1 /*
2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
3 *
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
10 *
11 */
12
13 #define KMSG_COMPONENT "IPVS"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
15
16 #include <linux/in.h>
17 #include <linux/ip.h>
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_ipv4.h>
22
23 #include <net/ip_vs.h>
24
25
26 /* TODO:
27
28 struct isakmp_hdr {
29 __u8 icookie[8];
30 __u8 rcookie[8];
31 __u8 np;
32 __u8 version;
33 __u8 xchgtype;
34 __u8 flags;
35 __u32 msgid;
36 __u32 length;
37 };
38
39 */
40
41 #define PORT_ISAKMP 500
42
43 static void
ah_esp_conn_fill_param_proto(struct net * net,int af,const struct ip_vs_iphdr * iph,int inverse,struct ip_vs_conn_param * p)44 ah_esp_conn_fill_param_proto(struct net *net, int af,
45 const struct ip_vs_iphdr *iph, int inverse,
46 struct ip_vs_conn_param *p)
47 {
48 if (likely(!inverse))
49 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
50 &iph->saddr, htons(PORT_ISAKMP),
51 &iph->daddr, htons(PORT_ISAKMP), p);
52 else
53 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
54 &iph->daddr, htons(PORT_ISAKMP),
55 &iph->saddr, htons(PORT_ISAKMP), p);
56 }
57
58 static struct ip_vs_conn *
ah_esp_conn_in_get(int af,const struct sk_buff * skb,const struct ip_vs_iphdr * iph,unsigned int proto_off,int inverse)59 ah_esp_conn_in_get(int af, const struct sk_buff *skb,
60 const struct ip_vs_iphdr *iph, unsigned int proto_off,
61 int inverse)
62 {
63 struct ip_vs_conn *cp;
64 struct ip_vs_conn_param p;
65 struct net *net = skb_net(skb);
66
67 ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
68 cp = ip_vs_conn_in_get(&p);
69 if (!cp) {
70 /*
71 * We are not sure if the packet is from our
72 * service, so our conn_schedule hook should return NF_ACCEPT
73 */
74 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
75 "%s%s %s->%s\n",
76 inverse ? "ICMP+" : "",
77 ip_vs_proto_get(iph->protocol)->name,
78 IP_VS_DBG_ADDR(af, &iph->saddr),
79 IP_VS_DBG_ADDR(af, &iph->daddr));
80 }
81
82 return cp;
83 }
84
85
86 static struct ip_vs_conn *
ah_esp_conn_out_get(int af,const struct sk_buff * skb,const struct ip_vs_iphdr * iph,unsigned int proto_off,int inverse)87 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
88 const struct ip_vs_iphdr *iph,
89 unsigned int proto_off,
90 int inverse)
91 {
92 struct ip_vs_conn *cp;
93 struct ip_vs_conn_param p;
94 struct net *net = skb_net(skb);
95
96 ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
97 cp = ip_vs_conn_out_get(&p);
98 if (!cp) {
99 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
100 "%s%s %s->%s\n",
101 inverse ? "ICMP+" : "",
102 ip_vs_proto_get(iph->protocol)->name,
103 IP_VS_DBG_ADDR(af, &iph->saddr),
104 IP_VS_DBG_ADDR(af, &iph->daddr));
105 }
106
107 return cp;
108 }
109
110
111 static int
ah_esp_conn_schedule(int af,struct sk_buff * skb,struct ip_vs_proto_data * pd,int * verdict,struct ip_vs_conn ** cpp)112 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
113 int *verdict, struct ip_vs_conn **cpp)
114 {
115 /*
116 * AH/ESP is only related traffic. Pass the packet to IP stack.
117 */
118 *verdict = NF_ACCEPT;
119 return 0;
120 }
121
122 #ifdef CONFIG_IP_VS_PROTO_AH
123 struct ip_vs_protocol ip_vs_protocol_ah = {
124 .name = "AH",
125 .protocol = IPPROTO_AH,
126 .num_states = 1,
127 .dont_defrag = 1,
128 .init = NULL,
129 .exit = NULL,
130 .conn_schedule = ah_esp_conn_schedule,
131 .conn_in_get = ah_esp_conn_in_get,
132 .conn_out_get = ah_esp_conn_out_get,
133 .snat_handler = NULL,
134 .dnat_handler = NULL,
135 .csum_check = NULL,
136 .state_transition = NULL,
137 .register_app = NULL,
138 .unregister_app = NULL,
139 .app_conn_bind = NULL,
140 .debug_packet = ip_vs_tcpudp_debug_packet,
141 .timeout_change = NULL, /* ISAKMP */
142 };
143 #endif
144
145 #ifdef CONFIG_IP_VS_PROTO_ESP
146 struct ip_vs_protocol ip_vs_protocol_esp = {
147 .name = "ESP",
148 .protocol = IPPROTO_ESP,
149 .num_states = 1,
150 .dont_defrag = 1,
151 .init = NULL,
152 .exit = NULL,
153 .conn_schedule = ah_esp_conn_schedule,
154 .conn_in_get = ah_esp_conn_in_get,
155 .conn_out_get = ah_esp_conn_out_get,
156 .snat_handler = NULL,
157 .dnat_handler = NULL,
158 .csum_check = NULL,
159 .state_transition = NULL,
160 .register_app = NULL,
161 .unregister_app = NULL,
162 .app_conn_bind = NULL,
163 .debug_packet = ip_vs_tcpudp_debug_packet,
164 .timeout_change = NULL, /* ISAKMP */
165 };
166 #endif
167