Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
409a1966 | 2 | * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS |
1da177e4 | 3 | * |
1da177e4 LT |
4 | * Authors: Julian Anastasov <ja@ssi.bg>, February 2002 |
5 | * Wensong Zhang <wensong@linuxvirtualserver.org> | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or | |
8 | * modify it under the terms of the GNU General Public License | |
9 | * version 2 as published by the Free Software Foundation; | |
10 | * | |
11 | */ | |
12 | ||
9aada7ac HE |
13 | #define KMSG_COMPONENT "IPVS" |
14 | #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt | |
15 | ||
14c85021 ACM |
16 | #include <linux/in.h> |
17 | #include <linux/ip.h> | |
1da177e4 LT |
18 | #include <linux/module.h> |
19 | #include <linux/kernel.h> | |
20 | #include <linux/netfilter.h> | |
21 | #include <linux/netfilter_ipv4.h> | |
22 | ||
23 | #include <net/ip_vs.h> | |
24 | ||
25 | ||
26 | /* TODO: | |
27 | ||
28 | struct isakmp_hdr { | |
29 | __u8 icookie[8]; | |
30 | __u8 rcookie[8]; | |
31 | __u8 np; | |
32 | __u8 version; | |
33 | __u8 xchgtype; | |
34 | __u8 flags; | |
35 | __u32 msgid; | |
36 | __u32 length; | |
37 | }; | |
38 | ||
39 | */ | |
40 | ||
41 | #define PORT_ISAKMP 500 | |
42 | ||
f11017ec | 43 | static void |
6e67e586 HS |
44 | ah_esp_conn_fill_param_proto(struct net *net, int af, |
45 | const struct ip_vs_iphdr *iph, int inverse, | |
46 | struct ip_vs_conn_param *p) | |
f11017ec SH |
47 | { |
48 | if (likely(!inverse)) | |
6e67e586 | 49 | ip_vs_conn_fill_param(net, af, IPPROTO_UDP, |
f11017ec SH |
50 | &iph->saddr, htons(PORT_ISAKMP), |
51 | &iph->daddr, htons(PORT_ISAKMP), p); | |
52 | else | |
6e67e586 | 53 | ip_vs_conn_fill_param(net, af, IPPROTO_UDP, |
f11017ec SH |
54 | &iph->daddr, htons(PORT_ISAKMP), |
55 | &iph->saddr, htons(PORT_ISAKMP), p); | |
56 | } | |
1da177e4 LT |
57 | |
58 | static struct ip_vs_conn * | |
9330419d | 59 | ah_esp_conn_in_get(int af, const struct sk_buff *skb, |
d4383f04 | 60 | const struct ip_vs_iphdr *iph, |
409a1966 | 61 | int inverse) |
1da177e4 LT |
62 | { |
63 | struct ip_vs_conn *cp; | |
f11017ec | 64 | struct ip_vs_conn_param p; |
6e67e586 | 65 | struct net *net = skb_net(skb); |
1da177e4 | 66 | |
6e67e586 | 67 | ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p); |
f11017ec | 68 | cp = ip_vs_conn_in_get(&p); |
1da177e4 LT |
69 | if (!cp) { |
70 | /* | |
71 | * We are not sure if the packet is from our | |
72 | * service, so our conn_schedule hook should return NF_ACCEPT | |
73 | */ | |
51ef348b JV |
74 | IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet " |
75 | "%s%s %s->%s\n", | |
76 | inverse ? "ICMP+" : "", | |
9330419d | 77 | ip_vs_proto_get(iph->protocol)->name, |
51ef348b JV |
78 | IP_VS_DBG_ADDR(af, &iph->saddr), |
79 | IP_VS_DBG_ADDR(af, &iph->daddr)); | |
1da177e4 LT |
80 | } |
81 | ||
82 | return cp; | |
83 | } | |
84 | ||
85 | ||
86 | static struct ip_vs_conn * | |
51ef348b | 87 | ah_esp_conn_out_get(int af, const struct sk_buff *skb, |
d4383f04 | 88 | const struct ip_vs_iphdr *iph, int inverse) |
1da177e4 LT |
89 | { |
90 | struct ip_vs_conn *cp; | |
f11017ec | 91 | struct ip_vs_conn_param p; |
6e67e586 | 92 | struct net *net = skb_net(skb); |
1da177e4 | 93 | |
6e67e586 | 94 | ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p); |
f11017ec | 95 | cp = ip_vs_conn_out_get(&p); |
1da177e4 | 96 | if (!cp) { |
51ef348b JV |
97 | IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet " |
98 | "%s%s %s->%s\n", | |
99 | inverse ? "ICMP+" : "", | |
9330419d | 100 | ip_vs_proto_get(iph->protocol)->name, |
51ef348b JV |
101 | IP_VS_DBG_ADDR(af, &iph->saddr), |
102 | IP_VS_DBG_ADDR(af, &iph->daddr)); | |
1da177e4 LT |
103 | } |
104 | ||
105 | return cp; | |
106 | } | |
107 | ||
108 | ||
109 | static int | |
9330419d | 110 | ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, |
d4383f04 JDB |
111 | int *verdict, struct ip_vs_conn **cpp, |
112 | struct ip_vs_iphdr *iph) | |
1da177e4 LT |
113 | { |
114 | /* | |
409a1966 | 115 | * AH/ESP is only related traffic. Pass the packet to IP stack. |
1da177e4 LT |
116 | */ |
117 | *verdict = NF_ACCEPT; | |
118 | return 0; | |
119 | } | |
120 | ||
409a1966 | 121 | #ifdef CONFIG_IP_VS_PROTO_AH |
1da177e4 LT |
122 | struct ip_vs_protocol ip_vs_protocol_ah = { |
123 | .name = "AH", | |
124 | .protocol = IPPROTO_AH, | |
2ad17def | 125 | .num_states = 1, |
1da177e4 | 126 | .dont_defrag = 1, |
88fe2d37 HS |
127 | .init = NULL, |
128 | .exit = NULL, | |
409a1966 JV |
129 | .conn_schedule = ah_esp_conn_schedule, |
130 | .conn_in_get = ah_esp_conn_in_get, | |
131 | .conn_out_get = ah_esp_conn_out_get, | |
1da177e4 LT |
132 | .snat_handler = NULL, |
133 | .dnat_handler = NULL, | |
134 | .csum_check = NULL, | |
135 | .state_transition = NULL, | |
136 | .register_app = NULL, | |
137 | .unregister_app = NULL, | |
138 | .app_conn_bind = NULL, | |
0d79641a | 139 | .debug_packet = ip_vs_tcpudp_debug_packet, |
1da177e4 | 140 | .timeout_change = NULL, /* ISAKMP */ |
1da177e4 | 141 | }; |
409a1966 JV |
142 | #endif |
143 | ||
144 | #ifdef CONFIG_IP_VS_PROTO_ESP | |
145 | struct ip_vs_protocol ip_vs_protocol_esp = { | |
146 | .name = "ESP", | |
147 | .protocol = IPPROTO_ESP, | |
148 | .num_states = 1, | |
149 | .dont_defrag = 1, | |
88fe2d37 HS |
150 | .init = NULL, |
151 | .exit = NULL, | |
409a1966 JV |
152 | .conn_schedule = ah_esp_conn_schedule, |
153 | .conn_in_get = ah_esp_conn_in_get, | |
154 | .conn_out_get = ah_esp_conn_out_get, | |
155 | .snat_handler = NULL, | |
156 | .dnat_handler = NULL, | |
157 | .csum_check = NULL, | |
158 | .state_transition = NULL, | |
159 | .register_app = NULL, | |
160 | .unregister_app = NULL, | |
161 | .app_conn_bind = NULL, | |
0d79641a | 162 | .debug_packet = ip_vs_tcpudp_debug_packet, |
409a1966 JV |
163 | .timeout_change = NULL, /* ISAKMP */ |
164 | }; | |
165 | #endif |