2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
15 #include <linux/module.h>
16 #include <linux/kernel.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv4.h>
20 #include <net/ip_vs.h>
38 #define PORT_ISAKMP 500
41 static struct ip_vs_conn *
42 ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
43 const struct ip_vs_iphdr *iph, unsigned int proto_off,
46 struct ip_vs_conn *cp;
48 if (likely(!inverse)) {
49 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
55 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
64 * We are not sure if the packet is from our
65 * service, so our conn_schedule hook should return NF_ACCEPT
67 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
69 inverse ? "ICMP+" : "",
71 IP_VS_DBG_ADDR(af, &iph->saddr),
72 IP_VS_DBG_ADDR(af, &iph->daddr));
79 static struct ip_vs_conn *
80 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
81 struct ip_vs_protocol *pp,
82 const struct ip_vs_iphdr *iph,
83 unsigned int proto_off,
86 struct ip_vs_conn *cp;
88 if (likely(!inverse)) {
89 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
95 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
103 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
105 inverse ? "ICMP+" : "",
107 IP_VS_DBG_ADDR(af, &iph->saddr),
108 IP_VS_DBG_ADDR(af, &iph->daddr));
116 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
117 int *verdict, struct ip_vs_conn **cpp)
120 * AH/ESP is only related traffic. Pass the packet to IP stack.
122 *verdict = NF_ACCEPT;
128 ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
129 int offset, const char *msg)
132 struct iphdr _iph, *ih;
134 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
136 sprintf(buf, "%s TRUNCATED", pp->name);
138 sprintf(buf, "%s %pI4->%pI4",
139 pp->name, &ih->saddr, &ih->daddr);
141 printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
144 #ifdef CONFIG_IP_VS_IPV6
146 ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
147 int offset, const char *msg)
150 struct ipv6hdr _iph, *ih;
152 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
154 sprintf(buf, "%s TRUNCATED", pp->name);
156 sprintf(buf, "%s %pI6->%pI6",
157 pp->name, &ih->saddr, &ih->daddr);
159 printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
164 ah_esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
165 int offset, const char *msg)
167 #ifdef CONFIG_IP_VS_IPV6
168 if (skb->protocol == htons(ETH_P_IPV6))
169 ah_esp_debug_packet_v6(pp, skb, offset, msg);
172 ah_esp_debug_packet_v4(pp, skb, offset, msg);
176 static void ah_esp_init(struct ip_vs_protocol *pp)
178 /* nothing to do now */
182 static void ah_esp_exit(struct ip_vs_protocol *pp)
184 /* nothing to do now */
188 #ifdef CONFIG_IP_VS_PROTO_AH
189 struct ip_vs_protocol ip_vs_protocol_ah = {
191 .protocol = IPPROTO_AH,
196 .conn_schedule = ah_esp_conn_schedule,
197 .conn_in_get = ah_esp_conn_in_get,
198 .conn_out_get = ah_esp_conn_out_get,
199 .snat_handler = NULL,
200 .dnat_handler = NULL,
202 .state_transition = NULL,
203 .register_app = NULL,
204 .unregister_app = NULL,
205 .app_conn_bind = NULL,
206 .debug_packet = ah_esp_debug_packet,
207 .timeout_change = NULL, /* ISAKMP */
208 .set_state_timeout = NULL,
212 #ifdef CONFIG_IP_VS_PROTO_ESP
213 struct ip_vs_protocol ip_vs_protocol_esp = {
215 .protocol = IPPROTO_ESP,
220 .conn_schedule = ah_esp_conn_schedule,
221 .conn_in_get = ah_esp_conn_in_get,
222 .conn_out_get = ah_esp_conn_out_get,
223 .snat_handler = NULL,
224 .dnat_handler = NULL,
226 .state_transition = NULL,
227 .register_app = NULL,
228 .unregister_app = NULL,
229 .app_conn_bind = NULL,
230 .debug_packet = ah_esp_debug_packet,
231 .timeout_change = NULL, /* ISAKMP */