[INET]: Generalise tcp_v4_lookup_listener
[linux-2.6] / net / ipv4 / ipvs / ip_vs_proto_esp.c
1 /*
2  * ip_vs_proto_esp.c:   ESP IPSec load balancing support for IPVS
3  *
4  * Version:     $Id: ip_vs_proto_esp.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
5  *
6  * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
7  *              Wensong Zhang <wensong@linuxvirtualserver.org>
8  *
9  *              This program is free software; you can redistribute it and/or
10  *              modify it under the terms of the GNU General Public License
11  *              version 2 as published by the Free Software Foundation;
12  *
13  */
14
15 #include <linux/module.h>
16 #include <linux/kernel.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv4.h>
19
20 #include <net/ip_vs.h>
21
22
23 /* TODO:
24
25 struct isakmp_hdr {
26         __u8            icookie[8];
27         __u8            rcookie[8];
28         __u8            np;
29         __u8            version;
30         __u8            xchgtype;
31         __u8            flags;
32         __u32           msgid;
33         __u32           length;
34 };
35
36 */
37
38 #define PORT_ISAKMP     500
39
40
41 static struct ip_vs_conn *
42 esp_conn_in_get(const struct sk_buff *skb,
43                 struct ip_vs_protocol *pp,
44                 const struct iphdr *iph,
45                 unsigned int proto_off,
46                 int inverse)
47 {
48         struct ip_vs_conn *cp;
49
50         if (likely(!inverse)) {
51                 cp = ip_vs_conn_in_get(IPPROTO_UDP,
52                                        iph->saddr,
53                                        __constant_htons(PORT_ISAKMP),
54                                        iph->daddr,
55                                        __constant_htons(PORT_ISAKMP));
56         } else {
57                 cp = ip_vs_conn_in_get(IPPROTO_UDP,
58                                        iph->daddr,
59                                        __constant_htons(PORT_ISAKMP),
60                                        iph->saddr,
61                                        __constant_htons(PORT_ISAKMP));
62         }
63
64         if (!cp) {
65                 /*
66                  * We are not sure if the packet is from our
67                  * service, so our conn_schedule hook should return NF_ACCEPT
68                  */
69                 IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
70                           "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
71                           inverse ? "ICMP+" : "",
72                           pp->name,
73                           NIPQUAD(iph->saddr),
74                           NIPQUAD(iph->daddr));
75         }
76
77         return cp;
78 }
79
80
81 static struct ip_vs_conn *
82 esp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
83                  const struct iphdr *iph, unsigned int proto_off, int inverse)
84 {
85         struct ip_vs_conn *cp;
86
87         if (likely(!inverse)) {
88                 cp = ip_vs_conn_out_get(IPPROTO_UDP,
89                                         iph->saddr,
90                                         __constant_htons(PORT_ISAKMP),
91                                         iph->daddr,
92                                         __constant_htons(PORT_ISAKMP));
93         } else {
94                 cp = ip_vs_conn_out_get(IPPROTO_UDP,
95                                         iph->daddr,
96                                         __constant_htons(PORT_ISAKMP),
97                                         iph->saddr,
98                                         __constant_htons(PORT_ISAKMP));
99         }
100
101         if (!cp) {
102                 IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
103                           "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
104                           inverse ? "ICMP+" : "",
105                           pp->name,
106                           NIPQUAD(iph->saddr),
107                           NIPQUAD(iph->daddr));
108         }
109
110         return cp;
111 }
112
113
114 static int
115 esp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
116                   int *verdict, struct ip_vs_conn **cpp)
117 {
118         /*
119          * ESP is only related traffic. Pass the packet to IP stack.
120          */
121         *verdict = NF_ACCEPT;
122         return 0;
123 }
124
125
126 static void
127 esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
128                  int offset, const char *msg)
129 {
130         char buf[256];
131         struct iphdr _iph, *ih;
132
133         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
134         if (ih == NULL)
135                 sprintf(buf, "%s TRUNCATED", pp->name);
136         else
137                 sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
138                         pp->name, NIPQUAD(ih->saddr),
139                         NIPQUAD(ih->daddr));
140
141         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
142 }
143
144
145 static void esp_init(struct ip_vs_protocol *pp)
146 {
147         /* nothing to do now */
148 }
149
150
151 static void esp_exit(struct ip_vs_protocol *pp)
152 {
153         /* nothing to do now */
154 }
155
156
157 struct ip_vs_protocol ip_vs_protocol_esp = {
158         .name =                 "ESP",
159         .protocol =             IPPROTO_ESP,
160         .dont_defrag =          1,
161         .init =                 esp_init,
162         .exit =                 esp_exit,
163         .conn_schedule =        esp_conn_schedule,
164         .conn_in_get =          esp_conn_in_get,
165         .conn_out_get =         esp_conn_out_get,
166         .snat_handler =         NULL,
167         .dnat_handler =         NULL,
168         .csum_check =           NULL,
169         .state_transition =     NULL,
170         .register_app =         NULL,
171         .unregister_app =       NULL,
172         .app_conn_bind =        NULL,
173         .debug_packet =         esp_debug_packet,
174         .timeout_change =       NULL,           /* ISAKMP */
175 };