if_ipsec.h revision 1.2
1 /* $NetBSD: if_ipsec.h,v 1.2 2018/04/19 21:20:43 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2017 Internet Initiative Japan Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * if_ipsec.h 31 */ 32 33 #ifndef _NET_IF_IPSEC_H_ 34 #define _NET_IF_IPSEC_H_ 35 36 #include <sys/queue.h> 37 #ifdef _KERNEL 38 #include <sys/psref.h> 39 #endif 40 41 #ifdef _KERNEL_OPT 42 #include "opt_inet.h" 43 #endif 44 45 #include <netinet/in.h> 46 #include <netipsec/ipsec.h> 47 48 #ifdef _KERNEL 49 /* 50 * This macro controls the upper limitation on nesting of ipsec tunnels. 51 * Since, setting a large value to this macro with a careless configuration 52 * may introduce system crash, we don't allow any nestings by default. 53 * If you need to configure nested ipsec tunnels, you can define this macro 54 * in your kernel configuration file. However, if you do so, please be 55 * careful to configure the tunnels so that it won't make a loop. 56 */ 57 #ifndef MAX_IPSEC_NEST 58 #define MAX_IPSEC_NEST 1 59 #endif 60 61 #define IFF_NAT_T IFF_LINK0 /* enable NAT-T */ 62 #define IFF_ECN IFF_LINK1 /* enable ECN */ 63 #define IFF_FWD_IPV6 IFF_LINK2 /* foward IPv6 packet */ 64 65 extern struct psref_class *iv_psref_class; 66 67 struct ipsec_variant { 68 struct ipsec_softc *iv_softc; 69 70 struct sockaddr *iv_psrc; /* Physical src addr */ 71 struct sockaddr *iv_pdst; /* Physical dst addr */ 72 const struct encaptab *iv_encap_cookie4; 73 const struct encaptab *iv_encap_cookie6; 74 int (*iv_output)(struct ipsec_variant *, int, struct mbuf *); 75 in_port_t iv_sport; 76 in_port_t iv_dport; 77 78 /* 79 * IPsec SPs 80 * Don't change directly, use if_ipsec_replace_sp(). 81 */ 82 struct secpolicy *iv_sp[IPSEC_DIR_MAX]; 83 struct secpolicy *iv_sp6[IPSEC_DIR_MAX]; 84 85 struct psref_target iv_psref; 86 }; 87 88 struct ipsec_ro { 89 struct route ir_ro; 90 kmutex_t ir_lock; 91 }; 92 93 struct ipsec_softc { 94 struct ifnet ipsec_if; /* common area - must be at the top */ 95 percpu_t *ipsec_ro_percpu; /* struct ipsec_ro */ 96 struct ipsec_variant *ipsec_var; /* 97 * reader must use ipsec_getref_variant() 98 * instead of direct dereference. 99 */ 100 kmutex_t ipsec_lock; /* writer lock for ipsec_var */ 101 102 LIST_ENTRY(ipsec_softc) ipsec_list; /* list of all gifs */ 103 }; 104 105 #define IPSEC_MTU (1280) /* Default MTU */ 106 #define IPSEC_MTU_MIN (1280) /* Minimum MTU */ 107 #define IPSEC_MTU_MAX (8192) /* Maximum MTU */ 108 109 #define IV_SP_IN(x) ((x)->iv_sp[IPSEC_DIR_INBOUND]) 110 #define IV_SP_IN6(x) ((x)->iv_sp6[IPSEC_DIR_INBOUND]) 111 #define IV_SP_OUT(x) ((x)->iv_sp[IPSEC_DIR_OUTBOUND]) 112 #define IV_SP_OUT6(x) ((x)->iv_sp6[IPSEC_DIR_OUTBOUND]) 113 114 static __inline bool 115 if_ipsec_variant_is_configured(struct ipsec_variant *var) 116 { 117 118 return (var->iv_psrc != NULL && var->iv_pdst != NULL); 119 } 120 121 static __inline bool 122 if_ipsec_variant_is_unconfigured(struct ipsec_variant *var) 123 { 124 125 return (var->iv_psrc == NULL || var->iv_pdst == NULL); 126 } 127 128 static __inline void 129 if_ipsec_copy_variant(struct ipsec_variant *dst, struct ipsec_variant *src) 130 { 131 132 dst->iv_softc = src->iv_softc; 133 dst->iv_psrc = src->iv_psrc; 134 dst->iv_pdst = src->iv_pdst; 135 dst->iv_encap_cookie4 = src->iv_encap_cookie4; 136 dst->iv_encap_cookie6 = src->iv_encap_cookie6; 137 dst->iv_output = src->iv_output; 138 dst->iv_sport = src->iv_sport; 139 dst->iv_dport = src->iv_dport; 140 } 141 142 static __inline void 143 if_ipsec_clear_config(struct ipsec_variant *var) 144 { 145 146 var->iv_psrc = NULL; 147 var->iv_pdst = NULL; 148 var->iv_encap_cookie4 = NULL; 149 var->iv_encap_cookie6 = NULL; 150 var->iv_output = NULL; 151 var->iv_sport = 0; 152 var->iv_dport = 0; 153 } 154 155 /* 156 * Get ipsec_variant from ipsec_softc. 157 * 158 * Never return NULL by contract. 159 * ipsec_variant itself is protected not to be freed by lv_psref. 160 * Once a reader dereference sc->sc_var by this API, the reader must not 161 * re-dereference from sc->sc_var. 162 */ 163 static __inline struct ipsec_variant * 164 if_ipsec_getref_variant(struct ipsec_softc *sc, struct psref *psref) 165 { 166 struct ipsec_variant *var; 167 int s; 168 169 s = pserialize_read_enter(); 170 var = sc->ipsec_var; 171 KASSERT(var != NULL); 172 membar_datadep_consumer(); 173 psref_acquire(psref, &var->iv_psref, iv_psref_class); 174 pserialize_read_exit(s); 175 176 return var; 177 } 178 179 static __inline void 180 if_ipsec_putref_variant(struct ipsec_variant *var, struct psref *psref) 181 { 182 183 KASSERT(var != NULL); 184 psref_release(psref, &var->iv_psref, iv_psref_class); 185 } 186 187 static __inline bool 188 if_ipsec_heldref_variant(struct ipsec_variant *var) 189 { 190 191 return psref_held(&var->iv_psref, iv_psref_class); 192 } 193 194 void ipsecifattach(int); 195 int if_ipsec_encap_func(struct mbuf *, int, int, void *); 196 void if_ipsec_input(struct mbuf *, int, struct ifnet *); 197 int if_ipsec_output(struct ifnet *, struct mbuf *, 198 const struct sockaddr *, const struct rtentry *); 199 int if_ipsec_ioctl(struct ifnet *, u_long, void *); 200 #endif /* _KERNEL */ 201 202 /* 203 * sharing SP note: 204 * When ipsec(4) I/Fs use NAT-T, they can use the same src and dst address pair 205 * as long as they use different port. Howerver, SPD cannot have the SPs which 206 * use the same src and dst address pair and the same policy. So, such ipsec(4) 207 * I/Fs share the same SPs. 208 * To avoid race between ipsec0 set_tunnel/delete_tunnel and ipsec1 209 * t_tunnel/delete_tunnel, any global lock is needed. See also the following 210 * locking notes. 211 * 212 * Locking notes: 213 * + ipsec_softcs.list is protected by ipsec_softcs.lock (an adaptive mutex) 214 * ipsec_softc_list is list of all ipsec_softcs. It is used by ioctl 215 * context only. 216 * + ipsec_softc->ipsec_var is protected by 217 * - ipsec_softc->ipsec_lock (an adaptive mutex) for writer 218 * - ipsec_var->iv_psref for reader 219 * ipsec_softc->ipsec_var is used for variant values while the ipsec tunnel 220 * exists. 221 * + struct ipsec_ro->ir_ro is protected by struct ipsec_ro->ir_lock. 222 * This lock is required to exclude softnet/0 lwp(such as output 223 * processing softint) and processing lwp(such as DAD timer processing). 224 * + if_ipsec_share_sp() and if_ipsec_unshare_sp() operations are serialized by 225 * encap_lock 226 * This only need to be global lock, need not to be encap_lock. 227 * 228 * Locking order: 229 * - encap_lock => ipsec_softc->ipsec_lock => ipsec_softcs.lock 230 */ 231 #endif /* _NET_IF_IPSEC_H_ */ 232
Indexes created Tue Sep 23 22:09:46 GMT 2025