xref: /freebsd/sys/netinet/libalias/alias_skinny.c (revision 3ff01b231dfa83d518854c63e7c9cd1debd1139e)
1 /*-
2  * alias_skinny.c
3  *
4  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
5  *
6  * Copyright (c) 2002, 2003 MarcusCom, Inc.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * Author: Joe Marcus Clarke <marcus@FreeBSD.org>
31  *
32  * $FreeBSD$
33  */
34 
35 #ifdef _KERNEL
36 #include <sys/param.h>
37 #include <sys/kernel.h>
38 #include <sys/module.h>
39 #else
40 #include <errno.h>
41 #include <stdio.h>
42 #include <unistd.h>
43 #endif
44 
45 #include <netinet/in_systm.h>
46 #include <netinet/in.h>
47 #include <netinet/ip.h>
48 #include <netinet/tcp.h>
49 
50 #ifdef _KERNEL
51 #include <netinet/libalias/alias_local.h>
52 #include <netinet/libalias/alias_mod.h>
53 #else
54 #include "alias_local.h"
55 #include "alias_mod.h"
56 #endif
57 
58 static void
59 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *);
60 
61 static int
62 fingerprint(struct libalias *la, struct alias_data *ah)
63 {
64 	if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL)
65 		return (-1);
66 	if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort ||
67 				    ntohs(*ah->dport) == la->skinnyPort))
68 		return (0);
69 	return (-1);
70 }
71 
72 static int
73 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah)
74 {
75 	AliasHandleSkinny(la, pip, ah->lnk);
76 	return (0);
77 }
78 
79 struct proto_handler handlers[] = {
80 	{
81 	  .pri = 110,
82 	  .dir = IN|OUT,
83 	  .proto = TCP,
84 	  .fingerprint = &fingerprint,
85 	  .protohandler = &protohandler
86 	},
87 	{ EOH }
88 };
89 
90 static int
91 mod_handler(module_t mod, int type, void *data)
92 {
93 	int error;
94 
95 	switch (type) {
96 	case MOD_LOAD:
97 		error = 0;
98 		LibAliasAttachHandlers(handlers);
99 		break;
100 	case MOD_UNLOAD:
101 		error = 0;
102 		LibAliasDetachHandlers(handlers);
103 		break;
104 	default:
105 		error = EINVAL;
106 	}
107 	return (error);
108 }
109 
110 #ifdef _KERNEL
111 static
112 #endif
113 moduledata_t alias_mod = {
114        "alias_skinny", mod_handler, NULL
115 };
116 
117 #ifdef _KERNEL
118 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
119 MODULE_VERSION(alias_skinny, 1);
120 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1);
121 #endif
122 
123 /*
124  * alias_skinny.c handles the translation for the Cisco Skinny Station
125  * protocol.  Skinny typically uses TCP port 2000 to set up calls between
126  * a Cisco Call Manager and a Cisco IP phone.  When a phone comes on line,
127  * it first needs to register with the Call Manager.  To do this it sends
128  * a registration message.  This message contains the IP address of the
129  * IP phone.  This message must then be translated to reflect our global
130  * IP address.  Along with the registration message (and usually in the
131  * same packet), the phone sends an IP port message.  This message indicates
132  * the TCP port over which it will communicate.
133  *
134  * When a call is placed from the phone, the Call Manager will send an
135  * Open Receive Channel message to the phone to let the caller know someone
136  * has answered.  The phone then sends back an Open Receive Channel
137  * Acknowledgement.  In this packet, the phone sends its IP address again,
138  * and the UDP port over which the voice traffic should flow.  These values
139  * need translation.  Right after the Open Receive Channel Acknowledgement,
140  * the Call Manager sends a Start Media Transmission message indicating the
141  * call is connected.  This message contains the IP address and UDP port
142  * number of the remote (called) party.  Once this message is translated, the
143  * call can commence.  The called part sends the first UDP packet to the
144  * calling phone at the pre-arranged UDP port in the Open Receive Channel
145  * Acknowledgement.
146  *
147  * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems,
148  * Inc.  All rights reserved.
149 */
150 
151 /* #define LIBALIAS_DEBUG 1 */
152 
153 /* Message types that need translating */
154 #define REG_MSG		0x00000001
155 #define IP_PORT_MSG	0x00000002
156 #define OPNRCVCH_ACK	0x00000022
157 #define START_MEDIATX	0x0000008a
158 
159 struct skinny_header {
160 	u_int32_t	len;
161 	u_int32_t	reserved;
162 	u_int32_t	msgId;
163 };
164 
165 struct RegisterMessage {
166 	u_int32_t	msgId;
167 	char		devName   [16];
168 	u_int32_t	uid;
169 	u_int32_t	instance;
170 	u_int32_t	ipAddr;
171 	u_char		devType;
172 	u_int32_t	maxStreams;
173 };
174 
175 struct IpPortMessage {
176 	u_int32_t	msgId;
177 	u_int32_t	stationIpPort;	/* Note: Skinny uses 32-bit port
178 					 * numbers */
179 };
180 
181 struct OpenReceiveChannelAck {
182 	u_int32_t	msgId;
183 	u_int32_t	status;
184 	u_int32_t	ipAddr;
185 	u_int32_t	port;
186 	u_int32_t	passThruPartyID;
187 };
188 
189 struct StartMediaTransmission {
190 	u_int32_t	msgId;
191 	u_int32_t	conferenceID;
192 	u_int32_t	passThruPartyID;
193 	u_int32_t	remoteIpAddr;
194 	u_int32_t	remotePort;
195 	u_int32_t	MSPacket;
196 	u_int32_t	payloadCap;
197 	u_int32_t	precedence;
198 	u_int32_t	silenceSuppression;
199 	u_short		maxFramesPerPacket;
200 	u_int32_t	G723BitRate;
201 };
202 
203 typedef enum {
204 	ClientToServer = 0,
205 	ServerToClient = 1
206 } ConvDirection;
207 
208 static int
209 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip,
210     struct tcphdr *tc, struct alias_link *lnk,
211     ConvDirection direction)
212 {
213 	(void)direction;
214 
215 	reg_msg->ipAddr = (u_int32_t)GetAliasAddress(lnk).s_addr;
216 
217 	tc->th_sum = 0;
218 #ifdef _KERNEL
219 	tc->th_x2 = 1;
220 #else
221 	tc->th_sum = TcpChecksum(pip);
222 #endif
223 
224 	return (0);
225 }
226 
227 static int
228 alias_skinny_startmedia(struct StartMediaTransmission *start_media,
229     struct ip *pip, struct tcphdr *tc,
230     struct alias_link *lnk, u_int32_t localIpAddr,
231     ConvDirection direction)
232 {
233 	struct in_addr dst, src;
234 
235 	(void)pip;
236 	(void)tc;
237 	(void)lnk;
238 	(void)direction;
239 
240 	dst.s_addr = start_media->remoteIpAddr;
241 	src.s_addr = localIpAddr;
242 
243 	/*
244 	 * XXX I should probably handle in bound global translations as
245 	 * well.
246 	 */
247 
248 	return (0);
249 }
250 
251 static int
252 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip,
253     struct tcphdr *tc, struct alias_link *lnk,
254     ConvDirection direction)
255 {
256 	(void)direction;
257 
258 	port_msg->stationIpPort = (u_int32_t)ntohs(GetAliasPort(lnk));
259 
260 	tc->th_sum = 0;
261 #ifdef _KERNEL
262 	tc->th_x2 = 1;
263 #else
264 	tc->th_sum = TcpChecksum(pip);
265 #endif
266 	return (0);
267 }
268 
269 static int
270 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack,
271     struct ip *pip, struct tcphdr *tc,
272     struct alias_link *lnk, u_int32_t * localIpAddr,
273     ConvDirection direction)
274 {
275 	struct in_addr null_addr;
276 	struct alias_link *opnrcv_lnk;
277 	u_int32_t localPort;
278 
279 	(void)lnk;
280 	(void)direction;
281 
282 	*localIpAddr = (u_int32_t)opnrcvch_ack->ipAddr;
283 	localPort = opnrcvch_ack->port;
284 
285 	null_addr.s_addr = INADDR_ANY;
286 	opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr,
287 	    htons((u_short) opnrcvch_ack->port), 0,
288 	    IPPROTO_UDP, 1);
289 	opnrcvch_ack->ipAddr = (u_int32_t)GetAliasAddress(opnrcv_lnk).s_addr;
290 	opnrcvch_ack->port = (u_int32_t)ntohs(GetAliasPort(opnrcv_lnk));
291 
292 	tc->th_sum = 0;
293 #ifdef _KERNEL
294 	tc->th_x2 = 1;
295 #else
296 	tc->th_sum = TcpChecksum(pip);
297 #endif
298 	return (0);
299 }
300 
301 static void
302 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk)
303 {
304 	size_t hlen, tlen, dlen;
305 	struct tcphdr *tc;
306 	u_int32_t msgId, t, len, lip;
307 	struct skinny_header *sd;
308 	size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header);
309 	ConvDirection direction;
310 
311 	lip = -1;
312 	tc = (struct tcphdr *)ip_next(pip);
313 	hlen = (pip->ip_hl + tc->th_off) << 2;
314 	tlen = ntohs(pip->ip_len);
315 	dlen = tlen - hlen;
316 
317 	sd = (struct skinny_header *)tcp_next(tc);
318 
319 	/*
320 	 * XXX This direction is reserved for future use.  I still need to
321 	 * handle the scenario where the call manager is on the inside, and
322 	 * the calling phone is on the global outside.
323 	 */
324 	if (ntohs(tc->th_dport) == la->skinnyPort)
325 		direction = ClientToServer;
326 	else if (ntohs(tc->th_sport) == la->skinnyPort)
327 		direction = ServerToClient;
328 	else {
329 #ifdef LIBALIAS_DEBUG
330 		fprintf(stderr,
331 		    "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n");
332 #endif
333 		return;
334 	}
335 
336 	orig_len = dlen;
337 	/*
338 	 * Skinny packets can contain many messages.  We need to loop
339 	 * through the packet using len to determine message boundaries.
340 	 * This comes into play big time with port messages being in the
341 	 * same packet as register messages.  Also, open receive channel
342 	 * acks are usually buried in a packet some 400 bytes long.
343 	 */
344 	while (dlen >= skinny_hdr_len) {
345 		len = (sd->len);
346 		msgId = (sd->msgId);
347 		t = len;
348 
349 		if (t > orig_len || t > dlen) {
350 #ifdef LIBALIAS_DEBUG
351 			fprintf(stderr,
352 			    "PacketAlias/Skinny: Not a skinny packet, invalid length \n");
353 #endif
354 			return;
355 		}
356 		switch (msgId) {
357 		case REG_MSG: {
358 			struct RegisterMessage *reg_mesg;
359 
360 			if (len < (int)sizeof(struct RegisterMessage)) {
361 #ifdef LIBALIAS_DEBUG
362 				fprintf(stderr,
363 				    "PacketAlias/Skinny: Not a skinny packet, bad registration message\n");
364 #endif
365 				return;
366 			}
367 			reg_mesg = (struct RegisterMessage *)&sd->msgId;
368 #ifdef LIBALIAS_DEBUG
369 			fprintf(stderr,
370 			    "PacketAlias/Skinny: Received a register message");
371 #endif
372 			alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction);
373 			break;
374 		}
375 		case IP_PORT_MSG: {
376 			struct IpPortMessage *port_mesg;
377 
378 			if (len < (int)sizeof(struct IpPortMessage)) {
379 #ifdef LIBALIAS_DEBUG
380 				fprintf(stderr,
381 				    "PacketAlias/Skinny: Not a skinny packet, port message\n");
382 #endif
383 				return;
384 			}
385 #ifdef LIBALIAS_DEBUG
386 			fprintf(stderr,
387 			    "PacketAlias/Skinny: Received ipport message\n");
388 #endif
389 			port_mesg = (struct IpPortMessage *)&sd->msgId;
390 			alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction);
391 			break;
392 		}
393 		case OPNRCVCH_ACK: {
394 			struct OpenReceiveChannelAck *opnrcvchn_ack;
395 
396 			if (len < (int)sizeof(struct OpenReceiveChannelAck)) {
397 #ifdef LIBALIAS_DEBUG
398 				fprintf(stderr,
399 				    "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n");
400 #endif
401 				return;
402 			}
403 #ifdef LIBALIAS_DEBUG
404 			fprintf(stderr,
405 			    "PacketAlias/Skinny: Received open rcv channel msg\n");
406 #endif
407 			opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId;
408 			alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction);
409 			break;
410 		}
411 		case START_MEDIATX: {
412 			struct StartMediaTransmission *startmedia_tx;
413 
414 			if (len < (int)sizeof(struct StartMediaTransmission)) {
415 #ifdef LIBALIAS_DEBUG
416 				fprintf(stderr,
417 				    "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n");
418 #endif
419 				return;
420 			}
421 			if (lip == -1) {
422 #ifdef LIBALIAS_DEBUG
423 				fprintf(stderr,
424 				    "PacketAlias/Skinny: received a"
425 				    " packet,StartMediaTx Message before"
426 				    " packet,OpnRcvChnAckMsg\n"
427 #endif
428 				return;
429 			}
430 
431 #ifdef LIBALIAS_DEBUG
432 			fprintf(stderr,
433 			    "PacketAlias/Skinny: Received start media trans msg\n");
434 #endif
435 			startmedia_tx = (struct StartMediaTransmission *)&sd->msgId;
436 			alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction);
437 			break;
438 		}
439 		default:
440 			break;
441 		}
442 		/* Place the pointer at the next message in the packet. */
443 		dlen -= len + (skinny_hdr_len - sizeof(msgId));
444 		sd = (struct skinny_header *)(((char *)&sd->msgId) + len);
445 	}
446 }
447