2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
13 #define KMSG_COMPONENT "IPVS"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_ipv4.h>
23 #include <net/ip_vs.h>
41 #define PORT_ISAKMP 500
44 ah_esp_conn_fill_param_proto(struct net *net, int af,
45 const struct ip_vs_iphdr *iph, int inverse,
46 struct ip_vs_conn_param *p)
49 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
50 &iph->saddr, htons(PORT_ISAKMP),
51 &iph->daddr, htons(PORT_ISAKMP), p);
53 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
54 &iph->daddr, htons(PORT_ISAKMP),
55 &iph->saddr, htons(PORT_ISAKMP), p);
58 static struct ip_vs_conn *
59 ah_esp_conn_in_get(int af, const struct sk_buff *skb,
60 const struct ip_vs_iphdr *iph,
63 struct ip_vs_conn *cp;
64 struct ip_vs_conn_param p;
65 struct net *net = skb_net(skb);
67 ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
68 cp = ip_vs_conn_in_get(&p);
71 * We are not sure if the packet is from our
72 * service, so our conn_schedule hook should return NF_ACCEPT
74 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
76 inverse ? "ICMP+" : "",
77 ip_vs_proto_get(iph->protocol)->name,
78 IP_VS_DBG_ADDR(af, &iph->saddr),
79 IP_VS_DBG_ADDR(af, &iph->daddr));
86 static struct ip_vs_conn *
87 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
88 const struct ip_vs_iphdr *iph, int inverse)
90 struct ip_vs_conn *cp;
91 struct ip_vs_conn_param p;
92 struct net *net = skb_net(skb);
94 ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
95 cp = ip_vs_conn_out_get(&p);
97 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
99 inverse ? "ICMP+" : "",
100 ip_vs_proto_get(iph->protocol)->name,
101 IP_VS_DBG_ADDR(af, &iph->saddr),
102 IP_VS_DBG_ADDR(af, &iph->daddr));
110 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
111 int *verdict, struct ip_vs_conn **cpp,
112 struct ip_vs_iphdr *iph)
115 * AH/ESP is only related traffic. Pass the packet to IP stack.
117 *verdict = NF_ACCEPT;
121 #ifdef CONFIG_IP_VS_PROTO_AH
122 struct ip_vs_protocol ip_vs_protocol_ah = {
124 .protocol = IPPROTO_AH,
129 .conn_schedule = ah_esp_conn_schedule,
130 .conn_in_get = ah_esp_conn_in_get,
131 .conn_out_get = ah_esp_conn_out_get,
132 .snat_handler = NULL,
133 .dnat_handler = NULL,
135 .state_transition = NULL,
136 .register_app = NULL,
137 .unregister_app = NULL,
138 .app_conn_bind = NULL,
139 .debug_packet = ip_vs_tcpudp_debug_packet,
140 .timeout_change = NULL, /* ISAKMP */
144 #ifdef CONFIG_IP_VS_PROTO_ESP
145 struct ip_vs_protocol ip_vs_protocol_esp = {
147 .protocol = IPPROTO_ESP,
152 .conn_schedule = ah_esp_conn_schedule,
153 .conn_in_get = ah_esp_conn_in_get,
154 .conn_out_get = ah_esp_conn_out_get,
155 .snat_handler = NULL,
156 .dnat_handler = NULL,
158 .state_transition = NULL,
159 .register_app = NULL,
160 .unregister_app = NULL,
161 .app_conn_bind = NULL,
162 .debug_packet = ip_vs_tcpudp_debug_packet,
163 .timeout_change = NULL, /* ISAKMP */