diff options
Diffstat (limited to 'src/charon/threads/kernel_interface.h')
| -rw-r--r-- | src/charon/threads/kernel_interface.h | 136 |
1 files changed, 88 insertions, 48 deletions
diff --git a/src/charon/threads/kernel_interface.h b/src/charon/threads/kernel_interface.h index 5d385caeb..bafb1a6d1 100644 --- a/src/charon/threads/kernel_interface.h +++ b/src/charon/threads/kernel_interface.h @@ -25,8 +25,6 @@ #ifndef KERNEL_INTERFACE_H_ #define KERNEL_INTERFACE_H_ -#include <linux/xfrm.h> - #include <utils/host.h> #include <crypto/prf_plus.h> #include <encoding/payloads/proposal_substructure.h> @@ -34,10 +32,29 @@ typedef struct natt_conf_t natt_conf_t; /** - * @brief Configuration for NAT-T + * Configuration for NAT-T */ struct natt_conf_t { - u_int16_t sport, dport; + /** source port to use for UDP-encapsulated packets */ + u_int16_t sport; + /** dest port to use for UDP-encapsulated packets */ + u_int16_t dport; +}; + +typedef enum policy_dir_t policy_dir_t; + +/** + * Direction of a policy. These are equal to those + * defined in xfrm.h, but we want to stay implementation + * neutral here. + */ +enum policy_dir_t { + /** Policy for inbound traffic */ + POLICY_IN = 0, + /** Policy for outbound traffic */ + POLICY_OUT = 1, + /** Policy for forwarded traffic */ + POLICY_FWD = 2, }; typedef struct kernel_interface_t kernel_interface_t; @@ -52,10 +69,10 @@ typedef struct kernel_interface_t kernel_interface_t; * reference counting. The Linux kernel does not allow the same policy * installed twice, but we need this as CHILD_SA exist multiple times * when rekeying. Thats why we do reference counting of policies. - * + * * @b Constructors: * - kernel_interface_create() - * + * * @ingroup threads */ struct kernel_interface_t { @@ -101,8 +118,8 @@ struct kernel_interface_t { * @param expire_hard lieftime in seconds before delete * @param enc_alg Algorithm to use for encryption (ESP only) * @param int_alg Algorithm to use for integrity protection - * @param prf_plus PRF to derive keys - * @param natt NAT-T Configuration + * @param prf_plus PRF to derive keys from + * @param natt NAT-T Configuration, or NULL of no NAT-T used * @param replace Should an already installed SA be updated? * @return * - SUCCESS @@ -113,35 +130,38 @@ struct kernel_interface_t { protocol_id_t protocol, u_int32_t reqid, u_int64_t expire_soft, u_int64_t expire_hard, algorithm_t *enc_alg, algorithm_t *int_alg, - prf_plus_t *prf_plus, natt_conf_t *natt, bool replace); + prf_plus_t *prf_plus, natt_conf_t *natt, bool update); /** - * @brief Update the hosts on an installed SA. Encapsulation ports are also updated. + * @brief Update the hosts on an installed SA. * - * @note We cannot directly update the destination address as the kernel requires the spi, - * the protocol AND the destination address (and family) to identify SAs. Therefore if the - * destination address changed we create a new SA and delete the old one. + * We cannot directly update the destination address as the kernel + * requires the spi, the protocol AND the destination address (and family) + * to identify SAs. Therefore if the destination address changed we + * create a new SA and delete the old one. * * @param this calling object - * @param src source address for this SA * @param dst destination address for this SA + * @param spi SPI of the SA + * @param protocol protocol for this SA (ESP/AH) * @param new_src new source address for this SA * @param new_dst new destination address for this SA * @param src_changes changes in src * @param dst_changes changes in dst - * @param spi SPI allocated by us or remote peer - * @param protocol protocol for this SA (ESP/AH) * @return * - SUCCESS * - FAILED if kernel comm failed */ - status_t (*update_sa_hosts)(kernel_interface_t *this, - host_t *src, host_t *dst, - host_t *new_src, host_t *new_dst, - int src_changes, int dst_changes, - u_int32_t spi, protocol_id_t protocol); + status_t (*update_sa)(kernel_interface_t *this, host_t *dst, u_int32_t spi, + protocol_id_t protocol, + host_t *new_src, host_t *new_dst, + host_diff_t src_changes, host_diff_t dst_changes); + /** * @brief Query the use time of an SA. + * + * The use time of an SA is not the time of the last usage, but + * the time of the first usage of the SA. * * @param this calling object * @param dst destination address for this SA @@ -153,7 +173,7 @@ struct kernel_interface_t { * - FAILED if kernel comm failed */ status_t (*query_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi, - protocol_id_t protocol, time_t *use_time); + protocol_id_t protocol, u_int32_t *use_time); /** * @brief Delete a previusly installed SA from the SAD. @@ -172,20 +192,19 @@ struct kernel_interface_t { /** * @brief Add a policy to the SPD. * - * A policy is always associated to an SA, so - * traffic applied to a policy. Traffic which - * matches a policy is handled by the SA with the same - * reqid. + * A policy is always associated to an SA. Traffic which matches a + * policy is handled by the SA with the same reqid. + * If the update flag is set, the policy is updated with the new + * src/dst addresses. + * If the update flag is not set, but a such policy is already in the + * kernel, the reference count to this policy is increased. * * @param this calling object - * @param me address of local peer - * @param other address of remote peer - * @param src src address of traffic this policy applies - * @param dst dest address of traffic this policy applies - * @param src_hostbits subnetmask to use for src address - * @param dst_hostbits subnetmask to use for dst address - * @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD - * @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...) + * @param src source address of SA + * @param dst dest address of SA + * @param src_ts traffic selector to match traffic source + * @param dst_ts traffic selector to match traffic dest + * @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD * @param protocol protocol to use to protect traffic (AH/ESP) * @param reqid uniqe ID of an SA to use to enforce policy * @param update update an existing policy, if TRUE @@ -193,32 +212,53 @@ struct kernel_interface_t { * - SUCCESS * - FAILED if kernel comm failed */ - status_t (*add_policy) (kernel_interface_t *this, - host_t *me, host_t *other, + status_t (*add_policy) (kernel_interface_t *this, host_t *src, host_t *dst, - u_int8_t src_hostbits, u_int8_t dst_hostbits, - u_int8_t direction, u_int8_t upper_proto, - protocol_id_t protocol, + traffic_selector_t *src_ts, + traffic_selector_t *dst_ts, + policy_dir_t direction, protocol_id_t protocol, u_int32_t reqid, bool update); /** + * @brief Query the use time of a policy. + * + * The use time of a policy is the time the policy was used + * for the last time. + * + * @param this calling object + * @param src_ts traffic selector to match traffic source + * @param dst_ts traffic selector to match traffic dest + * @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD + * @param[out] use_time the time of this SA's last use + * @return + * - SUCCESS + * - FAILED if kernel comm failed + */ + status_t (*query_policy) (kernel_interface_t *this, + traffic_selector_t *src_ts, + traffic_selector_t *dst_ts, + policy_dir_t direction, u_int32_t *use_time); + + /** * @brief Remove a policy from the SPD. * + * The kernel interface implements reference counting for policies. + * If the same policy is installed multiple times (in the case of rekeying), + * the reference counter is increased. del_policy() decreases the ref counter + * and removes the policy only when no more references are available. + * * @param this calling object - * @param src src address of traffic this policy applies - * @param dst dest address of traffic this policy applies - * @param src_hostbits subnetmask to use for src address - * @param dst_hostbits subnetmask to use for dst address - * @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD - * @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...) + * @param src_ts traffic selector to match traffic source + * @param dst_ts traffic selector to match traffic dest + * @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD * @return * - SUCCESS * - FAILED if kernel comm failed */ status_t (*del_policy) (kernel_interface_t *this, - host_t *src, host_t *dst, - u_int8_t src_hostbits, u_int8_t dst_hostbits, - u_int8_t direction, u_int8_t upper_proto); + traffic_selector_t *src_ts, + traffic_selector_t *dst_ts, + policy_dir_t direction); /** * @brief Destroys a kernel_interface object. |