /****************************************************************************/
787 static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
788 enum ip_conntrack_info ctinfo,
789 unsigned char **data, int dataoff,
790 Connect_UUIE * connect)
795 DEBUGP("ip_ct_q931: Connect\n");
797 if (connect->options & eConnect_UUIE_h245Address) {
798 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
799 &connect->h245Address);
804 if (connect->options & eConnect_UUIE_fastStart) {
805 for (i = 0; i < connect->fastStart.count; i++) {
806 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
807 &connect->fastStart.item[i]);
816 /****************************************************************************/
817 static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
818 enum ip_conntrack_info ctinfo,
819 unsigned char **data, int dataoff,
820 Alerting_UUIE * alert)
825 DEBUGP("ip_ct_q931: Alerting\n");
827 if (alert->options & eAlerting_UUIE_h245Address) {
828 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
829 &alert->h245Address);
834 if (alert->options & eAlerting_UUIE_fastStart) {
835 for (i = 0; i < alert->fastStart.count; i++) {
836 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
837 &alert->fastStart.item[i]);
846 /****************************************************************************/
847 static int process_information(struct sk_buff **pskb,
848 struct ip_conntrack *ct,
849 enum ip_conntrack_info ctinfo,
850 unsigned char **data, int dataoff,
851 Information_UUIE * info)
856 DEBUGP("ip_ct_q931: Information\n");
858 if (info->options & eInformation_UUIE_fastStart) {
859 for (i = 0; i < info->fastStart.count; i++) {
860 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
861 &info->fastStart.item[i]);
870 /****************************************************************************/
871 static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
872 enum ip_conntrack_info ctinfo,
873 unsigned char **data, int dataoff,
874 Facility_UUIE * facility)
879 DEBUGP("ip_ct_q931: Facility\n");
881 if (facility->options & eFacility_UUIE_h245Address) {
882 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
883 &facility->h245Address);
888 if (facility->options & eFacility_UUIE_fastStart) {
889 for (i = 0; i < facility->fastStart.count; i++) {
890 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
891 &facility->fastStart.item[i]);
900 /****************************************************************************/
901 static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
902 enum ip_conntrack_info ctinfo,
903 unsigned char **data, int dataoff,
904 Progress_UUIE * progress)
909 DEBUGP("ip_ct_q931: Progress\n");
911 if (progress->options & eProgress_UUIE_h245Address) {
912 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
913 &progress->h245Address);
918 if (progress->options & eProgress_UUIE_fastStart) {
919 for (i = 0; i < progress->fastStart.count; i++) {
920 ret = process_olc(pskb, ct, ctinfo, data, dataoff,
921 &progress->fastStart.item[i]);
930 /****************************************************************************/
931 static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
932 enum ip_conntrack_info ctinfo,
933 unsigned char **data, int dataoff, Q931 * q931)
935 H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
939 switch (pdu->h323_message_body.choice) {
940 case eH323_UU_PDU_h323_message_body_setup:
941 ret = process_setup(pskb, ct, ctinfo, data, dataoff,
942 &pdu->h323_message_body.setup);
944 case eH323_UU_PDU_h323_message_body_callProceeding:
945 ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
946 &pdu->h323_message_body.
949 case eH323_UU_PDU_h323_message_body_connect:
950 ret = process_connect(pskb, ct, ctinfo, data, dataoff,
951 &pdu->h323_message_body.connect);
953 case eH323_UU_PDU_h323_message_body_alerting:
954 ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
955 &pdu->h323_message_body.alerting);
957 case eH323_UU_PDU_h323_message_body_information:
958 ret = process_information(pskb, ct, ctinfo, data, dataoff,
959 &pdu->h323_message_body.
962 case eH323_UU_PDU_h323_message_body_facility:
963 ret = process_facility(pskb, ct, ctinfo, data, dataoff,
964 &pdu->h323_message_body.facility);
966 case eH323_UU_PDU_h323_message_body_progress:
967 ret = process_progress(pskb, ct, ctinfo, data, dataoff,
968 &pdu->h323_message_body.progress);
971 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
972 pdu->h323_message_body.choice);
979 if (pdu->options & eH323_UU_PDU_h245Control) {
980 for (i = 0; i < pdu->h245Control.count; i++) {
981 ret = process_h245(pskb, ct, ctinfo, data, dataoff,
982 &pdu->h245Control.item[i]);
991 /****************************************************************************/
992 static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
993 enum ip_conntrack_info ctinfo)
996 unsigned char *data = NULL;
1001 /* Until there's been traffic both ways, don't look in packets. */
1002 if (ctinfo != IP_CT_ESTABLISHED
1003 && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
1006 DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
1008 spin_lock_bh(&ip_h323_lock);
1010 /* Process each TPKT */
1011 while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
1012 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1013 NIPQUAD((*pskb)->nh.iph->saddr),
1014 NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1016 /* Decode Q.931 signal */
1017 ret = DecodeQ931(data, datalen, &q931);
1019 if (net_ratelimit())
1020 printk("ip_ct_q931: decoding error: %s\n",
1021 ret == H323_ERROR_BOUND ?
1022 "out of bound" : "out of range");
1023 /* We don't drop when decoding error */
1027 /* Process Q.931 signal */
1028 if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
1032 spin_unlock_bh(&ip_h323_lock);
1036 spin_unlock_bh(&ip_h323_lock);
1037 if (net_ratelimit())
1038 printk("ip_ct_q931: packet dropped\n");
1042 /****************************************************************************/
1043 static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
1046 .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
1048 .tuple = {.src = {.u = {__constant_htons(Q931_PORT)}},
1049 .dst = {.protonum = IPPROTO_TCP}},
1050 .mask = {.src = {.u = {0xFFFF}},
1051 .dst = {.protonum = 0xFF}},
1055 /****************************************************************************/
1056 void ip_conntrack_q931_expect(struct ip_conntrack *new,
1057 struct ip_conntrack_expect *this)
1059 write_lock_bh(&ip_conntrack_lock);
1060 new->helper = &ip_conntrack_helper_q931;
1061 write_unlock_bh(&ip_conntrack_lock);
1064 /****************************************************************************/
1065 static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
1067 struct udphdr _uh, *uh;
1070 uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
1074 dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
1075 if (dataoff >= (*pskb)->len)
1077 *datalen = (*pskb)->len - dataoff;
1078 return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
1081 /****************************************************************************/
1082 static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
1083 u_int32_t ip, u_int16_t port)
1085 struct ip_conntrack_expect *exp;
1086 struct ip_conntrack_tuple tuple;
1089 tuple.src.u.tcp.port = 0;
1091 tuple.dst.u.tcp.port = htons(port);
1092 tuple.dst.protonum = IPPROTO_TCP;
1094 exp = __ip_conntrack_expect_find(&tuple);
1095 if (exp && exp->master == ct)
1100 /****************************************************************************/
1101 static int set_expect_timeout(struct ip_conntrack_expect *exp,
1104 if (!exp || !del_timer(&exp->timeout))
1107 exp->timeout.expires = jiffies + timeout * HZ;
1108 add_timer(&exp->timeout);
1113 /****************************************************************************/
1114 static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
1115 enum ip_conntrack_info ctinfo,
1116 unsigned char **data,
1117 TransportAddress * addr, int count)
1119 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1120 int dir = CTINFO2DIR(ctinfo);
1125 struct ip_conntrack_expect *exp;
1127 /* Look for the first related address */
1128 for (i = 0; i < count; i++) {
1129 if (get_h225_addr(*data, &addr[i], &ip, &port) &&
1130 ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
1134 if (i >= count) /* Not found */
1137 /* Create expect for Q.931 */
1138 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1140 exp->tuple.src.ip = gkrouted_only ? /* only accept calls from GK? */
1141 ct->tuplehash[!dir].tuple.src.ip : 0;
1142 exp->tuple.src.u.tcp.port = 0;
1143 exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
1144 exp->tuple.dst.u.tcp.port = htons(port);
1145 exp->tuple.dst.protonum = IPPROTO_TCP;
1146 exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
1147 exp->mask.src.u.tcp.port = 0;
1148 exp->mask.dst.ip = 0xFFFFFFFF;
1149 exp->mask.dst.u.tcp.port = 0xFFFF;
1150 exp->mask.dst.protonum = 0xFF;
1151 exp->flags = IP_CT_EXPECT_PERMANENT; /* Accept multiple calls */
1153 if (nat_q931_hook) { /* Need NAT */
1154 ret = nat_q931_hook(pskb, ct, ctinfo, data, addr, i,
1156 } else { /* Conntrack only */
1157 exp->expectfn = ip_conntrack_q931_expect;
1159 if (ip_conntrack_expect_related(exp) == 0) {
1160 DEBUGP("ip_ct_ras: expect Q.931 "
1161 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1162 NIPQUAD(exp->tuple.src.ip),
1163 ntohs(exp->tuple.src.u.tcp.port),
1164 NIPQUAD(exp->tuple.dst.ip),
1165 ntohs(exp->tuple.dst.u.tcp.port));
1167 /* Save port for looking up expect in processing RCF */
1168 info->sig_port[dir] = port;
1173 ip_conntrack_expect_put(exp);
1178 /****************************************************************************/
1179 static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
1180 enum ip_conntrack_info ctinfo,
1181 unsigned char **data, GatekeeperRequest * grq)
1183 DEBUGP("ip_ct_ras: GRQ\n");
1185 if (set_ras_addr_hook) /* NATed */
1186 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1187 &grq->rasAddress, 1);
1191 /* Declare before using */
1192 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1193 struct ip_conntrack_expect *this);
1195 /****************************************************************************/
1196 static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1197 enum ip_conntrack_info ctinfo,
1198 unsigned char **data, GatekeeperConfirm * gcf)
1200 int dir = CTINFO2DIR(ctinfo);
1204 struct ip_conntrack_expect *exp;
1206 DEBUGP("ip_ct_ras: GCF\n");
1208 if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
1211 /* Registration port is the same as discovery port */
1212 if (ip == ct->tuplehash[dir].tuple.src.ip &&
1213 port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
1216 /* Avoid RAS expectation loops. A GCF is never expected. */
1217 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1220 /* Need new expect */
1221 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1223 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1224 exp->tuple.src.u.tcp.port = 0;
1225 exp->tuple.dst.ip = ip;
1226 exp->tuple.dst.u.tcp.port = htons(port);
1227 exp->tuple.dst.protonum = IPPROTO_UDP;
1228 exp->mask.src.ip = 0xFFFFFFFF;
1229 exp->mask.src.u.tcp.port = 0;
1230 exp->mask.dst.ip = 0xFFFFFFFF;
1231 exp->mask.dst.u.tcp.port = 0xFFFF;
1232 exp->mask.dst.protonum = 0xFF;
1234 exp->expectfn = ip_conntrack_ras_expect;
1235 if (ip_conntrack_expect_related(exp) == 0) {
1236 DEBUGP("ip_ct_ras: expect RAS "
1237 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1238 NIPQUAD(exp->tuple.src.ip),
1239 ntohs(exp->tuple.src.u.tcp.port),
1240 NIPQUAD(exp->tuple.dst.ip),
1241 ntohs(exp->tuple.dst.u.tcp.port));
1245 ip_conntrack_expect_put(exp);
1250 /****************************************************************************/
1251 static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1252 enum ip_conntrack_info ctinfo,
1253 unsigned char **data, RegistrationRequest * rrq)
1255 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1258 DEBUGP("ip_ct_ras: RRQ\n");
1260 ret = expect_q931(pskb, ct, ctinfo, data,
1261 rrq->callSignalAddress.item,
1262 rrq->callSignalAddress.count);
1266 if (set_ras_addr_hook) {
1267 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1268 rrq->rasAddress.item,
1269 rrq->rasAddress.count);
1274 if (rrq->options & eRegistrationRequest_timeToLive) {
1275 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1276 info->timeout = rrq->timeToLive;
1278 info->timeout = default_rrq_ttl;
1283 /****************************************************************************/
1284 static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1285 enum ip_conntrack_info ctinfo,
1286 unsigned char **data, RegistrationConfirm * rcf)
1288 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1289 int dir = CTINFO2DIR(ctinfo);
1291 struct ip_conntrack_expect *exp;
1293 DEBUGP("ip_ct_ras: RCF\n");
1295 if (set_sig_addr_hook) {
1296 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1297 rcf->callSignalAddress.item,
1298 rcf->callSignalAddress.count);
1303 if (rcf->options & eRegistrationConfirm_timeToLive) {
1304 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1305 info->timeout = rcf->timeToLive;
1308 if (info->timeout > 0) {
1310 ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1312 ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
1314 /* Set expect timeout */
1315 read_lock_bh(&ip_conntrack_lock);
1316 exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
1317 info->sig_port[!dir]);
1319 DEBUGP("ip_ct_ras: set Q.931 expect "
1320 "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1321 "timeout to %u seconds\n",
1322 NIPQUAD(exp->tuple.src.ip),
1323 ntohs(exp->tuple.src.u.tcp.port),
1324 NIPQUAD(exp->tuple.dst.ip),
1325 ntohs(exp->tuple.dst.u.tcp.port),
1327 set_expect_timeout(exp, info->timeout);
1329 read_unlock_bh(&ip_conntrack_lock);
1335 /****************************************************************************/
1336 static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
1337 enum ip_conntrack_info ctinfo,
1338 unsigned char **data, UnregistrationRequest * urq)
1340 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1341 int dir = CTINFO2DIR(ctinfo);
1344 DEBUGP("ip_ct_ras: URQ\n");
1346 if (set_sig_addr_hook) {
1347 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1348 urq->callSignalAddress.item,
1349 urq->callSignalAddress.count);
1354 /* Clear old expect */
1355 ip_ct_remove_expectations(ct);
1356 info->sig_port[dir] = 0;
1357 info->sig_port[!dir] = 0;
1359 /* Give it 30 seconds for UCF or URJ */
1360 ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
1365 /****************************************************************************/
1366 static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
1367 enum ip_conntrack_info ctinfo,
1368 unsigned char **data, AdmissionRequest * arq)
1370 struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1371 int dir = CTINFO2DIR(ctinfo);
1375 DEBUGP("ip_ct_ras: ARQ\n");
1377 if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1378 get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
1379 ip == ct->tuplehash[dir].tuple.src.ip &&
1380 port == info->sig_port[dir] && set_h225_addr_hook) {
1382 return set_h225_addr_hook(pskb, data, 0,
1383 &arq->destCallSignalAddress,
1384 ct->tuplehash[!dir].tuple.dst.ip,
1385 info->sig_port[!dir]);
1388 if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1389 get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
1390 ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr_hook) {
1392 return set_h225_addr_hook(pskb, data, 0,
1393 &arq->srcCallSignalAddress,
1394 ct->tuplehash[!dir].tuple.dst.ip,
1401 /****************************************************************************/
1402 static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
1403 enum ip_conntrack_info ctinfo,
1404 unsigned char **data, AdmissionConfirm * acf)
1406 int dir = CTINFO2DIR(ctinfo);
1410 struct ip_conntrack_expect *exp;
1412 DEBUGP("ip_ct_ras: ACF\n");
1414 if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
1417 if (ip == ct->tuplehash[dir].tuple.dst.ip) { /* Answering ACF */
1418 if (set_sig_addr_hook)
1419 return set_sig_addr_hook(pskb, ct, ctinfo, data,
1420 &acf->destCallSignalAddress,
1425 /* Need new expect */
1426 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1428 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1429 exp->tuple.src.u.tcp.port = 0;
1430 exp->tuple.dst.ip = ip;
1431 exp->tuple.dst.u.tcp.port = htons(port);
1432 exp->tuple.dst.protonum = IPPROTO_TCP;
1433 exp->mask.src.ip = 0xFFFFFFFF;
1434 exp->mask.src.u.tcp.port = 0;
1435 exp->mask.dst.ip = 0xFFFFFFFF;
1436 exp->mask.dst.u.tcp.port = 0xFFFF;
1437 exp->mask.dst.protonum = 0xFF;
1438 exp->flags = IP_CT_EXPECT_PERMANENT;
1439 exp->expectfn = ip_conntrack_q931_expect;
1441 if (ip_conntrack_expect_related(exp) == 0) {
1442 DEBUGP("ip_ct_ras: expect Q.931 "
1443 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1444 NIPQUAD(exp->tuple.src.ip),
1445 ntohs(exp->tuple.src.u.tcp.port),
1446 NIPQUAD(exp->tuple.dst.ip),
1447 ntohs(exp->tuple.dst.u.tcp.port));
1451 ip_conntrack_expect_put(exp);
1456 /****************************************************************************/
1457 static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1458 enum ip_conntrack_info ctinfo,
1459 unsigned char **data, LocationRequest * lrq)
1461 DEBUGP("ip_ct_ras: LRQ\n");
1463 if (set_ras_addr_hook)
1464 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1465 &lrq->replyAddress, 1);
1469 /****************************************************************************/
1470 static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1471 enum ip_conntrack_info ctinfo,
1472 unsigned char **data, LocationConfirm * lcf)
1474 int dir = CTINFO2DIR(ctinfo);
1478 struct ip_conntrack_expect *exp = NULL;
1480 DEBUGP("ip_ct_ras: LCF\n");
1482 if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
1485 /* Need new expect for call signal */
1486 if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1488 exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1489 exp->tuple.src.u.tcp.port = 0;
1490 exp->tuple.dst.ip = ip;
1491 exp->tuple.dst.u.tcp.port = htons(port);
1492 exp->tuple.dst.protonum = IPPROTO_TCP;
1493 exp->mask.src.ip = 0xFFFFFFFF;
1494 exp->mask.src.u.tcp.port = 0;
1495 exp->mask.dst.ip = 0xFFFFFFFF;
1496 exp->mask.dst.u.tcp.port = 0xFFFF;
1497 exp->mask.dst.protonum = 0xFF;
1498 exp->flags = IP_CT_EXPECT_PERMANENT;
1499 exp->expectfn = ip_conntrack_q931_expect;
1501 if (ip_conntrack_expect_related(exp) == 0) {
1502 DEBUGP("ip_ct_ras: expect Q.931 "
1503 "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1504 NIPQUAD(exp->tuple.src.ip),
1505 ntohs(exp->tuple.src.u.tcp.port),
1506 NIPQUAD(exp->tuple.dst.ip),
1507 ntohs(exp->tuple.dst.u.tcp.port));
1511 ip_conntrack_expect_put(exp);
1513 /* Ignore rasAddress */
1518 /****************************************************************************/
1519 static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
1520 enum ip_conntrack_info ctinfo,
1521 unsigned char **data, InfoRequestResponse * irr)
1525 DEBUGP("ip_ct_ras: IRR\n");
1527 if (set_ras_addr_hook) {
1528 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1529 &irr->rasAddress, 1);
1534 if (set_sig_addr_hook) {
1535 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1536 irr->callSignalAddress.item,
1537 irr->callSignalAddress.count);
1545 /****************************************************************************/
1546 static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
1547 enum ip_conntrack_info ctinfo,
1548 unsigned char **data, RasMessage * ras)
1550 switch (ras->choice) {
1551 case eRasMessage_gatekeeperRequest:
1552 return process_grq(pskb, ct, ctinfo, data,
1553 &ras->gatekeeperRequest);
1554 case eRasMessage_gatekeeperConfirm:
1555 return process_gcf(pskb, ct, ctinfo, data,
1556 &ras->gatekeeperConfirm);
1557 case eRasMessage_registrationRequest:
1558 return process_rrq(pskb, ct, ctinfo, data,
1559 &ras->registrationRequest);
1560 case eRasMessage_registrationConfirm:
1561 return process_rcf(pskb, ct, ctinfo, data,
1562 &ras->registrationConfirm);
1563 case eRasMessage_unregistrationRequest:
1564 return process_urq(pskb, ct, ctinfo, data,
1565 &ras->unregistrationRequest);
1566 case eRasMessage_admissionRequest:
1567 return process_arq(pskb, ct, ctinfo, data,
1568 &ras->admissionRequest);
1569 case eRasMessage_admissionConfirm:
1570 return process_acf(pskb, ct, ctinfo, data,
1571 &ras->admissionConfirm);
1572 case eRasMessage_locationRequest:
1573 return process_lrq(pskb, ct, ctinfo, data,
1574 &ras->locationRequest);
1575 case eRasMessage_locationConfirm:
1576 return process_lcf(pskb, ct, ctinfo, data,
1577 &ras->locationConfirm);
1578 case eRasMessage_infoRequestResponse:
1579 return process_irr(pskb, ct, ctinfo, data,
1580 &ras->infoRequestResponse);
1582 DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
1589 /****************************************************************************/
1590 static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1591 enum ip_conntrack_info ctinfo)
1593 static RasMessage ras;
1594 unsigned char *data;
1598 DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
1600 spin_lock_bh(&ip_h323_lock);
1603 data = get_udp_data(pskb, &datalen);
1606 DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1607 NIPQUAD((*pskb)->nh.iph->saddr),
1608 NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1610 /* Decode RAS message */
1611 ret = DecodeRasMessage(data, datalen, &ras);
1613 if (net_ratelimit())
1614 printk("ip_ct_ras: decoding error: %s\n",
1615 ret == H323_ERROR_BOUND ?
1616 "out of bound" : "out of range");
1620 /* Process RAS message */
1621 if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
1625 spin_unlock_bh(&ip_h323_lock);
1629 spin_unlock_bh(&ip_h323_lock);
1630 if (net_ratelimit())
1631 printk("ip_ct_ras: packet dropped\n");
1635 /****************************************************************************/
1636 static struct ip_conntrack_helper ip_conntrack_helper_ras = {
1641 .tuple = {.src = {.u = {__constant_htons(RAS_PORT)}},
1642 .dst = {.protonum = IPPROTO_UDP}},
1643 .mask = {.src = {.u = {0xFFFE}},
1644 .dst = {.protonum = 0xFF}},
1648 /****************************************************************************/
1649 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1650 struct ip_conntrack_expect *this)
1652 write_lock_bh(&ip_conntrack_lock);
1653 new->helper = &ip_conntrack_helper_ras;
1654 write_unlock_bh(&ip_conntrack_lock);
1657 /****************************************************************************/
1658 /* Not __exit - called from init() */
1659 static void fini(void)
1661 ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
1662 ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
1664 DEBUGP("ip_ct_h323: fini\n");
1667 /****************************************************************************/
1668 static int __init init(void)
1672 h323_buffer = kmalloc(65536, GFP_KERNEL);
1675 if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
1676 (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
1681 DEBUGP("ip_ct_h323: init success\n");
1685 /****************************************************************************/
1689 EXPORT_SYMBOL_GPL(get_h225_addr);
1690 EXPORT_SYMBOL_GPL(ip_conntrack_h245_expect);
1691 EXPORT_SYMBOL_GPL(ip_conntrack_q931_expect);
1692 EXPORT_SYMBOL_GPL(set_h245_addr_hook);
1693 EXPORT_SYMBOL_GPL(set_h225_addr_hook);
1694 EXPORT_SYMBOL_GPL(set_sig_addr_hook);
1695 EXPORT_SYMBOL_GPL(set_ras_addr_hook);
1696 EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
1697 EXPORT_SYMBOL_GPL(nat_t120_hook);
1698 EXPORT_SYMBOL_GPL(nat_h245_hook);
1699 EXPORT_SYMBOL_GPL(nat_q931_hook);
1701 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1702 MODULE_DESCRIPTION("H.323 connection tracking helper");
1703 MODULE_LICENSE("GPL");