net/ipv4/ipvs/ip_vs_proto_ah.c

   1 /*
   2  * ip_vs_proto_ah.c:    AH IPSec load balancing support for IPVS
   3  *
   4  * Version:     $Id: ip_vs_proto_ah.c,v 1.1 2003/07/04 15:04:37 wensong Exp $
   5  *
   6  * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
   7  *              Wensong Zhang <wensong@linuxvirtualserver.org>
   8  *
   9  *              This program is free software; you can redistribute it and/or
  10  *              modify it under the terms of the GNU General Public License
  11  *              version 2 as published by the Free Software Foundation;
  12  *
  13  */
  14
  15 #include <linux/module.h>
  16 #include <linux/kernel.h>
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter_ipv4.h>
  19
  20 #include <net/ip_vs.h>
  21
  22
  23 /* TODO:
  24
  25 struct isakmp_hdr {
  26         __u8            icookie[8];
  27         __u8            rcookie[8];
  28         __u8            np;
  29         __u8            version;
  30         __u8            xchgtype;
  31         __u8            flags;
  32         __u32           msgid;
  33         __u32           length;
  34 };
  35
  36 */
  37
  38 #define PORT_ISAKMP     500
  39
  40
  41 static struct ip_vs_conn *
  42 ah_conn_in_get(const struct sk_buff *skb,
  43                struct ip_vs_protocol *pp,
  44                const struct iphdr *iph,
  45                unsigned int proto_off,
  46                int inverse)
  47 {
  48         struct ip_vs_conn *cp;
  49
  50         if (likely(!inverse)) {
  51                 cp = ip_vs_conn_in_get(IPPROTO_UDP,
  52                                        iph->saddr,
  53                                        __constant_htons(PORT_ISAKMP),
  54                                        iph->daddr,
  55                                        __constant_htons(PORT_ISAKMP));
  56         } else {
  57                 cp = ip_vs_conn_in_get(IPPROTO_UDP,
  58                                        iph->daddr,
  59                                        __constant_htons(PORT_ISAKMP),
  60                                        iph->saddr,
  61                                        __constant_htons(PORT_ISAKMP));
  62         }
  63
  64         if (!cp) {
  65                 /*
  66                  * We are not sure if the packet is from our
  67                  * service, so our conn_schedule hook should return NF_ACCEPT
  68                  */
  69                 IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
  70                           "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
  71                           inverse ? "ICMP+" : "",
  72                           pp->name,
  73                           NIPQUAD(iph->saddr),
  74                           NIPQUAD(iph->daddr));
  75         }
  76
  77         return cp;
  78 }
  79
  80
  81 static struct ip_vs_conn *
  82 ah_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
  83                 const struct iphdr *iph, unsigned int proto_off, int inverse)
  84 {
  85         struct ip_vs_conn *cp;
  86
  87         if (likely(!inverse)) {
  88                 cp = ip_vs_conn_out_get(IPPROTO_UDP,
  89                                         iph->saddr,
  90                                         __constant_htons(PORT_ISAKMP),
  91                                         iph->daddr,
  92                                         __constant_htons(PORT_ISAKMP));
  93         } else {
  94                 cp = ip_vs_conn_out_get(IPPROTO_UDP,
  95                                         iph->daddr,
  96                                         __constant_htons(PORT_ISAKMP),
  97                                         iph->saddr,
  98                                         __constant_htons(PORT_ISAKMP));
  99         }
 100
 101         if (!cp) {
 102                 IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
 103                           "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
 104                           inverse ? "ICMP+" : "",
 105                           pp->name,
 106                           NIPQUAD(iph->saddr),
 107                           NIPQUAD(iph->daddr));
 108         }
 109
 110         return cp;
 111 }
 112
 113
 114 static int
 115 ah_conn_schedule(struct sk_buff *skb,
 116                  struct ip_vs_protocol *pp,
 117                  int *verdict, struct ip_vs_conn **cpp)
 118 {
 119         /*
 120          * AH is only related traffic. Pass the packet to IP stack.
 121          */
 122         *verdict = NF_ACCEPT;
 123         return 0;
 124 }
 125
 126
 127 static void
 128 ah_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
 129                 int offset, const char *msg)
 130 {
 131         char buf[256];
 132         struct iphdr iph;
 133
 134         if (skb_copy_bits(skb, offset, &iph, sizeof(iph)) < 0)
 135                 sprintf(buf, "%s TRUNCATED", pp->name);
 136         else
 137                 sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
 138                         pp->name, NIPQUAD(iph.saddr),
 139                         NIPQUAD(iph.daddr));
 140
 141         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
 142 }
 143
 144
 145 static void ah_init(struct ip_vs_protocol *pp)
 146 {
 147         /* nothing to do now */
 148 }
 149
 150
 151 static void ah_exit(struct ip_vs_protocol *pp)
 152 {
 153         /* nothing to do now */
 154 }
 155
 156
 157 struct ip_vs_protocol ip_vs_protocol_ah = {
 158         .name =                 "AH",
 159         .protocol =             IPPROTO_AH,
 160         .dont_defrag =          1,
 161         .init =                 ah_init,
 162         .exit =                 ah_exit,
 163         .conn_schedule =        ah_conn_schedule,
 164         .conn_in_get =          ah_conn_in_get,
 165         .conn_out_get =         ah_conn_out_get,
 166         .snat_handler =         NULL,
 167         .dnat_handler =         NULL,
 168         .csum_check =           NULL,
 169         .state_transition =     NULL,
 170         .register_app =         NULL,
 171         .unregister_app =       NULL,
 172         .app_conn_bind =        NULL,
 173         .debug_packet =         ah_debug_packet,
 174         .timeout_change =       NULL,           /* ISAKMP */
 175         .set_state_timeout =    NULL,
 176 };