2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
13 #define KMSG_COMPONENT "IPVS"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_ipv4.h>
23 #include <net/ip_vs.h>
41 #define PORT_ISAKMP 500
44 ah_esp_conn_fill_param_proto(struct net
*net
, int af
,
45 const struct ip_vs_iphdr
*iph
, int inverse
,
46 struct ip_vs_conn_param
*p
)
49 ip_vs_conn_fill_param(net
, af
, IPPROTO_UDP
,
50 &iph
->saddr
, htons(PORT_ISAKMP
),
51 &iph
->daddr
, htons(PORT_ISAKMP
), p
);
53 ip_vs_conn_fill_param(net
, af
, IPPROTO_UDP
,
54 &iph
->daddr
, htons(PORT_ISAKMP
),
55 &iph
->saddr
, htons(PORT_ISAKMP
), p
);
58 static struct ip_vs_conn
*
59 ah_esp_conn_in_get(int af
, const struct sk_buff
*skb
,
60 const struct ip_vs_iphdr
*iph
, unsigned int proto_off
,
63 struct ip_vs_conn
*cp
;
64 struct ip_vs_conn_param p
;
65 struct net
*net
= skb_net(skb
);
67 ah_esp_conn_fill_param_proto(net
, af
, iph
, inverse
, &p
);
68 cp
= ip_vs_conn_in_get(&p
);
71 * We are not sure if the packet is from our
72 * service, so our conn_schedule hook should return NF_ACCEPT
74 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
76 inverse
? "ICMP+" : "",
77 ip_vs_proto_get(iph
->protocol
)->name
,
78 IP_VS_DBG_ADDR(af
, &iph
->saddr
),
79 IP_VS_DBG_ADDR(af
, &iph
->daddr
));
86 static struct ip_vs_conn
*
87 ah_esp_conn_out_get(int af
, const struct sk_buff
*skb
,
88 const struct ip_vs_iphdr
*iph
,
89 unsigned int proto_off
,
92 struct ip_vs_conn
*cp
;
93 struct ip_vs_conn_param p
;
94 struct net
*net
= skb_net(skb
);
96 ah_esp_conn_fill_param_proto(net
, af
, iph
, inverse
, &p
);
97 cp
= ip_vs_conn_out_get(&p
);
99 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
101 inverse
? "ICMP+" : "",
102 ip_vs_proto_get(iph
->protocol
)->name
,
103 IP_VS_DBG_ADDR(af
, &iph
->saddr
),
104 IP_VS_DBG_ADDR(af
, &iph
->daddr
));
112 ah_esp_conn_schedule(int af
, struct sk_buff
*skb
, struct ip_vs_proto_data
*pd
,
113 int *verdict
, struct ip_vs_conn
**cpp
)
116 * AH/ESP is only related traffic. Pass the packet to IP stack.
118 *verdict
= NF_ACCEPT
;
122 #ifdef CONFIG_IP_VS_PROTO_AH
123 struct ip_vs_protocol ip_vs_protocol_ah
= {
125 .protocol
= IPPROTO_AH
,
130 .conn_schedule
= ah_esp_conn_schedule
,
131 .conn_in_get
= ah_esp_conn_in_get
,
132 .conn_out_get
= ah_esp_conn_out_get
,
133 .snat_handler
= NULL
,
134 .dnat_handler
= NULL
,
136 .state_transition
= NULL
,
137 .register_app
= NULL
,
138 .unregister_app
= NULL
,
139 .app_conn_bind
= NULL
,
140 .debug_packet
= ip_vs_tcpudp_debug_packet
,
141 .timeout_change
= NULL
, /* ISAKMP */
145 #ifdef CONFIG_IP_VS_PROTO_ESP
146 struct ip_vs_protocol ip_vs_protocol_esp
= {
148 .protocol
= IPPROTO_ESP
,
153 .conn_schedule
= ah_esp_conn_schedule
,
154 .conn_in_get
= ah_esp_conn_in_get
,
155 .conn_out_get
= ah_esp_conn_out_get
,
156 .snat_handler
= NULL
,
157 .dnat_handler
= NULL
,
159 .state_transition
= NULL
,
160 .register_app
= NULL
,
161 .unregister_app
= NULL
,
162 .app_conn_bind
= NULL
,
163 .debug_packet
= ip_vs_tcpudp_debug_packet
,
164 .timeout_change
= NULL
, /* ISAKMP */