1 /*-
2 * alias_skinny.c
3 *
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 * Copyright (c) 2002, 2003 MarcusCom, Inc.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * Author: Joe Marcus Clarke <marcus@FreeBSD.org>
31 */
32
33 #ifdef _KERNEL
34 #include <sys/param.h>
35 #include <sys/kernel.h>
36 #include <sys/module.h>
37 #else
38 #include <errno.h>
39 #include <stdio.h>
40 #include <unistd.h>
41 #endif
42
43 #include <netinet/in_systm.h>
44 #include <netinet/in.h>
45 #include <netinet/ip.h>
46 #include <netinet/tcp.h>
47
48 #ifdef _KERNEL
49 #include <netinet/libalias/alias_local.h>
50 #include <netinet/libalias/alias_mod.h>
51 #else
52 #include "alias_local.h"
53 #include "alias_mod.h"
54 #endif
55
56 static void
57 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *);
58
59 static int
fingerprint(struct libalias * la,struct alias_data * ah)60 fingerprint(struct libalias *la, struct alias_data *ah)
61 {
62 if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL)
63 return (-1);
64 if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort ||
65 ntohs(*ah->dport) == la->skinnyPort))
66 return (0);
67 return (-1);
68 }
69
70 static int
protohandler(struct libalias * la,struct ip * pip,struct alias_data * ah)71 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah)
72 {
73 AliasHandleSkinny(la, pip, ah->lnk);
74 return (0);
75 }
76
77 struct proto_handler handlers[] = {
78 {
79 .pri = 110,
80 .dir = IN|OUT,
81 .proto = TCP,
82 .fingerprint = &fingerprint,
83 .protohandler = &protohandler
84 },
85 { EOH }
86 };
87
88 static int
mod_handler(module_t mod,int type,void * data)89 mod_handler(module_t mod, int type, void *data)
90 {
91 int error;
92
93 switch (type) {
94 case MOD_LOAD:
95 error = 0;
96 LibAliasAttachHandlers(handlers);
97 break;
98 case MOD_UNLOAD:
99 error = 0;
100 LibAliasDetachHandlers(handlers);
101 break;
102 default:
103 error = EINVAL;
104 }
105 return (error);
106 }
107
108 #ifdef _KERNEL
109 static
110 #endif
111 moduledata_t alias_mod = {
112 "alias_skinny", mod_handler, NULL
113 };
114
115 #ifdef _KERNEL
116 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
117 MODULE_VERSION(alias_skinny, 1);
118 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1);
119 #endif
120
121 /*
122 * alias_skinny.c handles the translation for the Cisco Skinny Station
123 * protocol. Skinny typically uses TCP port 2000 to set up calls between
124 * a Cisco Call Manager and a Cisco IP phone. When a phone comes on line,
125 * it first needs to register with the Call Manager. To do this it sends
126 * a registration message. This message contains the IP address of the
127 * IP phone. This message must then be translated to reflect our global
128 * IP address. Along with the registration message (and usually in the
129 * same packet), the phone sends an IP port message. This message indicates
130 * the TCP port over which it will communicate.
131 *
132 * When a call is placed from the phone, the Call Manager will send an
133 * Open Receive Channel message to the phone to let the caller know someone
134 * has answered. The phone then sends back an Open Receive Channel
135 * Acknowledgement. In this packet, the phone sends its IP address again,
136 * and the UDP port over which the voice traffic should flow. These values
137 * need translation. Right after the Open Receive Channel Acknowledgement,
138 * the Call Manager sends a Start Media Transmission message indicating the
139 * call is connected. This message contains the IP address and UDP port
140 * number of the remote (called) party. Once this message is translated, the
141 * call can commence. The called part sends the first UDP packet to the
142 * calling phone at the pre-arranged UDP port in the Open Receive Channel
143 * Acknowledgement.
144 *
145 * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems,
146 * Inc. All rights reserved.
147 */
148
149 /* #define LIBALIAS_DEBUG 1 */
150
151 /* Message types that need translating */
152 #define REG_MSG 0x00000001
153 #define IP_PORT_MSG 0x00000002
154 #define OPNRCVCH_ACK 0x00000022
155 #define START_MEDIATX 0x0000008a
156
157 struct skinny_header {
158 u_int32_t len;
159 u_int32_t reserved;
160 u_int32_t msgId;
161 };
162
163 struct RegisterMessage {
164 u_int32_t msgId;
165 char devName [16];
166 u_int32_t uid;
167 u_int32_t instance;
168 u_int32_t ipAddr;
169 u_char devType;
170 u_int32_t maxStreams;
171 };
172
173 struct IpPortMessage {
174 u_int32_t msgId;
175 u_int32_t stationIpPort; /* Note: Skinny uses 32-bit port
176 * numbers */
177 };
178
179 struct OpenReceiveChannelAck {
180 u_int32_t msgId;
181 u_int32_t status;
182 u_int32_t ipAddr;
183 u_int32_t port;
184 u_int32_t passThruPartyID;
185 };
186
187 struct StartMediaTransmission {
188 u_int32_t msgId;
189 u_int32_t conferenceID;
190 u_int32_t passThruPartyID;
191 u_int32_t remoteIpAddr;
192 u_int32_t remotePort;
193 u_int32_t MSPacket;
194 u_int32_t payloadCap;
195 u_int32_t precedence;
196 u_int32_t silenceSuppression;
197 u_short maxFramesPerPacket;
198 u_int32_t G723BitRate;
199 };
200
201 typedef enum {
202 ClientToServer = 0,
203 ServerToClient = 1
204 } ConvDirection;
205
206 static int
alias_skinny_reg_msg(struct RegisterMessage * reg_msg,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,ConvDirection direction)207 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip,
208 struct tcphdr *tc, struct alias_link *lnk,
209 ConvDirection direction)
210 {
211 (void)direction;
212
213 reg_msg->ipAddr = (u_int32_t)GetAliasAddress(lnk).s_addr;
214
215 tc->th_sum = 0;
216 #ifdef _KERNEL
217 tc->th_x2 = (TH_RES1 >> 8);
218 #else
219 tc->th_sum = TcpChecksum(pip);
220 #endif
221
222 return (0);
223 }
224
225 static int
alias_skinny_startmedia(struct StartMediaTransmission * start_media,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,u_int32_t localIpAddr,ConvDirection direction)226 alias_skinny_startmedia(struct StartMediaTransmission *start_media,
227 struct ip *pip, struct tcphdr *tc,
228 struct alias_link *lnk, u_int32_t localIpAddr,
229 ConvDirection direction)
230 {
231 struct in_addr dst __unused, src __unused;
232
233 (void)pip;
234 (void)tc;
235 (void)lnk;
236 (void)direction;
237
238 dst.s_addr = start_media->remoteIpAddr;
239 src.s_addr = localIpAddr;
240
241 /*
242 * XXX I should probably handle in bound global translations as
243 * well.
244 */
245
246 return (0);
247 }
248
249 static int
alias_skinny_port_msg(struct IpPortMessage * port_msg,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,ConvDirection direction)250 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip,
251 struct tcphdr *tc, struct alias_link *lnk,
252 ConvDirection direction)
253 {
254 (void)direction;
255
256 port_msg->stationIpPort = (u_int32_t)ntohs(GetAliasPort(lnk));
257
258 tc->th_sum = 0;
259 #ifdef _KERNEL
260 tc->th_x2 = (TH_RES1 >> 8);
261 #else
262 tc->th_sum = TcpChecksum(pip);
263 #endif
264 return (0);
265 }
266
267 static int
alias_skinny_opnrcvch_ack(struct libalias * la,struct OpenReceiveChannelAck * opnrcvch_ack,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,u_int32_t * localIpAddr,ConvDirection direction)268 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack,
269 struct ip *pip, struct tcphdr *tc,
270 struct alias_link *lnk, u_int32_t * localIpAddr,
271 ConvDirection direction)
272 {
273 struct in_addr null_addr;
274 struct alias_link *opnrcv_lnk;
275
276 (void)lnk;
277 (void)direction;
278
279 *localIpAddr = (u_int32_t)opnrcvch_ack->ipAddr;
280
281 null_addr.s_addr = INADDR_ANY;
282 opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr,
283 htons((u_short) opnrcvch_ack->port), 0,
284 IPPROTO_UDP, 1);
285 opnrcvch_ack->ipAddr = (u_int32_t)GetAliasAddress(opnrcv_lnk).s_addr;
286 opnrcvch_ack->port = (u_int32_t)ntohs(GetAliasPort(opnrcv_lnk));
287
288 tc->th_sum = 0;
289 #ifdef _KERNEL
290 tc->th_x2 = (TH_RES1 >> 8);
291 #else
292 tc->th_sum = TcpChecksum(pip);
293 #endif
294 return (0);
295 }
296
297 static void
AliasHandleSkinny(struct libalias * la,struct ip * pip,struct alias_link * lnk)298 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk)
299 {
300 size_t hlen, tlen, dlen;
301 struct tcphdr *tc;
302 u_int32_t msgId, t, len, lip;
303 struct skinny_header *sd;
304 size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header);
305 ConvDirection direction;
306
307 lip = -1;
308 tc = (struct tcphdr *)ip_next(pip);
309 hlen = (pip->ip_hl + tc->th_off) << 2;
310 tlen = ntohs(pip->ip_len);
311 dlen = tlen - hlen;
312
313 sd = (struct skinny_header *)tcp_next(tc);
314
315 /*
316 * XXX This direction is reserved for future use. I still need to
317 * handle the scenario where the call manager is on the inside, and
318 * the calling phone is on the global outside.
319 */
320 if (ntohs(tc->th_dport) == la->skinnyPort)
321 direction = ClientToServer;
322 else if (ntohs(tc->th_sport) == la->skinnyPort)
323 direction = ServerToClient;
324 else {
325 #ifdef LIBALIAS_DEBUG
326 fprintf(stderr,
327 "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n");
328 #endif
329 return;
330 }
331
332 orig_len = dlen;
333 /*
334 * Skinny packets can contain many messages. We need to loop
335 * through the packet using len to determine message boundaries.
336 * This comes into play big time with port messages being in the
337 * same packet as register messages. Also, open receive channel
338 * acks are usually buried in a packet some 400 bytes long.
339 */
340 while (dlen >= skinny_hdr_len) {
341 len = (sd->len);
342 msgId = (sd->msgId);
343 t = len;
344
345 if (t > orig_len || t > dlen) {
346 #ifdef LIBALIAS_DEBUG
347 fprintf(stderr,
348 "PacketAlias/Skinny: Not a skinny packet, invalid length \n");
349 #endif
350 return;
351 }
352 switch (msgId) {
353 case REG_MSG: {
354 struct RegisterMessage *reg_mesg;
355
356 if (len < (int)sizeof(struct RegisterMessage)) {
357 #ifdef LIBALIAS_DEBUG
358 fprintf(stderr,
359 "PacketAlias/Skinny: Not a skinny packet, bad registration message\n");
360 #endif
361 return;
362 }
363 reg_mesg = (struct RegisterMessage *)&sd->msgId;
364 #ifdef LIBALIAS_DEBUG
365 fprintf(stderr,
366 "PacketAlias/Skinny: Received a register message");
367 #endif
368 alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction);
369 break;
370 }
371 case IP_PORT_MSG: {
372 struct IpPortMessage *port_mesg;
373
374 if (len < (int)sizeof(struct IpPortMessage)) {
375 #ifdef LIBALIAS_DEBUG
376 fprintf(stderr,
377 "PacketAlias/Skinny: Not a skinny packet, port message\n");
378 #endif
379 return;
380 }
381 #ifdef LIBALIAS_DEBUG
382 fprintf(stderr,
383 "PacketAlias/Skinny: Received ipport message\n");
384 #endif
385 port_mesg = (struct IpPortMessage *)&sd->msgId;
386 alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction);
387 break;
388 }
389 case OPNRCVCH_ACK: {
390 struct OpenReceiveChannelAck *opnrcvchn_ack;
391
392 if (len < (int)sizeof(struct OpenReceiveChannelAck)) {
393 #ifdef LIBALIAS_DEBUG
394 fprintf(stderr,
395 "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n");
396 #endif
397 return;
398 }
399 #ifdef LIBALIAS_DEBUG
400 fprintf(stderr,
401 "PacketAlias/Skinny: Received open rcv channel msg\n");
402 #endif
403 opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId;
404 alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction);
405 break;
406 }
407 case START_MEDIATX: {
408 struct StartMediaTransmission *startmedia_tx;
409
410 if (len < (int)sizeof(struct StartMediaTransmission)) {
411 #ifdef LIBALIAS_DEBUG
412 fprintf(stderr,
413 "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n");
414 #endif
415 return;
416 }
417 if (lip == -1) {
418 #ifdef LIBALIAS_DEBUG
419 fprintf(stderr,
420 "PacketAlias/Skinny: received a"
421 " packet,StartMediaTx Message before"
422 " packet,OpnRcvChnAckMsg\n"
423 #endif
424 return;
425 }
426
427 #ifdef LIBALIAS_DEBUG
428 fprintf(stderr,
429 "PacketAlias/Skinny: Received start media trans msg\n");
430 #endif
431 startmedia_tx = (struct StartMediaTransmission *)&sd->msgId;
432 alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction);
433 break;
434 }
435 default:
436 break;
437 }
438 /* Place the pointer at the next message in the packet. */
439 dlen -= len + (skinny_hdr_len - sizeof(msgId));
440 sd = (struct skinny_header *)(((char *)&sd->msgId) + len);
441 }
442 }
443