]>
Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
409a1966 | 2 | * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS |
1da177e4 | 3 | * |
1da177e4 LT |
4 | * Authors: Julian Anastasov <ja@ssi.bg>, February 2002 |
5 | * Wensong Zhang <wensong@linuxvirtualserver.org> | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or | |
8 | * modify it under the terms of the GNU General Public License | |
9 | * version 2 as published by the Free Software Foundation; | |
10 | * | |
11 | */ | |
12 | ||
9aada7ac HE |
13 | #define KMSG_COMPONENT "IPVS" |
14 | #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt | |
15 | ||
14c85021 ACM |
16 | #include <linux/in.h> |
17 | #include <linux/ip.h> | |
1da177e4 LT |
18 | #include <linux/module.h> |
19 | #include <linux/kernel.h> | |
20 | #include <linux/netfilter.h> | |
21 | #include <linux/netfilter_ipv4.h> | |
22 | ||
23 | #include <net/ip_vs.h> | |
24 | ||
25 | ||
26 | /* TODO: | |
27 | ||
28 | struct isakmp_hdr { | |
29 | __u8 icookie[8]; | |
30 | __u8 rcookie[8]; | |
31 | __u8 np; | |
32 | __u8 version; | |
33 | __u8 xchgtype; | |
34 | __u8 flags; | |
35 | __u32 msgid; | |
36 | __u32 length; | |
37 | }; | |
38 | ||
39 | */ | |
40 | ||
41 | #define PORT_ISAKMP 500 | |
42 | ||
f11017ec SH |
43 | static void |
44 | ah_esp_conn_fill_param_proto(int af, const struct ip_vs_iphdr *iph, | |
45 | int inverse, struct ip_vs_conn_param *p) | |
46 | { | |
47 | if (likely(!inverse)) | |
48 | ip_vs_conn_fill_param(af, IPPROTO_UDP, | |
49 | &iph->saddr, htons(PORT_ISAKMP), | |
50 | &iph->daddr, htons(PORT_ISAKMP), p); | |
51 | else | |
52 | ip_vs_conn_fill_param(af, IPPROTO_UDP, | |
53 | &iph->daddr, htons(PORT_ISAKMP), | |
54 | &iph->saddr, htons(PORT_ISAKMP), p); | |
55 | } | |
1da177e4 LT |
56 | |
57 | static struct ip_vs_conn * | |
51ef348b JV |
58 | ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp, |
59 | const struct ip_vs_iphdr *iph, unsigned int proto_off, | |
409a1966 | 60 | int inverse) |
1da177e4 LT |
61 | { |
62 | struct ip_vs_conn *cp; | |
f11017ec | 63 | struct ip_vs_conn_param p; |
1da177e4 | 64 | |
f11017ec SH |
65 | ah_esp_conn_fill_param_proto(af, iph, inverse, &p); |
66 | cp = ip_vs_conn_in_get(&p); | |
1da177e4 LT |
67 | if (!cp) { |
68 | /* | |
69 | * We are not sure if the packet is from our | |
70 | * service, so our conn_schedule hook should return NF_ACCEPT | |
71 | */ | |
51ef348b JV |
72 | IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet " |
73 | "%s%s %s->%s\n", | |
74 | inverse ? "ICMP+" : "", | |
75 | pp->name, | |
76 | IP_VS_DBG_ADDR(af, &iph->saddr), | |
77 | IP_VS_DBG_ADDR(af, &iph->daddr)); | |
1da177e4 LT |
78 | } |
79 | ||
80 | return cp; | |
81 | } | |
82 | ||
83 | ||
84 | static struct ip_vs_conn * | |
51ef348b JV |
85 | ah_esp_conn_out_get(int af, const struct sk_buff *skb, |
86 | struct ip_vs_protocol *pp, | |
87 | const struct ip_vs_iphdr *iph, | |
88 | unsigned int proto_off, | |
89 | int inverse) | |
1da177e4 LT |
90 | { |
91 | struct ip_vs_conn *cp; | |
f11017ec | 92 | struct ip_vs_conn_param p; |
1da177e4 | 93 | |
f11017ec SH |
94 | ah_esp_conn_fill_param_proto(af, iph, inverse, &p); |
95 | cp = ip_vs_conn_out_get(&p); | |
1da177e4 | 96 | if (!cp) { |
51ef348b JV |
97 | IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet " |
98 | "%s%s %s->%s\n", | |
99 | inverse ? "ICMP+" : "", | |
100 | pp->name, | |
101 | IP_VS_DBG_ADDR(af, &iph->saddr), | |
102 | IP_VS_DBG_ADDR(af, &iph->daddr)); | |
1da177e4 LT |
103 | } |
104 | ||
105 | return cp; | |
106 | } | |
107 | ||
108 | ||
109 | static int | |
51ef348b | 110 | ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, |
409a1966 | 111 | int *verdict, struct ip_vs_conn **cpp) |
1da177e4 LT |
112 | { |
113 | /* | |
409a1966 | 114 | * AH/ESP is only related traffic. Pass the packet to IP stack. |
1da177e4 LT |
115 | */ |
116 | *verdict = NF_ACCEPT; | |
117 | return 0; | |
118 | } | |
119 | ||
409a1966 | 120 | static void ah_esp_init(struct ip_vs_protocol *pp) |
1da177e4 LT |
121 | { |
122 | /* nothing to do now */ | |
123 | } | |
124 | ||
125 | ||
409a1966 | 126 | static void ah_esp_exit(struct ip_vs_protocol *pp) |
1da177e4 LT |
127 | { |
128 | /* nothing to do now */ | |
129 | } | |
130 | ||
131 | ||
409a1966 | 132 | #ifdef CONFIG_IP_VS_PROTO_AH |
1da177e4 LT |
133 | struct ip_vs_protocol ip_vs_protocol_ah = { |
134 | .name = "AH", | |
135 | .protocol = IPPROTO_AH, | |
2ad17def | 136 | .num_states = 1, |
1da177e4 | 137 | .dont_defrag = 1, |
409a1966 JV |
138 | .init = ah_esp_init, |
139 | .exit = ah_esp_exit, | |
140 | .conn_schedule = ah_esp_conn_schedule, | |
141 | .conn_in_get = ah_esp_conn_in_get, | |
142 | .conn_out_get = ah_esp_conn_out_get, | |
1da177e4 LT |
143 | .snat_handler = NULL, |
144 | .dnat_handler = NULL, | |
145 | .csum_check = NULL, | |
146 | .state_transition = NULL, | |
147 | .register_app = NULL, | |
148 | .unregister_app = NULL, | |
149 | .app_conn_bind = NULL, | |
0d79641a | 150 | .debug_packet = ip_vs_tcpudp_debug_packet, |
1da177e4 LT |
151 | .timeout_change = NULL, /* ISAKMP */ |
152 | .set_state_timeout = NULL, | |
153 | }; | |
409a1966 JV |
154 | #endif |
155 | ||
156 | #ifdef CONFIG_IP_VS_PROTO_ESP | |
157 | struct ip_vs_protocol ip_vs_protocol_esp = { | |
158 | .name = "ESP", | |
159 | .protocol = IPPROTO_ESP, | |
160 | .num_states = 1, | |
161 | .dont_defrag = 1, | |
162 | .init = ah_esp_init, | |
163 | .exit = ah_esp_exit, | |
164 | .conn_schedule = ah_esp_conn_schedule, | |
165 | .conn_in_get = ah_esp_conn_in_get, | |
166 | .conn_out_get = ah_esp_conn_out_get, | |
167 | .snat_handler = NULL, | |
168 | .dnat_handler = NULL, | |
169 | .csum_check = NULL, | |
170 | .state_transition = NULL, | |
171 | .register_app = NULL, | |
172 | .unregister_app = NULL, | |
173 | .app_conn_bind = NULL, | |
0d79641a | 174 | .debug_packet = ip_vs_tcpudp_debug_packet, |
409a1966 JV |
175 | .timeout_change = NULL, /* ISAKMP */ |
176 | }; | |
177 | #endif |