[net-next-2.6.git] / net / ipv4 / ipvs / ip_vs_proto_ah.c

/*
 * ip_vs_proto_ah.c:	AH IPSec load balancing support for IPVS
 *
 * Version:     $Id: ip_vs_proto_ah.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
 *
 * Authors:	Julian Anastasov <ja@ssi.bg>, February 2002
 *		Wensong Zhang <wensong@linuxvirtualserver.org>
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		version 2 as published by the Free Software Foundation;
 *
 */

#include <linux/in.h>
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

#include <net/ip_vs.h>


/* TODO:

struct isakmp_hdr {
	__u8		icookie[8];
	__u8		rcookie[8];
	__u8		np;
	__u8		version;
	__u8		xchgtype;
	__u8		flags;
	__u32		msgid;
	__u32		length;
};

*/

#define PORT_ISAKMP	500


static struct ip_vs_conn *
ah_conn_in_get(const struct sk_buff *skb,
	       struct ip_vs_protocol *pp,
	       const struct iphdr *iph,
	       unsigned int proto_off,
	       int inverse)
{
	struct ip_vs_conn *cp;

	if (likely(!inverse)) {
		cp = ip_vs_conn_in_get(IPPROTO_UDP,
				       iph->saddr,
				       htons(PORT_ISAKMP),
				       iph->daddr,
				       htons(PORT_ISAKMP));
	} else {
		cp = ip_vs_conn_in_get(IPPROTO_UDP,
				       iph->daddr,
				       htons(PORT_ISAKMP),
				       iph->saddr,
				       htons(PORT_ISAKMP));
	}

	if (!cp) {
		/*
		 * We are not sure if the packet is from our
		 * service, so our conn_schedule hook should return NF_ACCEPT
		 */
		IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
			  "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
			  inverse ? "ICMP+" : "",
			  pp->name,
			  NIPQUAD(iph->saddr),
			  NIPQUAD(iph->daddr));
	}

	return cp;
}


static struct ip_vs_conn *
ah_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	struct ip_vs_conn *cp;

	if (likely(!inverse)) {
		cp = ip_vs_conn_out_get(IPPROTO_UDP,
					iph->saddr,
					htons(PORT_ISAKMP),
					iph->daddr,
					htons(PORT_ISAKMP));
	} else {
		cp = ip_vs_conn_out_get(IPPROTO_UDP,
					iph->daddr,
					htons(PORT_ISAKMP),
					iph->saddr,
					htons(PORT_ISAKMP));
	}

	if (!cp) {
		IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
			  "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
			  inverse ? "ICMP+" : "",
			  pp->name,
			  NIPQUAD(iph->saddr),
			  NIPQUAD(iph->daddr));
	}

	return cp;
}


static int
ah_conn_schedule(struct sk_buff *skb,
		 struct ip_vs_protocol *pp,
		 int *verdict, struct ip_vs_conn **cpp)
{
	/*
	 * AH is only related traffic. Pass the packet to IP stack.
	 */
	*verdict = NF_ACCEPT;
	return 0;
}


static void
ah_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
		int offset, const char *msg)
{
	char buf[256];
	struct iphdr _iph, *ih;

	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	if (ih == NULL)
		sprintf(buf, "%s TRUNCATED", pp->name);
	else
		sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
			pp->name, NIPQUAD(ih->saddr),
			NIPQUAD(ih->daddr));

	printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
}


static void ah_init(struct ip_vs_protocol *pp)
{
	/* nothing to do now */
}


static void ah_exit(struct ip_vs_protocol *pp)
{
	/* nothing to do now */
}


struct ip_vs_protocol ip_vs_protocol_ah = {
	.name =			"AH",
	.protocol =		IPPROTO_AH,
	.dont_defrag =		1,
	.init =			ah_init,
	.exit =			ah_exit,
	.conn_schedule =	ah_conn_schedule,
	.conn_in_get =		ah_conn_in_get,
	.conn_out_get =		ah_conn_out_get,
	.snat_handler =		NULL,
	.dnat_handler =		NULL,
	.csum_check =		NULL,
	.state_transition =	NULL,
	.register_app =		NULL,
	.unregister_app =	NULL,
	.app_conn_bind =	NULL,
	.debug_packet =		ah_debug_packet,
	.timeout_change =	NULL,		/* ISAKMP */
	.set_state_timeout =	NULL,
};
Commit	Line	Data
1da177e4 LT	1	/*
	2	* ip_vs_proto_ah.c: AH IPSec load balancing support for IPVS
	3	*
	4	* Version: $Id: ip_vs_proto_ah.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
	5	*
	6	* Authors: Julian Anastasov <ja@ssi.bg>, February 2002
	7	* Wensong Zhang <wensong@linuxvirtualserver.org>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* version 2 as published by the Free Software Foundation;
	12	*
	13	*/
	14
14c85021 ACM	15	#include <linux/in.h>
14c85021 ACM	16	#include <linux/ip.h>
1da177e4 LT	17	#include <linux/module.h>
	18	#include <linux/kernel.h>
	19	#include <linux/netfilter.h>
	20	#include <linux/netfilter_ipv4.h>
	21
	22	#include <net/ip_vs.h>
	23
	24
	25	/* TODO:
	26
	27	struct isakmp_hdr {
	28	__u8 icookie[8];
	29	__u8 rcookie[8];
	30	__u8 np;
	31	__u8 version;
	32	__u8 xchgtype;
	33	__u8 flags;
	34	__u32 msgid;
	35	__u32 length;
	36	};
	37
	38	*/
	39
	40	#define PORT_ISAKMP 500
	41
	42
	43	static struct ip_vs_conn *
	44	ah_conn_in_get(const struct sk_buff *skb,
	45	struct ip_vs_protocol *pp,
	46	const struct iphdr *iph,
	47	unsigned int proto_off,
	48	int inverse)
	49	{
	50	struct ip_vs_conn *cp;
	51
	52	if (likely(!inverse)) {
	53	cp = ip_vs_conn_in_get(IPPROTO_UDP,
	54	iph->saddr,
4412ec49	55	htons(PORT_ISAKMP),
1da177e4	56	iph->daddr,
4412ec49	57	htons(PORT_ISAKMP));
1da177e4 LT	58	} else {
	59	cp = ip_vs_conn_in_get(IPPROTO_UDP,
	60	iph->daddr,
4412ec49	61	htons(PORT_ISAKMP),
1da177e4	62	iph->saddr,
4412ec49	63	htons(PORT_ISAKMP));
1da177e4 LT	64	}
	65
	66	if (!cp) {
	67	/*
	68	* We are not sure if the packet is from our
	69	* service, so our conn_schedule hook should return NF_ACCEPT
	70	*/
	71	IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
	72	"%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
	73	inverse ? "ICMP+" : "",
	74	pp->name,
	75	NIPQUAD(iph->saddr),
	76	NIPQUAD(iph->daddr));
	77	}
	78
	79	return cp;
	80	}
	81
	82
	83	static struct ip_vs_conn *
	84	ah_conn_out_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	85	const struct iphdr *iph, unsigned int proto_off, int inverse)
	86	{
	87	struct ip_vs_conn *cp;
	88
	89	if (likely(!inverse)) {
	90	cp = ip_vs_conn_out_get(IPPROTO_UDP,
	91	iph->saddr,
4412ec49	92	htons(PORT_ISAKMP),
1da177e4	93	iph->daddr,
4412ec49	94	htons(PORT_ISAKMP));
1da177e4 LT	95	} else {
	96	cp = ip_vs_conn_out_get(IPPROTO_UDP,
	97	iph->daddr,
4412ec49	98	htons(PORT_ISAKMP),
1da177e4	99	iph->saddr,
4412ec49	100	htons(PORT_ISAKMP));
1da177e4 LT	101	}
	102
	103	if (!cp) {
	104	IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
	105	"%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
	106	inverse ? "ICMP+" : "",
	107	pp->name,
	108	NIPQUAD(iph->saddr),
	109	NIPQUAD(iph->daddr));
	110	}
	111
	112	return cp;
	113	}
	114
	115
	116	static int
	117	ah_conn_schedule(struct sk_buff *skb,
	118	struct ip_vs_protocol *pp,
	119	int verdict, struct ip_vs_conn *cpp)
	120	{
	121	/*
	122	* AH is only related traffic. Pass the packet to IP stack.
	123	*/
	124	*verdict = NF_ACCEPT;
	125	return 0;
	126	}
	127
	128
	129	static void
	130	ah_debug_packet(struct ip_vs_protocol pp, const struct sk_buff skb,
	131	int offset, const char *msg)
	132	{
	133	char buf[256];
	134	struct iphdr _iph, *ih;
	135
	136	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	137	if (ih == NULL)
	138	sprintf(buf, "%s TRUNCATED", pp->name);
	139	else
	140	sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
	141	pp->name, NIPQUAD(ih->saddr),
	142	NIPQUAD(ih->daddr));
	143
	144	printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
	145	}
	146
	147
	148	static void ah_init(struct ip_vs_protocol *pp)
	149	{
	150	/* nothing to do now */
	151	}
	152
	153
	154	static void ah_exit(struct ip_vs_protocol *pp)
	155	{
	156	/* nothing to do now */
	157	}
	158
	159
	160	struct ip_vs_protocol ip_vs_protocol_ah = {
	161	.name = "AH",
	162	.protocol = IPPROTO_AH,
	163	.dont_defrag = 1,
	164	.init = ah_init,
165	.exit = ah_exit,
166	.conn_schedule = ah_conn_schedule,
167	.conn_in_get = ah_conn_in_get,
168	.conn_out_get = ah_conn_out_get,
169	.snat_handler = NULL,
170	.dnat_handler = NULL,
171	.csum_check = NULL,
172	.state_transition = NULL,
173	.register_app = NULL,
174	.unregister_app = NULL,
175	.app_conn_bind = NULL,
176	.debug_packet = ah_debug_packet,
177	.timeout_change = NULL, /* ISAKMP */
178	.set_state_timeout = NULL,
179	};