net/ipv4/netfilter/ip_conntrack_helper_h323.c

   1 /*
   2  * H.323 connection tracking helper
   3  *
   4  * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
   5  *
   6  * This source code is licensed under General Public License version 2.
   7  *
   8  * Based on the 'brute force' H.323 connection tracking module by
   9  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  10  *
  11  * For more information, please see http://nath323.sourceforge.net/
  12  *
  13  * Changes:
  14  *      2006-02-01 - initial version 0.1
  15  *
  16  *      2006-02-20 - version 0.2
  17  *        1. Changed source format to follow kernel conventions
  18  *        2. Deleted some unnecessary structures
  19  *        3. Minor fixes
  20  *
  21  *      2006-03-10 - version 0.3
  22  *        1. Added support for multiple TPKTs in one packet (suggested by
  23  *           Patrick McHardy)
  24  *        2. Avoid excessive stack usage (based on Patrick McHardy's patch)
  25  *        3. Added support for non-linear skb (based on Patrick McHardy's patch)
  26  *        4. Fixed missing H.245 module owner (Patrick McHardy)
  27  *        5. Avoid long RAS expectation chains (Patrick McHardy)
  28  *        6. Fixed incorrect __exit attribute (Patrick McHardy)
  29  *        7. Eliminated unnecessary return code
  30  *        8. Fixed incorrect use of NAT data from conntrack code (suggested by
  31  *           Patrick McHardy)
  32  *        9. Fixed TTL calculation error in RCF
  33  *        10. Added TTL support in RRQ
  34  *        11. Better support for separate TPKT header and data
  35  *
  36  *      2006-03-15 - version 0.4
  37  *        1. Added support for T.120 channels
  38  *        2. Added parameter gkrouted_only (suggested by Patrick McHardy)
  39  *        3. Splitted ASN.1 code and data (suggested by Patrick McHardy)
  40  *        4. Sort ASN.1 data to avoid forwarding declarations (suggested by
  41  *           Patrick McHardy)
  42  *        5. Reset next TPKT data length in get_tpkt_data()
  43  */
  44
  45 #include <linux/config.h>
  46 #include <linux/module.h>
  47 #include <linux/netfilter.h>
  48 #include <linux/ip.h>
  49 #include <net/tcp.h>
  50 #include <linux/netfilter_ipv4/ip_conntrack.h>
  51 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  52 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  53 #include <linux/netfilter_ipv4/ip_conntrack_tuple.h>
  54 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
  55 #include <linux/moduleparam.h>
  56
  57 #include "ip_conntrack_helper_h323_asn1.h"
  58
  59 #if 0
  60 #define DEBUGP printk
  61 #else
  62 #define DEBUGP(format, args...)
  63 #endif
  64
  65 /* Parameters */
  66 static int gkrouted_only = 1;
  67 module_param(gkrouted_only, int, 0600);
  68 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
  69
  70 /* Hooks for NAT */
  71 int (*set_h245_addr_hook) (struct sk_buff ** pskb,
  72                            unsigned char **data, int dataoff,
  73                            H245_TransportAddress * addr,
  74                            u_int32_t ip, u_int16_t port);
  75 int (*set_h225_addr_hook) (struct sk_buff ** pskb,
  76                            unsigned char **data, int dataoff,
  77                            TransportAddress * addr,
  78                            u_int32_t ip, u_int16_t port);
  79 int (*set_sig_addr_hook) (struct sk_buff ** pskb,
  80                           struct ip_conntrack * ct,
  81                           enum ip_conntrack_info ctinfo,
  82                           unsigned char **data,
  83                           TransportAddress * addr, int count);
  84 int (*set_ras_addr_hook) (struct sk_buff ** pskb,
  85                           struct ip_conntrack * ct,
  86                           enum ip_conntrack_info ctinfo,
  87                           unsigned char **data,
  88                           TransportAddress * addr, int count);
  89 int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
  90                           struct ip_conntrack * ct,
  91                           enum ip_conntrack_info ctinfo,
  92                           unsigned char **data, int dataoff,
  93                           H245_TransportAddress * addr,
  94                           u_int16_t port, u_int16_t rtp_port,
  95                           struct ip_conntrack_expect * rtp_exp,
  96                           struct ip_conntrack_expect * rtcp_exp);
  97 int (*nat_t120_hook) (struct sk_buff ** pskb,
  98                       struct ip_conntrack * ct,
  99                       enum ip_conntrack_info ctinfo,
 100                       unsigned char **data, int dataoff,
 101                       H245_TransportAddress * addr, u_int16_t port,
 102                       struct ip_conntrack_expect * exp);
 103 int (*nat_h245_hook) (struct sk_buff ** pskb,
 104                       struct ip_conntrack * ct,
 105                       enum ip_conntrack_info ctinfo,
 106                       unsigned char **data, int dataoff,
 107                       TransportAddress * addr, u_int16_t port,
 108                       struct ip_conntrack_expect * exp);
 109 int (*nat_q931_hook) (struct sk_buff ** pskb,
 110                       struct ip_conntrack * ct,
 111                       enum ip_conntrack_info ctinfo,
 112                       unsigned char **data, TransportAddress * addr, int idx,
 113                       u_int16_t port, struct ip_conntrack_expect * exp);
 114
 115
 116 static DEFINE_SPINLOCK(ip_h323_lock);
 117 static char *h323_buffer;
 118
 119 /****************************************************************************/
 120 static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
 121                          enum ip_conntrack_info ctinfo,
 122                          unsigned char **data, int *datalen, int *dataoff)
 123 {
 124         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
 125         int dir = CTINFO2DIR(ctinfo);
 126         struct tcphdr _tcph, *th;
 127         int tcpdatalen;
 128         int tcpdataoff;
 129         unsigned char *tpkt;
 130         int tpktlen;
 131         int tpktoff;
 132
 133         /* Get TCP header */
 134         th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4,
 135                                 sizeof(_tcph), &_tcph);
 136         if (th == NULL)
 137                 return 0;
 138
 139         /* Get TCP data offset */
 140         tcpdataoff = (*pskb)->nh.iph->ihl * 4 + th->doff * 4;
 141
 142         /* Get TCP data length */
 143         tcpdatalen = (*pskb)->len - tcpdataoff;
 144         if (tcpdatalen <= 0)    /* No TCP data */
 145                 goto clear_out;
 146
 147         if (*data == NULL) {    /* first TPKT */
 148                 /* Get first TPKT pointer */
 149                 tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
 150                                           h323_buffer);
 151                 BUG_ON(tpkt == NULL);
 152
 153                 /* Validate TPKT identifier */
 154                 if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {
 155                         /* Netmeeting sends TPKT header and data separately */
 156                         if (info->tpkt_len[dir] > 0) {
 157                                 DEBUGP("ip_ct_h323: previous packet "
 158                                        "indicated separate TPKT data of %hu "
 159                                        "bytes\n", info->tpkt_len[dir]);
 160                                 if (info->tpkt_len[dir] <= tcpdatalen) {
 161                                         /* Yes, there was a TPKT header
 162                                          * received */
 163                                         *data = tpkt;
 164                                         *datalen = info->tpkt_len[dir];
 165                                         *dataoff = 0;
 166                                         goto out;
 167                                 }
 168
 169                                 /* Fragmented TPKT */
 170                                 if (net_ratelimit())
 171                                         printk("ip_ct_h323: "
 172                                                "fragmented TPKT\n");
 173                                 goto clear_out;
 174                         }
 175
 176                         /* It is not even a TPKT */
 177                         return 0;
 178                 }
 179                 tpktoff = 0;
 180         } else {                /* Next TPKT */
 181                 tpktoff = *dataoff + *datalen;
 182                 tcpdatalen -= tpktoff;
 183                 if (tcpdatalen <= 4)    /* No more TPKT */
 184                         goto clear_out;
 185                 tpkt = *data + *datalen;
 186
 187                 /* Validate TPKT identifier */
 188                 if (tpkt[0] != 0x03 || tpkt[1] != 0)
 189                         goto clear_out;
 190         }
 191
 192         /* Validate TPKT length */
 193         tpktlen = tpkt[2] * 256 + tpkt[3];
 194         if (tpktlen > tcpdatalen) {
 195                 if (tcpdatalen == 4) {  /* Separate TPKT header */
 196                         /* Netmeeting sends TPKT header and data separately */
 197                         DEBUGP("ip_ct_h323: separate TPKT header indicates "
 198                                "there will be TPKT data of %hu bytes\n",
 199                                tpktlen - 4);
 200                         info->tpkt_len[dir] = tpktlen - 4;
 201                         return 0;
 202                 }
 203
 204                 if (net_ratelimit())
 205                         printk("ip_ct_h323: incomplete TPKT (fragmented?)\n");
 206                 goto clear_out;
 207         }
 208
 209         /* This is the encapsulated data */
 210         *data = tpkt + 4;
 211         *datalen = tpktlen - 4;
 212         *dataoff = tpktoff + 4;
 213
 214       out:
 215         /* Clear TPKT length */
 216         info->tpkt_len[dir] = 0;
 217         return 1;
 218
 219       clear_out:
 220         info->tpkt_len[dir] = 0;
 221         return 0;
 222 }
 223
 224 /****************************************************************************/
 225 int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
 226                   u_int32_t * ip, u_int16_t * port)
 227 {
 228         unsigned char *p;
 229
 230         if (addr->choice != eH245_TransportAddress_unicastAddress ||
 231             addr->unicastAddress.choice != eUnicastAddress_iPAddress)
 232                 return 0;
 233
 234         p = data + addr->unicastAddress.iPAddress.network;
 235         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
 236         *port = (p[4] << 8) | (p[5]);
 237
 238         return 1;
 239 }
 240
 241 /****************************************************************************/
 242 static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
 243                            enum ip_conntrack_info ctinfo,
 244                            unsigned char **data, int dataoff,
 245                            H245_TransportAddress * addr)
 246 {
 247         int dir = CTINFO2DIR(ctinfo);
 248         int ret = 0;
 249         u_int32_t ip;
 250         u_int16_t port;
 251         u_int16_t rtp_port;
 252         struct ip_conntrack_expect *rtp_exp;
 253         struct ip_conntrack_expect *rtcp_exp;
 254
 255         /* Read RTP or RTCP address */
 256         if (!get_h245_addr(*data, addr, &ip, &port) ||
 257             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
 258                 return 0;
 259
 260         /* RTP port is even */
 261         rtp_port = port & (~1);
 262
 263         /* Create expect for RTP */
 264         if ((rtp_exp = ip_conntrack_expect_alloc(ct)) == NULL)
 265                 return -1;
 266         rtp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 267         rtp_exp->tuple.src.u.udp.port = 0;
 268         rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 269         rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
 270         rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
 271         rtp_exp->mask.src.ip = 0xFFFFFFFF;
 272         rtp_exp->mask.src.u.udp.port = 0;
 273         rtp_exp->mask.dst.ip = 0xFFFFFFFF;
 274         rtp_exp->mask.dst.u.udp.port = 0xFFFF;
 275         rtp_exp->mask.dst.protonum = 0xFF;
 276         rtp_exp->flags = 0;
 277
 278         /* Create expect for RTCP */
 279         if ((rtcp_exp = ip_conntrack_expect_alloc(ct)) == NULL) {
 280                 ip_conntrack_expect_put(rtp_exp);
 281                 return -1;
 282         }
 283         rtcp_exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 284         rtcp_exp->tuple.src.u.udp.port = 0;
 285         rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 286         rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
 287         rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
 288         rtcp_exp->mask.src.ip = 0xFFFFFFFF;
 289         rtcp_exp->mask.src.u.udp.port = 0;
 290         rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
 291         rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
 292         rtcp_exp->mask.dst.protonum = 0xFF;
 293         rtcp_exp->flags = 0;
 294
 295         if (ct->tuplehash[dir].tuple.src.ip !=
 296             ct->tuplehash[!dir].tuple.dst.ip && nat_rtp_rtcp_hook) {
 297                 /* NAT needed */
 298                 ret = nat_rtp_rtcp_hook(pskb, ct, ctinfo, data, dataoff,
 299                                         addr, port, rtp_port, rtp_exp,
 300                                         rtcp_exp);
 301         } else {                /* Conntrack only */
 302                 rtp_exp->expectfn = NULL;
 303                 rtcp_exp->expectfn = NULL;
 304
 305                 if (ip_conntrack_expect_related(rtp_exp) == 0) {
 306                         if (ip_conntrack_expect_related(rtcp_exp) == 0) {
 307                                 DEBUGP("ip_ct_h323: expect RTP "
 308                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 309                                        NIPQUAD(rtp_exp->tuple.src.ip),
 310                                        ntohs(rtp_exp->tuple.src.u.udp.port),
 311                                        NIPQUAD(rtp_exp->tuple.dst.ip),
 312                                        ntohs(rtp_exp->tuple.dst.u.udp.port));
 313                                 DEBUGP("ip_ct_h323: expect RTCP "
 314                                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 315                                        NIPQUAD(rtcp_exp->tuple.src.ip),
 316                                        ntohs(rtcp_exp->tuple.src.u.udp.port),
 317                                        NIPQUAD(rtcp_exp->tuple.dst.ip),
 318                                        ntohs(rtcp_exp->tuple.dst.u.udp.port));
 319                         } else {
 320                                 ip_conntrack_unexpect_related(rtp_exp);
 321                                 ret = -1;
 322                         }
 323                 } else
 324                         ret = -1;
 325         }
 326
 327         ip_conntrack_expect_put(rtp_exp);
 328         ip_conntrack_expect_put(rtcp_exp);
 329
 330         return ret;
 331 }
 332
 333 /****************************************************************************/
 334 static int expect_t120(struct sk_buff **pskb,
 335                        struct ip_conntrack *ct,
 336                        enum ip_conntrack_info ctinfo,
 337                        unsigned char **data, int dataoff,
 338                        H245_TransportAddress * addr)
 339 {
 340         int dir = CTINFO2DIR(ctinfo);
 341         int ret = 0;
 342         u_int32_t ip;
 343         u_int16_t port;
 344         struct ip_conntrack_expect *exp = NULL;
 345
 346         /* Read T.120 address */
 347         if (!get_h245_addr(*data, addr, &ip, &port) ||
 348             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
 349                 return 0;
 350
 351         /* Create expect for T.120 connections */
 352         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
 353                 return -1;
 354         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 355         exp->tuple.src.u.tcp.port = 0;
 356         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 357         exp->tuple.dst.u.tcp.port = htons(port);
 358         exp->tuple.dst.protonum = IPPROTO_TCP;
 359         exp->mask.src.ip = 0xFFFFFFFF;
 360         exp->mask.src.u.tcp.port = 0;
 361         exp->mask.dst.ip = 0xFFFFFFFF;
 362         exp->mask.dst.u.tcp.port = 0xFFFF;
 363         exp->mask.dst.protonum = 0xFF;
 364         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple channels */
 365
 366         if (ct->tuplehash[dir].tuple.src.ip !=
 367             ct->tuplehash[!dir].tuple.dst.ip && nat_t120_hook) {
 368                 /* NAT needed */
 369                 ret = nat_t120_hook(pskb, ct, ctinfo, data, dataoff, addr,
 370                                     port, exp);
 371         } else {                /* Conntrack only */
 372                 exp->expectfn = NULL;
 373                 if (ip_conntrack_expect_related(exp) == 0) {
 374                         DEBUGP("ip_ct_h323: expect T.120 "
 375                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 376                                NIPQUAD(exp->tuple.src.ip),
 377                                ntohs(exp->tuple.src.u.tcp.port),
 378                                NIPQUAD(exp->tuple.dst.ip),
 379                                ntohs(exp->tuple.dst.u.tcp.port));
 380                 } else
 381                         ret = -1;
 382         }
 383
 384         ip_conntrack_expect_put(exp);
 385
 386         return ret;
 387 }
 388
 389 /****************************************************************************/
 390 static int process_h245_channel(struct sk_buff **pskb,
 391                                 struct ip_conntrack *ct,
 392                                 enum ip_conntrack_info ctinfo,
 393                                 unsigned char **data, int dataoff,
 394                                 H2250LogicalChannelParameters * channel)
 395 {
 396         int ret;
 397
 398         if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
 399                 /* RTP */
 400                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 401                                       &channel->mediaChannel);
 402                 if (ret < 0)
 403                         return -1;
 404         }
 405
 406         if (channel->
 407             options & eH2250LogicalChannelParameters_mediaControlChannel) {
 408                 /* RTCP */
 409                 ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 410                                       &channel->mediaControlChannel);
 411                 if (ret < 0)
 412                         return -1;
 413         }
 414
 415         return 0;
 416 }
 417
 418 /****************************************************************************/
 419 static int process_olc(struct sk_buff **pskb, struct ip_conntrack *ct,
 420                        enum ip_conntrack_info ctinfo,
 421                        unsigned char **data, int dataoff,
 422                        OpenLogicalChannel * olc)
 423 {
 424         int ret;
 425
 426         DEBUGP("ip_ct_h323: OpenLogicalChannel\n");
 427
 428         if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
 429             eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
 430         {
 431                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
 432                                            &olc->
 433                                            forwardLogicalChannelParameters.
 434                                            multiplexParameters.
 435                                            h2250LogicalChannelParameters);
 436                 if (ret < 0)
 437                         return -1;
 438         }
 439
 440         if ((olc->options &
 441              eOpenLogicalChannel_reverseLogicalChannelParameters) &&
 442             (olc->reverseLogicalChannelParameters.options &
 443              eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters)
 444             && (olc->reverseLogicalChannelParameters.multiplexParameters.
 445                 choice ==
 446                 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
 447         {
 448                 ret =
 449                     process_h245_channel(pskb, ct, ctinfo, data, dataoff,
 450                                          &olc->
 451                                          reverseLogicalChannelParameters.
 452                                          multiplexParameters.
 453                                          h2250LogicalChannelParameters);
 454                 if (ret < 0)
 455                         return -1;
 456         }
 457
 458         if ((olc->options & eOpenLogicalChannel_separateStack) &&
 459             olc->forwardLogicalChannelParameters.dataType.choice ==
 460             eDataType_data &&
 461             olc->forwardLogicalChannelParameters.dataType.data.application.
 462             choice == eDataApplicationCapability_application_t120 &&
 463             olc->forwardLogicalChannelParameters.dataType.data.application.
 464             t120.choice == eDataProtocolCapability_separateLANStack &&
 465             olc->separateStack.networkAddress.choice ==
 466             eNetworkAccessParameters_networkAddress_localAreaAddress) {
 467                 ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
 468                                   &olc->separateStack.networkAddress.
 469                                   localAreaAddress);
 470                 if (ret < 0)
 471                         return -1;
 472         }
 473
 474         return 0;
 475 }
 476
 477 /****************************************************************************/
 478 static int process_olca(struct sk_buff **pskb, struct ip_conntrack *ct,
 479                         enum ip_conntrack_info ctinfo,
 480                         unsigned char **data, int dataoff,
 481                         OpenLogicalChannelAck * olca)
 482 {
 483         H2250LogicalChannelAckParameters *ack;
 484         int ret;
 485
 486         DEBUGP("ip_ct_h323: OpenLogicalChannelAck\n");
 487
 488         if ((olca->options &
 489              eOpenLogicalChannelAck_reverseLogicalChannelParameters) &&
 490             (olca->reverseLogicalChannelParameters.options &
 491              eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters)
 492             && (olca->reverseLogicalChannelParameters.multiplexParameters.
 493                 choice ==
 494                 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
 495         {
 496                 ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
 497                                            &olca->
 498                                            reverseLogicalChannelParameters.
 499                                            multiplexParameters.
 500                                            h2250LogicalChannelParameters);
 501                 if (ret < 0)
 502                         return -1;
 503         }
 504
 505         if ((olca->options &
 506              eOpenLogicalChannelAck_forwardMultiplexAckParameters) &&
 507             (olca->forwardMultiplexAckParameters.choice ==
 508              eOpenLogicalChannelAck_forwardMultiplexAckParameters_h2250LogicalChannelAckParameters))
 509         {
 510                 ack = &olca->forwardMultiplexAckParameters.
 511                     h2250LogicalChannelAckParameters;
 512                 if (ack->options &
 513                     eH2250LogicalChannelAckParameters_mediaChannel) {
 514                         /* RTP */
 515                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 516                                               &ack->mediaChannel);
 517                         if (ret < 0)
 518                                 return -1;
 519                 }
 520
 521                 if (ack->options &
 522                     eH2250LogicalChannelAckParameters_mediaControlChannel) {
 523                         /* RTCP */
 524                         ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
 525                                               &ack->mediaControlChannel);
 526                         if (ret < 0)
 527                                 return -1;
 528                 }
 529         }
 530
 531         return 0;
 532 }
 533
 534 /****************************************************************************/
 535 static int process_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
 536                         enum ip_conntrack_info ctinfo,
 537                         unsigned char **data, int dataoff,
 538                         MultimediaSystemControlMessage * mscm)
 539 {
 540         switch (mscm->choice) {
 541         case eMultimediaSystemControlMessage_request:
 542                 if (mscm->request.choice ==
 543                     eRequestMessage_openLogicalChannel) {
 544                         return process_olc(pskb, ct, ctinfo, data, dataoff,
 545                                            &mscm->request.openLogicalChannel);
 546                 }
 547                 DEBUGP("ip_ct_h323: H.245 Request %d\n",
 548                        mscm->request.choice);
 549                 break;
 550         case eMultimediaSystemControlMessage_response:
 551                 if (mscm->response.choice ==
 552                     eResponseMessage_openLogicalChannelAck) {
 553                         return process_olca(pskb, ct, ctinfo, data, dataoff,
 554                                             &mscm->response.
 555                                             openLogicalChannelAck);
 556                 }
 557                 DEBUGP("ip_ct_h323: H.245 Response %d\n",
 558                        mscm->response.choice);
 559                 break;
 560         default:
 561                 DEBUGP("ip_ct_h323: H.245 signal %d\n", mscm->choice);
 562                 break;
 563         }
 564
 565         return 0;
 566 }
 567
 568 /****************************************************************************/
 569 static int h245_help(struct sk_buff **pskb, struct ip_conntrack *ct,
 570                      enum ip_conntrack_info ctinfo)
 571 {
 572         static MultimediaSystemControlMessage mscm;
 573         unsigned char *data = NULL;
 574         int datalen;
 575         int dataoff;
 576         int ret;
 577
 578         /* Until there's been traffic both ways, don't look in packets. */
 579         if (ctinfo != IP_CT_ESTABLISHED
 580             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
 581                 return NF_ACCEPT;
 582         }
 583         DEBUGP("ip_ct_h245: skblen = %u\n", (*pskb)->len);
 584
 585         spin_lock_bh(&ip_h323_lock);
 586
 587         /* Process each TPKT */
 588         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
 589                 DEBUGP("ip_ct_h245: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
 590                        NIPQUAD((*pskb)->nh.iph->saddr),
 591                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
 592
 593                 /* Decode H.245 signal */
 594                 ret = DecodeMultimediaSystemControlMessage(data, datalen,
 595                                                            &mscm);
 596                 if (ret < 0) {
 597                         if (net_ratelimit())
 598                                 printk("ip_ct_h245: decoding error: %s\n",
 599                                        ret == H323_ERROR_BOUND ?
 600                                        "out of bound" : "out of range");
 601                         /* We don't drop when decoding error */
 602                         break;
 603                 }
 604
 605                 /* Process H.245 signal */
 606                 if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
 607                         goto drop;
 608         }
 609
 610         spin_unlock_bh(&ip_h323_lock);
 611         return NF_ACCEPT;
 612
 613       drop:
 614         spin_unlock_bh(&ip_h323_lock);
 615         if (net_ratelimit())
 616                 printk("ip_ct_h245: packet dropped\n");
 617         return NF_DROP;
 618 }
 619
 620 /****************************************************************************/
 621 static struct ip_conntrack_helper ip_conntrack_helper_h245 = {
 622         .name = "H.245",
 623         .me = THIS_MODULE,
 624         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 2 /* T.120 */ ,
 625         .timeout = 240,
 626         .tuple = {.dst = {.protonum = IPPROTO_TCP}},
 627         .mask = {.src = {.u = {0xFFFF}},
 628                  .dst = {.protonum = 0xFF}},
 629         .help = h245_help
 630 };
 631
 632 /****************************************************************************/
 633 void ip_conntrack_h245_expect(struct ip_conntrack *new,
 634                               struct ip_conntrack_expect *this)
 635 {
 636         write_lock_bh(&ip_conntrack_lock);
 637         new->helper = &ip_conntrack_helper_h245;
 638         write_unlock_bh(&ip_conntrack_lock);
 639 }
 640
 641 /****************************************************************************/
 642 int get_h225_addr(unsigned char *data, TransportAddress * addr,
 643                   u_int32_t * ip, u_int16_t * port)
 644 {
 645         unsigned char *p;
 646
 647         if (addr->choice != eTransportAddress_ipAddress)
 648                 return 0;
 649
 650         p = data + addr->ipAddress.ip;
 651         *ip = htonl((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]));
 652         *port = (p[4] << 8) | (p[5]);
 653
 654         return 1;
 655 }
 656
 657 /****************************************************************************/
 658 static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
 659                        enum ip_conntrack_info ctinfo,
 660                        unsigned char **data, int dataoff,
 661                        TransportAddress * addr)
 662 {
 663         int dir = CTINFO2DIR(ctinfo);
 664         int ret = 0;
 665         u_int32_t ip;
 666         u_int16_t port;
 667         struct ip_conntrack_expect *exp = NULL;
 668
 669         /* Read h245Address */
 670         if (!get_h225_addr(*data, addr, &ip, &port) ||
 671             ip != ct->tuplehash[dir].tuple.src.ip || port == 0)
 672                 return 0;
 673
 674         /* Create expect for h245 connection */
 675         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
 676                 return -1;
 677         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
 678         exp->tuple.src.u.tcp.port = 0;
 679         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
 680         exp->tuple.dst.u.tcp.port = htons(port);
 681         exp->tuple.dst.protonum = IPPROTO_TCP;
 682         exp->mask.src.ip = 0xFFFFFFFF;
 683         exp->mask.src.u.tcp.port = 0;
 684         exp->mask.dst.ip = 0xFFFFFFFF;
 685         exp->mask.dst.u.tcp.port = 0xFFFF;
 686         exp->mask.dst.protonum = 0xFF;
 687         exp->flags = 0;
 688
 689         if (ct->tuplehash[dir].tuple.src.ip !=
 690             ct->tuplehash[!dir].tuple.dst.ip && nat_h245_hook) {
 691                 /* NAT needed */
 692                 ret = nat_h245_hook(pskb, ct, ctinfo, data, dataoff, addr,
 693                                     port, exp);
 694         } else {                /* Conntrack only */
 695                 exp->expectfn = ip_conntrack_h245_expect;
 696
 697                 if (ip_conntrack_expect_related(exp) == 0) {
 698                         DEBUGP("ip_ct_q931: expect H.245 "
 699                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 700                                NIPQUAD(exp->tuple.src.ip),
 701                                ntohs(exp->tuple.src.u.tcp.port),
 702                                NIPQUAD(exp->tuple.dst.ip),
 703                                ntohs(exp->tuple.dst.u.tcp.port));
 704                 } else
 705                         ret = -1;
 706         }
 707
 708         ip_conntrack_expect_put(exp);
 709
 710         return ret;
 711 }
 712
 713 /****************************************************************************/
 714 static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
 715                          enum ip_conntrack_info ctinfo,
 716                          unsigned char **data, int dataoff,
 717                          Setup_UUIE * setup)
 718 {
 719         int dir = CTINFO2DIR(ctinfo);
 720         int ret;
 721         int i;
 722         u_int32_t ip;
 723         u_int16_t port;
 724
 725         DEBUGP("ip_ct_q931: Setup\n");
 726
 727         if (setup->options & eSetup_UUIE_h245Address) {
 728                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 729                                   &setup->h245Address);
 730                 if (ret < 0)
 731                         return -1;
 732         }
 733
 734         if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
 735             (set_h225_addr_hook) &&
 736             get_h225_addr(*data, &setup->destCallSignalAddress, &ip, &port) &&
 737             ip != ct->tuplehash[!dir].tuple.src.ip) {
 738                 DEBUGP("ip_ct_q931: set destCallSignalAddress "
 739                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 740                        NIPQUAD(ip), port,
 741                        NIPQUAD(ct->tuplehash[!dir].tuple.src.ip),
 742                        ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
 743                 ret = set_h225_addr_hook(pskb, data, dataoff,
 744                                          &setup->destCallSignalAddress,
 745                                          ct->tuplehash[!dir].tuple.src.ip,
 746                                          ntohs(ct->tuplehash[!dir].tuple.src.
 747                                                u.tcp.port));
 748                 if (ret < 0)
 749                         return -1;
 750         }
 751
 752         if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
 753             (set_h225_addr_hook) &&
 754             get_h225_addr(*data, &setup->sourceCallSignalAddress, &ip, &port)
 755             && ip != ct->tuplehash[!dir].tuple.dst.ip) {
 756                 DEBUGP("ip_ct_q931: set sourceCallSignalAddress "
 757                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
 758                        NIPQUAD(ip), port,
 759                        NIPQUAD(ct->tuplehash[!dir].tuple.dst.ip),
 760                        ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
 761                 ret = set_h225_addr_hook(pskb, data, dataoff,
 762                                          &setup->sourceCallSignalAddress,
 763                                          ct->tuplehash[!dir].tuple.dst.ip,
 764                                          ntohs(ct->tuplehash[!dir].tuple.dst.
 765                                                u.tcp.port));
 766                 if (ret < 0)
 767                         return -1;
 768         }
 769
 770         if (setup->options & eSetup_UUIE_fastStart) {
 771                 for (i = 0; i < setup->fastStart.count; i++) {
 772                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 773                                           &setup->fastStart.item[i]);
 774                         if (ret < 0)
 775                                 return -1;
 776                 }
 777         }
 778
 779         return 0;
 780 }
 781
 782 /****************************************************************************/
 783 static int process_callproceeding(struct sk_buff **pskb,
 784                                   struct ip_conntrack *ct,
 785                                   enum ip_conntrack_info ctinfo,
 786                                   unsigned char **data, int dataoff,
 787                                   CallProceeding_UUIE * callproc)
 788 {
 789         int ret;
 790         int i;
 791
 792         DEBUGP("ip_ct_q931: CallProceeding\n");
 793
 794         if (callproc->options & eCallProceeding_UUIE_h245Address) {
 795                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 796                                   &callproc->h245Address);
 797                 if (ret < 0)
 798                         return -1;
 799         }
 800
 801         if (callproc->options & eCallProceeding_UUIE_fastStart) {
 802                 for (i = 0; i < callproc->fastStart.count; i++) {
 803                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 804                                           &callproc->fastStart.item[i]);
 805                         if (ret < 0)
 806                                 return -1;
 807                 }
 808         }
 809
 810         return 0;
 811 }
 812
 813 /****************************************************************************/
 814 static int process_connect(struct sk_buff **pskb, struct ip_conntrack *ct,
 815                            enum ip_conntrack_info ctinfo,
 816                            unsigned char **data, int dataoff,
 817                            Connect_UUIE * connect)
 818 {
 819         int ret;
 820         int i;
 821
 822         DEBUGP("ip_ct_q931: Connect\n");
 823
 824         if (connect->options & eConnect_UUIE_h245Address) {
 825                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 826                                   &connect->h245Address);
 827                 if (ret < 0)
 828                         return -1;
 829         }
 830
 831         if (connect->options & eConnect_UUIE_fastStart) {
 832                 for (i = 0; i < connect->fastStart.count; i++) {
 833                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 834                                           &connect->fastStart.item[i]);
 835                         if (ret < 0)
 836                                 return -1;
 837                 }
 838         }
 839
 840         return 0;
 841 }
 842
 843 /****************************************************************************/
 844 static int process_alerting(struct sk_buff **pskb, struct ip_conntrack *ct,
 845                             enum ip_conntrack_info ctinfo,
 846                             unsigned char **data, int dataoff,
 847                             Alerting_UUIE * alert)
 848 {
 849         int ret;
 850         int i;
 851
 852         DEBUGP("ip_ct_q931: Alerting\n");
 853
 854         if (alert->options & eAlerting_UUIE_h245Address) {
 855                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 856                                   &alert->h245Address);
 857                 if (ret < 0)
 858                         return -1;
 859         }
 860
 861         if (alert->options & eAlerting_UUIE_fastStart) {
 862                 for (i = 0; i < alert->fastStart.count; i++) {
 863                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 864                                           &alert->fastStart.item[i]);
 865                         if (ret < 0)
 866                                 return -1;
 867                 }
 868         }
 869
 870         return 0;
 871 }
 872
 873 /****************************************************************************/
 874 static int process_information(struct sk_buff **pskb,
 875                                struct ip_conntrack *ct,
 876                                enum ip_conntrack_info ctinfo,
 877                                unsigned char **data, int dataoff,
 878                                Information_UUIE * info)
 879 {
 880         int ret;
 881         int i;
 882
 883         DEBUGP("ip_ct_q931: Information\n");
 884
 885         if (info->options & eInformation_UUIE_fastStart) {
 886                 for (i = 0; i < info->fastStart.count; i++) {
 887                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 888                                           &info->fastStart.item[i]);
 889                         if (ret < 0)
 890                                 return -1;
 891                 }
 892         }
 893
 894         return 0;
 895 }
 896
 897 /****************************************************************************/
 898 static int process_facility(struct sk_buff **pskb, struct ip_conntrack *ct,
 899                             enum ip_conntrack_info ctinfo,
 900                             unsigned char **data, int dataoff,
 901                             Facility_UUIE * facility)
 902 {
 903         int ret;
 904         int i;
 905
 906         DEBUGP("ip_ct_q931: Facility\n");
 907
 908         if (facility->options & eFacility_UUIE_h245Address) {
 909                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 910                                   &facility->h245Address);
 911                 if (ret < 0)
 912                         return -1;
 913         }
 914
 915         if (facility->options & eFacility_UUIE_fastStart) {
 916                 for (i = 0; i < facility->fastStart.count; i++) {
 917                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 918                                           &facility->fastStart.item[i]);
 919                         if (ret < 0)
 920                                 return -1;
 921                 }
 922         }
 923
 924         return 0;
 925 }
 926
 927 /****************************************************************************/
 928 static int process_progress(struct sk_buff **pskb, struct ip_conntrack *ct,
 929                             enum ip_conntrack_info ctinfo,
 930                             unsigned char **data, int dataoff,
 931                             Progress_UUIE * progress)
 932 {
 933         int ret;
 934         int i;
 935
 936         DEBUGP("ip_ct_q931: Progress\n");
 937
 938         if (progress->options & eProgress_UUIE_h245Address) {
 939                 ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
 940                                   &progress->h245Address);
 941                 if (ret < 0)
 942                         return -1;
 943         }
 944
 945         if (progress->options & eProgress_UUIE_fastStart) {
 946                 for (i = 0; i < progress->fastStart.count; i++) {
 947                         ret = process_olc(pskb, ct, ctinfo, data, dataoff,
 948                                           &progress->fastStart.item[i]);
 949                         if (ret < 0)
 950                                 return -1;
 951                 }
 952         }
 953
 954         return 0;
 955 }
 956
 957 /****************************************************************************/
 958 static int process_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
 959                         enum ip_conntrack_info ctinfo,
 960                         unsigned char **data, int dataoff, Q931 * q931)
 961 {
 962         H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
 963         int i;
 964         int ret = 0;
 965
 966         switch (pdu->h323_message_body.choice) {
 967         case eH323_UU_PDU_h323_message_body_setup:
 968                 ret = process_setup(pskb, ct, ctinfo, data, dataoff,
 969                                     &pdu->h323_message_body.setup);
 970                 break;
 971         case eH323_UU_PDU_h323_message_body_callProceeding:
 972                 ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
 973                                              &pdu->h323_message_body.
 974                                              callProceeding);
 975                 break;
 976         case eH323_UU_PDU_h323_message_body_connect:
 977                 ret = process_connect(pskb, ct, ctinfo, data, dataoff,
 978                                       &pdu->h323_message_body.connect);
 979                 break;
 980         case eH323_UU_PDU_h323_message_body_alerting:
 981                 ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
 982                                        &pdu->h323_message_body.alerting);
 983                 break;
 984         case eH323_UU_PDU_h323_message_body_information:
 985                 ret = process_information(pskb, ct, ctinfo, data, dataoff,
 986                                           &pdu->h323_message_body.
 987                                           information);
 988                 break;
 989         case eH323_UU_PDU_h323_message_body_facility:
 990                 ret = process_facility(pskb, ct, ctinfo, data, dataoff,
 991                                        &pdu->h323_message_body.facility);
 992                 break;
 993         case eH323_UU_PDU_h323_message_body_progress:
 994                 ret = process_progress(pskb, ct, ctinfo, data, dataoff,
 995                                        &pdu->h323_message_body.progress);
 996                 break;
 997         default:
 998                 DEBUGP("ip_ct_q931: Q.931 signal %d\n",
 999                        pdu->h323_message_body.choice);
1000                 break;
1001         }
1002
1003         if (ret < 0)
1004                 return -1;
1005
1006         if (pdu->options & eH323_UU_PDU_h245Control) {
1007                 for (i = 0; i < pdu->h245Control.count; i++) {
1008                         ret = process_h245(pskb, ct, ctinfo, data, dataoff,
1009                                            &pdu->h245Control.item[i]);
1010                         if (ret < 0)
1011                                 return -1;
1012                 }
1013         }
1014
1015         return 0;
1016 }
1017
1018 /****************************************************************************/
1019 static int q931_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1020                      enum ip_conntrack_info ctinfo)
1021 {
1022         static Q931 q931;
1023         unsigned char *data = NULL;
1024         int datalen;
1025         int dataoff;
1026         int ret;
1027
1028         /* Until there's been traffic both ways, don't look in packets. */
1029         if (ctinfo != IP_CT_ESTABLISHED
1030             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
1031                 return NF_ACCEPT;
1032         }
1033         DEBUGP("ip_ct_q931: skblen = %u\n", (*pskb)->len);
1034
1035         spin_lock_bh(&ip_h323_lock);
1036
1037         /* Process each TPKT */
1038         while (get_tpkt_data(pskb, ct, ctinfo, &data, &datalen, &dataoff)) {
1039                 DEBUGP("ip_ct_q931: TPKT %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1040                        NIPQUAD((*pskb)->nh.iph->saddr),
1041                        NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1042
1043                 /* Decode Q.931 signal */
1044                 ret = DecodeQ931(data, datalen, &q931);
1045                 if (ret < 0) {
1046                         if (net_ratelimit())
1047                                 printk("ip_ct_q931: decoding error: %s\n",
1048                                        ret == H323_ERROR_BOUND ?
1049                                        "out of bound" : "out of range");
1050                         /* We don't drop when decoding error */
1051                         break;
1052                 }
1053
1054                 /* Process Q.931 signal */
1055                 if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
1056                         goto drop;
1057         }
1058
1059         spin_unlock_bh(&ip_h323_lock);
1060         return NF_ACCEPT;
1061
1062       drop:
1063         spin_unlock_bh(&ip_h323_lock);
1064         if (net_ratelimit())
1065                 printk("ip_ct_q931: packet dropped\n");
1066         return NF_DROP;
1067 }
1068
1069 /****************************************************************************/
1070 static struct ip_conntrack_helper ip_conntrack_helper_q931 = {
1071         .name = "Q.931",
1072         .me = THIS_MODULE,
1073         .max_expected = H323_RTP_CHANNEL_MAX * 4 + 4 /* T.120 and H.245 */ ,
1074         .timeout = 240,
1075         .tuple = {.src = {.u = {__constant_htons(Q931_PORT)}},
1076                   .dst = {.protonum = IPPROTO_TCP}},
1077         .mask = {.src = {.u = {0xFFFF}},
1078                  .dst = {.protonum = 0xFF}},
1079         .help = q931_help
1080 };
1081
1082 /****************************************************************************/
1083 void ip_conntrack_q931_expect(struct ip_conntrack *new,
1084                               struct ip_conntrack_expect *this)
1085 {
1086         write_lock_bh(&ip_conntrack_lock);
1087         new->helper = &ip_conntrack_helper_q931;
1088         write_unlock_bh(&ip_conntrack_lock);
1089 }
1090
1091 /****************************************************************************/
1092 static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
1093 {
1094         struct udphdr _uh, *uh;
1095         int dataoff;
1096
1097         uh = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, sizeof(_uh),
1098                                 &_uh);
1099         if (uh == NULL)
1100                 return NULL;
1101         dataoff = (*pskb)->nh.iph->ihl * 4 + sizeof(_uh);
1102         if (dataoff >= (*pskb)->len)
1103                 return NULL;
1104         *datalen = (*pskb)->len - dataoff;
1105         return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
1106 }
1107
1108 /****************************************************************************/
1109 static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
1110                                                u_int32_t ip, u_int16_t port)
1111 {
1112         struct ip_conntrack_expect *exp;
1113         struct ip_conntrack_tuple tuple;
1114
1115         tuple.src.ip = 0;
1116         tuple.src.u.tcp.port = 0;
1117         tuple.dst.ip = ip;
1118         tuple.dst.u.tcp.port = htons(port);
1119         tuple.dst.protonum = IPPROTO_TCP;
1120
1121         exp = __ip_conntrack_expect_find(&tuple);
1122         if (exp->master == ct)
1123                 return exp;
1124         return NULL;
1125 }
1126
1127 /****************************************************************************/
1128 static int set_expect_timeout(struct ip_conntrack_expect *exp,
1129                               unsigned timeout)
1130 {
1131         if (!exp || !del_timer(&exp->timeout))
1132                 return 0;
1133
1134         exp->timeout.expires = jiffies + timeout * HZ;
1135         add_timer(&exp->timeout);
1136
1137         return 1;
1138 }
1139
1140 /****************************************************************************/
1141 static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
1142                        enum ip_conntrack_info ctinfo,
1143                        unsigned char **data,
1144                        TransportAddress * addr, int count)
1145 {
1146         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1147         int dir = CTINFO2DIR(ctinfo);
1148         int ret = 0;
1149         int i;
1150         u_int32_t ip;
1151         u_int16_t port;
1152         struct ip_conntrack_expect *exp;
1153
1154         /* Look for the first related address */
1155         for (i = 0; i < count; i++) {
1156                 if (get_h225_addr(*data, &addr[i], &ip, &port) &&
1157                     ip == ct->tuplehash[dir].tuple.src.ip && port != 0)
1158                         break;
1159         }
1160
1161         if (i >= count)         /* Not found */
1162                 return 0;
1163
1164         /* Create expect for Q.931 */
1165         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1166                 return -1;
1167         exp->tuple.src.ip = gkrouted_only ?     /* only accept calls from GK? */
1168             ct->tuplehash[!dir].tuple.src.ip : 0;
1169         exp->tuple.src.u.tcp.port = 0;
1170         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
1171         exp->tuple.dst.u.tcp.port = htons(port);
1172         exp->tuple.dst.protonum = IPPROTO_TCP;
1173         exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
1174         exp->mask.src.u.tcp.port = 0;
1175         exp->mask.dst.ip = 0xFFFFFFFF;
1176         exp->mask.dst.u.tcp.port = 0xFFFF;
1177         exp->mask.dst.protonum = 0xFF;
1178         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
1179
1180         if (nat_q931_hook) {    /* Need NAT */
1181                 ret = nat_q931_hook(pskb, ct, ctinfo, data, addr, i,
1182                                     port, exp);
1183         } else {                /* Conntrack only */
1184                 exp->expectfn = ip_conntrack_q931_expect;
1185
1186                 if (ip_conntrack_expect_related(exp) == 0) {
1187                         DEBUGP("ip_ct_ras: expect Q.931 "
1188                                "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1189                                NIPQUAD(exp->tuple.src.ip),
1190                                ntohs(exp->tuple.src.u.tcp.port),
1191                                NIPQUAD(exp->tuple.dst.ip),
1192                                ntohs(exp->tuple.dst.u.tcp.port));
1193
1194                         /* Save port for looking up expect in processing RCF */
1195                         info->sig_port[dir] = port;
1196                 } else
1197                         ret = -1;
1198         }
1199
1200         ip_conntrack_expect_put(exp);
1201
1202         return ret;
1203 }
1204
1205 /****************************************************************************/
1206 static int process_grq(struct sk_buff **pskb, struct ip_conntrack *ct,
1207                        enum ip_conntrack_info ctinfo,
1208                        unsigned char **data, GatekeeperRequest * grq)
1209 {
1210         DEBUGP("ip_ct_ras: GRQ\n");
1211
1212         if (set_ras_addr_hook)  /* NATed */
1213                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1214                                          &grq->rasAddress, 1);
1215         return 0;
1216 }
1217
1218 /* Declare before using */
1219 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1220                                     struct ip_conntrack_expect *this);
1221
1222 /****************************************************************************/
1223 static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1224                        enum ip_conntrack_info ctinfo,
1225                        unsigned char **data, GatekeeperConfirm * gcf)
1226 {
1227         int dir = CTINFO2DIR(ctinfo);
1228         int ret = 0;
1229         u_int32_t ip;
1230         u_int16_t port;
1231         struct ip_conntrack_expect *exp;
1232
1233         DEBUGP("ip_ct_ras: GCF\n");
1234
1235         if (!get_h225_addr(*data, &gcf->rasAddress, &ip, &port))
1236                 return 0;
1237
1238         /* Registration port is the same as discovery port */
1239         if (ip == ct->tuplehash[dir].tuple.src.ip &&
1240             port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
1241                 return 0;
1242
1243         /* Avoid RAS expectation loops. A GCF is never expected. */
1244         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1245                 return 0;
1246
1247         /* Need new expect */
1248         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1249                 return -1;
1250         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1251         exp->tuple.src.u.tcp.port = 0;
1252         exp->tuple.dst.ip = ip;
1253         exp->tuple.dst.u.tcp.port = htons(port);
1254         exp->tuple.dst.protonum = IPPROTO_UDP;
1255         exp->mask.src.ip = 0xFFFFFFFF;
1256         exp->mask.src.u.tcp.port = 0;
1257         exp->mask.dst.ip = 0xFFFFFFFF;
1258         exp->mask.dst.u.tcp.port = 0xFFFF;
1259         exp->mask.dst.protonum = 0xFF;
1260         exp->flags = 0;
1261         exp->expectfn = ip_conntrack_ras_expect;
1262         if (ip_conntrack_expect_related(exp) == 0) {
1263                 DEBUGP("ip_ct_ras: expect RAS "
1264                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1265                        NIPQUAD(exp->tuple.src.ip),
1266                        ntohs(exp->tuple.src.u.tcp.port),
1267                        NIPQUAD(exp->tuple.dst.ip),
1268                        ntohs(exp->tuple.dst.u.tcp.port));
1269         } else
1270                 ret = -1;
1271
1272         ip_conntrack_expect_put(exp);
1273
1274         return ret;
1275 }
1276
1277 /****************************************************************************/
1278 static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1279                        enum ip_conntrack_info ctinfo,
1280                        unsigned char **data, RegistrationRequest * rrq)
1281 {
1282         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1283         int ret;
1284
1285         DEBUGP("ip_ct_ras: RRQ\n");
1286
1287         ret = expect_q931(pskb, ct, ctinfo, data,
1288                           rrq->callSignalAddress.item,
1289                           rrq->callSignalAddress.count);
1290         if (ret < 0)
1291                 return -1;
1292
1293         if (set_ras_addr_hook) {
1294                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1295                                         rrq->rasAddress.item,
1296                                         rrq->rasAddress.count);
1297                 if (ret < 0)
1298                         return -1;
1299         }
1300
1301         if (rrq->options & eRegistrationRequest_timeToLive) {
1302                 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
1303                 info->timeout = rrq->timeToLive;
1304         } else
1305                 info->timeout = 0;
1306
1307         return 0;
1308 }
1309
1310 /****************************************************************************/
1311 static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1312                        enum ip_conntrack_info ctinfo,
1313                        unsigned char **data, RegistrationConfirm * rcf)
1314 {
1315         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1316         int dir = CTINFO2DIR(ctinfo);
1317         int ret;
1318         struct ip_conntrack_expect *exp;
1319
1320         DEBUGP("ip_ct_ras: RCF\n");
1321
1322         if (set_sig_addr_hook) {
1323                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1324                                         rcf->callSignalAddress.item,
1325                                         rcf->callSignalAddress.count);
1326                 if (ret < 0)
1327                         return -1;
1328         }
1329
1330         if (rcf->options & eRegistrationConfirm_timeToLive) {
1331                 DEBUGP("ip_ct_ras: RCF TTL = %u seconds\n", rcf->timeToLive);
1332                 info->timeout = rcf->timeToLive;
1333         }
1334
1335         if (info->timeout > 0) {
1336                 DEBUGP
1337                     ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
1338                      info->timeout);
1339                 ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
1340
1341                 /* Set expect timeout */
1342                 read_lock_bh(&ip_conntrack_lock);
1343                 exp = find_expect(ct, ct->tuplehash[dir].tuple.dst.ip,
1344                                   info->sig_port[!dir]);
1345                 if (exp) {
1346                         DEBUGP("ip_ct_ras: set Q.931 expect "
1347                                "(%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu) "
1348                                "timeout to %u seconds\n",
1349                                NIPQUAD(exp->tuple.src.ip),
1350                                ntohs(exp->tuple.src.u.tcp.port),
1351                                NIPQUAD(exp->tuple.dst.ip),
1352                                ntohs(exp->tuple.dst.u.tcp.port),
1353                                info->timeout);
1354                         set_expect_timeout(exp, info->timeout);
1355                 }
1356                 read_unlock_bh(&ip_conntrack_lock);
1357         }
1358
1359         return 0;
1360 }
1361
1362 /****************************************************************************/
1363 static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
1364                        enum ip_conntrack_info ctinfo,
1365                        unsigned char **data, UnregistrationRequest * urq)
1366 {
1367         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1368         int dir = CTINFO2DIR(ctinfo);
1369         int ret;
1370
1371         DEBUGP("ip_ct_ras: URQ\n");
1372
1373         if (set_sig_addr_hook) {
1374                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1375                                         urq->callSignalAddress.item,
1376                                         urq->callSignalAddress.count);
1377                 if (ret < 0)
1378                         return -1;
1379         }
1380
1381         /* Clear old expect */
1382         ip_ct_remove_expectations(ct);
1383         info->sig_port[dir] = 0;
1384         info->sig_port[!dir] = 0;
1385
1386         /* Give it 30 seconds for UCF or URJ */
1387         ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
1388
1389         return 0;
1390 }
1391
1392 /****************************************************************************/
1393 static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
1394                        enum ip_conntrack_info ctinfo,
1395                        unsigned char **data, AdmissionRequest * arq)
1396 {
1397         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
1398         int dir = CTINFO2DIR(ctinfo);
1399         u_int32_t ip;
1400         u_int16_t port;
1401
1402         DEBUGP("ip_ct_ras: ARQ\n");
1403
1404         if ((arq->options & eAdmissionRequest_destCallSignalAddress) &&
1405             get_h225_addr(*data, &arq->destCallSignalAddress, &ip, &port) &&
1406             ip == ct->tuplehash[dir].tuple.src.ip &&
1407             port == info->sig_port[dir] && set_h225_addr_hook) {
1408                 /* Answering ARQ */
1409                 return set_h225_addr_hook(pskb, data, 0,
1410                                           &arq->destCallSignalAddress,
1411                                           ct->tuplehash[!dir].tuple.dst.ip,
1412                                           info->sig_port[!dir]);
1413         }
1414
1415         if ((arq->options & eAdmissionRequest_srcCallSignalAddress) &&
1416             get_h225_addr(*data, &arq->srcCallSignalAddress, &ip, &port) &&
1417             ip == ct->tuplehash[dir].tuple.src.ip && set_h225_addr_hook) {
1418                 /* Calling ARQ */
1419                 return set_h225_addr_hook(pskb, data, 0,
1420                                           &arq->srcCallSignalAddress,
1421                                           ct->tuplehash[!dir].tuple.dst.ip,
1422                                           port);
1423         }
1424
1425         return 0;
1426 }
1427
1428 /****************************************************************************/
1429 static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
1430                        enum ip_conntrack_info ctinfo,
1431                        unsigned char **data, AdmissionConfirm * acf)
1432 {
1433         int dir = CTINFO2DIR(ctinfo);
1434         int ret = 0;
1435         u_int32_t ip;
1436         u_int16_t port;
1437         struct ip_conntrack_expect *exp;
1438
1439         DEBUGP("ip_ct_ras: ACF\n");
1440
1441         if (!get_h225_addr(*data, &acf->destCallSignalAddress, &ip, &port))
1442                 return 0;
1443
1444         if (ip == ct->tuplehash[dir].tuple.dst.ip) {    /* Answering ACF */
1445                 if (set_sig_addr_hook)
1446                         return set_sig_addr_hook(pskb, ct, ctinfo, data,
1447                                                  &acf->destCallSignalAddress,
1448                                                  1);
1449                 return 0;
1450         }
1451
1452         /* Need new expect */
1453         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1454                 return -1;
1455         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1456         exp->tuple.src.u.tcp.port = 0;
1457         exp->tuple.dst.ip = ip;
1458         exp->tuple.dst.u.tcp.port = htons(port);
1459         exp->tuple.dst.protonum = IPPROTO_TCP;
1460         exp->mask.src.ip = 0xFFFFFFFF;
1461         exp->mask.src.u.tcp.port = 0;
1462         exp->mask.dst.ip = 0xFFFFFFFF;
1463         exp->mask.dst.u.tcp.port = 0xFFFF;
1464         exp->mask.dst.protonum = 0xFF;
1465         exp->flags = IP_CT_EXPECT_PERMANENT;
1466         exp->expectfn = ip_conntrack_q931_expect;
1467
1468         if (ip_conntrack_expect_related(exp) == 0) {
1469                 DEBUGP("ip_ct_ras: expect Q.931 "
1470                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1471                        NIPQUAD(exp->tuple.src.ip),
1472                        ntohs(exp->tuple.src.u.tcp.port),
1473                        NIPQUAD(exp->tuple.dst.ip),
1474                        ntohs(exp->tuple.dst.u.tcp.port));
1475         } else
1476                 ret = -1;
1477
1478         ip_conntrack_expect_put(exp);
1479
1480         return ret;
1481 }
1482
1483 /****************************************************************************/
1484 static int process_lrq(struct sk_buff **pskb, struct ip_conntrack *ct,
1485                        enum ip_conntrack_info ctinfo,
1486                        unsigned char **data, LocationRequest * lrq)
1487 {
1488         DEBUGP("ip_ct_ras: LRQ\n");
1489
1490         if (set_ras_addr_hook)
1491                 return set_ras_addr_hook(pskb, ct, ctinfo, data,
1492                                          &lrq->replyAddress, 1);
1493         return 0;
1494 }
1495
1496 /****************************************************************************/
1497 static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
1498                        enum ip_conntrack_info ctinfo,
1499                        unsigned char **data, LocationConfirm * lcf)
1500 {
1501         int dir = CTINFO2DIR(ctinfo);
1502         int ret = 0;
1503         u_int32_t ip;
1504         u_int16_t port;
1505         struct ip_conntrack_expect *exp = NULL;
1506
1507         DEBUGP("ip_ct_ras: LCF\n");
1508
1509         if (!get_h225_addr(*data, &lcf->callSignalAddress, &ip, &port))
1510                 return 0;
1511
1512         /* Need new expect for call signal */
1513         if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
1514                 return -1;
1515         exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
1516         exp->tuple.src.u.tcp.port = 0;
1517         exp->tuple.dst.ip = ip;
1518         exp->tuple.dst.u.tcp.port = htons(port);
1519         exp->tuple.dst.protonum = IPPROTO_TCP;
1520         exp->mask.src.ip = 0xFFFFFFFF;
1521         exp->mask.src.u.tcp.port = 0;
1522         exp->mask.dst.ip = 0xFFFFFFFF;
1523         exp->mask.dst.u.tcp.port = 0xFFFF;
1524         exp->mask.dst.protonum = 0xFF;
1525         exp->flags = IP_CT_EXPECT_PERMANENT;
1526         exp->expectfn = ip_conntrack_q931_expect;
1527
1528         if (ip_conntrack_expect_related(exp) == 0) {
1529                 DEBUGP("ip_ct_ras: expect Q.931 "
1530                        "%u.%u.%u.%u:%hu->%u.%u.%u.%u:%hu\n",
1531                        NIPQUAD(exp->tuple.src.ip),
1532                        ntohs(exp->tuple.src.u.tcp.port),
1533                        NIPQUAD(exp->tuple.dst.ip),
1534                        ntohs(exp->tuple.dst.u.tcp.port));
1535         } else
1536                 ret = -1;
1537
1538         ip_conntrack_expect_put(exp);
1539
1540         /* Ignore rasAddress */
1541
1542         return ret;
1543 }
1544
1545 /****************************************************************************/
1546 static int process_irr(struct sk_buff **pskb, struct ip_conntrack *ct,
1547                        enum ip_conntrack_info ctinfo,
1548                        unsigned char **data, InfoRequestResponse * irr)
1549 {
1550         int ret;
1551
1552         DEBUGP("ip_ct_ras: IRR\n");
1553
1554         if (set_ras_addr_hook) {
1555                 ret = set_ras_addr_hook(pskb, ct, ctinfo, data,
1556                                         &irr->rasAddress, 1);
1557                 if (ret < 0)
1558                         return -1;
1559         }
1560
1561         if (set_sig_addr_hook) {
1562                 ret = set_sig_addr_hook(pskb, ct, ctinfo, data,
1563                                         irr->callSignalAddress.item,
1564                                         irr->callSignalAddress.count);
1565                 if (ret < 0)
1566                         return -1;
1567         }
1568
1569         return 0;
1570 }
1571
1572 /****************************************************************************/
1573 static int process_ras(struct sk_buff **pskb, struct ip_conntrack *ct,
1574                        enum ip_conntrack_info ctinfo,
1575                        unsigned char **data, RasMessage * ras)
1576 {
1577         switch (ras->choice) {
1578         case eRasMessage_gatekeeperRequest:
1579                 return process_grq(pskb, ct, ctinfo, data,
1580                                    &ras->gatekeeperRequest);
1581         case eRasMessage_gatekeeperConfirm:
1582                 return process_gcf(pskb, ct, ctinfo, data,
1583                                    &ras->gatekeeperConfirm);
1584         case eRasMessage_registrationRequest:
1585                 return process_rrq(pskb, ct, ctinfo, data,
1586                                    &ras->registrationRequest);
1587         case eRasMessage_registrationConfirm:
1588                 return process_rcf(pskb, ct, ctinfo, data,
1589                                    &ras->registrationConfirm);
1590         case eRasMessage_unregistrationRequest:
1591                 return process_urq(pskb, ct, ctinfo, data,
1592                                    &ras->unregistrationRequest);
1593         case eRasMessage_admissionRequest:
1594                 return process_arq(pskb, ct, ctinfo, data,
1595                                    &ras->admissionRequest);
1596         case eRasMessage_admissionConfirm:
1597                 return process_acf(pskb, ct, ctinfo, data,
1598                                    &ras->admissionConfirm);
1599         case eRasMessage_locationRequest:
1600                 return process_lrq(pskb, ct, ctinfo, data,
1601                                    &ras->locationRequest);
1602         case eRasMessage_locationConfirm:
1603                 return process_lcf(pskb, ct, ctinfo, data,
1604                                    &ras->locationConfirm);
1605         case eRasMessage_infoRequestResponse:
1606                 return process_irr(pskb, ct, ctinfo, data,
1607                                    &ras->infoRequestResponse);
1608         default:
1609                 DEBUGP("ip_ct_ras: RAS message %d\n", ras->choice);
1610                 break;
1611         }
1612
1613         return 0;
1614 }
1615
1616 /****************************************************************************/
1617 static int ras_help(struct sk_buff **pskb, struct ip_conntrack *ct,
1618                     enum ip_conntrack_info ctinfo)
1619 {
1620         static RasMessage ras;
1621         unsigned char *data;
1622         int datalen = 0;
1623         int ret;
1624
1625         DEBUGP("ip_ct_ras: skblen = %u\n", (*pskb)->len);
1626
1627         spin_lock_bh(&ip_h323_lock);
1628
1629         /* Get UDP data */
1630         data = get_udp_data(pskb, &datalen);
1631         if (data == NULL)
1632                 goto accept;
1633         DEBUGP("ip_ct_ras: RAS message %u.%u.%u.%u->%u.%u.%u.%u, len=%d\n",
1634                NIPQUAD((*pskb)->nh.iph->saddr),
1635                NIPQUAD((*pskb)->nh.iph->daddr), datalen);
1636
1637         /* Decode RAS message */
1638         ret = DecodeRasMessage(data, datalen, &ras);
1639         if (ret < 0) {
1640                 if (net_ratelimit())
1641                         printk("ip_ct_ras: decoding error: %s\n",
1642                                ret == H323_ERROR_BOUND ?
1643                                "out of bound" : "out of range");
1644                 goto accept;
1645         }
1646
1647         /* Process RAS message */
1648         if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
1649                 goto drop;
1650
1651       accept:
1652         spin_unlock_bh(&ip_h323_lock);
1653         return NF_ACCEPT;
1654
1655       drop:
1656         spin_unlock_bh(&ip_h323_lock);
1657         if (net_ratelimit())
1658                 printk("ip_ct_ras: packet dropped\n");
1659         return NF_DROP;
1660 }
1661
1662 /****************************************************************************/
1663 static struct ip_conntrack_helper ip_conntrack_helper_ras = {
1664         .name = "RAS",
1665         .me = THIS_MODULE,
1666         .max_expected = 32,
1667         .timeout = 240,
1668         .tuple = {.src = {.u = {__constant_htons(RAS_PORT)}},
1669                   .dst = {.protonum = IPPROTO_UDP}},
1670         .mask = {.src = {.u = {0xFFFE}},
1671                  .dst = {.protonum = 0xFF}},
1672         .help = ras_help,
1673 };
1674
1675 /****************************************************************************/
1676 static void ip_conntrack_ras_expect(struct ip_conntrack *new,
1677                                     struct ip_conntrack_expect *this)
1678 {
1679         write_lock_bh(&ip_conntrack_lock);
1680         new->helper = &ip_conntrack_helper_ras;
1681         write_unlock_bh(&ip_conntrack_lock);
1682 }
1683
1684 /****************************************************************************/
1685 /* Not __exit - called from init() */
1686 static void fini(void)
1687 {
1688         ip_conntrack_helper_unregister(&ip_conntrack_helper_ras);
1689         ip_conntrack_helper_unregister(&ip_conntrack_helper_q931);
1690         kfree(h323_buffer);
1691         DEBUGP("ip_ct_h323: fini\n");
1692 }
1693
1694 /****************************************************************************/
1695 static int __init init(void)
1696 {
1697         int ret;
1698
1699         h323_buffer = kmalloc(65536, GFP_KERNEL);
1700         if (!h323_buffer)
1701                 return -ENOMEM;
1702         if ((ret = ip_conntrack_helper_register(&ip_conntrack_helper_q931)) ||
1703             (ret = ip_conntrack_helper_register(&ip_conntrack_helper_ras))) {
1704                 fini();
1705                 return ret;
1706         }
1707
1708         DEBUGP("ip_ct_h323: init success\n");
1709         return 0;
1710 }
1711
1712 /****************************************************************************/
1713 module_init(init);
1714 module_exit(fini);
1715
1716 EXPORT_SYMBOL(get_h245_addr);
1717 EXPORT_SYMBOL(get_h225_addr);
1718 EXPORT_SYMBOL(ip_conntrack_h245_expect);
1719 EXPORT_SYMBOL(ip_conntrack_q931_expect);
1720 EXPORT_SYMBOL(set_h245_addr_hook);
1721 EXPORT_SYMBOL(set_h225_addr_hook);
1722 EXPORT_SYMBOL(set_sig_addr_hook);
1723 EXPORT_SYMBOL(set_ras_addr_hook);
1724 EXPORT_SYMBOL(nat_rtp_rtcp_hook);
1725 EXPORT_SYMBOL(nat_t120_hook);
1726 EXPORT_SYMBOL(nat_h245_hook);
1727 EXPORT_SYMBOL(nat_q931_hook);
1728
1729 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
1730 MODULE_DESCRIPTION("H.323 connection tracking helper");
1731 MODULE_LICENSE("GPL");