[net-next-2.6.git] / net / netfilter / ipvs / ip_vs_proto_ah_esp.c

/*
 * ip_vs_proto_ah_esp.c:	AH/ESP IPSec load balancing support for IPVS
 *
 * Authors:	Julian Anastasov <ja@ssi.bg>, February 2002
 *		Wensong Zhang <wensong@linuxvirtualserver.org>
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		version 2 as published by the Free Software Foundation;
 *
 */

#define KMSG_COMPONENT "IPVS"
#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt

#include <linux/in.h>
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

#include <net/ip_vs.h>


/* TODO:

struct isakmp_hdr {
	__u8		icookie[8];
	__u8		rcookie[8];
	__u8		np;
	__u8		version;
	__u8		xchgtype;
	__u8		flags;
	__u32		msgid;
	__u32		length;
};

*/

#define PORT_ISAKMP	500

static void
ah_esp_conn_fill_param_proto(int af, const struct ip_vs_iphdr *iph,
			     int inverse, struct ip_vs_conn_param *p)
{
	if (likely(!inverse))
		ip_vs_conn_fill_param(af, IPPROTO_UDP,
				      &iph->saddr, htons(PORT_ISAKMP),
				      &iph->daddr, htons(PORT_ISAKMP), p);
	else
		ip_vs_conn_fill_param(af, IPPROTO_UDP,
				      &iph->daddr, htons(PORT_ISAKMP),
				      &iph->saddr, htons(PORT_ISAKMP), p);
}

static struct ip_vs_conn *
ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
		   const struct ip_vs_iphdr *iph, unsigned int proto_off,
		   int inverse)
{
	struct ip_vs_conn *cp;
	struct ip_vs_conn_param p;

	ah_esp_conn_fill_param_proto(af, iph, inverse, &p);
	cp = ip_vs_conn_in_get(&p);
	if (!cp) {
		/*
		 * We are not sure if the packet is from our
		 * service, so our conn_schedule hook should return NF_ACCEPT
		 */
		IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
			      "%s%s %s->%s\n",
			      inverse ? "ICMP+" : "",
			      pp->name,
			      IP_VS_DBG_ADDR(af, &iph->saddr),
			      IP_VS_DBG_ADDR(af, &iph->daddr));
	}

	return cp;
}


static struct ip_vs_conn *
ah_esp_conn_out_get(int af, const struct sk_buff *skb,
		    struct ip_vs_protocol *pp,
		    const struct ip_vs_iphdr *iph,
		    unsigned int proto_off,
		    int inverse)
{
	struct ip_vs_conn *cp;
	struct ip_vs_conn_param p;

	ah_esp_conn_fill_param_proto(af, iph, inverse, &p);
	cp = ip_vs_conn_out_get(&p);
	if (!cp) {
		IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
			      "%s%s %s->%s\n",
			      inverse ? "ICMP+" : "",
			      pp->name,
			      IP_VS_DBG_ADDR(af, &iph->saddr),
			      IP_VS_DBG_ADDR(af, &iph->daddr));
	}

	return cp;
}


static int
ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
		     int *verdict, struct ip_vs_conn **cpp)
{
	/*
	 * AH/ESP is only related traffic. Pass the packet to IP stack.
	 */
	*verdict = NF_ACCEPT;
	return 0;
}


static void
ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
		       int offset, const char *msg)
{
	char buf[256];
	struct iphdr _iph, *ih;

	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	if (ih == NULL)
		sprintf(buf, "TRUNCATED");
	else
		sprintf(buf, "%pI4->%pI4", &ih->saddr, &ih->daddr);

	pr_debug("%s: %s %s\n", msg, pp->name, buf);
}

#ifdef CONFIG_IP_VS_IPV6
static void
ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
		       int offset, const char *msg)
{
	char buf[256];
	struct ipv6hdr _iph, *ih;

	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	if (ih == NULL)
		sprintf(buf, "TRUNCATED");
	else
		sprintf(buf, "%pI6->%pI6", &ih->saddr, &ih->daddr);

	pr_debug("%s: %s %s\n", msg, pp->name, buf);
}
#endif

static void
ah_esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
		    int offset, const char *msg)
{
#ifdef CONFIG_IP_VS_IPV6
	if (skb->protocol == htons(ETH_P_IPV6))
		ah_esp_debug_packet_v6(pp, skb, offset, msg);
	else
#endif
		ah_esp_debug_packet_v4(pp, skb, offset, msg);
}


static void ah_esp_init(struct ip_vs_protocol *pp)
{
	/* nothing to do now */
}


static void ah_esp_exit(struct ip_vs_protocol *pp)
{
	/* nothing to do now */
}


#ifdef CONFIG_IP_VS_PROTO_AH
struct ip_vs_protocol ip_vs_protocol_ah = {
	.name =			"AH",
	.protocol =		IPPROTO_AH,
	.num_states =		1,
	.dont_defrag =		1,
	.init =			ah_esp_init,
	.exit =			ah_esp_exit,
	.conn_schedule =	ah_esp_conn_schedule,
	.conn_in_get =		ah_esp_conn_in_get,
	.conn_out_get =		ah_esp_conn_out_get,
	.snat_handler =		NULL,
	.dnat_handler =		NULL,
	.csum_check =		NULL,
	.state_transition =	NULL,
	.register_app =		NULL,
	.unregister_app =	NULL,
	.app_conn_bind =	NULL,
	.debug_packet =		ah_esp_debug_packet,
	.timeout_change =	NULL,		/* ISAKMP */
	.set_state_timeout =	NULL,
};
#endif

#ifdef CONFIG_IP_VS_PROTO_ESP
struct ip_vs_protocol ip_vs_protocol_esp = {
	.name =			"ESP",
	.protocol =		IPPROTO_ESP,
	.num_states =		1,
	.dont_defrag =		1,
	.init =			ah_esp_init,
	.exit =			ah_esp_exit,
	.conn_schedule =	ah_esp_conn_schedule,
	.conn_in_get =		ah_esp_conn_in_get,
	.conn_out_get =		ah_esp_conn_out_get,
	.snat_handler =		NULL,
	.dnat_handler =		NULL,
	.csum_check =		NULL,
	.state_transition =	NULL,
	.register_app =		NULL,
	.unregister_app =	NULL,
	.app_conn_bind =	NULL,
	.debug_packet =		ah_esp_debug_packet,
	.timeout_change =	NULL,		/* ISAKMP */
};
#endif
Commit	Line	Data
1da177e4	1	/*
409a1966	2	* ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
1da177e4	3	*
1da177e4 LT	4	* Authors: Julian Anastasov <ja@ssi.bg>, February 2002
	5	* Wensong Zhang <wensong@linuxvirtualserver.org>
	6	*
	7	* This program is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU General Public License
	9	* version 2 as published by the Free Software Foundation;
	10	*
	11	*/
	12
9aada7ac HE	13	#define KMSG_COMPONENT "IPVS"
	14	#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
	15
14c85021 ACM	16	#include <linux/in.h>
14c85021 ACM	17	#include <linux/ip.h>
1da177e4 LT	18	#include <linux/module.h>
	19	#include <linux/kernel.h>
	20	#include <linux/netfilter.h>
	21	#include <linux/netfilter_ipv4.h>
	22
	23	#include <net/ip_vs.h>
	24
	25
	26	/* TODO:
	27
	28	struct isakmp_hdr {
	29	__u8 icookie[8];
	30	__u8 rcookie[8];
	31	__u8 np;
	32	__u8 version;
	33	__u8 xchgtype;
	34	__u8 flags;
	35	__u32 msgid;
	36	__u32 length;
	37	};
	38
	39	*/
	40
	41	#define PORT_ISAKMP 500
	42
f11017ec SH	43	static void
	44	ah_esp_conn_fill_param_proto(int af, const struct ip_vs_iphdr *iph,
	45	int inverse, struct ip_vs_conn_param *p)
	46	{
	47	if (likely(!inverse))
	48	ip_vs_conn_fill_param(af, IPPROTO_UDP,
	49	&iph->saddr, htons(PORT_ISAKMP),
	50	&iph->daddr, htons(PORT_ISAKMP), p);
	51	else
	52	ip_vs_conn_fill_param(af, IPPROTO_UDP,
	53	&iph->daddr, htons(PORT_ISAKMP),
	54	&iph->saddr, htons(PORT_ISAKMP), p);
	55	}
1da177e4 LT	56
1da177e4 LT	57	static struct ip_vs_conn *
51ef348b JV	58	ah_esp_conn_in_get(int af, const struct sk_buff skb, struct ip_vs_protocol pp,
51ef348b JV	59	const struct ip_vs_iphdr *iph, unsigned int proto_off,
409a1966	60	int inverse)
1da177e4 LT	61	{
1da177e4 LT	62	struct ip_vs_conn *cp;
f11017ec	63	struct ip_vs_conn_param p;
1da177e4	64
f11017ec SH	65	ah_esp_conn_fill_param_proto(af, iph, inverse, &p);
f11017ec SH	66	cp = ip_vs_conn_in_get(&p);
1da177e4 LT	67	if (!cp) {
	68	/*
	69	* We are not sure if the packet is from our
	70	* service, so our conn_schedule hook should return NF_ACCEPT
	71	*/
51ef348b JV	72	IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
	73	"%s%s %s->%s\n",
	74	inverse ? "ICMP+" : "",
	75	pp->name,
	76	IP_VS_DBG_ADDR(af, &iph->saddr),
	77	IP_VS_DBG_ADDR(af, &iph->daddr));
1da177e4 LT	78	}
	79
	80	return cp;
	81	}
	82
	83
	84	static struct ip_vs_conn *
51ef348b JV	85	ah_esp_conn_out_get(int af, const struct sk_buff *skb,
	86	struct ip_vs_protocol *pp,
	87	const struct ip_vs_iphdr *iph,
	88	unsigned int proto_off,
	89	int inverse)
1da177e4 LT	90	{
1da177e4 LT	91	struct ip_vs_conn *cp;
f11017ec	92	struct ip_vs_conn_param p;
1da177e4	93
f11017ec SH	94	ah_esp_conn_fill_param_proto(af, iph, inverse, &p);
f11017ec SH	95	cp = ip_vs_conn_out_get(&p);
1da177e4	96	if (!cp) {
51ef348b JV	97	IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
	98	"%s%s %s->%s\n",
	99	inverse ? "ICMP+" : "",
	100	pp->name,
	101	IP_VS_DBG_ADDR(af, &iph->saddr),
	102	IP_VS_DBG_ADDR(af, &iph->daddr));
1da177e4 LT	103	}
	104
	105	return cp;
	106	}
	107
	108
	109	static int
51ef348b	110	ah_esp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_protocol pp,
409a1966	111	int verdict, struct ip_vs_conn *cpp)
1da177e4 LT	112	{
1da177e4 LT	113	/*
409a1966	114	* AH/ESP is only related traffic. Pass the packet to IP stack.
1da177e4 LT	115	*/
	116	*verdict = NF_ACCEPT;
	117	return 0;
	118	}
	119
	120
	121	static void
3b047d9d JV	122	ah_esp_debug_packet_v4(struct ip_vs_protocol pp, const struct sk_buff skb,
3b047d9d JV	123	int offset, const char *msg)
1da177e4 LT	124	{
	125	char buf[256];
	126	struct iphdr _iph, *ih;
	127
	128	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	129	if (ih == NULL)
3d91c1a8	130	sprintf(buf, "TRUNCATED");
1da177e4	131	else
3d91c1a8	132	sprintf(buf, "%pI4->%pI4", &ih->saddr, &ih->daddr);
1da177e4	133
3d91c1a8	134	pr_debug("%s: %s %s\n", msg, pp->name, buf);
1da177e4 LT	135	}
1da177e4 LT	136
3b047d9d JV	137	#ifdef CONFIG_IP_VS_IPV6
	138	static void
	139	ah_esp_debug_packet_v6(struct ip_vs_protocol pp, const struct sk_buff skb,
	140	int offset, const char *msg)
	141	{
	142	char buf[256];
	143	struct ipv6hdr _iph, *ih;
	144
	145	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	146	if (ih == NULL)
3d91c1a8	147	sprintf(buf, "TRUNCATED");
3b047d9d	148	else
3d91c1a8	149	sprintf(buf, "%pI6->%pI6", &ih->saddr, &ih->daddr);
3b047d9d	150
3d91c1a8	151	pr_debug("%s: %s %s\n", msg, pp->name, buf);
3b047d9d JV	152	}
	153	#endif
	154
	155	static void
	156	ah_esp_debug_packet(struct ip_vs_protocol pp, const struct sk_buff skb,
	157	int offset, const char *msg)
	158	{
	159	#ifdef CONFIG_IP_VS_IPV6
d286600e	160	if (skb->protocol == htons(ETH_P_IPV6))
3b047d9d JV	161	ah_esp_debug_packet_v6(pp, skb, offset, msg);
	162	else
	163	#endif
	164	ah_esp_debug_packet_v4(pp, skb, offset, msg);
	165	}
	166
1da177e4	167
409a1966	168	static void ah_esp_init(struct ip_vs_protocol *pp)
1da177e4 LT	169	{
	170	/* nothing to do now */
	171	}
	172
	173
409a1966	174	static void ah_esp_exit(struct ip_vs_protocol *pp)
1da177e4 LT	175	{
	176	/* nothing to do now */
	177	}
	178
	179
409a1966	180	#ifdef CONFIG_IP_VS_PROTO_AH
1da177e4 LT	181	struct ip_vs_protocol ip_vs_protocol_ah = {
	182	.name = "AH",
	183	.protocol = IPPROTO_AH,
2ad17def	184	.num_states = 1,
1da177e4	185	.dont_defrag = 1,
409a1966 JV	186	.init = ah_esp_init,
	187	.exit = ah_esp_exit,
	188	.conn_schedule = ah_esp_conn_schedule,
	189	.conn_in_get = ah_esp_conn_in_get,
	190	.conn_out_get = ah_esp_conn_out_get,
1da177e4 LT	191	.snat_handler = NULL,
	192	.dnat_handler = NULL,
	193	.csum_check = NULL,
	194	.state_transition = NULL,
	195	.register_app = NULL,
	196	.unregister_app = NULL,
	197	.app_conn_bind = NULL,
409a1966	198	.debug_packet = ah_esp_debug_packet,
1da177e4 LT	199	.timeout_change = NULL, /* ISAKMP */
	200	.set_state_timeout = NULL,
	201	};
409a1966 JV	202	#endif
	203
	204	#ifdef CONFIG_IP_VS_PROTO_ESP
	205	struct ip_vs_protocol ip_vs_protocol_esp = {
	206	.name = "ESP",
	207	.protocol = IPPROTO_ESP,
	208	.num_states = 1,
	209	.dont_defrag = 1,
	210	.init = ah_esp_init,
	211	.exit = ah_esp_exit,
	212	.conn_schedule = ah_esp_conn_schedule,
	213	.conn_in_get = ah_esp_conn_in_get,
	214	.conn_out_get = ah_esp_conn_out_get,
	215	.snat_handler = NULL,
	216	.dnat_handler = NULL,
	217	.csum_check = NULL,
	218	.state_transition = NULL,
	219	.register_app = NULL,
	220	.unregister_app = NULL,
	221	.app_conn_bind = NULL,
	222	.debug_packet = ah_esp_debug_packet,
	223	.timeout_change = NULL, /* ISAKMP */
	224	};
	225	#endif