blob: bb9e8056251d08a6a3540d7e5cd61dee288c7df9 [file] [log] [blame]
Neale Ranns17dcec02019-01-09 21:22:20 -08001/* Hey Emacs use -*- mode: C -*- */
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01002/*
3 * Copyright (c) 2015-2016 Cisco and/or its affiliates.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Neale Ranns17dcec02019-01-09 21:22:20 -080017option version = "3.0.0";
18
19import "vnet/ip/ip_types.api";
Dave Barach0d056e52017-09-28 15:11:16 -040020
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010021/** \brief IPsec: Add/delete Security Policy Database
22 @param client_index - opaque cookie to identify the sender
23 @param context - sender context, to match reply w/ request
24 @param is_add - add SPD if non-zero, else delete
25 @param spd_id - SPD instance id (control plane allocated)
26*/
27
Dave Barach11b8dbf2017-04-24 10:46:54 -040028autoreply define ipsec_spd_add_del
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010029{
30 u32 client_index;
31 u32 context;
32 u8 is_add;
33 u32 spd_id;
34};
35
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010036/** \brief IPsec: Add/delete SPD from interface
37
38 @param client_index - opaque cookie to identify the sender
39 @param context - sender context, to match reply w/ request
40 @param is_add - add security mode if non-zero, else delete
41 @param sw_if_index - index of the interface
42 @param spd_id - SPD instance id to use for lookups
43*/
44
45
Dave Barach11b8dbf2017-04-24 10:46:54 -040046autoreply define ipsec_interface_add_del_spd
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010047{
48 u32 client_index;
49 u32 context;
50
51 u8 is_add;
52 u32 sw_if_index;
53 u32 spd_id;
54};
55
Neale Ranns17dcec02019-01-09 21:22:20 -080056
57enum ipsec_spd_action
58{
59 /* bypass - no IPsec processing */
60 IPSEC_API_SPD_ACTION_BYPASS = 0,
61 /* discard - discard packet with ICMP processing */
62 IPSEC_API_SPD_ACTION_DISCARD,
63 /* resolve - send request to control plane for SA resolving */
64 IPSEC_API_SPD_ACTION_RESOLVE,
65 /* protect - apply IPsec policy using following parameters */
66 IPSEC_API_SPD_ACTION_PROTECT,
67};
68
69/** \brief IPsec: Security Policy Database entry
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010070
71 See RFC 4301, 4.4.1.1 on how to match packet to selectors
72
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010073 @param spd_id - SPD instance id (control plane allocated)
74 @param priority - priority of SPD entry (non-unique value). Used to order SPD matching - higher priorities match before lower
75 @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010076 @param remote_address_start - start of remote address range to match
77 @param remote_address_stop - end of remote address range to match
78 @param local_address_start - start of local address range to match
79 @param local_address_stop - end of local address range to match
Neale Ranns17dcec02019-01-09 21:22:20 -080080 @param protocol - protocol type to match [0 means any] otherwise IANA value
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010081 @param remote_port_start - start of remote port range to match ...
82 @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
83 @param local_port_start - start of local port range to match ...
84 @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
Neale Ranns17dcec02019-01-09 21:22:20 -080085 @param policy - action to perform on match
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010086 @param sa_id - SAD instance id (control plane allocated)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010087*/
Neale Ranns17dcec02019-01-09 21:22:20 -080088typedef ipsec_spd_entry
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010089{
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010090 u32 spd_id;
91 i32 priority;
92 u8 is_outbound;
93
Neale Ranns17dcec02019-01-09 21:22:20 -080094 u32 sa_id;
95 vl_api_ipsec_spd_action_t policy;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010096 u8 protocol;
97
Neale Ranns17dcec02019-01-09 21:22:20 -080098 // Selector
Neale Ranns17dcec02019-01-09 21:22:20 -080099 vl_api_address_t remote_address_start;
100 vl_api_address_t remote_address_stop;
101 vl_api_address_t local_address_start;
102 vl_api_address_t local_address_stop;
103
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100104 u16 remote_port_start;
105 u16 remote_port_stop;
106 u16 local_port_start;
107 u16 local_port_stop;
Neale Ranns17dcec02019-01-09 21:22:20 -0800108};
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100109
Neale Ranns17dcec02019-01-09 21:22:20 -0800110/** \brief IPsec: Add/delete Security Policy Database entry
111
112 @param client_index - opaque cookie to identify the sender
113 @param context - sender context, to match reply w/ request
114 @param is_add - add SPD if non-zero, else delete
115 @param entry - Description of the entry to add/dell
116*/
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800117define ipsec_spd_entry_add_del
Neale Ranns17dcec02019-01-09 21:22:20 -0800118{
119 u32 client_index;
120 u32 context;
121 u8 is_add;
122 vl_api_ipsec_spd_entry_t entry;
123};
124
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800125/** \brief IPsec: Reply Add/delete Security Policy Database entry
126
127 @param context - sender context, to match reply w/ request
128 @param retval - success/fail rutrun code
129 @param stat_index - An index for the policy in the stats segment @ /net/ipec/policy
130*/
131define ipsec_spd_entry_add_del_reply
132{
133 u32 context;
134 i32 retval;
135 u32 stat_index;
136};
137
Neale Ranns17dcec02019-01-09 21:22:20 -0800138/** \brief Dump IPsec all SPD IDs
139 @param client_index - opaque cookie to identify the sender
140 @param context - sender context, to match reply w/ request
141*/
142define ipsec_spds_dump {
143 u32 client_index;
144 u32 context;
145};
146
147/** \brief Dump IPsec all SPD IDs response
148 @param client_index - opaque cookie to identify the sender
149 @param spd_id - SPD instance id (control plane allocated)
150 @param npolicies - number of policies in SPD
151*/
152define ipsec_spds_details {
153 u32 context;
154 u32 spd_id;
155 u32 npolicies;
156};
157
158/** \brief Dump ipsec policy database data
159 @param client_index - opaque cookie to identify the sender
160 @param context - sender context, to match reply w/ request
161 @param spd_id - SPD instance id
162 @param sa_id - SA id, optional, set to ~0 to see all policies in SPD
163*/
164define ipsec_spd_dump {
165 u32 client_index;
166 u32 context;
167 u32 spd_id;
168 u32 sa_id;
169};
170
171/** \brief IPsec policy database response
172 @param context - sender context which was passed in the request
173 €param entry - The SPD entry.
174 @param bytes - byte count of packets matching this policy
175 @param packets - count of packets matching this policy
176*/
177define ipsec_spd_details {
178 u32 context;
179 vl_api_ipsec_spd_entry_t entry;
Neale Ranns17dcec02019-01-09 21:22:20 -0800180};
181
182/*
183 * @brief Support cryptographic algorithms
184 */
185enum ipsec_crypto_alg
186{
187 IPSEC_API_CRYPTO_ALG_NONE = 0,
188 IPSEC_API_CRYPTO_ALG_AES_CBC_128,
189 IPSEC_API_CRYPTO_ALG_AES_CBC_192,
190 IPSEC_API_CRYPTO_ALG_AES_CBC_256,
191 IPSEC_API_CRYPTO_ALG_AES_CTR_128,
192 IPSEC_API_CRYPTO_ALG_AES_CTR_192,
193 IPSEC_API_CRYPTO_ALG_AES_CTR_256,
194 IPSEC_API_CRYPTO_ALG_AES_GCM_128,
195 IPSEC_API_CRYPTO_ALG_AES_GCM_192,
196 IPSEC_API_CRYPTO_ALG_AES_GCM_256,
197 IPSEC_API_CRYPTO_ALG_DES_CBC,
198 IPSEC_API_CRYPTO_ALG_3DES_CBC,
199};
200
201/*
202 * @brief Supported Integrity Algorithms
203 */
204enum ipsec_integ_alg
205{
206 IPSEC_API_INTEG_ALG_NONE = 0,
207 /* RFC2403 */
208 IPSEC_API_INTEG_ALG_MD5_96,
209 /* RFC2404 */
210 IPSEC_API_INTEG_ALG_SHA1_96,
211 /* draft-ietf-ipsec-ciph-sha-256-00 */
212 IPSEC_API_INTEG_ALG_SHA_256_96,
213 /* RFC4868 */
214 IPSEC_API_INTEG_ALG_SHA_256_128,
215 /* RFC4868 */
216 IPSEC_API_INTEG_ALG_SHA_384_192,
217 /* RFC4868 */
218 IPSEC_API_INTEG_ALG_SHA_512_256,
219};
220
221enum ipsec_sad_flags
222{
223 IPSEC_API_SAD_FLAG_NONE = 0,
224 /* Enable extended sequence numbers */
Damjan Marion1e3aa5e2019-03-28 10:58:59 +0100225 IPSEC_API_SAD_FLAG_USE_ESN = 0x01,
Neale Ranns17dcec02019-01-09 21:22:20 -0800226 /* Enable Anti-replay */
227 IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02,
228 /* IPsec tunnel mode if non-zero, else transport mode */
229 IPSEC_API_SAD_FLAG_IS_TUNNEL = 0x04,
230 /* IPsec tunnel mode is IPv6 if non-zero,
231 * else IPv4 tunnel only valid if is_tunnel is non-zero */
232 IPSEC_API_SAD_FLAG_IS_TUNNEL_V6 = 0x08,
233 /* enable UDP encapsulation for NAT traversal */
234 IPSEC_API_SAD_FLAG_UDP_ENCAP = 0x10,
235};
236
237enum ipsec_proto
238{
239 IPSEC_API_PROTO_ESP,
240 IPSEC_API_PROTO_AH,
241};
242
243typedef key
244{
245 /* the length of the key */
246 u8 length;
247 /* The data for the key */
248 u8 data[128];
249};
250
251/** \brief IPsec: Security Association Database entry
252 @param client_index - opaque cookie to identify the sender
253 @param context - sender context, to match reply w/ request
254 @param is_add - add SAD entry if non-zero, else delete
255 @param sad_id - sad id
256 @param spi - security parameter index
257 @param protocol - 0 = AH, 1 = ESP
258 @param crypto_algorithm - a supported crypto algorithm
259 @param crypto_key - crypto keying material
260 @param integrity_algorithm - one of the supported algorithms
261 @param integrity_key - integrity keying material
262 @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
263 @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
Neale Ranns8d7c5022019-02-06 01:41:05 -0800264 @param tx_table_id - the FIB id used for encapsulated packets
Neale Ranns80f6fd52019-04-16 02:41:34 +0000265 @param salt - for use with counter mode ciphers
Neale Ranns17dcec02019-01-09 21:22:20 -0800266 */
267typedef ipsec_sad_entry
268{
269 u32 sad_id;
270
271 u32 spi;
272
273 vl_api_ipsec_proto_t protocol;
274
275 vl_api_ipsec_crypto_alg_t crypto_algorithm;
276 vl_api_key_t crypto_key;
277
278 vl_api_ipsec_integ_alg_t integrity_algorithm;
279 vl_api_key_t integrity_key;
280
281 vl_api_ipsec_sad_flags_t flags;
282
283 vl_api_address_t tunnel_src;
284 vl_api_address_t tunnel_dst;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800285 u32 tx_table_id;
Neale Ranns80f6fd52019-04-16 02:41:34 +0000286 u32 salt;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100287};
288
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100289/** \brief IPsec: Add/delete Security Association Database entry
290 @param client_index - opaque cookie to identify the sender
291 @param context - sender context, to match reply w/ request
Neale Ranns17dcec02019-01-09 21:22:20 -0800292 @param entry - Entry to add or delete
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100293 */
Neale Rannseba31ec2019-02-17 18:04:27 +0000294define ipsec_sad_entry_add_del
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100295{
296 u32 client_index;
297 u32 context;
298 u8 is_add;
Neale Ranns17dcec02019-01-09 21:22:20 -0800299 vl_api_ipsec_sad_entry_t entry;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100300};
Neale Rannseba31ec2019-02-17 18:04:27 +0000301define ipsec_sad_entry_add_del_reply
302{
303 u32 context;
304 i32 retval;
305 u32 stat_index;
306};
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100307
Filip Varga871bca92018-11-02 13:51:44 +0100308/** \brief IPsec: Get SPD interfaces
309 @param client_index - opaque cookie to identify the sender
310 @param context - sender context, to match reply w/ request
311 @param spd_index - SPD index
312 @param spd_index_valid - if 1 spd_index is used to filter
313 spd_index's, if 0 no filtering is done
314*/
315define ipsec_spd_interface_dump {
316 u32 client_index;
317 u32 context;
318 u32 spd_index;
319 u8 spd_index_valid;
320};
321
322/** \brief IPsec: SPD interface response
323 @param context - sender context which was passed in the request
324 @param spd_index - SPD index
325 @param sw_if_index - index of the interface
326*/
327define ipsec_spd_interface_details {
328 u32 context;
329 u32 spd_index;
330 u32 sw_if_index;
331};
332
Matthew Smithb0972cb2017-05-02 16:20:41 -0500333/** \brief Add or delete IPsec tunnel interface
334 @param client_index - opaque cookie to identify the sender
335 @param context - sender context, to match reply w/ request
336 @param is_add - add IPsec tunnel interface if nonzero, else delete
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400337 @param is_ip6 - tunnel v6 or v4
Matthew Smithb0972cb2017-05-02 16:20:41 -0500338 @param esn - enable extended sequence numbers if nonzero, else disable
339 @param anti_replay - enable anti replay check if nonzero, else disable
340 @param local_ip - local IP address
341 @param remote_ip - IP address of remote IPsec peer
342 @param local_spi - SPI of outbound IPsec SA
343 @param remote_spi - SPI of inbound IPsec SA
344 @param crypto_alg - encryption algorithm ID
345 @param local_crypto_key_len - length of local crypto key in bytes
346 @param local_crypto_key - crypto key for outbound IPsec SA
347 @param remote_crypto_key_len - length of remote crypto key in bytes
348 @param remote_crypto_key - crypto key for inbound IPsec SA
349 @param integ_alg - integrity algorithm ID
350 @param local_integ_key_len - length of local integrity key in bytes
351 @param local_integ_key - integrity key for outbound IPsec SA
352 @param remote_integ_key_len - length of remote integrity key in bytes
353 @param remote_integ_key - integrity key for inbound IPsec SA
Matthew Smith8e1039a2018-04-12 07:32:56 -0500354 @param renumber - intf display name uses a specified instance if != 0
355 @param show_instance - instance to display for intf if renumber is set
Filip Tehlarb4a7a7d2018-11-30 07:27:27 -0800356 @param udp_encap - enable UDP encapsulation for NAT traversal
Pierre Pfister4c422f92018-12-10 11:19:08 +0100357 @param tx_table_id - the FIB id used after packet encap
Neale Ranns80f6fd52019-04-16 02:41:34 +0000358 @param salt - for use with counter mode ciphers
Matthew Smithb0972cb2017-05-02 16:20:41 -0500359*/
Matthew Smithe04d09d2017-05-14 21:47:18 -0500360define ipsec_tunnel_if_add_del {
Matthew Smithb0972cb2017-05-02 16:20:41 -0500361 u32 client_index;
362 u32 context;
363 u8 is_add;
364 u8 esn;
365 u8 anti_replay;
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400366 vl_api_address_t local_ip;
367 vl_api_address_t remote_ip;
Matthew Smithb0972cb2017-05-02 16:20:41 -0500368 u32 local_spi;
369 u32 remote_spi;
370 u8 crypto_alg;
371 u8 local_crypto_key_len;
372 u8 local_crypto_key[128];
373 u8 remote_crypto_key_len;
374 u8 remote_crypto_key[128];
375 u8 integ_alg;
376 u8 local_integ_key_len;
377 u8 local_integ_key[128];
378 u8 remote_integ_key_len;
379 u8 remote_integ_key[128];
Matthew Smith8e1039a2018-04-12 07:32:56 -0500380 u8 renumber;
381 u32 show_instance;
Filip Tehlarb4a7a7d2018-11-30 07:27:27 -0800382 u8 udp_encap;
Pierre Pfister4c422f92018-12-10 11:19:08 +0100383 u32 tx_table_id;
Neale Ranns80f6fd52019-04-16 02:41:34 +0000384 u32 salt;
Matthew Smithb0972cb2017-05-02 16:20:41 -0500385};
386
Matthew Smithe04d09d2017-05-14 21:47:18 -0500387/** \brief Add/delete IPsec tunnel interface response
388 @param context - sender context, to match reply w/ request
389 @param retval - return status
390 @param sw_if_index - sw_if_index of new interface (for successful add)
391*/
392define ipsec_tunnel_if_add_del_reply {
393 u32 context;
394 i32 retval;
395 u32 sw_if_index;
396};
397
Matthew Smith28029532017-09-26 13:33:44 -0500398/** \brief Dump IPsec security association
399 @param client_index - opaque cookie to identify the sender
400 @param context - sender context, to match reply w/ request
401 @param sa_id - optional ID of an SA to dump, if ~0 dump all SAs in SAD
402*/
403define ipsec_sa_dump {
404 u32 client_index;
405 u32 context;
406 u32 sa_id;
407};
408
409/** \brief IPsec security association database response
410 @param context - sender context which was passed in the request
411 @param sa_id - SA ID, policy-based SAs >=0, tunnel interface SAs = 0
412 @param sw_if_index - sw_if_index of tunnel interface, policy-based SAs = ~0
413 @param spi - security parameter index
414 @param protocol - IPsec protocol (value from ipsec_protocol_t)
415 @param crypto_alg - crypto algorithm (value from ipsec_crypto_alg_t)
416 @param crypto_key_len - length of crypto_key in bytes
417 @param crypto_key - crypto keying material
418 @param integ_alg - integrity algorithm (value from ipsec_integ_alg_t)
419 @param integ_key_len - length of integ_key in bytes
420 @param integ_key - integrity keying material
421 @param use_esn - using extended sequence numbers when non-zero
422 @param use_anti_replay - using anti-replay window when non-zero
423 @param is_tunnel - IPsec tunnel mode when non-zero, else transport mode
424 @param is_tunnel_ipv6 - If using tunnel mode, endpoints are IPv6
425 @param tunnel_src_addr - Tunnel source address if using tunnel mode
426 @param tunnel_dst_addr - Tunnel destination address is using tunnel mode
427 @param salt - 4 byte salt
428 @param seq - current sequence number for outbound
429 @param seq_hi - high 32 bits of ESN for outbound
430 @param last_seq - highest sequence number received inbound
431 @param last_seq_hi - high 32 bits of highest ESN received inbound
432 @param replay_window - bit map of seq nums received relative to last_seq if using anti-replay
433 @param total_data_size - total bytes sent or received
Klement Sekera4b089f22018-04-17 18:04:57 +0200434 @param udp_encap - 1 if UDP encap enabled, 0 otherwise
Matthew Smith28029532017-09-26 13:33:44 -0500435*/
436define ipsec_sa_details {
437 u32 context;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800438 vl_api_ipsec_sad_entry_t entry;
439
Matthew Smith28029532017-09-26 13:33:44 -0500440 u32 sw_if_index;
Matthew Smith28029532017-09-26 13:33:44 -0500441 u32 salt;
442 u64 seq_outbound;
443 u64 last_seq_inbound;
444 u64 replay_window;
445
446 u64 total_data_size;
447};
448
Matthew Smithca514fd2017-10-12 12:06:59 -0500449/** \brief Set new SA on IPsec interface
450 @param client_index - opaque cookie to identify the sender
451 @param context - sender context, to match reply w/ request
452 @param sw_if_index - index of tunnel interface
453 @param sa_id - ID of SA to use
454 @param is_outbound - 1 if outbound (local) SA, 0 if inbound (remote)
455*/
456autoreply define ipsec_tunnel_if_set_sa {
457 u32 client_index;
458 u32 context;
459 u32 sw_if_index;
460 u32 sa_id;
461 u8 is_outbound;
462};
463
Klement Sekerab4d30532018-11-08 13:00:02 +0100464/** \brief Dump IPsec backends
465 @param client_index - opaque cookie to identify the sender
466 @param context - sender context, to match reply w/ request
467*/
468define ipsec_backend_dump {
469 u32 client_index;
470 u32 context;
471};
472
473/** \brief IPsec backend details
474 @param name - name of the backend
475 @param protocol - IPsec protocol (value from ipsec_protocol_t)
476 @param index - backend index
477 @param active - set to 1 if the backend is active, otherwise 0
478*/
479define ipsec_backend_details {
480 u32 context;
481 u8 name[128];
Neale Ranns17dcec02019-01-09 21:22:20 -0800482 vl_api_ipsec_proto_t protocol;
Klement Sekerab4d30532018-11-08 13:00:02 +0100483 u8 index;
484 u8 active;
485};
486
487/** \brief Select IPsec backend
488 @param client_index - opaque cookie to identify the sender
489 @param context - sender context, to match reply w/ request
490 @param protocol - IPsec protocol (value from ipsec_protocol_t)
491 @param index - backend index
492*/
493autoreply define ipsec_select_backend {
494 u32 client_index;
495 u32 context;
Neale Ranns17dcec02019-01-09 21:22:20 -0800496 vl_api_ipsec_proto_t protocol;
Klement Sekerab4d30532018-11-08 13:00:02 +0100497 u8 index;
498};
499
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100500/*
501 * Local Variables:
502 * eval: (c-set-style "gnu")
503 * End:
504 */
Dave Barach11b8dbf2017-04-24 10:46:54 -0400505