kernel-interface: Add feature to indicate if query_sa() returns last use time

Currently supported by libipsec and PF_KEY on macOS (FreeBSD, like Linux,
reports the time the SA was first used in sadb_lifetime_usetime - it also
triggers rekeyings based on that, which Linux doesn't, it also triggers
them if an SA is never used).

src/frontends/android/app/src/main/jni/libandroidbridge/kernel/android_ipsec.c

@@ -46,6 +46,12 @@ static void expire(uint8_t protocol, uint32_t spi, host_t *dst, bool hard)
 	charon->kernel->expire(charon->kernel, protocol, spi, dst, hard);
 }
 
+METHOD(kernel_ipsec_t, get_features, kernel_feature_t,
+	private_kernel_android_ipsec_t *this)
+{
+	return KERNEL_SA_USE_TIME;
+}
+
 METHOD(kernel_ipsec_t, get_spi, status_t,
 	private_kernel_android_ipsec_t *this, host_t *src, host_t *dst,
 	uint8_t protocol, uint32_t *spi)
@@ -166,6 +172,7 @@ kernel_android_ipsec_t *kernel_android_ipsec_create()
 	INIT(this,
 		.public = {
 			.interface = {
+				.get_features = _get_features,
 				.get_spi = _get_spi,
 				.get_cpi = _get_cpi,
 				.add_sa  = _add_sa,

src/libcharon/kernel/kernel_interface.h

@@ -79,6 +79,8 @@ enum kernel_feature_t {
 	KERNEL_NO_POLICY_UPDATES = (1<<3),
 	/** IPsec backend supports installing SPIs on policies */
 	KERNEL_POLICY_SPI = (1<<4),
+	/** IPsec backend reports use time per SA via query_sa() */
+	KERNEL_SA_USE_TIME = (1<<5),
 };
 
 /**
@@ -202,7 +204,11 @@ struct kernel_interface_t {
 						  kernel_ipsec_update_sa_t *data);
 
 	/**
-	 * Query the number of bytes processed by an SA from the SAD.
+	 * Query the number of bytes and packets processed by an SA from the SAD.
+	 *
+	 * Some implementations may also return the last use time (as indicated by
+	 * get_features()). This is a monotonic timestamp as returned by
+	 * time_monotonic().
 	 *
 	 * @param id			data identifying this SA
 	 * @param data			data to query the SA
@@ -247,11 +253,12 @@ struct kernel_interface_t {
 	 * Query the use time of a policy.
 	 *
 	 * The use time of a policy is the time the policy was used
-	 * for the last time.
+	 * for the last time. This is a monotonic timestamp as returned by
+	 * time_monotonic().
 	 *
 	 * @param id			data identifying this policy
 	 * @param data			data to query the policy
-	 * @param[out] use_time	the monotonic timestamp of this SA's last use
+	 * @param[out] use_time	the monotonic timestamp of this policy's last use
 	 * @return				SUCCESS if operation completed
 	 */
 	status_t (*query_policy)(kernel_interface_t *this,

src/libcharon/kernel/kernel_ipsec.h

@@ -269,7 +269,11 @@ struct kernel_ipsec_t {
 						  kernel_ipsec_update_sa_t *data);
 
 	/**
-	 * Query the number of bytes processed by an SA from the SAD.
+	 * Query the number of bytes and packets processed by an SA from the SAD.
+	 *
+	 * Some implementations may also return the last use time (as indicated by
+	 * get_features()). This is a monotonic timestamp as returned by
+	 * time_monotonic().
 	 *
 	 * @param id			data identifying this SA
 	 * @param data			data to query the SA
@@ -314,12 +318,11 @@ struct kernel_ipsec_t {
 	 * Query the use time of a policy.
 	 *
 	 * The use time of a policy is the time the policy was used for the last
-	 * time. It is not the system time, but a monotonic timestamp as returned
-	 * by time_monotonic.
+	 * time. This is a monotonic timestamp as returned by time_monotonic().
 	 *
 	 * @param id			data identifying this policy
 	 * @param data			data to query the policy
-	 * @param[out] use_time	the monotonic timestamp of this SA's last use
+	 * @param[out] use_time	the monotonic timestamp of this policy's last use
 	 * @return				SUCCESS if operation completed
 	 */
 	status_t (*query_policy)(kernel_ipsec_t *this,

src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c

@@ -231,7 +231,8 @@ static void expire(uint8_t protocol, uint32_t spi, host_t *dst, bool hard)
 METHOD(kernel_ipsec_t, get_features, kernel_feature_t,
 	private_kernel_libipsec_ipsec_t *this)
 {
-	return KERNEL_REQUIRE_UDP_ENCAPSULATION | KERNEL_ESP_V3_TFC;
+	return KERNEL_REQUIRE_UDP_ENCAPSULATION | KERNEL_ESP_V3_TFC |
+		   KERNEL_SA_USE_TIME;
 }
 
 METHOD(kernel_ipsec_t, get_spi, status_t,

src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c

@@ -1659,6 +1659,16 @@ static status_t get_spi_internal(private_kernel_pfkey_ipsec_t *this,
 	return SUCCESS;
 }
 
+METHOD(kernel_ipsec_t, get_features, kernel_feature_t,
+	private_kernel_pfkey_ipsec_t *this)
+{
+#ifdef __APPLE__
+	return KERNEL_SA_USE_TIME;
+#else
+	return 0;
+#endif
+}
+
 METHOD(kernel_ipsec_t, get_spi, status_t,
 	private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
 	uint8_t protocol, uint32_t *spi)
@@ -2198,9 +2208,9 @@ METHOD(kernel_ipsec_t, query_sa, status_t,
 		/* OS X uses the "last" time of use in usetime */
 		*time = response.lft_current->sadb_lifetime_usetime;
 #else /* !__APPLE__ */
-		/* on Linux, sadb_lifetime_usetime is set to the "first" time of use,
-		 * which is actually correct according to PF_KEY. We have to query
-		 * policies for the last usetime. */
+		/* on Linux and FreeBSD, sadb_lifetime_usetime is set to the "first"
+		 * time of use, which is actually correct according to PF_KEY. We have
+		 * to query policies for the last usetime. */
 		*time = 0;
 #endif /* !__APPLE__ */
 	}
@@ -3308,6 +3318,7 @@ kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create()
 	INIT(this,
 		.public = {
 			.interface = {
+				.get_features = _get_features,
 				.get_spi = _get_spi,
 				.get_cpi = _get_cpi,
 				.add_sa  = _add_sa,