1/*	$NetBSD: if_ipsec.h,v 1.8 2022/01/17 20:56:03 andvar Exp $  */
2
3/*
4 * Copyright (c) 2017 Internet Initiative Japan Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/*
30 * if_ipsec.h
31 */
32
33#ifndef _NET_IF_IPSEC_H_
34#define _NET_IF_IPSEC_H_
35
36#include <sys/queue.h>
37#ifdef _KERNEL
38#include <sys/pserialize.h>
39#include <sys/psref.h>
40#endif
41
42#ifdef _KERNEL_OPT
43#include "opt_inet.h"
44#endif
45
46#include <netinet/in.h>
47#include <netipsec/ipsec.h>
48
49#ifdef _KERNEL
50/*
51 * This macro controls the upper limitation on nesting of ipsec tunnels.
52 * Since, setting a large value to this macro with a careless configuration
53 * may introduce system crash, we don't allow any nestings by default.
54 * If you need to configure nested ipsec tunnels, you can define this macro
55 * in your kernel configuration file.  However, if you do so, please be
56 * careful to configure the tunnels so that it won't make a loop.
57 */
58#ifndef MAX_IPSEC_NEST
59#define MAX_IPSEC_NEST 1
60#endif
61
62#define IFF_NAT_T	IFF_LINK0	/* enable NAT-T */
63#define IFF_ECN		IFF_LINK1	/* enable ECN */
64#define IFF_FWD_IPV6	IFF_LINK2	/* forward IPv6 packet */
65
66extern struct psref_class *iv_psref_class;
67
68struct ipsec_variant {
69	struct ipsec_softc *iv_softc;
70
71	struct sockaddr	*iv_psrc;	/* Physical src addr */
72	struct sockaddr	*iv_pdst;	/* Physical dst addr */
73	const struct encaptab *iv_encap_cookie4;
74	const struct encaptab *iv_encap_cookie6;
75	int (*iv_output)(struct ipsec_variant *, int, struct mbuf *);
76	in_port_t iv_sport;
77	in_port_t iv_dport;
78
79	/*
80	 * IPsec SPs
81	 * Don't change directly, use if_ipsec_replace_sp().
82	 */
83	struct secpolicy *iv_sp[IPSEC_DIR_MAX];
84	struct secpolicy *iv_sp6[IPSEC_DIR_MAX];
85
86	struct psref_target iv_psref;
87};
88
89struct ipsec_softc {
90	struct ifnet	ipsec_if;	/* common area - must be at the top */
91	percpu_t *ipsec_ro_percpu;	/* struct tunnel_ro */
92	struct ipsec_variant *ipsec_var; /*
93					  * reader must use ipsec_getref_variant()
94					  * instead of direct dereference.
95					  */
96	kmutex_t ipsec_lock;		/* writer lock for ipsec_var */
97	pserialize_t ipsec_psz;
98	int ipsec_pmtu;
99
100	LIST_ENTRY(ipsec_softc) ipsec_list; /* list of all gifs */
101};
102
103#define IPSEC_MTU		(1280)	/* Default MTU */
104#define	IPSEC_MTU_MIN		(1280)	/* Minimum MTU */
105#define	IPSEC_MTU_MAX		(8192)	/* Maximum MTU */
106
107#define IV_SP_IN(x) ((x)->iv_sp[IPSEC_DIR_INBOUND])
108#define IV_SP_IN6(x) ((x)->iv_sp6[IPSEC_DIR_INBOUND])
109#define IV_SP_OUT(x) ((x)->iv_sp[IPSEC_DIR_OUTBOUND])
110#define IV_SP_OUT6(x) ((x)->iv_sp6[IPSEC_DIR_OUTBOUND])
111
112static __inline bool
113if_ipsec_variant_is_configured(struct ipsec_variant *var)
114{
115
116	return (var->iv_psrc != NULL && var->iv_pdst != NULL);
117}
118
119static __inline bool
120if_ipsec_variant_is_unconfigured(struct ipsec_variant *var)
121{
122
123	return (var->iv_psrc == NULL || var->iv_pdst == NULL);
124}
125
126static __inline void
127if_ipsec_copy_variant(struct ipsec_variant *dst, struct ipsec_variant *src)
128{
129
130	dst->iv_softc = src->iv_softc;
131	dst->iv_psrc = src->iv_psrc;
132	dst->iv_pdst = src->iv_pdst;
133	dst->iv_encap_cookie4 = src->iv_encap_cookie4;
134	dst->iv_encap_cookie6 = src->iv_encap_cookie6;
135	dst->iv_output = src->iv_output;
136	dst->iv_sport = src->iv_sport;
137	dst->iv_dport = src->iv_dport;
138}
139
140static __inline void
141if_ipsec_clear_config(struct ipsec_variant *var)
142{
143
144	var->iv_psrc = NULL;
145	var->iv_pdst = NULL;
146	var->iv_encap_cookie4 = NULL;
147	var->iv_encap_cookie6 = NULL;
148	var->iv_output = NULL;
149	var->iv_sport = 0;
150	var->iv_dport = 0;
151}
152
153/*
154 * Get ipsec_variant from ipsec_softc.
155 *
156 * Never return NULL by contract.
157 * ipsec_variant itself is protected not to be freed by lv_psref.
158 * Once a reader dereference sc->sc_var by this API, the reader must not
159 * re-dereference from sc->sc_var.
160 */
161static __inline struct ipsec_variant *
162if_ipsec_getref_variant(struct ipsec_softc *sc, struct psref *psref)
163{
164	struct ipsec_variant *var;
165	int s;
166
167	s = pserialize_read_enter();
168	var = atomic_load_consume(&sc->ipsec_var);
169	KASSERT(var != NULL);
170	psref_acquire(psref, &var->iv_psref, iv_psref_class);
171	pserialize_read_exit(s);
172
173	return var;
174}
175
176static __inline void
177if_ipsec_putref_variant(struct ipsec_variant *var, struct psref *psref)
178{
179
180	KASSERT(var != NULL);
181	psref_release(psref, &var->iv_psref, iv_psref_class);
182}
183
184static __inline bool
185if_ipsec_heldref_variant(struct ipsec_variant *var)
186{
187
188	return psref_held(&var->iv_psref, iv_psref_class);
189}
190
191void ipsecifattach(int);
192int if_ipsec_encap_func(struct mbuf *, int, int, void *);
193void if_ipsec_input(struct mbuf *, int, struct ifnet *);
194int if_ipsec_output(struct ifnet *, struct mbuf *,
195		    const struct sockaddr *, const struct rtentry *);
196int if_ipsec_ioctl(struct ifnet *, u_long, void *);
197#endif /* _KERNEL */
198
199/*
200 * sharing SP note:
201 * When ipsec(4) I/Fs use NAT-T, they can use the same src and dst address pair
202 * as long as they use different port. Howerver, SPD cannot have the SPs which
203 * use the same src and dst address pair and the same policy. So, such ipsec(4)
204 * I/Fs share the same SPs.
205 * To avoid race between ipsec0 set_tunnel/delete_tunnel and ipsec1
206 * t_tunnel/delete_tunnel, any global lock is needed. See also the following
207 * locking notes.
208 *
209 * Locking notes:
210 * + ipsec_softcs.list is protected by ipsec_softcs.lock (an adaptive mutex)
211 *       ipsec_softc_list is list of all ipsec_softcs. It is used by ioctl
212 *       context only.
213 * + ipsec_softc->ipsec_var is protected by
214 *   - ipsec_softc->ipsec_lock (an adaptive mutex) for writer
215 *   - ipsec_var->iv_psref for reader
216 *       ipsec_softc->ipsec_var is used for variant values while the ipsec tunnel
217 *       exists.
218 * + struct tunnel_ro->tr_ro is protected by struct tunnel_ro->tr_lock.
219 *       This lock is required to exclude softnet/0 lwp(such as output
220 *       processing softint) and  processing lwp(such as DAD timer processing).
221 * + if_ipsec_share_sp() and if_ipsec_unshare_sp() operations are serialized by
222 *   encap_lock
223 *       This only need to be global lock, need not to be encap_lock.
224 *
225 * Locking order:
226 *     - encap_lock => ipsec_softc->ipsec_lock => ipsec_softcs.lock
227 */
228#endif /* _NET_IF_IPSEC_H_ */
229