xref: /freebsd/sys/netinet/libalias/alias_skinny.c (revision 2a58b312b62f908ec92311d1bd8536dbaeb8e55b)
1 /*-
2  * alias_skinny.c
3  *
4  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
5  *
6  * Copyright (c) 2002, 2003 MarcusCom, Inc.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * Author: Joe Marcus Clarke <marcus@FreeBSD.org>
31  *
32  * $FreeBSD$
33  */
34 
35 #ifdef _KERNEL
36 #include <sys/param.h>
37 #include <sys/kernel.h>
38 #include <sys/module.h>
39 #else
40 #include <errno.h>
41 #include <stdio.h>
42 #include <unistd.h>
43 #endif
44 
45 #include <netinet/in_systm.h>
46 #include <netinet/in.h>
47 #include <netinet/ip.h>
48 #include <netinet/tcp.h>
49 
50 #ifdef _KERNEL
51 #include <netinet/libalias/alias_local.h>
52 #include <netinet/libalias/alias_mod.h>
53 #else
54 #include "alias_local.h"
55 #include "alias_mod.h"
56 #endif
57 
58 static void
59 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *);
60 
61 static int
62 fingerprint(struct libalias *la, struct alias_data *ah)
63 {
64 	if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL)
65 		return (-1);
66 	if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort ||
67 				    ntohs(*ah->dport) == la->skinnyPort))
68 		return (0);
69 	return (-1);
70 }
71 
72 static int
73 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah)
74 {
75 	AliasHandleSkinny(la, pip, ah->lnk);
76 	return (0);
77 }
78 
79 struct proto_handler handlers[] = {
80 	{
81 	  .pri = 110,
82 	  .dir = IN|OUT,
83 	  .proto = TCP,
84 	  .fingerprint = &fingerprint,
85 	  .protohandler = &protohandler
86 	},
87 	{ EOH }
88 };
89 
90 static int
91 mod_handler(module_t mod, int type, void *data)
92 {
93 	int error;
94 
95 	switch (type) {
96 	case MOD_LOAD:
97 		error = 0;
98 		LibAliasAttachHandlers(handlers);
99 		break;
100 	case MOD_UNLOAD:
101 		error = 0;
102 		LibAliasDetachHandlers(handlers);
103 		break;
104 	default:
105 		error = EINVAL;
106 	}
107 	return (error);
108 }
109 
110 #ifdef _KERNEL
111 static
112 #endif
113 moduledata_t alias_mod = {
114        "alias_skinny", mod_handler, NULL
115 };
116 
117 #ifdef _KERNEL
118 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
119 MODULE_VERSION(alias_skinny, 1);
120 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1);
121 #endif
122 
123 /*
124  * alias_skinny.c handles the translation for the Cisco Skinny Station
125  * protocol.  Skinny typically uses TCP port 2000 to set up calls between
126  * a Cisco Call Manager and a Cisco IP phone.  When a phone comes on line,
127  * it first needs to register with the Call Manager.  To do this it sends
128  * a registration message.  This message contains the IP address of the
129  * IP phone.  This message must then be translated to reflect our global
130  * IP address.  Along with the registration message (and usually in the
131  * same packet), the phone sends an IP port message.  This message indicates
132  * the TCP port over which it will communicate.
133  *
134  * When a call is placed from the phone, the Call Manager will send an
135  * Open Receive Channel message to the phone to let the caller know someone
136  * has answered.  The phone then sends back an Open Receive Channel
137  * Acknowledgement.  In this packet, the phone sends its IP address again,
138  * and the UDP port over which the voice traffic should flow.  These values
139  * need translation.  Right after the Open Receive Channel Acknowledgement,
140  * the Call Manager sends a Start Media Transmission message indicating the
141  * call is connected.  This message contains the IP address and UDP port
142  * number of the remote (called) party.  Once this message is translated, the
143  * call can commence.  The called part sends the first UDP packet to the
144  * calling phone at the pre-arranged UDP port in the Open Receive Channel
145  * Acknowledgement.
146  *
147  * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems,
148  * Inc.  All rights reserved.
149 */
150 
151 /* #define LIBALIAS_DEBUG 1 */
152 
153 /* Message types that need translating */
154 #define REG_MSG		0x00000001
155 #define IP_PORT_MSG	0x00000002
156 #define OPNRCVCH_ACK	0x00000022
157 #define START_MEDIATX	0x0000008a
158 
159 struct skinny_header {
160 	u_int32_t	len;
161 	u_int32_t	reserved;
162 	u_int32_t	msgId;
163 };
164 
165 struct RegisterMessage {
166 	u_int32_t	msgId;
167 	char		devName   [16];
168 	u_int32_t	uid;
169 	u_int32_t	instance;
170 	u_int32_t	ipAddr;
171 	u_char		devType;
172 	u_int32_t	maxStreams;
173 };
174 
175 struct IpPortMessage {
176 	u_int32_t	msgId;
177 	u_int32_t	stationIpPort;	/* Note: Skinny uses 32-bit port
178 					 * numbers */
179 };
180 
181 struct OpenReceiveChannelAck {
182 	u_int32_t	msgId;
183 	u_int32_t	status;
184 	u_int32_t	ipAddr;
185 	u_int32_t	port;
186 	u_int32_t	passThruPartyID;
187 };
188 
189 struct StartMediaTransmission {
190 	u_int32_t	msgId;
191 	u_int32_t	conferenceID;
192 	u_int32_t	passThruPartyID;
193 	u_int32_t	remoteIpAddr;
194 	u_int32_t	remotePort;
195 	u_int32_t	MSPacket;
196 	u_int32_t	payloadCap;
197 	u_int32_t	precedence;
198 	u_int32_t	silenceSuppression;
199 	u_short		maxFramesPerPacket;
200 	u_int32_t	G723BitRate;
201 };
202 
203 typedef enum {
204 	ClientToServer = 0,
205 	ServerToClient = 1
206 } ConvDirection;
207 
208 static int
209 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip,
210     struct tcphdr *tc, struct alias_link *lnk,
211     ConvDirection direction)
212 {
213 	(void)direction;
214 
215 	reg_msg->ipAddr = (u_int32_t)GetAliasAddress(lnk).s_addr;
216 
217 	tc->th_sum = 0;
218 #ifdef _KERNEL
219 	tc->th_x2 = (TH_RES1 >> 8);
220 #else
221 	tc->th_sum = TcpChecksum(pip);
222 #endif
223 
224 	return (0);
225 }
226 
227 static int
228 alias_skinny_startmedia(struct StartMediaTransmission *start_media,
229     struct ip *pip, struct tcphdr *tc,
230     struct alias_link *lnk, u_int32_t localIpAddr,
231     ConvDirection direction)
232 {
233 	struct in_addr dst, src;
234 
235 	(void)pip;
236 	(void)tc;
237 	(void)lnk;
238 	(void)direction;
239 
240 	dst.s_addr = start_media->remoteIpAddr;
241 	src.s_addr = localIpAddr;
242 
243 	/*
244 	 * XXX I should probably handle in bound global translations as
245 	 * well.
246 	 */
247 
248 	return (0);
249 }
250 
251 static int
252 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip,
253     struct tcphdr *tc, struct alias_link *lnk,
254     ConvDirection direction)
255 {
256 	(void)direction;
257 
258 	port_msg->stationIpPort = (u_int32_t)ntohs(GetAliasPort(lnk));
259 
260 	tc->th_sum = 0;
261 #ifdef _KERNEL
262 	tc->th_x2 = (TH_RES1 >> 8);
263 #else
264 	tc->th_sum = TcpChecksum(pip);
265 #endif
266 	return (0);
267 }
268 
269 static int
270 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack,
271     struct ip *pip, struct tcphdr *tc,
272     struct alias_link *lnk, u_int32_t * localIpAddr,
273     ConvDirection direction)
274 {
275 	struct in_addr null_addr;
276 	struct alias_link *opnrcv_lnk;
277 
278 	(void)lnk;
279 	(void)direction;
280 
281 	*localIpAddr = (u_int32_t)opnrcvch_ack->ipAddr;
282 
283 	null_addr.s_addr = INADDR_ANY;
284 	opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr,
285 	    htons((u_short) opnrcvch_ack->port), 0,
286 	    IPPROTO_UDP, 1);
287 	opnrcvch_ack->ipAddr = (u_int32_t)GetAliasAddress(opnrcv_lnk).s_addr;
288 	opnrcvch_ack->port = (u_int32_t)ntohs(GetAliasPort(opnrcv_lnk));
289 
290 	tc->th_sum = 0;
291 #ifdef _KERNEL
292 	tc->th_x2 = (TH_RES1 >> 8);
293 #else
294 	tc->th_sum = TcpChecksum(pip);
295 #endif
296 	return (0);
297 }
298 
299 static void
300 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk)
301 {
302 	size_t hlen, tlen, dlen;
303 	struct tcphdr *tc;
304 	u_int32_t msgId, t, len, lip;
305 	struct skinny_header *sd;
306 	size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header);
307 	ConvDirection direction;
308 
309 	lip = -1;
310 	tc = (struct tcphdr *)ip_next(pip);
311 	hlen = (pip->ip_hl + tc->th_off) << 2;
312 	tlen = ntohs(pip->ip_len);
313 	dlen = tlen - hlen;
314 
315 	sd = (struct skinny_header *)tcp_next(tc);
316 
317 	/*
318 	 * XXX This direction is reserved for future use.  I still need to
319 	 * handle the scenario where the call manager is on the inside, and
320 	 * the calling phone is on the global outside.
321 	 */
322 	if (ntohs(tc->th_dport) == la->skinnyPort)
323 		direction = ClientToServer;
324 	else if (ntohs(tc->th_sport) == la->skinnyPort)
325 		direction = ServerToClient;
326 	else {
327 #ifdef LIBALIAS_DEBUG
328 		fprintf(stderr,
329 		    "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n");
330 #endif
331 		return;
332 	}
333 
334 	orig_len = dlen;
335 	/*
336 	 * Skinny packets can contain many messages.  We need to loop
337 	 * through the packet using len to determine message boundaries.
338 	 * This comes into play big time with port messages being in the
339 	 * same packet as register messages.  Also, open receive channel
340 	 * acks are usually buried in a packet some 400 bytes long.
341 	 */
342 	while (dlen >= skinny_hdr_len) {
343 		len = (sd->len);
344 		msgId = (sd->msgId);
345 		t = len;
346 
347 		if (t > orig_len || t > dlen) {
348 #ifdef LIBALIAS_DEBUG
349 			fprintf(stderr,
350 			    "PacketAlias/Skinny: Not a skinny packet, invalid length \n");
351 #endif
352 			return;
353 		}
354 		switch (msgId) {
355 		case REG_MSG: {
356 			struct RegisterMessage *reg_mesg;
357 
358 			if (len < (int)sizeof(struct RegisterMessage)) {
359 #ifdef LIBALIAS_DEBUG
360 				fprintf(stderr,
361 				    "PacketAlias/Skinny: Not a skinny packet, bad registration message\n");
362 #endif
363 				return;
364 			}
365 			reg_mesg = (struct RegisterMessage *)&sd->msgId;
366 #ifdef LIBALIAS_DEBUG
367 			fprintf(stderr,
368 			    "PacketAlias/Skinny: Received a register message");
369 #endif
370 			alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction);
371 			break;
372 		}
373 		case IP_PORT_MSG: {
374 			struct IpPortMessage *port_mesg;
375 
376 			if (len < (int)sizeof(struct IpPortMessage)) {
377 #ifdef LIBALIAS_DEBUG
378 				fprintf(stderr,
379 				    "PacketAlias/Skinny: Not a skinny packet, port message\n");
380 #endif
381 				return;
382 			}
383 #ifdef LIBALIAS_DEBUG
384 			fprintf(stderr,
385 			    "PacketAlias/Skinny: Received ipport message\n");
386 #endif
387 			port_mesg = (struct IpPortMessage *)&sd->msgId;
388 			alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction);
389 			break;
390 		}
391 		case OPNRCVCH_ACK: {
392 			struct OpenReceiveChannelAck *opnrcvchn_ack;
393 
394 			if (len < (int)sizeof(struct OpenReceiveChannelAck)) {
395 #ifdef LIBALIAS_DEBUG
396 				fprintf(stderr,
397 				    "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n");
398 #endif
399 				return;
400 			}
401 #ifdef LIBALIAS_DEBUG
402 			fprintf(stderr,
403 			    "PacketAlias/Skinny: Received open rcv channel msg\n");
404 #endif
405 			opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId;
406 			alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction);
407 			break;
408 		}
409 		case START_MEDIATX: {
410 			struct StartMediaTransmission *startmedia_tx;
411 
412 			if (len < (int)sizeof(struct StartMediaTransmission)) {
413 #ifdef LIBALIAS_DEBUG
414 				fprintf(stderr,
415 				    "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n");
416 #endif
417 				return;
418 			}
419 			if (lip == -1) {
420 #ifdef LIBALIAS_DEBUG
421 				fprintf(stderr,
422 				    "PacketAlias/Skinny: received a"
423 				    " packet,StartMediaTx Message before"
424 				    " packet,OpnRcvChnAckMsg\n"
425 #endif
426 				return;
427 			}
428 
429 #ifdef LIBALIAS_DEBUG
430 			fprintf(stderr,
431 			    "PacketAlias/Skinny: Received start media trans msg\n");
432 #endif
433 			startmedia_tx = (struct StartMediaTransmission *)&sd->msgId;
434 			alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction);
435 			break;
436 		}
437 		default:
438 			break;
439 		}
440 		/* Place the pointer at the next message in the packet. */
441 		dlen -= len + (skinny_hdr_len - sizeof(msgId));
442 		sd = (struct skinny_header *)(((char *)&sd->msgId) + len);
443 	}
444 }
445