[linux-2.6] / net / ipv4 / ipvs / ip_vs_proto_esp.c

/*
 * ip_vs_proto_esp.c:	ESP IPSec load balancing support for IPVS
 *
 * Version:     $Id: ip_vs_proto_esp.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
 *
 * Authors:	Julian Anastasov <ja@ssi.bg>, February 2002
 *		Wensong Zhang <wensong@linuxvirtualserver.org>
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		version 2 as published by the Free Software Foundation;
 *
 */

#include <linux/in.h>
#include <linux/ip.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

#include <net/ip_vs.h>


/* TODO:

struct isakmp_hdr {
	__u8		icookie[8];
	__u8		rcookie[8];
	__u8		np;
	__u8		version;
	__u8		xchgtype;
	__u8		flags;
	__u32		msgid;
	__u32		length;
};

*/

#define PORT_ISAKMP	500


static struct ip_vs_conn *
esp_conn_in_get(const struct sk_buff *skb,
		struct ip_vs_protocol *pp,
		const struct iphdr *iph,
		unsigned int proto_off,
		int inverse)
{
	struct ip_vs_conn *cp;

	if (likely(!inverse)) {
		cp = ip_vs_conn_in_get(IPPROTO_UDP,
				       iph->saddr,
				       __constant_htons(PORT_ISAKMP),
				       iph->daddr,
				       __constant_htons(PORT_ISAKMP));
	} else {
		cp = ip_vs_conn_in_get(IPPROTO_UDP,
				       iph->daddr,
				       __constant_htons(PORT_ISAKMP),
				       iph->saddr,
				       __constant_htons(PORT_ISAKMP));
	}

	if (!cp) {
		/*
		 * We are not sure if the packet is from our
		 * service, so our conn_schedule hook should return NF_ACCEPT
		 */
		IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
			  "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
			  inverse ? "ICMP+" : "",
			  pp->name,
			  NIPQUAD(iph->saddr),
			  NIPQUAD(iph->daddr));
	}

	return cp;
}


static struct ip_vs_conn *
esp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		 const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	struct ip_vs_conn *cp;

	if (likely(!inverse)) {
		cp = ip_vs_conn_out_get(IPPROTO_UDP,
					iph->saddr,
					__constant_htons(PORT_ISAKMP),
					iph->daddr,
					__constant_htons(PORT_ISAKMP));
	} else {
		cp = ip_vs_conn_out_get(IPPROTO_UDP,
					iph->daddr,
					__constant_htons(PORT_ISAKMP),
					iph->saddr,
					__constant_htons(PORT_ISAKMP));
	}

	if (!cp) {
		IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
			  "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
			  inverse ? "ICMP+" : "",
			  pp->name,
			  NIPQUAD(iph->saddr),
			  NIPQUAD(iph->daddr));
	}

	return cp;
}


static int
esp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
		  int *verdict, struct ip_vs_conn **cpp)
{
	/*
	 * ESP is only related traffic. Pass the packet to IP stack.
	 */
	*verdict = NF_ACCEPT;
	return 0;
}


static void
esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
		 int offset, const char *msg)
{
	char buf[256];
	struct iphdr _iph, *ih;

	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
	if (ih == NULL)
		sprintf(buf, "%s TRUNCATED", pp->name);
	else
		sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
			pp->name, NIPQUAD(ih->saddr),
			NIPQUAD(ih->daddr));

	printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
}


static void esp_init(struct ip_vs_protocol *pp)
{
	/* nothing to do now */
}


static void esp_exit(struct ip_vs_protocol *pp)
{
	/* nothing to do now */
}


struct ip_vs_protocol ip_vs_protocol_esp = {
	.name =			"ESP",
	.protocol =		IPPROTO_ESP,
	.dont_defrag =		1,
	.init =			esp_init,
	.exit =			esp_exit,
	.conn_schedule =	esp_conn_schedule,
	.conn_in_get =		esp_conn_in_get,
	.conn_out_get =		esp_conn_out_get,
	.snat_handler =		NULL,
	.dnat_handler =		NULL,
	.csum_check =		NULL,
	.state_transition =	NULL,
	.register_app =		NULL,
	.unregister_app =	NULL,
	.app_conn_bind =	NULL,
	.debug_packet =		esp_debug_packet,
	.timeout_change =	NULL,		/* ISAKMP */
};
Commit	Line	Data
1da177e4 LT	1	/*
	2	* ip_vs_proto_esp.c: ESP IPSec load balancing support for IPVS
	3	*
	4	* Version: $Id: ip_vs_proto_esp.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
	5	*
	6	* Authors: Julian Anastasov <ja@ssi.bg>, February 2002
	7	* Wensong Zhang <wensong@linuxvirtualserver.org>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* version 2 as published by the Free Software Foundation;
	12	*
	13	*/
	14
14c85021 ACM	15	#include <linux/in.h>
14c85021 ACM	16	#include <linux/ip.h>
1da177e4 LT	17	#include <linux/module.h>
	18	#include <linux/kernel.h>
	19	#include <linux/netfilter.h>
	20	#include <linux/netfilter_ipv4.h>
	21
	22	#include <net/ip_vs.h>
	23
	24
	25	/* TODO:
	26
	27	struct isakmp_hdr {
	28	__u8 icookie[8];
	29	__u8 rcookie[8];
	30	__u8 np;
	31	__u8 version;
	32	__u8 xchgtype;
	33	__u8 flags;
	34	__u32 msgid;
	35	__u32 length;
	36	};
	37
	38	*/
	39
	40	#define PORT_ISAKMP 500
	41
	42
	43	static struct ip_vs_conn *
	44	esp_conn_in_get(const struct sk_buff *skb,
	45	struct ip_vs_protocol *pp,
	46	const struct iphdr *iph,
	47	unsigned int proto_off,
	48	int inverse)
	49	{
	50	struct ip_vs_conn *cp;
	51
	52	if (likely(!inverse)) {
	53	cp = ip_vs_conn_in_get(IPPROTO_UDP,
	54	iph->saddr,
	55	__constant_htons(PORT_ISAKMP),
	56	iph->daddr,
	57	__constant_htons(PORT_ISAKMP));
	58	} else {
	59	cp = ip_vs_conn_in_get(IPPROTO_UDP,
	60	iph->daddr,
	61	__constant_htons(PORT_ISAKMP),
	62	iph->saddr,
	63	__constant_htons(PORT_ISAKMP));
	64	}
	65
	66	if (!cp) {
	67	/*
	68	* We are not sure if the packet is from our
	69	* service, so our conn_schedule hook should return NF_ACCEPT
	70	*/
	71	IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
	72	"%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
	73	inverse ? "ICMP+" : "",
	74	pp->name,
	75	NIPQUAD(iph->saddr),
	76	NIPQUAD(iph->daddr));
	77	}
	78
	79	return cp;
	80	}
81
82
83	static struct ip_vs_conn *
84	esp_conn_out_get(const struct sk_buff skb, struct ip_vs_protocol pp,
85	const struct iphdr *iph, unsigned int proto_off, int inverse)
86	{
87	struct ip_vs_conn *cp;
88
89	if (likely(!inverse)) {
90	cp = ip_vs_conn_out_get(IPPROTO_UDP,
91	iph->saddr,
92	__constant_htons(PORT_ISAKMP),
93	iph->daddr,
94	__constant_htons(PORT_ISAKMP));
95	} else {
96	cp = ip_vs_conn_out_get(IPPROTO_UDP,
97	iph->daddr,
98	__constant_htons(PORT_ISAKMP),
99	iph->saddr,
100	__constant_htons(PORT_ISAKMP));
101	}
102
103	if (!cp) {
104	IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
105	"%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
106	inverse ? "ICMP+" : "",
107	pp->name,
108	NIPQUAD(iph->saddr),
109	NIPQUAD(iph->daddr));
110	}
111
112	return cp;
113	}
114
115
116	static int
117	esp_conn_schedule(struct sk_buff skb, struct ip_vs_protocol pp,
118	int verdict, struct ip_vs_conn *cpp)
119	{
120	/*
121	* ESP is only related traffic. Pass the packet to IP stack.
122	*/
123	*verdict = NF_ACCEPT;
124	return 0;
125	}
126
127
128	static void
129	esp_debug_packet(struct ip_vs_protocol pp, const struct sk_buff skb,
130	int offset, const char *msg)
131	{
132	char buf[256];
133	struct iphdr _iph, *ih;
134
135	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
136	if (ih == NULL)
137	sprintf(buf, "%s TRUNCATED", pp->name);
138	else
139	sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
140	pp->name, NIPQUAD(ih->saddr),
141	NIPQUAD(ih->daddr));
142
143	printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
144	}
145
146
147	static void esp_init(struct ip_vs_protocol *pp)
148	{
149	/* nothing to do now */
150	}
151
152
153	static void esp_exit(struct ip_vs_protocol *pp)
154	{
155	/* nothing to do now */
156	}
157
158
159	struct ip_vs_protocol ip_vs_protocol_esp = {
160	.name = "ESP",
161	.protocol = IPPROTO_ESP,
162	.dont_defrag = 1,
163	.init = esp_init,
164	.exit = esp_exit,
165	.conn_schedule = esp_conn_schedule,
166	.conn_in_get = esp_conn_in_get,
167	.conn_out_get = esp_conn_out_get,
168	.snat_handler = NULL,
169	.dnat_handler = NULL,
170	.csum_check = NULL,
171	.state_transition = NULL,
172	.register_app = NULL,
173	.unregister_app = NULL,
174	.app_conn_bind = NULL,
175	.debug_packet = esp_debug_packet,
176	.timeout_change = NULL, /* ISAKMP */
177	};