1 /*- 2 * alias_skinny.c 3 * 4 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 5 * 6 * Copyright (c) 2002, 2003 MarcusCom, Inc. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 * 30 * Author: Joe Marcus Clarke <marcus@FreeBSD.org> 31 * 32 * $FreeBSD$ 33 */ 34 35 #ifdef _KERNEL 36 #include <sys/param.h> 37 #include <sys/kernel.h> 38 #include <sys/module.h> 39 #else 40 #include <errno.h> 41 #include <stdio.h> 42 #include <unistd.h> 43 #endif 44 45 #include <netinet/in_systm.h> 46 #include <netinet/in.h> 47 #include <netinet/ip.h> 48 #include <netinet/tcp.h> 49 50 #ifdef _KERNEL 51 #include <netinet/libalias/alias_local.h> 52 #include <netinet/libalias/alias_mod.h> 53 #else 54 #include "alias_local.h" 55 #include "alias_mod.h" 56 #endif 57 58 static void 59 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *); 60 61 static int 62 fingerprint(struct libalias *la, struct alias_data *ah) 63 { 64 65 if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL) 66 return (-1); 67 if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort || 68 ntohs(*ah->dport) == la->skinnyPort)) 69 return (0); 70 return (-1); 71 } 72 73 static int 74 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) 75 { 76 77 AliasHandleSkinny(la, pip, ah->lnk); 78 return (0); 79 } 80 81 struct proto_handler handlers[] = { 82 { 83 .pri = 110, 84 .dir = IN|OUT, 85 .proto = TCP, 86 .fingerprint = &fingerprint, 87 .protohandler = &protohandler 88 }, 89 { EOH } 90 }; 91 92 static int 93 mod_handler(module_t mod, int type, void *data) 94 { 95 int error; 96 97 switch (type) { 98 case MOD_LOAD: 99 error = 0; 100 LibAliasAttachHandlers(handlers); 101 break; 102 case MOD_UNLOAD: 103 error = 0; 104 LibAliasDetachHandlers(handlers); 105 break; 106 default: 107 error = EINVAL; 108 } 109 return (error); 110 } 111 112 #ifdef _KERNEL 113 static 114 #endif 115 moduledata_t alias_mod = { 116 "alias_skinny", mod_handler, NULL 117 }; 118 119 #ifdef _KERNEL 120 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND); 121 MODULE_VERSION(alias_skinny, 1); 122 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1); 123 #endif 124 125 /* 126 * alias_skinny.c handles the translation for the Cisco Skinny Station 127 * protocol. Skinny typically uses TCP port 2000 to set up calls between 128 * a Cisco Call Manager and a Cisco IP phone. When a phone comes on line, 129 * it first needs to register with the Call Manager. To do this it sends 130 * a registration message. This message contains the IP address of the 131 * IP phone. This message must then be translated to reflect our global 132 * IP address. Along with the registration message (and usually in the 133 * same packet), the phone sends an IP port message. This message indicates 134 * the TCP port over which it will communicate. 135 * 136 * When a call is placed from the phone, the Call Manager will send an 137 * Open Receive Channel message to the phone to let the caller know someone 138 * has answered. The phone then sends back an Open Receive Channel 139 * Acknowledgement. In this packet, the phone sends its IP address again, 140 * and the UDP port over which the voice traffic should flow. These values 141 * need translation. Right after the Open Receive Channel Acknowledgement, 142 * the Call Manager sends a Start Media Transmission message indicating the 143 * call is connected. This message contains the IP address and UDP port 144 * number of the remote (called) party. Once this message is translated, the 145 * call can commence. The called part sends the first UDP packet to the 146 * calling phone at the pre-arranged UDP port in the Open Receive Channel 147 * Acknowledgement. 148 * 149 * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems, 150 * Inc. All rights reserved. 151 */ 152 153 /* #define LIBALIAS_DEBUG 1 */ 154 155 /* Message types that need translating */ 156 #define REG_MSG 0x00000001 157 #define IP_PORT_MSG 0x00000002 158 #define OPNRCVCH_ACK 0x00000022 159 #define START_MEDIATX 0x0000008a 160 161 struct skinny_header { 162 u_int32_t len; 163 u_int32_t reserved; 164 u_int32_t msgId; 165 }; 166 167 struct RegisterMessage { 168 u_int32_t msgId; 169 char devName [16]; 170 u_int32_t uid; 171 u_int32_t instance; 172 u_int32_t ipAddr; 173 u_char devType; 174 u_int32_t maxStreams; 175 }; 176 177 struct IpPortMessage { 178 u_int32_t msgId; 179 u_int32_t stationIpPort; /* Note: Skinny uses 32-bit port 180 * numbers */ 181 }; 182 183 struct OpenReceiveChannelAck { 184 u_int32_t msgId; 185 u_int32_t status; 186 u_int32_t ipAddr; 187 u_int32_t port; 188 u_int32_t passThruPartyID; 189 }; 190 191 struct StartMediaTransmission { 192 u_int32_t msgId; 193 u_int32_t conferenceID; 194 u_int32_t passThruPartyID; 195 u_int32_t remoteIpAddr; 196 u_int32_t remotePort; 197 u_int32_t MSPacket; 198 u_int32_t payloadCap; 199 u_int32_t precedence; 200 u_int32_t silenceSuppression; 201 u_short maxFramesPerPacket; 202 u_int32_t G723BitRate; 203 }; 204 205 typedef enum { 206 ClientToServer = 0, 207 ServerToClient = 1 208 } ConvDirection; 209 210 211 static int 212 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip, 213 struct tcphdr *tc, struct alias_link *lnk, 214 ConvDirection direction) 215 { 216 (void)direction; 217 218 reg_msg->ipAddr = (u_int32_t) GetAliasAddress(lnk).s_addr; 219 220 tc->th_sum = 0; 221 #ifdef _KERNEL 222 tc->th_x2 = 1; 223 #else 224 tc->th_sum = TcpChecksum(pip); 225 #endif 226 227 return (0); 228 } 229 230 static int 231 alias_skinny_startmedia(struct StartMediaTransmission *start_media, 232 struct ip *pip, struct tcphdr *tc, 233 struct alias_link *lnk, u_int32_t localIpAddr, 234 ConvDirection direction) 235 { 236 struct in_addr dst, src; 237 238 (void)pip; 239 (void)tc; 240 (void)lnk; 241 (void)direction; 242 243 dst.s_addr = start_media->remoteIpAddr; 244 src.s_addr = localIpAddr; 245 246 /* 247 * XXX I should probably handle in bound global translations as 248 * well. 249 */ 250 251 return (0); 252 } 253 254 static int 255 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip, 256 struct tcphdr *tc, struct alias_link *lnk, 257 ConvDirection direction) 258 { 259 (void)direction; 260 261 port_msg->stationIpPort = (u_int32_t) ntohs(GetAliasPort(lnk)); 262 263 tc->th_sum = 0; 264 #ifdef _KERNEL 265 tc->th_x2 = 1; 266 #else 267 tc->th_sum = TcpChecksum(pip); 268 #endif 269 return (0); 270 } 271 272 static int 273 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack, 274 struct ip *pip, struct tcphdr *tc, 275 struct alias_link *lnk, u_int32_t * localIpAddr, 276 ConvDirection direction) 277 { 278 struct in_addr null_addr; 279 struct alias_link *opnrcv_lnk; 280 u_int32_t localPort; 281 282 (void)lnk; 283 (void)direction; 284 285 *localIpAddr = (u_int32_t) opnrcvch_ack->ipAddr; 286 localPort = opnrcvch_ack->port; 287 288 null_addr.s_addr = INADDR_ANY; 289 opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr, 290 htons((u_short) opnrcvch_ack->port), 0, 291 IPPROTO_UDP, 1); 292 opnrcvch_ack->ipAddr = (u_int32_t) GetAliasAddress(opnrcv_lnk).s_addr; 293 opnrcvch_ack->port = (u_int32_t) ntohs(GetAliasPort(opnrcv_lnk)); 294 295 tc->th_sum = 0; 296 #ifdef _KERNEL 297 tc->th_x2 = 1; 298 #else 299 tc->th_sum = TcpChecksum(pip); 300 #endif 301 return (0); 302 } 303 304 static void 305 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk) 306 { 307 size_t hlen, tlen, dlen; 308 struct tcphdr *tc; 309 u_int32_t msgId, t, len, lip; 310 struct skinny_header *sd; 311 size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header); 312 ConvDirection direction; 313 314 lip = -1; 315 tc = (struct tcphdr *)ip_next(pip); 316 hlen = (pip->ip_hl + tc->th_off) << 2; 317 tlen = ntohs(pip->ip_len); 318 dlen = tlen - hlen; 319 320 sd = (struct skinny_header *)tcp_next(tc); 321 322 /* 323 * XXX This direction is reserved for future use. I still need to 324 * handle the scenario where the call manager is on the inside, and 325 * the calling phone is on the global outside. 326 */ 327 if (ntohs(tc->th_dport) == la->skinnyPort) { 328 direction = ClientToServer; 329 } else if (ntohs(tc->th_sport) == la->skinnyPort) { 330 direction = ServerToClient; 331 } else { 332 #ifdef LIBALIAS_DEBUG 333 fprintf(stderr, 334 "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n"); 335 #endif 336 return; 337 } 338 339 orig_len = dlen; 340 /* 341 * Skinny packets can contain many messages. We need to loop 342 * through the packet using len to determine message boundaries. 343 * This comes into play big time with port messages being in the 344 * same packet as register messages. Also, open receive channel 345 * acks are usually buried in a packet some 400 bytes long. 346 */ 347 while (dlen >= skinny_hdr_len) { 348 len = (sd->len); 349 msgId = (sd->msgId); 350 t = len; 351 352 if (t > orig_len || t > dlen) { 353 #ifdef LIBALIAS_DEBUG 354 fprintf(stderr, 355 "PacketAlias/Skinny: Not a skinny packet, invalid length \n"); 356 #endif 357 return; 358 } 359 switch (msgId) { 360 case REG_MSG: { 361 struct RegisterMessage *reg_mesg; 362 363 if (len < (int)sizeof(struct RegisterMessage)) { 364 #ifdef LIBALIAS_DEBUG 365 fprintf(stderr, 366 "PacketAlias/Skinny: Not a skinny packet, bad registration message\n"); 367 #endif 368 return; 369 } 370 reg_mesg = (struct RegisterMessage *)&sd->msgId; 371 #ifdef LIBALIAS_DEBUG 372 fprintf(stderr, 373 "PacketAlias/Skinny: Received a register message"); 374 #endif 375 alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction); 376 break; 377 } 378 case IP_PORT_MSG: { 379 struct IpPortMessage *port_mesg; 380 381 if (len < (int)sizeof(struct IpPortMessage)) { 382 #ifdef LIBALIAS_DEBUG 383 fprintf(stderr, 384 "PacketAlias/Skinny: Not a skinny packet, port message\n"); 385 #endif 386 return; 387 } 388 #ifdef LIBALIAS_DEBUG 389 fprintf(stderr, 390 "PacketAlias/Skinny: Received ipport message\n"); 391 #endif 392 port_mesg = (struct IpPortMessage *)&sd->msgId; 393 alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction); 394 break; 395 } 396 case OPNRCVCH_ACK: { 397 struct OpenReceiveChannelAck *opnrcvchn_ack; 398 399 if (len < (int)sizeof(struct OpenReceiveChannelAck)) { 400 #ifdef LIBALIAS_DEBUG 401 fprintf(stderr, 402 "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n"); 403 #endif 404 return; 405 } 406 #ifdef LIBALIAS_DEBUG 407 fprintf(stderr, 408 "PacketAlias/Skinny: Received open rcv channel msg\n"); 409 #endif 410 opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId; 411 alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction); 412 break; 413 } 414 case START_MEDIATX: { 415 struct StartMediaTransmission *startmedia_tx; 416 417 if (len < (int)sizeof(struct StartMediaTransmission)) { 418 #ifdef LIBALIAS_DEBUG 419 fprintf(stderr, 420 "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n"); 421 #endif 422 return; 423 } 424 if (lip == -1) { 425 #ifdef LIBALIAS_DEBUG 426 fprintf(stderr, 427 "PacketAlias/Skinny: received a" 428 " packet,StartMediaTx Message before" 429 " packet,OpnRcvChnAckMsg\n" 430 #endif 431 return; 432 } 433 434 #ifdef LIBALIAS_DEBUG 435 fprintf(stderr, 436 "PacketAlias/Skinny: Received start media trans msg\n"); 437 #endif 438 startmedia_tx = (struct StartMediaTransmission *)&sd->msgId; 439 alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction); 440 break; 441 } 442 default: 443 break; 444 } 445 /* Place the pointer at the next message in the packet. */ 446 dlen -= len + (skinny_hdr_len - sizeof(msgId)); 447 sd = (struct skinny_header *)(((char *)&sd->msgId) + len); 448 } 449 } 450