if_ipsec.h revision 1.3.2.2
1 /* $NetBSD: if_ipsec.h,v 1.3.2.2 2020/04/08 14:08:57 martin Exp $ */ 2 3 /* 4 * Copyright (c) 2017 Internet Initiative Japan Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * if_ipsec.h 31 */ 32 33 #ifndef _NET_IF_IPSEC_H_ 34 #define _NET_IF_IPSEC_H_ 35 36 #include <sys/queue.h> 37 #ifdef _KERNEL 38 #include <sys/pserialize.h> 39 #include <sys/psref.h> 40 #endif 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #endif 45 46 #include <netinet/in.h> 47 #include <netipsec/ipsec.h> 48 49 #ifdef _KERNEL 50 /* 51 * This macro controls the upper limitation on nesting of ipsec tunnels. 52 * Since, setting a large value to this macro with a careless configuration 53 * may introduce system crash, we don't allow any nestings by default. 54 * If you need to configure nested ipsec tunnels, you can define this macro 55 * in your kernel configuration file. However, if you do so, please be 56 * careful to configure the tunnels so that it won't make a loop. 57 */ 58 #ifndef MAX_IPSEC_NEST 59 #define MAX_IPSEC_NEST 1 60 #endif 61 62 #define IFF_NAT_T IFF_LINK0 /* enable NAT-T */ 63 #define IFF_ECN IFF_LINK1 /* enable ECN */ 64 #define IFF_FWD_IPV6 IFF_LINK2 /* foward IPv6 packet */ 65 66 extern struct psref_class *iv_psref_class; 67 68 struct ipsec_variant { 69 struct ipsec_softc *iv_softc; 70 71 struct sockaddr *iv_psrc; /* Physical src addr */ 72 struct sockaddr *iv_pdst; /* Physical dst addr */ 73 const struct encaptab *iv_encap_cookie4; 74 const struct encaptab *iv_encap_cookie6; 75 int (*iv_output)(struct ipsec_variant *, int, struct mbuf *); 76 in_port_t iv_sport; 77 in_port_t iv_dport; 78 79 /* 80 * IPsec SPs 81 * Don't change directly, use if_ipsec_replace_sp(). 82 */ 83 struct secpolicy *iv_sp[IPSEC_DIR_MAX]; 84 struct secpolicy *iv_sp6[IPSEC_DIR_MAX]; 85 86 struct psref_target iv_psref; 87 }; 88 89 struct ipsec_ro { 90 struct route ir_ro; 91 kmutex_t *ir_lock; 92 }; 93 94 struct ipsec_softc { 95 struct ifnet ipsec_if; /* common area - must be at the top */ 96 percpu_t *ipsec_ro_percpu; /* struct ipsec_ro */ 97 struct ipsec_variant *ipsec_var; /* 98 * reader must use ipsec_getref_variant() 99 * instead of direct dereference. 100 */ 101 kmutex_t ipsec_lock; /* writer lock for ipsec_var */ 102 pserialize_t ipsec_psz; 103 104 LIST_ENTRY(ipsec_softc) ipsec_list; /* list of all gifs */ 105 }; 106 107 #define IPSEC_MTU (1280) /* Default MTU */ 108 #define IPSEC_MTU_MIN (1280) /* Minimum MTU */ 109 #define IPSEC_MTU_MAX (8192) /* Maximum MTU */ 110 111 #define IV_SP_IN(x) ((x)->iv_sp[IPSEC_DIR_INBOUND]) 112 #define IV_SP_IN6(x) ((x)->iv_sp6[IPSEC_DIR_INBOUND]) 113 #define IV_SP_OUT(x) ((x)->iv_sp[IPSEC_DIR_OUTBOUND]) 114 #define IV_SP_OUT6(x) ((x)->iv_sp6[IPSEC_DIR_OUTBOUND]) 115 116 static __inline bool 117 if_ipsec_variant_is_configured(struct ipsec_variant *var) 118 { 119 120 return (var->iv_psrc != NULL && var->iv_pdst != NULL); 121 } 122 123 static __inline bool 124 if_ipsec_variant_is_unconfigured(struct ipsec_variant *var) 125 { 126 127 return (var->iv_psrc == NULL || var->iv_pdst == NULL); 128 } 129 130 static __inline void 131 if_ipsec_copy_variant(struct ipsec_variant *dst, struct ipsec_variant *src) 132 { 133 134 dst->iv_softc = src->iv_softc; 135 dst->iv_psrc = src->iv_psrc; 136 dst->iv_pdst = src->iv_pdst; 137 dst->iv_encap_cookie4 = src->iv_encap_cookie4; 138 dst->iv_encap_cookie6 = src->iv_encap_cookie6; 139 dst->iv_output = src->iv_output; 140 dst->iv_sport = src->iv_sport; 141 dst->iv_dport = src->iv_dport; 142 } 143 144 static __inline void 145 if_ipsec_clear_config(struct ipsec_variant *var) 146 { 147 148 var->iv_psrc = NULL; 149 var->iv_pdst = NULL; 150 var->iv_encap_cookie4 = NULL; 151 var->iv_encap_cookie6 = NULL; 152 var->iv_output = NULL; 153 var->iv_sport = 0; 154 var->iv_dport = 0; 155 } 156 157 /* 158 * Get ipsec_variant from ipsec_softc. 159 * 160 * Never return NULL by contract. 161 * ipsec_variant itself is protected not to be freed by lv_psref. 162 * Once a reader dereference sc->sc_var by this API, the reader must not 163 * re-dereference from sc->sc_var. 164 */ 165 static __inline struct ipsec_variant * 166 if_ipsec_getref_variant(struct ipsec_softc *sc, struct psref *psref) 167 { 168 struct ipsec_variant *var; 169 int s; 170 171 s = pserialize_read_enter(); 172 var = atomic_load_consume(&sc->ipsec_var); 173 KASSERT(var != NULL); 174 psref_acquire(psref, &var->iv_psref, iv_psref_class); 175 pserialize_read_exit(s); 176 177 return var; 178 } 179 180 static __inline void 181 if_ipsec_putref_variant(struct ipsec_variant *var, struct psref *psref) 182 { 183 184 KASSERT(var != NULL); 185 psref_release(psref, &var->iv_psref, iv_psref_class); 186 } 187 188 static __inline bool 189 if_ipsec_heldref_variant(struct ipsec_variant *var) 190 { 191 192 return psref_held(&var->iv_psref, iv_psref_class); 193 } 194 195 void ipsecifattach(int); 196 int if_ipsec_encap_func(struct mbuf *, int, int, void *); 197 void if_ipsec_input(struct mbuf *, int, struct ifnet *); 198 int if_ipsec_output(struct ifnet *, struct mbuf *, 199 const struct sockaddr *, const struct rtentry *); 200 int if_ipsec_ioctl(struct ifnet *, u_long, void *); 201 #endif /* _KERNEL */ 202 203 /* 204 * sharing SP note: 205 * When ipsec(4) I/Fs use NAT-T, they can use the same src and dst address pair 206 * as long as they use different port. Howerver, SPD cannot have the SPs which 207 * use the same src and dst address pair and the same policy. So, such ipsec(4) 208 * I/Fs share the same SPs. 209 * To avoid race between ipsec0 set_tunnel/delete_tunnel and ipsec1 210 * t_tunnel/delete_tunnel, any global lock is needed. See also the following 211 * locking notes. 212 * 213 * Locking notes: 214 * + ipsec_softcs.list is protected by ipsec_softcs.lock (an adaptive mutex) 215 * ipsec_softc_list is list of all ipsec_softcs. It is used by ioctl 216 * context only. 217 * + ipsec_softc->ipsec_var is protected by 218 * - ipsec_softc->ipsec_lock (an adaptive mutex) for writer 219 * - ipsec_var->iv_psref for reader 220 * ipsec_softc->ipsec_var is used for variant values while the ipsec tunnel 221 * exists. 222 * + struct ipsec_ro->ir_ro is protected by struct ipsec_ro->ir_lock. 223 * This lock is required to exclude softnet/0 lwp(such as output 224 * processing softint) and processing lwp(such as DAD timer processing). 225 * + if_ipsec_share_sp() and if_ipsec_unshare_sp() operations are serialized by 226 * encap_lock 227 * This only need to be global lock, need not to be encap_lock. 228 * 229 * Locking order: 230 * - encap_lock => ipsec_softc->ipsec_lock => ipsec_softcs.lock 231 */ 232 #endif /* _NET_IF_IPSEC_H_ */ 233
Indexes created Mon Sep 29 21:09:56 GMT 2025