2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
15 #include <linux/module.h>
16 #include <linux/kernel.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv4.h>
20 #include <net/ip_vs.h>
38 #define PORT_ISAKMP 500
41 static struct ip_vs_conn
*
42 ah_esp_conn_in_get(int af
, const struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
43 const struct ip_vs_iphdr
*iph
, unsigned int proto_off
,
46 struct ip_vs_conn
*cp
;
48 if (likely(!inverse
)) {
49 cp
= ip_vs_conn_in_get(af
, IPPROTO_UDP
,
55 cp
= ip_vs_conn_in_get(af
, IPPROTO_UDP
,
64 * We are not sure if the packet is from our
65 * service, so our conn_schedule hook should return NF_ACCEPT
67 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
69 inverse
? "ICMP+" : "",
71 IP_VS_DBG_ADDR(af
, &iph
->saddr
),
72 IP_VS_DBG_ADDR(af
, &iph
->daddr
));
79 static struct ip_vs_conn
*
80 ah_esp_conn_out_get(int af
, const struct sk_buff
*skb
,
81 struct ip_vs_protocol
*pp
,
82 const struct ip_vs_iphdr
*iph
,
83 unsigned int proto_off
,
86 struct ip_vs_conn
*cp
;
88 if (likely(!inverse
)) {
89 cp
= ip_vs_conn_out_get(af
, IPPROTO_UDP
,
95 cp
= ip_vs_conn_out_get(af
, IPPROTO_UDP
,
103 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
105 inverse
? "ICMP+" : "",
107 IP_VS_DBG_ADDR(af
, &iph
->saddr
),
108 IP_VS_DBG_ADDR(af
, &iph
->daddr
));
116 ah_esp_conn_schedule(int af
, struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
117 int *verdict
, struct ip_vs_conn
**cpp
)
120 * AH/ESP is only related traffic. Pass the packet to IP stack.
122 *verdict
= NF_ACCEPT
;
128 ah_esp_debug_packet_v4(struct ip_vs_protocol
*pp
, const struct sk_buff
*skb
,
129 int offset
, const char *msg
)
132 struct iphdr _iph
, *ih
;
134 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
136 sprintf(buf
, "%s TRUNCATED", pp
->name
);
138 sprintf(buf
, "%s %u.%u.%u.%u->%u.%u.%u.%u",
139 pp
->name
, NIPQUAD(ih
->saddr
),
142 printk(KERN_DEBUG
"IPVS: %s: %s\n", msg
, buf
);
145 #ifdef CONFIG_IP_VS_IPV6
147 ah_esp_debug_packet_v6(struct ip_vs_protocol
*pp
, const struct sk_buff
*skb
,
148 int offset
, const char *msg
)
151 struct ipv6hdr _iph
, *ih
;
153 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
155 sprintf(buf
, "%s TRUNCATED", pp
->name
);
157 sprintf(buf
, "%s %pI6->%pI6",
158 pp
->name
, &ih
->saddr
, &ih
->daddr
);
160 printk(KERN_DEBUG
"IPVS: %s: %s\n", msg
, buf
);
165 ah_esp_debug_packet(struct ip_vs_protocol
*pp
, const struct sk_buff
*skb
,
166 int offset
, const char *msg
)
168 #ifdef CONFIG_IP_VS_IPV6
169 if (skb
->protocol
== htons(ETH_P_IPV6
))
170 ah_esp_debug_packet_v6(pp
, skb
, offset
, msg
);
173 ah_esp_debug_packet_v4(pp
, skb
, offset
, msg
);
177 static void ah_esp_init(struct ip_vs_protocol
*pp
)
179 /* nothing to do now */
183 static void ah_esp_exit(struct ip_vs_protocol
*pp
)
185 /* nothing to do now */
189 #ifdef CONFIG_IP_VS_PROTO_AH
190 struct ip_vs_protocol ip_vs_protocol_ah
= {
192 .protocol
= IPPROTO_AH
,
197 .conn_schedule
= ah_esp_conn_schedule
,
198 .conn_in_get
= ah_esp_conn_in_get
,
199 .conn_out_get
= ah_esp_conn_out_get
,
200 .snat_handler
= NULL
,
201 .dnat_handler
= NULL
,
203 .state_transition
= NULL
,
204 .register_app
= NULL
,
205 .unregister_app
= NULL
,
206 .app_conn_bind
= NULL
,
207 .debug_packet
= ah_esp_debug_packet
,
208 .timeout_change
= NULL
, /* ISAKMP */
209 .set_state_timeout
= NULL
,
213 #ifdef CONFIG_IP_VS_PROTO_ESP
214 struct ip_vs_protocol ip_vs_protocol_esp
= {
216 .protocol
= IPPROTO_ESP
,
221 .conn_schedule
= ah_esp_conn_schedule
,
222 .conn_in_get
= ah_esp_conn_in_get
,
223 .conn_out_get
= ah_esp_conn_out_get
,
224 .snat_handler
= NULL
,
225 .dnat_handler
= NULL
,
227 .state_transition
= NULL
,
228 .register_app
= NULL
,
229 .unregister_app
= NULL
,
230 .app_conn_bind
= NULL
,
231 .debug_packet
= ah_esp_debug_packet
,
232 .timeout_change
= NULL
, /* ISAKMP */