1 /*- 2 * alias_skinny.c 3 * 4 * SPDX-License-Identifier: BSD-2-Clause 5 * 6 * Copyright (c) 2002, 2003 MarcusCom, Inc. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 * 30 * Author: Joe Marcus Clarke <marcus@FreeBSD.org> 31 */ 32 33 #ifdef _KERNEL 34 #include <sys/param.h> 35 #include <sys/kernel.h> 36 #include <sys/module.h> 37 #else 38 #include <errno.h> 39 #include <stdio.h> 40 #include <unistd.h> 41 #endif 42 43 #include <netinet/in_systm.h> 44 #include <netinet/in.h> 45 #include <netinet/ip.h> 46 #include <netinet/tcp.h> 47 48 #ifdef _KERNEL 49 #include <netinet/libalias/alias_local.h> 50 #include <netinet/libalias/alias_mod.h> 51 #else 52 #include "alias_local.h" 53 #include "alias_mod.h" 54 #endif 55 56 static void 57 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *); 58 59 static int 60 fingerprint(struct libalias *la, struct alias_data *ah) 61 { 62 if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL) 63 return (-1); 64 if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort || 65 ntohs(*ah->dport) == la->skinnyPort)) 66 return (0); 67 return (-1); 68 } 69 70 static int 71 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) 72 { 73 AliasHandleSkinny(la, pip, ah->lnk); 74 return (0); 75 } 76 77 struct proto_handler handlers[] = { 78 { 79 .pri = 110, 80 .dir = IN|OUT, 81 .proto = TCP, 82 .fingerprint = &fingerprint, 83 .protohandler = &protohandler 84 }, 85 { EOH } 86 }; 87 88 static int 89 mod_handler(module_t mod, int type, void *data) 90 { 91 int error; 92 93 switch (type) { 94 case MOD_LOAD: 95 error = 0; 96 LibAliasAttachHandlers(handlers); 97 break; 98 case MOD_UNLOAD: 99 error = 0; 100 LibAliasDetachHandlers(handlers); 101 break; 102 default: 103 error = EINVAL; 104 } 105 return (error); 106 } 107 108 #ifdef _KERNEL 109 static 110 #endif 111 moduledata_t alias_mod = { 112 "alias_skinny", mod_handler, NULL 113 }; 114 115 #ifdef _KERNEL 116 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND); 117 MODULE_VERSION(alias_skinny, 1); 118 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1); 119 #endif 120 121 /* 122 * alias_skinny.c handles the translation for the Cisco Skinny Station 123 * protocol. Skinny typically uses TCP port 2000 to set up calls between 124 * a Cisco Call Manager and a Cisco IP phone. When a phone comes on line, 125 * it first needs to register with the Call Manager. To do this it sends 126 * a registration message. This message contains the IP address of the 127 * IP phone. This message must then be translated to reflect our global 128 * IP address. Along with the registration message (and usually in the 129 * same packet), the phone sends an IP port message. This message indicates 130 * the TCP port over which it will communicate. 131 * 132 * When a call is placed from the phone, the Call Manager will send an 133 * Open Receive Channel message to the phone to let the caller know someone 134 * has answered. The phone then sends back an Open Receive Channel 135 * Acknowledgement. In this packet, the phone sends its IP address again, 136 * and the UDP port over which the voice traffic should flow. These values 137 * need translation. Right after the Open Receive Channel Acknowledgement, 138 * the Call Manager sends a Start Media Transmission message indicating the 139 * call is connected. This message contains the IP address and UDP port 140 * number of the remote (called) party. Once this message is translated, the 141 * call can commence. The called part sends the first UDP packet to the 142 * calling phone at the pre-arranged UDP port in the Open Receive Channel 143 * Acknowledgement. 144 * 145 * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems, 146 * Inc. All rights reserved. 147 */ 148 149 /* #define LIBALIAS_DEBUG 1 */ 150 151 /* Message types that need translating */ 152 #define REG_MSG 0x00000001 153 #define IP_PORT_MSG 0x00000002 154 #define OPNRCVCH_ACK 0x00000022 155 #define START_MEDIATX 0x0000008a 156 157 struct skinny_header { 158 u_int32_t len; 159 u_int32_t reserved; 160 u_int32_t msgId; 161 }; 162 163 struct RegisterMessage { 164 u_int32_t msgId; 165 char devName [16]; 166 u_int32_t uid; 167 u_int32_t instance; 168 u_int32_t ipAddr; 169 u_char devType; 170 u_int32_t maxStreams; 171 }; 172 173 struct IpPortMessage { 174 u_int32_t msgId; 175 u_int32_t stationIpPort; /* Note: Skinny uses 32-bit port 176 * numbers */ 177 }; 178 179 struct OpenReceiveChannelAck { 180 u_int32_t msgId; 181 u_int32_t status; 182 u_int32_t ipAddr; 183 u_int32_t port; 184 u_int32_t passThruPartyID; 185 }; 186 187 struct StartMediaTransmission { 188 u_int32_t msgId; 189 u_int32_t conferenceID; 190 u_int32_t passThruPartyID; 191 u_int32_t remoteIpAddr; 192 u_int32_t remotePort; 193 u_int32_t MSPacket; 194 u_int32_t payloadCap; 195 u_int32_t precedence; 196 u_int32_t silenceSuppression; 197 u_short maxFramesPerPacket; 198 u_int32_t G723BitRate; 199 }; 200 201 typedef enum { 202 ClientToServer = 0, 203 ServerToClient = 1 204 } ConvDirection; 205 206 static int 207 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip, 208 struct tcphdr *tc, struct alias_link *lnk, 209 ConvDirection direction) 210 { 211 (void)direction; 212 213 reg_msg->ipAddr = (u_int32_t)GetAliasAddress(lnk).s_addr; 214 215 tc->th_sum = 0; 216 #ifdef _KERNEL 217 tc->th_x2 = (TH_RES1 >> 8); 218 #else 219 tc->th_sum = TcpChecksum(pip); 220 #endif 221 222 return (0); 223 } 224 225 static int 226 alias_skinny_startmedia(struct StartMediaTransmission *start_media, 227 struct ip *pip, struct tcphdr *tc, 228 struct alias_link *lnk, u_int32_t localIpAddr, 229 ConvDirection direction) 230 { 231 struct in_addr dst __unused, src __unused; 232 233 (void)pip; 234 (void)tc; 235 (void)lnk; 236 (void)direction; 237 238 dst.s_addr = start_media->remoteIpAddr; 239 src.s_addr = localIpAddr; 240 241 /* 242 * XXX I should probably handle in bound global translations as 243 * well. 244 */ 245 246 return (0); 247 } 248 249 static int 250 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip, 251 struct tcphdr *tc, struct alias_link *lnk, 252 ConvDirection direction) 253 { 254 (void)direction; 255 256 port_msg->stationIpPort = (u_int32_t)ntohs(GetAliasPort(lnk)); 257 258 tc->th_sum = 0; 259 #ifdef _KERNEL 260 tc->th_x2 = (TH_RES1 >> 8); 261 #else 262 tc->th_sum = TcpChecksum(pip); 263 #endif 264 return (0); 265 } 266 267 static int 268 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack, 269 struct ip *pip, struct tcphdr *tc, 270 struct alias_link *lnk, u_int32_t * localIpAddr, 271 ConvDirection direction) 272 { 273 struct in_addr null_addr; 274 struct alias_link *opnrcv_lnk; 275 276 (void)lnk; 277 (void)direction; 278 279 *localIpAddr = (u_int32_t)opnrcvch_ack->ipAddr; 280 281 null_addr.s_addr = INADDR_ANY; 282 opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr, 283 htons((u_short) opnrcvch_ack->port), 0, 284 IPPROTO_UDP, 1); 285 opnrcvch_ack->ipAddr = (u_int32_t)GetAliasAddress(opnrcv_lnk).s_addr; 286 opnrcvch_ack->port = (u_int32_t)ntohs(GetAliasPort(opnrcv_lnk)); 287 288 tc->th_sum = 0; 289 #ifdef _KERNEL 290 tc->th_x2 = (TH_RES1 >> 8); 291 #else 292 tc->th_sum = TcpChecksum(pip); 293 #endif 294 return (0); 295 } 296 297 static void 298 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk) 299 { 300 size_t hlen, tlen, dlen; 301 struct tcphdr *tc; 302 u_int32_t msgId, t, len, lip; 303 struct skinny_header *sd; 304 size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header); 305 ConvDirection direction; 306 307 lip = -1; 308 tc = (struct tcphdr *)ip_next(pip); 309 hlen = (pip->ip_hl + tc->th_off) << 2; 310 tlen = ntohs(pip->ip_len); 311 dlen = tlen - hlen; 312 313 sd = (struct skinny_header *)tcp_next(tc); 314 315 /* 316 * XXX This direction is reserved for future use. I still need to 317 * handle the scenario where the call manager is on the inside, and 318 * the calling phone is on the global outside. 319 */ 320 if (ntohs(tc->th_dport) == la->skinnyPort) 321 direction = ClientToServer; 322 else if (ntohs(tc->th_sport) == la->skinnyPort) 323 direction = ServerToClient; 324 else { 325 #ifdef LIBALIAS_DEBUG 326 fprintf(stderr, 327 "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n"); 328 #endif 329 return; 330 } 331 332 orig_len = dlen; 333 /* 334 * Skinny packets can contain many messages. We need to loop 335 * through the packet using len to determine message boundaries. 336 * This comes into play big time with port messages being in the 337 * same packet as register messages. Also, open receive channel 338 * acks are usually buried in a packet some 400 bytes long. 339 */ 340 while (dlen >= skinny_hdr_len) { 341 len = (sd->len); 342 msgId = (sd->msgId); 343 t = len; 344 345 if (t > orig_len || t > dlen) { 346 #ifdef LIBALIAS_DEBUG 347 fprintf(stderr, 348 "PacketAlias/Skinny: Not a skinny packet, invalid length \n"); 349 #endif 350 return; 351 } 352 switch (msgId) { 353 case REG_MSG: { 354 struct RegisterMessage *reg_mesg; 355 356 if (len < (int)sizeof(struct RegisterMessage)) { 357 #ifdef LIBALIAS_DEBUG 358 fprintf(stderr, 359 "PacketAlias/Skinny: Not a skinny packet, bad registration message\n"); 360 #endif 361 return; 362 } 363 reg_mesg = (struct RegisterMessage *)&sd->msgId; 364 #ifdef LIBALIAS_DEBUG 365 fprintf(stderr, 366 "PacketAlias/Skinny: Received a register message"); 367 #endif 368 alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction); 369 break; 370 } 371 case IP_PORT_MSG: { 372 struct IpPortMessage *port_mesg; 373 374 if (len < (int)sizeof(struct IpPortMessage)) { 375 #ifdef LIBALIAS_DEBUG 376 fprintf(stderr, 377 "PacketAlias/Skinny: Not a skinny packet, port message\n"); 378 #endif 379 return; 380 } 381 #ifdef LIBALIAS_DEBUG 382 fprintf(stderr, 383 "PacketAlias/Skinny: Received ipport message\n"); 384 #endif 385 port_mesg = (struct IpPortMessage *)&sd->msgId; 386 alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction); 387 break; 388 } 389 case OPNRCVCH_ACK: { 390 struct OpenReceiveChannelAck *opnrcvchn_ack; 391 392 if (len < (int)sizeof(struct OpenReceiveChannelAck)) { 393 #ifdef LIBALIAS_DEBUG 394 fprintf(stderr, 395 "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n"); 396 #endif 397 return; 398 } 399 #ifdef LIBALIAS_DEBUG 400 fprintf(stderr, 401 "PacketAlias/Skinny: Received open rcv channel msg\n"); 402 #endif 403 opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId; 404 alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction); 405 break; 406 } 407 case START_MEDIATX: { 408 struct StartMediaTransmission *startmedia_tx; 409 410 if (len < (int)sizeof(struct StartMediaTransmission)) { 411 #ifdef LIBALIAS_DEBUG 412 fprintf(stderr, 413 "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n"); 414 #endif 415 return; 416 } 417 if (lip == -1) { 418 #ifdef LIBALIAS_DEBUG 419 fprintf(stderr, 420 "PacketAlias/Skinny: received a" 421 " packet,StartMediaTx Message before" 422 " packet,OpnRcvChnAckMsg\n" 423 #endif 424 return; 425 } 426 427 #ifdef LIBALIAS_DEBUG 428 fprintf(stderr, 429 "PacketAlias/Skinny: Received start media trans msg\n"); 430 #endif 431 startmedia_tx = (struct StartMediaTransmission *)&sd->msgId; 432 alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction); 433 break; 434 } 435 default: 436 break; 437 } 438 /* Place the pointer at the next message in the packet. */ 439 dlen -= len + (skinny_hdr_len - sizeof(msgId)); 440 sd = (struct skinny_header *)(((char *)&sd->msgId) + len); 441 } 442 } 443