1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * H.323 connection tracking helper
4  *
5  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
6  * Copyright (c) 2006-2012 Patrick McHardy <kaber@trash.net>
7  *
8  * Based on the 'brute force' H.323 connection tracking module by
9  * Jozsef Kadlecsik <kadlec@netfilter.org>
10  *
11  * For more information, please see http://nath323.sourceforge.net/
12  */
13 
14 #include <linux/module.h>
15 #include <linux/moduleparam.h>
16 #include <linux/ctype.h>
17 #include <linux/inet.h>
18 #include <linux/in.h>
19 #include <linux/ip.h>
20 #include <linux/slab.h>
21 #include <linux/udp.h>
22 #include <linux/tcp.h>
23 #include <linux/skbuff.h>
24 #include <net/route.h>
25 #include <net/ip6_route.h>
26 #include <linux/netfilter_ipv6.h>
27 
28 #include <net/netfilter/nf_conntrack.h>
29 #include <net/netfilter/nf_conntrack_core.h>
30 #include <net/netfilter/nf_conntrack_tuple.h>
31 #include <net/netfilter/nf_conntrack_expect.h>
32 #include <net/netfilter/nf_conntrack_ecache.h>
33 #include <net/netfilter/nf_conntrack_helper.h>
34 #include <net/netfilter/nf_conntrack_zones.h>
35 #include <linux/netfilter/nf_conntrack_h323.h>
36 
37 #define H323_MAX_SIZE 65535
38 
39 /* Parameters */
40 static unsigned int default_rrq_ttl __read_mostly = 300;
41 module_param(default_rrq_ttl, uint, 0600);
42 MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
43 
44 static int gkrouted_only __read_mostly = 1;
45 module_param(gkrouted_only, int, 0600);
46 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
47 
48 static bool callforward_filter __read_mostly = true;
49 module_param(callforward_filter, bool, 0600);
50 MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations "
51 				     "if both endpoints are on different sides "
52 				     "(determined by routing information)");
53 
54 const struct nfct_h323_nat_hooks __rcu *nfct_h323_nat_hook __read_mostly;
55 EXPORT_SYMBOL_GPL(nfct_h323_nat_hook);
56 
57 static DEFINE_SPINLOCK(nf_h323_lock);
58 static char *h323_buffer;
59 
60 static struct nf_conntrack_helper nf_conntrack_helper_h245;
61 static struct nf_conntrack_helper nf_conntrack_helper_q931[];
62 static struct nf_conntrack_helper nf_conntrack_helper_ras[];
63 
get_tpkt_data(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned char ** data,int * datalen,int * dataoff)64 static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
65 			 struct nf_conn *ct, enum ip_conntrack_info ctinfo,
66 			 unsigned char **data, int *datalen, int *dataoff)
67 {
68 	struct nf_ct_h323_master *info = nfct_help_data(ct);
69 	int dir = CTINFO2DIR(ctinfo);
70 	const struct tcphdr *th;
71 	struct tcphdr _tcph;
72 	int tcpdatalen;
73 	int tcpdataoff;
74 	unsigned char *tpkt;
75 	int tpktlen;
76 	int tpktoff;
77 
78 	/* Get TCP header */
79 	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
80 	if (th == NULL)
81 		return 0;
82 
83 	/* Get TCP data offset */
84 	tcpdataoff = protoff + th->doff * 4;
85 
86 	/* Get TCP data length */
87 	tcpdatalen = skb->len - tcpdataoff;
88 	if (tcpdatalen <= 0)	/* No TCP data */
89 		goto clear_out;
90 
91 	if (tcpdatalen > H323_MAX_SIZE)
92 		tcpdatalen = H323_MAX_SIZE;
93 
94 	if (*data == NULL) {	/* first TPKT */
95 		/* Get first TPKT pointer */
96 		tpkt = skb_header_pointer(skb, tcpdataoff, tcpdatalen,
97 					  h323_buffer);
98 		if (!tpkt)
99 			goto clear_out;
100 
101 		/* Validate TPKT identifier */
102 		if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
103 			/* Netmeeting sends TPKT header and data separately */
104 			if (info->tpkt_len[dir] > 0) {
105 				pr_debug("nf_ct_h323: previous packet "
106 					 "indicated separate TPKT data of %hu "
107 					 "bytes\n", info->tpkt_len[dir]);
108 				if (info->tpkt_len[dir] <= tcpdatalen) {
109 					/* Yes, there was a TPKT header
110 					 * received */
111 					*data = tpkt;
112 					*datalen = info->tpkt_len[dir];
113 					*dataoff = 0;
114 					goto out;
115 				}
116 
117 				/* Fragmented TPKT */
118 				pr_debug("nf_ct_h323: fragmented TPKT\n");
119 				goto clear_out;
120 			}
121 
122 			/* It is not even a TPKT */
123 			return 0;
124 		}
125 		tpktoff = 0;
126 	} else {		/* Next TPKT */
127 		tpktoff = *dataoff + *datalen;
128 		tcpdatalen -= tpktoff;
129 		if (tcpdatalen <= 4)	/* No more TPKT */
130 			goto clear_out;
131 		tpkt = *data + *datalen;
132 
133 		/* Validate TPKT identifier */
134 		if (tpkt[0] != 0x03 || tpkt[1] != 0)
135 			goto clear_out;
136 	}
137 
138 	/* Validate TPKT length */
139 	tpktlen = tpkt[2] * 256 + tpkt[3];
140 	if (tpktlen < 4)
141 		goto clear_out;
142 	if (tpktlen > tcpdatalen) {
143 		if (tcpdatalen == 4) {	/* Separate TPKT header */
144 			/* Netmeeting sends TPKT header and data separately */
145 			pr_debug("nf_ct_h323: separate TPKT header indicates "
146 				 "there will be TPKT data of %d bytes\n",
147 				 tpktlen - 4);
148 			info->tpkt_len[dir] = tpktlen - 4;
149 			return 0;
150 		}
151 
152 		pr_debug("nf_ct_h323: incomplete TPKT (fragmented?)\n");
153 		goto clear_out;
154 	}
155 
156 	/* This is the encapsulated data */
157 	*data = tpkt + 4;
158 	*datalen = tpktlen - 4;
159 	*dataoff = tpktoff + 4;
160 
161       out:
162 	/* Clear TPKT length */
163 	info->tpkt_len[dir] = 0;
164 	return 1;
165 
166       clear_out:
167 	info->tpkt_len[dir] = 0;
168 	return 0;
169 }
170 
get_h245_addr(struct nf_conn * ct,const unsigned char * data,H245_TransportAddress * taddr,union nf_inet_addr * addr,__be16 * port)171 static int get_h245_addr(struct nf_conn *ct, const unsigned char *data,
172 			 H245_TransportAddress *taddr,
173 			 union nf_inet_addr *addr, __be16 *port)
174 {
175 	const unsigned char *p;
176 	int len;
177 
178 	if (taddr->choice != eH245_TransportAddress_unicastAddress)
179 		return 0;
180 
181 	switch (taddr->unicastAddress.choice) {
182 	case eUnicastAddress_iPAddress:
183 		if (nf_ct_l3num(ct) != AF_INET)
184 			return 0;
185 		p = data + taddr->unicastAddress.iPAddress.network;
186 		len = 4;
187 		break;
188 	case eUnicastAddress_iP6Address:
189 		if (nf_ct_l3num(ct) != AF_INET6)
190 			return 0;
191 		p = data + taddr->unicastAddress.iP6Address.network;
192 		len = 16;
193 		break;
194 	default:
195 		return 0;
196 	}
197 
198 	memcpy(addr, p, len);
199 	memset((void *)addr + len, 0, sizeof(*addr) - len);
200 	memcpy(port, p + len, sizeof(__be16));
201 
202 	return 1;
203 }
204 
expect_rtp_rtcp(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,H245_TransportAddress * taddr)205 static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
206 			   enum ip_conntrack_info ctinfo,
207 			   unsigned int protoff,
208 			   unsigned char **data, int dataoff,
209 			   H245_TransportAddress *taddr)
210 {
211 	const struct nfct_h323_nat_hooks *nathook;
212 	int dir = CTINFO2DIR(ctinfo);
213 	int ret = 0;
214 	__be16 port;
215 	__be16 rtp_port, rtcp_port;
216 	union nf_inet_addr addr;
217 	struct nf_conntrack_expect *rtp_exp;
218 	struct nf_conntrack_expect *rtcp_exp;
219 
220 	/* Read RTP or RTCP address */
221 	if (!get_h245_addr(ct, *data, taddr, &addr, &port) ||
222 	    memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) ||
223 	    port == 0)
224 		return 0;
225 
226 	/* RTP port is even */
227 	rtp_port = port & ~htons(1);
228 	rtcp_port = port | htons(1);
229 
230 	/* Create expect for RTP */
231 	if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
232 		return -1;
233 	nf_ct_expect_init(rtp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
234 			  &ct->tuplehash[!dir].tuple.src.u3,
235 			  &ct->tuplehash[!dir].tuple.dst.u3,
236 			  IPPROTO_UDP, NULL, &rtp_port);
237 
238 	/* Create expect for RTCP */
239 	if ((rtcp_exp = nf_ct_expect_alloc(ct)) == NULL) {
240 		nf_ct_expect_put(rtp_exp);
241 		return -1;
242 	}
243 	nf_ct_expect_init(rtcp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
244 			  &ct->tuplehash[!dir].tuple.src.u3,
245 			  &ct->tuplehash[!dir].tuple.dst.u3,
246 			  IPPROTO_UDP, NULL, &rtcp_port);
247 
248 	nathook = rcu_dereference(nfct_h323_nat_hook);
249 	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
250 		   &ct->tuplehash[!dir].tuple.dst.u3,
251 		   sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
252 		   nathook &&
253 		   nf_ct_l3num(ct) == NFPROTO_IPV4 &&
254 		   ct->status & IPS_NAT_MASK) {
255 		/* NAT needed */
256 		ret = nathook->nat_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
257 					    taddr, port, rtp_port, rtp_exp, rtcp_exp);
258 	} else {		/* Conntrack only */
259 		if (nf_ct_expect_related(rtp_exp, 0) == 0) {
260 			if (nf_ct_expect_related(rtcp_exp, 0) == 0) {
261 				pr_debug("nf_ct_h323: expect RTP ");
262 				nf_ct_dump_tuple(&rtp_exp->tuple);
263 				pr_debug("nf_ct_h323: expect RTCP ");
264 				nf_ct_dump_tuple(&rtcp_exp->tuple);
265 			} else {
266 				nf_ct_unexpect_related(rtp_exp);
267 				ret = -1;
268 			}
269 		} else
270 			ret = -1;
271 	}
272 
273 	nf_ct_expect_put(rtp_exp);
274 	nf_ct_expect_put(rtcp_exp);
275 
276 	return ret;
277 }
278 
expect_t120(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,H245_TransportAddress * taddr)279 static int expect_t120(struct sk_buff *skb,
280 		       struct nf_conn *ct,
281 		       enum ip_conntrack_info ctinfo,
282 		       unsigned int protoff,
283 		       unsigned char **data, int dataoff,
284 		       H245_TransportAddress *taddr)
285 {
286 	const struct nfct_h323_nat_hooks *nathook;
287 	int dir = CTINFO2DIR(ctinfo);
288 	int ret = 0;
289 	__be16 port;
290 	union nf_inet_addr addr;
291 	struct nf_conntrack_expect *exp;
292 
293 	/* Read T.120 address */
294 	if (!get_h245_addr(ct, *data, taddr, &addr, &port) ||
295 	    memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) ||
296 	    port == 0)
297 		return 0;
298 
299 	/* Create expect for T.120 connections */
300 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
301 		return -1;
302 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
303 			  &ct->tuplehash[!dir].tuple.src.u3,
304 			  &ct->tuplehash[!dir].tuple.dst.u3,
305 			  IPPROTO_TCP, NULL, &port);
306 	exp->flags = NF_CT_EXPECT_PERMANENT;	/* Accept multiple channels */
307 
308 	nathook = rcu_dereference(nfct_h323_nat_hook);
309 	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
310 		   &ct->tuplehash[!dir].tuple.dst.u3,
311 		   sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
312 	    nathook &&
313 	    nf_ct_l3num(ct) == NFPROTO_IPV4 &&
314 	    ct->status & IPS_NAT_MASK) {
315 		/* NAT needed */
316 		ret = nathook->nat_t120(skb, ct, ctinfo, protoff, data,
317 					dataoff, taddr, port, exp);
318 	} else {		/* Conntrack only */
319 		if (nf_ct_expect_related(exp, 0) == 0) {
320 			pr_debug("nf_ct_h323: expect T.120 ");
321 			nf_ct_dump_tuple(&exp->tuple);
322 		} else
323 			ret = -1;
324 	}
325 
326 	nf_ct_expect_put(exp);
327 
328 	return ret;
329 }
330 
process_h245_channel(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,H2250LogicalChannelParameters * channel)331 static int process_h245_channel(struct sk_buff *skb,
332 				struct nf_conn *ct,
333 				enum ip_conntrack_info ctinfo,
334 				unsigned int protoff,
335 				unsigned char **data, int dataoff,
336 				H2250LogicalChannelParameters *channel)
337 {
338 	int ret;
339 
340 	if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
341 		/* RTP */
342 		ret = expect_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
343 				      &channel->mediaChannel);
344 		if (ret < 0)
345 			return -1;
346 	}
347 
348 	if (channel->
349 	    options & eH2250LogicalChannelParameters_mediaControlChannel) {
350 		/* RTCP */
351 		ret = expect_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
352 				      &channel->mediaControlChannel);
353 		if (ret < 0)
354 			return -1;
355 	}
356 
357 	return 0;
358 }
359 
process_olc(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,OpenLogicalChannel * olc)360 static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
361 		       enum ip_conntrack_info ctinfo,
362 		       unsigned int protoff,
363 		       unsigned char **data, int dataoff,
364 		       OpenLogicalChannel *olc)
365 {
366 	int ret;
367 
368 	pr_debug("nf_ct_h323: OpenLogicalChannel\n");
369 
370 	if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
371 	    eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
372 	{
373 		ret = process_h245_channel(skb, ct, ctinfo,
374 					   protoff, data, dataoff,
375 					   &olc->
376 					   forwardLogicalChannelParameters.
377 					   multiplexParameters.
378 					   h2250LogicalChannelParameters);
379 		if (ret < 0)
380 			return -1;
381 	}
382 
383 	if ((olc->options &
384 	     eOpenLogicalChannel_reverseLogicalChannelParameters) &&
385 	    (olc->reverseLogicalChannelParameters.options &
386 	     eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
387 	    && (olc->reverseLogicalChannelParameters.multiplexParameters.
388 		choice ==
389 		eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
390 	{
391 		ret =
392 		    process_h245_channel(skb, ct, ctinfo,
393 					 protoff, data, dataoff,
394 					 &olc->
395 					 reverseLogicalChannelParameters.
396 					 multiplexParameters.
397 					 h2250LogicalChannelParameters);
398 		if (ret < 0)
399 			return -1;
400 	}
401 
402 	if ((olc->options & eOpenLogicalChannel_separateStack) &&
403 	    olc->forwardLogicalChannelParameters.dataType.choice ==
404 	    eDataType_data &&
405 	    olc->forwardLogicalChannelParameters.dataType.data.application.
406 	    choice == eDataApplicationCapability_application_t120 &&
407 	    olc->forwardLogicalChannelParameters.dataType.data.application.
408 	    t120.choice == eDataProtocolCapability_separateLANStack &&
409 	    olc->separateStack.networkAddress.choice ==
410 	    eNetworkAccessParameters_networkAddress_localAreaAddress) {
411 		ret = expect_t120(skb, ct, ctinfo, protoff, data, dataoff,
412 				  &olc->separateStack.networkAddress.
413 				  localAreaAddress);
414 		if (ret < 0)
415 			return -1;
416 	}
417 
418 	return 0;
419 }
420 
process_olca(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,OpenLogicalChannelAck * olca)421 static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
422 			enum ip_conntrack_info ctinfo,
423 			unsigned int protoff, unsigned char **data, int dataoff,
424 			OpenLogicalChannelAck *olca)
425 {
426 	H2250LogicalChannelAckParameters *ack;
427 	int ret;
428 
429 	pr_debug("nf_ct_h323: OpenLogicalChannelAck\n");
430 
431 	if ((olca->options &
432 	     eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
433 	    (olca->reverseLogicalChannelParameters.options &
434 	     eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
435 	    && (olca->reverseLogicalChannelParameters.multiplexParameters.
436 		choice ==
437 		eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
438 	{
439 		ret = process_h245_channel(skb, ct, ctinfo,
440 					   protoff, data, dataoff,
441 					   &olca->
442 					   reverseLogicalChannelParameters.
443 					   multiplexParameters.
444 					   h2250LogicalChannelParameters);
445 		if (ret < 0)
446 			return -1;
447 	}
448 
449 	if ((olca->options &
450 	     eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
451 	    (olca->forwardMultiplexAckParameters.choice ==
452 	     eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
453 	{
454 		ack = &olca->forwardMultiplexAckParameters.
455 		    h2250LogicalChannelAckParameters;
456 		if (ack->options &
457 		    eH2250LogicalChannelAckParameters_mediaChannel) {
458 			/* RTP */
459 			ret = expect_rtp_rtcp(skb, ct, ctinfo,
460 					      protoff, data, dataoff,
461 					      &ack->mediaChannel);
462 			if (ret < 0)
463 				return -1;
464 		}
465 
466 		if (ack->options &
467 		    eH2250LogicalChannelAckParameters_mediaControlChannel) {
468 			/* RTCP */
469 			ret = expect_rtp_rtcp(skb, ct, ctinfo,
470 					      protoff, data, dataoff,
471 					      &ack->mediaControlChannel);
472 			if (ret < 0)
473 				return -1;
474 		}
475 	}
476 
477 	if ((olca->options & eOpenLogicalChannelAck_separateStack) &&
478 		olca->separateStack.networkAddress.choice ==
479 		eNetworkAccessParameters_networkAddress_localAreaAddress) {
480 		ret = expect_t120(skb, ct, ctinfo, protoff, data, dataoff,
481 				  &olca->separateStack.networkAddress.
482 				  localAreaAddress);
483 		if (ret < 0)
484 			return -1;
485 	}
486 
487 	return 0;
488 }
489 
process_h245(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,MultimediaSystemControlMessage * mscm)490 static int process_h245(struct sk_buff *skb, struct nf_conn *ct,
491 			enum ip_conntrack_info ctinfo,
492 			unsigned int protoff, unsigned char **data, int dataoff,
493 			MultimediaSystemControlMessage *mscm)
494 {
495 	switch (mscm->choice) {
496 	case eMultimediaSystemControlMessage_request:
497 		if (mscm->request.choice ==
498 		    eRequestMessage_openLogicalChannel) {
499 			return process_olc(skb, ct, ctinfo,
500 					   protoff, data, dataoff,
501 					   &mscm->request.openLogicalChannel);
502 		}
503 		pr_debug("nf_ct_h323: H.245 Request %d\n",
504 			 mscm->request.choice);
505 		break;
506 	case eMultimediaSystemControlMessage_response:
507 		if (mscm->response.choice ==
508 		    eResponseMessage_openLogicalChannelAck) {
509 			return process_olca(skb, ct, ctinfo,
510 					    protoff, data, dataoff,
511 					    &mscm->response.
512 					    openLogicalChannelAck);
513 		}
514 		pr_debug("nf_ct_h323: H.245 Response %d\n",
515 			 mscm->response.choice);
516 		break;
517 	default:
518 		pr_debug("nf_ct_h323: H.245 signal %d\n", mscm->choice);
519 		break;
520 	}
521 
522 	return 0;
523 }
524 
h245_help(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo)525 static int h245_help(struct sk_buff *skb, unsigned int protoff,
526 		     struct nf_conn *ct, enum ip_conntrack_info ctinfo)
527 {
528 	static MultimediaSystemControlMessage mscm;
529 	unsigned char *data = NULL;
530 	int datalen;
531 	int dataoff;
532 	int ret;
533 
534 	/* Until there's been traffic both ways, don't look in packets. */
535 	if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
536 		return NF_ACCEPT;
537 
538 	pr_debug("nf_ct_h245: skblen = %u\n", skb->len);
539 
540 	spin_lock_bh(&nf_h323_lock);
541 
542 	/* Process each TPKT */
543 	while (get_tpkt_data(skb, protoff, ct, ctinfo,
544 			     &data, &datalen, &dataoff)) {
545 		pr_debug("nf_ct_h245: TPKT len=%d ", datalen);
546 		nf_ct_dump_tuple(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
547 
548 		/* Decode H.245 signal */
549 		ret = DecodeMultimediaSystemControlMessage(data, datalen,
550 							   &mscm);
551 		if (ret < 0) {
552 			pr_debug("nf_ct_h245: decoding error: %s\n",
553 				 ret == H323_ERROR_BOUND ?
554 				 "out of bound" : "out of range");
555 			/* We don't drop when decoding error */
556 			break;
557 		}
558 
559 		/* Process H.245 signal */
560 		if (process_h245(skb, ct, ctinfo, protoff,
561 				 &data, dataoff, &mscm) < 0)
562 			goto drop;
563 	}
564 
565 	spin_unlock_bh(&nf_h323_lock);
566 	return NF_ACCEPT;
567 
568       drop:
569 	spin_unlock_bh(&nf_h323_lock);
570 	nf_ct_helper_log(skb, ct, "cannot process H.245 message");
571 	return NF_DROP;
572 }
573 
574 static const struct nf_conntrack_expect_policy h245_exp_policy = {
575 	.max_expected	= H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */,
576 	.timeout	= 240,
577 };
578 
579 static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
580 	.name			= "H.245",
581 	.me			= THIS_MODULE,
582 	.tuple.src.l3num	= AF_UNSPEC,
583 	.tuple.dst.protonum	= IPPROTO_UDP,
584 	.help			= h245_help,
585 	.expect_policy		= &h245_exp_policy,
586 };
587 
get_h225_addr(struct nf_conn * ct,unsigned char * data,TransportAddress * taddr,union nf_inet_addr * addr,__be16 * port)588 int get_h225_addr(struct nf_conn *ct, unsigned char *data,
589 		  TransportAddress *taddr,
590 		  union nf_inet_addr *addr, __be16 *port)
591 {
592 	const unsigned char *p;
593 	int len;
594 
595 	switch (taddr->choice) {
596 	case eTransportAddress_ipAddress:
597 		if (nf_ct_l3num(ct) != AF_INET)
598 			return 0;
599 		p = data + taddr->ipAddress.ip;
600 		len = 4;
601 		break;
602 	case eTransportAddress_ip6Address:
603 		if (nf_ct_l3num(ct) != AF_INET6)
604 			return 0;
605 		p = data + taddr->ip6Address.ip;
606 		len = 16;
607 		break;
608 	default:
609 		return 0;
610 	}
611 
612 	memcpy(addr, p, len);
613 	memset((void *)addr + len, 0, sizeof(*addr) - len);
614 	memcpy(port, p + len, sizeof(__be16));
615 
616 	return 1;
617 }
618 EXPORT_SYMBOL_GPL(get_h225_addr);
619 
expect_h245(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,TransportAddress * taddr)620 static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
621 		       enum ip_conntrack_info ctinfo,
622 		       unsigned int protoff, unsigned char **data, int dataoff,
623 		       TransportAddress *taddr)
624 {
625 	const struct nfct_h323_nat_hooks *nathook;
626 	int dir = CTINFO2DIR(ctinfo);
627 	int ret = 0;
628 	__be16 port;
629 	union nf_inet_addr addr;
630 	struct nf_conntrack_expect *exp;
631 
632 	/* Read h245Address */
633 	if (!get_h225_addr(ct, *data, taddr, &addr, &port) ||
634 	    memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) ||
635 	    port == 0)
636 		return 0;
637 
638 	/* Create expect for h245 connection */
639 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
640 		return -1;
641 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
642 			  &ct->tuplehash[!dir].tuple.src.u3,
643 			  &ct->tuplehash[!dir].tuple.dst.u3,
644 			  IPPROTO_TCP, NULL, &port);
645 	exp->helper = &nf_conntrack_helper_h245;
646 
647 	nathook = rcu_dereference(nfct_h323_nat_hook);
648 	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
649 		   &ct->tuplehash[!dir].tuple.dst.u3,
650 		   sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
651 	    nathook &&
652 	    nf_ct_l3num(ct) == NFPROTO_IPV4 &&
653 	    ct->status & IPS_NAT_MASK) {
654 		/* NAT needed */
655 		ret = nathook->nat_h245(skb, ct, ctinfo, protoff, data,
656 					dataoff, taddr, port, exp);
657 	} else {		/* Conntrack only */
658 		if (nf_ct_expect_related(exp, 0) == 0) {
659 			pr_debug("nf_ct_q931: expect H.245 ");
660 			nf_ct_dump_tuple(&exp->tuple);
661 		} else
662 			ret = -1;
663 	}
664 
665 	nf_ct_expect_put(exp);
666 
667 	return ret;
668 }
669 
670 /* If the calling party is on the same side of the forward-to party,
671  * we don't need to track the second call
672  */
callforward_do_filter(struct net * net,const union nf_inet_addr * src,const union nf_inet_addr * dst,u_int8_t family)673 static int callforward_do_filter(struct net *net,
674 				 const union nf_inet_addr *src,
675 				 const union nf_inet_addr *dst,
676 				 u_int8_t family)
677 {
678 	int ret = 0;
679 
680 	switch (family) {
681 	case AF_INET: {
682 		struct flowi4 fl1, fl2;
683 		struct rtable *rt1, *rt2;
684 
685 		memset(&fl1, 0, sizeof(fl1));
686 		fl1.daddr = src->ip;
687 
688 		memset(&fl2, 0, sizeof(fl2));
689 		fl2.daddr = dst->ip;
690 		if (!nf_ip_route(net, (struct dst_entry **)&rt1,
691 				 flowi4_to_flowi(&fl1), false)) {
692 			if (!nf_ip_route(net, (struct dst_entry **)&rt2,
693 					 flowi4_to_flowi(&fl2), false)) {
694 				if (rt_nexthop(rt1, fl1.daddr) ==
695 				    rt_nexthop(rt2, fl2.daddr) &&
696 				    rt1->dst.dev  == rt2->dst.dev)
697 					ret = 1;
698 				dst_release(&rt2->dst);
699 			}
700 			dst_release(&rt1->dst);
701 		}
702 		break;
703 	}
704 #if IS_ENABLED(CONFIG_IPV6)
705 	case AF_INET6: {
706 		struct rt6_info *rt1, *rt2;
707 		struct flowi6 fl1, fl2;
708 
709 		memset(&fl1, 0, sizeof(fl1));
710 		fl1.daddr = src->in6;
711 
712 		memset(&fl2, 0, sizeof(fl2));
713 		fl2.daddr = dst->in6;
714 		if (!nf_ip6_route(net, (struct dst_entry **)&rt1,
715 				  flowi6_to_flowi(&fl1), false)) {
716 			if (!nf_ip6_route(net, (struct dst_entry **)&rt2,
717 					  flowi6_to_flowi(&fl2), false)) {
718 				if (ipv6_addr_equal(rt6_nexthop(rt1, &fl1.daddr),
719 						    rt6_nexthop(rt2, &fl2.daddr)) &&
720 				    rt1->dst.dev == rt2->dst.dev)
721 					ret = 1;
722 				dst_release(&rt2->dst);
723 			}
724 			dst_release(&rt1->dst);
725 		}
726 		break;
727 	}
728 #endif
729 	}
730 	return ret;
731 
732 }
733 
expect_callforwarding(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,TransportAddress * taddr)734 static int expect_callforwarding(struct sk_buff *skb,
735 				 struct nf_conn *ct,
736 				 enum ip_conntrack_info ctinfo,
737 				 unsigned int protoff,
738 				 unsigned char **data, int dataoff,
739 				 TransportAddress *taddr)
740 {
741 	const struct nfct_h323_nat_hooks *nathook;
742 	int dir = CTINFO2DIR(ctinfo);
743 	int ret = 0;
744 	__be16 port;
745 	union nf_inet_addr addr;
746 	struct nf_conntrack_expect *exp;
747 	struct net *net = nf_ct_net(ct);
748 
749 	/* Read alternativeAddress */
750 	if (!get_h225_addr(ct, *data, taddr, &addr, &port) || port == 0)
751 		return 0;
752 
753 	/* If the calling party is on the same side of the forward-to party,
754 	 * we don't need to track the second call
755 	 */
756 	if (callforward_filter &&
757 	    callforward_do_filter(net, &addr, &ct->tuplehash[!dir].tuple.src.u3,
758 				  nf_ct_l3num(ct))) {
759 		pr_debug("nf_ct_q931: Call Forwarding not tracked\n");
760 		return 0;
761 	}
762 
763 	/* Create expect for the second call leg */
764 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
765 		return -1;
766 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
767 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
768 			  IPPROTO_TCP, NULL, &port);
769 	exp->helper = nf_conntrack_helper_q931;
770 
771 	nathook = rcu_dereference(nfct_h323_nat_hook);
772 	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
773 		   &ct->tuplehash[!dir].tuple.dst.u3,
774 		   sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
775 	    nathook &&
776 	    nf_ct_l3num(ct) == NFPROTO_IPV4 &&
777 	    ct->status & IPS_NAT_MASK) {
778 		/* Need NAT */
779 		ret = nathook->nat_callforwarding(skb, ct, ctinfo,
780 						  protoff, data, dataoff,
781 						  taddr, port, exp);
782 	} else {		/* Conntrack only */
783 		if (nf_ct_expect_related(exp, 0) == 0) {
784 			pr_debug("nf_ct_q931: expect Call Forwarding ");
785 			nf_ct_dump_tuple(&exp->tuple);
786 		} else
787 			ret = -1;
788 	}
789 
790 	nf_ct_expect_put(exp);
791 
792 	return ret;
793 }
794 
process_setup(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,Setup_UUIE * setup)795 static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
796 			 enum ip_conntrack_info ctinfo,
797 			 unsigned int protoff,
798 			 unsigned char **data, int dataoff,
799 			 Setup_UUIE *setup)
800 {
801 	const struct nfct_h323_nat_hooks *nathook;
802 	int dir = CTINFO2DIR(ctinfo);
803 	int ret;
804 	int i;
805 	__be16 port;
806 	union nf_inet_addr addr;
807 
808 	pr_debug("nf_ct_q931: Setup\n");
809 
810 	if (setup->options & eSetup_UUIE_h245Address) {
811 		ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
812 				  &setup->h245Address);
813 		if (ret < 0)
814 			return -1;
815 	}
816 
817 	nathook = rcu_dereference(nfct_h323_nat_hook);
818 	if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
819 	    nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
820 	    ct->status & IPS_NAT_MASK &&
821 	    get_h225_addr(ct, *data, &setup->destCallSignalAddress,
822 			  &addr, &port) &&
823 	    memcmp(&addr, &ct->tuplehash[!dir].tuple.src.u3, sizeof(addr))) {
824 		pr_debug("nf_ct_q931: set destCallSignalAddress %pI6:%hu->%pI6:%hu\n",
825 			 &addr, ntohs(port), &ct->tuplehash[!dir].tuple.src.u3,
826 			 ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
827 		ret = nathook->set_h225_addr(skb, protoff, data, dataoff,
828 					     &setup->destCallSignalAddress,
829 					     &ct->tuplehash[!dir].tuple.src.u3,
830 					     ct->tuplehash[!dir].tuple.src.u.tcp.port);
831 		if (ret < 0)
832 			return -1;
833 	}
834 
835 	if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
836 	    nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
837 	    ct->status & IPS_NAT_MASK &&
838 	    get_h225_addr(ct, *data, &setup->sourceCallSignalAddress,
839 			  &addr, &port) &&
840 	    memcmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3, sizeof(addr))) {
841 		pr_debug("nf_ct_q931: set sourceCallSignalAddress %pI6:%hu->%pI6:%hu\n",
842 			 &addr, ntohs(port), &ct->tuplehash[!dir].tuple.dst.u3,
843 			 ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
844 		ret = nathook->set_h225_addr(skb, protoff, data, dataoff,
845 					     &setup->sourceCallSignalAddress,
846 					     &ct->tuplehash[!dir].tuple.dst.u3,
847 					     ct->tuplehash[!dir].tuple.dst.u.tcp.port);
848 		if (ret < 0)
849 			return -1;
850 	}
851 
852 	if (setup->options & eSetup_UUIE_fastStart) {
853 		for (i = 0; i < setup->fastStart.count; i++) {
854 			ret = process_olc(skb, ct, ctinfo,
855 					  protoff, data, dataoff,
856 					  &setup->fastStart.item[i]);
857 			if (ret < 0)
858 				return -1;
859 		}
860 	}
861 
862 	return 0;
863 }
864 
process_callproceeding(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,CallProceeding_UUIE * callproc)865 static int process_callproceeding(struct sk_buff *skb,
866 				  struct nf_conn *ct,
867 				  enum ip_conntrack_info ctinfo,
868 				  unsigned int protoff,
869 				  unsigned char **data, int dataoff,
870 				  CallProceeding_UUIE *callproc)
871 {
872 	int ret;
873 	int i;
874 
875 	pr_debug("nf_ct_q931: CallProceeding\n");
876 
877 	if (callproc->options & eCallProceeding_UUIE_h245Address) {
878 		ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
879 				  &callproc->h245Address);
880 		if (ret < 0)
881 			return -1;
882 	}
883 
884 	if (callproc->options & eCallProceeding_UUIE_fastStart) {
885 		for (i = 0; i < callproc->fastStart.count; i++) {
886 			ret = process_olc(skb, ct, ctinfo,
887 					  protoff, data, dataoff,
888 					  &callproc->fastStart.item[i]);
889 			if (ret < 0)
890 				return -1;
891 		}
892 	}
893 
894 	return 0;
895 }
896 
process_connect(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,Connect_UUIE * connect)897 static int process_connect(struct sk_buff *skb, struct nf_conn *ct,
898 			   enum ip_conntrack_info ctinfo,
899 			   unsigned int protoff,
900 			   unsigned char **data, int dataoff,
901 			   Connect_UUIE *connect)
902 {
903 	int ret;
904 	int i;
905 
906 	pr_debug("nf_ct_q931: Connect\n");
907 
908 	if (connect->options & eConnect_UUIE_h245Address) {
909 		ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
910 				  &connect->h245Address);
911 		if (ret < 0)
912 			return -1;
913 	}
914 
915 	if (connect->options & eConnect_UUIE_fastStart) {
916 		for (i = 0; i < connect->fastStart.count; i++) {
917 			ret = process_olc(skb, ct, ctinfo,
918 					  protoff, data, dataoff,
919 					  &connect->fastStart.item[i]);
920 			if (ret < 0)
921 				return -1;
922 		}
923 	}
924 
925 	return 0;
926 }
927 
process_alerting(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,Alerting_UUIE * alert)928 static int process_alerting(struct sk_buff *skb, struct nf_conn *ct,
929 			    enum ip_conntrack_info ctinfo,
930 			    unsigned int protoff,
931 			    unsigned char **data, int dataoff,
932 			    Alerting_UUIE *alert)
933 {
934 	int ret;
935 	int i;
936 
937 	pr_debug("nf_ct_q931: Alerting\n");
938 
939 	if (alert->options & eAlerting_UUIE_h245Address) {
940 		ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
941 				  &alert->h245Address);
942 		if (ret < 0)
943 			return -1;
944 	}
945 
946 	if (alert->options & eAlerting_UUIE_fastStart) {
947 		for (i = 0; i < alert->fastStart.count; i++) {
948 			ret = process_olc(skb, ct, ctinfo,
949 					  protoff, data, dataoff,
950 					  &alert->fastStart.item[i]);
951 			if (ret < 0)
952 				return -1;
953 		}
954 	}
955 
956 	return 0;
957 }
958 
process_facility(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,Facility_UUIE * facility)959 static int process_facility(struct sk_buff *skb, struct nf_conn *ct,
960 			    enum ip_conntrack_info ctinfo,
961 			    unsigned int protoff,
962 			    unsigned char **data, int dataoff,
963 			    Facility_UUIE *facility)
964 {
965 	int ret;
966 	int i;
967 
968 	pr_debug("nf_ct_q931: Facility\n");
969 
970 	if (facility->reason.choice == eFacilityReason_callForwarded) {
971 		if (facility->options & eFacility_UUIE_alternativeAddress)
972 			return expect_callforwarding(skb, ct, ctinfo,
973 						     protoff, data, dataoff,
974 						     &facility->
975 						     alternativeAddress);
976 		return 0;
977 	}
978 
979 	if (facility->options & eFacility_UUIE_h245Address) {
980 		ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
981 				  &facility->h245Address);
982 		if (ret < 0)
983 			return -1;
984 	}
985 
986 	if (facility->options & eFacility_UUIE_fastStart) {
987 		for (i = 0; i < facility->fastStart.count; i++) {
988 			ret = process_olc(skb, ct, ctinfo,
989 					  protoff, data, dataoff,
990 					  &facility->fastStart.item[i]);
991 			if (ret < 0)
992 				return -1;
993 		}
994 	}
995 
996 	return 0;
997 }
998 
process_progress(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,Progress_UUIE * progress)999 static int process_progress(struct sk_buff *skb, struct nf_conn *ct,
1000 			    enum ip_conntrack_info ctinfo,
1001 			    unsigned int protoff,
1002 			    unsigned char **data, int dataoff,
1003 			    Progress_UUIE *progress)
1004 {
1005 	int ret;
1006 	int i;
1007 
1008 	pr_debug("nf_ct_q931: Progress\n");
1009 
1010 	if (progress->options & eProgress_UUIE_h245Address) {
1011 		ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
1012 				  &progress->h245Address);
1013 		if (ret < 0)
1014 			return -1;
1015 	}
1016 
1017 	if (progress->options & eProgress_UUIE_fastStart) {
1018 		for (i = 0; i < progress->fastStart.count; i++) {
1019 			ret = process_olc(skb, ct, ctinfo,
1020 					  protoff, data, dataoff,
1021 					  &progress->fastStart.item[i]);
1022 			if (ret < 0)
1023 				return -1;
1024 		}
1025 	}
1026 
1027 	return 0;
1028 }
1029 
process_q931(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,int dataoff,Q931 * q931)1030 static int process_q931(struct sk_buff *skb, struct nf_conn *ct,
1031 			enum ip_conntrack_info ctinfo,
1032 			unsigned int protoff, unsigned char **data, int dataoff,
1033 			Q931 *q931)
1034 {
1035 	H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
1036 	int i;
1037 	int ret = 0;
1038 
1039 	switch (pdu->h323_message_body.choice) {
1040 	case eH323_UU_PDU_h323_message_body_setup:
1041 		ret = process_setup(skb, ct, ctinfo, protoff, data, dataoff,
1042 				    &pdu->h323_message_body.setup);
1043 		break;
1044 	case eH323_UU_PDU_h323_message_body_callProceeding:
1045 		ret = process_callproceeding(skb, ct, ctinfo,
1046 					     protoff, data, dataoff,
1047 					     &pdu->h323_message_body.
1048 					     callProceeding);
1049 		break;
1050 	case eH323_UU_PDU_h323_message_body_connect:
1051 		ret = process_connect(skb, ct, ctinfo, protoff, data, dataoff,
1052 				      &pdu->h323_message_body.connect);
1053 		break;
1054 	case eH323_UU_PDU_h323_message_body_alerting:
1055 		ret = process_alerting(skb, ct, ctinfo, protoff, data, dataoff,
1056 				       &pdu->h323_message_body.alerting);
1057 		break;
1058 	case eH323_UU_PDU_h323_message_body_facility:
1059 		ret = process_facility(skb, ct, ctinfo, protoff, data, dataoff,
1060 				       &pdu->h323_message_body.facility);
1061 		break;
1062 	case eH323_UU_PDU_h323_message_body_progress:
1063 		ret = process_progress(skb, ct, ctinfo, protoff, data, dataoff,
1064 				       &pdu->h323_message_body.progress);
1065 		break;
1066 	default:
1067 		pr_debug("nf_ct_q931: Q.931 signal %d\n",
1068 			 pdu->h323_message_body.choice);
1069 		break;
1070 	}
1071 
1072 	if (ret < 0)
1073 		return -1;
1074 
1075 	if (pdu->options & eH323_UU_PDU_h245Control) {
1076 		for (i = 0; i < pdu->h245Control.count; i++) {
1077 			ret = process_h245(skb, ct, ctinfo,
1078 					   protoff, data, dataoff,
1079 					   &pdu->h245Control.item[i]);
1080 			if (ret < 0)
1081 				return -1;
1082 		}
1083 	}
1084 
1085 	return 0;
1086 }
1087 
q931_help(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo)1088 static int q931_help(struct sk_buff *skb, unsigned int protoff,
1089 		     struct nf_conn *ct, enum ip_conntrack_info ctinfo)
1090 {
1091 	static Q931 q931;
1092 	unsigned char *data = NULL;
1093 	int datalen;
1094 	int dataoff;
1095 	int ret;
1096 
1097 	/* Until there's been traffic both ways, don't look in packets. */
1098 	if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
1099 		return NF_ACCEPT;
1100 
1101 	pr_debug("nf_ct_q931: skblen = %u\n", skb->len);
1102 
1103 	spin_lock_bh(&nf_h323_lock);
1104 
1105 	/* Process each TPKT */
1106 	while (get_tpkt_data(skb, protoff, ct, ctinfo,
1107 			     &data, &datalen, &dataoff)) {
1108 		pr_debug("nf_ct_q931: TPKT len=%d ", datalen);
1109 		nf_ct_dump_tuple(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
1110 
1111 		/* Decode Q.931 signal */
1112 		ret = DecodeQ931(data, datalen, &q931);
1113 		if (ret < 0) {
1114 			pr_debug("nf_ct_q931: decoding error: %s\n",
1115 				 ret == H323_ERROR_BOUND ?
1116 				 "out of bound" : "out of range");
1117 			/* We don't drop when decoding error */
1118 			break;
1119 		}
1120 
1121 		/* Process Q.931 signal */
1122 		if (process_q931(skb, ct, ctinfo, protoff,
1123 				 &data, dataoff, &q931) < 0)
1124 			goto drop;
1125 	}
1126 
1127 	spin_unlock_bh(&nf_h323_lock);
1128 	return NF_ACCEPT;
1129 
1130       drop:
1131 	spin_unlock_bh(&nf_h323_lock);
1132 	nf_ct_helper_log(skb, ct, "cannot process Q.931 message");
1133 	return NF_DROP;
1134 }
1135 
1136 static const struct nf_conntrack_expect_policy q931_exp_policy = {
1137 	/* T.120 and H.245 */
1138 	.max_expected		= H323_RTP_CHANNEL_MAX * 4 + 4,
1139 	.timeout		= 240,
1140 };
1141 
1142 static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
1143 	{
1144 		.name			= "Q.931",
1145 		.me			= THIS_MODULE,
1146 		.tuple.src.l3num	= AF_INET,
1147 		.tuple.src.u.tcp.port	= cpu_to_be16(Q931_PORT),
1148 		.tuple.dst.protonum	= IPPROTO_TCP,
1149 		.help			= q931_help,
1150 		.expect_policy		= &q931_exp_policy,
1151 	},
1152 	{
1153 		.name			= "Q.931",
1154 		.me			= THIS_MODULE,
1155 		.tuple.src.l3num	= AF_INET6,
1156 		.tuple.src.u.tcp.port	= cpu_to_be16(Q931_PORT),
1157 		.tuple.dst.protonum	= IPPROTO_TCP,
1158 		.help			= q931_help,
1159 		.expect_policy		= &q931_exp_policy,
1160 	},
1161 };
1162 
get_udp_data(struct sk_buff * skb,unsigned int protoff,int * datalen)1163 static unsigned char *get_udp_data(struct sk_buff *skb, unsigned int protoff,
1164 				   int *datalen)
1165 {
1166 	const struct udphdr *uh;
1167 	struct udphdr _uh;
1168 	int dataoff;
1169 
1170 	uh = skb_header_pointer(skb, protoff, sizeof(_uh), &_uh);
1171 	if (uh == NULL)
1172 		return NULL;
1173 	dataoff = protoff + sizeof(_uh);
1174 	if (dataoff >= skb->len)
1175 		return NULL;
1176 	*datalen = skb->len - dataoff;
1177 	if (*datalen > H323_MAX_SIZE)
1178 		*datalen = H323_MAX_SIZE;
1179 
1180 	return skb_header_pointer(skb, dataoff, *datalen, h323_buffer);
1181 }
1182 
find_expect(struct nf_conn * ct,union nf_inet_addr * addr,__be16 port)1183 static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
1184 					       union nf_inet_addr *addr,
1185 					       __be16 port)
1186 {
1187 	struct net *net = nf_ct_net(ct);
1188 	struct nf_conntrack_expect *exp;
1189 	struct nf_conntrack_tuple tuple;
1190 
1191 	memset(&tuple.src.u3, 0, sizeof(tuple.src.u3));
1192 	tuple.src.u.tcp.port = 0;
1193 	memcpy(&tuple.dst.u3, addr, sizeof(tuple.dst.u3));
1194 	tuple.dst.u.tcp.port = port;
1195 	tuple.dst.protonum = IPPROTO_TCP;
1196 
1197 	exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
1198 	if (exp && exp->master == ct)
1199 		return exp;
1200 	return NULL;
1201 }
1202 
expect_q931(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,TransportAddress * taddr,int count)1203 static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
1204 		       enum ip_conntrack_info ctinfo,
1205 		       unsigned int protoff, unsigned char **data,
1206 		       TransportAddress *taddr, int count)
1207 {
1208 	struct nf_ct_h323_master *info = nfct_help_data(ct);
1209 	const struct nfct_h323_nat_hooks *nathook;
1210 	int dir = CTINFO2DIR(ctinfo);
1211 	int ret = 0;
1212 	int i;
1213 	__be16 port;
1214 	union nf_inet_addr addr;
1215 	struct nf_conntrack_expect *exp;
1216 
1217 	/* Look for the first related address */
1218 	for (i = 0; i < count; i++) {
1219 		if (get_h225_addr(ct, *data, &taddr[i], &addr, &port) &&
1220 		    memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3,
1221 			   sizeof(addr)) == 0 && port != 0)
1222 			break;
1223 	}
1224 
1225 	if (i >= count)		/* Not found */
1226 		return 0;
1227 
1228 	/* Create expect for Q.931 */
1229 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
1230 		return -1;
1231 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
1232 			  gkrouted_only ? /* only accept calls from GK? */
1233 				&ct->tuplehash[!dir].tuple.src.u3 : NULL,
1234 			  &ct->tuplehash[!dir].tuple.dst.u3,
1235 			  IPPROTO_TCP, NULL, &port);
1236 	exp->helper = nf_conntrack_helper_q931;
1237 	exp->flags = NF_CT_EXPECT_PERMANENT;	/* Accept multiple calls */
1238 
1239 	nathook = rcu_dereference(nfct_h323_nat_hook);
1240 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1241 	    ct->status & IPS_NAT_MASK) {	/* Need NAT */
1242 		ret = nathook->nat_q931(skb, ct, ctinfo, protoff, data,
1243 					taddr, i, port, exp);
1244 	} else {		/* Conntrack only */
1245 		if (nf_ct_expect_related(exp, 0) == 0) {
1246 			pr_debug("nf_ct_ras: expect Q.931 ");
1247 			nf_ct_dump_tuple(&exp->tuple);
1248 
1249 			/* Save port for looking up expect in processing RCF */
1250 			info->sig_port[dir] = port;
1251 		} else
1252 			ret = -1;
1253 	}
1254 
1255 	nf_ct_expect_put(exp);
1256 
1257 	return ret;
1258 }
1259 
process_grq(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,GatekeeperRequest * grq)1260 static int process_grq(struct sk_buff *skb, struct nf_conn *ct,
1261 		       enum ip_conntrack_info ctinfo,
1262 		       unsigned int protoff,
1263 		       unsigned char **data, GatekeeperRequest *grq)
1264 {
1265 	const struct nfct_h323_nat_hooks *nathook;
1266 
1267 	pr_debug("nf_ct_ras: GRQ\n");
1268 
1269 	nathook = rcu_dereference(nfct_h323_nat_hook);
1270 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1271 	    ct->status & IPS_NAT_MASK)	/* NATed */
1272 		return nathook->set_ras_addr(skb, ct, ctinfo, protoff, data,
1273 					     &grq->rasAddress, 1);
1274 	return 0;
1275 }
1276 
process_gcf(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,GatekeeperConfirm * gcf)1277 static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,
1278 		       enum ip_conntrack_info ctinfo,
1279 		       unsigned int protoff,
1280 		       unsigned char **data, GatekeeperConfirm *gcf)
1281 {
1282 	int dir = CTINFO2DIR(ctinfo);
1283 	int ret = 0;
1284 	__be16 port;
1285 	union nf_inet_addr addr;
1286 	struct nf_conntrack_expect *exp;
1287 
1288 	pr_debug("nf_ct_ras: GCF\n");
1289 
1290 	if (!get_h225_addr(ct, *data, &gcf->rasAddress, &addr, &port))
1291 		return 0;
1292 
1293 	/* Registration port is the same as discovery port */
1294 	if (!memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
1295 	    port == ct->tuplehash[dir].tuple.src.u.udp.port)
1296 		return 0;
1297 
1298 	/* Avoid RAS expectation loops. A GCF is never expected. */
1299 	if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1300 		return 0;
1301 
1302 	/* Need new expect */
1303 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
1304 		return -1;
1305 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
1306 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
1307 			  IPPROTO_UDP, NULL, &port);
1308 	exp->helper = nf_conntrack_helper_ras;
1309 
1310 	if (nf_ct_expect_related(exp, 0) == 0) {
1311 		pr_debug("nf_ct_ras: expect RAS ");
1312 		nf_ct_dump_tuple(&exp->tuple);
1313 	} else
1314 		ret = -1;
1315 
1316 	nf_ct_expect_put(exp);
1317 
1318 	return ret;
1319 }
1320 
process_rrq(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,RegistrationRequest * rrq)1321 static int process_rrq(struct sk_buff *skb, struct nf_conn *ct,
1322 		       enum ip_conntrack_info ctinfo,
1323 		       unsigned int protoff,
1324 		       unsigned char **data, RegistrationRequest *rrq)
1325 {
1326 	struct nf_ct_h323_master *info = nfct_help_data(ct);
1327 	const struct nfct_h323_nat_hooks *nathook;
1328 	int ret;
1329 
1330 	pr_debug("nf_ct_ras: RRQ\n");
1331 
1332 	ret = expect_q931(skb, ct, ctinfo, protoff, data,
1333 			  rrq->callSignalAddress.item,
1334 			  rrq->callSignalAddress.count);
1335 	if (ret < 0)
1336 		return -1;
1337 
1338 	nathook = rcu_dereference(nfct_h323_nat_hook);
1339 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1340 	    ct->status & IPS_NAT_MASK) {
1341 		ret = nathook->set_ras_addr(skb, ct, ctinfo, protoff, data,
1342 					    rrq->rasAddress.item,
1343 					    rrq->rasAddress.count);
1344 		if (ret < 0)
1345 			return -1;
1346 	}
1347 
1348 	if (rrq->options & eRegistrationRequest_timeToLive) {
1349 		pr_debug("nf_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1350 		info->timeout = rrq->timeToLive;
1351 	} else
1352 		info->timeout = default_rrq_ttl;
1353 
1354 	return 0;
1355 }
1356 
process_rcf(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,RegistrationConfirm * rcf)1357 static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
1358 		       enum ip_conntrack_info ctinfo,
1359 		       unsigned int protoff,
1360 		       unsigned char **data, RegistrationConfirm *rcf)
1361 {
1362 	struct nf_ct_h323_master *info = nfct_help_data(ct);
1363 	const struct nfct_h323_nat_hooks *nathook;
1364 	int dir = CTINFO2DIR(ctinfo);
1365 	int ret;
1366 	struct nf_conntrack_expect *exp;
1367 
1368 	pr_debug("nf_ct_ras: RCF\n");
1369 
1370 	nathook = rcu_dereference(nfct_h323_nat_hook);
1371 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1372 	    ct->status & IPS_NAT_MASK) {
1373 		ret = nathook->set_sig_addr(skb, ct, ctinfo, protoff, data,
1374 					    rcf->callSignalAddress.item,
1375 					    rcf->callSignalAddress.count);
1376 		if (ret < 0)
1377 			return -1;
1378 	}
1379 
1380 	if (rcf->options & eRegistrationConfirm_timeToLive) {
1381 		pr_debug("nf_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1382 		info->timeout = rcf->timeToLive;
1383 	}
1384 
1385 	if (info->timeout > 0) {
1386 		pr_debug("nf_ct_ras: set RAS connection timeout to "
1387 			 "%u seconds\n", info->timeout);
1388 		nf_ct_refresh(ct, skb, info->timeout * HZ);
1389 
1390 		/* Set expect timeout */
1391 		spin_lock_bh(&nf_conntrack_expect_lock);
1392 		exp = find_expect(ct, &ct->tuplehash[dir].tuple.dst.u3,
1393 				  info->sig_port[!dir]);
1394 		if (exp) {
1395 			pr_debug("nf_ct_ras: set Q.931 expect "
1396 				 "timeout to %u seconds for",
1397 				 info->timeout);
1398 			nf_ct_dump_tuple(&exp->tuple);
1399 			mod_timer_pending(&exp->timeout,
1400 					  jiffies + info->timeout * HZ);
1401 		}
1402 		spin_unlock_bh(&nf_conntrack_expect_lock);
1403 	}
1404 
1405 	return 0;
1406 }
1407 
process_urq(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,UnregistrationRequest * urq)1408 static int process_urq(struct sk_buff *skb, struct nf_conn *ct,
1409 		       enum ip_conntrack_info ctinfo,
1410 		       unsigned int protoff,
1411 		       unsigned char **data, UnregistrationRequest *urq)
1412 {
1413 	struct nf_ct_h323_master *info = nfct_help_data(ct);
1414 	const struct nfct_h323_nat_hooks *nathook;
1415 	int dir = CTINFO2DIR(ctinfo);
1416 	int ret;
1417 
1418 	pr_debug("nf_ct_ras: URQ\n");
1419 
1420 	nathook = rcu_dereference(nfct_h323_nat_hook);
1421 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1422 	    ct->status & IPS_NAT_MASK) {
1423 		ret = nathook->set_sig_addr(skb, ct, ctinfo, protoff, data,
1424 					    urq->callSignalAddress.item,
1425 					    urq->callSignalAddress.count);
1426 		if (ret < 0)
1427 			return -1;
1428 	}
1429 
1430 	/* Clear old expect */
1431 	nf_ct_remove_expectations(ct);
1432 	info->sig_port[dir] = 0;
1433 	info->sig_port[!dir] = 0;
1434 
1435 	/* Give it 30 seconds for UCF or URJ */
1436 	nf_ct_refresh(ct, skb, 30 * HZ);
1437 
1438 	return 0;
1439 }
1440 
process_arq(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,AdmissionRequest * arq)1441 static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
1442 		       enum ip_conntrack_info ctinfo,
1443 		       unsigned int protoff,
1444 		       unsigned char **data, AdmissionRequest *arq)
1445 {
1446 	const struct nf_ct_h323_master *info = nfct_help_data(ct);
1447 	const struct nfct_h323_nat_hooks *nathook;
1448 	int dir = CTINFO2DIR(ctinfo);
1449 	__be16 port;
1450 	union nf_inet_addr addr;
1451 
1452 	pr_debug("nf_ct_ras: ARQ\n");
1453 
1454 	nathook = rcu_dereference(nfct_h323_nat_hook);
1455 	if (!nathook)
1456 		return 0;
1457 
1458 	if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1459 	    get_h225_addr(ct, *data, &arq->destCallSignalAddress,
1460 			  &addr, &port) &&
1461 	    !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
1462 	    port == info->sig_port[dir] &&
1463 	    nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1464 	    ct->status & IPS_NAT_MASK) {
1465 		/* Answering ARQ */
1466 		return nathook->set_h225_addr(skb, protoff, data, 0,
1467 					      &arq->destCallSignalAddress,
1468 					      &ct->tuplehash[!dir].tuple.dst.u3,
1469 					      info->sig_port[!dir]);
1470 	}
1471 
1472 	if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1473 	    get_h225_addr(ct, *data, &arq->srcCallSignalAddress,
1474 			  &addr, &port) &&
1475 	    !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
1476 	    nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1477 	    ct->status & IPS_NAT_MASK) {
1478 		/* Calling ARQ */
1479 		return nathook->set_h225_addr(skb, protoff, data, 0,
1480 					      &arq->srcCallSignalAddress,
1481 					      &ct->tuplehash[!dir].tuple.dst.u3,
1482 					      port);
1483 	}
1484 
1485 	return 0;
1486 }
1487 
process_acf(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,AdmissionConfirm * acf)1488 static int process_acf(struct sk_buff *skb, struct nf_conn *ct,
1489 		       enum ip_conntrack_info ctinfo,
1490 		       unsigned int protoff,
1491 		       unsigned char **data, AdmissionConfirm *acf)
1492 {
1493 	int dir = CTINFO2DIR(ctinfo);
1494 	int ret = 0;
1495 	__be16 port;
1496 	union nf_inet_addr addr;
1497 	struct nf_conntrack_expect *exp;
1498 
1499 	pr_debug("nf_ct_ras: ACF\n");
1500 
1501 	if (!get_h225_addr(ct, *data, &acf->destCallSignalAddress,
1502 			   &addr, &port))
1503 		return 0;
1504 
1505 	if (!memcmp(&addr, &ct->tuplehash[dir].tuple.dst.u3, sizeof(addr))) {
1506 		const struct nfct_h323_nat_hooks *nathook;
1507 
1508 		/* Answering ACF */
1509 		nathook = rcu_dereference(nfct_h323_nat_hook);
1510 		if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1511 		    ct->status & IPS_NAT_MASK)
1512 			return nathook->set_sig_addr(skb, ct, ctinfo, protoff,
1513 						     data,
1514 						     &acf->destCallSignalAddress, 1);
1515 		return 0;
1516 	}
1517 
1518 	/* Need new expect */
1519 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
1520 		return -1;
1521 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
1522 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
1523 			  IPPROTO_TCP, NULL, &port);
1524 	exp->flags = NF_CT_EXPECT_PERMANENT;
1525 	exp->helper = nf_conntrack_helper_q931;
1526 
1527 	if (nf_ct_expect_related(exp, 0) == 0) {
1528 		pr_debug("nf_ct_ras: expect Q.931 ");
1529 		nf_ct_dump_tuple(&exp->tuple);
1530 	} else
1531 		ret = -1;
1532 
1533 	nf_ct_expect_put(exp);
1534 
1535 	return ret;
1536 }
1537 
process_lrq(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,LocationRequest * lrq)1538 static int process_lrq(struct sk_buff *skb, struct nf_conn *ct,
1539 		       enum ip_conntrack_info ctinfo,
1540 		       unsigned int protoff,
1541 		       unsigned char **data, LocationRequest *lrq)
1542 {
1543 	const struct nfct_h323_nat_hooks *nathook;
1544 
1545 	pr_debug("nf_ct_ras: LRQ\n");
1546 
1547 	nathook = rcu_dereference(nfct_h323_nat_hook);
1548 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1549 	    ct->status & IPS_NAT_MASK)
1550 		return nathook->set_ras_addr(skb, ct, ctinfo, protoff, data,
1551 					     &lrq->replyAddress, 1);
1552 	return 0;
1553 }
1554 
process_lcf(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,LocationConfirm * lcf)1555 static int process_lcf(struct sk_buff *skb, struct nf_conn *ct,
1556 		       enum ip_conntrack_info ctinfo,
1557 		       unsigned int protoff,
1558 		       unsigned char **data, LocationConfirm *lcf)
1559 {
1560 	int dir = CTINFO2DIR(ctinfo);
1561 	int ret = 0;
1562 	__be16 port;
1563 	union nf_inet_addr addr;
1564 	struct nf_conntrack_expect *exp;
1565 
1566 	pr_debug("nf_ct_ras: LCF\n");
1567 
1568 	if (!get_h225_addr(ct, *data, &lcf->callSignalAddress,
1569 			   &addr, &port))
1570 		return 0;
1571 
1572 	/* Need new expect for call signal */
1573 	if ((exp = nf_ct_expect_alloc(ct)) == NULL)
1574 		return -1;
1575 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
1576 			  &ct->tuplehash[!dir].tuple.src.u3, &addr,
1577 			  IPPROTO_TCP, NULL, &port);
1578 	exp->flags = NF_CT_EXPECT_PERMANENT;
1579 	exp->helper = nf_conntrack_helper_q931;
1580 
1581 	if (nf_ct_expect_related(exp, 0) == 0) {
1582 		pr_debug("nf_ct_ras: expect Q.931 ");
1583 		nf_ct_dump_tuple(&exp->tuple);
1584 	} else
1585 		ret = -1;
1586 
1587 	nf_ct_expect_put(exp);
1588 
1589 	/* Ignore rasAddress */
1590 
1591 	return ret;
1592 }
1593 
process_irr(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,InfoRequestResponse * irr)1594 static int process_irr(struct sk_buff *skb, struct nf_conn *ct,
1595 		       enum ip_conntrack_info ctinfo,
1596 		       unsigned int protoff,
1597 		       unsigned char **data, InfoRequestResponse *irr)
1598 {
1599 	const struct nfct_h323_nat_hooks *nathook;
1600 	int ret;
1601 
1602 	pr_debug("nf_ct_ras: IRR\n");
1603 
1604 	nathook = rcu_dereference(nfct_h323_nat_hook);
1605 	if (nathook && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
1606 	    ct->status & IPS_NAT_MASK) {
1607 		ret = nathook->set_ras_addr(skb, ct, ctinfo, protoff, data,
1608 					    &irr->rasAddress, 1);
1609 		if (ret < 0)
1610 			return -1;
1611 
1612 		ret = nathook->set_sig_addr(skb, ct, ctinfo, protoff, data,
1613 					    irr->callSignalAddress.item,
1614 					    irr->callSignalAddress.count);
1615 		if (ret < 0)
1616 			return -1;
1617 	}
1618 
1619 	return 0;
1620 }
1621 
process_ras(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int protoff,unsigned char ** data,RasMessage * ras)1622 static int process_ras(struct sk_buff *skb, struct nf_conn *ct,
1623 		       enum ip_conntrack_info ctinfo,
1624 		       unsigned int protoff,
1625 		       unsigned char **data, RasMessage *ras)
1626 {
1627 	switch (ras->choice) {
1628 	case eRasMessage_gatekeeperRequest:
1629 		return process_grq(skb, ct, ctinfo, protoff, data,
1630 				   &ras->gatekeeperRequest);
1631 	case eRasMessage_gatekeeperConfirm:
1632 		return process_gcf(skb, ct, ctinfo, protoff, data,
1633 				   &ras->gatekeeperConfirm);
1634 	case eRasMessage_registrationRequest:
1635 		return process_rrq(skb, ct, ctinfo, protoff, data,
1636 				   &ras->registrationRequest);
1637 	case eRasMessage_registrationConfirm:
1638 		return process_rcf(skb, ct, ctinfo, protoff, data,
1639 				   &ras->registrationConfirm);
1640 	case eRasMessage_unregistrationRequest:
1641 		return process_urq(skb, ct, ctinfo, protoff, data,
1642 				   &ras->unregistrationRequest);
1643 	case eRasMessage_admissionRequest:
1644 		return process_arq(skb, ct, ctinfo, protoff, data,
1645 				   &ras->admissionRequest);
1646 	case eRasMessage_admissionConfirm:
1647 		return process_acf(skb, ct, ctinfo, protoff, data,
1648 				   &ras->admissionConfirm);
1649 	case eRasMessage_locationRequest:
1650 		return process_lrq(skb, ct, ctinfo, protoff, data,
1651 				   &ras->locationRequest);
1652 	case eRasMessage_locationConfirm:
1653 		return process_lcf(skb, ct, ctinfo, protoff, data,
1654 				   &ras->locationConfirm);
1655 	case eRasMessage_infoRequestResponse:
1656 		return process_irr(skb, ct, ctinfo, protoff, data,
1657 				   &ras->infoRequestResponse);
1658 	default:
1659 		pr_debug("nf_ct_ras: RAS message %d\n", ras->choice);
1660 		break;
1661 	}
1662 
1663 	return 0;
1664 }
1665 
ras_help(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo)1666 static int ras_help(struct sk_buff *skb, unsigned int protoff,
1667 		    struct nf_conn *ct, enum ip_conntrack_info ctinfo)
1668 {
1669 	static RasMessage ras;
1670 	unsigned char *data;
1671 	int datalen = 0;
1672 	int ret;
1673 
1674 	pr_debug("nf_ct_ras: skblen = %u\n", skb->len);
1675 
1676 	spin_lock_bh(&nf_h323_lock);
1677 
1678 	/* Get UDP data */
1679 	data = get_udp_data(skb, protoff, &datalen);
1680 	if (data == NULL)
1681 		goto accept;
1682 	pr_debug("nf_ct_ras: RAS message len=%d ", datalen);
1683 	nf_ct_dump_tuple(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
1684 
1685 	/* Decode RAS message */
1686 	ret = DecodeRasMessage(data, datalen, &ras);
1687 	if (ret < 0) {
1688 		pr_debug("nf_ct_ras: decoding error: %s\n",
1689 			 ret == H323_ERROR_BOUND ?
1690 			 "out of bound" : "out of range");
1691 		goto accept;
1692 	}
1693 
1694 	/* Process RAS message */
1695 	if (process_ras(skb, ct, ctinfo, protoff, &data, &ras) < 0)
1696 		goto drop;
1697 
1698       accept:
1699 	spin_unlock_bh(&nf_h323_lock);
1700 	return NF_ACCEPT;
1701 
1702       drop:
1703 	spin_unlock_bh(&nf_h323_lock);
1704 	nf_ct_helper_log(skb, ct, "cannot process RAS message");
1705 	return NF_DROP;
1706 }
1707 
1708 static const struct nf_conntrack_expect_policy ras_exp_policy = {
1709 	.max_expected		= 32,
1710 	.timeout		= 240,
1711 };
1712 
1713 static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = {
1714 	{
1715 		.name			= "RAS",
1716 		.me			= THIS_MODULE,
1717 		.tuple.src.l3num	= AF_INET,
1718 		.tuple.src.u.udp.port	= cpu_to_be16(RAS_PORT),
1719 		.tuple.dst.protonum	= IPPROTO_UDP,
1720 		.help			= ras_help,
1721 		.expect_policy		= &ras_exp_policy,
1722 	},
1723 	{
1724 		.name			= "RAS",
1725 		.me			= THIS_MODULE,
1726 		.tuple.src.l3num	= AF_INET6,
1727 		.tuple.src.u.udp.port	= cpu_to_be16(RAS_PORT),
1728 		.tuple.dst.protonum	= IPPROTO_UDP,
1729 		.help			= ras_help,
1730 		.expect_policy		= &ras_exp_policy,
1731 	},
1732 };
1733 
h323_helper_init(void)1734 static int __init h323_helper_init(void)
1735 {
1736 	int ret;
1737 
1738 	ret = nf_conntrack_helper_register(&nf_conntrack_helper_h245);
1739 	if (ret < 0)
1740 		return ret;
1741 	ret = nf_conntrack_helpers_register(nf_conntrack_helper_q931,
1742 					ARRAY_SIZE(nf_conntrack_helper_q931));
1743 	if (ret < 0)
1744 		goto err1;
1745 	ret = nf_conntrack_helpers_register(nf_conntrack_helper_ras,
1746 					ARRAY_SIZE(nf_conntrack_helper_ras));
1747 	if (ret < 0)
1748 		goto err2;
1749 
1750 	return 0;
1751 err2:
1752 	nf_conntrack_helpers_unregister(nf_conntrack_helper_q931,
1753 					ARRAY_SIZE(nf_conntrack_helper_q931));
1754 err1:
1755 	nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
1756 	return ret;
1757 }
1758 
h323_helper_exit(void)1759 static void __exit h323_helper_exit(void)
1760 {
1761 	nf_conntrack_helpers_unregister(nf_conntrack_helper_ras,
1762 					ARRAY_SIZE(nf_conntrack_helper_ras));
1763 	nf_conntrack_helpers_unregister(nf_conntrack_helper_q931,
1764 					ARRAY_SIZE(nf_conntrack_helper_q931));
1765 	nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
1766 }
1767 
nf_conntrack_h323_fini(void)1768 static void __exit nf_conntrack_h323_fini(void)
1769 {
1770 	h323_helper_exit();
1771 	kfree(h323_buffer);
1772 	pr_debug("nf_ct_h323: fini\n");
1773 }
1774 
nf_conntrack_h323_init(void)1775 static int __init nf_conntrack_h323_init(void)
1776 {
1777 	int ret;
1778 
1779 	NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_h323_master));
1780 
1781 	h323_buffer = kmalloc(H323_MAX_SIZE + 1, GFP_KERNEL);
1782 	if (!h323_buffer)
1783 		return -ENOMEM;
1784 	ret = h323_helper_init();
1785 	if (ret < 0)
1786 		goto err1;
1787 	pr_debug("nf_ct_h323: init success\n");
1788 	return 0;
1789 err1:
1790 	kfree(h323_buffer);
1791 	return ret;
1792 }
1793 
1794 module_init(nf_conntrack_h323_init);
1795 module_exit(nf_conntrack_h323_fini);
1796 
1797 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1798 MODULE_DESCRIPTION("H.323 connection tracking helper");
1799 MODULE_LICENSE("GPL");
1800 MODULE_ALIAS("ip_conntrack_h323");
1801 MODULE_ALIAS_NFCT_HELPER("RAS");
1802 MODULE_ALIAS_NFCT_HELPER("Q.931");
1803 MODULE_ALIAS_NFCT_HELPER("H.245");
1804