2005-04-17 00:20:36 +02:00
|
|
|
/*
|
2008-08-22 14:06:12 +02:00
|
|
|
* ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
|
2005-04-17 00:20:36 +02:00
|
|
|
*
|
|
|
|
* Authors: Julian Anastasov <ja@ssi.bg>, February 2002
|
|
|
|
* Wensong Zhang <wensong@linuxvirtualserver.org>
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* version 2 as published by the Free Software Foundation;
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
2009-07-30 23:29:44 +02:00
|
|
|
#define KMSG_COMPONENT "IPVS"
|
|
|
|
#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
|
|
|
|
|
2005-12-27 05:43:12 +01:00
|
|
|
#include <linux/in.h>
|
|
|
|
#include <linux/ip.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/netfilter.h>
|
|
|
|
#include <linux/netfilter_ipv4.h>
|
|
|
|
|
|
|
|
#include <net/ip_vs.h>
|
|
|
|
|
|
|
|
|
|
|
|
/* TODO:
|
|
|
|
|
|
|
|
struct isakmp_hdr {
|
|
|
|
__u8 icookie[8];
|
|
|
|
__u8 rcookie[8];
|
|
|
|
__u8 np;
|
|
|
|
__u8 version;
|
|
|
|
__u8 xchgtype;
|
|
|
|
__u8 flags;
|
|
|
|
__u32 msgid;
|
|
|
|
__u32 length;
|
|
|
|
};
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define PORT_ISAKMP 500
|
|
|
|
|
2010-08-22 14:37:52 +02:00
|
|
|
static void
|
2011-01-03 14:44:57 +01:00
|
|
|
ah_esp_conn_fill_param_proto(struct net *net, int af,
|
|
|
|
const struct ip_vs_iphdr *iph, int inverse,
|
|
|
|
struct ip_vs_conn_param *p)
|
2010-08-22 14:37:52 +02:00
|
|
|
{
|
|
|
|
if (likely(!inverse))
|
2011-01-03 14:44:57 +01:00
|
|
|
ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
|
2010-08-22 14:37:52 +02:00
|
|
|
&iph->saddr, htons(PORT_ISAKMP),
|
|
|
|
&iph->daddr, htons(PORT_ISAKMP), p);
|
|
|
|
else
|
2011-01-03 14:44:57 +01:00
|
|
|
ip_vs_conn_fill_param(net, af, IPPROTO_UDP,
|
2010-08-22 14:37:52 +02:00
|
|
|
&iph->daddr, htons(PORT_ISAKMP),
|
|
|
|
&iph->saddr, htons(PORT_ISAKMP), p);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
static struct ip_vs_conn *
|
2011-01-03 14:44:51 +01:00
|
|
|
ah_esp_conn_in_get(int af, const struct sk_buff *skb,
|
2008-09-02 15:55:40 +02:00
|
|
|
const struct ip_vs_iphdr *iph, unsigned int proto_off,
|
2008-08-22 14:06:12 +02:00
|
|
|
int inverse)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct ip_vs_conn *cp;
|
2010-08-22 14:37:52 +02:00
|
|
|
struct ip_vs_conn_param p;
|
2011-01-03 14:44:57 +01:00
|
|
|
struct net *net = skb_net(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2011-01-03 14:44:57 +01:00
|
|
|
ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
|
2010-08-22 14:37:52 +02:00
|
|
|
cp = ip_vs_conn_in_get(&p);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!cp) {
|
|
|
|
/*
|
|
|
|
* We are not sure if the packet is from our
|
|
|
|
* service, so our conn_schedule hook should return NF_ACCEPT
|
|
|
|
*/
|
2008-09-02 15:55:40 +02:00
|
|
|
IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
|
|
|
|
"%s%s %s->%s\n",
|
|
|
|
inverse ? "ICMP+" : "",
|
2011-01-03 14:44:51 +01:00
|
|
|
ip_vs_proto_get(iph->protocol)->name,
|
2008-09-02 15:55:40 +02:00
|
|
|
IP_VS_DBG_ADDR(af, &iph->saddr),
|
|
|
|
IP_VS_DBG_ADDR(af, &iph->daddr));
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return cp;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static struct ip_vs_conn *
|
2008-09-02 15:55:40 +02:00
|
|
|
ah_esp_conn_out_get(int af, const struct sk_buff *skb,
|
|
|
|
const struct ip_vs_iphdr *iph,
|
|
|
|
unsigned int proto_off,
|
|
|
|
int inverse)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct ip_vs_conn *cp;
|
2010-08-22 14:37:52 +02:00
|
|
|
struct ip_vs_conn_param p;
|
2011-01-03 14:44:57 +01:00
|
|
|
struct net *net = skb_net(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2011-01-03 14:44:57 +01:00
|
|
|
ah_esp_conn_fill_param_proto(net, af, iph, inverse, &p);
|
2010-08-22 14:37:52 +02:00
|
|
|
cp = ip_vs_conn_out_get(&p);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!cp) {
|
2008-09-02 15:55:40 +02:00
|
|
|
IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
|
|
|
|
"%s%s %s->%s\n",
|
|
|
|
inverse ? "ICMP+" : "",
|
2011-01-03 14:44:51 +01:00
|
|
|
ip_vs_proto_get(iph->protocol)->name,
|
2008-09-02 15:55:40 +02:00
|
|
|
IP_VS_DBG_ADDR(af, &iph->saddr),
|
|
|
|
IP_VS_DBG_ADDR(af, &iph->daddr));
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return cp;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
2011-01-03 14:44:51 +01:00
|
|
|
ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
|
2008-08-22 14:06:12 +02:00
|
|
|
int *verdict, struct ip_vs_conn **cpp)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
/*
|
2008-08-22 14:06:12 +02:00
|
|
|
* AH/ESP is only related traffic. Pass the packet to IP stack.
|
2005-04-17 00:20:36 +02:00
|
|
|
*/
|
|
|
|
*verdict = NF_ACCEPT;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-08-22 14:06:12 +02:00
|
|
|
#ifdef CONFIG_IP_VS_PROTO_AH
|
2005-04-17 00:20:36 +02:00
|
|
|
struct ip_vs_protocol ip_vs_protocol_ah = {
|
|
|
|
.name = "AH",
|
|
|
|
.protocol = IPPROTO_AH,
|
2008-04-29 12:21:23 +02:00
|
|
|
.num_states = 1,
|
2005-04-17 00:20:36 +02:00
|
|
|
.dont_defrag = 1,
|
2011-01-03 14:44:50 +01:00
|
|
|
.init = NULL,
|
|
|
|
.exit = NULL,
|
2008-08-22 14:06:12 +02:00
|
|
|
.conn_schedule = ah_esp_conn_schedule,
|
|
|
|
.conn_in_get = ah_esp_conn_in_get,
|
|
|
|
.conn_out_get = ah_esp_conn_out_get,
|
2005-04-17 00:20:36 +02:00
|
|
|
.snat_handler = NULL,
|
|
|
|
.dnat_handler = NULL,
|
|
|
|
.csum_check = NULL,
|
|
|
|
.state_transition = NULL,
|
|
|
|
.register_app = NULL,
|
|
|
|
.unregister_app = NULL,
|
|
|
|
.app_conn_bind = NULL,
|
2010-10-17 15:46:17 +02:00
|
|
|
.debug_packet = ip_vs_tcpudp_debug_packet,
|
2005-04-17 00:20:36 +02:00
|
|
|
.timeout_change = NULL, /* ISAKMP */
|
|
|
|
};
|
2008-08-22 14:06:12 +02:00
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef CONFIG_IP_VS_PROTO_ESP
|
|
|
|
struct ip_vs_protocol ip_vs_protocol_esp = {
|
|
|
|
.name = "ESP",
|
|
|
|
.protocol = IPPROTO_ESP,
|
|
|
|
.num_states = 1,
|
|
|
|
.dont_defrag = 1,
|
2011-01-03 14:44:50 +01:00
|
|
|
.init = NULL,
|
|
|
|
.exit = NULL,
|
2008-08-22 14:06:12 +02:00
|
|
|
.conn_schedule = ah_esp_conn_schedule,
|
|
|
|
.conn_in_get = ah_esp_conn_in_get,
|
|
|
|
.conn_out_get = ah_esp_conn_out_get,
|
|
|
|
.snat_handler = NULL,
|
|
|
|
.dnat_handler = NULL,
|
|
|
|
.csum_check = NULL,
|
|
|
|
.state_transition = NULL,
|
|
|
|
.register_app = NULL,
|
|
|
|
.unregister_app = NULL,
|
|
|
|
.app_conn_bind = NULL,
|
2010-10-17 15:46:17 +02:00
|
|
|
.debug_packet = ip_vs_tcpudp_debug_packet,
|
2008-08-22 14:06:12 +02:00
|
|
|
.timeout_change = NULL, /* ISAKMP */
|
|
|
|
};
|
|
|
|
#endif
|