net/ipv4/netfilter/ip_conntrack_helper_h323.c

   1 /*
   2  * H.323 connection tracking helper
   3  *
   4  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
   5  *
   6  * This source code is licensed under General Public License version 2.
   7  *
   8  * Based on the 'brute force' H.323 connection tracking module by
   9  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  10  *
  11  * For more information, please see http://nath323.sourceforge.net/
  12  *
  13  * Changes:
  14  *      2006-02-01 - initial version 0.1
  15  *
  16  *      2006-02-20 - version 0.2
  17  *        1. Changed source format to follow kernel conventions
  18  *        2. Deleted some unnecessary structures
  19  *        3. Minor fixes
  20  *
  21  *      2006-03-10 - version 0.3
  22  *        1. Added support for multiple TPKTs in one packet (suggested by
  23  *           Patrick McHardy)
  24  *        2. Avoid excessive stack usage (based on Patrick McHardy's patch)
  25  *        3. Added support for non-linear skb (based on Patrick McHardy's patch)
  26  *        4. Fixed missing H.245 module owner (Patrick McHardy)
  27  *        5. Avoid long RAS expectation chains (Patrick McHardy)
  28  *        6. Fixed incorrect __exit attribute (Patrick McHardy)
  29  *        7. Eliminated unnecessary return code
  30  *        8. Fixed incorrect use of NAT data from conntrack code (suggested by
  31  *           Patrick McHardy)
  32  *        9. Fixed TTL calculation error in RCF
  33  *        10. Added TTL support in RRQ
  34  *        11. Better support for separate TPKT header and data
  35  *
  36  *      2006-03-15 - version 0.4
  37  *        1. Added support for T.120 channels
  38  *        2. Added parameter gkrouted_only (suggested by Patrick McHardy)
  39  *        3. Splitted ASN.1 code and data (suggested by Patrick McHardy)
  40  *        4. Sort ASN.1 data to avoid forwarding declarations (suggested by
  41  *           Patrick McHardy)
  42  *        5. Reset next TPKT data length in get_tpkt_data()
  43  */
  44
  45 #include <linux/config.h>
  46 #include <linux/module.h>
  47 #include <linux/netfilter.h>
  48 #include <linux/ip.h>
  49 #include <net/tcp.h>
  50 #include <linux/netfilter_ipv4/ip_conntrack.h>
  51 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  52 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  53 #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
  54 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
  55 #include <linux/moduleparam.h>
  56
  57 #if 0
  58 #define DEBUGP printk
  59 #else
  60 #define DEBUGP(format, args...)
  61 #endif
  62
  63 /* Parameters */
  64 static unsigned int default_rrq_ttl = 300;
  65 module_param(default_rrq_ttl, uint, 0600);
  66 MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
  67
  68 static int gkrouted_only = 1;
  69 module_param(gkrouted_only, int, 0600);
  70 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
  71
  72 /* Hooks for NAT */
  73 int (*set_h245_addr_hook) (struct sk_buff ** pskb,
  74                            unsigned char **data, int dataoff,
  75                            H245_TransportAddress * addr,
  76                            u_int32_t ip, u_int16_t port);
  77 int (*set_h225_addr_hook) (struct sk_buff ** pskb,
  78                            unsigned char **data, int dataoff,
  79                            TransportAddress * addr,
  80                            u_int32_t ip, u_int16_t port);
  81 int (*set_sig_addr_hook) (struct sk_buff ** pskb,
  82                           struct ip_conntrack * ct,
  83                           enum ip_conntrack_info ctinfo,
  84                           unsigned char **data,
  85                           TransportAddress * addr, int count);
  86 int (*set_ras_addr_hook) (struct sk_buff ** pskb,
  87                           struct ip_conntrack * ct,
  88                           enum ip_conntrack_info ctinfo,
  89                           unsigned char **data,
  90                           TransportAddress * addr, int count);
  91 int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
  92                           struct ip_conntrack * ct,
  93                           enum ip_conntrack_info ctinfo,
  94                           unsigned char **data, int dataoff,
  95                           H245_TransportAddress * addr,
  96                           u_int16_t port, u_int16_t rtp_port,
  97                           struct ip_conntrack_expect * rtp_exp,
  98                           struct ip_conntrack_expect * rtcp_exp);
  99 int (*nat_t120_hook) (struct sk_buff ** pskb,
 100                       struct ip_conntrack * ct,
 101                       enum ip_conntrack_info ctinfo,
 102                       unsigned char **data, int dataoff,
 103                       H245_TransportAddress * addr, u_int16_t port,
 104                       struct ip_conntrack_expect * exp);
 105 int (*nat_h245_hook) (struct sk_buff ** pskb,
 106                       struct ip_conntrack * ct,
 107                       enum ip_conntrack_info ctinfo,
 108                       unsigned char **data, int dataoff,
 109                       TransportAddress * addr, u_int16_t port,
 110                       struct ip_conntrack_expect * exp);
 111 int (*nat_q931_hook) (struct sk_buff ** pskb,
 112                       struct ip_conntrack * ct,
 113                       enum ip_conntrack_info ctinfo,
 114                       unsigned char **data, TransportAddress * addr, int idx,
 115                       u_int16_t port, struct ip_conntrack_expect * exp);
 116
 117
 118 static DEFINE_SPINLOCK(ip_h323_lock);
 119 static char *h323_buffer;
 120
 121 /****************************************************************************/
 122 static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
 123                          enum ip_conntrack_info ctinfo,
 124                          unsigned char **data, int *datalen, int *dataoff)
 125 {
 126         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
 127         int dir = CTINFO2DIR(ctinfo);
 128         struct tcphdr _tcph, *th;
 129         int tcpdatalen;
 130         int tcpdataoff;
 131         unsigned char *tpkt;
 132         int tpktlen;
 133         int tpktoff;
 134
 135         /* Get TCP header */
 136         th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
 137                                 sizeof(_tcph), &_tcph);
 138         if (th == NULL)
 139                 return 0;
 140
 141         /* Get TCP data offset */
 142         tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
 143
 144         /* Get TCP data length */
 145         tcpdatalen = (*pskb)->len - tcpdataoff;
 146         if (tcpdatalen <= 0)    /* No TCP data */
 147                 goto clear_out;
 148
 149         if (*data == NULL) {    /* first TPKT */
 150                 /* Get first TPKT pointer */
 151                 tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
 152                                           h323_buffer);
 153                 BUG_ON(tpkt == NULL);
 154
 155                 /* Validate TPKT identifier */
 156                 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
 157                         /* Netmeeting sends TPKT header and data separately */
 158                         if (info->tpkt_len[dir] > 0) {
 159                                 DEBUGP("ip_ct_h323: previous packet "
 160                                        "indicated separate TPKT data of %hu "
 161                                        "bytes\n", info->tpkt_len[dir]);
 162                                 if (info->tpkt_len[dir] <= tcpdatalen) {
 163                                         /* Yes, there was a TPKT header
 164                                          * received */
 165                                         *data = tpkt;
 166                                         *datalen = info->tpkt_len[dir];
 167                                         *dataoff = 0;
 168                                         goto out;
 169                                 }
 170
 171                                 /* Fragmented TPKT */
 172                                 if (net_ratelimit())
 173                                         printk("ip_ct_h323: "
 174                                                "fragmented TPKT\n");
 175                                 goto clear_out;
 176                         }
 177
 178                         /* It is not even a TPKT */
 179                         return 0;
 180                 }
 181                 tpktoff = 0;
 182         } else {                /* Next TPKT */
 183                 tpktoff = *dataoff + *datalen;
 184                 tcpdatalen -= tpktoff;
 185                 if (tcpdatalen <= 4)    /* No more TPKT */
 186                         goto clear_out;
 187                 tpkt = *data + *datalen;
 188
 189                 /* Validate TPKT identifier */
 190                 if (tpkt[0] != 0x03 || tpkt[1] != 0)
 191                         goto clear_out;
 192         }
 193
 194         /* Validate TPKT length */
 195         tpktlen = tpkt[2] * 256 + tpkt[3];
 196         if (tpktlen > tcpdatalen) {
 197                 if (tcpdatalen == 4) {  /* Separate TPKT header */
 198                         /* Netmeeting sends TPKT header and data separately */
 199                         DEBUGP("ip_ct_h323: separate TPKT header indicates "
 200                                "there will be TPKT data of %hu bytes\n",
 201                                tpktlen - 4);
 202                         info->tpkt_len[dir] = tpktlen - 4;
 203                         return 0;
 204                 }
 205
 206                 if (net_ratelimit())
 207                         printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
 208                 goto clear_out;
 209         }
 210
 211         /* This is the encapsulated data */
 212         *data = tpkt + 4;
 213         *datalen = tpktlen - 4;
 214         *dataoff = tpktoff + 4;
 215
 216       out:
 217         /* Clear TPKT length */
 218         info->tpkt_len[dir] = 0;
 219         return 1;
 220
 221       clear_out:
 222         info->tpkt_len[dir] = 0;
 223         return 0;
 224 }
 225
 226 /****************************************************************************/
 227 static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
 228                          u_int32_t * ip, u_int16_t * port)
 229 {
 230         unsigned char *p;
 231
 232         if (addr->choice != eH245_TransportAddress_unicastAddress ||
 233             addr->unicastAddress.choice != eUnicastAddress_iPAddress)
 234                 return 0;
 235
 236         p = data + addr->unicastAddress.iPAddress.network;
 237         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
 238         *port = (p[4] << 8) | (p[5]);
 239
 240         return 1;
 241 }
 242
 243 /****************************************************************************/
 244 static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
 245                            enum ip_conntrack_info ctinfo,
 246                            unsigned char **data, int dataoff,
 247                            H245_TransportAddress * addr)
 248 {
 249         int dir = CTINFO2DIR(ctinfo);
 250         int ret = 0;
 251         u_int32_t ip;
 252         u_int16_t port;
 253         u_int16_t rtp_port;
 254         struct ip_conntrack_expect *rtp_exp;
 255         struct ip_conntrack_expect *rtcp_exp;
 256
 257         /* Read RTP or RTCP address */
 258         if (!get_h245_addr(*data, addr, &ip, &port) ||
 259             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
 260                 return 0;
 261
 262         /* RTP port is even */
 263         rtp_port = port & (~1);
 264
 265         /* Create expect for RTP */
 266         if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
 267                 return -1;
 268         rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 269         rtp_exp->tuple.src.u.udp.port = 0;
 270         rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 271         rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
 272         rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
 273         rtp_exp->mask.src.ip = 0xFFFFFFFF;
 274         rtp_exp->mask.src.u.udp.port = 0;
 275         rtp_exp->mask.dst.ip = 0xFFFFFFFF;
 276         rtp_exp->mask.dst.u.udp.port = 0xFFFF;
 277         rtp_exp->mask.dst.protonum = 0xFF;
 278         rtp_exp->flags = 0;
 279
 280         /* Create expect for RTCP */
 281         if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
 282                 ip_conntrack_expect_put(rtp_exp);
 283                 return -1;
 284         }
 285         rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 286         rtcp_exp->tuple.src.u.udp.port = 0;
 287         rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 288         rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
 289         rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
 290         rtcp_exp->mask.src.ip = 0xFFFFFFFF;
 291         rtcp_exp->mask.src.u.udp.port = 0;
 292         rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
 293         rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
 294         rtcp_exp->mask.dst.protonum = 0xFF;
 295         rtcp_exp->flags = 0;
 296
 297         if (ct->tuplehash[dir].tuple.src.ip !=
 298             ct->tuplehash[!dir].tuple.dst.ip && nat_rtp_rtcp_hook) {
 299                 /* NAT needed */
 300                 ret = nat_rtp_rtcp_hook(pskb, ct, ctinfo, data, dataoff,
 301                                         addr, port, rtp_port, rtp_exp,
 302                                         rtcp_exp);
 303         } else {                /* Conntrack only */
 304                 rtp_exp->expectfn = NULL;
 305                 rtcp_exp->expectfn = NULL;
 306
 307                 if (ip_conntrack_expect_related(rtp_exp) == 0) {
 308                         if (ip_conntrack_expect_related(rtcp_exp) == 0) {
 309                                 DEBUGP("ip_ct_h323: expect RTP "
 310                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 311                                        NIPQUAD(rtp_exp->tuple.src.ip),
 312                                        ntohs(rtp_exp->tuple.src.u.udp.port),
 313                                        NIPQUAD(rtp_exp->tuple.dst.ip),
 314                                        ntohs(rtp_exp->tuple.dst.u.udp.port));
 315                                 DEBUGP("ip_ct_h323: expect RTCP "
 316                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 317                                        NIPQUAD(rtcp_exp->tuple.src.ip),
 318                                        ntohs(rtcp_exp->tuple.src.u.udp.port),
 319                                        NIPQUAD(rtcp_exp->tuple.dst.ip),
 320                                        ntohs(rtcp_exp->tuple.dst.u.udp.port));
 321                         } else {
 322                                 ip_conntrack_unexpect_related(rtp_exp);
 323                                 ret = -1;
 324                         }
 325                 } else
 326                         ret = -1;
 327         }
 328
 329         ip_conntrack_expect_put(rtp_exp);
 330         ip_conntrack_expect_put(rtcp_exp);
 331
 332         return ret;
 333 }
 334
 335 /****************************************************************************/
 336 static int expect_t120(struct sk_buff **pskb,
 337                        struct ip_conntrack *ct,
 338                        enum ip_conntrack_info ctinfo,
 339                        unsigned char **data, int dataoff,
 340                        H245_TransportAddress * addr)
 341 {
 342         int dir = CTINFO2DIR(ctinfo);
 343         int ret = 0;
 344         u_int32_t ip;
 345         u_int16_t port;
 346         struct ip_conntrack_expect *exp = NULL;
 347
 348         /* Read T.120 address */
 349         if (!get_h245_addr(*data, addr, &ip, &port) ||
 350             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
 351                 return 0;
 352
 353         /* Create expect for T.120 connections */
 354         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
 355                 return -1;
 356         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 357         exp->tuple.src.u.tcp.port = 0;
 358         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 359         exp->tuple.dst.u.tcp.port = htons(port);
 360         exp->tuple.dst.protonum = IPPROTO_TCP;
 361         exp->mask.src.ip = 0xFFFFFFFF;
 362         exp->mask.src.u.tcp.port = 0;
 363         exp->mask.dst.ip = 0xFFFFFFFF;
 364         exp->mask.dst.u.tcp.port = 0xFFFF;
 365         exp->mask.dst.protonum = 0xFF;
 366         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple channels */
 367
 368         if (ct->tuplehash[dir].tuple.src.ip !=
 369             ct->tuplehash[!dir].tuple.dst.ip && nat_t120_hook) {
 370                 /* NAT needed */
 371                 ret = nat_t120_hook(pskb, ct, ctinfo, data, dataoff, addr,
 372                                     port, exp);
 373         } else {                /* Conntrack only */
 374                 exp->expectfn = NULL;
 375                 if (ip_conntrack_expect_related(exp) == 0) {
 376                         DEBUGP("ip_ct_h323: expect T.120 "
 377                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 378                                NIPQUAD(exp->tuple.src.ip),
 379                                ntohs(exp->tuple.src.u.tcp.port),
 380                                NIPQUAD(exp->tuple.dst.ip),
 381                                ntohs(exp->tuple.dst.u.tcp.port));
 382                 } else
 383                         ret = -1;
 384         }
 385
 386         ip_conntrack_expect_put(exp);
 387
 388         return ret;
 389 }
 390
 391 /****************************************************************************/
 392 static int process_h245_channel(struct sk_buff **pskb,
 393                                 struct ip_conntrack *ct,
 394                                 enum ip_conntrack_info ctinfo,
 395                                 unsigned char **data, int dataoff,
 396                                 H2250LogicalChannelParameters * channel)
 397 {
 398         int ret;
 399
 400         if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
 401                 /* RTP */
 402                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 403                                       &channel->mediaChannel);
 404                 if (ret < 0)
 405                         return -1;
 406         }
 407
 408         if (channel->
 409             options & eH2250LogicalChannelParameters_mediaControlChannel) {
 410                 /* RTCP */
 411                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 412                                       &channel->mediaControlChannel);
 413                 if (ret < 0)
 414                         return -1;
 415         }
 416
 417         return 0;
 418 }
 419
 420 /****************************************************************************/
 421 static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
 422                        enum ip_conntrack_info ctinfo,
 423                        unsigned char **data, int dataoff,
 424                        OpenLogicalChannel * olc)
 425 {
 426         int ret;
 427
 428         DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
 429
 430         if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
 431             eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
 432         {
 433                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
 434                                            &olc->
 435                                            forwardLogicalChannelParameters.
 436                                            multiplexParameters.
 437                                            h2250LogicalChannelParameters);
 438                 if (ret < 0)
 439                         return -1;
 440         }
 441
 442         if ((olc->options &
 443              eOpenLogicalChannel_reverseLogicalChannelParameters) &&
 444             (olc->reverseLogicalChannelParameters.options &
 445              eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
 446             && (olc->reverseLogicalChannelParameters.multiplexParameters.
 447                 choice ==
 448                 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
 449         {
 450                 ret =
 451                     process_h245_channel(pskb, ct, ctinfo, data, dataoff,
 452                                          &olc->
 453                                          reverseLogicalChannelParameters.
 454                                          multiplexParameters.
 455                                          h2250LogicalChannelParameters);
 456                 if (ret < 0)
 457                         return -1;
 458         }
 459
 460         if ((olc->options & eOpenLogicalChannel_separateStack) &&
 461             olc->forwardLogicalChannelParameters.dataType.choice ==
 462             eDataType_data &&
 463             olc->forwardLogicalChannelParameters.dataType.data.application.
 464             choice == eDataApplicationCapability_application_t120 &&
 465             olc->forwardLogicalChannelParameters.dataType.data.application.
 466             t120.choice == eDataProtocolCapability_separateLANStack &&
 467             olc->separateStack.networkAddress.choice ==
 468             eNetworkAccessParameters_networkAddress_localAreaAddress) {
 469                 ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
 470                                   &olc->separateStack.networkAddress.
 471                                   localAreaAddress);
 472                 if (ret < 0)
 473                         return -1;
 474         }
 475
 476         return 0;
 477 }
 478
 479 /****************************************************************************/
 480 static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
 481                         enum ip_conntrack_info ctinfo,
 482                         unsigned char **data, int dataoff,
 483                         OpenLogicalChannelAck * olca)
 484 {
 485         H2250LogicalChannelAckParameters *ack;
 486         int ret;
 487
 488         DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
 489
 490         if ((olca->options &
 491              eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
 492             (olca->reverseLogicalChannelParameters.options &
 493              eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
 494             && (olca->reverseLogicalChannelParameters.multiplexParameters.
 495                 choice ==
 496                 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
 497         {
 498                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
 499                                            &olca->
 500                                            reverseLogicalChannelParameters.
 501                                            multiplexParameters.
 502                                            h2250LogicalChannelParameters);
 503                 if (ret < 0)
 504                         return -1;
 505         }
 506
 507         if ((olca->options &
 508              eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
 509             (olca->forwardMultiplexAckParameters.choice ==
 510              eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
 511         {
 512                 ack = &olca->forwardMultiplexAckParameters.
 513                     h2250LogicalChannelAckParameters;
 514                 if (ack->options &
 515                     eH2250LogicalChannelAckParameters_mediaChannel) {
 516                         /* RTP */
 517                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 518                                               &ack->mediaChannel);
 519                         if (ret < 0)
 520                                 return -1;
 521                 }
 522
 523                 if (ack->options &
 524                     eH2250LogicalChannelAckParameters_mediaControlChannel) {
 525                         /* RTCP */
 526                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 527                                               &ack->mediaControlChannel);
 528                         if (ret < 0)
 529                                 return -1;
 530                 }
 531         }
 532
 533         return 0;
 534 }
 535
 536 /****************************************************************************/
 537 static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
 538                         enum ip_conntrack_info ctinfo,
 539                         unsigned char **data, int dataoff,
 540                         MultimediaSystemControlMessage * mscm)
 541 {
 542         switch (mscm->choice) {
 543         case eMultimediaSystemControlMessage_request:
 544                 if (mscm->request.choice ==
 545                     eRequestMessage_openLogicalChannel) {
 546                         return process_olc(pskb, ct, ctinfo, data, dataoff,
 547                                            &mscm->request.openLogicalChannel);
 548                 }
 549                 DEBUGP("ip_ct_h323: H.245 Request %d\n",
 550                        mscm->request.choice);
 551                 break;
 552         case eMultimediaSystemControlMessage_response:
 553                 if (mscm->response.choice ==
 554                     eResponseMessage_openLogicalChannelAck) {
 555                         return process_olca(pskb, ct, ctinfo, data, dataoff,
 556                                             &mscm->response.
 557                                             openLogicalChannelAck);
 558                 }
 559                 DEBUGP("ip_ct_h323: H.245 Response %d\n",
 560                        mscm->response.choice);
 561                 break;
 562         default:
 563                 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
 564                 break;
 565         }
 566
 567         return 0;
 568 }
 569
 570 /****************************************************************************/
 571 static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
 572                      enum ip_conntrack_info ctinfo)
 573 {
 574         static MultimediaSystemControlMessage mscm;
 575         unsigned char *data = NULL;
 576         int datalen;
 577         int dataoff;
 578         int ret;
 579
 580         /* Until there's been traffic both ways, don't look in packets. */
 581         if (ctinfo != IP_CT_ESTABLISHED
 582             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
 583                 return NF_ACCEPT;
 584         }
 585         DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
 586
 587         spin_lock_bh(&ip_h323_lock);
 588
 589         /* Process each TPKT */
 590         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
 591                 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
 592                        NIPQUAD((*pskb)->nh.iph->saddr),
 593                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
 594
 595                 /* Decode H.245 signal */
 596                 ret = DecodeMultimediaSystemControlMessage(data, datalen,
 597                                                            &mscm);
 598                 if (ret < 0) {
 599                         if (net_ratelimit())
 600                                 printk("ip_ct_h245: decoding error: %s\n",
 601                                        ret == H323_ERROR_BOUND ?
 602                                        "out of bound" : "out of range");
 603                         /* We don't drop when decoding error */
 604                         break;
 605                 }
 606
 607                 /* Process H.245 signal */
 608                 if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
 609                         goto drop;
 610         }
 611
 612         spin_unlock_bh(&ip_h323_lock);
 613         return NF_ACCEPT;
 614
 615       drop:
 616         spin_unlock_bh(&ip_h323_lock);
 617         if (net_ratelimit())
 618                 printk("ip_ct_h245: packet dropped\n");
 619         return NF_DROP;
 620 }
 621
 622 /****************************************************************************/
 623 static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
 624         .name = "H.245",
 625         .me = THIS_MODULE,
 626         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
 627         .timeout = 240,
 628         .tuple = {.dst = {.protonum = IPPROTO_TCP}},
 629         .mask = {.src = {.u = {0xFFFF}},
 630                  .dst = {.protonum = 0xFF}},
 631         .help = h245_help
 632 };
 633
 634 /****************************************************************************/
 635 void ip_conntrack_h245_expect(struct ip_conntrack *new,
 636                               struct ip_conntrack_expect *this)
 637 {
 638         write_lock_bh(&ip_conntrack_lock);
 639         new->helper = &ip_conntrack_helper_h245;
 640         write_unlock_bh(&ip_conntrack_lock);
 641 }
 642
 643 /****************************************************************************/
 644 int get_h225_addr(unsigned char *data, TransportAddress * addr,
 645                   u_int32_t * ip, u_int16_t * port)
 646 {
 647         unsigned char *p;
 648
 649         if (addr->choice != eTransportAddress_ipAddress)
 650                 return 0;
 651
 652         p = data + addr->ipAddress.ip;
 653         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
 654         *port = (p[4] << 8) | (p[5]);
 655
 656         return 1;
 657 }
 658
 659 /****************************************************************************/
 660 static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
 661                        enum ip_conntrack_info ctinfo,
 662                        unsigned char **data, int dataoff,
 663                        TransportAddress * addr)
 664 {
 665         int dir = CTINFO2DIR(ctinfo);
 666         int ret = 0;
 667         u_int32_t ip;
 668         u_int16_t port;
 669         struct ip_conntrack_expect *exp = NULL;
 670
 671         /* Read h245Address */
 672         if (!get_h225_addr(*data, addr, &ip, &port) ||
 673             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
 674                 return 0;
 675
 676         /* Create expect for h245 connection */
 677         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
 678                 return -1;
 679         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 680         exp->tuple.src.u.tcp.port = 0;
 681         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 682         exp->tuple.dst.u.tcp.port = htons(port);
 683         exp->tuple.dst.protonum = IPPROTO_TCP;
 684         exp->mask.src.ip = 0xFFFFFFFF;
 685         exp->mask.src.u.tcp.port = 0;
 686         exp->mask.dst.ip = 0xFFFFFFFF;
 687         exp->mask.dst.u.tcp.port = 0xFFFF;
 688         exp->mask.dst.protonum = 0xFF;
 689         exp->flags = 0;
 690
 691         if (ct->tuplehash[dir].tuple.src.ip !=
 692             ct->tuplehash[!dir].tuple.dst.ip && nat_h245_hook) {
 693                 /* NAT needed */
 694                 ret = nat_h245_hook(pskb, ct, ctinfo, data, dataoff, addr,
 695                                     port, exp);
 696         } else {                /* Conntrack only */
 697                 exp->expectfn = ip_conntrack_h245_expect;
 698
 699                 if (ip_conntrack_expect_related(exp) == 0) {
 700                         DEBUGP("ip_ct_q931: expect H.245 "
 701                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 702                                NIPQUAD(exp->tuple.src.ip),
 703                                ntohs(exp->tuple.src.u.tcp.port),
 704                                NIPQUAD(exp->tuple.dst.ip),
 705                                ntohs(exp->tuple.dst.u.tcp.port));
 706                 } else
 707                         ret = -1;
 708         }
 709
 710         ip_conntrack_expect_put(exp);
 711
 712         return ret;
 713 }
 714
 715 /****************************************************************************/
 716 static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
 717                          enum ip_conntrack_info ctinfo,
 718                          unsigned char **data, int dataoff,
 719                          Setup_UUIE * setup)
 720 {
 721         int dir = CTINFO2DIR(ctinfo);
 722         int ret;
 723         int i;
 724         u_int32_t ip;
 725         u_int16_t port;
 726
 727         DEBUGP("ip_ct_q931: Setup\n");
 728
 729         if (setup->options & eSetup_UUIE_h245Address) {
 730                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 731                                   &setup->h245Address);
 732                 if (ret < 0)
 733                         return -1;
 734         }
 735
 736         if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
 737             (set_h225_addr_hook) &&
 738             get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
 739             ip != ct->tuplehash[!dir].tuple.src.ip) {
 740                 DEBUGP("ip_ct_q931: set destCallSignalAddress "
 741                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 742                        NIPQUAD(ip), port,
 743                        NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
 744                        ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
 745                 ret = set_h225_addr_hook(pskb, data, dataoff,
 746                                          &setup->destCallSignalAddress,
 747                                          ct->tuplehash[!dir].tuple.src.ip,
 748                                          ntohs(ct->tuplehash[!dir].tuple.src.
 749                                                u.tcp.port));
 750                 if (ret < 0)
 751                         return -1;
 752         }
 753
 754         if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
 755             (set_h225_addr_hook) &&
 756             get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
 757             && ip != ct->tuplehash[!dir].tuple.dst.ip) {
 758                 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
 759                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 760                        NIPQUAD(ip), port,
 761                        NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
 762                        ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
 763                 ret = set_h225_addr_hook(pskb, data, dataoff,
 764                                          &setup->sourceCallSignalAddress,
 765                                          ct->tuplehash[!dir].tuple.dst.ip,
 766                                          ntohs(ct->tuplehash[!dir].tuple.dst.
 767                                                u.tcp.port));
 768                 if (ret < 0)
 769                         return -1;
 770         }
 771
 772         if (setup->options & eSetup_UUIE_fastStart) {
 773                 for (i = 0; i < setup->fastStart.count; i++) {
 774                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 775                                           &setup->fastStart.item[i]);
 776                         if (ret < 0)
 777                                 return -1;
 778                 }
 779         }
 780
 781         return 0;
 782 }
 783
 784 /****************************************************************************/
 785 static int process_callproceeding(struct sk_buff **pskb,
 786                                   struct ip_conntrack *ct,
 787                                   enum ip_conntrack_info ctinfo,
 788                                   unsigned char **data, int dataoff,
 789                                   CallProceeding_UUIE * callproc)
 790 {
 791         int ret;
 792         int i;
 793
 794         DEBUGP("ip_ct_q931: CallProceeding\n");
 795
 796         if (callproc->options & eCallProceeding_UUIE_h245Address) {
 797                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 798                                   &callproc->h245Address);
 799                 if (ret < 0)
 800                         return -1;
 801         }
 802
 803         if (callproc->options & eCallProceeding_UUIE_fastStart) {
 804                 for (i = 0; i < callproc->fastStart.count; i++) {
 805                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 806                                           &callproc->fastStart.item[i]);
 807                         if (ret < 0)
 808                                 return -1;
 809                 }
 810         }
 811
 812         return 0;
 813 }
 814
 815 /****************************************************************************/
 816 static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
 817                            enum ip_conntrack_info ctinfo,
 818                            unsigned char **data, int dataoff,
 819                            Connect_UUIE * connect)
 820 {
 821         int ret;
 822         int i;
 823
 824         DEBUGP("ip_ct_q931: Connect\n");
 825
 826         if (connect->options & eConnect_UUIE_h245Address) {
 827                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 828                                   &connect->h245Address);
 829                 if (ret < 0)
 830                         return -1;
 831         }
 832
 833         if (connect->options & eConnect_UUIE_fastStart) {
 834                 for (i = 0; i < connect->fastStart.count; i++) {
 835                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 836                                           &connect->fastStart.item[i]);
 837                         if (ret < 0)
 838                                 return -1;
 839                 }
 840         }
 841
 842         return 0;
 843 }
 844
 845 /****************************************************************************/
 846 static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
 847                             enum ip_conntrack_info ctinfo,
 848                             unsigned char **data, int dataoff,
 849                             Alerting_UUIE * alert)
 850 {
 851         int ret;
 852         int i;
 853
 854         DEBUGP("ip_ct_q931: Alerting\n");
 855
 856         if (alert->options & eAlerting_UUIE_h245Address) {
 857                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 858                                   &alert->h245Address);
 859                 if (ret < 0)
 860                         return -1;
 861         }
 862
 863         if (alert->options & eAlerting_UUIE_fastStart) {
 864                 for (i = 0; i < alert->fastStart.count; i++) {
 865                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 866                                           &alert->fastStart.item[i]);
 867                         if (ret < 0)
 868                                 return -1;
 869                 }
 870         }
 871
 872         return 0;
 873 }
 874
 875 /****************************************************************************/
 876 static int process_information(struct sk_buff **pskb,
 877                                struct ip_conntrack *ct,
 878                                enum ip_conntrack_info ctinfo,
 879                                unsigned char **data, int dataoff,
 880                                Information_UUIE * info)
 881 {
 882         int ret;
 883         int i;
 884
 885         DEBUGP("ip_ct_q931: Information\n");
 886
 887         if (info->options & eInformation_UUIE_fastStart) {
 888                 for (i = 0; i < info->fastStart.count; i++) {
 889                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 890                                           &info->fastStart.item[i]);
 891                         if (ret < 0)
 892                                 return -1;
 893                 }
 894         }
 895
 896         return 0;
 897 }
 898
 899 /****************************************************************************/
 900 static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
 901                             enum ip_conntrack_info ctinfo,
 902                             unsigned char **data, int dataoff,
 903                             Facility_UUIE * facility)
 904 {
 905         int ret;
 906         int i;
 907
 908         DEBUGP("ip_ct_q931: Facility\n");
 909
 910         if (facility->options & eFacility_UUIE_h245Address) {
 911                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 912                                   &facility->h245Address);
 913                 if (ret < 0)
 914                         return -1;
 915         }
 916
 917         if (facility->options & eFacility_UUIE_fastStart) {
 918                 for (i = 0; i < facility->fastStart.count; i++) {
 919                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 920                                           &facility->fastStart.item[i]);
 921                         if (ret < 0)
 922                                 return -1;
 923                 }
 924         }
 925
 926         return 0;
 927 }
 928
 929 /****************************************************************************/
 930 static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
 931                             enum ip_conntrack_info ctinfo,
 932                             unsigned char **data, int dataoff,
 933                             Progress_UUIE * progress)
 934 {
 935         int ret;
 936         int i;
 937
 938         DEBUGP("ip_ct_q931: Progress\n");
 939
 940         if (progress->options & eProgress_UUIE_h245Address) {
 941                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 942                                   &progress->h245Address);
 943                 if (ret < 0)
 944                         return -1;
 945         }
 946
 947         if (progress->options & eProgress_UUIE_fastStart) {
 948                 for (i = 0; i < progress->fastStart.count; i++) {
 949                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 950                                           &progress->fastStart.item[i]);
 951                         if (ret < 0)
 952                                 return -1;
 953                 }
 954         }
 955
 956         return 0;
 957 }
 958
 959 /****************************************************************************/
 960 static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
 961                         enum ip_conntrack_info ctinfo,
 962                         unsigned char **data, int dataoff, Q931 * q931)
 963 {
 964         H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
 965         int i;
 966         int ret = 0;
 967
 968         switch (pdu->h323_message_body.choice) {
 969         case eH323_UU_PDU_h323_message_body_setup:
 970                 ret = process_setup(pskb, ct, ctinfo, data, dataoff,
 971                                     &pdu->h323_message_body.setup);
 972                 break;
 973         case eH323_UU_PDU_h323_message_body_callProceeding:
 974                 ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
 975                                              &pdu->h323_message_body.
 976                                              callProceeding);
 977                 break;
 978         case eH323_UU_PDU_h323_message_body_connect:
 979                 ret = process_connect(pskb, ct, ctinfo, data, dataoff,
 980                                       &pdu->h323_message_body.connect);
 981                 break;
 982         case eH323_UU_PDU_h323_message_body_alerting:
 983                 ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
 984                                        &pdu->h323_message_body.alerting);
 985                 break;
 986         case eH323_UU_PDU_h323_message_body_information:
 987                 ret = process_information(pskb, ct, ctinfo, data, dataoff,
 988                                           &pdu->h323_message_body.
 989                                           information);
 990                 break;
 991         case eH323_UU_PDU_h323_message_body_facility:
 992                 ret = process_facility(pskb, ct, ctinfo, data, dataoff,
 993                                        &pdu->h323_message_body.facility);
 994                 break;
 995         case eH323_UU_PDU_h323_message_body_progress:
 996                 ret = process_progress(pskb, ct, ctinfo, data, dataoff,
 997                                        &pdu->h323_message_body.progress);
 998                 break;
 999         default:
1000                 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
1001                        pdu->h323_message_body.choice);
1002                 break;
1003         }
1004
1005         if (ret < 0)
1006                 return -1;
1007
1008         if (pdu->options & eH323_UU_PDU_h245Control) {
1009                 for (i = 0; i < pdu->h245Control.count; i++) {
1010                         ret = process_h245(pskb, ct, ctinfo, data, dataoff,
1011                                            &pdu->h245Control.item[i]);
1012                         if (ret < 0)
1013                                 return -1;
1014                 }
1015         }
1016
1017         return 0;
1018 }
1019
1020 /****************************************************************************/
1021 static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1022                      enum ip_conntrack_info ctinfo)
1023 {
1024         static Q931 q931;
1025         unsigned char *data = NULL;
1026         int datalen;
1027         int dataoff;
1028         int ret;
1029
1030         /* Until there's been traffic both ways, don't look in packets. */
1031         if (ctinfo != IP_CT_ESTABLISHED
1032             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
1033                 return NF_ACCEPT;
1034         }
1035         DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
1036
1037         spin_lock_bh(&ip_h323_lock);
1038
1039         /* Process each TPKT */
1040         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
1041                 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1042                        NIPQUAD((*pskb)->nh.iph->saddr),
1043                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1044
1045                 /* Decode Q.931 signal */
1046                 ret = DecodeQ931(data, datalen, &q931);
1047                 if (ret < 0) {
1048                         if (net_ratelimit())
1049                                 printk("ip_ct_q931: decoding error: %s\n",
1050                                        ret == H323_ERROR_BOUND ?
1051                                        "out of bound" : "out of range");
1052                         /* We don't drop when decoding error */
1053                         break;
1054                 }
1055
1056                 /* Process Q.931 signal */
1057                 if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
1058                         goto drop;
1059         }
1060
1061         spin_unlock_bh(&ip_h323_lock);
1062         return NF_ACCEPT;
1063
1064       drop:
1065         spin_unlock_bh(&ip_h323_lock);
1066         if (net_ratelimit())
1067                 printk("ip_ct_q931: packet dropped\n");
1068         return NF_DROP;
1069 }
1070
1071 /****************************************************************************/
1072 static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
1073         .name = "Q.931",
1074         .me = THIS_MODULE,
1075         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
1076         .timeout = 240,
1077         .tuple = {.src = {.u = {__constant_htons(Q931_PORT)}},
1078                   .dst = {.protonum = IPPROTO_TCP}},
1079         .mask = {.src = {.u = {0xFFFF}},
1080                  .dst = {.protonum = 0xFF}},
1081         .help = q931_help
1082 };
1083
1084 /****************************************************************************/
1085 void ip_conntrack_q931_expect(struct ip_conntrack *new,
1086                               struct ip_conntrack_expect *this)
1087 {
1088         write_lock_bh(&ip_conntrack_lock);
1089         new->helper = &ip_conntrack_helper_q931;
1090         write_unlock_bh(&ip_conntrack_lock);
1091 }
1092
1093 /****************************************************************************/
1094 static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
1095 {
1096         struct udphdr _uh, *uh;
1097         int dataoff;
1098
1099         uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
1100                                 &_uh);
1101         if (uh == NULL)
1102                 return NULL;
1103         dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
1104         if (dataoff >= (*pskb)->len)
1105                 return NULL;
1106         *datalen = (*pskb)->len - dataoff;
1107         return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
1108 }
1109
1110 /****************************************************************************/
1111 static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
1112                                                u_int32_t ip, u_int16_t port)
1113 {
1114         struct ip_conntrack_expect *exp;
1115         struct ip_conntrack_tuple tuple;
1116
1117         tuple.src.ip = 0;
1118         tuple.src.u.tcp.port = 0;
1119         tuple.dst.ip = ip;
1120         tuple.dst.u.tcp.port = htons(port);
1121         tuple.dst.protonum = IPPROTO_TCP;
1122
1123         exp = __ip_conntrack_expect_find(&tuple);
1124         if (exp->master == ct)
1125                 return exp;
1126         return NULL;
1127 }
1128
1129 /****************************************************************************/
1130 static int set_expect_timeout(struct ip_conntrack_expect *exp,
1131                               unsigned timeout)
1132 {
1133         if (!exp || !del_timer(&exp->timeout))
1134                 return 0;
1135
1136         exp->timeout.expires = jiffies + timeout * HZ;
1137         add_timer(&exp->timeout);
1138
1139         return 1;
1140 }
1141
1142 /****************************************************************************/
1143 static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
1144                        enum ip_conntrack_info ctinfo,
1145                        unsigned char **data,
1146                        TransportAddress * addr, int count)
1147 {
1148         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1149         int dir = CTINFO2DIR(ctinfo);
1150         int ret = 0;
1151         int i;
1152         u_int32_t ip;
1153         u_int16_t port;
1154         struct ip_conntrack_expect *exp;
1155
1156         /* Look for the first related address */
1157         for (i = 0; i < count; i++) {
1158                 if (get_h225_addr(*data, &addr[i], &ip, &port) &&
1159                     ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
1160                         break;
1161         }
1162
1163         if (i >= count)         /* Not found */
1164                 return 0;
1165
1166         /* Create expect for Q.931 */
1167         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1168                 return -1;
1169         exp->tuple.src.ip = gkrouted_only ?     /* only accept calls from GK? */
1170             ct->tuplehash[!dir].tuple.src.ip : 0;
1171         exp->tuple.src.u.tcp.port = 0;
1172         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
1173         exp->tuple.dst.u.tcp.port = htons(port);
1174         exp->tuple.dst.protonum = IPPROTO_TCP;
1175         exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
1176         exp->mask.src.u.tcp.port = 0;
1177         exp->mask.dst.ip = 0xFFFFFFFF;
1178         exp->mask.dst.u.tcp.port = 0xFFFF;
1179         exp->mask.dst.protonum = 0xFF;
1180         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
1181
1182         if (nat_q931_hook) {    /* Need NAT */
1183                 ret = nat_q931_hook(pskb, ct, ctinfo, data, addr, i,
1184                                     port, exp);
1185         } else {                /* Conntrack only */
1186                 exp->expectfn = ip_conntrack_q931_expect;
1187
1188                 if (ip_conntrack_expect_related(exp) == 0) {
1189                         DEBUGP("ip_ct_ras: expect Q.931 "
1190                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1191                                NIPQUAD(exp->tuple.src.ip),
1192                                ntohs(exp->tuple.src.u.tcp.port),
1193                                NIPQUAD(exp->tuple.dst.ip),
1194                                ntohs(exp->tuple.dst.u.tcp.port));
1195
1196                         /* Save port for looking up expect in processing RCF */
1197                         info->sig_port[dir] = port;
1198                 } else
1199                         ret = -1;
1200         }
1201
1202         ip_conntrack_expect_put(exp);
1203
1204         return ret;
1205 }
1206
1207 /****************************************************************************/
1208 static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
1209                        enum ip_conntrack_info ctinfo,
1210                        unsigned char **data, GatekeeperRequest * grq)
1211 {
1212         DEBUGP("ip_ct_ras: GRQ\n");
1213
1214         if (set_ras_addr_hook)  /* NATed */
1215                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1216                                          &grq->rasAddress, 1);
1217         return 0;
1218 }
1219
1220 /* Declare before using */
1221 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1222                                     struct ip_conntrack_expect *this);
1223
1224 /****************************************************************************/
1225 static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1226                        enum ip_conntrack_info ctinfo,
1227                        unsigned char **data, GatekeeperConfirm * gcf)
1228 {
1229         int dir = CTINFO2DIR(ctinfo);
1230         int ret = 0;
1231         u_int32_t ip;
1232         u_int16_t port;
1233         struct ip_conntrack_expect *exp;
1234
1235         DEBUGP("ip_ct_ras: GCF\n");
1236
1237         if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
1238                 return 0;
1239
1240         /* Registration port is the same as discovery port */
1241         if (ip == ct->tuplehash[dir].tuple.src.ip &&
1242             port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
1243                 return 0;
1244
1245         /* Avoid RAS expectation loops. A GCF is never expected. */
1246         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1247                 return 0;
1248
1249         /* Need new expect */
1250         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1251                 return -1;
1252         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1253         exp->tuple.src.u.tcp.port = 0;
1254         exp->tuple.dst.ip = ip;
1255         exp->tuple.dst.u.tcp.port = htons(port);
1256         exp->tuple.dst.protonum = IPPROTO_UDP;
1257         exp->mask.src.ip = 0xFFFFFFFF;
1258         exp->mask.src.u.tcp.port = 0;
1259         exp->mask.dst.ip = 0xFFFFFFFF;
1260         exp->mask.dst.u.tcp.port = 0xFFFF;
1261         exp->mask.dst.protonum = 0xFF;
1262         exp->flags = 0;
1263         exp->expectfn = ip_conntrack_ras_expect;
1264         if (ip_conntrack_expect_related(exp) == 0) {
1265                 DEBUGP("ip_ct_ras: expect RAS "
1266                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1267                        NIPQUAD(exp->tuple.src.ip),
1268                        ntohs(exp->tuple.src.u.tcp.port),
1269                        NIPQUAD(exp->tuple.dst.ip),
1270                        ntohs(exp->tuple.dst.u.tcp.port));
1271         } else
1272                 ret = -1;
1273
1274         ip_conntrack_expect_put(exp);
1275
1276         return ret;
1277 }
1278
1279 /****************************************************************************/
1280 static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1281                        enum ip_conntrack_info ctinfo,
1282                        unsigned char **data, RegistrationRequest * rrq)
1283 {
1284         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1285         int ret;
1286
1287         DEBUGP("ip_ct_ras: RRQ\n");
1288
1289         ret = expect_q931(pskb, ct, ctinfo, data,
1290                           rrq->callSignalAddress.item,
1291                           rrq->callSignalAddress.count);
1292         if (ret < 0)
1293                 return -1;
1294
1295         if (set_ras_addr_hook) {
1296                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1297                                         rrq->rasAddress.item,
1298                                         rrq->rasAddress.count);
1299                 if (ret < 0)
1300                         return -1;
1301         }
1302
1303         if (rrq->options & eRegistrationRequest_timeToLive) {
1304                 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1305                 info->timeout = rrq->timeToLive;
1306         } else
1307                 info->timeout = default_rrq_ttl;
1308
1309         return 0;
1310 }
1311
1312 /****************************************************************************/
1313 static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1314                        enum ip_conntrack_info ctinfo,
1315                        unsigned char **data, RegistrationConfirm * rcf)
1316 {
1317         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1318         int dir = CTINFO2DIR(ctinfo);
1319         int ret;
1320         struct ip_conntrack_expect *exp;
1321
1322         DEBUGP("ip_ct_ras: RCF\n");
1323
1324         if (set_sig_addr_hook) {
1325                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1326                                         rcf->callSignalAddress.item,
1327                                         rcf->callSignalAddress.count);
1328                 if (ret < 0)
1329                         return -1;
1330         }
1331
1332         if (rcf->options & eRegistrationConfirm_timeToLive) {
1333                 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1334                 info->timeout = rcf->timeToLive;
1335         }
1336
1337         if (info->timeout > 0) {
1338                 DEBUGP
1339                     ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1340                      info->timeout);
1341                 ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
1342
1343                 /* Set expect timeout */
1344                 read_lock_bh(&ip_conntrack_lock);
1345                 exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
1346                                   info->sig_port[!dir]);
1347                 if (exp) {
1348                         DEBUGP("ip_ct_ras: set Q.931 expect "
1349                                "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1350                                "timeout to %u seconds\n",
1351                                NIPQUAD(exp->tuple.src.ip),
1352                                ntohs(exp->tuple.src.u.tcp.port),
1353                                NIPQUAD(exp->tuple.dst.ip),
1354                                ntohs(exp->tuple.dst.u.tcp.port),
1355                                info->timeout);
1356                         set_expect_timeout(exp, info->timeout);
1357                 }
1358                 read_unlock_bh(&ip_conntrack_lock);
1359         }
1360
1361         return 0;
1362 }
1363
1364 /****************************************************************************/
1365 static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
1366                        enum ip_conntrack_info ctinfo,
1367                        unsigned char **data, UnregistrationRequest * urq)
1368 {
1369         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1370         int dir = CTINFO2DIR(ctinfo);
1371         int ret;
1372
1373         DEBUGP("ip_ct_ras: URQ\n");
1374
1375         if (set_sig_addr_hook) {
1376                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1377                                         urq->callSignalAddress.item,
1378                                         urq->callSignalAddress.count);
1379                 if (ret < 0)
1380                         return -1;
1381         }
1382
1383         /* Clear old expect */
1384         ip_ct_remove_expectations(ct);
1385         info->sig_port[dir] = 0;
1386         info->sig_port[!dir] = 0;
1387
1388         /* Give it 30 seconds for UCF or URJ */
1389         ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
1390
1391         return 0;
1392 }
1393
1394 /****************************************************************************/
1395 static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
1396                        enum ip_conntrack_info ctinfo,
1397                        unsigned char **data, AdmissionRequest * arq)
1398 {
1399         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1400         int dir = CTINFO2DIR(ctinfo);
1401         u_int32_t ip;
1402         u_int16_t port;
1403
1404         DEBUGP("ip_ct_ras: ARQ\n");
1405
1406         if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1407             get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
1408             ip == ct->tuplehash[dir].tuple.src.ip &&
1409             port == info->sig_port[dir] && set_h225_addr_hook) {
1410                 /* Answering ARQ */
1411                 return set_h225_addr_hook(pskb, data, 0,
1412                                           &arq->destCallSignalAddress,
1413                                           ct->tuplehash[!dir].tuple.dst.ip,
1414                                           info->sig_port[!dir]);
1415         }
1416
1417         if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1418             get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
1419             ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr_hook) {
1420                 /* Calling ARQ */
1421                 return set_h225_addr_hook(pskb, data, 0,
1422                                           &arq->srcCallSignalAddress,
1423                                           ct->tuplehash[!dir].tuple.dst.ip,
1424                                           port);
1425         }
1426
1427         return 0;
1428 }
1429
1430 /****************************************************************************/
1431 static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
1432                        enum ip_conntrack_info ctinfo,
1433                        unsigned char **data, AdmissionConfirm * acf)
1434 {
1435         int dir = CTINFO2DIR(ctinfo);
1436         int ret = 0;
1437         u_int32_t ip;
1438         u_int16_t port;
1439         struct ip_conntrack_expect *exp;
1440
1441         DEBUGP("ip_ct_ras: ACF\n");
1442
1443         if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
1444                 return 0;
1445
1446         if (ip == ct->tuplehash[dir].tuple.dst.ip) {    /* Answering ACF */
1447                 if (set_sig_addr_hook)
1448                         return set_sig_addr_hook(pskb, ct, ctinfo, data,
1449                                                  &acf->destCallSignalAddress,
1450                                                  1);
1451                 return 0;
1452         }
1453
1454         /* Need new expect */
1455         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1456                 return -1;
1457         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1458         exp->tuple.src.u.tcp.port = 0;
1459         exp->tuple.dst.ip = ip;
1460         exp->tuple.dst.u.tcp.port = htons(port);
1461         exp->tuple.dst.protonum = IPPROTO_TCP;
1462         exp->mask.src.ip = 0xFFFFFFFF;
1463         exp->mask.src.u.tcp.port = 0;
1464         exp->mask.dst.ip = 0xFFFFFFFF;
1465         exp->mask.dst.u.tcp.port = 0xFFFF;
1466         exp->mask.dst.protonum = 0xFF;
1467         exp->flags = IP_CT_EXPECT_PERMANENT;
1468         exp->expectfn = ip_conntrack_q931_expect;
1469
1470         if (ip_conntrack_expect_related(exp) == 0) {
1471                 DEBUGP("ip_ct_ras: expect Q.931 "
1472                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1473                        NIPQUAD(exp->tuple.src.ip),
1474                        ntohs(exp->tuple.src.u.tcp.port),
1475                        NIPQUAD(exp->tuple.dst.ip),
1476                        ntohs(exp->tuple.dst.u.tcp.port));
1477         } else
1478                 ret = -1;
1479
1480         ip_conntrack_expect_put(exp);
1481
1482         return ret;
1483 }
1484
1485 /****************************************************************************/
1486 static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1487                        enum ip_conntrack_info ctinfo,
1488                        unsigned char **data, LocationRequest * lrq)
1489 {
1490         DEBUGP("ip_ct_ras: LRQ\n");
1491
1492         if (set_ras_addr_hook)
1493                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1494                                          &lrq->replyAddress, 1);
1495         return 0;
1496 }
1497
1498 /****************************************************************************/
1499 static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1500                        enum ip_conntrack_info ctinfo,
1501                        unsigned char **data, LocationConfirm * lcf)
1502 {
1503         int dir = CTINFO2DIR(ctinfo);
1504         int ret = 0;
1505         u_int32_t ip;
1506         u_int16_t port;
1507         struct ip_conntrack_expect *exp = NULL;
1508
1509         DEBUGP("ip_ct_ras: LCF\n");
1510
1511         if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
1512                 return 0;
1513
1514         /* Need new expect for call signal */
1515         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1516                 return -1;
1517         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1518         exp->tuple.src.u.tcp.port = 0;
1519         exp->tuple.dst.ip = ip;
1520         exp->tuple.dst.u.tcp.port = htons(port);
1521         exp->tuple.dst.protonum = IPPROTO_TCP;
1522         exp->mask.src.ip = 0xFFFFFFFF;
1523         exp->mask.src.u.tcp.port = 0;
1524         exp->mask.dst.ip = 0xFFFFFFFF;
1525         exp->mask.dst.u.tcp.port = 0xFFFF;
1526         exp->mask.dst.protonum = 0xFF;
1527         exp->flags = IP_CT_EXPECT_PERMANENT;
1528         exp->expectfn = ip_conntrack_q931_expect;
1529
1530         if (ip_conntrack_expect_related(exp) == 0) {
1531                 DEBUGP("ip_ct_ras: expect Q.931 "
1532                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1533                        NIPQUAD(exp->tuple.src.ip),
1534                        ntohs(exp->tuple.src.u.tcp.port),
1535                        NIPQUAD(exp->tuple.dst.ip),
1536                        ntohs(exp->tuple.dst.u.tcp.port));
1537         } else
1538                 ret = -1;
1539
1540         ip_conntrack_expect_put(exp);
1541
1542         /* Ignore rasAddress */
1543
1544         return ret;
1545 }
1546
1547 /****************************************************************************/
1548 static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
1549                        enum ip_conntrack_info ctinfo,
1550                        unsigned char **data, InfoRequestResponse * irr)
1551 {
1552         int ret;
1553
1554         DEBUGP("ip_ct_ras: IRR\n");
1555
1556         if (set_ras_addr_hook) {
1557                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1558                                         &irr->rasAddress, 1);
1559                 if (ret < 0)
1560                         return -1;
1561         }
1562
1563         if (set_sig_addr_hook) {
1564                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1565                                         irr->callSignalAddress.item,
1566                                         irr->callSignalAddress.count);
1567                 if (ret < 0)
1568                         return -1;
1569         }
1570
1571         return 0;
1572 }
1573
1574 /****************************************************************************/
1575 static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
1576                        enum ip_conntrack_info ctinfo,
1577                        unsigned char **data, RasMessage * ras)
1578 {
1579         switch (ras->choice) {
1580         case eRasMessage_gatekeeperRequest:
1581                 return process_grq(pskb, ct, ctinfo, data,
1582                                    &ras->gatekeeperRequest);
1583         case eRasMessage_gatekeeperConfirm:
1584                 return process_gcf(pskb, ct, ctinfo, data,
1585                                    &ras->gatekeeperConfirm);
1586         case eRasMessage_registrationRequest:
1587                 return process_rrq(pskb, ct, ctinfo, data,
1588                                    &ras->registrationRequest);
1589         case eRasMessage_registrationConfirm:
1590                 return process_rcf(pskb, ct, ctinfo, data,
1591                                    &ras->registrationConfirm);
1592         case eRasMessage_unregistrationRequest:
1593                 return process_urq(pskb, ct, ctinfo, data,
1594                                    &ras->unregistrationRequest);
1595         case eRasMessage_admissionRequest:
1596                 return process_arq(pskb, ct, ctinfo, data,
1597                                    &ras->admissionRequest);
1598         case eRasMessage_admissionConfirm:
1599                 return process_acf(pskb, ct, ctinfo, data,
1600                                    &ras->admissionConfirm);
1601         case eRasMessage_locationRequest:
1602                 return process_lrq(pskb, ct, ctinfo, data,
1603                                    &ras->locationRequest);
1604         case eRasMessage_locationConfirm:
1605                 return process_lcf(pskb, ct, ctinfo, data,
1606                                    &ras->locationConfirm);
1607         case eRasMessage_infoRequestResponse:
1608                 return process_irr(pskb, ct, ctinfo, data,
1609                                    &ras->infoRequestResponse);
1610         default:
1611                 DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
1612                 break;
1613         }
1614
1615         return 0;
1616 }
1617
1618 /****************************************************************************/
1619 static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1620                     enum ip_conntrack_info ctinfo)
1621 {
1622         static RasMessage ras;
1623         unsigned char *data;
1624         int datalen = 0;
1625         int ret;
1626
1627         DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
1628
1629         spin_lock_bh(&ip_h323_lock);
1630
1631         /* Get UDP data */
1632         data = get_udp_data(pskb, &datalen);
1633         if (data == NULL)
1634                 goto accept;
1635         DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1636                NIPQUAD((*pskb)->nh.iph->saddr),
1637                NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1638
1639         /* Decode RAS message */
1640         ret = DecodeRasMessage(data, datalen, &ras);
1641         if (ret < 0) {
1642                 if (net_ratelimit())
1643                         printk("ip_ct_ras: decoding error: %s\n",
1644                                ret == H323_ERROR_BOUND ?
1645                                "out of bound" : "out of range");
1646                 goto accept;
1647         }
1648
1649         /* Process RAS message */
1650         if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
1651                 goto drop;
1652
1653       accept:
1654         spin_unlock_bh(&ip_h323_lock);
1655         return NF_ACCEPT;
1656
1657       drop:
1658         spin_unlock_bh(&ip_h323_lock);
1659         if (net_ratelimit())
1660                 printk("ip_ct_ras: packet dropped\n");
1661         return NF_DROP;
1662 }
1663
1664 /****************************************************************************/
1665 static struct ip_conntrack_helper ip_conntrack_helper_ras = {
1666         .name = "RAS",
1667         .me = THIS_MODULE,
1668         .max_expected = 32,
1669         .timeout = 240,
1670         .tuple = {.src = {.u = {__constant_htons(RAS_PORT)}},
1671                   .dst = {.protonum = IPPROTO_UDP}},
1672         .mask = {.src = {.u = {0xFFFE}},
1673                  .dst = {.protonum = 0xFF}},
1674         .help = ras_help,
1675 };
1676
1677 /****************************************************************************/
1678 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1679                                     struct ip_conntrack_expect *this)
1680 {
1681         write_lock_bh(&ip_conntrack_lock);
1682         new->helper = &ip_conntrack_helper_ras;
1683         write_unlock_bh(&ip_conntrack_lock);
1684 }
1685
1686 /****************************************************************************/
1687 /* Not __exit - called from init() */
1688 static void fini(void)
1689 {
1690         ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
1691         ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
1692         kfree(h323_buffer);
1693         DEBUGP("ip_ct_h323: fini\n");
1694 }
1695
1696 /****************************************************************************/
1697 static int __init init(void)
1698 {
1699         int ret;
1700
1701         h323_buffer = kmalloc(65536, GFP_KERNEL);
1702         if (!h323_buffer)
1703                 return -ENOMEM;
1704         if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
1705             (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
1706                 fini();
1707                 return ret;
1708         }
1709
1710         DEBUGP("ip_ct_h323: init success\n");
1711         return 0;
1712 }
1713
1714 /****************************************************************************/
1715 module_init(init);
1716 module_exit(fini);
1717
1718 EXPORT_SYMBOL_GPL(get_h225_addr);
1719 EXPORT_SYMBOL_GPL(ip_conntrack_h245_expect);
1720 EXPORT_SYMBOL_GPL(ip_conntrack_q931_expect);
1721 EXPORT_SYMBOL_GPL(set_h245_addr_hook);
1722 EXPORT_SYMBOL_GPL(set_h225_addr_hook);
1723 EXPORT_SYMBOL_GPL(set_sig_addr_hook);
1724 EXPORT_SYMBOL_GPL(set_ras_addr_hook);
1725 EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
1726 EXPORT_SYMBOL_GPL(nat_t120_hook);
1727 EXPORT_SYMBOL_GPL(nat_h245_hook);
1728 EXPORT_SYMBOL_GPL(nat_q931_hook);
1729
1730 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1731 MODULE_DESCRIPTION("H.323 connection tracking helper");
1732 MODULE_LICENSE("GPL");