2 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
4 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
5 * Wensong Zhang <wensong@linuxvirtualserver.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation;
15 #include <linux/module.h>
16 #include <linux/kernel.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv4.h>
20 #include <net/ip_vs.h>
38 #define PORT_ISAKMP 500
41 static struct ip_vs_conn *
42 ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
43 const struct ip_vs_iphdr *iph, unsigned int proto_off,
46 struct ip_vs_conn *cp;
48 if (likely(!inverse)) {
49 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
55 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
64 * We are not sure if the packet is from our
65 * service, so our conn_schedule hook should return NF_ACCEPT
67 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
69 inverse ? "ICMP+" : "",
71 IP_VS_DBG_ADDR(af, &iph->saddr),
72 IP_VS_DBG_ADDR(af, &iph->daddr));
79 static struct ip_vs_conn *
80 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
81 struct ip_vs_protocol *pp,
82 const struct ip_vs_iphdr *iph,
83 unsigned int proto_off,
86 struct ip_vs_conn *cp;
88 if (likely(!inverse)) {
89 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
95 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
103 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
105 inverse ? "ICMP+" : "",
107 IP_VS_DBG_ADDR(af, &iph->saddr),
108 IP_VS_DBG_ADDR(af, &iph->daddr));
116 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
117 int *verdict, struct ip_vs_conn **cpp)
120 * AH/ESP is only related traffic. Pass the packet to IP stack.
122 *verdict = NF_ACCEPT;
128 ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
129 int offset, const char *msg)
132 struct iphdr _iph, *ih;
134 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
136 sprintf(buf, "%s TRUNCATED", pp->name);
138 sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
139 pp->name, NIPQUAD(ih->saddr),
142 printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
145 #ifdef CONFIG_IP_VS_IPV6
147 ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
148 int offset, const char *msg)
151 struct ipv6hdr _iph, *ih;
153 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
155 sprintf(buf, "%s TRUNCATED", pp->name);
157 sprintf(buf, "%s " NIP6_FMT "->" NIP6_FMT,
158 pp->name, NIP6(ih->saddr),
161 printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
166 ah_esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
167 int offset, const char *msg)
169 #ifdef CONFIG_IP_VS_IPV6
170 if (skb->protocol == htons(ETH_P_IPV6))
171 ah_esp_debug_packet_v6(pp, skb, offset, msg);
174 ah_esp_debug_packet_v4(pp, skb, offset, msg);
178 static void ah_esp_init(struct ip_vs_protocol *pp)
180 /* nothing to do now */
184 static void ah_esp_exit(struct ip_vs_protocol *pp)
186 /* nothing to do now */
190 #ifdef CONFIG_IP_VS_PROTO_AH
191 struct ip_vs_protocol ip_vs_protocol_ah = {
193 .protocol = IPPROTO_AH,
198 .conn_schedule = ah_esp_conn_schedule,
199 .conn_in_get = ah_esp_conn_in_get,
200 .conn_out_get = ah_esp_conn_out_get,
201 .snat_handler = NULL,
202 .dnat_handler = NULL,
204 .state_transition = NULL,
205 .register_app = NULL,
206 .unregister_app = NULL,
207 .app_conn_bind = NULL,
208 .debug_packet = ah_esp_debug_packet,
209 .timeout_change = NULL, /* ISAKMP */
210 .set_state_timeout = NULL,
214 #ifdef CONFIG_IP_VS_PROTO_ESP
215 struct ip_vs_protocol ip_vs_protocol_esp = {
217 .protocol = IPPROTO_ESP,
222 .conn_schedule = ah_esp_conn_schedule,
223 .conn_in_get = ah_esp_conn_in_get,
224 .conn_out_get = ah_esp_conn_out_get,
225 .snat_handler = NULL,
226 .dnat_handler = NULL,
228 .state_transition = NULL,
229 .register_app = NULL,
230 .unregister_app = NULL,
231 .app_conn_bind = NULL,
232 .debug_packet = ah_esp_debug_packet,
233 .timeout_change = NULL, /* ISAKMP */