93c89f6b0fe6a4171734fd4824bcad26ddad03df
[strongswan.git] / src / charon / kernel / kernel_interface.h
1 /*
2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2006 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /**
20 * @defgroup kernel_interface kernel_interface
21 * @{ @ingroup kernel
22 */
23
24 #ifndef KERNEL_INTERFACE_H_
25 #define KERNEL_INTERFACE_H_
26
27 typedef struct kernel_interface_t kernel_interface_t;
28
29 #include <utils/host.h>
30 #include <crypto/prf_plus.h>
31 #include <encoding/payloads/proposal_substructure.h>
32
33 #include <kernel/kernel_ipsec.h>
34 #include <kernel/kernel_net.h>
35
36 /**
37 * Constructor function for ipsec kernel interface
38 */
39 typedef kernel_ipsec_t* (*kernel_ipsec_constructor_t)(void);
40
41 /**
42 * Constructor function for network kernel interface
43 */
44 typedef kernel_net_t* (*kernel_net_constructor_t)(void);
45
46 /**
47 * Manager and wrapper for different kernel interfaces.
48 *
49 * The kernel interface handles the communication with the kernel
50 * for SA and policy management and interface and IP address management.
51 */
52 struct kernel_interface_t {
53
54 /**
55 * Get a SPI from the kernel.
56 *
57 * @param src source address of SA
58 * @param dst destination address of SA
59 * @param protocol protocol for SA (ESP/AH)
60 * @param reqid unique ID for this SA
61 * @param spi allocated spi
62 * @return SUCCESS if operation completed
63 */
64 status_t (*get_spi)(kernel_interface_t *this, host_t *src, host_t *dst,
65 protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi);
66
67 /**
68 * Get a Compression Parameter Index (CPI) from the kernel.
69 *
70 * @param src source address of SA
71 * @param dst destination address of SA
72 * @param reqid unique ID for the corresponding SA
73 * @param cpi allocated cpi
74 * @return SUCCESS if operation completed
75 */
76 status_t (*get_cpi)(kernel_interface_t *this, host_t *src, host_t *dst,
77 u_int32_t reqid, u_int16_t *cpi);
78
79 /**
80 * Add an SA to the SAD.
81 *
82 * add_sa() may update an already allocated
83 * SPI (via get_spi). In this case, the replace
84 * flag must be set.
85 * This function does install a single SA for a
86 * single protocol in one direction. The kernel-interface
87 * gets the keys itself from the PRF, as we don't know
88 * his algorithms and key sizes.
89 *
90 * @param src source address for this SA
91 * @param dst destination address for this SA
92 * @param spi SPI allocated by us or remote peer
93 * @param protocol protocol for this SA (ESP/AH)
94 * @param reqid unique ID for this SA
95 * @param expire_soft lifetime in seconds before rekeying
96 * @param expire_hard lifetime in seconds before delete
97 * @param enc_alg Algorithm to use for encryption (ESP only)
98 * @param enc_key key to use for encryption
99 * @param int_alg Algorithm to use for integrity protection
100 * @param int_key key to use for integrity protection
101 * @param mode mode of the SA (tunnel, transport)
102 * @param ipcomp IPComp transform to use
103 * @param cpi CPI for IPComp
104 * @param encap enable UDP encapsulation for NAT traversal
105 * @param inbound TRUE if this is an inbound SA
106 * @return SUCCESS if operation completed
107 */
108 status_t (*add_sa) (kernel_interface_t *this,
109 host_t *src, host_t *dst, u_int32_t spi,
110 protocol_id_t protocol, u_int32_t reqid,
111 u_int64_t expire_soft, u_int64_t expire_hard,
112 u_int16_t enc_alg, chunk_t enc_key,
113 u_int16_t int_alg, chunk_t int_key,
114 ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
115 bool encap, bool inbound);
116
117 /**
118 * Update the hosts on an installed SA.
119 *
120 * We cannot directly update the destination address as the kernel
121 * requires the spi, the protocol AND the destination address (and family)
122 * to identify SAs. Therefore if the destination address changed we
123 * create a new SA and delete the old one.
124 *
125 * @param spi SPI of the SA
126 * @param protocol protocol for this SA (ESP/AH)
127 * @param cpi CPI for IPComp, 0 if no IPComp is used
128 * @param src current source address
129 * @param dst current destination address
130 * @param new_src new source address
131 * @param new_dst new destination address
132 * @param encap current use of UDP encapsulation
133 * @param new_encap new use of UDP encapsulation
134 * @return SUCCESS if operation completed, NOT_SUPPORTED if
135 * the kernel interface can't update the SA
136 */
137 status_t (*update_sa)(kernel_interface_t *this,
138 u_int32_t spi, protocol_id_t protocol, u_int16_t cpi,
139 host_t *src, host_t *dst,
140 host_t *new_src, host_t *new_dst,
141 bool encap, bool new_encap);
142
143 /**
144 * Delete a previously installed SA from the SAD.
145 *
146 * @param src source address for this SA
147 * @param dst destination address for this SA
148 * @param spi SPI allocated by us or remote peer
149 * @param protocol protocol for this SA (ESP/AH)
150 * @param cpi CPI for IPComp or 0
151 * @return SUCCESS if operation completed
152 */
153 status_t (*del_sa) (kernel_interface_t *this, host_t *src, host_t *dst,
154 u_int32_t spi, protocol_id_t protocol, u_int16_t cpi);
155
156 /**
157 * Add a policy to the SPD.
158 *
159 * A policy is always associated to an SA. Traffic which matches a
160 * policy is handled by the SA with the same reqid.
161 *
162 * @param src source address of SA
163 * @param dst dest address of SA
164 * @param src_ts traffic selector to match traffic source
165 * @param dst_ts traffic selector to match traffic dest
166 * @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
167 * @param spi SPI of SA
168 * @param protocol protocol to use to protect traffic (AH/ESP)
169 * @param reqid unique ID of an SA to use to enforce policy
170 * @param mode mode of SA (tunnel, transport)
171 * @param ipcomp the IPComp transform used
172 * @param cpi CPI for IPComp
173 * @param routed TRUE, if this policy is routed in the kernel
174 * @return SUCCESS if operation completed
175 */
176 status_t (*add_policy) (kernel_interface_t *this,
177 host_t *src, host_t *dst,
178 traffic_selector_t *src_ts,
179 traffic_selector_t *dst_ts,
180 policy_dir_t direction, u_int32_t spi,
181 protocol_id_t protocol, u_int32_t reqid,
182 ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
183 bool routed);
184
185 /**
186 * Query the use time of a policy.
187 *
188 * The use time of a policy is the time the policy was used
189 * for the last time.
190 *
191 * @param src_ts traffic selector to match traffic source
192 * @param dst_ts traffic selector to match traffic dest
193 * @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
194 * @param[out] use_time the time of this SA's last use
195 * @return SUCCESS if operation completed
196 */
197 status_t (*query_policy) (kernel_interface_t *this,
198 traffic_selector_t *src_ts,
199 traffic_selector_t *dst_ts,
200 policy_dir_t direction, u_int32_t *use_time);
201
202 /**
203 * Remove a policy from the SPD.
204 *
205 * The kernel interface implements reference counting for policies.
206 * If the same policy is installed multiple times (in the case of rekeying),
207 * the reference counter is increased. del_policy() decreases the ref counter
208 * and removes the policy only when no more references are available.
209 *
210 * @param src_ts traffic selector to match traffic source
211 * @param dst_ts traffic selector to match traffic dest
212 * @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
213 * @param unrouted TRUE, if this policy is unrouted from the kernel
214 * @return SUCCESS if operation completed
215 */
216 status_t (*del_policy) (kernel_interface_t *this,
217 traffic_selector_t *src_ts,
218 traffic_selector_t *dst_ts,
219 policy_dir_t direction,
220 bool unrouted);
221
222 /**
223 * Get our outgoing source address for a destination.
224 *
225 * Does a route lookup to get the source address used to reach dest.
226 * The returned host is allocated and must be destroyed.
227 * An optional src address can be used to check if a route is available
228 * for given source to dest.
229 *
230 * @param dest target destination address
231 * @param src source address to check, or NULL
232 * @return outgoing source address, NULL if unreachable
233 */
234 host_t* (*get_source_addr)(kernel_interface_t *this,
235 host_t *dest, host_t *src);
236
237 /**
238 * Get the next hop for a destination.
239 *
240 * Does a route lookup to get the next hop used to reach dest.
241 * The returned host is allocated and must be destroyed.
242 *
243 * @param dest target destination address
244 * @return next hop address, NULL if unreachable
245 */
246 host_t* (*get_nexthop)(kernel_interface_t *this, host_t *dest);
247
248 /**
249 * Get the interface name of a local address.
250 *
251 * @param host address to get interface name from
252 * @return allocated interface name, or NULL if not found
253 */
254 char* (*get_interface) (kernel_interface_t *this, host_t *host);
255
256 /**
257 * Creates an enumerator over all local addresses.
258 *
259 * This function blocks an internal cached address list until the
260 * enumerator gets destroyed.
261 * The hosts are read-only, do not modify of free.
262 *
263 * @param include_down_ifaces TRUE to enumerate addresses from down interfaces
264 * @param include_virtual_ips TRUE to enumerate virtual ip addresses
265 * @return enumerator over host_t's
266 */
267 enumerator_t *(*create_address_enumerator) (kernel_interface_t *this,
268 bool include_down_ifaces, bool include_virtual_ips);
269
270 /**
271 * Add a virtual IP to an interface.
272 *
273 * Virtual IPs are attached to an interface. If an IP is added multiple
274 * times, the IP is refcounted and not removed until del_ip() was called
275 * as many times as add_ip().
276 * The virtual IP is attached to the interface where the iface_ip is found.
277 *
278 * @param virtual_ip virtual ip address to assign
279 * @param iface_ip IP of an interface to attach virtual IP
280 * @return SUCCESS if operation completed
281 */
282 status_t (*add_ip) (kernel_interface_t *this, host_t *virtual_ip,
283 host_t *iface_ip);
284
285 /**
286 * Remove a virtual IP from an interface.
287 *
288 * The kernel interface uses refcounting, see add_ip().
289 *
290 * @param virtual_ip virtual ip address to assign
291 * @return SUCCESS if operation completed
292 */
293 status_t (*del_ip) (kernel_interface_t *this, host_t *virtual_ip);
294
295 /**
296 * Add a route.
297 *
298 * @param dst_net destination net
299 * @param prefixlen destination net prefix length
300 * @param gateway gateway for this route
301 * @param src_ip sourc ip of the route
302 * @param if_name name of the interface the route is bound to
303 * @return SUCCESS if operation completed
304 * ALREADY_DONE if the route already exists
305 */
306 status_t (*add_route) (kernel_interface_t *this, chunk_t dst_net, u_int8_t prefixlen,
307 host_t *gateway, host_t *src_ip, char *if_name);
308
309 /**
310 * Delete a route.
311 *
312 * @param dst_net destination net
313 * @param prefixlen destination net prefix length
314 * @param gateway gateway for this route
315 * @param src_ip sourc ip of the route
316 * @param if_name name of the interface the route is bound to
317 * @return SUCCESS if operation completed
318 */
319 status_t (*del_route) (kernel_interface_t *this, chunk_t dst_net, u_int8_t prefixlen,
320 host_t *gateway, host_t *src_ip, char *if_name);
321
322 /**
323 * manager methods
324 */
325
326 /**
327 * Tries to find an ip address of a local interface that is included in the
328 * supplied traffic selector.
329 *
330 * @param ts traffic selector
331 * @param ip returned ip (has to be destroyed)
332 * @return SUCCESS if address found
333 */
334 status_t (*get_address_by_ts) (kernel_interface_t *this,
335 traffic_selector_t *ts, host_t **ip);
336
337 /**
338 * Register an ipsec kernel interface constructor on the manager.
339 *
340 * @param create constructor to register
341 */
342 void (*add_ipsec_interface)(kernel_interface_t *this, kernel_ipsec_constructor_t create);
343
344 /**
345 * Unregister an ipsec kernel interface constructor.
346 *
347 * @param create constructor to unregister
348 */
349 void (*remove_ipsec_interface)(kernel_interface_t *this, kernel_ipsec_constructor_t create);
350
351 /**
352 * Register a network kernel interface constructor on the manager.
353 *
354 * @param create constructor to register
355 */
356 void (*add_net_interface)(kernel_interface_t *this, kernel_net_constructor_t create);
357
358 /**
359 * Unregister a network kernel interface constructor.
360 *
361 * @param create constructor to unregister
362 */
363 void (*remove_net_interface)(kernel_interface_t *this, kernel_net_constructor_t create);
364
365 /**
366 * Create the kernel interfaces classes.
367 */
368 void (*create_interfaces)(kernel_interface_t *this);
369
370 /**
371 * Destroys a kernel_interface_manager_t object.
372 */
373 void (*destroy) (kernel_interface_t *this);
374 };
375
376 /**
377 * Creates an object of type kernel_interface_t.
378 */
379 kernel_interface_t *kernel_interface_create(void);
380
381 #endif /** KERNEL_INTERFACE_H_ @}*/