blob: c36ccf057a19fe53942de7a387b7c328fcd24664 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * ip_vs_proto_esp.c: ESP IPSec load balancing support for IPVS
3 *
4 * Version: $Id: ip_vs_proto_esp.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
5 *
6 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
7 * Wensong Zhang <wensong@linuxvirtualserver.org>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * version 2 as published by the Free Software Foundation;
12 *
13 */
14
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -020015#include <linux/in.h>
16#include <linux/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017#include <linux/module.h>
18#include <linux/kernel.h>
19#include <linux/netfilter.h>
20#include <linux/netfilter_ipv4.h>
21
22#include <net/ip_vs.h>
23
24
25/* TODO:
26
27struct isakmp_hdr {
28 __u8 icookie[8];
29 __u8 rcookie[8];
30 __u8 np;
31 __u8 version;
32 __u8 xchgtype;
33 __u8 flags;
34 __u32 msgid;
35 __u32 length;
36};
37
38*/
39
40#define PORT_ISAKMP 500
41
42
43static struct ip_vs_conn *
44esp_conn_in_get(const struct sk_buff *skb,
45 struct ip_vs_protocol *pp,
46 const struct iphdr *iph,
47 unsigned int proto_off,
48 int inverse)
49{
50 struct ip_vs_conn *cp;
51
52 if (likely(!inverse)) {
53 cp = ip_vs_conn_in_get(IPPROTO_UDP,
54 iph->saddr,
55 __constant_htons(PORT_ISAKMP),
56 iph->daddr,
57 __constant_htons(PORT_ISAKMP));
58 } else {
59 cp = ip_vs_conn_in_get(IPPROTO_UDP,
60 iph->daddr,
61 __constant_htons(PORT_ISAKMP),
62 iph->saddr,
63 __constant_htons(PORT_ISAKMP));
64 }
65
66 if (!cp) {
67 /*
68 * We are not sure if the packet is from our
69 * service, so our conn_schedule hook should return NF_ACCEPT
70 */
71 IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
72 "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
73 inverse ? "ICMP+" : "",
74 pp->name,
75 NIPQUAD(iph->saddr),
76 NIPQUAD(iph->daddr));
77 }
78
79 return cp;
80}
81
82
83static struct ip_vs_conn *
84esp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
85 const struct iphdr *iph, unsigned int proto_off, int inverse)
86{
87 struct ip_vs_conn *cp;
88
89 if (likely(!inverse)) {
90 cp = ip_vs_conn_out_get(IPPROTO_UDP,
91 iph->saddr,
92 __constant_htons(PORT_ISAKMP),
93 iph->daddr,
94 __constant_htons(PORT_ISAKMP));
95 } else {
96 cp = ip_vs_conn_out_get(IPPROTO_UDP,
97 iph->daddr,
98 __constant_htons(PORT_ISAKMP),
99 iph->saddr,
100 __constant_htons(PORT_ISAKMP));
101 }
102
103 if (!cp) {
104 IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
105 "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
106 inverse ? "ICMP+" : "",
107 pp->name,
108 NIPQUAD(iph->saddr),
109 NIPQUAD(iph->daddr));
110 }
111
112 return cp;
113}
114
115
116static int
117esp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
118 int *verdict, struct ip_vs_conn **cpp)
119{
120 /*
121 * ESP is only related traffic. Pass the packet to IP stack.
122 */
123 *verdict = NF_ACCEPT;
124 return 0;
125}
126
127
128static void
129esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
130 int offset, const char *msg)
131{
132 char buf[256];
133 struct iphdr _iph, *ih;
134
135 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
136 if (ih == NULL)
137 sprintf(buf, "%s TRUNCATED", pp->name);
138 else
139 sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
140 pp->name, NIPQUAD(ih->saddr),
141 NIPQUAD(ih->daddr));
142
143 printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
144}
145
146
147static void esp_init(struct ip_vs_protocol *pp)
148{
149 /* nothing to do now */
150}
151
152
153static void esp_exit(struct ip_vs_protocol *pp)
154{
155 /* nothing to do now */
156}
157
158
159struct ip_vs_protocol ip_vs_protocol_esp = {
160 .name = "ESP",
161 .protocol = IPPROTO_ESP,
162 .dont_defrag = 1,
163 .init = esp_init,
164 .exit = esp_exit,
165 .conn_schedule = esp_conn_schedule,
166 .conn_in_get = esp_conn_in_get,
167 .conn_out_get = esp_conn_out_get,
168 .snat_handler = NULL,
169 .dnat_handler = NULL,
170 .csum_check = NULL,
171 .state_transition = NULL,
172 .register_app = NULL,
173 .unregister_app = NULL,
174 .app_conn_bind = NULL,
175 .debug_packet = esp_debug_packet,
176 .timeout_change = NULL, /* ISAKMP */
177};