2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
13 #define KMSG_COMPONENT "IPVS"
14 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
18 #include <linux/module.h>
19 #include <linux/kernel.h>
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_ipv4.h>
23 #include <net/ip_vs.h>
41 #define PORT_ISAKMP 500
44 ah_esp_conn_fill_param_proto(struct net *net, int af,
45 const struct ip_vs_iphdr *iph, int inverse,
46 struct ip_vs_conn_param *p)
49 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
50 &iph->saddr, htons(PORT_ISAKMP),
51 &iph->daddr, htons(PORT_ISAKMP), p);
53 ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
54 &iph->daddr, htons(PORT_ISAKMP),
55 &iph->saddr, htons(PORT_ISAKMP), p);
58 static struct ip_vs_conn *
59 ah_esp_conn_in_get(int af, const struct sk_buff *skb,
60 const struct ip_vs_iphdr *iph, unsigned int proto_off,
63 struct ip_vs_conn *cp;
64 struct ip_vs_conn_param p;
65 struct net *net = skb_net(skb);
67 ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
68 cp = ip_vs_conn_in_get(&p);
71 * We are not sure if the packet is from our
72 * service, so our conn_schedule hook should return NF_ACCEPT
74 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
76 inverse ? "ICMP+" : "",
77 ip_vs_proto_get(iph->protocol)->name,
78 IP_VS_DBG_ADDR(af, &iph->saddr),
79 IP_VS_DBG_ADDR(af, &iph->daddr));
86 static struct ip_vs_conn *
87 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
88 const struct ip_vs_iphdr *iph,
89 unsigned int proto_off,
92 struct ip_vs_conn *cp;
93 struct ip_vs_conn_param p;
94 struct net *net = skb_net(skb);
96 ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
97 cp = ip_vs_conn_out_get(&p);
99 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
101 inverse ? "ICMP+" : "",
102 ip_vs_proto_get(iph->protocol)->name,
103 IP_VS_DBG_ADDR(af, &iph->saddr),
104 IP_VS_DBG_ADDR(af, &iph->daddr));
112 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
113 int *verdict, struct ip_vs_conn **cpp)
116 * AH/ESP is only related traffic. Pass the packet to IP stack.
118 *verdict = NF_ACCEPT;
122 #ifdef CONFIG_IP_VS_PROTO_AH
123 struct ip_vs_protocol ip_vs_protocol_ah = {
125 .protocol = IPPROTO_AH,
130 .conn_schedule = ah_esp_conn_schedule,
131 .conn_in_get = ah_esp_conn_in_get,
132 .conn_out_get = ah_esp_conn_out_get,
133 .snat_handler = NULL,
134 .dnat_handler = NULL,
136 .state_transition = NULL,
137 .register_app = NULL,
138 .unregister_app = NULL,
139 .app_conn_bind = NULL,
140 .debug_packet = ip_vs_tcpudp_debug_packet,
141 .timeout_change = NULL, /* ISAKMP */
145 #ifdef CONFIG_IP_VS_PROTO_ESP
146 struct ip_vs_protocol ip_vs_protocol_esp = {
148 .protocol = IPPROTO_ESP,
153 .conn_schedule = ah_esp_conn_schedule,
154 .conn_in_get = ah_esp_conn_in_get,
155 .conn_out_get = ah_esp_conn_out_get,
156 .snat_handler = NULL,
157 .dnat_handler = NULL,
159 .state_transition = NULL,
160 .register_app = NULL,
161 .unregister_app = NULL,
162 .app_conn_bind = NULL,
163 .debug_packet = ip_vs_tcpudp_debug_packet,
164 .timeout_change = NULL, /* ISAKMP */