denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleanups in kernel interface code

Browse Source 
added proper traffic selector to string conversion
some cleanups here & there
This commit is contained in:
Martin Willi
2006-07-18 12:53:54 +00:00
parent 623d3dcf78
commit 92ee45a0ee
23 changed files with 730 additions and 586 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/threads/kernel_interface.h
+88 -48
View File
@@ -25,8 +25,6 @@
#ifndef KERNEL_INTERFACE_H_
#define KERNEL_INTERFACE_H_
#include <linux/xfrm.h>
#include <utils/host.h>
#include <crypto/prf_plus.h>
#include <encoding/payloads/proposal_substructure.h>
@@ -34,10 +32,29 @@
typedef struct natt_conf_t natt_conf_t;
/**
* @brief Configuration for NAT-T
* Configuration for NAT-T
*/
struct natt_conf_t {
u_int16_t sport, dport;
/** source port to use for UDP-encapsulated packets */
u_int16_t sport;
/** dest port to use for UDP-encapsulated packets */
u_int16_t dport;
};
typedef enum policy_dir_t policy_dir_t;
/**
* Direction of a policy. These are equal to those
* defined in xfrm.h, but we want to stay implementation
* neutral here.
*/
enum policy_dir_t {
/** Policy for inbound traffic */
POLICY_IN = 0,
/** Policy for outbound traffic */
POLICY_OUT = 1,
/** Policy for forwarded traffic */
POLICY_FWD = 2,
};
typedef struct kernel_interface_t kernel_interface_t;
@@ -52,10 +69,10 @@ typedef struct kernel_interface_t kernel_interface_t;
* reference counting. The Linux kernel does not allow the same policy
* installed twice, but we need this as CHILD_SA exist multiple times
* when rekeying. Thats why we do reference counting of policies.
*
*
* @b Constructors:
* - kernel_interface_create()
*
*
* @ingroup threads
*/
struct kernel_interface_t {
@@ -101,8 +118,8 @@ struct kernel_interface_t {
* @param expire_hard lieftime in seconds before delete
* @param enc_alg Algorithm to use for encryption (ESP only)
* @param int_alg Algorithm to use for integrity protection
* @param prf_plus PRF to derive keys
* @param natt NAT-T Configuration
* @param prf_plus PRF to derive keys from
* @param natt NAT-T Configuration, or NULL of no NAT-T used
* @param replace Should an already installed SA be updated?
* @return
* - SUCCESS
@@ -113,35 +130,38 @@ struct kernel_interface_t {
protocol_id_t protocol, u_int32_t reqid,
u_int64_t expire_soft, u_int64_t expire_hard,
algorithm_t *enc_alg, algorithm_t *int_alg,
prf_plus_t *prf_plus, natt_conf_t *natt, bool replace);
prf_plus_t *prf_plus, natt_conf_t *natt, bool update);
/**
* @brief Update the hosts on an installed SA. Encapsulation ports are also updated.
* @brief Update the hosts on an installed SA.
*
* @note We cannot directly update the destination address as the kernel requires the spi,
* the protocol AND the destination address (and family) to identify SAs. Therefore if the
* destination address changed we create a new SA and delete the old one.
* We cannot directly update the destination address as the kernel
* requires the spi, the protocol AND the destination address (and family)
* to identify SAs. Therefore if the destination address changed we
* create a new SA and delete the old one.
*
* @param this calling object
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI of the SA
* @param protocol protocol for this SA (ESP/AH)
* @param new_src new source address for this SA
* @param new_dst new destination address for this SA
* @param src_changes changes in src
* @param dst_changes changes in dst
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @return
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*update_sa_hosts)(kernel_interface_t *this,
host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst,
int src_changes, int dst_changes,
u_int32_t spi, protocol_id_t protocol);
status_t (*update_sa)(kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol,
host_t *new_src, host_t *new_dst,
host_diff_t src_changes, host_diff_t dst_changes);
/**
* @brief Query the use time of an SA.
*
* The use time of an SA is not the time of the last usage, but
* the time of the first usage of the SA.
*
* @param this calling object
* @param dst destination address for this SA
@@ -153,7 +173,7 @@ struct kernel_interface_t {
* - FAILED if kernel comm failed
*/
status_t (*query_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol, time_t *use_time);
protocol_id_t protocol, u_int32_t *use_time);
/**
* @brief Delete a previusly installed SA from the SAD.
@@ -172,20 +192,19 @@ struct kernel_interface_t {
/**
* @brief Add a policy to the SPD.
*
* A policy is always associated to an SA, so
* traffic applied to a policy. Traffic which
* matches a policy is handled by the SA with the same
* reqid.
* A policy is always associated to an SA. Traffic which matches a
* policy is handled by the SA with the same reqid.
* If the update flag is set, the policy is updated with the new
* src/dst addresses.
* If the update flag is not set, but a such policy is already in the
* kernel, the reference count to this policy is increased.
*
* @param this calling object
* @param me address of local peer
* @param other address of remote peer
* @param src src address of traffic this policy applies
* @param dst dest address of traffic this policy applies
* @param src_hostbits subnetmask to use for src address
* @param dst_hostbits subnetmask to use for dst address
* @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD
* @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...)
* @param src source address of SA
* @param dst dest address of SA
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param protocol protocol to use to protect traffic (AH/ESP)
* @param reqid uniqe ID of an SA to use to enforce policy
* @param update update an existing policy, if TRUE
@@ -193,32 +212,53 @@ struct kernel_interface_t {
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*add_policy) (kernel_interface_t *this,
host_t *me, host_t *other,
status_t (*add_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
u_int8_t src_hostbits, u_int8_t dst_hostbits,
u_int8_t direction, u_int8_t upper_proto,
protocol_id_t protocol,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, protocol_id_t protocol,
u_int32_t reqid, bool update);
/**
* @brief Query the use time of a policy.
*
* The use time of a policy is the time the policy was used
* for the last time.
*
* @param this calling object
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param[out] use_time the time of this SA's last use
* @return
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*query_policy) (kernel_interface_t *this,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time);
/**
* @brief Remove a policy from the SPD.
*
* The kernel interface implements reference counting for policies.
* If the same policy is installed multiple times (in the case of rekeying),
* the reference counter is increased. del_policy() decreases the ref counter
* and removes the policy only when no more references are available.
*
* @param this calling object
* @param src src address of traffic this policy applies
* @param dst dest address of traffic this policy applies
* @param src_hostbits subnetmask to use for src address
* @param dst_hostbits subnetmask to use for dst address
* @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD
* @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...)
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @return
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*del_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
u_int8_t src_hostbits, u_int8_t dst_hostbits,
u_int8_t direction, u_int8_t upper_proto);
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction);
/**
* @brief Destroys a kernel_interface object.