summaryrefslogtreecommitdiff
path: root/src/charon/kernel/kernel_interface.h
diff options
context:
space:
mode:
Diffstat (limited to 'src/charon/kernel/kernel_interface.h')
-rw-r--r--src/charon/kernel/kernel_interface.h79
1 files changed, 40 insertions, 39 deletions
diff --git a/src/charon/kernel/kernel_interface.h b/src/charon/kernel/kernel_interface.h
index b3bf907e5..3c3b05c81 100644
--- a/src/charon/kernel/kernel_interface.h
+++ b/src/charon/kernel/kernel_interface.h
@@ -15,7 +15,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
- * $Id: kernel_interface.h 4386 2008-10-08 08:23:46Z martin $
+ * $Id: kernel_interface.h 4618 2008-11-11 09:22:00Z tobias $
*/
/**
@@ -56,10 +56,6 @@ struct kernel_interface_t {
/**
* Get a SPI from the kernel.
*
- * @warning get_spi() implicitly creates an SA with
- * the allocated SPI, therefore the replace flag
- * in add_sa() must be set when installing this SA.
- *
* @param src source address of SA
* @param dst destination address of SA
* @param protocol protocol for SA (ESP/AH)
@@ -101,25 +97,24 @@ struct kernel_interface_t {
* @param expire_soft lifetime in seconds before rekeying
* @param expire_hard lifetime in seconds before delete
* @param enc_alg Algorithm to use for encryption (ESP only)
- * @param enc_size key length of encryption algorithm, if dynamic
+ * @param enc_key key to use for encryption
* @param int_alg Algorithm to use for integrity protection
- * @param int_size key length of integrity algorithm, if dynamic
- * @param prf_plus PRF to derive keys from
+ * @param int_key key to use for integrity protection
* @param mode mode of the SA (tunnel, transport)
* @param ipcomp IPComp transform to use
+ * @param cpi CPI for IPComp
* @param encap enable UDP encapsulation for NAT traversal
- * @param replace Should an already installed SA be updated?
+ * @param inbound TRUE if this is an inbound SA
* @return SUCCESS if operation completed
*/
status_t (*add_sa) (kernel_interface_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
u_int64_t expire_soft, u_int64_t expire_hard,
- u_int16_t enc_alg, u_int16_t enc_size,
- u_int16_t int_alg, u_int16_t int_size,
- prf_plus_t *prf_plus, ipsec_mode_t mode,
- u_int16_t ipcomp, bool encap,
- bool update);
+ u_int16_t enc_alg, chunk_t enc_key,
+ u_int16_t int_alg, chunk_t int_key,
+ ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
+ bool encap, bool inbound);
/**
* Update the hosts on an installed SA.
@@ -131,32 +126,21 @@ struct kernel_interface_t {
*
* @param spi SPI of the SA
* @param protocol protocol for this SA (ESP/AH)
+ * @param cpi CPI for IPComp, 0 if no IPComp is used
* @param src current source address
* @param dst current destination address
* @param new_src new source address
* @param new_dst new destination address
- * @param encap use UDP encapsulation
- * @return SUCCESS if operation completed
+ * @param encap current use of UDP encapsulation
+ * @param new_encap new use of UDP encapsulation
+ * @return SUCCESS if operation completed, NOT_SUPPORTED if
+ * the kernel interface can't update the SA
*/
status_t (*update_sa)(kernel_interface_t *this,
- u_int32_t spi, protocol_id_t protocol,
+ u_int32_t spi, protocol_id_t protocol, u_int16_t cpi,
host_t *src, host_t *dst,
- host_t *new_src, host_t *new_dst, bool encap);
-
- /**
- * Query the use time of an SA.
- *
- * The use time of an SA is not the time of the last usage, but
- * the time of the first usage of the SA.
- *
- * @param dst destination address for this SA
- * @param spi SPI allocated by us or remote peer
- * @param protocol protocol for this SA (ESP/AH)
- * @param use_time pointer receives the time of this SA's last use
- * @return SUCCESS if operation completed
- */
- status_t (*query_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
- protocol_id_t protocol, u_int32_t *use_time);
+ host_t *new_src, host_t *new_dst,
+ bool encap, bool new_encap);
/**
* Delete a previously installed SA from the SAD.
@@ -164,10 +148,11 @@ struct kernel_interface_t {
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
+ * @param cpi CPI for IPComp or 0
* @return SUCCESS if operation completed
*/
status_t (*del_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
- protocol_id_t protocol);
+ protocol_id_t protocol, u_int16_t cpi);
/**
* Add a policy to the SPD.
@@ -180,20 +165,23 @@ struct kernel_interface_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
+ * @param spi SPI of SA
* @param protocol protocol to use to protect traffic (AH/ESP)
* @param reqid unique ID of an SA to use to enforce policy
- * @param high_prio if TRUE, uses a higher priority than any with FALSE
* @param mode mode of SA (tunnel, transport)
* @param ipcomp the IPComp transform used
+ * @param cpi CPI for IPComp
+ * @param routed TRUE, if this policy is routed in the kernel
* @return SUCCESS if operation completed
*/
status_t (*add_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
- policy_dir_t direction, protocol_id_t protocol,
- u_int32_t reqid, bool high_prio, ipsec_mode_t mode,
- u_int16_t ipcomp);
+ policy_dir_t direction, u_int32_t spi,
+ protocol_id_t protocol, u_int32_t reqid,
+ ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
+ bool routed);
/**
* Query the use time of a policy.
@@ -223,12 +211,14 @@ struct kernel_interface_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
+ * @param unrouted TRUE, if this policy is unrouted from the kernel
* @return SUCCESS if operation completed
*/
status_t (*del_policy) (kernel_interface_t *this,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
- policy_dir_t direction);
+ policy_dir_t direction,
+ bool unrouted);
/**
* Get our outgoing source address for a destination.
@@ -335,6 +325,17 @@ struct kernel_interface_t {
*/
/**
+ * Tries to find an ip address of a local interface that is included in the
+ * supplied traffic selector.
+ *
+ * @param ts traffic selector
+ * @param ip returned ip (has to be destroyed)
+ * @return SUCCESS if address found
+ */
+ status_t (*get_address_by_ts) (kernel_interface_t *this,
+ traffic_selector_t *ts, host_t **ip);
+
+ /**
* Register an ipsec kernel interface constructor on the manager.
*
* @param create constructor to register