1 /* $NetBSD: if_ipsec.h,v 1.8 2022/01/17 20:56:03 andvar Exp $ */ 2 3 /* 4 * Copyright (c) 2017 Internet Initiative Japan Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * if_ipsec.h 31 */ 32 33 #ifndef _NET_IF_IPSEC_H_ 34 #define _NET_IF_IPSEC_H_ 35 36 #include <sys/queue.h> 37 #ifdef _KERNEL 38 #include <sys/pserialize.h> 39 #include <sys/psref.h> 40 #endif 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #endif 45 46 #include <netinet/in.h> 47 #include <netipsec/ipsec.h> 48 49 #ifdef _KERNEL 50 /* 51 * This macro controls the upper limitation on nesting of ipsec tunnels. 52 * Since, setting a large value to this macro with a careless configuration 53 * may introduce system crash, we don't allow any nestings by default. 54 * If you need to configure nested ipsec tunnels, you can define this macro 55 * in your kernel configuration file. However, if you do so, please be 56 * careful to configure the tunnels so that it won't make a loop. 57 */ 58 #ifndef MAX_IPSEC_NEST 59 #define MAX_IPSEC_NEST 1 60 #endif 61 62 #define IFF_NAT_T IFF_LINK0 /* enable NAT-T */ 63 #define IFF_ECN IFF_LINK1 /* enable ECN */ 64 #define IFF_FWD_IPV6 IFF_LINK2 /* forward IPv6 packet */ 65 66 extern struct psref_class *iv_psref_class; 67 68 struct ipsec_variant { 69 struct ipsec_softc *iv_softc; 70 71 struct sockaddr *iv_psrc; /* Physical src addr */ 72 struct sockaddr *iv_pdst; /* Physical dst addr */ 73 const struct encaptab *iv_encap_cookie4; 74 const struct encaptab *iv_encap_cookie6; 75 int (*iv_output)(struct ipsec_variant *, int, struct mbuf *); 76 in_port_t iv_sport; 77 in_port_t iv_dport; 78 79 /* 80 * IPsec SPs 81 * Don't change directly, use if_ipsec_replace_sp(). 82 */ 83 struct secpolicy *iv_sp[IPSEC_DIR_MAX]; 84 struct secpolicy *iv_sp6[IPSEC_DIR_MAX]; 85 86 struct psref_target iv_psref; 87 }; 88 89 struct ipsec_softc { 90 struct ifnet ipsec_if; /* common area - must be at the top */ 91 percpu_t *ipsec_ro_percpu; /* struct tunnel_ro */ 92 struct ipsec_variant *ipsec_var; /* 93 * reader must use ipsec_getref_variant() 94 * instead of direct dereference. 95 */ 96 kmutex_t ipsec_lock; /* writer lock for ipsec_var */ 97 pserialize_t ipsec_psz; 98 int ipsec_pmtu; 99 100 LIST_ENTRY(ipsec_softc) ipsec_list; /* list of all gifs */ 101 }; 102 103 #define IPSEC_MTU (1280) /* Default MTU */ 104 #define IPSEC_MTU_MIN (1280) /* Minimum MTU */ 105 #define IPSEC_MTU_MAX (8192) /* Maximum MTU */ 106 107 #define IV_SP_IN(x) ((x)->iv_sp[IPSEC_DIR_INBOUND]) 108 #define IV_SP_IN6(x) ((x)->iv_sp6[IPSEC_DIR_INBOUND]) 109 #define IV_SP_OUT(x) ((x)->iv_sp[IPSEC_DIR_OUTBOUND]) 110 #define IV_SP_OUT6(x) ((x)->iv_sp6[IPSEC_DIR_OUTBOUND]) 111 112 static __inline bool 113 if_ipsec_variant_is_configured(struct ipsec_variant *var) 114 { 115 116 return (var->iv_psrc != NULL && var->iv_pdst != NULL); 117 } 118 119 static __inline bool 120 if_ipsec_variant_is_unconfigured(struct ipsec_variant *var) 121 { 122 123 return (var->iv_psrc == NULL || var->iv_pdst == NULL); 124 } 125 126 static __inline void 127 if_ipsec_copy_variant(struct ipsec_variant *dst, struct ipsec_variant *src) 128 { 129 130 dst->iv_softc = src->iv_softc; 131 dst->iv_psrc = src->iv_psrc; 132 dst->iv_pdst = src->iv_pdst; 133 dst->iv_encap_cookie4 = src->iv_encap_cookie4; 134 dst->iv_encap_cookie6 = src->iv_encap_cookie6; 135 dst->iv_output = src->iv_output; 136 dst->iv_sport = src->iv_sport; 137 dst->iv_dport = src->iv_dport; 138 } 139 140 static __inline void 141 if_ipsec_clear_config(struct ipsec_variant *var) 142 { 143 144 var->iv_psrc = NULL; 145 var->iv_pdst = NULL; 146 var->iv_encap_cookie4 = NULL; 147 var->iv_encap_cookie6 = NULL; 148 var->iv_output = NULL; 149 var->iv_sport = 0; 150 var->iv_dport = 0; 151 } 152 153 /* 154 * Get ipsec_variant from ipsec_softc. 155 * 156 * Never return NULL by contract. 157 * ipsec_variant itself is protected not to be freed by lv_psref. 158 * Once a reader dereference sc->sc_var by this API, the reader must not 159 * re-dereference from sc->sc_var. 160 */ 161 static __inline struct ipsec_variant * 162 if_ipsec_getref_variant(struct ipsec_softc *sc, struct psref *psref) 163 { 164 struct ipsec_variant *var; 165 int s; 166 167 s = pserialize_read_enter(); 168 var = atomic_load_consume(&sc->ipsec_var); 169 KASSERT(var != NULL); 170 psref_acquire(psref, &var->iv_psref, iv_psref_class); 171 pserialize_read_exit(s); 172 173 return var; 174 } 175 176 static __inline void 177 if_ipsec_putref_variant(struct ipsec_variant *var, struct psref *psref) 178 { 179 180 KASSERT(var != NULL); 181 psref_release(psref, &var->iv_psref, iv_psref_class); 182 } 183 184 static __inline bool 185 if_ipsec_heldref_variant(struct ipsec_variant *var) 186 { 187 188 return psref_held(&var->iv_psref, iv_psref_class); 189 } 190 191 void ipsecifattach(int); 192 int if_ipsec_encap_func(struct mbuf *, int, int, void *); 193 void if_ipsec_input(struct mbuf *, int, struct ifnet *); 194 int if_ipsec_output(struct ifnet *, struct mbuf *, 195 const struct sockaddr *, const struct rtentry *); 196 int if_ipsec_ioctl(struct ifnet *, u_long, void *); 197 #endif /* _KERNEL */ 198 199 /* 200 * sharing SP note: 201 * When ipsec(4) I/Fs use NAT-T, they can use the same src and dst address pair 202 * as long as they use different port. Howerver, SPD cannot have the SPs which 203 * use the same src and dst address pair and the same policy. So, such ipsec(4) 204 * I/Fs share the same SPs. 205 * To avoid race between ipsec0 set_tunnel/delete_tunnel and ipsec1 206 * t_tunnel/delete_tunnel, any global lock is needed. See also the following 207 * locking notes. 208 * 209 * Locking notes: 210 * + ipsec_softcs.list is protected by ipsec_softcs.lock (an adaptive mutex) 211 * ipsec_softc_list is list of all ipsec_softcs. It is used by ioctl 212 * context only. 213 * + ipsec_softc->ipsec_var is protected by 214 * - ipsec_softc->ipsec_lock (an adaptive mutex) for writer 215 * - ipsec_var->iv_psref for reader 216 * ipsec_softc->ipsec_var is used for variant values while the ipsec tunnel 217 * exists. 218 * + struct tunnel_ro->tr_ro is protected by struct tunnel_ro->tr_lock. 219 * This lock is required to exclude softnet/0 lwp(such as output 220 * processing softint) and processing lwp(such as DAD timer processing). 221 * + if_ipsec_share_sp() and if_ipsec_unshare_sp() operations are serialized by 222 * encap_lock 223 * This only need to be global lock, need not to be encap_lock. 224 * 225 * Locking order: 226 * - encap_lock => ipsec_softc->ipsec_lock => ipsec_softcs.lock 227 */ 228 #endif /* _NET_IF_IPSEC_H_ */ 229
Indexes created Sun Sep 21 16:09:51 GMT 2025