net/netfilter/ipvs/ip_vs_proto_ah_esp.c

   1 /*
   2  * ip_vs_proto_ah_esp.c:        AH/ESP IPSec load balancing support for IPVS
   3  *
   4  * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
   5  *              Wensong Zhang <wensong@linuxvirtualserver.org>
   6  *
   7  *              This program is free software; you can redistribute it and/or
   8  *              modify it under the terms of the GNU General Public License
   9  *              version 2 as published by the Free Software Foundation;
  10  *
  11  */
  12
  13 #include <linux/in.h>
  14 #include <linux/ip.h>
  15 #include <linux/module.h>
  16 #include <linux/kernel.h>
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter_ipv4.h>
  19
  20 #include <net/ip_vs.h>
  21
  22
  23 /* TODO:
  24
  25 struct isakmp_hdr {
  26         __u8            icookie[8];
  27         __u8            rcookie[8];
  28         __u8            np;
  29         __u8            version;
  30         __u8            xchgtype;
  31         __u8            flags;
  32         __u32           msgid;
  33         __u32           length;
  34 };
  35
  36 */
  37
  38 #define PORT_ISAKMP     500
  39
  40
  41 static struct ip_vs_conn *
  42 ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
  43                    const struct ip_vs_iphdr *iph, unsigned int proto_off,
  44                    int inverse)
  45 {
  46         struct ip_vs_conn *cp;
  47
  48         if (likely(!inverse)) {
  49                 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
  50                                        &iph->saddr,
  51                                        htons(PORT_ISAKMP),
  52                                        &iph->daddr,
  53                                        htons(PORT_ISAKMP));
  54         } else {
  55                 cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
  56                                        &iph->daddr,
  57                                        htons(PORT_ISAKMP),
  58                                        &iph->saddr,
  59                                        htons(PORT_ISAKMP));
  60         }
  61
  62         if (!cp) {
  63                 /*
  64                  * We are not sure if the packet is from our
  65                  * service, so our conn_schedule hook should return NF_ACCEPT
  66                  */
  67                 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
  68                               "%s%s %s->%s\n",
  69                               inverse ? "ICMP+" : "",
  70                               pp->name,
  71                               IP_VS_DBG_ADDR(af, &iph->saddr),
  72                               IP_VS_DBG_ADDR(af, &iph->daddr));
  73         }
  74
  75         return cp;
  76 }
  77
  78
  79 static struct ip_vs_conn *
  80 ah_esp_conn_out_get(int af, const struct sk_buff *skb,
  81                     struct ip_vs_protocol *pp,
  82                     const struct ip_vs_iphdr *iph,
  83                     unsigned int proto_off,
  84                     int inverse)
  85 {
  86         struct ip_vs_conn *cp;
  87
  88         if (likely(!inverse)) {
  89                 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
  90                                         &iph->saddr,
  91                                         htons(PORT_ISAKMP),
  92                                         &iph->daddr,
  93                                         htons(PORT_ISAKMP));
  94         } else {
  95                 cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
  96                                         &iph->daddr,
  97                                         htons(PORT_ISAKMP),
  98                                         &iph->saddr,
  99                                         htons(PORT_ISAKMP));
 100         }
 101
 102         if (!cp) {
 103                 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
 104                               "%s%s %s->%s\n",
 105                               inverse ? "ICMP+" : "",
 106                               pp->name,
 107                               IP_VS_DBG_ADDR(af, &iph->saddr),
 108                               IP_VS_DBG_ADDR(af, &iph->daddr));
 109         }
 110
 111         return cp;
 112 }
 113
 114
 115 static int
 116 ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
 117                      int *verdict, struct ip_vs_conn **cpp)
 118 {
 119         /*
 120          * AH/ESP is only related traffic. Pass the packet to IP stack.
 121          */
 122         *verdict = NF_ACCEPT;
 123         return 0;
 124 }
 125
 126
 127 static void
 128 ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
 129                        int offset, const char *msg)
 130 {
 131         char buf[256];
 132         struct iphdr _iph, *ih;
 133
 134         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
 135         if (ih == NULL)
 136                 sprintf(buf, "%s TRUNCATED", pp->name);
 137         else
 138                 sprintf(buf, "%s %pI4->%pI4",
 139                         pp->name, &ih->saddr, &ih->daddr);
 140
 141         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
 142 }
 143
 144 #ifdef CONFIG_IP_VS_IPV6
 145 static void
 146 ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
 147                        int offset, const char *msg)
 148 {
 149         char buf[256];
 150         struct ipv6hdr _iph, *ih;
 151
 152         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
 153         if (ih == NULL)
 154                 sprintf(buf, "%s TRUNCATED", pp->name);
 155         else
 156                 sprintf(buf, "%s %pI6->%pI6",
 157                         pp->name, &ih->saddr, &ih->daddr);
 158
 159         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
 160 }
 161 #endif
 162
 163 static void
 164 ah_esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
 165                     int offset, const char *msg)
 166 {
 167 #ifdef CONFIG_IP_VS_IPV6
 168         if (skb->protocol == htons(ETH_P_IPV6))
 169                 ah_esp_debug_packet_v6(pp, skb, offset, msg);
 170         else
 171 #endif
 172                 ah_esp_debug_packet_v4(pp, skb, offset, msg);
 173 }
 174
 175
 176 static void ah_esp_init(struct ip_vs_protocol *pp)
 177 {
 178         /* nothing to do now */
 179 }
 180
 181
 182 static void ah_esp_exit(struct ip_vs_protocol *pp)
 183 {
 184         /* nothing to do now */
 185 }
 186
 187
 188 #ifdef CONFIG_IP_VS_PROTO_AH
 189 struct ip_vs_protocol ip_vs_protocol_ah = {
 190         .name =                 "AH",
 191         .protocol =             IPPROTO_AH,
 192         .num_states =           1,
 193         .dont_defrag =          1,
 194         .init =                 ah_esp_init,
 195         .exit =                 ah_esp_exit,
 196         .conn_schedule =        ah_esp_conn_schedule,
 197         .conn_in_get =          ah_esp_conn_in_get,
 198         .conn_out_get =         ah_esp_conn_out_get,
 199         .snat_handler =         NULL,
 200         .dnat_handler =         NULL,
 201         .csum_check =           NULL,
 202         .state_transition =     NULL,
 203         .register_app =         NULL,
 204         .unregister_app =       NULL,
 205         .app_conn_bind =        NULL,
 206         .debug_packet =         ah_esp_debug_packet,
 207         .timeout_change =       NULL,           /* ISAKMP */
 208         .set_state_timeout =    NULL,
 209 };
 210 #endif
 211
 212 #ifdef CONFIG_IP_VS_PROTO_ESP
 213 struct ip_vs_protocol ip_vs_protocol_esp = {
 214         .name =                 "ESP",
 215         .protocol =             IPPROTO_ESP,
 216         .num_states =           1,
 217         .dont_defrag =          1,
 218         .init =                 ah_esp_init,
 219         .exit =                 ah_esp_exit,
 220         .conn_schedule =        ah_esp_conn_schedule,
 221         .conn_in_get =          ah_esp_conn_in_get,
 222         .conn_out_get =         ah_esp_conn_out_get,
 223         .snat_handler =         NULL,
 224         .dnat_handler =         NULL,
 225         .csum_check =           NULL,
 226         .state_transition =     NULL,
 227         .register_app =         NULL,
 228         .unregister_app =       NULL,
 229         .app_conn_bind =        NULL,
 230         .debug_packet =         ah_esp_debug_packet,
 231         .timeout_change =       NULL,           /* ISAKMP */
 232 };
 233 #endif