2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
13 #define KMSG_COMPONENT "IPVS"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_ipv4.h>
23 #include <net/ip_vs.h>
41 #define PORT_ISAKMP 500
44 static struct ip_vs_conn *
45 ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
46 const struct ip_vs_iphdr *iph, unsigned int proto_off,
49 struct ip_vs_conn *cp;
51 if (likely(!inverse)) {
52 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
58 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
67 * We are not sure if the packet is from our
68 * service, so our conn_schedule hook should return NF_ACCEPT
70 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
72 inverse ? "ICMP+" : "",
74 IP_VS_DBG_ADDR(af, &iph->saddr),
75 IP_VS_DBG_ADDR(af, &iph->daddr));
82 static struct ip_vs_conn *
83 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
84 struct ip_vs_protocol *pp,
85 const struct ip_vs_iphdr *iph,
86 unsigned int proto_off,
89 struct ip_vs_conn *cp;
91 if (likely(!inverse)) {
92 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
98 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
106 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
108 inverse ? "ICMP+" : "",
110 IP_VS_DBG_ADDR(af, &iph->saddr),
111 IP_VS_DBG_ADDR(af, &iph->daddr));
119 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
120 int *verdict, struct ip_vs_conn **cpp)
123 * AH/ESP is only related traffic. Pass the packet to IP stack.
125 *verdict = NF_ACCEPT;
131 ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
132 int offset, const char *msg)
135 struct iphdr _iph, *ih;
137 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
139 sprintf(buf, "TRUNCATED");
141 sprintf(buf, "%pI4->%pI4", &ih->saddr, &ih->daddr);
143 pr_debug("%s: %s %s\n", msg, pp->name, buf);
146 #ifdef CONFIG_IP_VS_IPV6
148 ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
149 int offset, const char *msg)
152 struct ipv6hdr _iph, *ih;
154 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
156 sprintf(buf, "TRUNCATED");
158 sprintf(buf, "%pI6->%pI6", &ih->saddr, &ih->daddr);
160 pr_debug("%s: %s %s\n", msg, pp->name, buf);
165 ah_esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
166 int offset, const char *msg)
168 #ifdef CONFIG_IP_VS_IPV6
169 if (skb->protocol == htons(ETH_P_IPV6))
170 ah_esp_debug_packet_v6(pp, skb, offset, msg);
173 ah_esp_debug_packet_v4(pp, skb, offset, msg);
177 static void ah_esp_init(struct ip_vs_protocol *pp)
179 /* nothing to do now */
183 static void ah_esp_exit(struct ip_vs_protocol *pp)
185 /* nothing to do now */
189 #ifdef CONFIG_IP_VS_PROTO_AH
190 struct ip_vs_protocol ip_vs_protocol_ah = {
192 .protocol = IPPROTO_AH,
197 .conn_schedule = ah_esp_conn_schedule,
198 .conn_in_get = ah_esp_conn_in_get,
199 .conn_out_get = ah_esp_conn_out_get,
200 .snat_handler = NULL,
201 .dnat_handler = NULL,
203 .state_transition = NULL,
204 .register_app = NULL,
205 .unregister_app = NULL,
206 .app_conn_bind = NULL,
207 .debug_packet = ah_esp_debug_packet,
208 .timeout_change = NULL, /* ISAKMP */
209 .set_state_timeout = NULL,
213 #ifdef CONFIG_IP_VS_PROTO_ESP
214 struct ip_vs_protocol ip_vs_protocol_esp = {
216 .protocol = IPPROTO_ESP,
221 .conn_schedule = ah_esp_conn_schedule,
222 .conn_in_get = ah_esp_conn_in_get,
223 .conn_out_get = ah_esp_conn_out_get,
224 .snat_handler = NULL,
225 .dnat_handler = NULL,
227 .state_transition = NULL,
228 .register_app = NULL,
229 .unregister_app = NULL,
230 .app_conn_bind = NULL,
231 .debug_packet = ah_esp_debug_packet,
232 .timeout_change = NULL, /* ISAKMP */