1/* $NetBSD: if_ipsec.h,v 1.8 2022/01/17 20:56:03 andvar Exp $ */
2
3/*
4 * Copyright (c) 2017 Internet Initiative Japan Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/*
30 * if_ipsec.h
31 */
32
33#ifndef _NET_IF_IPSEC_H_
34#define _NET_IF_IPSEC_H_
35
36#include <sys/queue.h>
37#ifdef _KERNEL
38#include <sys/pserialize.h>
39#include <sys/psref.h>
40#endif
41
42#ifdef _KERNEL_OPT
43#include "opt_inet.h"
44#endif
45
46#include <netinet/in.h>
47#include <netipsec/ipsec.h>
48
49#ifdef _KERNEL
50/*
51 * This macro controls the upper limitation on nesting of ipsec tunnels.
52 * Since, setting a large value to this macro with a careless configuration
53 * may introduce system crash, we don't allow any nestings by default.
54 * If you need to configure nested ipsec tunnels, you can define this macro
55 * in your kernel configuration file. However, if you do so, please be
56 * careful to configure the tunnels so that it won't make a loop.
57 */
58#ifndef MAX_IPSEC_NEST
59#define MAX_IPSEC_NEST 1
60#endif
61
62#define IFF_NAT_T IFF_LINK0 /* enable NAT-T */
63#define IFF_ECN IFF_LINK1 /* enable ECN */
64#define IFF_FWD_IPV6 IFF_LINK2 /* forward IPv6 packet */
65
66extern struct psref_class *iv_psref_class;
67
68struct ipsec_variant {
69 struct ipsec_softc *iv_softc;
70
71 struct sockaddr *iv_psrc; /* Physical src addr */
72 struct sockaddr *iv_pdst; /* Physical dst addr */
73 const struct encaptab *iv_encap_cookie4;
74 const struct encaptab *iv_encap_cookie6;
75 int (*iv_output)(struct ipsec_variant *, int, struct mbuf *);
76 in_port_t iv_sport;
77 in_port_t iv_dport;
78
79 /*
80 * IPsec SPs
81 * Don't change directly, use if_ipsec_replace_sp().
82 */
83 struct secpolicy *iv_sp[IPSEC_DIR_MAX];
84 struct secpolicy *iv_sp6[IPSEC_DIR_MAX];
85
86 struct psref_target iv_psref;
87};
88
89struct ipsec_softc {
90 struct ifnet ipsec_if; /* common area - must be at the top */
91 percpu_t *ipsec_ro_percpu; /* struct tunnel_ro */
92 struct ipsec_variant *ipsec_var; /*
93 * reader must use ipsec_getref_variant()
94 * instead of direct dereference.
95 */
96 kmutex_t ipsec_lock; /* writer lock for ipsec_var */
97 pserialize_t ipsec_psz;
98 int ipsec_pmtu;
99
100 LIST_ENTRY(ipsec_softc) ipsec_list; /* list of all gifs */
101};
102
103#define IPSEC_MTU (1280) /* Default MTU */
104#define IPSEC_MTU_MIN (1280) /* Minimum MTU */
105#define IPSEC_MTU_MAX (8192) /* Maximum MTU */
106
107#define IV_SP_IN(x) ((x)->iv_sp[IPSEC_DIR_INBOUND])
108#define IV_SP_IN6(x) ((x)->iv_sp6[IPSEC_DIR_INBOUND])
109#define IV_SP_OUT(x) ((x)->iv_sp[IPSEC_DIR_OUTBOUND])
110#define IV_SP_OUT6(x) ((x)->iv_sp6[IPSEC_DIR_OUTBOUND])
111
112static __inline bool
113if_ipsec_variant_is_configured(struct ipsec_variant *var)
114{
115
116 return (var->iv_psrc != NULL && var->iv_pdst != NULL);
117}
118
119static __inline bool
120if_ipsec_variant_is_unconfigured(struct ipsec_variant *var)
121{
122
123 return (var->iv_psrc == NULL || var->iv_pdst == NULL);
124}
125
126static __inline void
127if_ipsec_copy_variant(struct ipsec_variant *dst, struct ipsec_variant *src)
128{
129
130 dst->iv_softc = src->iv_softc;
131 dst->iv_psrc = src->iv_psrc;
132 dst->iv_pdst = src->iv_pdst;
133 dst->iv_encap_cookie4 = src->iv_encap_cookie4;
134 dst->iv_encap_cookie6 = src->iv_encap_cookie6;
135 dst->iv_output = src->iv_output;
136 dst->iv_sport = src->iv_sport;
137 dst->iv_dport = src->iv_dport;
138}
139
140static __inline void
141if_ipsec_clear_config(struct ipsec_variant *var)
142{
143
144 var->iv_psrc = NULL;
145 var->iv_pdst = NULL;
146 var->iv_encap_cookie4 = NULL;
147 var->iv_encap_cookie6 = NULL;
148 var->iv_output = NULL;
149 var->iv_sport = 0;
150 var->iv_dport = 0;
151}
152
153/*
154 * Get ipsec_variant from ipsec_softc.
155 *
156 * Never return NULL by contract.
157 * ipsec_variant itself is protected not to be freed by lv_psref.
158 * Once a reader dereference sc->sc_var by this API, the reader must not
159 * re-dereference from sc->sc_var.
160 */
161static __inline struct ipsec_variant *
162if_ipsec_getref_variant(struct ipsec_softc *sc, struct psref *psref)
163{
164 struct ipsec_variant *var;
165 int s;
166
167 s = pserialize_read_enter();
168 var = atomic_load_consume(&sc->ipsec_var);
169 KASSERT(var != NULL);
170 psref_acquire(psref, &var->iv_psref, iv_psref_class);
171 pserialize_read_exit(s);
172
173 return var;
174}
175
176static __inline void
177if_ipsec_putref_variant(struct ipsec_variant *var, struct psref *psref)
178{
179
180 KASSERT(var != NULL);
181 psref_release(psref, &var->iv_psref, iv_psref_class);
182}
183
184static __inline bool
185if_ipsec_heldref_variant(struct ipsec_variant *var)
186{
187
188 return psref_held(&var->iv_psref, iv_psref_class);
189}
190
191void ipsecifattach(int);
192int if_ipsec_encap_func(struct mbuf *, int, int, void *);
193void if_ipsec_input(struct mbuf *, int, struct ifnet *);
194int if_ipsec_output(struct ifnet *, struct mbuf *,
195 const struct sockaddr *, const struct rtentry *);
196int if_ipsec_ioctl(struct ifnet *, u_long, void *);
197#endif /* _KERNEL */
198
199/*
200 * sharing SP note:
201 * When ipsec(4) I/Fs use NAT-T, they can use the same src and dst address pair
202 * as long as they use different port. Howerver, SPD cannot have the SPs which
203 * use the same src and dst address pair and the same policy. So, such ipsec(4)
204 * I/Fs share the same SPs.
205 * To avoid race between ipsec0 set_tunnel/delete_tunnel and ipsec1
206 * t_tunnel/delete_tunnel, any global lock is needed. See also the following
207 * locking notes.
208 *
209 * Locking notes:
210 * + ipsec_softcs.list is protected by ipsec_softcs.lock (an adaptive mutex)
211 * ipsec_softc_list is list of all ipsec_softcs. It is used by ioctl
212 * context only.
213 * + ipsec_softc->ipsec_var is protected by
214 * - ipsec_softc->ipsec_lock (an adaptive mutex) for writer
215 * - ipsec_var->iv_psref for reader
216 * ipsec_softc->ipsec_var is used for variant values while the ipsec tunnel
217 * exists.
218 * + struct tunnel_ro->tr_ro is protected by struct tunnel_ro->tr_lock.
219 * This lock is required to exclude softnet/0 lwp(such as output
220 * processing softint) and processing lwp(such as DAD timer processing).
221 * + if_ipsec_share_sp() and if_ipsec_unshare_sp() operations are serialized by
222 * encap_lock
223 * This only need to be global lock, need not to be encap_lock.
224 *
225 * Locking order:
226 * - encap_lock => ipsec_softc->ipsec_lock => ipsec_softcs.lock
227 */
228#endif /* _NET_IF_IPSEC_H_ */