blob: 148cdcdc675490e128422468245aaa8eb62f1d2f [file] [log] [blame]
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001/*
2 * Copyright (c) 2015-2016 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
Matus Fabiana9a0b2c2018-10-02 01:13:25 -070016option version = "2.0.0";
Dave Barach0d056e52017-09-28 15:11:16 -040017
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010018/** \brief IPsec: Add/delete Security Policy Database
19 @param client_index - opaque cookie to identify the sender
20 @param context - sender context, to match reply w/ request
21 @param is_add - add SPD if non-zero, else delete
22 @param spd_id - SPD instance id (control plane allocated)
23*/
24
Dave Barach11b8dbf2017-04-24 10:46:54 -040025autoreply define ipsec_spd_add_del
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010026{
27 u32 client_index;
28 u32 context;
29 u8 is_add;
30 u32 spd_id;
31};
32
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010033/** \brief IPsec: Add/delete SPD from interface
34
35 @param client_index - opaque cookie to identify the sender
36 @param context - sender context, to match reply w/ request
37 @param is_add - add security mode if non-zero, else delete
38 @param sw_if_index - index of the interface
39 @param spd_id - SPD instance id to use for lookups
40*/
41
42
Dave Barach11b8dbf2017-04-24 10:46:54 -040043autoreply define ipsec_interface_add_del_spd
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010044{
45 u32 client_index;
46 u32 context;
47
48 u8 is_add;
49 u32 sw_if_index;
50 u32 spd_id;
51};
52
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010053/** \brief IPsec: Add/delete Security Policy Database entry
54
55 See RFC 4301, 4.4.1.1 on how to match packet to selectors
56
57 @param client_index - opaque cookie to identify the sender
58 @param context - sender context, to match reply w/ request
59 @param is_add - add SPD if non-zero, else delete
60 @param spd_id - SPD instance id (control plane allocated)
61 @param priority - priority of SPD entry (non-unique value). Used to order SPD matching - higher priorities match before lower
62 @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
63 @param is_ipv6 - remote/local address are IPv6 if non-zero, else IPv4
64 @param remote_address_start - start of remote address range to match
65 @param remote_address_stop - end of remote address range to match
66 @param local_address_start - start of local address range to match
67 @param local_address_stop - end of local address range to match
68 @param protocol - protocol type to match [0 means any]
69 @param remote_port_start - start of remote port range to match ...
70 @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
71 @param local_port_start - start of local port range to match ...
72 @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
73 @param policy - 0 = bypass (no IPsec processing), 1 = discard (discard packet with ICMP processing), 2 = resolve (send request to control plane for SA resolving, and discard without ICMP processing), 3 = protect (apply IPsec policy using following parameters)
74 @param sa_id - SAD instance id (control plane allocated)
75
76*/
77
Dave Barach11b8dbf2017-04-24 10:46:54 -040078autoreply define ipsec_spd_add_del_entry
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010079{
80 u32 client_index;
81 u32 context;
82 u8 is_add;
83
84 u32 spd_id;
85 i32 priority;
86 u8 is_outbound;
87
88 // Selector
89 u8 is_ipv6;
90 u8 is_ip_any;
91 u8 remote_address_start[16];
92 u8 remote_address_stop[16];
93 u8 local_address_start[16];
94 u8 local_address_stop[16];
95
96 u8 protocol;
97
98 u16 remote_port_start;
99 u16 remote_port_stop;
100 u16 local_port_start;
101 u16 local_port_stop;
102
103 // Policy
104 u8 policy;
105 u32 sa_id;
106};
107
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100108/** \brief IPsec: Add/delete Security Association Database entry
109 @param client_index - opaque cookie to identify the sender
110 @param context - sender context, to match reply w/ request
111 @param is_add - add SAD entry if non-zero, else delete
112
113 @param sad_id - sad id
114
115 @param spi - security parameter index
116
117 @param protocol - 0 = AH, 1 = ESP
118
119 @param crypto_algorithm - 0 = Null, 1 = AES-CBC-128, 2 = AES-CBC-192, 3 = AES-CBC-256, 4 = 3DES-CBC
120 @param crypto_key_length - length of crypto_key in bytes
121 @param crypto_key - crypto keying material
122
123 @param integrity_algorithm - 0 = None, 1 = MD5-96, 2 = SHA1-96, 3 = SHA-256, 4 = SHA-384, 5=SHA-512
124 @param integrity_key_length - length of integrity_key in bytes
125 @param integrity_key - integrity keying material
126
127 @param use_extended_sequence_number - use ESN when non-zero
128
129 @param is_tunnel - IPsec tunnel mode if non-zero, else transport mode
130 @param is_tunnel_ipv6 - IPsec tunnel mode is IPv6 if non-zero, else IPv4 tunnel only valid if is_tunnel is non-zero
131 @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
132 @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
Klement Sekera4b089f22018-04-17 18:04:57 +0200133 @param udp_encap - enable UDP encapsulation for NAT traversal
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100134
135 To be added:
136 Anti-replay
137 IPsec tunnel address copy mode (to support GDOI)
138 */
139
Dave Barach11b8dbf2017-04-24 10:46:54 -0400140autoreply define ipsec_sad_add_del_entry
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100141{
142 u32 client_index;
143 u32 context;
144 u8 is_add;
145
146 u32 sad_id;
147
148 u32 spi;
149
150 u8 protocol;
151
152 u8 crypto_algorithm;
153 u8 crypto_key_length;
154 u8 crypto_key[128];
155
156 u8 integrity_algorithm;
157 u8 integrity_key_length;
158 u8 integrity_key[128];
159
160 u8 use_extended_sequence_number;
Matthew Smithca514fd2017-10-12 12:06:59 -0500161 u8 use_anti_replay;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100162
163 u8 is_tunnel;
164 u8 is_tunnel_ipv6;
165 u8 tunnel_src_address[16];
166 u8 tunnel_dst_address[16];
Klement Sekera4b089f22018-04-17 18:04:57 +0200167 u8 udp_encap;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100168};
169
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100170/** \brief IPsec: Update Security Association keys
171 @param client_index - opaque cookie to identify the sender
172 @param context - sender context, to match reply w/ request
173
174 @param sa_id - sa id
175
176 @param crypto_key_length - length of crypto_key in bytes
177 @param crypto_key - crypto keying material
178
179 @param integrity_key_length - length of integrity_key in bytes
180 @param integrity_key - integrity keying material
181*/
182
Dave Barach11b8dbf2017-04-24 10:46:54 -0400183autoreply define ipsec_sa_set_key
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100184{
185 u32 client_index;
186 u32 context;
187
188 u32 sa_id;
189
190 u8 crypto_key_length;
191 u8 crypto_key[128];
192
193 u8 integrity_key_length;
194 u8 integrity_key[128];
195};
196
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100197/** \brief IKEv2: Add/delete profile
198 @param client_index - opaque cookie to identify the sender
199 @param context - sender context, to match reply w/ request
200
201 @param name - IKEv2 profile name
202 @param is_add - Add IKEv2 profile if non-zero, else delete
203*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400204autoreply define ikev2_profile_add_del
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100205{
206 u32 client_index;
207 u32 context;
208
209 u8 name[64];
210 u8 is_add;
211};
212
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100213/** \brief IKEv2: Set IKEv2 profile authentication method
214 @param client_index - opaque cookie to identify the sender
215 @param context - sender context, to match reply w/ request
216
217 @param name - IKEv2 profile name
218 @param auth_method - IKEv2 authentication method (shared-key-mic/rsa-sig)
219 @param is_hex - Authentication data in hex format if non-zero, else string
220 @param data_len - Authentication data length
221 @param data - Authentication data (for rsa-sig cert file path)
222*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400223autoreply define ikev2_profile_set_auth
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100224{
225 u32 client_index;
226 u32 context;
227
228 u8 name[64];
229 u8 auth_method;
230 u8 is_hex;
231 u32 data_len;
Juraj Slobodae9fcf232018-04-23 10:14:37 +0200232 u8 data[data_len];
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100233};
234
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100235/** \brief IKEv2: Set IKEv2 profile local/remote identification
236 @param client_index - opaque cookie to identify the sender
237 @param context - sender context, to match reply w/ request
238
239 @param name - IKEv2 profile name
240 @param is_local - Identification is local if non-zero, else remote
241 @param id_type - Identification type
242 @param data_len - Identification data length
243 @param data - Identification data
244*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400245autoreply define ikev2_profile_set_id
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100246{
247 u32 client_index;
248 u32 context;
249
250 u8 name[64];
251 u8 is_local;
252 u8 id_type;
253 u32 data_len;
Juraj Slobodae9fcf232018-04-23 10:14:37 +0200254 u8 data[data_len];
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100255};
256
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100257/** \brief IKEv2: Set IKEv2 profile traffic selector parameters
258 @param client_index - opaque cookie to identify the sender
259 @param context - sender context, to match reply w/ request
260
261 @param name - IKEv2 profile name
262 @param is_local - Traffic selector is local if non-zero, else remote
263 @param proto - Traffic selector IP protocol (if zero not relevant)
264 @param start_port - The smallest port number allowed by traffic selector
265 @param end_port - The largest port number allowed by traffic selector
266 @param start_addr - The smallest address included in traffic selector
267 @param end_addr - The largest address included in traffic selector
268*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400269autoreply define ikev2_profile_set_ts
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100270{
271 u32 client_index;
272 u32 context;
273
274 u8 name[64];
275 u8 is_local;
276 u8 proto;
277 u16 start_port;
278 u16 end_port;
279 u32 start_addr;
280 u32 end_addr;
281};
282
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100283/** \brief IKEv2: Set IKEv2 local RSA private key
284 @param client_index - opaque cookie to identify the sender
285 @param context - sender context, to match reply w/ request
286
287 @param key_file - Key file absolute path
288*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400289autoreply define ikev2_set_local_key
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100290{
291 u32 client_index;
292 u32 context;
293
294 u8 key_file[256];
295};
296
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000297/** \brief IKEv2: Set IKEv2 responder interface and IP address
298 @param client_index - opaque cookie to identify the sender
299 @param context - sender context, to match reply w/ request
300
301 @param name - IKEv2 profile name
302 @param sw_if_index - interface index
303 @param address - interface address
304*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400305autoreply define ikev2_set_responder
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000306{
307 u32 client_index;
308 u32 context;
309
310 u8 name[64];
311 u32 sw_if_index;
312 u8 address[4];
313};
314
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000315/** \brief IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296)
316 @param client_index - opaque cookie to identify the sender
317 @param context - sender context, to match reply w/ request
318
319 @param name - IKEv2 profile name
320 @param crypto_alg - encryption algorithm
321 @param crypto_key_size - encryption key size
322 @param integ_alg - integrity algorithm
323 @param dh_group - Diffie-Hellman group
324
325*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400326autoreply define ikev2_set_ike_transforms
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000327{
328 u32 client_index;
329 u32 context;
330
331 u8 name[64];
332 u32 crypto_alg;
333 u32 crypto_key_size;
334 u32 integ_alg;
335 u32 dh_group;
336};
337
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000338/** \brief IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296)
339 @param client_index - opaque cookie to identify the sender
340 @param context - sender context, to match reply w/ request
341
342 @param name - IKEv2 profile name
343 @param crypto_alg - encryption algorithm
344 @param crypto_key_size - encryption key size
345 @param integ_alg - integrity algorithm
346 @param dh_group - Diffie-Hellman group
347
348*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400349autoreply define ikev2_set_esp_transforms
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000350{
351 u32 client_index;
352 u32 context;
353
354 u8 name[64];
355 u32 crypto_alg;
356 u32 crypto_key_size;
357 u32 integ_alg;
358 u32 dh_group;
359};
360
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000361/** \brief IKEv2: Set Child SA lifetime, limited by time and/or data
362 @param client_index - opaque cookie to identify the sender
363 @param context - sender context, to match reply w/ request
364
365 @param name - IKEv2 profile name
366 @param lifetime - SA maximum life time in seconds (0 to disable)
Paul Vinciguerrabdc0e6b2018-09-22 05:32:50 -0700367 @param lifetime_jitter - Jitter added to prevent simultaneous rekeying
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000368 @param handover - Hand over time
369 @param lifetime_maxdata - SA maximum life time in bytes (0 to disable)
370
371*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400372autoreply define ikev2_set_sa_lifetime
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000373{
374 u32 client_index;
375 u32 context;
376
377 u8 name[64];
378 u64 lifetime;
379 u32 lifetime_jitter;
380 u32 handover;
381 u64 lifetime_maxdata;
382};
383
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000384/** \brief IKEv2: Initiate the SA_INIT exchange
385 @param client_index - opaque cookie to identify the sender
386 @param context - sender context, to match reply w/ request
387
388 @param name - IKEv2 profile name
389
390*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400391autoreply define ikev2_initiate_sa_init
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000392{
393 u32 client_index;
394 u32 context;
395
396 u8 name[64];
397};
398
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000399/** \brief IKEv2: Initiate the delete IKE SA exchange
400 @param client_index - opaque cookie to identify the sender
401 @param context - sender context, to match reply w/ request
402
403 @param ispi - IKE SA initiator SPI
404
405*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400406autoreply define ikev2_initiate_del_ike_sa
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000407{
408 u32 client_index;
409 u32 context;
410
411 u64 ispi;
412};
413
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000414/** \brief IKEv2: Initiate the delete Child SA exchange
415 @param client_index - opaque cookie to identify the sender
416 @param context - sender context, to match reply w/ request
417
418 @param ispi - Child SA initiator SPI
419
420*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400421autoreply define ikev2_initiate_del_child_sa
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000422{
423 u32 client_index;
424 u32 context;
425
426 u32 ispi;
427};
428
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000429/** \brief IKEv2: Initiate the rekey Child SA exchange
430 @param client_index - opaque cookie to identify the sender
431 @param context - sender context, to match reply w/ request
432
433 @param ispi - Child SA initiator SPI
434
435*/
Dave Barach11b8dbf2017-04-24 10:46:54 -0400436autoreply define ikev2_initiate_rekey_child_sa
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000437{
438 u32 client_index;
439 u32 context;
440
441 u32 ispi;
442};
443
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700444/** \brief Dump IPsec all SPD IDs
445 @param client_index - opaque cookie to identify the sender
446 @param context - sender context, to match reply w/ request
447*/
448define ipsec_spds_dump {
449 u32 client_index;
450 u32 context;
451};
452
453/** \brief Dump IPsec all SPD IDs response
454 @param client_index - opaque cookie to identify the sender
455 @param spd_id - SPD instance id (control plane allocated)
456 @param npolicies - number of policies in SPD
457*/
Filip Varga871bca92018-11-02 13:51:44 +0100458define ipsec_spds_details {
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700459 u32 context;
460 u32 spd_id;
461 u32 npolicies;
462};
463
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100464/** \brief Dump ipsec policy database data
465 @param client_index - opaque cookie to identify the sender
466 @param context - sender context, to match reply w/ request
467 @param spd_id - SPD instance id
468 @param sa_id - SA id, optional, set to ~0 to see all policies in SPD
469*/
470define ipsec_spd_dump {
471 u32 client_index;
472 u32 context;
473 u32 spd_id;
474 u32 sa_id;
475};
476
477/** \brief IPsec policy database response
478 @param context - sender context which was passed in the request
479 @param spd_id - SPD instance id
480 @param priority - numeric value to control policy evaluation order
481 @param is_outbound - [1|0] to indicate if direction is [out|in]bound
482 @param is_ipv6 - [1|0] to indicate if address family is ipv[6|4]
483 @param local_start_addr - first address in local traffic selector range
484 @param local_stop_addr - last address in local traffic selector range
485 @param local_start_port - first port in local traffic selector range
486 @param local_stop_port - last port in local traffic selector range
487 @param remote_start_addr - first address in remote traffic selector range
488 @param remote_stop_addr - last address in remote traffic selector range
489 @param remote_start_port - first port in remote traffic selector range
490 @param remote_stop_port - last port in remote traffic selector range
491 @param protocol - traffic selector protocol
492 @param policy - policy action
493 @param sa_id - SA id
494 @param bytes - byte count of packets matching this policy
495 @param packets - count of packets matching this policy
496*/
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100497define ipsec_spd_details {
498 u32 context;
499 u32 spd_id;
500 i32 priority;
501 u8 is_outbound;
502 u8 is_ipv6;
503 u8 local_start_addr[16];
504 u8 local_stop_addr[16];
505 u16 local_start_port;
506 u16 local_stop_port;
507 u8 remote_start_addr[16];
508 u8 remote_stop_addr[16];
509 u16 remote_start_port;
510 u16 remote_stop_port;
511 u8 protocol;
512 u8 policy;
513 u32 sa_id;
514 u64 bytes;
515 u64 packets;
516};
517
Filip Varga871bca92018-11-02 13:51:44 +0100518/** \brief IPsec: Get SPD interfaces
519 @param client_index - opaque cookie to identify the sender
520 @param context - sender context, to match reply w/ request
521 @param spd_index - SPD index
522 @param spd_index_valid - if 1 spd_index is used to filter
523 spd_index's, if 0 no filtering is done
524*/
525define ipsec_spd_interface_dump {
526 u32 client_index;
527 u32 context;
528 u32 spd_index;
529 u8 spd_index_valid;
530};
531
532/** \brief IPsec: SPD interface response
533 @param context - sender context which was passed in the request
534 @param spd_index - SPD index
535 @param sw_if_index - index of the interface
536*/
537define ipsec_spd_interface_details {
538 u32 context;
539 u32 spd_index;
540 u32 sw_if_index;
541};
542
Matthew Smithb0972cb2017-05-02 16:20:41 -0500543/** \brief Add or delete IPsec tunnel interface
544 @param client_index - opaque cookie to identify the sender
545 @param context - sender context, to match reply w/ request
546 @param is_add - add IPsec tunnel interface if nonzero, else delete
547 @param esn - enable extended sequence numbers if nonzero, else disable
548 @param anti_replay - enable anti replay check if nonzero, else disable
549 @param local_ip - local IP address
550 @param remote_ip - IP address of remote IPsec peer
551 @param local_spi - SPI of outbound IPsec SA
552 @param remote_spi - SPI of inbound IPsec SA
553 @param crypto_alg - encryption algorithm ID
554 @param local_crypto_key_len - length of local crypto key in bytes
555 @param local_crypto_key - crypto key for outbound IPsec SA
556 @param remote_crypto_key_len - length of remote crypto key in bytes
557 @param remote_crypto_key - crypto key for inbound IPsec SA
558 @param integ_alg - integrity algorithm ID
559 @param local_integ_key_len - length of local integrity key in bytes
560 @param local_integ_key - integrity key for outbound IPsec SA
561 @param remote_integ_key_len - length of remote integrity key in bytes
562 @param remote_integ_key - integrity key for inbound IPsec SA
Matthew Smith8e1039a2018-04-12 07:32:56 -0500563 @param renumber - intf display name uses a specified instance if != 0
564 @param show_instance - instance to display for intf if renumber is set
Matthew Smithb0972cb2017-05-02 16:20:41 -0500565*/
Matthew Smithe04d09d2017-05-14 21:47:18 -0500566define ipsec_tunnel_if_add_del {
Matthew Smithb0972cb2017-05-02 16:20:41 -0500567 u32 client_index;
568 u32 context;
569 u8 is_add;
570 u8 esn;
571 u8 anti_replay;
572 u8 local_ip[4];
573 u8 remote_ip[4];
574 u32 local_spi;
575 u32 remote_spi;
576 u8 crypto_alg;
577 u8 local_crypto_key_len;
578 u8 local_crypto_key[128];
579 u8 remote_crypto_key_len;
580 u8 remote_crypto_key[128];
581 u8 integ_alg;
582 u8 local_integ_key_len;
583 u8 local_integ_key[128];
584 u8 remote_integ_key_len;
585 u8 remote_integ_key[128];
Matthew Smith8e1039a2018-04-12 07:32:56 -0500586 u8 renumber;
587 u32 show_instance;
Matthew Smithb0972cb2017-05-02 16:20:41 -0500588};
589
Matthew Smithe04d09d2017-05-14 21:47:18 -0500590/** \brief Add/delete IPsec tunnel interface response
591 @param context - sender context, to match reply w/ request
592 @param retval - return status
593 @param sw_if_index - sw_if_index of new interface (for successful add)
594*/
595define ipsec_tunnel_if_add_del_reply {
596 u32 context;
597 i32 retval;
598 u32 sw_if_index;
599};
600
Matthew Smith28029532017-09-26 13:33:44 -0500601/** \brief Dump IPsec security association
602 @param client_index - opaque cookie to identify the sender
603 @param context - sender context, to match reply w/ request
604 @param sa_id - optional ID of an SA to dump, if ~0 dump all SAs in SAD
605*/
606define ipsec_sa_dump {
607 u32 client_index;
608 u32 context;
609 u32 sa_id;
610};
611
612/** \brief IPsec security association database response
613 @param context - sender context which was passed in the request
614 @param sa_id - SA ID, policy-based SAs >=0, tunnel interface SAs = 0
615 @param sw_if_index - sw_if_index of tunnel interface, policy-based SAs = ~0
616 @param spi - security parameter index
617 @param protocol - IPsec protocol (value from ipsec_protocol_t)
618 @param crypto_alg - crypto algorithm (value from ipsec_crypto_alg_t)
619 @param crypto_key_len - length of crypto_key in bytes
620 @param crypto_key - crypto keying material
621 @param integ_alg - integrity algorithm (value from ipsec_integ_alg_t)
622 @param integ_key_len - length of integ_key in bytes
623 @param integ_key - integrity keying material
624 @param use_esn - using extended sequence numbers when non-zero
625 @param use_anti_replay - using anti-replay window when non-zero
626 @param is_tunnel - IPsec tunnel mode when non-zero, else transport mode
627 @param is_tunnel_ipv6 - If using tunnel mode, endpoints are IPv6
628 @param tunnel_src_addr - Tunnel source address if using tunnel mode
629 @param tunnel_dst_addr - Tunnel destination address is using tunnel mode
630 @param salt - 4 byte salt
631 @param seq - current sequence number for outbound
632 @param seq_hi - high 32 bits of ESN for outbound
633 @param last_seq - highest sequence number received inbound
634 @param last_seq_hi - high 32 bits of highest ESN received inbound
635 @param replay_window - bit map of seq nums received relative to last_seq if using anti-replay
636 @param total_data_size - total bytes sent or received
Klement Sekera4b089f22018-04-17 18:04:57 +0200637 @param udp_encap - 1 if UDP encap enabled, 0 otherwise
Matthew Smith28029532017-09-26 13:33:44 -0500638*/
639define ipsec_sa_details {
640 u32 context;
641 u32 sa_id;
642 u32 sw_if_index;
643
644 u32 spi;
645 u8 protocol;
646
647 u8 crypto_alg;
648 u8 crypto_key_len;
649 u8 crypto_key[128];
650
651 u8 integ_alg;
652 u8 integ_key_len;
653 u8 integ_key[128];
654
655 u8 use_esn;
656 u8 use_anti_replay;
657
658 u8 is_tunnel;
659 u8 is_tunnel_ip6;
660 u8 tunnel_src_addr[16];
661 u8 tunnel_dst_addr[16];
662
663 u32 salt;
664 u64 seq_outbound;
665 u64 last_seq_inbound;
666 u64 replay_window;
667
668 u64 total_data_size;
Klement Sekera4b089f22018-04-17 18:04:57 +0200669 u8 udp_encap;
Matthew Smith28029532017-09-26 13:33:44 -0500670};
671
Matthew Smith75d85602017-10-05 19:03:05 -0500672/** \brief Set key on IPsec interface
673 @param client_index - opaque cookie to identify the sender
674 @param context - sender context, to match reply w/ request
675 @param sw_if_index - index of tunnel interface
676 @param key_type - type of key being set
677 @param alg - algorithm used with key
678 @param key_len - length key in bytes
679 @param key - key
680*/
681autoreply define ipsec_tunnel_if_set_key {
682 u32 client_index;
683 u32 context;
684 u32 sw_if_index;
685 u8 key_type;
686 u8 alg;
687 u8 key_len;
688 u8 key[128];
689};
690
Matthew Smithca514fd2017-10-12 12:06:59 -0500691/** \brief Set new SA on IPsec interface
692 @param client_index - opaque cookie to identify the sender
693 @param context - sender context, to match reply w/ request
694 @param sw_if_index - index of tunnel interface
695 @param sa_id - ID of SA to use
696 @param is_outbound - 1 if outbound (local) SA, 0 if inbound (remote)
697*/
698autoreply define ipsec_tunnel_if_set_sa {
699 u32 client_index;
700 u32 context;
701 u32 sw_if_index;
702 u32 sa_id;
703 u8 is_outbound;
704};
705
Klement Sekerab4d30532018-11-08 13:00:02 +0100706/** \brief Dump IPsec backends
707 @param client_index - opaque cookie to identify the sender
708 @param context - sender context, to match reply w/ request
709*/
710define ipsec_backend_dump {
711 u32 client_index;
712 u32 context;
713};
714
715/** \brief IPsec backend details
716 @param name - name of the backend
717 @param protocol - IPsec protocol (value from ipsec_protocol_t)
718 @param index - backend index
719 @param active - set to 1 if the backend is active, otherwise 0
720*/
721define ipsec_backend_details {
722 u32 context;
723 u8 name[128];
724 u8 protocol;
725 u8 index;
726 u8 active;
727};
728
729/** \brief Select IPsec backend
730 @param client_index - opaque cookie to identify the sender
731 @param context - sender context, to match reply w/ request
732 @param protocol - IPsec protocol (value from ipsec_protocol_t)
733 @param index - backend index
734*/
735autoreply define ipsec_select_backend {
736 u32 client_index;
737 u32 context;
738 u8 protocol;
739 u8 index;
740};
741
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100742/*
743 * Local Variables:
744 * eval: (c-set-style "gnu")
745 * End:
746 */
Dave Barach11b8dbf2017-04-24 10:46:54 -0400747