1 // SPDX-License-Identifier: GPL-2.0-only
3 * ip_vs_proto_ah_esp.c: AH/ESP IPSec load balancing support for IPVS
5 * Authors: Julian Anastasov <ja@ssi.bg>, February 2002
6 * Wensong Zhang <wensong@linuxvirtualserver.org>
9 #define KMSG_COMPONENT "IPVS"
10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
14 #include <linux/module.h>
15 #include <linux/kernel.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter_ipv4.h>
19 #include <net/ip_vs.h>
37 #define PORT_ISAKMP 500
40 ah_esp_conn_fill_param_proto(struct netns_ipvs *ipvs, int af,
41 const struct ip_vs_iphdr *iph,
42 struct ip_vs_conn_param *p)
44 if (likely(!ip_vs_iph_inverse(iph)))
45 ip_vs_conn_fill_param(ipvs, af, IPPROTO_UDP,
46 &iph->saddr, htons(PORT_ISAKMP),
47 &iph->daddr, htons(PORT_ISAKMP), p);
49 ip_vs_conn_fill_param(ipvs, af, IPPROTO_UDP,
50 &iph->daddr, htons(PORT_ISAKMP),
51 &iph->saddr, htons(PORT_ISAKMP), p);
54 static struct ip_vs_conn *
55 ah_esp_conn_in_get(struct netns_ipvs *ipvs, int af, const struct sk_buff *skb,
56 const struct ip_vs_iphdr *iph)
58 struct ip_vs_conn *cp;
59 struct ip_vs_conn_param p;
61 ah_esp_conn_fill_param_proto(ipvs, af, iph, &p);
62 cp = ip_vs_conn_in_get(&p);
65 * We are not sure if the packet is from our
66 * service, so our conn_schedule hook should return NF_ACCEPT
68 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
70 ip_vs_iph_icmp(iph) ? "ICMP+" : "",
71 ip_vs_proto_get(iph->protocol)->name,
72 IP_VS_DBG_ADDR(af, &iph->saddr),
73 IP_VS_DBG_ADDR(af, &iph->daddr));
80 static struct ip_vs_conn *
81 ah_esp_conn_out_get(struct netns_ipvs *ipvs, int af, const struct sk_buff *skb,
82 const struct ip_vs_iphdr *iph)
84 struct ip_vs_conn *cp;
85 struct ip_vs_conn_param p;
87 ah_esp_conn_fill_param_proto(ipvs, af, iph, &p);
88 cp = ip_vs_conn_out_get(&p);
90 IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
92 ip_vs_iph_icmp(iph) ? "ICMP+" : "",
93 ip_vs_proto_get(iph->protocol)->name,
94 IP_VS_DBG_ADDR(af, &iph->saddr),
95 IP_VS_DBG_ADDR(af, &iph->daddr));
103 ah_esp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
104 struct ip_vs_proto_data *pd,
105 int *verdict, struct ip_vs_conn **cpp,
106 struct ip_vs_iphdr *iph)
109 * AH/ESP is only related traffic. Pass the packet to IP stack.
111 *verdict = NF_ACCEPT;
115 #ifdef CONFIG_IP_VS_PROTO_AH
116 struct ip_vs_protocol ip_vs_protocol_ah = {
118 .protocol = IPPROTO_AH,
123 .conn_schedule = ah_esp_conn_schedule,
124 .conn_in_get = ah_esp_conn_in_get,
125 .conn_out_get = ah_esp_conn_out_get,
126 .snat_handler = NULL,
127 .dnat_handler = NULL,
128 .state_transition = NULL,
129 .register_app = NULL,
130 .unregister_app = NULL,
131 .app_conn_bind = NULL,
132 .debug_packet = ip_vs_tcpudp_debug_packet,
133 .timeout_change = NULL, /* ISAKMP */
137 #ifdef CONFIG_IP_VS_PROTO_ESP
138 struct ip_vs_protocol ip_vs_protocol_esp = {
140 .protocol = IPPROTO_ESP,
145 .conn_schedule = ah_esp_conn_schedule,
146 .conn_in_get = ah_esp_conn_in_get,
147 .conn_out_get = ah_esp_conn_out_get,
148 .snat_handler = NULL,
149 .dnat_handler = NULL,
150 .state_transition = NULL,
151 .register_app = NULL,
152 .unregister_app = NULL,
153 .app_conn_bind = NULL,
154 .debug_packet = ip_vs_tcpudp_debug_packet,
155 .timeout_change = NULL, /* ISAKMP */