if_ipsec.h revision 1.1.2.2
1 1.1.2.2 snj /* $NetBSD: if_ipsec.h,v 1.1.2.2 2018/02/11 21:17:34 snj Exp $ */ 2 1.1.2.2 snj 3 1.1.2.2 snj /* 4 1.1.2.2 snj * Copyright (c) 2017 Internet Initiative Japan Inc. 5 1.1.2.2 snj * All rights reserved. 6 1.1.2.2 snj * 7 1.1.2.2 snj * Redistribution and use in source and binary forms, with or without 8 1.1.2.2 snj * modification, are permitted provided that the following conditions 9 1.1.2.2 snj * are met: 10 1.1.2.2 snj * 1. Redistributions of source code must retain the above copyright 11 1.1.2.2 snj * notice, this list of conditions and the following disclaimer. 12 1.1.2.2 snj * 2. Redistributions in binary form must reproduce the above copyright 13 1.1.2.2 snj * notice, this list of conditions and the following disclaimer in the 14 1.1.2.2 snj * documentation and/or other materials provided with the distribution. 15 1.1.2.2 snj * 16 1.1.2.2 snj * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 1.1.2.2 snj * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 1.1.2.2 snj * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 1.1.2.2 snj * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 1.1.2.2 snj * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 1.1.2.2 snj * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 1.1.2.2 snj * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 1.1.2.2 snj * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 1.1.2.2 snj * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 1.1.2.2 snj * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 1.1.2.2 snj * POSSIBILITY OF SUCH DAMAGE. 27 1.1.2.2 snj */ 28 1.1.2.2 snj 29 1.1.2.2 snj /* 30 1.1.2.2 snj * if_ipsec.h 31 1.1.2.2 snj */ 32 1.1.2.2 snj 33 1.1.2.2 snj #ifndef _NET_IF_IPSEC_H_ 34 1.1.2.2 snj #define _NET_IF_IPSEC_H_ 35 1.1.2.2 snj 36 1.1.2.2 snj #include <sys/queue.h> 37 1.1.2.2 snj #ifdef _KERNEL 38 1.1.2.2 snj #include <sys/psref.h> 39 1.1.2.2 snj #endif 40 1.1.2.2 snj 41 1.1.2.2 snj #ifdef _KERNEL_OPT 42 1.1.2.2 snj #include "opt_inet.h" 43 1.1.2.2 snj #endif 44 1.1.2.2 snj 45 1.1.2.2 snj #include <netinet/in.h> 46 1.1.2.2 snj #include <netipsec/ipsec.h> 47 1.1.2.2 snj 48 1.1.2.2 snj #ifdef _KERNEL 49 1.1.2.2 snj /* 50 1.1.2.2 snj * This macro controls the upper limitation on nesting of ipsec tunnels. 51 1.1.2.2 snj * Since, setting a large value to this macro with a careless configuration 52 1.1.2.2 snj * may introduce system crash, we don't allow any nestings by default. 53 1.1.2.2 snj * If you need to configure nested ipsec tunnels, you can define this macro 54 1.1.2.2 snj * in your kernel configuration file. However, if you do so, please be 55 1.1.2.2 snj * careful to configure the tunnels so that it won't make a loop. 56 1.1.2.2 snj */ 57 1.1.2.2 snj #ifndef MAX_IPSEC_NEST 58 1.1.2.2 snj #define MAX_IPSEC_NEST 1 59 1.1.2.2 snj #endif 60 1.1.2.2 snj 61 1.1.2.2 snj #define IFF_NAT_T IFF_LINK0 /* enable NAT-T */ 62 1.1.2.2 snj #define IFF_ECN IFF_LINK1 /* enable ECN */ 63 1.1.2.2 snj #define IFF_FWD_IPV6 IFF_LINK2 /* foward IPv6 packet */ 64 1.1.2.2 snj 65 1.1.2.2 snj extern struct psref_class *iv_psref_class; 66 1.1.2.2 snj 67 1.1.2.2 snj struct ipsec_variant { 68 1.1.2.2 snj struct ipsec_softc *iv_softc; 69 1.1.2.2 snj 70 1.1.2.2 snj struct sockaddr *iv_psrc; /* Physical src addr */ 71 1.1.2.2 snj struct sockaddr *iv_pdst; /* Physical dst addr */ 72 1.1.2.2 snj const struct encaptab *iv_encap_cookie4; 73 1.1.2.2 snj const struct encaptab *iv_encap_cookie6; 74 1.1.2.2 snj int (*iv_output)(struct ipsec_variant *, int, struct mbuf *); 75 1.1.2.2 snj in_port_t iv_sport; 76 1.1.2.2 snj in_port_t iv_dport; 77 1.1.2.2 snj 78 1.1.2.2 snj /* 79 1.1.2.2 snj * IPsec SPs 80 1.1.2.2 snj * Don't change directly, use if_ipsec_replace_sp(). 81 1.1.2.2 snj */ 82 1.1.2.2 snj struct secpolicy *iv_sp[IPSEC_DIR_MAX]; 83 1.1.2.2 snj struct secpolicy *iv_sp6[IPSEC_DIR_MAX]; 84 1.1.2.2 snj 85 1.1.2.2 snj struct psref_target iv_psref; 86 1.1.2.2 snj }; 87 1.1.2.2 snj 88 1.1.2.2 snj struct ipsec_ro { 89 1.1.2.2 snj struct route ir_ro; 90 1.1.2.2 snj kmutex_t ir_lock; 91 1.1.2.2 snj }; 92 1.1.2.2 snj 93 1.1.2.2 snj struct ipsec_softc { 94 1.1.2.2 snj struct ifnet ipsec_if; /* common area - must be at the top */ 95 1.1.2.2 snj percpu_t *ipsec_ro_percpu; /* struct ipsec_ro */ 96 1.1.2.2 snj struct ipsec_variant *ipsec_var; /* 97 1.1.2.2 snj * reader must use ipsec_getref_variant() 98 1.1.2.2 snj * instead of direct dereference. 99 1.1.2.2 snj */ 100 1.1.2.2 snj kmutex_t ipsec_lock; /* writer lock for ipsec_var */ 101 1.1.2.2 snj 102 1.1.2.2 snj LIST_ENTRY(ipsec_softc) ipsec_list; /* list of all gifs */ 103 1.1.2.2 snj }; 104 1.1.2.2 snj 105 1.1.2.2 snj #define IPSEC_MTU (1280) /* Default MTU */ 106 1.1.2.2 snj #define IPSEC_MTU_MIN (1280) /* Minimum MTU */ 107 1.1.2.2 snj #define IPSEC_MTU_MAX (8192) /* Maximum MTU */ 108 1.1.2.2 snj 109 1.1.2.2 snj #define IV_SP_IN(x) ((x)->iv_sp[IPSEC_DIR_INBOUND]) 110 1.1.2.2 snj #define IV_SP_IN6(x) ((x)->iv_sp6[IPSEC_DIR_INBOUND]) 111 1.1.2.2 snj #define IV_SP_OUT(x) ((x)->iv_sp[IPSEC_DIR_OUTBOUND]) 112 1.1.2.2 snj #define IV_SP_OUT6(x) ((x)->iv_sp6[IPSEC_DIR_OUTBOUND]) 113 1.1.2.2 snj 114 1.1.2.2 snj static inline bool 115 1.1.2.2 snj if_ipsec_variant_is_configured(struct ipsec_variant *var) 116 1.1.2.2 snj { 117 1.1.2.2 snj 118 1.1.2.2 snj return (var->iv_psrc != NULL && var->iv_pdst != NULL); 119 1.1.2.2 snj } 120 1.1.2.2 snj 121 1.1.2.2 snj static inline bool 122 1.1.2.2 snj if_ipsec_variant_is_unconfigured(struct ipsec_variant *var) 123 1.1.2.2 snj { 124 1.1.2.2 snj 125 1.1.2.2 snj return (var->iv_psrc == NULL || var->iv_pdst == NULL); 126 1.1.2.2 snj } 127 1.1.2.2 snj 128 1.1.2.2 snj static inline void 129 1.1.2.2 snj if_ipsec_copy_variant(struct ipsec_variant *dst, struct ipsec_variant *src) 130 1.1.2.2 snj { 131 1.1.2.2 snj 132 1.1.2.2 snj dst->iv_softc = src->iv_softc; 133 1.1.2.2 snj dst->iv_psrc = src->iv_psrc; 134 1.1.2.2 snj dst->iv_pdst = src->iv_pdst; 135 1.1.2.2 snj dst->iv_encap_cookie4 = src->iv_encap_cookie4; 136 1.1.2.2 snj dst->iv_encap_cookie6 = src->iv_encap_cookie6; 137 1.1.2.2 snj dst->iv_output = src->iv_output; 138 1.1.2.2 snj dst->iv_sport = src->iv_sport; 139 1.1.2.2 snj dst->iv_dport = src->iv_dport; 140 1.1.2.2 snj } 141 1.1.2.2 snj 142 1.1.2.2 snj static inline void 143 1.1.2.2 snj if_ipsec_clear_config(struct ipsec_variant *var) 144 1.1.2.2 snj { 145 1.1.2.2 snj 146 1.1.2.2 snj var->iv_psrc = NULL; 147 1.1.2.2 snj var->iv_pdst = NULL; 148 1.1.2.2 snj var->iv_encap_cookie4 = NULL; 149 1.1.2.2 snj var->iv_encap_cookie6 = NULL; 150 1.1.2.2 snj var->iv_output = NULL; 151 1.1.2.2 snj var->iv_sport = 0; 152 1.1.2.2 snj var->iv_dport = 0; 153 1.1.2.2 snj } 154 1.1.2.2 snj 155 1.1.2.2 snj /* 156 1.1.2.2 snj * Get ipsec_variant from ipsec_softc. 157 1.1.2.2 snj * 158 1.1.2.2 snj * Never return NULL by contract. 159 1.1.2.2 snj * ipsec_variant itself is protected not to be freed by lv_psref. 160 1.1.2.2 snj * Once a reader dereference sc->sc_var by this API, the reader must not 161 1.1.2.2 snj * re-dereference from sc->sc_var. 162 1.1.2.2 snj */ 163 1.1.2.2 snj static inline struct ipsec_variant * 164 1.1.2.2 snj if_ipsec_getref_variant(struct ipsec_softc *sc, struct psref *psref) 165 1.1.2.2 snj { 166 1.1.2.2 snj struct ipsec_variant *var; 167 1.1.2.2 snj int s; 168 1.1.2.2 snj 169 1.1.2.2 snj s = pserialize_read_enter(); 170 1.1.2.2 snj var = sc->ipsec_var; 171 1.1.2.2 snj KASSERT(var != NULL); 172 1.1.2.2 snj membar_datadep_consumer(); 173 1.1.2.2 snj psref_acquire(psref, &var->iv_psref, iv_psref_class); 174 1.1.2.2 snj pserialize_read_exit(s); 175 1.1.2.2 snj 176 1.1.2.2 snj return var; 177 1.1.2.2 snj } 178 1.1.2.2 snj 179 1.1.2.2 snj static inline void 180 1.1.2.2 snj if_ipsec_putref_variant(struct ipsec_variant *var, struct psref *psref) 181 1.1.2.2 snj { 182 1.1.2.2 snj 183 1.1.2.2 snj KASSERT(var != NULL); 184 1.1.2.2 snj psref_release(psref, &var->iv_psref, iv_psref_class); 185 1.1.2.2 snj } 186 1.1.2.2 snj 187 1.1.2.2 snj static inline bool 188 1.1.2.2 snj if_ipsec_heldref_variant(struct ipsec_variant *var) 189 1.1.2.2 snj { 190 1.1.2.2 snj 191 1.1.2.2 snj return psref_held(&var->iv_psref, iv_psref_class); 192 1.1.2.2 snj } 193 1.1.2.2 snj 194 1.1.2.2 snj void ipsecifattach(int); 195 1.1.2.2 snj int if_ipsec_encap_func(struct mbuf *, int, int, void *); 196 1.1.2.2 snj void if_ipsec_input(struct mbuf *, int, struct ifnet *); 197 1.1.2.2 snj int if_ipsec_output(struct ifnet *, struct mbuf *, 198 1.1.2.2 snj const struct sockaddr *, const struct rtentry *); 199 1.1.2.2 snj int if_ipsec_ioctl(struct ifnet *, u_long, void *); 200 1.1.2.2 snj #endif /* _KERNEL */ 201 1.1.2.2 snj 202 1.1.2.2 snj /* 203 1.1.2.2 snj * sharing SP note: 204 1.1.2.2 snj * When ipsec(4) I/Fs use NAT-T, they can use the same src and dst address pair 205 1.1.2.2 snj * as long as they use different port. Howerver, SPD cannot have the SPs which 206 1.1.2.2 snj * use the same src and dst address pair and the same policy. So, such ipsec(4) 207 1.1.2.2 snj * I/Fs share the same SPs. 208 1.1.2.2 snj * To avoid race between ipsec0 set_tunnel/delete_tunnel and ipsec1 209 1.1.2.2 snj * t_tunnel/delete_tunnel, any global lock is needed. See also the following 210 1.1.2.2 snj * locking notes. 211 1.1.2.2 snj * 212 1.1.2.2 snj * Locking notes: 213 1.1.2.2 snj * + ipsec_softcs.list is protected by ipsec_softcs.lock (an adaptive mutex) 214 1.1.2.2 snj * ipsec_softc_list is list of all ipsec_softcs. It is used by ioctl 215 1.1.2.2 snj * context only. 216 1.1.2.2 snj * + ipsec_softc->ipsec_var is protected by 217 1.1.2.2 snj * - ipsec_softc->ipsec_lock (an adaptive mutex) for writer 218 1.1.2.2 snj * - ipsec_var->iv_psref for reader 219 1.1.2.2 snj * ipsec_softc->ipsec_var is used for variant values while the ipsec tunnel 220 1.1.2.2 snj * exists. 221 1.1.2.2 snj * + struct ipsec_ro->ir_ro is protected by struct ipsec_ro->ir_lock. 222 1.1.2.2 snj * This lock is required to exclude softnet/0 lwp(such as output 223 1.1.2.2 snj * processing softint) and processing lwp(such as DAD timer processing). 224 1.1.2.2 snj * + if_ipsec_share_sp() and if_ipsec_unshare_sp() operations are serialized by 225 1.1.2.2 snj * encap_lock 226 1.1.2.2 snj * This only need to be global lock, need not to be encap_lock. 227 1.1.2.2 snj * 228 1.1.2.2 snj * Locking order: 229 1.1.2.2 snj * - encap_lock => ipsec_softc->ipsec_lock => ipsec_softcs.lock 230 1.1.2.2 snj */ 231 1.1.2.2 snj #endif /* _NET_IF_IPSEC_H_ */ 232
Indexes created Tue Sep 30 06:09:59 GMT 2025