1 /*-
2 * alias_skinny.c
3 *
4 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
5 *
6 * Copyright (c) 2002, 2003 MarcusCom, Inc.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * Author: Joe Marcus Clarke <[email protected]>
31 *
32 * $FreeBSD$
33 */
34
35 #ifdef _KERNEL
36 #include <sys/param.h>
37 #include <sys/kernel.h>
38 #include <sys/module.h>
39 #else
40 #include <errno.h>
41 #include <stdio.h>
42 #include <unistd.h>
43 #endif
44
45 #include <netinet/in_systm.h>
46 #include <netinet/in.h>
47 #include <netinet/ip.h>
48 #include <netinet/tcp.h>
49
50 #ifdef _KERNEL
51 #include <netinet/libalias/alias_local.h>
52 #include <netinet/libalias/alias_mod.h>
53 #else
54 #include "alias_local.h"
55 #include "alias_mod.h"
56 #endif
57
58 static void
59 AliasHandleSkinny(struct libalias *, struct ip *, struct alias_link *);
60
61 static int
fingerprint(struct libalias * la,struct alias_data * ah)62 fingerprint(struct libalias *la, struct alias_data *ah)
63 {
64
65 if (ah->dport == NULL || ah->sport == NULL || ah->lnk == NULL)
66 return (-1);
67 if (la->skinnyPort != 0 && (ntohs(*ah->sport) == la->skinnyPort ||
68 ntohs(*ah->dport) == la->skinnyPort))
69 return (0);
70 return (-1);
71 }
72
73 static int
protohandler(struct libalias * la,struct ip * pip,struct alias_data * ah)74 protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah)
75 {
76
77 AliasHandleSkinny(la, pip, ah->lnk);
78 return (0);
79 }
80
81 struct proto_handler handlers[] = {
82 {
83 .pri = 110,
84 .dir = IN|OUT,
85 .proto = TCP,
86 .fingerprint = &fingerprint,
87 .protohandler = &protohandler
88 },
89 { EOH }
90 };
91
92 static int
mod_handler(module_t mod,int type,void * data)93 mod_handler(module_t mod, int type, void *data)
94 {
95 int error;
96
97 switch (type) {
98 case MOD_LOAD:
99 error = 0;
100 LibAliasAttachHandlers(handlers);
101 break;
102 case MOD_UNLOAD:
103 error = 0;
104 LibAliasDetachHandlers(handlers);
105 break;
106 default:
107 error = EINVAL;
108 }
109 return (error);
110 }
111
112 #ifdef _KERNEL
113 static
114 #endif
115 moduledata_t alias_mod = {
116 "alias_skinny", mod_handler, NULL
117 };
118
119 #ifdef _KERNEL
120 DECLARE_MODULE(alias_skinny, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
121 MODULE_VERSION(alias_skinny, 1);
122 MODULE_DEPEND(alias_skinny, libalias, 1, 1, 1);
123 #endif
124
125 /*
126 * alias_skinny.c handles the translation for the Cisco Skinny Station
127 * protocol. Skinny typically uses TCP port 2000 to set up calls between
128 * a Cisco Call Manager and a Cisco IP phone. When a phone comes on line,
129 * it first needs to register with the Call Manager. To do this it sends
130 * a registration message. This message contains the IP address of the
131 * IP phone. This message must then be translated to reflect our global
132 * IP address. Along with the registration message (and usually in the
133 * same packet), the phone sends an IP port message. This message indicates
134 * the TCP port over which it will communicate.
135 *
136 * When a call is placed from the phone, the Call Manager will send an
137 * Open Receive Channel message to the phone to let the caller know someone
138 * has answered. The phone then sends back an Open Receive Channel
139 * Acknowledgement. In this packet, the phone sends its IP address again,
140 * and the UDP port over which the voice traffic should flow. These values
141 * need translation. Right after the Open Receive Channel Acknowledgement,
142 * the Call Manager sends a Start Media Transmission message indicating the
143 * call is connected. This message contains the IP address and UDP port
144 * number of the remote (called) party. Once this message is translated, the
145 * call can commence. The called part sends the first UDP packet to the
146 * calling phone at the pre-arranged UDP port in the Open Receive Channel
147 * Acknowledgement.
148 *
149 * Skinny is a Cisco-proprietary protocol and is a trademark of Cisco Systems,
150 * Inc. All rights reserved.
151 */
152
153 /* #define LIBALIAS_DEBUG 1 */
154
155 /* Message types that need translating */
156 #define REG_MSG 0x00000001
157 #define IP_PORT_MSG 0x00000002
158 #define OPNRCVCH_ACK 0x00000022
159 #define START_MEDIATX 0x0000008a
160
161 struct skinny_header {
162 u_int32_t len;
163 u_int32_t reserved;
164 u_int32_t msgId;
165 };
166
167 struct RegisterMessage {
168 u_int32_t msgId;
169 char devName [16];
170 u_int32_t uid;
171 u_int32_t instance;
172 u_int32_t ipAddr;
173 u_char devType;
174 u_int32_t maxStreams;
175 };
176
177 struct IpPortMessage {
178 u_int32_t msgId;
179 u_int32_t stationIpPort; /* Note: Skinny uses 32-bit port
180 * numbers */
181 };
182
183 struct OpenReceiveChannelAck {
184 u_int32_t msgId;
185 u_int32_t status;
186 u_int32_t ipAddr;
187 u_int32_t port;
188 u_int32_t passThruPartyID;
189 };
190
191 struct StartMediaTransmission {
192 u_int32_t msgId;
193 u_int32_t conferenceID;
194 u_int32_t passThruPartyID;
195 u_int32_t remoteIpAddr;
196 u_int32_t remotePort;
197 u_int32_t MSPacket;
198 u_int32_t payloadCap;
199 u_int32_t precedence;
200 u_int32_t silenceSuppression;
201 u_short maxFramesPerPacket;
202 u_int32_t G723BitRate;
203 };
204
205 typedef enum {
206 ClientToServer = 0,
207 ServerToClient = 1
208 } ConvDirection;
209
210
211 static int
alias_skinny_reg_msg(struct RegisterMessage * reg_msg,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,ConvDirection direction)212 alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip,
213 struct tcphdr *tc, struct alias_link *lnk,
214 ConvDirection direction)
215 {
216 (void)direction;
217
218 reg_msg->ipAddr = (u_int32_t) GetAliasAddress(lnk).s_addr;
219
220 tc->th_sum = 0;
221 #ifdef _KERNEL
222 tc->th_x2 = 1;
223 #else
224 tc->th_sum = TcpChecksum(pip);
225 #endif
226
227 return (0);
228 }
229
230 static int
alias_skinny_startmedia(struct StartMediaTransmission * start_media,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,u_int32_t localIpAddr,ConvDirection direction)231 alias_skinny_startmedia(struct StartMediaTransmission *start_media,
232 struct ip *pip, struct tcphdr *tc,
233 struct alias_link *lnk, u_int32_t localIpAddr,
234 ConvDirection direction)
235 {
236 struct in_addr dst, src;
237
238 (void)pip;
239 (void)tc;
240 (void)lnk;
241 (void)direction;
242
243 dst.s_addr = start_media->remoteIpAddr;
244 src.s_addr = localIpAddr;
245
246 /*
247 * XXX I should probably handle in bound global translations as
248 * well.
249 */
250
251 return (0);
252 }
253
254 static int
alias_skinny_port_msg(struct IpPortMessage * port_msg,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,ConvDirection direction)255 alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip,
256 struct tcphdr *tc, struct alias_link *lnk,
257 ConvDirection direction)
258 {
259 (void)direction;
260
261 port_msg->stationIpPort = (u_int32_t) ntohs(GetAliasPort(lnk));
262
263 tc->th_sum = 0;
264 #ifdef _KERNEL
265 tc->th_x2 = 1;
266 #else
267 tc->th_sum = TcpChecksum(pip);
268 #endif
269 return (0);
270 }
271
272 static int
alias_skinny_opnrcvch_ack(struct libalias * la,struct OpenReceiveChannelAck * opnrcvch_ack,struct ip * pip,struct tcphdr * tc,struct alias_link * lnk,u_int32_t * localIpAddr,ConvDirection direction)273 alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opnrcvch_ack,
274 struct ip *pip, struct tcphdr *tc,
275 struct alias_link *lnk, u_int32_t * localIpAddr,
276 ConvDirection direction)
277 {
278 struct in_addr null_addr;
279 struct alias_link *opnrcv_lnk;
280 u_int32_t localPort;
281
282 (void)lnk;
283 (void)direction;
284
285 *localIpAddr = (u_int32_t) opnrcvch_ack->ipAddr;
286 localPort = opnrcvch_ack->port;
287
288 null_addr.s_addr = INADDR_ANY;
289 opnrcv_lnk = FindUdpTcpOut(la, pip->ip_src, null_addr,
290 htons((u_short) opnrcvch_ack->port), 0,
291 IPPROTO_UDP, 1);
292 opnrcvch_ack->ipAddr = (u_int32_t) GetAliasAddress(opnrcv_lnk).s_addr;
293 opnrcvch_ack->port = (u_int32_t) ntohs(GetAliasPort(opnrcv_lnk));
294
295 tc->th_sum = 0;
296 #ifdef _KERNEL
297 tc->th_x2 = 1;
298 #else
299 tc->th_sum = TcpChecksum(pip);
300 #endif
301 return (0);
302 }
303
304 static void
AliasHandleSkinny(struct libalias * la,struct ip * pip,struct alias_link * lnk)305 AliasHandleSkinny(struct libalias *la, struct ip *pip, struct alias_link *lnk)
306 {
307 size_t hlen, tlen, dlen;
308 struct tcphdr *tc;
309 u_int32_t msgId, t, len, lip;
310 struct skinny_header *sd;
311 size_t orig_len, skinny_hdr_len = sizeof(struct skinny_header);
312 ConvDirection direction;
313
314 lip = -1;
315 tc = (struct tcphdr *)ip_next(pip);
316 hlen = (pip->ip_hl + tc->th_off) << 2;
317 tlen = ntohs(pip->ip_len);
318 dlen = tlen - hlen;
319
320 sd = (struct skinny_header *)tcp_next(tc);
321
322 /*
323 * XXX This direction is reserved for future use. I still need to
324 * handle the scenario where the call manager is on the inside, and
325 * the calling phone is on the global outside.
326 */
327 if (ntohs(tc->th_dport) == la->skinnyPort) {
328 direction = ClientToServer;
329 } else if (ntohs(tc->th_sport) == la->skinnyPort) {
330 direction = ServerToClient;
331 } else {
332 #ifdef LIBALIAS_DEBUG
333 fprintf(stderr,
334 "PacketAlias/Skinny: Invalid port number, not a Skinny packet\n");
335 #endif
336 return;
337 }
338
339 orig_len = dlen;
340 /*
341 * Skinny packets can contain many messages. We need to loop
342 * through the packet using len to determine message boundaries.
343 * This comes into play big time with port messages being in the
344 * same packet as register messages. Also, open receive channel
345 * acks are usually buried in a packet some 400 bytes long.
346 */
347 while (dlen >= skinny_hdr_len) {
348 len = (sd->len);
349 msgId = (sd->msgId);
350 t = len;
351
352 if (t > orig_len || t > dlen) {
353 #ifdef LIBALIAS_DEBUG
354 fprintf(stderr,
355 "PacketAlias/Skinny: Not a skinny packet, invalid length \n");
356 #endif
357 return;
358 }
359 switch (msgId) {
360 case REG_MSG: {
361 struct RegisterMessage *reg_mesg;
362
363 if (len < (int)sizeof(struct RegisterMessage)) {
364 #ifdef LIBALIAS_DEBUG
365 fprintf(stderr,
366 "PacketAlias/Skinny: Not a skinny packet, bad registration message\n");
367 #endif
368 return;
369 }
370 reg_mesg = (struct RegisterMessage *)&sd->msgId;
371 #ifdef LIBALIAS_DEBUG
372 fprintf(stderr,
373 "PacketAlias/Skinny: Received a register message");
374 #endif
375 alias_skinny_reg_msg(reg_mesg, pip, tc, lnk, direction);
376 break;
377 }
378 case IP_PORT_MSG: {
379 struct IpPortMessage *port_mesg;
380
381 if (len < (int)sizeof(struct IpPortMessage)) {
382 #ifdef LIBALIAS_DEBUG
383 fprintf(stderr,
384 "PacketAlias/Skinny: Not a skinny packet, port message\n");
385 #endif
386 return;
387 }
388 #ifdef LIBALIAS_DEBUG
389 fprintf(stderr,
390 "PacketAlias/Skinny: Received ipport message\n");
391 #endif
392 port_mesg = (struct IpPortMessage *)&sd->msgId;
393 alias_skinny_port_msg(port_mesg, pip, tc, lnk, direction);
394 break;
395 }
396 case OPNRCVCH_ACK: {
397 struct OpenReceiveChannelAck *opnrcvchn_ack;
398
399 if (len < (int)sizeof(struct OpenReceiveChannelAck)) {
400 #ifdef LIBALIAS_DEBUG
401 fprintf(stderr,
402 "PacketAlias/Skinny: Not a skinny packet, packet,OpnRcvChnAckMsg\n");
403 #endif
404 return;
405 }
406 #ifdef LIBALIAS_DEBUG
407 fprintf(stderr,
408 "PacketAlias/Skinny: Received open rcv channel msg\n");
409 #endif
410 opnrcvchn_ack = (struct OpenReceiveChannelAck *)&sd->msgId;
411 alias_skinny_opnrcvch_ack(la, opnrcvchn_ack, pip, tc, lnk, &lip, direction);
412 break;
413 }
414 case START_MEDIATX: {
415 struct StartMediaTransmission *startmedia_tx;
416
417 if (len < (int)sizeof(struct StartMediaTransmission)) {
418 #ifdef LIBALIAS_DEBUG
419 fprintf(stderr,
420 "PacketAlias/Skinny: Not a skinny packet,StartMediaTx Message\n");
421 #endif
422 return;
423 }
424 if (lip == -1) {
425 #ifdef LIBALIAS_DEBUG
426 fprintf(stderr,
427 "PacketAlias/Skinny: received a"
428 " packet,StartMediaTx Message before"
429 " packet,OpnRcvChnAckMsg\n"
430 #endif
431 return;
432 }
433
434 #ifdef LIBALIAS_DEBUG
435 fprintf(stderr,
436 "PacketAlias/Skinny: Received start media trans msg\n");
437 #endif
438 startmedia_tx = (struct StartMediaTransmission *)&sd->msgId;
439 alias_skinny_startmedia(startmedia_tx, pip, tc, lnk, lip, direction);
440 break;
441 }
442 default:
443 break;
444 }
445 /* Place the pointer at the next message in the packet. */
446 dlen -= len + (skinny_hdr_len - sizeof(msgId));
447 sd = (struct skinny_header *)(((char *)&sd->msgId) + len);
448 }
449 }
450