src/libcharon/kernel/kernel_interface.h

   1 /*
   2  * Copyright (C) 2006-2015 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2006 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /*
  20  * Copyright (c) 2012 Nanoteq Pty Ltd
  21  *
  22  * Permission is hereby granted, free of charge, to any person obtaining a copy
  23  * of this software and associated documentation files (the "Software"), to deal
  24  * in the Software without restriction, including without limitation the rights
  25  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  26  * copies of the Software, and to permit persons to whom the Software is
  27  * furnished to do so, subject to the following conditions:
  28  *
  29  * The above copyright notice and this permission notice shall be included in
  30  * all copies or substantial portions of the Software.
  31  *
  32  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  33  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  34  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  35  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  36  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  37  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  38  * THE SOFTWARE.
  39  */
  40
  41 /**
  42  * @defgroup kernel_interface kernel_interface
  43  * @{ @ingroup kernel
  44  */
  45
  46 #ifndef KERNEL_INTERFACE_H_
  47 #define KERNEL_INTERFACE_H_
  48
  49 typedef struct kernel_interface_t kernel_interface_t;
  50 typedef enum kernel_feature_t kernel_feature_t;
  51
  52 #include <networking/host.h>
  53 #include <crypto/prf_plus.h>
  54
  55 #include <kernel/kernel_listener.h>
  56 #include <kernel/kernel_ipsec.h>
  57 #include <kernel/kernel_net.h>
  58
  59 /**
  60  * Bitfield of optional features a kernel backend supports.
  61  *
  62  * This feature-set is for both, kernel_ipsec_t and kernel_net_t. Each
  63  * backend returns a subset of these features.
  64  */
  65 enum kernel_feature_t {
  66         /** IPsec can process ESPv3 (RFC 4303) TFC padded packets */
  67         KERNEL_ESP_V3_TFC = (1<<0),
  68         /** Networking requires an "exclude" route for IKE/ESP packets */
  69         KERNEL_REQUIRE_EXCLUDE_ROUTE = (1<<1),
  70         /** IPsec implementation requires UDP encapsulation of ESP packets */
  71         KERNEL_REQUIRE_UDP_ENCAPSULATION = (1<<2),
  72         /** IPsec backend does not require a policy reinstall on SA updates */
  73         KERNEL_NO_POLICY_UPDATES = (1<<3),
  74 };
  75
  76 /**
  77  * Constructor function for ipsec kernel interface
  78  */
  79 typedef kernel_ipsec_t* (*kernel_ipsec_constructor_t)(void);
  80
  81 /**
  82  * Constructor function for network kernel interface
  83  */
  84 typedef kernel_net_t* (*kernel_net_constructor_t)(void);
  85
  86 /**
  87  * Manager and wrapper for different kernel interfaces.
  88  *
  89  * The kernel interface handles the communication with the kernel
  90  * for SA and policy management and interface and IP address management.
  91  */
  92 struct kernel_interface_t {
  93
  94         /**
  95          * Get the feature set supported by the net and ipsec kernel backends.
  96          *
  97          * @return                              ORed feature-set of backends
  98          */
  99         kernel_feature_t (*get_features)(kernel_interface_t *this);
 100
 101         /**
 102          * Get a SPI from the kernel.
 103          *
 104          * @param src           source address of SA
 105          * @param dst           destination address of SA
 106          * @param protocol      protocol for SA (ESP/AH)
 107          * @param spi           allocated spi
 108          * @return                      SUCCESS if operation completed
 109          */
 110         status_t (*get_spi)(kernel_interface_t *this, host_t *src, host_t *dst,
 111                                                 u_int8_t protocol, u_int32_t *spi);
 112
 113         /**
 114          * Get a Compression Parameter Index (CPI) from the kernel.
 115          *
 116          * @param src           source address of SA
 117          * @param dst           destination address of SA
 118          * @param cpi           allocated cpi
 119          * @return                      SUCCESS if operation completed
 120          */
 121         status_t (*get_cpi)(kernel_interface_t *this, host_t *src, host_t *dst,
 122                                                 u_int16_t *cpi);
 123
 124         /**
 125          * Allocate or confirm a reqid to use for a given SA pair.
 126          *
 127          * Each returned reqid by a successful call to alloc_reqid() must be
 128          * released using release_reqid().
 129          *
 130          * The reqid parameter is an in/out parameter. If it points to non-zero,
 131          * the reqid is confirmed and registered for use. If it points to zero,
 132          * a reqid is allocated for the given selectors, and returned to reqid.
 133          *
 134          * @param local_ts      traffic selectors of local side for SA
 135          * @param remote_ts     traffic selectors of remote side for SA
 136          * @param mark_in       inbound mark on SA
 137          * @param mark_out      outbound mark on SA
 138          * @param reqid         allocated reqid
 139          * @return                      SUCCESS if reqid allocated
 140          */
 141         status_t (*alloc_reqid)(kernel_interface_t *this,
 142                                                         linked_list_t *local_ts, linked_list_t *remote_ts,
 143                                                         mark_t mark_in, mark_t mark_out,
 144                                                         u_int32_t *reqid);
 145
 146         /**
 147          * Release a previously allocated reqid.
 148          *
 149          * @param reqid         reqid to release
 150          * @param mark_in       inbound mark on SA
 151          * @param mark_out      outbound mark on SA
 152          * @return                      SUCCESS if reqid released
 153          */
 154         status_t (*release_reqid)(kernel_interface_t *this, u_int32_t reqid,
 155                                                           mark_t mark_in, mark_t mark_out);
 156
 157         /**
 158          * Add an SA to the SAD.
 159          *
 160          * This function does install a single SA for a single protocol in one
 161          * direction.
 162          *
 163          * @param src                   source address for this SA
 164          * @param dst                   destination address for this SA
 165          * @param spi                   SPI allocated by us or remote peer
 166          * @param protocol              protocol for this SA (ESP/AH)
 167          * @param reqid                 reqid for this SA
 168          * @param mark                  optional mark for this SA
 169          * @param tfc                   Traffic Flow Confidentiality padding for this SA
 170          * @param lifetime              lifetime_cfg_t for this SA
 171          * @param enc_alg               Algorithm to use for encryption (ESP only)
 172          * @param enc_key               key to use for encryption
 173          * @param int_alg               Algorithm to use for integrity protection
 174          * @param int_key               key to use for integrity protection
 175          * @param mode                  mode of the SA (tunnel, transport)
 176          * @param ipcomp                IPComp transform to use
 177          * @param cpi                   CPI for IPComp
 178          * @param replay_window anti-replay window size
 179          * @param initiator             TRUE if initiator of the exchange creating this SA
 180          * @param encap                 enable UDP encapsulation for NAT traversal
 181          * @param esn                   TRUE to use Extended Sequence Numbers
 182          * @param inbound               TRUE if this is an inbound SA
 183          * @param update                TRUE if an SPI has already been allocated for SA
 184          * @param src_ts                list of source traffic selectors
 185          * @param dst_ts                list of destination traffic selectors
 186          * @return                              SUCCESS if operation completed
 187          */
 188         status_t (*add_sa) (kernel_interface_t *this,
 189                                                 host_t *src, host_t *dst, u_int32_t spi,
 190                                                 u_int8_t protocol, u_int32_t reqid, mark_t mark,
 191                                                 u_int32_t tfc, lifetime_cfg_t *lifetime,
 192                                                 u_int16_t enc_alg, chunk_t enc_key,
 193                                                 u_int16_t int_alg, chunk_t int_key,
 194                                                 ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
 195                                                 u_int32_t replay_window, bool initiator, bool encap,
 196                                                 bool esn, bool inbound, bool update,
 197                                                 linked_list_t *src_ts, linked_list_t *dst_ts);
 198
 199         /**
 200          * Update the hosts on an installed SA.
 201          *
 202          * We cannot directly update the destination address as the kernel
 203          * requires the spi, the protocol AND the destination address (and family)
 204          * to identify SAs. Therefore if the destination address changed we
 205          * create a new SA and delete the old one.
 206          *
 207          * @param spi                   SPI of the SA
 208          * @param protocol              protocol for this SA (ESP/AH)
 209          * @param cpi                   CPI for IPComp, 0 if no IPComp is used
 210          * @param src                   current source address
 211          * @param dst                   current destination address
 212          * @param new_src               new source address
 213          * @param new_dst               new destination address
 214          * @param encap                 current use of UDP encapsulation
 215          * @param new_encap             new use of UDP encapsulation
 216          * @param mark                  optional mark for this SA
 217          * @return                              SUCCESS if operation completed, NOT_SUPPORTED if
 218          *                                        the kernel interface can't update the SA
 219          */
 220         status_t (*update_sa)(kernel_interface_t *this,
 221                                                   u_int32_t spi, u_int8_t protocol, u_int16_t cpi,
 222                                                   host_t *src, host_t *dst,
 223                                                   host_t *new_src, host_t *new_dst,
 224                                                   bool encap, bool new_encap, mark_t mark);
 225
 226         /**
 227          * Query the number of bytes processed by an SA from the SAD.
 228          *
 229          * @param src                   source address for this SA
 230          * @param dst                   destination address for this SA
 231          * @param spi                   SPI allocated by us or remote peer
 232          * @param protocol              protocol for this SA (ESP/AH)
 233          * @param mark                  optional mark for this SA
 234          * @param[out] bytes    the number of bytes processed by SA
 235          * @param[out] packets  number of packets processed by SA
 236          * @param[out] time             last (monotonic) time of SA use
 237          * @return                              SUCCESS if operation completed
 238          */
 239         status_t (*query_sa) (kernel_interface_t *this, host_t *src, host_t *dst,
 240                                                   u_int32_t spi, u_int8_t protocol, mark_t mark,
 241                                                   u_int64_t *bytes, u_int64_t *packets, time_t *time);
 242
 243         /**
 244          * Delete a previously installed SA from the SAD.
 245          *
 246          * @param src                   source address for this SA
 247          * @param dst                   destination address for this SA
 248          * @param spi                   SPI allocated by us or remote peer
 249          * @param protocol              protocol for this SA (ESP/AH)
 250          * @param cpi                   CPI for IPComp or 0
 251          * @param mark                  optional mark for this SA
 252          * @return                              SUCCESS if operation completed
 253          */
 254         status_t (*del_sa) (kernel_interface_t *this, host_t *src, host_t *dst,
 255                                                 u_int32_t spi, u_int8_t protocol, u_int16_t cpi,
 256                                                 mark_t mark);
 257
 258         /**
 259          * Flush all SAs from the SAD.
 260          *
 261          * @return                              SUCCESS if operation completed
 262          */
 263         status_t (*flush_sas) (kernel_interface_t *this);
 264
 265         /**
 266          * Add a policy to the SPD.
 267          *
 268          * @param src                   source address of SA
 269          * @param dst                   dest address of SA
 270          * @param src_ts                traffic selector to match traffic source
 271          * @param dst_ts                traffic selector to match traffic dest
 272          * @param direction             direction of traffic, POLICY_(IN|OUT|FWD)
 273          * @param type                  type of policy, POLICY_(IPSEC|PASS|DROP)
 274          * @param sa                    details about the SA(s) tied to this policy
 275          * @param mark                  mark for this policy
 276          * @param priority              priority of this policy
 277          * @return                              SUCCESS if operation completed
 278          */
 279         status_t (*add_policy) (kernel_interface_t *this,
 280                                                         host_t *src, host_t *dst,
 281                                                         traffic_selector_t *src_ts,
 282                                                         traffic_selector_t *dst_ts,
 283                                                         policy_dir_t direction, policy_type_t type,
 284                                                         ipsec_sa_cfg_t *sa, mark_t mark,
 285                                                         policy_priority_t priority);
 286
 287         /**
 288          * Query the use time of a policy.
 289          *
 290          * The use time of a policy is the time the policy was used
 291          * for the last time.
 292          *
 293          * @param src_ts                traffic selector to match traffic source
 294          * @param dst_ts                traffic selector to match traffic dest
 295          * @param direction             direction of traffic, POLICY_(IN|OUT|FWD)
 296          * @param mark                  optional mark
 297          * @param[out] use_time the (monotonic) time of this SA's last use
 298          * @return                              SUCCESS if operation completed
 299          */
 300         status_t (*query_policy) (kernel_interface_t *this,
 301                                                           traffic_selector_t *src_ts,
 302                                                           traffic_selector_t *dst_ts,
 303                                                           policy_dir_t direction, mark_t mark,
 304                                                           time_t *use_time);
 305
 306         /**
 307          * Remove a policy from the SPD.
 308          *
 309          * @param src                   source address of SA
 310          * @param dst                   dest address of SA
 311          * @param src_ts                traffic selector to match traffic source
 312          * @param dst_ts                traffic selector to match traffic dest
 313          * @param direction             direction of traffic, POLICY_(IN|OUT|FWD)
 314          * @param type                  type of policy, POLICY_(IPSEC|PASS|DROP)
 315          * @param sa                    details about the SA(s) tied to this policy
 316          * @param mark                  mark for this policy
 317          * @param priority              priority of the policy
 318          * @return                              SUCCESS if operation completed
 319          */
 320         status_t (*del_policy) (kernel_interface_t *this,
 321                                                         host_t *src, host_t *dst,
 322                                                         traffic_selector_t *src_ts,
 323                                                         traffic_selector_t *dst_ts,
 324                                                         policy_dir_t direction, policy_type_t type,
 325                                                         ipsec_sa_cfg_t *sa, mark_t mark,
 326                                                         policy_priority_t priority);
 327
 328         /**
 329          * Flush all policies from the SPD.
 330          *
 331          * @return                              SUCCESS if operation completed
 332          */
 333         status_t (*flush_policies) (kernel_interface_t *this);
 334
 335         /**
 336          * Get our outgoing source address for a destination.
 337          *
 338          * Does a route lookup to get the source address used to reach dest.
 339          * The returned host is allocated and must be destroyed.
 340          * An optional src address can be used to check if a route is available
 341          * for the given source to dest.
 342          *
 343          * @param dest                  target destination address
 344          * @param src                   source address to check, or NULL
 345          * @return                              outgoing source address, NULL if unreachable
 346          */
 347         host_t* (*get_source_addr)(kernel_interface_t *this,
 348                                                            host_t *dest, host_t *src);
 349
 350         /**
 351          * Get the next hop for a destination.
 352          *
 353          * Does a route lookup to get the next hop used to reach dest.
 354          * The returned host is allocated and must be destroyed.
 355          * An optional src address can be used to check if a route is available
 356          * for the given source to dest.
 357          *
 358          * @param dest                  target destination address
 359          * @param prefix                prefix length if dest is a subnet, -1 for auto
 360          * @param src                   source address to check, or NULL
 361          * @return                              next hop address, NULL if unreachable
 362          */
 363         host_t* (*get_nexthop)(kernel_interface_t *this, host_t *dest,
 364                                                    int prefix, host_t *src);
 365
 366         /**
 367          * Get the interface name of a local address. Interfaces that are down or
 368          * ignored by config are not considered.
 369          *
 370          * @param host                  address to get interface name from
 371          * @param name                  allocated interface name (optional)
 372          * @return                              TRUE if interface found and usable
 373          */
 374         bool (*get_interface)(kernel_interface_t *this, host_t *host, char **name);
 375
 376         /**
 377          * Creates an enumerator over all local addresses.
 378          *
 379          * This function blocks an internal cached address list until the
 380          * enumerator gets destroyed.
 381          * The hosts are read-only, do not modify of free.
 382          *
 383          * @param which                 a combination of address types to enumerate
 384          * @return                              enumerator over host_t's
 385          */
 386         enumerator_t *(*create_address_enumerator) (kernel_interface_t *this,
 387                                                                                                 kernel_address_type_t which);
 388
 389         /**
 390          * Add a virtual IP to an interface.
 391          *
 392          * Virtual IPs are attached to an interface. If an IP is added multiple
 393          * times, the IP is refcounted and not removed until del_ip() was called
 394          * as many times as add_ip().
 395          *
 396          * @param virtual_ip    virtual ip address to assign
 397          * @param prefix                prefix length to install IP with, -1 for auto
 398          * @param iface                 interface to install virtual IP on
 399          * @return                              SUCCESS if operation completed
 400          */
 401         status_t (*add_ip) (kernel_interface_t *this, host_t *virtual_ip, int prefix,
 402                                                 char *iface);
 403
 404         /**
 405          * Remove a virtual IP from an interface.
 406          *
 407          * The kernel interface uses refcounting, see add_ip().
 408          *
 409          * @param virtual_ip    virtual ip address to remove
 410          * @param prefix                prefix length of the IP to uninstall, -1 for auto
 411          * @param wait                  TRUE to wait untily IP is gone
 412          * @return                              SUCCESS if operation completed
 413          */
 414         status_t (*del_ip) (kernel_interface_t *this, host_t *virtual_ip,
 415                                                 int prefix, bool wait);
 416
 417         /**
 418          * Add a route.
 419          *
 420          * @param dst_net               destination net
 421          * @param prefixlen             destination net prefix length
 422          * @param gateway               gateway for this route
 423          * @param src_ip                source ip of the route
 424          * @param if_name               name of the interface the route is bound to
 425          * @return                              SUCCESS if operation completed
 426          *                                              ALREADY_DONE if the route already exists
 427          */
 428         status_t (*add_route) (kernel_interface_t *this, chunk_t dst_net,
 429                                                    u_int8_t prefixlen, host_t *gateway, host_t *src_ip,
 430                                                    char *if_name);
 431
 432         /**
 433          * Delete a route.
 434          *
 435          * @param dst_net               destination net
 436          * @param prefixlen             destination net prefix length
 437          * @param gateway               gateway for this route
 438          * @param src_ip                source ip of the route
 439          * @param if_name               name of the interface the route is bound to
 440          * @return                              SUCCESS if operation completed
 441          */
 442         status_t (*del_route) (kernel_interface_t *this, chunk_t dst_net,
 443                                                    u_int8_t prefixlen, host_t *gateway, host_t *src_ip,
 444                                                    char *if_name);
 445
 446         /**
 447          * Set up a bypass policy for a given socket.
 448          *
 449          * @param fd                    socket file descriptor to setup policy for
 450          * @param family                protocol family of the socket
 451          * @return                              TRUE if policy set up successfully
 452          */
 453         bool (*bypass_socket)(kernel_interface_t *this, int fd, int family);
 454
 455         /**
 456          * Enable decapsulation of ESP-in-UDP packets for the given port/socket.
 457          *
 458          * @param fd                    socket file descriptor
 459          * @param family                protocol family of the socket
 460          * @param port                  the UDP port
 461          * @return                              TRUE if UDP decapsulation was enabled successfully
 462          */
 463         bool (*enable_udp_decap)(kernel_interface_t *this, int fd, int family,
 464                                                          u_int16_t port);
 465
 466
 467         /**
 468          * manager methods
 469          */
 470
 471         /**
 472          * Verifies that the given interface is usable and not excluded by
 473          * configuration.
 474          *
 475          * @param iface                 interface name
 476          * @return                              TRUE if usable
 477          */
 478         bool (*is_interface_usable)(kernel_interface_t *this, const char *iface);
 479
 480         /**
 481          * Check if interfaces are excluded by config.
 482          *
 483          * @return                              TRUE if no interfaces are exclued by config
 484          */
 485         bool (*all_interfaces_usable)(kernel_interface_t *this);
 486
 487         /**
 488          * Tries to find an IP address of a local interface that is included in the
 489          * supplied traffic selector.
 490          *
 491          * @param ts                    traffic selector
 492          * @param ip                    returned IP address (has to be destroyed)
 493          * @param vip                   set to TRUE if returned address is a virtual IP
 494          * @return                              SUCCESS if address found
 495          */
 496         status_t (*get_address_by_ts)(kernel_interface_t *this,
 497                                                                   traffic_selector_t *ts, host_t **ip, bool *vip);
 498
 499         /**
 500          * Register an ipsec kernel interface constructor on the manager.
 501          *
 502          * @param create                constructor to register
 503          * @return                              TRUE if the ipsec kernel interface was registered
 504          *                                              successfully, FALSE if an interface was already
 505          *                                              registered or the registration failed
 506          */
 507         bool (*add_ipsec_interface)(kernel_interface_t *this,
 508                                                                 kernel_ipsec_constructor_t create);
 509
 510         /**
 511          * Unregister an ipsec kernel interface constructor.
 512          *
 513          * @param create                constructor to unregister
 514          * @return                              TRUE if the ipsec kernel interface was unregistered
 515          *                                              successfully, FALSE otherwise
 516          */
 517         bool (*remove_ipsec_interface)(kernel_interface_t *this,
 518                                                                    kernel_ipsec_constructor_t create);
 519
 520         /**
 521          * Register a network kernel interface constructor on the manager.
 522          *
 523          * @param create                constructor to register
 524          * @return                              TRUE if the kernel net interface was registered
 525          *                                              successfully, FALSE if an interface was already
 526          *                                              registered or the registration failed
 527          */
 528         bool (*add_net_interface)(kernel_interface_t *this,
 529                                                           kernel_net_constructor_t create);
 530
 531         /**
 532          * Unregister a network kernel interface constructor.
 533          *
 534          * @param create                constructor to unregister
 535          * @return                              TRUE if the kernel net interface was unregistered
 536          *                                              successfully, FALSE otherwise
 537          */
 538         bool (*remove_net_interface)(kernel_interface_t *this,
 539                                                                  kernel_net_constructor_t create);
 540
 541         /**
 542          * Add a listener to the kernel interface.
 543          *
 544          * @param listener              listener to add
 545          */
 546         void (*add_listener)(kernel_interface_t *this,
 547                                                  kernel_listener_t *listener);
 548
 549         /**
 550          * Remove a listener from the kernel interface.
 551          *
 552          * @param listener              listener to remove
 553          */
 554         void (*remove_listener)(kernel_interface_t *this,
 555                                                         kernel_listener_t *listener);
 556
 557         /**
 558          * Raise an acquire event.
 559          *
 560          * @param reqid                 reqid of the policy to acquire
 561          * @param src_ts                source traffic selector
 562          * @param dst_ts                destination traffic selector
 563          */
 564         void (*acquire)(kernel_interface_t *this, u_int32_t reqid,
 565                                         traffic_selector_t *src_ts, traffic_selector_t *dst_ts);
 566
 567         /**
 568          * Raise an expire event.
 569          *
 570          * @param protocol              protocol of the expired SA
 571          * @param spi                   spi of the expired SA
 572          * @param dst                   destination address of expired SA
 573          * @param hard                  TRUE if it is a hard expire, FALSE otherwise
 574          */
 575         void (*expire)(kernel_interface_t *this, u_int8_t protocol, u_int32_t spi,
 576                                    host_t *dst, bool hard);
 577
 578         /**
 579          * Raise a mapping event.
 580          *
 581          * @param protocol              protocol of affected SA
 582          * @param spi                   spi of the SA
 583          * @param dst                   original destination address of SA
 584          * @param remote                new remote host
 585          */
 586         void (*mapping)(kernel_interface_t *this, u_int8_t protocol, u_int32_t spi,
 587                                         host_t *dst, host_t *remote);
 588
 589         /**
 590          * Raise a migrate event.
 591          *
 592          * @param reqid                 reqid of the policy
 593          * @param src_ts                source traffic selector
 594          * @param dst_ts                destination traffic selector
 595          * @param direction             direction of the policy (in|out)
 596          * @param local                 local host address to be used in the IKE_SA
 597          * @param remote                remote host address to be used in the IKE_SA
 598          */
 599         void (*migrate)(kernel_interface_t *this, u_int32_t reqid,
 600                                         traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
 601                                         policy_dir_t direction, host_t *local, host_t *remote);
 602
 603         /**
 604          * Raise a roam event.
 605          *
 606          * @param address               TRUE if address list, FALSE if routing changed
 607          */
 608         void (*roam)(kernel_interface_t *this, bool address);
 609
 610         /**
 611          * Raise a tun event.
 612          *
 613          * @param tun                   TUN device
 614          * @param created               TRUE if created, FALSE if going to be destroyed
 615          */
 616         void (*tun)(kernel_interface_t *this, tun_device_t *tun, bool created);
 617
 618         /**
 619          * Register a new algorithm with the kernel interface.
 620          *
 621          * @param alg_id                        the IKE id of the algorithm
 622          * @param type                          the transform type of the algorithm
 623          * @param kernel_id                     the kernel id of the algorithm
 624          * @param kernel_name           the kernel name of the algorithm
 625          */
 626         void (*register_algorithm)(kernel_interface_t *this, u_int16_t alg_id,
 627                                                            transform_type_t type, u_int16_t kernel_id,
 628                                                            char *kernel_name);
 629
 630         /**
 631          * Return the kernel-specific id and/or name for an algorithms depending on
 632          * the arguments specified.
 633          *
 634          * @param alg_id                        the IKE id of the algorithm
 635          * @param type                          the transform type of the algorithm
 636          * @param kernel_id                     the kernel id of the algorithm (optional)
 637          * @param kernel_name           the kernel name of the algorithm (optional)
 638          * @return                                      TRUE if algorithm was found
 639          */
 640         bool (*lookup_algorithm)(kernel_interface_t *this, u_int16_t alg_id,
 641                                                          transform_type_t type, u_int16_t *kernel_id,
 642                                                          char **kernel_name);
 643
 644         /**
 645          * Destroys a kernel_interface_t object.
 646          */
 647         void (*destroy) (kernel_interface_t *this);
 648 };
 649
 650 /**
 651  * Creates an object of type kernel_interface_t.
 652  */
 653 kernel_interface_t *kernel_interface_create(void);
 654
 655 #endif /** KERNEL_INTERFACE_H_ @}*/