]> pilppa.com Git - linux-2.6-omap-h63xx.git/commitdiff
[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port
authorPatrick McHardy <kaber@trash.net>
Sun, 3 Dec 2006 06:08:46 +0000 (22:08 -0800)
committerDavid S. Miller <davem@davemloft.net>
Sun, 3 Dec 2006 06:08:46 +0000 (22:08 -0800)
Add IPv4 and IPv6 capable nf_conntrack port of the H.323 conntrack/NAT helper.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
15 files changed:
include/linux/netfilter/nf_conntrack_h323.h [new file with mode: 0644]
include/linux/netfilter/nf_conntrack_h323_asn1.h [moved from include/linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h with 92% similarity]
include/linux/netfilter/nf_conntrack_h323_types.h [moved from include/linux/netfilter_ipv4/ip_conntrack_helper_h323_types.h with 98% similarity]
include/linux/netfilter_ipv4/Kbuild
include/linux/netfilter_ipv4/ip_conntrack_h323.h
include/net/netfilter/nf_conntrack.h
include/net/netfilter/nf_conntrack_expect.h
net/ipv4/netfilter/Kconfig
net/ipv4/netfilter/Makefile
net/ipv4/netfilter/nf_nat_h323.c [new file with mode: 0644]
net/netfilter/Kconfig
net/netfilter/Makefile
net/netfilter/nf_conntrack_h323_asn1.c [moved from net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c with 99% similarity]
net/netfilter/nf_conntrack_h323_main.c [new file with mode: 0644]
net/netfilter/nf_conntrack_h323_types.c [moved from net/ipv4/netfilter/ip_conntrack_helper_h323_types.c with 99% similarity]

diff --git a/include/linux/netfilter/nf_conntrack_h323.h b/include/linux/netfilter/nf_conntrack_h323.h
new file mode 100644 (file)
index 0000000..08e2f49
--- /dev/null
@@ -0,0 +1,92 @@
+#ifndef _NF_CONNTRACK_H323_H
+#define _NF_CONNTRACK_H323_H
+
+#ifdef __KERNEL__
+
+#include <linux/netfilter/nf_conntrack_h323_asn1.h>
+
+#define RAS_PORT 1719
+#define Q931_PORT 1720
+#define H323_RTP_CHANNEL_MAX 4 /* Audio, video, FAX and other */
+
+/* This structure exists only once per master */
+struct nf_ct_h323_master {
+
+       /* Original and NATed Q.931 or H.245 signal ports */
+       __be16 sig_port[IP_CT_DIR_MAX];
+
+       /* Original and NATed RTP ports */
+       __be16 rtp_port[H323_RTP_CHANNEL_MAX][IP_CT_DIR_MAX];
+
+       union {
+               /* RAS connection timeout */
+               u_int32_t timeout;
+
+               /* Next TPKT length (for separate TPKT header and data) */
+               u_int16_t tpkt_len[IP_CT_DIR_MAX];
+       };
+};
+
+struct nf_conn;
+
+extern int get_h225_addr(struct nf_conn *ct, unsigned char *data,
+                        TransportAddress *taddr,
+                        union nf_conntrack_address *addr, __be16 *port);
+extern void nf_conntrack_h245_expect(struct nf_conn *new,
+                                    struct nf_conntrack_expect *this);
+extern void nf_conntrack_q931_expect(struct nf_conn *new,
+                                    struct nf_conntrack_expect *this);
+extern int (*set_h245_addr_hook) (struct sk_buff **pskb,
+                                 unsigned char **data, int dataoff,
+                                 H245_TransportAddress *taddr,
+                                 union nf_conntrack_address *addr,
+                                 __be16 port);
+extern int (*set_h225_addr_hook) (struct sk_buff **pskb,
+                                 unsigned char **data, int dataoff,
+                                 TransportAddress *taddr,
+                                 union nf_conntrack_address *addr,
+                                 __be16 port);
+extern int (*set_sig_addr_hook) (struct sk_buff **pskb,
+                                struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo,
+                                unsigned char **data,
+                                TransportAddress *taddr, int count);
+extern int (*set_ras_addr_hook) (struct sk_buff **pskb,
+                                struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo,
+                                unsigned char **data,
+                                TransportAddress *taddr, int count);
+extern int (*nat_rtp_rtcp_hook) (struct sk_buff **pskb,
+                                struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo,
+                                unsigned char **data, int dataoff,
+                                H245_TransportAddress *taddr,
+                                __be16 port, __be16 rtp_port,
+                                struct nf_conntrack_expect *rtp_exp,
+                                struct nf_conntrack_expect *rtcp_exp);
+extern int (*nat_t120_hook) (struct sk_buff **pskb, struct nf_conn *ct,
+                            enum ip_conntrack_info ctinfo,
+                            unsigned char **data, int dataoff,
+                            H245_TransportAddress *taddr, __be16 port,
+                            struct nf_conntrack_expect *exp);
+extern int (*nat_h245_hook) (struct sk_buff **pskb, struct nf_conn *ct,
+                            enum ip_conntrack_info ctinfo,
+                            unsigned char **data, int dataoff,
+                            TransportAddress *taddr, __be16 port,
+                            struct nf_conntrack_expect *exp);
+extern int (*nat_callforwarding_hook) (struct sk_buff **pskb,
+                                      struct nf_conn *ct,
+                                      enum ip_conntrack_info ctinfo,
+                                      unsigned char **data, int dataoff,
+                                      TransportAddress *taddr,
+                                      __be16 port,
+                                      struct nf_conntrack_expect *exp);
+extern int (*nat_q931_hook) (struct sk_buff **pskb, struct nf_conn *ct,
+                            enum ip_conntrack_info ctinfo,
+                            unsigned char **data, TransportAddress *taddr,
+                            int idx, __be16 port,
+                            struct nf_conntrack_expect *exp);
+
+#endif
+
+#endif
similarity index 92%
rename from include/linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h
rename to include/linux/netfilter/nf_conntrack_h323_asn1.h
index c6e9a0b6d30ba0e5f8e64171cf15977705bf816f..8dab5968fc7e3756123921a8ea0c46ad3083f187 100644 (file)
@@ -1,6 +1,6 @@
 /****************************************************************************
- * ip_conntrack_helper_h323_asn1.h - BER and PER decoding library for H.323
- *                                  conntrack/NAT module.
+ * ip_conntrack_h323_asn1.h - BER and PER decoding library for H.323
+ *                           conntrack/NAT module.
  *
  * Copyright (c) 2006 by Jing Min Zhao <zhaojingmin@users.sourceforge.net>
  *
  *
  ****************************************************************************/
 
-#ifndef _IP_CONNTRACK_HELPER_H323_ASN1_H_
-#define _IP_CONNTRACK_HELPER_H323_ASN1_H_
+#ifndef _NF_CONNTRACK_HELPER_H323_ASN1_H_
+#define _NF_CONNTRACK_HELPER_H323_ASN1_H_
 
 /*****************************************************************************
  * H.323 Types
  ****************************************************************************/
-#include "ip_conntrack_helper_h323_types.h"
+#include "nf_conntrack_h323_types.h"
 
 typedef struct {
        enum {
similarity index 98%
rename from include/linux/netfilter_ipv4/ip_conntrack_helper_h323_types.h
rename to include/linux/netfilter/nf_conntrack_h323_types.h
index 3d4a773799fcf5a0827e3ba4fe3f9c9b583523af..38d74d5c970098cc8e07c18a5b79c0a448f63f1f 100644 (file)
@@ -10,6 +10,11 @@ typedef struct TransportAddress_ipAddress {  /* SEQUENCE */
        unsigned ip;
 } TransportAddress_ipAddress;
 
+typedef struct TransportAddress_ip6Address {   /* SEQUENCE */
+       int options;            /* No use */
+       unsigned ip6;
+} TransportAddress_ip6Address;
+
 typedef struct TransportAddress {      /* CHOICE */
        enum {
                eTransportAddress_ipAddress,
@@ -22,6 +27,7 @@ typedef struct TransportAddress {     /* CHOICE */
        } choice;
        union {
                TransportAddress_ipAddress ipAddress;
+               TransportAddress_ip6Address ip6Address;
        };
 } TransportAddress;
 
@@ -93,6 +99,11 @@ typedef struct UnicastAddress_iPAddress {    /* SEQUENCE */
        unsigned network;
 } UnicastAddress_iPAddress;
 
+typedef struct UnicastAddress_iP6Address {     /* SEQUENCE */
+       int options;            /* No use */
+       unsigned network;
+} UnicastAddress_iP6Address;
+
 typedef struct UnicastAddress {        /* CHOICE */
        enum {
                eUnicastAddress_iPAddress,
@@ -105,6 +116,7 @@ typedef struct UnicastAddress {     /* CHOICE */
        } choice;
        union {
                UnicastAddress_iPAddress iPAddress;
+               UnicastAddress_iP6Address iP6Address;
        };
 } UnicastAddress;
 
index 591c1a809c0046effc78273ecd8b27e36f1b93aa..180337801a8621110f2709a51b396bcc2a0a9209 100644 (file)
@@ -1,6 +1,4 @@
 header-y += ip_conntrack_helper.h
-header-y += ip_conntrack_helper_h323_asn1.h
-header-y += ip_conntrack_helper_h323_types.h
 header-y += ip_conntrack_protocol.h
 header-y += ip_conntrack_sctp.h
 header-y += ip_conntrack_tcp.h
index 943cc6a4871d172d96ffc19f622ae5edc226c32f..18f769818f4ee45964798ab4e69750c61b91096a 100644 (file)
@@ -3,7 +3,7 @@
 
 #ifdef __KERNEL__
 
-#include <linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h>
+#include <linux/netfilter/nf_conntrack_h323_asn1.h>
 
 #define RAS_PORT 1719
 #define Q931_PORT 1720
index 83694cfdfa8fa723cfd673f945ffad34e608f1bc..1646076933b1925ebe2d60b14fbc709773efabab 100644 (file)
@@ -41,11 +41,13 @@ union nf_conntrack_expect_proto {
 
 /* Add protocol helper include file here */
 #include <linux/netfilter/nf_conntrack_ftp.h>
+#include <linux/netfilter/nf_conntrack_h323.h>
 
 /* per conntrack: application helper private data */
 union nf_conntrack_help {
        /* insert conntrack helper private data (master) here */
        struct nf_ct_ftp_master ct_ftp_info;
+       struct nf_ct_h323_master ct_h323_info;
 };
 
 #include <linux/types.h>
index 54a3d038beaa2d138672fbc9890fd78f8306236d..cef3136e22a32b0799ca7bbbb50012dd9c93e90a 100644 (file)
@@ -41,6 +41,7 @@ struct nf_conntrack_expect
        unsigned int flags;
 
 #ifdef CONFIG_NF_NAT_NEEDED
+       __be32 saved_ip;
        /* This is the original per-proto part, used to map the
         * expected connection the way the recipient expects. */
        union nf_conntrack_man_proto saved_proto;
index 6993ec53dc06ffdd304246e78ddb9620ea47885d..e14156d1122e2e52423430624f21ce0db8389821 100644 (file)
@@ -529,6 +529,11 @@ config IP_NF_NAT_H323
        default IP_NF_NAT if IP_NF_H323=y
        default m if IP_NF_H323=m
 
+config NF_NAT_H323
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_H323
+
 config IP_NF_NAT_SIP
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
index 8893249bbe9805dc7ae9329c3aa21c350ff88c49..bdaba4700e3b13c9fff1743c23b77e340d8d75f4 100644 (file)
@@ -15,7 +15,7 @@ endif
 ip_conntrack_pptp-objs := ip_conntrack_helper_pptp.o ip_conntrack_proto_gre.o
 ip_nat_pptp-objs       := ip_nat_helper_pptp.o ip_nat_proto_gre.o
 
-ip_conntrack_h323-objs := ip_conntrack_helper_h323.o ip_conntrack_helper_h323_asn1.o
+ip_conntrack_h323-objs := ip_conntrack_helper_h323.o ../../netfilter/nf_conntrack_h323_asn1.o
 ip_nat_h323-objs := ip_nat_helper_h323.o
 
 # connection tracking
@@ -52,6 +52,7 @@ obj-$(CONFIG_IP_NF_NAT_SIP) += ip_nat_sip.o
 # NAT helpers (nf_conntrack)
 obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
 obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
+obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
 
 # generic IP tables 
 obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
new file mode 100644 (file)
index 0000000..fb9ab01
--- /dev/null
@@ -0,0 +1,596 @@
+/*
+ * H.323 extension for NAT alteration.
+ *
+ * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
+ *
+ * This source code is licensed under General Public License version 2.
+ *
+ * Based on the 'brute force' H.323 NAT module by
+ * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/tcp.h>
+#include <net/tcp.h>
+
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/nf_nat_helper.h>
+#include <net/netfilter/nf_nat_rule.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_expect.h>
+#include <linux/netfilter/nf_conntrack_h323.h>
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+/****************************************************************************/
+static int set_addr(struct sk_buff **pskb,
+                   unsigned char **data, int dataoff,
+                   unsigned int addroff, __be32 ip, __be16 port)
+{
+       enum ip_conntrack_info ctinfo;
+       struct nf_conn *ct = ip_conntrack_get(*pskb, &ctinfo);
+       struct {
+               __be32 ip;
+               __be16 port;
+       } __attribute__ ((__packed__)) buf;
+       struct tcphdr _tcph, *th;
+
+       buf.ip = ip;
+       buf.port = port;
+       addroff += dataoff;
+
+       if ((*pskb)->nh.iph->protocol == IPPROTO_TCP) {
+               if (!nf_nat_mangle_tcp_packet(pskb, ct, ctinfo,
+                                             addroff, sizeof(buf),
+                                             (char *) &buf, sizeof(buf))) {
+                       if (net_ratelimit())
+                               printk("nf_nat_h323: nf_nat_mangle_tcp_packet"
+                                      " error\n");
+                       return -1;
+               }
+
+               /* Relocate data pointer */
+               th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
+                                       sizeof(_tcph), &_tcph);
+               if (th == NULL)
+                       return -1;
+               *data = (*pskb)->data + (*pskb)->nh.iph->ihl * 4 +
+                   th->doff * 4 + dataoff;
+       } else {
+               if (!nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
+                                             addroff, sizeof(buf),
+                                             (char *) &buf, sizeof(buf))) {
+                       if (net_ratelimit())
+                               printk("nf_nat_h323: nf_nat_mangle_udp_packet"
+                                      " error\n");
+                       return -1;
+               }
+               /* nf_nat_mangle_udp_packet uses skb_make_writable() to copy
+                * or pull everything in a linear buffer, so we can safely
+                * use the skb pointers now */
+               *data = (*pskb)->data + (*pskb)->nh.iph->ihl * 4 +
+                   sizeof(struct udphdr);
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int set_h225_addr(struct sk_buff **pskb,
+                        unsigned char **data, int dataoff,
+                        TransportAddress *taddr,
+                        union nf_conntrack_address *addr, __be16 port)
+{
+       return set_addr(pskb, data, dataoff, taddr->ipAddress.ip,
+                       addr->ip, port);
+}
+
+/****************************************************************************/
+static int set_h245_addr(struct sk_buff **pskb,
+                        unsigned char **data, int dataoff,
+                        H245_TransportAddress *taddr,
+                        union nf_conntrack_address *addr, __be16 port)
+{
+       return set_addr(pskb, data, dataoff,
+                       taddr->unicastAddress.iPAddress.network,
+                       addr->ip, port);
+}
+
+/****************************************************************************/
+static int set_sig_addr(struct sk_buff **pskb, struct nf_conn *ct,
+                       enum ip_conntrack_info ctinfo,
+                       unsigned char **data,
+                       TransportAddress *taddr, int count)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       int i;
+       __be16 port;
+       union nf_conntrack_address addr;
+
+       for (i = 0; i < count; i++) {
+               if (get_h225_addr(ct, *data, &taddr[i], &addr, &port)) {
+                       if (addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
+                           port == info->sig_port[dir]) {
+                               /* GW->GK */
+
+                               /* Fix for Gnomemeeting */
+                               if (i > 0 &&
+                                   get_h225_addr(ct, *data, &taddr[0],
+                                                 &addr, &port) &&
+                                   (ntohl(addr.ip) & 0xff000000) == 0x7f000000)
+                                       i = 0;
+
+                               DEBUGP
+                                   ("nf_nat_ras: set signal address "
+                                    "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+                                    NIPQUAD(ip), port,
+                                    NIPQUAD(ct->tuplehash[!dir].tuple.dst.
+                                            ip), info->sig_port[!dir]);
+                               return set_h225_addr(pskb, data, 0, &taddr[i],
+                                                    &ct->tuplehash[!dir].
+                                                    tuple.dst.u3,
+                                                    info->sig_port[!dir]);
+                       } else if (addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
+                                  port == info->sig_port[dir]) {
+                               /* GK->GW */
+                               DEBUGP
+                                   ("nf_nat_ras: set signal address "
+                                    "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+                                    NIPQUAD(ip), port,
+                                    NIPQUAD(ct->tuplehash[!dir].tuple.src.
+                                            ip), info->sig_port[!dir]);
+                               return set_h225_addr(pskb, data, 0, &taddr[i],
+                                                    &ct->tuplehash[!dir].
+                                                    tuple.src.u3,
+                                                    info->sig_port[!dir]);
+                       }
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int set_ras_addr(struct sk_buff **pskb, struct nf_conn *ct,
+                       enum ip_conntrack_info ctinfo,
+                       unsigned char **data,
+                       TransportAddress *taddr, int count)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int i;
+       __be16 port;
+       union nf_conntrack_address addr;
+
+       for (i = 0; i < count; i++) {
+               if (get_h225_addr(ct, *data, &taddr[i], &addr, &port) &&
+                   addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
+                   port == ct->tuplehash[dir].tuple.src.u.udp.port) {
+                       DEBUGP("nf_nat_ras: set rasAddress "
+                              "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+                              NIPQUAD(ip), ntohs(port),
+                              NIPQUAD(ct->tuplehash[!dir].tuple.dst.u3.ip),
+                              ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.
+                                    port));
+                       return set_h225_addr(pskb, data, 0, &taddr[i],
+                                            &ct->tuplehash[!dir].tuple.dst.u3,
+                                            ct->tuplehash[!dir].tuple.
+                                                               dst.u.udp.port);
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int nat_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
+                       enum ip_conntrack_info ctinfo,
+                       unsigned char **data, int dataoff,
+                       H245_TransportAddress *taddr,
+                       __be16 port, __be16 rtp_port,
+                       struct nf_conntrack_expect *rtp_exp,
+                       struct nf_conntrack_expect *rtcp_exp)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       int i;
+       u_int16_t nated_port;
+
+       /* Set expectations for NAT */
+       rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
+       rtp_exp->expectfn = nf_nat_follow_master;
+       rtp_exp->dir = !dir;
+       rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
+       rtcp_exp->expectfn = nf_nat_follow_master;
+       rtcp_exp->dir = !dir;
+
+       /* Lookup existing expects */
+       for (i = 0; i < H323_RTP_CHANNEL_MAX; i++) {
+               if (info->rtp_port[i][dir] == rtp_port) {
+                       /* Expected */
+
+                       /* Use allocated ports first. This will refresh
+                        * the expects */
+                       rtp_exp->tuple.dst.u.udp.port = info->rtp_port[i][dir];
+                       rtcp_exp->tuple.dst.u.udp.port =
+                           htons(ntohs(info->rtp_port[i][dir]) + 1);
+                       break;
+               } else if (info->rtp_port[i][dir] == 0) {
+                       /* Not expected */
+                       break;
+               }
+       }
+
+       /* Run out of expectations */
+       if (i >= H323_RTP_CHANNEL_MAX) {
+               if (net_ratelimit())
+                       printk("nf_nat_h323: out of expectations\n");
+               return 0;
+       }
+
+       /* Try to get a pair of ports. */
+       for (nated_port = ntohs(rtp_exp->tuple.dst.u.udp.port);
+            nated_port != 0; nated_port += 2) {
+               rtp_exp->tuple.dst.u.udp.port = htons(nated_port);
+               if (nf_conntrack_expect_related(rtp_exp) == 0) {
+                       rtcp_exp->tuple.dst.u.udp.port =
+                           htons(nated_port + 1);
+                       if (nf_conntrack_expect_related(rtcp_exp) == 0)
+                               break;
+                       nf_conntrack_unexpect_related(rtp_exp);
+               }
+       }
+
+       if (nated_port == 0) {  /* No port available */
+               if (net_ratelimit())
+                       printk("nf_nat_h323: out of RTP ports\n");
+               return 0;
+       }
+
+       /* Modify signal */
+       if (set_h245_addr(pskb, data, dataoff, taddr,
+                         &ct->tuplehash[!dir].tuple.dst.u3,
+                         htons((port & htons(1)) ? nated_port + 1 :
+                                                   nated_port)) == 0) {
+               /* Save ports */
+               info->rtp_port[i][dir] = rtp_port;
+               info->rtp_port[i][!dir] = htons(nated_port);
+       } else {
+               nf_conntrack_unexpect_related(rtp_exp);
+               nf_conntrack_unexpect_related(rtcp_exp);
+               return -1;
+       }
+
+       /* Success */
+       DEBUGP("nf_nat_h323: expect RTP %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+              NIPQUAD(rtp_exp->tuple.src.ip),
+              ntohs(rtp_exp->tuple.src.u.udp.port),
+              NIPQUAD(rtp_exp->tuple.dst.ip),
+              ntohs(rtp_exp->tuple.dst.u.udp.port));
+       DEBUGP("nf_nat_h323: expect RTCP %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+              NIPQUAD(rtcp_exp->tuple.src.ip),
+              ntohs(rtcp_exp->tuple.src.u.udp.port),
+              NIPQUAD(rtcp_exp->tuple.dst.ip),
+              ntohs(rtcp_exp->tuple.dst.u.udp.port));
+
+       return 0;
+}
+
+/****************************************************************************/
+static int nat_t120(struct sk_buff **pskb, struct nf_conn *ct,
+                   enum ip_conntrack_info ctinfo,
+                   unsigned char **data, int dataoff,
+                   H245_TransportAddress *taddr, __be16 port,
+                   struct nf_conntrack_expect *exp)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       u_int16_t nated_port = ntohs(port);
+
+       /* Set expectations for NAT */
+       exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
+       exp->expectfn = nf_nat_follow_master;
+       exp->dir = !dir;
+
+       /* Try to get same port: if not, try to change it. */
+       for (; nated_port != 0; nated_port++) {
+               exp->tuple.dst.u.tcp.port = htons(nated_port);
+               if (nf_conntrack_expect_related(exp) == 0)
+                       break;
+       }
+
+       if (nated_port == 0) {  /* No port available */
+               if (net_ratelimit())
+                       printk("nf_nat_h323: out of TCP ports\n");
+               return 0;
+       }
+
+       /* Modify signal */
+       if (set_h245_addr(pskb, data, dataoff, taddr,
+                         &ct->tuplehash[!dir].tuple.dst.u3,
+                         htons(nated_port)) < 0) {
+               nf_conntrack_unexpect_related(exp);
+               return -1;
+       }
+
+       DEBUGP("nf_nat_h323: expect T.120 %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+              NIPQUAD(exp->tuple.src.ip), ntohs(exp->tuple.src.u.tcp.port),
+              NIPQUAD(exp->tuple.dst.ip), ntohs(exp->tuple.dst.u.tcp.port));
+
+       return 0;
+}
+
+/****************************************************************************/
+static int nat_h245(struct sk_buff **pskb, struct nf_conn *ct,
+                   enum ip_conntrack_info ctinfo,
+                   unsigned char **data, int dataoff,
+                   TransportAddress *taddr, __be16 port,
+                   struct nf_conntrack_expect *exp)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       u_int16_t nated_port = ntohs(port);
+
+       /* Set expectations for NAT */
+       exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
+       exp->expectfn = nf_nat_follow_master;
+       exp->dir = !dir;
+
+       /* Check existing expects */
+       if (info->sig_port[dir] == port)
+               nated_port = ntohs(info->sig_port[!dir]);
+
+       /* Try to get same port: if not, try to change it. */
+       for (; nated_port != 0; nated_port++) {
+               exp->tuple.dst.u.tcp.port = htons(nated_port);
+               if (nf_conntrack_expect_related(exp) == 0)
+                       break;
+       }
+
+       if (nated_port == 0) {  /* No port available */
+               if (net_ratelimit())
+                       printk("nf_nat_q931: out of TCP ports\n");
+               return 0;
+       }
+
+       /* Modify signal */
+       if (set_h225_addr(pskb, data, dataoff, taddr,
+                         &ct->tuplehash[!dir].tuple.dst.u3,
+                         htons(nated_port)) == 0) {
+               /* Save ports */
+               info->sig_port[dir] = port;
+               info->sig_port[!dir] = htons(nated_port);
+       } else {
+               nf_conntrack_unexpect_related(exp);
+               return -1;
+       }
+
+       DEBUGP("nf_nat_q931: expect H.245 %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+              NIPQUAD(exp->tuple.src.ip), ntohs(exp->tuple.src.u.tcp.port),
+              NIPQUAD(exp->tuple.dst.ip), ntohs(exp->tuple.dst.u.tcp.port));
+
+       return 0;
+}
+
+/****************************************************************************
+ * This conntrack expect function replaces nf_conntrack_q931_expect()
+ * which was set by nf_conntrack_h323.c.
+ ****************************************************************************/
+static void ip_nat_q931_expect(struct nf_conn *new,
+                              struct nf_conntrack_expect *this)
+{
+       struct ip_nat_range range;
+
+       if (this->tuple.src.u3.ip != 0) {       /* Only accept calls from GK */
+               nf_nat_follow_master(new, this);
+               return;
+       }
+
+       /* This must be a fresh one. */
+       BUG_ON(new->status & IPS_NAT_DONE_MASK);
+
+       /* Change src to where master sends to */
+       range.flags = IP_NAT_RANGE_MAP_IPS;
+       range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
+
+       /* hook doesn't matter, but it has to do source manip */
+       nf_nat_setup_info(new, &range, NF_IP_POST_ROUTING);
+
+       /* For DST manip, map port here to where it's expected. */
+       range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
+       range.min = range.max = this->saved_proto;
+       range.min_ip = range.max_ip =
+           new->master->tuplehash[!this->dir].tuple.src.u3.ip;
+
+       /* hook doesn't matter, but it has to do destination manip */
+       nf_nat_setup_info(new, &range, NF_IP_PRE_ROUTING);
+}
+
+/****************************************************************************/
+static int nat_q931(struct sk_buff **pskb, struct nf_conn *ct,
+                   enum ip_conntrack_info ctinfo,
+                   unsigned char **data, TransportAddress *taddr, int idx,
+                   __be16 port, struct nf_conntrack_expect *exp)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       u_int16_t nated_port = ntohs(port);
+       union nf_conntrack_address addr;
+
+       /* Set expectations for NAT */
+       exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
+       exp->expectfn = ip_nat_q931_expect;
+       exp->dir = !dir;
+
+       /* Check existing expects */
+       if (info->sig_port[dir] == port)
+               nated_port = ntohs(info->sig_port[!dir]);
+
+       /* Try to get same port: if not, try to change it. */
+       for (; nated_port != 0; nated_port++) {
+               exp->tuple.dst.u.tcp.port = htons(nated_port);
+               if (nf_conntrack_expect_related(exp) == 0)
+                       break;
+       }
+
+       if (nated_port == 0) {  /* No port available */
+               if (net_ratelimit())
+                       printk("nf_nat_ras: out of TCP ports\n");
+               return 0;
+       }
+
+       /* Modify signal */
+       if (set_h225_addr(pskb, data, 0, &taddr[idx],
+                         &ct->tuplehash[!dir].tuple.dst.u3,
+                         htons(nated_port)) == 0) {
+               /* Save ports */
+               info->sig_port[dir] = port;
+               info->sig_port[!dir] = htons(nated_port);
+
+               /* Fix for Gnomemeeting */
+               if (idx > 0 &&
+                   get_h225_addr(ct, *data, &taddr[0], &addr, &port) &&
+                   (ntohl(addr.ip) & 0xff000000) == 0x7f000000) {
+                       set_h225_addr_hook(pskb, data, 0, &taddr[0],
+                                          &ct->tuplehash[!dir].tuple.dst.u3,
+                                          info->sig_port[!dir]);
+               }
+       } else {
+               nf_conntrack_unexpect_related(exp);
+               return -1;
+       }
+
+       /* Success */
+       DEBUGP("nf_nat_ras: expect Q.931 %u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+              NIPQUAD(exp->tuple.src.ip), ntohs(exp->tuple.src.u.tcp.port),
+              NIPQUAD(exp->tuple.dst.ip), ntohs(exp->tuple.dst.u.tcp.port));
+
+       return 0;
+}
+
+/****************************************************************************/
+static void ip_nat_callforwarding_expect(struct nf_conn *new,
+                                        struct nf_conntrack_expect *this)
+{
+       struct nf_nat_range range;
+
+       /* This must be a fresh one. */
+       BUG_ON(new->status & IPS_NAT_DONE_MASK);
+
+       /* Change src to where master sends to */
+       range.flags = IP_NAT_RANGE_MAP_IPS;
+       range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
+
+       /* hook doesn't matter, but it has to do source manip */
+       nf_nat_setup_info(new, &range, NF_IP_POST_ROUTING);
+
+       /* For DST manip, map port here to where it's expected. */
+       range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
+       range.min = range.max = this->saved_proto;
+       range.min_ip = range.max_ip = this->saved_ip;
+
+       /* hook doesn't matter, but it has to do destination manip */
+       nf_nat_setup_info(new, &range, NF_IP_PRE_ROUTING);
+}
+
+/****************************************************************************/
+static int nat_callforwarding(struct sk_buff **pskb, struct nf_conn *ct,
+                             enum ip_conntrack_info ctinfo,
+                             unsigned char **data, int dataoff,
+                             TransportAddress *taddr, __be16 port,
+                             struct nf_conntrack_expect *exp)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       u_int16_t nated_port;
+
+       /* Set expectations for NAT */
+       exp->saved_ip = exp->tuple.dst.u3.ip;
+       exp->tuple.dst.u3.ip = ct->tuplehash[!dir].tuple.dst.u3.ip;
+       exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
+       exp->expectfn = ip_nat_callforwarding_expect;
+       exp->dir = !dir;
+
+       /* Try to get same port: if not, try to change it. */
+       for (nated_port = ntohs(port); nated_port != 0; nated_port++) {
+               exp->tuple.dst.u.tcp.port = htons(nated_port);
+               if (nf_conntrack_expect_related(exp) == 0)
+                       break;
+       }
+
+       if (nated_port == 0) {  /* No port available */
+               if (net_ratelimit())
+                       printk("nf_nat_q931: out of TCP ports\n");
+               return 0;
+       }
+
+       /* Modify signal */
+       if (!set_h225_addr(pskb, data, dataoff, taddr,
+                          &ct->tuplehash[!dir].tuple.dst.u3,
+                          htons(nated_port)) == 0) {
+               nf_conntrack_unexpect_related(exp);
+               return -1;
+       }
+
+       /* Success */
+       DEBUGP("nf_nat_q931: expect Call Forwarding "
+              "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
+              NIPQUAD(exp->tuple.src.ip), ntohs(exp->tuple.src.u.tcp.port),
+              NIPQUAD(exp->tuple.dst.ip), ntohs(exp->tuple.dst.u.tcp.port));
+
+       return 0;
+}
+
+/****************************************************************************/
+static int __init init(void)
+{
+       BUG_ON(rcu_dereference(set_h245_addr_hook) != NULL);
+       BUG_ON(rcu_dereference(set_h225_addr_hook) != NULL);
+       BUG_ON(rcu_dereference(set_sig_addr_hook) != NULL);
+       BUG_ON(rcu_dereference(set_ras_addr_hook) != NULL);
+       BUG_ON(rcu_dereference(nat_rtp_rtcp_hook) != NULL);
+       BUG_ON(rcu_dereference(nat_t120_hook) != NULL);
+       BUG_ON(rcu_dereference(nat_h245_hook) != NULL);
+       BUG_ON(rcu_dereference(nat_callforwarding_hook) != NULL);
+       BUG_ON(rcu_dereference(nat_q931_hook) != NULL);
+
+       rcu_assign_pointer(set_h245_addr_hook, set_h245_addr);
+       rcu_assign_pointer(set_h225_addr_hook, set_h225_addr);
+       rcu_assign_pointer(set_sig_addr_hook, set_sig_addr);
+       rcu_assign_pointer(set_ras_addr_hook, set_ras_addr);
+       rcu_assign_pointer(nat_rtp_rtcp_hook, nat_rtp_rtcp);
+       rcu_assign_pointer(nat_t120_hook, nat_t120);
+       rcu_assign_pointer(nat_h245_hook, nat_h245);
+       rcu_assign_pointer(nat_callforwarding_hook, nat_callforwarding);
+       rcu_assign_pointer(nat_q931_hook, nat_q931);
+
+       DEBUGP("nf_nat_h323: init success\n");
+       return 0;
+}
+
+/****************************************************************************/
+static void __exit fini(void)
+{
+       rcu_assign_pointer(set_h245_addr_hook, NULL);
+       rcu_assign_pointer(set_h225_addr_hook, NULL);
+       rcu_assign_pointer(set_sig_addr_hook, NULL);
+       rcu_assign_pointer(set_ras_addr_hook, NULL);
+       rcu_assign_pointer(nat_rtp_rtcp_hook, NULL);
+       rcu_assign_pointer(nat_t120_hook, NULL);
+       rcu_assign_pointer(nat_h245_hook, NULL);
+       rcu_assign_pointer(nat_callforwarding_hook, NULL);
+       rcu_assign_pointer(nat_q931_hook, NULL);
+       synchronize_rcu();
+}
+
+/****************************************************************************/
+module_init(init);
+module_exit(fini);
+
+MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
+MODULE_DESCRIPTION("H.323 NAT helper");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ip_nat_h323");
index f85fd43b344bda6305e74b0b0af04344629f68a4..d8f3451c95b67dbcaab9040d22ba6c490fdeaa81 100644 (file)
@@ -160,6 +160,25 @@ config NF_CONNTRACK_FTP
 
          To compile it as a module, choose M here.  If unsure, say N.
 
+config NF_CONNTRACK_H323
+       tristate "H.323 protocol support (EXPERIMENTAL)"
+       depends on EXPERIMENTAL && NF_CONNTRACK
+       help
+         H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+         important VoIP protocols, it is widely used by voice hardware and
+         software including voice gateways, IP phones, Netmeeting, OpenPhone,
+         Gnomemeeting, etc.
+
+         With this module you can support H.323 on a connection tracking/NAT
+         firewall.
+
+         This module supports RAS, Fast Start, H.245 Tunnelling, Call
+         Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
+         whiteboard, file transfer, etc. For more information, please
+         visit http://nath323.sourceforge.net/.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
 config NF_CT_NETLINK
        tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
        depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
index a5ee9381742718fdbcb96922d15b4359fd0bf231..69b554576b6bfacc6e6c7e636b909964350b006f 100644 (file)
@@ -20,8 +20,11 @@ obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o
 
 # connection tracking helpers
+nf_conntrack_h323-objs := nf_conntrack_h323_main.o nf_conntrack_h323_asn1.o
+
 obj-$(CONFIG_NF_CONNTRACK_AMANDA) += nf_conntrack_amanda.o
 obj-$(CONFIG_NF_CONNTRACK_FTP) += nf_conntrack_ftp.o
+obj-$(CONFIG_NF_CONNTRACK_H323) += nf_conntrack_h323.o
 
 # generic X tables 
 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
similarity index 99%
rename from net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
rename to net/netfilter/nf_conntrack_h323_asn1.c
index 26dfecadb335681ef8c0b28d778d7ef3001c6a5d..f6fad713d484d7558184bf3436031c93948ee60f 100644 (file)
@@ -15,7 +15,7 @@
 #else
 #include <stdio.h>
 #endif
-#include <linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h>
+#include <linux/netfilter/nf_conntrack_h323_asn1.h>
 
 /* Trace Flag */
 #ifndef H323_TRACE
@@ -144,7 +144,7 @@ static decoder_t Decoders[] = {
 /****************************************************************************
  * H.323 Types
  ****************************************************************************/
-#include "ip_conntrack_helper_h323_types.c"
+#include "nf_conntrack_h323_types.c"
 
 /****************************************************************************
  * Functions
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
new file mode 100644 (file)
index 0000000..6d85689
--- /dev/null
@@ -0,0 +1,1856 @@
+/*
+ * H.323 connection tracking helper
+ *
+ * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
+ *
+ * This source code is licensed under General Public License version 2.
+ *
+ * Based on the 'brute force' H.323 connection tracking module by
+ * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ * For more information, please see http://nath323.sourceforge.net/
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/ctype.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <linux/skbuff.h>
+#include <net/route.h>
+#include <net/ip6_route.h>
+
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_tuple.h>
+#include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <linux/netfilter/nf_conntrack_h323.h>
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+/* Parameters */
+static unsigned int default_rrq_ttl __read_mostly = 300;
+module_param(default_rrq_ttl, uint, 0600);
+MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
+
+static int gkrouted_only __read_mostly = 1;
+module_param(gkrouted_only, int, 0600);
+MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
+
+static int callforward_filter __read_mostly = 1;
+module_param(callforward_filter, bool, 0600);
+MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations "
+                                    "if both endpoints are on different sides "
+                                    "(determined by routing information)");
+
+/* Hooks for NAT */
+int (*set_h245_addr_hook) (struct sk_buff **pskb,
+                          unsigned char **data, int dataoff,
+                          H245_TransportAddress *taddr,
+                          union nf_conntrack_address *addr, __be16 port)
+                          __read_mostly;
+int (*set_h225_addr_hook) (struct sk_buff **pskb,
+                          unsigned char **data, int dataoff,
+                          TransportAddress *taddr,
+                          union nf_conntrack_address *addr, __be16 port)
+                          __read_mostly;
+int (*set_sig_addr_hook) (struct sk_buff **pskb,
+                         struct nf_conn *ct,
+                         enum ip_conntrack_info ctinfo,
+                         unsigned char **data,
+                         TransportAddress *taddr, int count) __read_mostly;
+int (*set_ras_addr_hook) (struct sk_buff **pskb,
+                         struct nf_conn *ct,
+                         enum ip_conntrack_info ctinfo,
+                         unsigned char **data,
+                         TransportAddress *taddr, int count) __read_mostly;
+int (*nat_rtp_rtcp_hook) (struct sk_buff **pskb,
+                         struct nf_conn *ct,
+                         enum ip_conntrack_info ctinfo,
+                         unsigned char **data, int dataoff,
+                         H245_TransportAddress *taddr,
+                         __be16 port, __be16 rtp_port,
+                         struct nf_conntrack_expect *rtp_exp,
+                         struct nf_conntrack_expect *rtcp_exp) __read_mostly;
+int (*nat_t120_hook) (struct sk_buff **pskb,
+                     struct nf_conn *ct,
+                     enum ip_conntrack_info ctinfo,
+                     unsigned char **data, int dataoff,
+                     H245_TransportAddress *taddr, __be16 port,
+                     struct nf_conntrack_expect *exp) __read_mostly;
+int (*nat_h245_hook) (struct sk_buff **pskb,
+                     struct nf_conn *ct,
+                     enum ip_conntrack_info ctinfo,
+                     unsigned char **data, int dataoff,
+                     TransportAddress *taddr, __be16 port,
+                     struct nf_conntrack_expect *exp) __read_mostly;
+int (*nat_callforwarding_hook) (struct sk_buff **pskb,
+                               struct nf_conn *ct,
+                               enum ip_conntrack_info ctinfo,
+                               unsigned char **data, int dataoff,
+                               TransportAddress *taddr, __be16 port,
+                               struct nf_conntrack_expect *exp) __read_mostly;
+int (*nat_q931_hook) (struct sk_buff **pskb,
+                     struct nf_conn *ct,
+                     enum ip_conntrack_info ctinfo,
+                     unsigned char **data, TransportAddress *taddr, int idx,
+                     __be16 port, struct nf_conntrack_expect *exp)
+                     __read_mostly;
+
+static DEFINE_SPINLOCK(nf_h323_lock);
+static char *h323_buffer;
+
+static struct nf_conntrack_helper nf_conntrack_helper_h245;
+static struct nf_conntrack_helper nf_conntrack_helper_q931[];
+static struct nf_conntrack_helper nf_conntrack_helper_ras[];
+
+/****************************************************************************/
+static int get_tpkt_data(struct sk_buff **pskb, unsigned int protoff,
+                        struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                        unsigned char **data, int *datalen, int *dataoff)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       struct tcphdr _tcph, *th;
+       int tcpdatalen;
+       int tcpdataoff;
+       unsigned char *tpkt;
+       int tpktlen;
+       int tpktoff;
+
+       /* Get TCP header */
+       th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
+       if (th == NULL)
+               return 0;
+
+       /* Get TCP data offset */
+       tcpdataoff = protoff + th->doff * 4;
+
+       /* Get TCP data length */
+       tcpdatalen = (*pskb)->len - tcpdataoff;
+       if (tcpdatalen <= 0)    /* No TCP data */
+               goto clear_out;
+
+       if (*data == NULL) {    /* first TPKT */
+               /* Get first TPKT pointer */
+               tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
+                                         h323_buffer);
+               BUG_ON(tpkt == NULL);
+
+               /* Validate TPKT identifier */
+               if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
+                       /* Netmeeting sends TPKT header and data separately */
+                       if (info->tpkt_len[dir] > 0) {
+                               DEBUGP("nf_ct_h323: previous packet "
+                                      "indicated separate TPKT data of %hu "
+                                      "bytes\n", info->tpkt_len[dir]);
+                               if (info->tpkt_len[dir] <= tcpdatalen) {
+                                       /* Yes, there was a TPKT header
+                                        * received */
+                                       *data = tpkt;
+                                       *datalen = info->tpkt_len[dir];
+                                       *dataoff = 0;
+                                       goto out;
+                               }
+
+                               /* Fragmented TPKT */
+                               if (net_ratelimit())
+                                       printk("nf_ct_h323: "
+                                              "fragmented TPKT\n");
+                               goto clear_out;
+                       }
+
+                       /* It is not even a TPKT */
+                       return 0;
+               }
+               tpktoff = 0;
+       } else {                /* Next TPKT */
+               tpktoff = *dataoff + *datalen;
+               tcpdatalen -= tpktoff;
+               if (tcpdatalen <= 4)    /* No more TPKT */
+                       goto clear_out;
+               tpkt = *data + *datalen;
+
+               /* Validate TPKT identifier */
+               if (tpkt[0] != 0x03 || tpkt[1] != 0)
+                       goto clear_out;
+       }
+
+       /* Validate TPKT length */
+       tpktlen = tpkt[2] * 256 + tpkt[3];
+       if (tpktlen < 4)
+               goto clear_out;
+       if (tpktlen > tcpdatalen) {
+               if (tcpdatalen == 4) {  /* Separate TPKT header */
+                       /* Netmeeting sends TPKT header and data separately */
+                       DEBUGP("nf_ct_h323: separate TPKT header indicates "
+                              "there will be TPKT data of %hu bytes\n",
+                              tpktlen - 4);
+                       info->tpkt_len[dir] = tpktlen - 4;
+                       return 0;
+               }
+
+               if (net_ratelimit())
+                       printk("nf_ct_h323: incomplete TPKT (fragmented?)\n");
+               goto clear_out;
+       }
+
+       /* This is the encapsulated data */
+       *data = tpkt + 4;
+       *datalen = tpktlen - 4;
+       *dataoff = tpktoff + 4;
+
+      out:
+       /* Clear TPKT length */
+       info->tpkt_len[dir] = 0;
+       return 1;
+
+      clear_out:
+       info->tpkt_len[dir] = 0;
+       return 0;
+}
+
+/****************************************************************************/
+static int get_h245_addr(struct nf_conn *ct, unsigned char *data,
+                        H245_TransportAddress *taddr,
+                        union nf_conntrack_address *addr, __be16 *port)
+{
+       unsigned char *p;
+       int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
+       int len;
+
+       if (taddr->choice != eH245_TransportAddress_unicastAddress)
+               return 0;
+
+       switch (taddr->unicastAddress.choice) {
+       case eUnicastAddress_iPAddress:
+               if (family != AF_INET)
+                       return 0;
+               p = data + taddr->unicastAddress.iPAddress.network;
+               len = 4;
+               break;
+       case eUnicastAddress_iP6Address:
+               if (family != AF_INET6)
+                       return 0;
+               p = data + taddr->unicastAddress.iP6Address.network;
+               len = 16;
+               break;
+       default:
+               return 0;
+       }
+
+       memcpy(addr, p, len);
+       memset((void *)addr + len, 0, sizeof(*addr) - len);
+       memcpy(port, p + len, sizeof(__be16));
+
+       return 1;
+}
+
+/****************************************************************************/
+static int expect_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
+                          enum ip_conntrack_info ctinfo,
+                          unsigned char **data, int dataoff,
+                          H245_TransportAddress *taddr)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       __be16 rtp_port, rtcp_port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *rtp_exp;
+       struct nf_conntrack_expect *rtcp_exp;
+       typeof(nat_rtp_rtcp_hook) nat_rtp_rtcp;
+
+       /* Read RTP or RTCP address */
+       if (!get_h245_addr(ct, *data, taddr, &addr, &port) ||
+           memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) ||
+           port == 0)
+               return 0;
+
+       /* RTP port is even */
+       port &= htons(~1);
+       rtp_port = port;
+       rtcp_port = htons(ntohs(port) + 1);
+
+       /* Create expect for RTP */
+       if ((rtp_exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(rtp_exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3,
+                                &ct->tuplehash[!dir].tuple.dst.u3,
+                                IPPROTO_UDP, NULL, &rtp_port);
+
+       /* Create expect for RTCP */
+       if ((rtcp_exp = nf_conntrack_expect_alloc(ct)) == NULL) {
+               nf_conntrack_expect_put(rtp_exp);
+               return -1;
+       }
+       nf_conntrack_expect_init(rtcp_exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3,
+                                &ct->tuplehash[!dir].tuple.dst.u3,
+                                IPPROTO_UDP, NULL, &rtcp_port);
+
+       if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
+                  &ct->tuplehash[!dir].tuple.dst.u3,
+                  sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
+                  (nat_rtp_rtcp = rcu_dereference(nat_rtp_rtcp_hook)) &&
+                  ct->status & IPS_NAT_MASK) {
+               /* NAT needed */
+               ret = nat_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                                  taddr, port, rtp_port, rtp_exp, rtcp_exp);
+       } else {                /* Conntrack only */
+               if (nf_conntrack_expect_related(rtp_exp) == 0) {
+                       if (nf_conntrack_expect_related(rtcp_exp) == 0) {
+                               DEBUGP("nf_ct_h323: expect RTP ");
+                               NF_CT_DUMP_TUPLE(&rtp_exp->tuple);
+                               DEBUGP("nf_ct_h323: expect RTCP ");
+                               NF_CT_DUMP_TUPLE(&rtcp_exp->tuple);
+                       } else {
+                               nf_conntrack_unexpect_related(rtp_exp);
+                               ret = -1;
+                       }
+               } else
+                       ret = -1;
+       }
+
+       nf_conntrack_expect_put(rtp_exp);
+       nf_conntrack_expect_put(rtcp_exp);
+
+       return ret;
+}
+
+/****************************************************************************/
+static int expect_t120(struct sk_buff **pskb,
+                      struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, int dataoff,
+                      H245_TransportAddress *taddr)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+       typeof(nat_t120_hook) nat_t120;
+
+       /* Read T.120 address */
+       if (!get_h245_addr(ct, *data, taddr, &addr, &port) ||
+           memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) ||
+           port == 0)
+               return 0;
+
+       /* Create expect for T.120 connections */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3,
+                                &ct->tuplehash[!dir].tuple.dst.u3,
+                                IPPROTO_TCP, NULL, &port);
+       exp->flags = NF_CT_EXPECT_PERMANENT;    /* Accept multiple channels */
+
+       if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
+                  &ct->tuplehash[!dir].tuple.dst.u3,
+                  sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
+           (nat_t120 = rcu_dereference(nat_t120_hook)) &&
+           ct->status & IPS_NAT_MASK) {
+               /* NAT needed */
+               ret = nat_t120(pskb, ct, ctinfo, data, dataoff, taddr,
+                              port, exp);
+       } else {                /* Conntrack only */
+               if (nf_conntrack_expect_related(exp) == 0) {
+                       DEBUGP("nf_ct_h323: expect T.120 ");
+                       NF_CT_DUMP_TUPLE(&exp->tuple);
+               } else
+                       ret = -1;
+       }
+
+       nf_conntrack_expect_put(exp);
+
+       return ret;
+}
+
+/****************************************************************************/
+static int process_h245_channel(struct sk_buff **pskb,
+                               struct nf_conn *ct,
+                               enum ip_conntrack_info ctinfo,
+                               unsigned char **data, int dataoff,
+                               H2250LogicalChannelParameters *channel)
+{
+       int ret;
+
+       if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
+               /* RTP */
+               ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                                     &channel->mediaChannel);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (channel->
+           options & eH2250LogicalChannelParameters_mediaControlChannel) {
+               /* RTCP */
+               ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                                     &channel->mediaControlChannel);
+               if (ret < 0)
+                       return -1;
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_olc(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, int dataoff,
+                      OpenLogicalChannel *olc)
+{
+       int ret;
+
+       DEBUGP("nf_ct_h323: OpenLogicalChannel\n");
+
+       if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
+           eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
+       {
+               ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
+                                          &olc->
+                                          forwardLogicalChannelParameters.
+                                          multiplexParameters.
+                                          h2250LogicalChannelParameters);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if ((olc->options &
+            eOpenLogicalChannel_reverseLogicalChannelParameters) &&
+           (olc->reverseLogicalChannelParameters.options &
+            eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
+           && (olc->reverseLogicalChannelParameters.multiplexParameters.
+               choice ==
+               eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
+       {
+               ret =
+                   process_h245_channel(pskb, ct, ctinfo, data, dataoff,
+                                        &olc->
+                                        reverseLogicalChannelParameters.
+                                        multiplexParameters.
+                                        h2250LogicalChannelParameters);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if ((olc->options & eOpenLogicalChannel_separateStack) &&
+           olc->forwardLogicalChannelParameters.dataType.choice ==
+           eDataType_data &&
+           olc->forwardLogicalChannelParameters.dataType.data.application.
+           choice == eDataApplicationCapability_application_t120 &&
+           olc->forwardLogicalChannelParameters.dataType.data.application.
+           t120.choice == eDataProtocolCapability_separateLANStack &&
+           olc->separateStack.networkAddress.choice ==
+           eNetworkAccessParameters_networkAddress_localAreaAddress) {
+               ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
+                                 &olc->separateStack.networkAddress.
+                                 localAreaAddress);
+               if (ret < 0)
+                       return -1;
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
+                       enum ip_conntrack_info ctinfo,
+                       unsigned char **data, int dataoff,
+                       OpenLogicalChannelAck *olca)
+{
+       H2250LogicalChannelAckParameters *ack;
+       int ret;
+
+       DEBUGP("nf_ct_h323: OpenLogicalChannelAck\n");
+
+       if ((olca->options &
+            eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
+           (olca->reverseLogicalChannelParameters.options &
+            eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
+           && (olca->reverseLogicalChannelParameters.multiplexParameters.
+               choice ==
+               eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
+       {
+               ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
+                                          &olca->
+                                          reverseLogicalChannelParameters.
+                                          multiplexParameters.
+                                          h2250LogicalChannelParameters);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if ((olca->options &
+            eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
+           (olca->forwardMultiplexAckParameters.choice ==
+            eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
+       {
+               ack = &olca->forwardMultiplexAckParameters.
+                   h2250LogicalChannelAckParameters;
+               if (ack->options &
+                   eH2250LogicalChannelAckParameters_mediaChannel) {
+                       /* RTP */
+                       ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                                             &ack->mediaChannel);
+                       if (ret < 0)
+                               return -1;
+               }
+
+               if (ack->options &
+                   eH2250LogicalChannelAckParameters_mediaControlChannel) {
+                       /* RTCP */
+                       ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                                             &ack->mediaControlChannel);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_h245(struct sk_buff **pskb, struct nf_conn *ct,
+                       enum ip_conntrack_info ctinfo,
+                       unsigned char **data, int dataoff,
+                       MultimediaSystemControlMessage *mscm)
+{
+       switch (mscm->choice) {
+       case eMultimediaSystemControlMessage_request:
+               if (mscm->request.choice ==
+                   eRequestMessage_openLogicalChannel) {
+                       return process_olc(pskb, ct, ctinfo, data, dataoff,
+                                          &mscm->request.openLogicalChannel);
+               }
+               DEBUGP("nf_ct_h323: H.245 Request %d\n",
+                      mscm->request.choice);
+               break;
+       case eMultimediaSystemControlMessage_response:
+               if (mscm->response.choice ==
+                   eResponseMessage_openLogicalChannelAck) {
+                       return process_olca(pskb, ct, ctinfo, data, dataoff,
+                                           &mscm->response.
+                                           openLogicalChannelAck);
+               }
+               DEBUGP("nf_ct_h323: H.245 Response %d\n",
+                      mscm->response.choice);
+               break;
+       default:
+               DEBUGP("nf_ct_h323: H.245 signal %d\n", mscm->choice);
+               break;
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int h245_help(struct sk_buff **pskb, unsigned int protoff,
+                    struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+       static MultimediaSystemControlMessage mscm;
+       unsigned char *data = NULL;
+       int datalen;
+       int dataoff;
+       int ret;
+
+       /* Until there's been traffic both ways, don't look in packets. */
+       if (ctinfo != IP_CT_ESTABLISHED &&
+           ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
+               return NF_ACCEPT;
+       }
+       DEBUGP("nf_ct_h245: skblen = %u\n", (*pskb)->len);
+
+       spin_lock_bh(&nf_h323_lock);
+
+       /* Process each TPKT */
+       while (get_tpkt_data(pskb, protoff, ct, ctinfo,
+                            &data, &datalen, &dataoff)) {
+               DEBUGP("nf_ct_h245: TPKT len=%d ", datalen);
+               NF_CT_DUMP_TUPLE(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
+
+               /* Decode H.245 signal */
+               ret = DecodeMultimediaSystemControlMessage(data, datalen,
+                                                          &mscm);
+               if (ret < 0) {
+                       if (net_ratelimit())
+                               printk("nf_ct_h245: decoding error: %s\n",
+                                      ret == H323_ERROR_BOUND ?
+                                      "out of bound" : "out of range");
+                       /* We don't drop when decoding error */
+                       break;
+               }
+
+               /* Process H.245 signal */
+               if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
+                       goto drop;
+       }
+
+       spin_unlock_bh(&nf_h323_lock);
+       return NF_ACCEPT;
+
+      drop:
+       spin_unlock_bh(&nf_h323_lock);
+       if (net_ratelimit())
+               printk("nf_ct_h245: packet dropped\n");
+       return NF_DROP;
+}
+
+/****************************************************************************/
+static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
+       .name                   = "H.245",
+       .me                     = THIS_MODULE,
+       .max_expected           = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */,
+       .timeout                = 240,
+       .tuple.dst.protonum     = IPPROTO_UDP,
+       .mask.src.u.udp.port    = __constant_htons(0xFFFF),
+       .mask.dst.protonum      = 0xFF,
+       .help                   = h245_help
+};
+
+/****************************************************************************/
+int get_h225_addr(struct nf_conn *ct, unsigned char *data,
+                 TransportAddress *taddr,
+                 union nf_conntrack_address *addr, __be16 *port)
+{
+       unsigned char *p;
+       int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
+       int len;
+
+       switch (taddr->choice) {
+       case eTransportAddress_ipAddress:
+               if (family != AF_INET)
+                       return 0;
+               p = data + taddr->ipAddress.ip;
+               len = 4;
+               break;
+       case eTransportAddress_ip6Address:
+               if (family != AF_INET6)
+                       return 0;
+               p = data + taddr->ip6Address.ip6;
+               len = 16;
+               break;
+       default:
+               return 0;
+       }
+
+       memcpy(addr, p, len);
+       memset((void *)addr + len, 0, sizeof(*addr) - len);
+       memcpy(port, p + len, sizeof(__be16));
+
+       return 1;
+}
+
+/****************************************************************************/
+static int expect_h245(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, int dataoff,
+                      TransportAddress *taddr)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+       typeof(nat_h245_hook) nat_h245;
+
+       /* Read h245Address */
+       if (!get_h225_addr(ct, *data, taddr, &addr, &port) ||
+           memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) ||
+           port == 0)
+               return 0;
+
+       /* Create expect for h245 connection */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3,
+                                &ct->tuplehash[!dir].tuple.dst.u3,
+                                IPPROTO_TCP, NULL, &port);
+       exp->helper = &nf_conntrack_helper_h245;
+
+       if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
+                  &ct->tuplehash[!dir].tuple.dst.u3,
+                  sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
+           (nat_h245 = rcu_dereference(nat_h245_hook)) &&
+           ct->status & IPS_NAT_MASK) {
+               /* NAT needed */
+               ret = nat_h245(pskb, ct, ctinfo, data, dataoff, taddr,
+                              port, exp);
+       } else {                /* Conntrack only */
+               if (nf_conntrack_expect_related(exp) == 0) {
+                       DEBUGP("nf_ct_q931: expect H.245 ");
+                       NF_CT_DUMP_TUPLE(&exp->tuple);
+               } else
+                       ret = -1;
+       }
+
+       nf_conntrack_expect_put(exp);
+
+       return ret;
+}
+
+/* If the calling party is on the same side of the forward-to party,
+ * we don't need to track the second call */
+static int callforward_do_filter(union nf_conntrack_address *src,
+                                union nf_conntrack_address *dst,
+                                int family)
+{
+       struct flowi fl1, fl2;
+       int ret = 0;
+
+       memset(&fl1, 0, sizeof(fl1));
+       memset(&fl2, 0, sizeof(fl2));
+
+       switch (family) {
+       case AF_INET: {
+               struct rtable *rt1, *rt2;
+
+               fl1.fl4_dst = src->ip;
+               fl2.fl4_dst = dst->ip;
+               if (ip_route_output_key(&rt1, &fl1) == 0) {
+                       if (ip_route_output_key(&rt2, &fl2) == 0) {
+                               if (rt1->rt_gateway == rt2->rt_gateway &&
+                                   rt1->u.dst.dev  == rt2->u.dst.dev)
+                                       ret = 1;
+                               dst_release(&rt2->u.dst);
+                       }
+                       dst_release(&rt1->u.dst);
+               }
+               break;
+       }
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+       case AF_INET6: {
+               struct rt6_info *rt1, *rt2;
+
+               memcpy(&fl1.fl6_dst, src, sizeof(fl1.fl6_dst));
+               memcpy(&fl2.fl6_dst, dst, sizeof(fl2.fl6_dst));
+               rt1 = (struct rt6_info *)ip6_route_output(NULL, &fl1);
+               if (rt1) {
+                       rt2 = (struct rt6_info *)ip6_route_output(NULL, &fl2);
+                       if (rt2) {
+                               if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
+                                           sizeof(rt1->rt6i_gateway)) &&
+                                   rt1->u.dst.dev == rt2->u.dst.dev)
+                                       ret = 1;
+                               dst_release(&rt2->u.dst);
+                       }
+                       dst_release(&rt1->u.dst);
+               }
+               break;
+       }
+#endif
+       }
+       return ret;
+
+}
+
+/****************************************************************************/
+static int expect_callforwarding(struct sk_buff **pskb,
+                                struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo,
+                                unsigned char **data, int dataoff,
+                                TransportAddress *taddr)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+       typeof(nat_callforwarding_hook) nat_callforwarding;
+
+       /* Read alternativeAddress */
+       if (!get_h225_addr(ct, *data, taddr, &addr, &port) || port == 0)
+               return 0;
+
+       /* If the calling party is on the same side of the forward-to party,
+        * we don't need to track the second call */
+       if (callforward_filter &&
+           callforward_do_filter(&addr, &ct->tuplehash[!dir].tuple.src.u3,
+                                 ct->tuplehash[!dir].tuple.src.l3num)) {
+               DEBUGP("nf_ct_q931: Call Forwarding not tracked\n");
+               return 0;
+       }
+
+       /* Create expect for the second call leg */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3, &addr,
+                                IPPROTO_TCP, NULL, &port);
+       exp->helper = nf_conntrack_helper_q931;
+
+       if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
+                  &ct->tuplehash[!dir].tuple.dst.u3,
+                  sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
+           (nat_callforwarding = rcu_dereference(nat_callforwarding_hook)) &&
+           ct->status & IPS_NAT_MASK) {
+               /* Need NAT */
+               ret = nat_callforwarding(pskb, ct, ctinfo, data, dataoff,
+                                        taddr, port, exp);
+       } else {                /* Conntrack only */
+               if (nf_conntrack_expect_related(exp) == 0) {
+                       DEBUGP("nf_ct_q931: expect Call Forwarding ");
+                       NF_CT_DUMP_TUPLE(&exp->tuple);
+               } else
+                       ret = -1;
+       }
+
+       nf_conntrack_expect_put(exp);
+
+       return ret;
+}
+
+/****************************************************************************/
+static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
+                        enum ip_conntrack_info ctinfo,
+                        unsigned char **data, int dataoff,
+                        Setup_UUIE *setup)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret;
+       int i;
+       __be16 port;
+       union nf_conntrack_address addr;
+       typeof(set_h225_addr_hook) set_h225_addr;
+
+       DEBUGP("nf_ct_q931: Setup\n");
+
+       if (setup->options & eSetup_UUIE_h245Address) {
+               ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                                 &setup->h245Address);
+               if (ret < 0)
+                       return -1;
+       }
+
+       set_h225_addr = rcu_dereference(set_h225_addr_hook);
+       if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
+           (set_h225_addr) && ct->status && IPS_NAT_MASK &&
+           get_h225_addr(ct, *data, &setup->destCallSignalAddress,
+                         &addr, &port) &&
+           memcmp(&addr, &ct->tuplehash[!dir].tuple.src.u3, sizeof(addr))) {
+               DEBUGP("nf_ct_q931: set destCallSignalAddress "
+                      NIP6_FMT ":%hu->" NIP6_FMT ":%hu\n",
+                      NIP6(*(struct in6_addr *)&addr), ntohs(port),
+                      NIP6(*(struct in6_addr *)&ct->tuplehash[!dir].tuple.src.u3),
+                      ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
+               ret = set_h225_addr(pskb, data, dataoff,
+                                   &setup->destCallSignalAddress,
+                                   &ct->tuplehash[!dir].tuple.src.u3,
+                                   ct->tuplehash[!dir].tuple.src.u.tcp.port);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
+           (set_h225_addr) && ct->status & IPS_NAT_MASK &&
+           get_h225_addr(ct, *data, &setup->sourceCallSignalAddress,
+                         &addr, &port) &&
+           memcmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3, sizeof(addr))) {
+               DEBUGP("nf_ct_q931: set sourceCallSignalAddress "
+                      NIP6_FMT ":%hu->" NIP6_FMT ":%hu\n",
+                      NIP6(*(struct in6_addr *)&addr), ntohs(port),
+                      NIP6(*(struct in6_addr *)&ct->tuplehash[!dir].tuple.dst.u3),
+                      ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
+               ret = set_h225_addr(pskb, data, dataoff,
+                                   &setup->sourceCallSignalAddress,
+                                   &ct->tuplehash[!dir].tuple.dst.u3,
+                                   ct->tuplehash[!dir].tuple.dst.u.tcp.port);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (setup->options & eSetup_UUIE_fastStart) {
+               for (i = 0; i < setup->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &setup->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_callproceeding(struct sk_buff **pskb,
+                                 struct nf_conn *ct,
+                                 enum ip_conntrack_info ctinfo,
+                                 unsigned char **data, int dataoff,
+                                 CallProceeding_UUIE *callproc)
+{
+       int ret;
+       int i;
+
+       DEBUGP("nf_ct_q931: CallProceeding\n");
+
+       if (callproc->options & eCallProceeding_UUIE_h245Address) {
+               ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                                 &callproc->h245Address);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (callproc->options & eCallProceeding_UUIE_fastStart) {
+               for (i = 0; i < callproc->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &callproc->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_connect(struct sk_buff **pskb, struct nf_conn *ct,
+                          enum ip_conntrack_info ctinfo,
+                          unsigned char **data, int dataoff,
+                          Connect_UUIE *connect)
+{
+       int ret;
+       int i;
+
+       DEBUGP("nf_ct_q931: Connect\n");
+
+       if (connect->options & eConnect_UUIE_h245Address) {
+               ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                                 &connect->h245Address);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (connect->options & eConnect_UUIE_fastStart) {
+               for (i = 0; i < connect->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &connect->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_alerting(struct sk_buff **pskb, struct nf_conn *ct,
+                           enum ip_conntrack_info ctinfo,
+                           unsigned char **data, int dataoff,
+                           Alerting_UUIE *alert)
+{
+       int ret;
+       int i;
+
+       DEBUGP("nf_ct_q931: Alerting\n");
+
+       if (alert->options & eAlerting_UUIE_h245Address) {
+               ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                                 &alert->h245Address);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (alert->options & eAlerting_UUIE_fastStart) {
+               for (i = 0; i < alert->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &alert->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_information(struct sk_buff **pskb,
+                              struct nf_conn *ct,
+                              enum ip_conntrack_info ctinfo,
+                              unsigned char **data, int dataoff,
+                              Information_UUIE *info)
+{
+       int ret;
+       int i;
+
+       DEBUGP("nf_ct_q931: Information\n");
+
+       if (info->options & eInformation_UUIE_fastStart) {
+               for (i = 0; i < info->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &info->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
+                           enum ip_conntrack_info ctinfo,
+                           unsigned char **data, int dataoff,
+                           Facility_UUIE *facility)
+{
+       int ret;
+       int i;
+
+       DEBUGP("nf_ct_q931: Facility\n");
+
+       if (facility->reason.choice == eFacilityReason_callForwarded) {
+               if (facility->options & eFacility_UUIE_alternativeAddress)
+                       return expect_callforwarding(pskb, ct, ctinfo, data,
+                                                    dataoff,
+                                                    &facility->
+                                                    alternativeAddress);
+               return 0;
+       }
+
+       if (facility->options & eFacility_UUIE_h245Address) {
+               ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                                 &facility->h245Address);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (facility->options & eFacility_UUIE_fastStart) {
+               for (i = 0; i < facility->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &facility->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_progress(struct sk_buff **pskb, struct nf_conn *ct,
+                           enum ip_conntrack_info ctinfo,
+                           unsigned char **data, int dataoff,
+                           Progress_UUIE *progress)
+{
+       int ret;
+       int i;
+
+       DEBUGP("nf_ct_q931: Progress\n");
+
+       if (progress->options & eProgress_UUIE_h245Address) {
+               ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                                 &progress->h245Address);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (progress->options & eProgress_UUIE_fastStart) {
+               for (i = 0; i < progress->fastStart.count; i++) {
+                       ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                                         &progress->fastStart.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_q931(struct sk_buff **pskb, struct nf_conn *ct,
+                       enum ip_conntrack_info ctinfo,
+                       unsigned char **data, int dataoff, Q931 *q931)
+{
+       H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
+       int i;
+       int ret = 0;
+
+       switch (pdu->h323_message_body.choice) {
+       case eH323_UU_PDU_h323_message_body_setup:
+               ret = process_setup(pskb, ct, ctinfo, data, dataoff,
+                                   &pdu->h323_message_body.setup);
+               break;
+       case eH323_UU_PDU_h323_message_body_callProceeding:
+               ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
+                                            &pdu->h323_message_body.
+                                            callProceeding);
+               break;
+       case eH323_UU_PDU_h323_message_body_connect:
+               ret = process_connect(pskb, ct, ctinfo, data, dataoff,
+                                     &pdu->h323_message_body.connect);
+               break;
+       case eH323_UU_PDU_h323_message_body_alerting:
+               ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
+                                      &pdu->h323_message_body.alerting);
+               break;
+       case eH323_UU_PDU_h323_message_body_information:
+               ret = process_information(pskb, ct, ctinfo, data, dataoff,
+                                         &pdu->h323_message_body.
+                                         information);
+               break;
+       case eH323_UU_PDU_h323_message_body_facility:
+               ret = process_facility(pskb, ct, ctinfo, data, dataoff,
+                                      &pdu->h323_message_body.facility);
+               break;
+       case eH323_UU_PDU_h323_message_body_progress:
+               ret = process_progress(pskb, ct, ctinfo, data, dataoff,
+                                      &pdu->h323_message_body.progress);
+               break;
+       default:
+               DEBUGP("nf_ct_q931: Q.931 signal %d\n",
+                      pdu->h323_message_body.choice);
+               break;
+       }
+
+       if (ret < 0)
+               return -1;
+
+       if (pdu->options & eH323_UU_PDU_h245Control) {
+               for (i = 0; i < pdu->h245Control.count; i++) {
+                       ret = process_h245(pskb, ct, ctinfo, data, dataoff,
+                                          &pdu->h245Control.item[i]);
+                       if (ret < 0)
+                               return -1;
+               }
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int q931_help(struct sk_buff **pskb, unsigned int protoff,
+                    struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+       static Q931 q931;
+       unsigned char *data = NULL;
+       int datalen;
+       int dataoff;
+       int ret;
+
+       /* Until there's been traffic both ways, don't look in packets. */
+       if (ctinfo != IP_CT_ESTABLISHED &&
+           ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
+               return NF_ACCEPT;
+       }
+       DEBUGP("nf_ct_q931: skblen = %u\n", (*pskb)->len);
+
+       spin_lock_bh(&nf_h323_lock);
+
+       /* Process each TPKT */
+       while (get_tpkt_data(pskb, protoff, ct, ctinfo,
+                            &data, &datalen, &dataoff)) {
+               DEBUGP("nf_ct_q931: TPKT len=%d ", datalen);
+               NF_CT_DUMP_TUPLE(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
+
+               /* Decode Q.931 signal */
+               ret = DecodeQ931(data, datalen, &q931);
+               if (ret < 0) {
+                       if (net_ratelimit())
+                               printk("nf_ct_q931: decoding error: %s\n",
+                                      ret == H323_ERROR_BOUND ?
+                                      "out of bound" : "out of range");
+                       /* We don't drop when decoding error */
+                       break;
+               }
+
+               /* Process Q.931 signal */
+               if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
+                       goto drop;
+       }
+
+       spin_unlock_bh(&nf_h323_lock);
+       return NF_ACCEPT;
+
+      drop:
+       spin_unlock_bh(&nf_h323_lock);
+       if (net_ratelimit())
+               printk("nf_ct_q931: packet dropped\n");
+       return NF_DROP;
+}
+
+/****************************************************************************/
+static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
+       {
+               .name                   = "Q.931",
+               .me                     = THIS_MODULE,
+                                         /* T.120 and H.245 */
+               .max_expected           = H323_RTP_CHANNEL_MAX * 4 + 4,
+               .timeout                = 240,
+               .tuple.src.l3num        = AF_INET,
+               .tuple.src.u.tcp.port   = __constant_htons(Q931_PORT),
+               .tuple.dst.protonum     = IPPROTO_TCP,
+               .mask.src.l3num         = 0xFFFF,
+               .mask.src.u.tcp.port    = __constant_htons(0xFFFF),
+               .mask.dst.protonum      = 0xFF,
+               .help                   = q931_help
+       },
+       {
+               .name                   = "Q.931",
+               .me                     = THIS_MODULE,
+                                         /* T.120 and H.245 */
+               .max_expected           = H323_RTP_CHANNEL_MAX * 4 + 4,
+               .timeout                = 240,
+               .tuple.src.l3num        = AF_INET6,
+               .tuple.src.u.tcp.port   = __constant_htons(Q931_PORT),
+               .tuple.dst.protonum     = IPPROTO_TCP,
+               .mask.src.l3num         = 0xFFFF,
+               .mask.src.u.tcp.port    = __constant_htons(0xFFFF),
+               .mask.dst.protonum      = 0xFF,
+               .help                   = q931_help
+       },
+};
+
+/****************************************************************************/
+static unsigned char *get_udp_data(struct sk_buff **pskb, unsigned int protoff,
+                                  int *datalen)
+{
+       struct udphdr _uh, *uh;
+       int dataoff;
+
+       uh = skb_header_pointer(*pskb, protoff, sizeof(_uh), &_uh);
+       if (uh == NULL)
+               return NULL;
+       dataoff = protoff + sizeof(_uh);
+       if (dataoff >= (*pskb)->len)
+               return NULL;
+       *datalen = (*pskb)->len - dataoff;
+       return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
+}
+
+/****************************************************************************/
+static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
+                                              union nf_conntrack_address *addr,
+                                              __be16 port)
+{
+       struct nf_conntrack_expect *exp;
+       struct nf_conntrack_tuple tuple;
+
+       memset(&tuple.src.u3, 0, sizeof(tuple.src.u3));
+       tuple.src.u.tcp.port = 0;
+       memcpy(&tuple.dst.u3, addr, sizeof(tuple.dst.u3));
+       tuple.dst.u.tcp.port = port;
+       tuple.dst.protonum = IPPROTO_TCP;
+
+       exp = __nf_conntrack_expect_find(&tuple);
+       if (exp && exp->master == ct)
+               return exp;
+       return NULL;
+}
+
+/****************************************************************************/
+static int set_expect_timeout(struct nf_conntrack_expect *exp,
+                             unsigned timeout)
+{
+       if (!exp || !del_timer(&exp->timeout))
+               return 0;
+
+       exp->timeout.expires = jiffies + timeout * HZ;
+       add_timer(&exp->timeout);
+
+       return 1;
+}
+
+/****************************************************************************/
+static int expect_q931(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data,
+                      TransportAddress *taddr, int count)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       int i;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+       typeof(nat_q931_hook) nat_q931;
+
+       /* Look for the first related address */
+       for (i = 0; i < count; i++) {
+               if (get_h225_addr(ct, *data, &taddr[i], &addr, &port) &&
+                   memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3,
+                          sizeof(addr)) == 0 && port != 0)
+                       break;
+       }
+
+       if (i >= count)         /* Not found */
+               return 0;
+
+       /* Create expect for Q.931 */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                gkrouted_only ? /* only accept calls from GK? */
+                                       &ct->tuplehash[!dir].tuple.src.u3 :
+                                       NULL,
+                                &ct->tuplehash[!dir].tuple.dst.u3,
+                                IPPROTO_TCP, NULL, &port);
+       exp->helper = nf_conntrack_helper_q931;
+       exp->flags = NF_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
+
+       nat_q931 = rcu_dereference(nat_q931_hook);
+       if (nat_q931 && ct->status & IPS_NAT_MASK) {    /* Need NAT */
+               ret = nat_q931(pskb, ct, ctinfo, data, taddr, i, port, exp);
+       } else {                /* Conntrack only */
+               if (nf_conntrack_expect_related(exp) == 0) {
+                       DEBUGP("nf_ct_ras: expect Q.931 ");
+                       NF_CT_DUMP_TUPLE(&exp->tuple);
+
+                       /* Save port for looking up expect in processing RCF */
+                       info->sig_port[dir] = port;
+               } else
+                       ret = -1;
+       }
+
+       nf_conntrack_expect_put(exp);
+
+       return ret;
+}
+
+/****************************************************************************/
+static int process_grq(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, GatekeeperRequest *grq)
+{
+       typeof(set_ras_addr_hook) set_ras_addr;
+
+       DEBUGP("nf_ct_ras: GRQ\n");
+
+       set_ras_addr = rcu_dereference(set_ras_addr_hook);
+       if (set_ras_addr && ct->status & IPS_NAT_MASK)  /* NATed */
+               return set_ras_addr(pskb, ct, ctinfo, data,
+                                   &grq->rasAddress, 1);
+       return 0;
+}
+
+/****************************************************************************/
+static int process_gcf(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, GatekeeperConfirm *gcf)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+
+       DEBUGP("nf_ct_ras: GCF\n");
+
+       if (!get_h225_addr(ct, *data, &gcf->rasAddress, &addr, &port))
+               return 0;
+
+       /* Registration port is the same as discovery port */
+       if (!memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
+           port == ct->tuplehash[dir].tuple.src.u.udp.port)
+               return 0;
+
+       /* Avoid RAS expectation loops. A GCF is never expected. */
+       if (test_bit(IPS_EXPECTED_BIT, &ct->status))
+               return 0;
+
+       /* Need new expect */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3, &addr,
+                                IPPROTO_UDP, NULL, &port);
+       exp->helper = nf_conntrack_helper_ras;
+
+       if (nf_conntrack_expect_related(exp) == 0) {
+               DEBUGP("nf_ct_ras: expect RAS ");
+               NF_CT_DUMP_TUPLE(&exp->tuple);
+       } else
+               ret = -1;
+
+       nf_conntrack_expect_put(exp);
+
+       return ret;
+}
+
+/****************************************************************************/
+static int process_rrq(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, RegistrationRequest *rrq)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int ret;
+       typeof(set_ras_addr_hook) set_ras_addr;
+
+       DEBUGP("nf_ct_ras: RRQ\n");
+
+       ret = expect_q931(pskb, ct, ctinfo, data,
+                         rrq->callSignalAddress.item,
+                         rrq->callSignalAddress.count);
+       if (ret < 0)
+               return -1;
+
+       set_ras_addr = rcu_dereference(set_ras_addr_hook);
+       if (set_ras_addr && ct->status & IPS_NAT_MASK) {
+               ret = set_ras_addr(pskb, ct, ctinfo, data,
+                                  rrq->rasAddress.item,
+                                  rrq->rasAddress.count);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (rrq->options & eRegistrationRequest_timeToLive) {
+               DEBUGP("nf_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
+               info->timeout = rrq->timeToLive;
+       } else
+               info->timeout = default_rrq_ttl;
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_rcf(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, RegistrationConfirm *rcf)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       int ret;
+       struct nf_conntrack_expect *exp;
+       typeof(set_sig_addr_hook) set_sig_addr;
+
+       DEBUGP("nf_ct_ras: RCF\n");
+
+       set_sig_addr = rcu_dereference(set_sig_addr_hook);
+       if (set_sig_addr && ct->status & IPS_NAT_MASK) {
+               ret = set_sig_addr(pskb, ct, ctinfo, data,
+                                       rcf->callSignalAddress.item,
+                                       rcf->callSignalAddress.count);
+               if (ret < 0)
+                       return -1;
+       }
+
+       if (rcf->options & eRegistrationConfirm_timeToLive) {
+               DEBUGP("nf_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
+               info->timeout = rcf->timeToLive;
+       }
+
+       if (info->timeout > 0) {
+               DEBUGP
+                   ("nf_ct_ras: set RAS connection timeout to %u seconds\n",
+                    info->timeout);
+               nf_ct_refresh(ct, *pskb, info->timeout * HZ);
+
+               /* Set expect timeout */
+               read_lock_bh(&nf_conntrack_lock);
+               exp = find_expect(ct, &ct->tuplehash[dir].tuple.dst.u3,
+                                 info->sig_port[!dir]);
+               if (exp) {
+                       DEBUGP("nf_ct_ras: set Q.931 expect "
+                              "timeout to %u seconds for",
+                              info->timeout);
+                       NF_CT_DUMP_TUPLE(&exp->tuple);
+                       set_expect_timeout(exp, info->timeout);
+               }
+               read_unlock_bh(&nf_conntrack_lock);
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_urq(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, UnregistrationRequest *urq)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       int ret;
+       typeof(set_sig_addr_hook) set_sig_addr;
+
+       DEBUGP("nf_ct_ras: URQ\n");
+
+       set_sig_addr = rcu_dereference(set_sig_addr_hook);
+       if (set_sig_addr && ct->status & IPS_NAT_MASK) {
+               ret = set_sig_addr(pskb, ct, ctinfo, data,
+                                  urq->callSignalAddress.item,
+                                  urq->callSignalAddress.count);
+               if (ret < 0)
+                       return -1;
+       }
+
+       /* Clear old expect */
+       nf_ct_remove_expectations(ct);
+       info->sig_port[dir] = 0;
+       info->sig_port[!dir] = 0;
+
+       /* Give it 30 seconds for UCF or URJ */
+       nf_ct_refresh(ct, *pskb, 30 * HZ);
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_arq(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, AdmissionRequest *arq)
+{
+       struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+       int dir = CTINFO2DIR(ctinfo);
+       __be16 port;
+       union nf_conntrack_address addr;
+       typeof(set_h225_addr_hook) set_h225_addr;
+
+       DEBUGP("nf_ct_ras: ARQ\n");
+
+       set_h225_addr = rcu_dereference(set_h225_addr_hook);
+       if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
+           get_h225_addr(ct, *data, &arq->destCallSignalAddress,
+                         &addr, &port) &&
+           !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
+           port == info->sig_port[dir] &&
+           set_h225_addr && ct->status & IPS_NAT_MASK) {
+               /* Answering ARQ */
+               return set_h225_addr(pskb, data, 0,
+                                    &arq->destCallSignalAddress,
+                                    &ct->tuplehash[!dir].tuple.dst.u3,
+                                    info->sig_port[!dir]);
+       }
+
+       if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
+           get_h225_addr(ct, *data, &arq->srcCallSignalAddress,
+                         &addr, &port) &&
+           !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
+           set_h225_addr && ct->status & IPS_NAT_MASK) {
+               /* Calling ARQ */
+               return set_h225_addr(pskb, data, 0,
+                                    &arq->srcCallSignalAddress,
+                                    &ct->tuplehash[!dir].tuple.dst.u3,
+                                    port);
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_acf(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, AdmissionConfirm *acf)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+       typeof(set_sig_addr_hook) set_sig_addr;
+
+       DEBUGP("nf_ct_ras: ACF\n");
+
+       if (!get_h225_addr(ct, *data, &acf->destCallSignalAddress,
+                          &addr, &port))
+               return 0;
+
+       if (!memcmp(&addr, &ct->tuplehash[dir].tuple.dst.u3, sizeof(addr))) {
+               /* Answering ACF */
+               set_sig_addr = rcu_dereference(set_sig_addr_hook);
+               if (set_sig_addr && ct->status & IPS_NAT_MASK)
+                       return set_sig_addr(pskb, ct, ctinfo, data,
+                                           &acf->destCallSignalAddress, 1);
+               return 0;
+       }
+
+       /* Need new expect */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3, &addr,
+                                IPPROTO_TCP, NULL, &port);
+       exp->flags = NF_CT_EXPECT_PERMANENT;
+       exp->helper = nf_conntrack_helper_q931;
+
+       if (nf_conntrack_expect_related(exp) == 0) {
+               DEBUGP("nf_ct_ras: expect Q.931 ");
+               NF_CT_DUMP_TUPLE(&exp->tuple);
+       } else
+               ret = -1;
+
+       nf_conntrack_expect_put(exp);
+
+       return ret;
+}
+
+/****************************************************************************/
+static int process_lrq(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, LocationRequest *lrq)
+{
+       typeof(set_ras_addr_hook) set_ras_addr;
+
+       DEBUGP("nf_ct_ras: LRQ\n");
+
+       set_ras_addr = rcu_dereference(set_ras_addr_hook);
+       if (set_ras_addr && ct->status & IPS_NAT_MASK)
+               return set_ras_addr(pskb, ct, ctinfo, data,
+                                   &lrq->replyAddress, 1);
+       return 0;
+}
+
+/****************************************************************************/
+static int process_lcf(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, LocationConfirm *lcf)
+{
+       int dir = CTINFO2DIR(ctinfo);
+       int ret = 0;
+       __be16 port;
+       union nf_conntrack_address addr;
+       struct nf_conntrack_expect *exp;
+
+       DEBUGP("nf_ct_ras: LCF\n");
+
+       if (!get_h225_addr(ct, *data, &lcf->callSignalAddress,
+                          &addr, &port))
+               return 0;
+
+       /* Need new expect for call signal */
+       if ((exp = nf_conntrack_expect_alloc(ct)) == NULL)
+               return -1;
+       nf_conntrack_expect_init(exp, ct->tuplehash[!dir].tuple.src.l3num,
+                                &ct->tuplehash[!dir].tuple.src.u3, &addr,
+                                IPPROTO_TCP, NULL, &port);
+       exp->flags = NF_CT_EXPECT_PERMANENT;
+       exp->helper = nf_conntrack_helper_q931;
+
+       if (nf_conntrack_expect_related(exp) == 0) {
+               DEBUGP("nf_ct_ras: expect Q.931 ");
+               NF_CT_DUMP_TUPLE(&exp->tuple);
+       } else
+               ret = -1;
+
+       nf_conntrack_expect_put(exp);
+
+       /* Ignore rasAddress */
+
+       return ret;
+}
+
+/****************************************************************************/
+static int process_irr(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, InfoRequestResponse *irr)
+{
+       int ret;
+       typeof(set_ras_addr_hook) set_ras_addr;
+       typeof(set_sig_addr_hook) set_sig_addr;
+
+       DEBUGP("nf_ct_ras: IRR\n");
+
+       set_ras_addr = rcu_dereference(set_ras_addr_hook);
+       if (set_ras_addr && ct->status & IPS_NAT_MASK) {
+               ret = set_ras_addr(pskb, ct, ctinfo, data,
+                                  &irr->rasAddress, 1);
+               if (ret < 0)
+                       return -1;
+       }
+
+       set_sig_addr = rcu_dereference(set_sig_addr_hook);
+       if (set_sig_addr && ct->status & IPS_NAT_MASK) {
+               ret = set_sig_addr(pskb, ct, ctinfo, data,
+                                       irr->callSignalAddress.item,
+                                       irr->callSignalAddress.count);
+               if (ret < 0)
+                       return -1;
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int process_ras(struct sk_buff **pskb, struct nf_conn *ct,
+                      enum ip_conntrack_info ctinfo,
+                      unsigned char **data, RasMessage *ras)
+{
+       switch (ras->choice) {
+       case eRasMessage_gatekeeperRequest:
+               return process_grq(pskb, ct, ctinfo, data,
+                                  &ras->gatekeeperRequest);
+       case eRasMessage_gatekeeperConfirm:
+               return process_gcf(pskb, ct, ctinfo, data,
+                                  &ras->gatekeeperConfirm);
+       case eRasMessage_registrationRequest:
+               return process_rrq(pskb, ct, ctinfo, data,
+                                  &ras->registrationRequest);
+       case eRasMessage_registrationConfirm:
+               return process_rcf(pskb, ct, ctinfo, data,
+                                  &ras->registrationConfirm);
+       case eRasMessage_unregistrationRequest:
+               return process_urq(pskb, ct, ctinfo, data,
+                                  &ras->unregistrationRequest);
+       case eRasMessage_admissionRequest:
+               return process_arq(pskb, ct, ctinfo, data,
+                                  &ras->admissionRequest);
+       case eRasMessage_admissionConfirm:
+               return process_acf(pskb, ct, ctinfo, data,
+                                  &ras->admissionConfirm);
+       case eRasMessage_locationRequest:
+               return process_lrq(pskb, ct, ctinfo, data,
+                                  &ras->locationRequest);
+       case eRasMessage_locationConfirm:
+               return process_lcf(pskb, ct, ctinfo, data,
+                                  &ras->locationConfirm);
+       case eRasMessage_infoRequestResponse:
+               return process_irr(pskb, ct, ctinfo, data,
+                                  &ras->infoRequestResponse);
+       default:
+               DEBUGP("nf_ct_ras: RAS message %d\n", ras->choice);
+               break;
+       }
+
+       return 0;
+}
+
+/****************************************************************************/
+static int ras_help(struct sk_buff **pskb, unsigned int protoff,
+                   struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+       static RasMessage ras;
+       unsigned char *data;
+       int datalen = 0;
+       int ret;
+
+       DEBUGP("nf_ct_ras: skblen = %u\n", (*pskb)->len);
+
+       spin_lock_bh(&nf_h323_lock);
+
+       /* Get UDP data */
+       data = get_udp_data(pskb, protoff, &datalen);
+       if (data == NULL)
+               goto accept;
+       DEBUGP("nf_ct_ras: RAS message len=%d ", datalen);
+       NF_CT_DUMP_TUPLE(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
+
+       /* Decode RAS message */
+       ret = DecodeRasMessage(data, datalen, &ras);
+       if (ret < 0) {
+               if (net_ratelimit())
+                       printk("nf_ct_ras: decoding error: %s\n",
+                              ret == H323_ERROR_BOUND ?
+                              "out of bound" : "out of range");
+               goto accept;
+       }
+
+       /* Process RAS message */
+       if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
+               goto drop;
+
+      accept:
+       spin_unlock_bh(&nf_h323_lock);
+       return NF_ACCEPT;
+
+      drop:
+       spin_unlock_bh(&nf_h323_lock);
+       if (net_ratelimit())
+               printk("nf_ct_ras: packet dropped\n");
+       return NF_DROP;
+}
+
+/****************************************************************************/
+static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = {
+       {
+               .name                   = "RAS",
+               .me                     = THIS_MODULE,
+               .max_expected           = 32,
+               .timeout                = 240,
+               .tuple.src.l3num        = AF_INET,
+               .tuple.src.u.udp.port   = __constant_htons(RAS_PORT),
+               .tuple.dst.protonum     = IPPROTO_UDP,
+               .mask.src.l3num         = 0xFFFF,
+               .mask.src.u.udp.port    = __constant_htons(0xFFFF),
+               .mask.dst.protonum      = 0xFF,
+               .help                   = ras_help,
+       },
+       {
+               .name                   = "RAS",
+               .me                     = THIS_MODULE,
+               .max_expected           = 32,
+               .timeout                = 240,
+               .tuple.src.l3num        = AF_INET6,
+               .tuple.src.u.udp.port   = __constant_htons(RAS_PORT),
+               .tuple.dst.protonum     = IPPROTO_UDP,
+               .mask.src.l3num         = 0xFFFF,
+               .mask.src.u.udp.port    = __constant_htons(0xFFFF),
+               .mask.dst.protonum      = 0xFF,
+               .help                   = ras_help,
+       },
+};
+
+/****************************************************************************/
+static void __exit nf_conntrack_h323_fini(void)
+{
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[1]);
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
+       kfree(h323_buffer);
+       DEBUGP("nf_ct_h323: fini\n");
+}
+
+/****************************************************************************/
+static int __init nf_conntrack_h323_init(void)
+{
+       int ret;
+
+       h323_buffer = kmalloc(65536, GFP_KERNEL);
+       if (!h323_buffer)
+               return -ENOMEM;
+       ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
+       if (ret < 0)
+               goto err1;
+       ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
+       if (ret < 0)
+               goto err2;
+       ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
+       if (ret < 0)
+               goto err3;
+       ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
+       if (ret < 0)
+               goto err4;
+       DEBUGP("nf_ct_h323: init success\n");
+       return 0;
+
+err4:
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
+err3:
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
+err2:
+       nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
+err1:
+       return ret;
+}
+
+/****************************************************************************/
+module_init(nf_conntrack_h323_init);
+module_exit(nf_conntrack_h323_fini);
+
+EXPORT_SYMBOL_GPL(get_h225_addr);
+EXPORT_SYMBOL_GPL(set_h245_addr_hook);
+EXPORT_SYMBOL_GPL(set_h225_addr_hook);
+EXPORT_SYMBOL_GPL(set_sig_addr_hook);
+EXPORT_SYMBOL_GPL(set_ras_addr_hook);
+EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
+EXPORT_SYMBOL_GPL(nat_t120_hook);
+EXPORT_SYMBOL_GPL(nat_h245_hook);
+EXPORT_SYMBOL_GPL(nat_callforwarding_hook);
+EXPORT_SYMBOL_GPL(nat_q931_hook);
+
+MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
+MODULE_DESCRIPTION("H.323 connection tracking helper");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ip_conntrack_h323");
similarity index 99%
rename from net/ipv4/netfilter/ip_conntrack_helper_h323_types.c
rename to net/netfilter/nf_conntrack_h323_types.c
index 4b359618beddfa6661cbdbd5cf8bfcc6c843237b..4c6f8b3b12083c4c5fe0bc8c9bccafc1c4056ae9 100644 (file)
@@ -36,7 +36,8 @@ static field_t _TransportAddress_ipxAddress[] = {     /* SEQUENCE */
 };
 
 static field_t _TransportAddress_ip6Address[] = {      /* SEQUENCE */
-       {FNAME("ip") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
+       {FNAME("ip") OCTSTR, FIXD, 16, 0, DECODE,
+        offsetof(TransportAddress_ip6Address, ip6), NULL},
        {FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
@@ -65,8 +66,8 @@ static field_t _TransportAddress[] = {        /* CHOICE */
         _TransportAddress_ipSourceRoute},
        {FNAME("ipxAddress") SEQ, 0, 3, 3, SKIP, 0,
         _TransportAddress_ipxAddress},
-       {FNAME("ip6Address") SEQ, 0, 2, 2, SKIP | EXT, 0,
-        _TransportAddress_ip6Address},
+       {FNAME("ip6Address") SEQ, 0, 2, 2, DECODE | EXT,
+       offsetof(TransportAddress, ip6Address), _TransportAddress_ip6Address},
        {FNAME("netBios") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
        {FNAME("nsap") OCTSTR, 5, 1, 0, SKIP, 0, NULL},
        {FNAME("nonStandardAddress") SEQ, 0, 2, 2, SKIP, 0,