net/netfilter/ipvs/ip_vs_proto_ah_esp.c

   1 /*
   2  * ip_vs_proto_ah_esp.c:        AH/ESP IPSec load balancing support for IPVS
   3  *
   4  * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
   5  *              Wensong Zhang <wensong@linuxvirtualserver.org>
   6  *
   7  *              This program is free software; you can redistribute it and/or
   8  *              modify it under the terms of the GNU General Public License
   9  *              version 2 as published by the Free Software Foundation;
  10  *
  11  */
  12
  13 #define KMSG_COMPONENT "IPVS"
  14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  15
  16 #include <linux/in.h>
  17 #include <linux/ip.h>
  18 #include <linux/module.h>
  19 #include <linux/kernel.h>
  20 #include <linux/netfilter.h>
  21 #include <linux/netfilter_ipv4.h>
  22
  23 #include <net/ip_vs.h>
  24
  25
  26 /* TODO:
  27
  28 struct isakmp_hdr {
  29         __u8            icookie[8];
  30         __u8            rcookie[8];
  31         __u8            np;
  32         __u8            version;
  33         __u8            xchgtype;
  34         __u8            flags;
  35         __u32           msgid;
  36         __u32           length;
  37 };
  38
  39 */
  40
  41 #define PORT_ISAKMP     500
  42
  43 static void
  44 ah_esp_conn_fill_param_proto(struct net *net, int af,
  45                              const struct ip_vs_iphdr *iph, int inverse,
  46                              struct ip_vs_conn_param *p)
  47 {
  48         if (likely(!inverse))
  49                 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
  50                                       &iph->saddr, htons(PORT_ISAKMP),
  51                                       &iph->daddr, htons(PORT_ISAKMP), p);
  52         else
  53                 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
  54                                       &iph->daddr, htons(PORT_ISAKMP),
  55                                       &iph->saddr, htons(PORT_ISAKMP), p);
  56 }
  57
  58 static struct ip_vs_conn *
  59 ah_esp_conn_in_get(int af, const struct sk_buff *skb,
  60                    const struct ip_vs_iphdr *iph, unsigned int proto_off,
  61                    int inverse)
  62 {
  63         struct ip_vs_conn *cp;
  64         struct ip_vs_conn_param p;
  65         struct net *net = skb_net(skb);
  66
  67         ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
  68         cp = ip_vs_conn_in_get(&p);
  69         if (!cp) {
  70                 /*
  71                  * We are not sure if the packet is from our
  72                  * service, so our conn_schedule hook should return NF_ACCEPT
  73                  */
  74                 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
  75                               "%s%s %s->%s\n",
  76                               inverse ? "ICMP+" : "",
  77                               ip_vs_proto_get(iph->protocol)->name,
  78                               IP_VS_DBG_ADDR(af, &iph->saddr),
  79                               IP_VS_DBG_ADDR(af, &iph->daddr));
  80         }
  81
  82         return cp;
  83 }
  84
  85
  86 static struct ip_vs_conn *
  87 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
  88                     const struct ip_vs_iphdr *iph,
  89                     unsigned int proto_off,
  90                     int inverse)
  91 {
  92         struct ip_vs_conn *cp;
  93         struct ip_vs_conn_param p;
  94         struct net *net = skb_net(skb);
  95
  96         ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
  97         cp = ip_vs_conn_out_get(&p);
  98         if (!cp) {
  99                 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
 100                               "%s%s %s->%s\n",
 101                               inverse ? "ICMP+" : "",
 102                               ip_vs_proto_get(iph->protocol)->name,
 103                               IP_VS_DBG_ADDR(af, &iph->saddr),
 104                               IP_VS_DBG_ADDR(af, &iph->daddr));
 105         }
 106
 107         return cp;
 108 }
 109
 110
 111 static int
 112 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
 113                      int *verdict, struct ip_vs_conn **cpp)
 114 {
 115         /*
 116          * AH/ESP is only related traffic. Pass the packet to IP stack.
 117          */
 118         *verdict = NF_ACCEPT;
 119         return 0;
 120 }
 121
 122 #ifdef CONFIG_IP_VS_PROTO_AH
 123 struct ip_vs_protocol ip_vs_protocol_ah = {
 124         .name =                 "AH",
 125         .protocol =             IPPROTO_AH,
 126         .num_states =           1,
 127         .dont_defrag =          1,
 128         .init =                 NULL,
 129         .exit =                 NULL,
 130         .conn_schedule =        ah_esp_conn_schedule,
 131         .conn_in_get =          ah_esp_conn_in_get,
 132         .conn_out_get =         ah_esp_conn_out_get,
 133         .snat_handler =         NULL,
 134         .dnat_handler =         NULL,
 135         .csum_check =           NULL,
 136         .state_transition =     NULL,
 137         .register_app =         NULL,
 138         .unregister_app =       NULL,
 139         .app_conn_bind =        NULL,
 140         .debug_packet =         ip_vs_tcpudp_debug_packet,
 141         .timeout_change =       NULL,           /* ISAKMP */
 142 };
 143 #endif
 144
 145 #ifdef CONFIG_IP_VS_PROTO_ESP
 146 struct ip_vs_protocol ip_vs_protocol_esp = {
 147         .name =                 "ESP",
 148         .protocol =             IPPROTO_ESP,
 149         .num_states =           1,
 150         .dont_defrag =          1,
 151         .init =                 NULL,
 152         .exit =                 NULL,
 153         .conn_schedule =        ah_esp_conn_schedule,
 154         .conn_in_get =          ah_esp_conn_in_get,
 155         .conn_out_get =         ah_esp_conn_out_get,
 156         .snat_handler =         NULL,
 157         .dnat_handler =         NULL,
 158         .csum_check =           NULL,
 159         .state_transition =     NULL,
 160         .register_app =         NULL,
 161         .unregister_app =       NULL,
 162         .app_conn_bind =        NULL,
 163         .debug_packet =         ip_vs_tcpudp_debug_packet,
 164         .timeout_change =       NULL,           /* ISAKMP */
 165 };
 166 #endif