2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
13 #define KMSG_COMPONENT "IPVS"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_ipv4.h>
23 #include <net/ip_vs.h>
41 #define PORT_ISAKMP 500
44 ah_esp_conn_fill_param_proto(struct netns_ipvs *ipvs, int af,
45 const struct ip_vs_iphdr *iph,
46 struct ip_vs_conn_param *p)
48 if (likely(!ip_vs_iph_inverse(iph)))
49 ip_vs_conn_fill_param(ipvs, af, IPPROTO_UDP,
50 &iph->saddr, htons(PORT_ISAKMP),
51 &iph->daddr, htons(PORT_ISAKMP), p);
53 ip_vs_conn_fill_param(ipvs, af, IPPROTO_UDP,
54 &iph->daddr, htons(PORT_ISAKMP),
55 &iph->saddr, htons(PORT_ISAKMP), p);
58 static struct ip_vs_conn *
59 ah_esp_conn_in_get(struct netns_ipvs *ipvs, int af, const struct sk_buff *skb,
60 const struct ip_vs_iphdr *iph)
62 struct ip_vs_conn *cp;
63 struct ip_vs_conn_param p;
65 ah_esp_conn_fill_param_proto(ipvs, af, iph, &p);
66 cp = ip_vs_conn_in_get(&p);
69 * We are not sure if the packet is from our
70 * service, so our conn_schedule hook should return NF_ACCEPT
72 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
74 ip_vs_iph_icmp(iph) ? "ICMP+" : "",
75 ip_vs_proto_get(iph->protocol)->name,
76 IP_VS_DBG_ADDR(af, &iph->saddr),
77 IP_VS_DBG_ADDR(af, &iph->daddr));
84 static struct ip_vs_conn *
85 ah_esp_conn_out_get(struct netns_ipvs *ipvs, int af, const struct sk_buff *skb,
86 const struct ip_vs_iphdr *iph)
88 struct ip_vs_conn *cp;
89 struct ip_vs_conn_param p;
91 ah_esp_conn_fill_param_proto(ipvs, af, iph, &p);
92 cp = ip_vs_conn_out_get(&p);
94 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
96 ip_vs_iph_icmp(iph) ? "ICMP+" : "",
97 ip_vs_proto_get(iph->protocol)->name,
98 IP_VS_DBG_ADDR(af, &iph->saddr),
99 IP_VS_DBG_ADDR(af, &iph->daddr));
107 ah_esp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
108 struct ip_vs_proto_data *pd,
109 int *verdict, struct ip_vs_conn **cpp,
110 struct ip_vs_iphdr *iph)
113 * AH/ESP is only related traffic. Pass the packet to IP stack.
115 *verdict = NF_ACCEPT;
119 #ifdef CONFIG_IP_VS_PROTO_AH
120 struct ip_vs_protocol ip_vs_protocol_ah = {
122 .protocol = IPPROTO_AH,
127 .conn_schedule = ah_esp_conn_schedule,
128 .conn_in_get = ah_esp_conn_in_get,
129 .conn_out_get = ah_esp_conn_out_get,
130 .snat_handler = NULL,
131 .dnat_handler = NULL,
133 .state_transition = NULL,
134 .register_app = NULL,
135 .unregister_app = NULL,
136 .app_conn_bind = NULL,
137 .debug_packet = ip_vs_tcpudp_debug_packet,
138 .timeout_change = NULL, /* ISAKMP */
142 #ifdef CONFIG_IP_VS_PROTO_ESP
143 struct ip_vs_protocol ip_vs_protocol_esp = {
145 .protocol = IPPROTO_ESP,
150 .conn_schedule = ah_esp_conn_schedule,
151 .conn_in_get = ah_esp_conn_in_get,
152 .conn_out_get = ah_esp_conn_out_get,
153 .snat_handler = NULL,
154 .dnat_handler = NULL,
156 .state_transition = NULL,
157 .register_app = NULL,
158 .unregister_app = NULL,
159 .app_conn_bind = NULL,
160 .debug_packet = ip_vs_tcpudp_debug_packet,
161 .timeout_change = NULL, /* ISAKMP */