1 /*- 2 * alias_skinny.c 3 * 4 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 5 * 6 * Copyright (c) 2002, 2003 MarcusCom, Inc. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 * 30 * Author: Joe Marcus Clarke <marcus@FreeBSD.org> 31 * 32 * $FreeBSD$ 33 */ 34 35 #ifdef _KERNEL 36 #include <sys/param.h> 37 #include <sys/kernel.h> 38 #include <sys/module.h> 39 #else 40 #include <errno.h> 41 #include <stdio.h> 42 #include <unistd.h> 43 #endif 44 45 #include <netinet/in_systm.h> 46 #include <netinet/in.h> 47 #include <netinet/ip.h> 48 #include <netinet/tcp.h> 49 50 #ifdef _KERNEL 51 #include <netinet/libalias/alias_local.h> 52 #include <netinet/libalias/alias_mod.h> 53 #else 54 #include "alias_local.h" 55 #include "alias_mod.h" 56 #endif 57 58 static void 59 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *); 60 61 static int 62 fingerprint(struct libalias *la, struct alias_data *ah) 63 { 64 if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL) 65 return (-1); 66 if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort || 67 ntohs(*ah->dport) == la->skinnyPort)) 68 return (0); 69 return (-1); 70 } 71 72 static int 73 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) 74 { 75 AliasHandleSkinny(la, pip, ah->lnk); 76 return (0); 77 } 78 79 struct proto_handler handlers[] = { 80 { 81 .pri = 110, 82 .dir = IN|OUT, 83 .proto = TCP, 84 .fingerprint = &fingerprint, 85 .protohandler = &protohandler 86 }, 87 { EOH } 88 }; 89 90 static int 91 mod_handler(module_t mod, int type, void *data) 92 { 93 int error; 94 95 switch (type) { 96 case MOD_LOAD: 97 error = 0; 98 LibAliasAttachHandlers(handlers); 99 break; 100 case MOD_UNLOAD: 101 error = 0; 102 LibAliasDetachHandlers(handlers); 103 break; 104 default: 105 error = EINVAL; 106 } 107 return (error); 108 } 109 110 #ifdef _KERNEL 111 static 112 #endif 113 moduledata_t alias_mod = { 114 "alias_skinny", mod_handler, NULL 115 }; 116 117 #ifdef _KERNEL 118 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND); 119 MODULE_VERSION(alias_skinny, 1); 120 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1); 121 #endif 122 123 /* 124 * alias_skinny.c handles the translation for the Cisco Skinny Station 125 * protocol. Skinny typically uses TCP port 2000 to set up calls between 126 * a Cisco Call Manager and a Cisco IP phone. When a phone comes on line, 127 * it first needs to register with the Call Manager. To do this it sends 128 * a registration message. This message contains the IP address of the 129 * IP phone. This message must then be translated to reflect our global 130 * IP address. Along with the registration message (and usually in the 131 * same packet), the phone sends an IP port message. This message indicates 132 * the TCP port over which it will communicate. 133 * 134 * When a call is placed from the phone, the Call Manager will send an 135 * Open Receive Channel message to the phone to let the caller know someone 136 * has answered. The phone then sends back an Open Receive Channel 137 * Acknowledgement. In this packet, the phone sends its IP address again, 138 * and the UDP port over which the voice traffic should flow. These values 139 * need translation. Right after the Open Receive Channel Acknowledgement, 140 * the Call Manager sends a Start Media Transmission message indicating the 141 * call is connected. This message contains the IP address and UDP port 142 * number of the remote (called) party. Once this message is translated, the 143 * call can commence. The called part sends the first UDP packet to the 144 * calling phone at the pre-arranged UDP port in the Open Receive Channel 145 * Acknowledgement. 146 * 147 * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems, 148 * Inc. All rights reserved. 149 */ 150 151 /* #define LIBALIAS_DEBUG 1 */ 152 153 /* Message types that need translating */ 154 #define REG_MSG 0x00000001 155 #define IP_PORT_MSG 0x00000002 156 #define OPNRCVCH_ACK 0x00000022 157 #define START_MEDIATX 0x0000008a 158 159 struct skinny_header { 160 u_int32_t len; 161 u_int32_t reserved; 162 u_int32_t msgId; 163 }; 164 165 struct RegisterMessage { 166 u_int32_t msgId; 167 char devName [16]; 168 u_int32_t uid; 169 u_int32_t instance; 170 u_int32_t ipAddr; 171 u_char devType; 172 u_int32_t maxStreams; 173 }; 174 175 struct IpPortMessage { 176 u_int32_t msgId; 177 u_int32_t stationIpPort; /* Note: Skinny uses 32-bit port 178 * numbers */ 179 }; 180 181 struct OpenReceiveChannelAck { 182 u_int32_t msgId; 183 u_int32_t status; 184 u_int32_t ipAddr; 185 u_int32_t port; 186 u_int32_t passThruPartyID; 187 }; 188 189 struct StartMediaTransmission { 190 u_int32_t msgId; 191 u_int32_t conferenceID; 192 u_int32_t passThruPartyID; 193 u_int32_t remoteIpAddr; 194 u_int32_t remotePort; 195 u_int32_t MSPacket; 196 u_int32_t payloadCap; 197 u_int32_t precedence; 198 u_int32_t silenceSuppression; 199 u_short maxFramesPerPacket; 200 u_int32_t G723BitRate; 201 }; 202 203 typedef enum { 204 ClientToServer = 0, 205 ServerToClient = 1 206 } ConvDirection; 207 208 static int 209 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip, 210 struct tcphdr *tc, struct alias_link *lnk, 211 ConvDirection direction) 212 { 213 (void)direction; 214 215 reg_msg->ipAddr = (u_int32_t)GetAliasAddress(lnk).s_addr; 216 217 tc->th_sum = 0; 218 #ifdef _KERNEL 219 tc->th_x2 = (TH_RES1 >> 8); 220 #else 221 tc->th_sum = TcpChecksum(pip); 222 #endif 223 224 return (0); 225 } 226 227 static int 228 alias_skinny_startmedia(struct StartMediaTransmission *start_media, 229 struct ip *pip, struct tcphdr *tc, 230 struct alias_link *lnk, u_int32_t localIpAddr, 231 ConvDirection direction) 232 { 233 struct in_addr dst, src; 234 235 (void)pip; 236 (void)tc; 237 (void)lnk; 238 (void)direction; 239 240 dst.s_addr = start_media->remoteIpAddr; 241 src.s_addr = localIpAddr; 242 243 /* 244 * XXX I should probably handle in bound global translations as 245 * well. 246 */ 247 248 return (0); 249 } 250 251 static int 252 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip, 253 struct tcphdr *tc, struct alias_link *lnk, 254 ConvDirection direction) 255 { 256 (void)direction; 257 258 port_msg->stationIpPort = (u_int32_t)ntohs(GetAliasPort(lnk)); 259 260 tc->th_sum = 0; 261 #ifdef _KERNEL 262 tc->th_x2 = (TH_RES1 >> 8); 263 #else 264 tc->th_sum = TcpChecksum(pip); 265 #endif 266 return (0); 267 } 268 269 static int 270 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack, 271 struct ip *pip, struct tcphdr *tc, 272 struct alias_link *lnk, u_int32_t * localIpAddr, 273 ConvDirection direction) 274 { 275 struct in_addr null_addr; 276 struct alias_link *opnrcv_lnk; 277 278 (void)lnk; 279 (void)direction; 280 281 *localIpAddr = (u_int32_t)opnrcvch_ack->ipAddr; 282 283 null_addr.s_addr = INADDR_ANY; 284 opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr, 285 htons((u_short) opnrcvch_ack->port), 0, 286 IPPROTO_UDP, 1); 287 opnrcvch_ack->ipAddr = (u_int32_t)GetAliasAddress(opnrcv_lnk).s_addr; 288 opnrcvch_ack->port = (u_int32_t)ntohs(GetAliasPort(opnrcv_lnk)); 289 290 tc->th_sum = 0; 291 #ifdef _KERNEL 292 tc->th_x2 = (TH_RES1 >> 8); 293 #else 294 tc->th_sum = TcpChecksum(pip); 295 #endif 296 return (0); 297 } 298 299 static void 300 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk) 301 { 302 size_t hlen, tlen, dlen; 303 struct tcphdr *tc; 304 u_int32_t msgId, t, len, lip; 305 struct skinny_header *sd; 306 size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header); 307 ConvDirection direction; 308 309 lip = -1; 310 tc = (struct tcphdr *)ip_next(pip); 311 hlen = (pip->ip_hl + tc->th_off) << 2; 312 tlen = ntohs(pip->ip_len); 313 dlen = tlen - hlen; 314 315 sd = (struct skinny_header *)tcp_next(tc); 316 317 /* 318 * XXX This direction is reserved for future use. I still need to 319 * handle the scenario where the call manager is on the inside, and 320 * the calling phone is on the global outside. 321 */ 322 if (ntohs(tc->th_dport) == la->skinnyPort) 323 direction = ClientToServer; 324 else if (ntohs(tc->th_sport) == la->skinnyPort) 325 direction = ServerToClient; 326 else { 327 #ifdef LIBALIAS_DEBUG 328 fprintf(stderr, 329 "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n"); 330 #endif 331 return; 332 } 333 334 orig_len = dlen; 335 /* 336 * Skinny packets can contain many messages. We need to loop 337 * through the packet using len to determine message boundaries. 338 * This comes into play big time with port messages being in the 339 * same packet as register messages. Also, open receive channel 340 * acks are usually buried in a packet some 400 bytes long. 341 */ 342 while (dlen >= skinny_hdr_len) { 343 len = (sd->len); 344 msgId = (sd->msgId); 345 t = len; 346 347 if (t > orig_len || t > dlen) { 348 #ifdef LIBALIAS_DEBUG 349 fprintf(stderr, 350 "PacketAlias/Skinny: Not a skinny packet, invalid length \n"); 351 #endif 352 return; 353 } 354 switch (msgId) { 355 case REG_MSG: { 356 struct RegisterMessage *reg_mesg; 357 358 if (len < (int)sizeof(struct RegisterMessage)) { 359 #ifdef LIBALIAS_DEBUG 360 fprintf(stderr, 361 "PacketAlias/Skinny: Not a skinny packet, bad registration message\n"); 362 #endif 363 return; 364 } 365 reg_mesg = (struct RegisterMessage *)&sd->msgId; 366 #ifdef LIBALIAS_DEBUG 367 fprintf(stderr, 368 "PacketAlias/Skinny: Received a register message"); 369 #endif 370 alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction); 371 break; 372 } 373 case IP_PORT_MSG: { 374 struct IpPortMessage *port_mesg; 375 376 if (len < (int)sizeof(struct IpPortMessage)) { 377 #ifdef LIBALIAS_DEBUG 378 fprintf(stderr, 379 "PacketAlias/Skinny: Not a skinny packet, port message\n"); 380 #endif 381 return; 382 } 383 #ifdef LIBALIAS_DEBUG 384 fprintf(stderr, 385 "PacketAlias/Skinny: Received ipport message\n"); 386 #endif 387 port_mesg = (struct IpPortMessage *)&sd->msgId; 388 alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction); 389 break; 390 } 391 case OPNRCVCH_ACK: { 392 struct OpenReceiveChannelAck *opnrcvchn_ack; 393 394 if (len < (int)sizeof(struct OpenReceiveChannelAck)) { 395 #ifdef LIBALIAS_DEBUG 396 fprintf(stderr, 397 "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n"); 398 #endif 399 return; 400 } 401 #ifdef LIBALIAS_DEBUG 402 fprintf(stderr, 403 "PacketAlias/Skinny: Received open rcv channel msg\n"); 404 #endif 405 opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId; 406 alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction); 407 break; 408 } 409 case START_MEDIATX: { 410 struct StartMediaTransmission *startmedia_tx; 411 412 if (len < (int)sizeof(struct StartMediaTransmission)) { 413 #ifdef LIBALIAS_DEBUG 414 fprintf(stderr, 415 "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n"); 416 #endif 417 return; 418 } 419 if (lip == -1) { 420 #ifdef LIBALIAS_DEBUG 421 fprintf(stderr, 422 "PacketAlias/Skinny: received a" 423 " packet,StartMediaTx Message before" 424 " packet,OpnRcvChnAckMsg\n" 425 #endif 426 return; 427 } 428 429 #ifdef LIBALIAS_DEBUG 430 fprintf(stderr, 431 "PacketAlias/Skinny: Received start media trans msg\n"); 432 #endif 433 startmedia_tx = (struct StartMediaTransmission *)&sd->msgId; 434 alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction); 435 break; 436 } 437 default: 438 break; 439 } 440 /* Place the pointer at the next message in the packet. */ 441 dlen -= len + (skinny_hdr_len - sizeof(msgId)); 442 sd = (struct skinny_header *)(((char *)&sd->msgId) + len); 443 } 444 } 445