-define input_acl_set_interface_reply {
- u32 context;
- i32 retval;
-};
-
-/** \brief IPsec: Add/delete Security Policy Database
- @param client_index - opaque cookie to identify the sender
- @param context - sender context, to match reply w/ request
- @param is_add - add SPD if non-zero, else delete
- @param spd_id - SPD instance id (control plane allocated)
-*/
-
-define ipsec_spd_add_del {
- u32 client_index;
- u32 context;
- u8 is_add;
- u32 spd_id;
-};
-
-/** \brief Reply for IPsec: Add/delete Security Policy Database entry
- @param context - returned sender context, to match reply w/ request
- @param retval - return code
-*/
-
-define ipsec_spd_add_del_reply {
- u32 context;
- i32 retval;
-};
-
-/** \brief IPsec: Add/delete SPD from interface
-
- @param client_index - opaque cookie to identify the sender
- @param context - sender context, to match reply w/ request
- @param is_add - add security mode if non-zero, else delete
- @param sw_if_index - index of the interface
- @param spd_id - SPD instance id to use for lookups
-*/
-
-
-define ipsec_interface_add_del_spd {
- u32 client_index;
- u32 context;
-
- u8 is_add;
- u32 sw_if_index;
- u32 spd_id;
-};
-
-/** \brief Reply for IPsec: Add/delete SPD from interface
- @param context - returned sender context, to match reply w/ request
- @param retval - return code
-*/
-
-define ipsec_interface_add_del_spd_reply {
- u32 context;
- i32 retval;
-};
-
-/** \brief IPsec: Add/delete Security Policy Database entry
-
- See RFC 4301, 4.4.1.1 on how to match packet to selectors
-
- @param client_index - opaque cookie to identify the sender
- @param context - sender context, to match reply w/ request
- @param is_add - add SPD if non-zero, else delete
- @param spd_id - SPD instance id (control plane allocated)
- @param priority - priority of SPD entry (non-unique value). Used to order SPD matching - higher priorities match before lower
- @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
- @param is_ipv6 - remote/local address are IPv6 if non-zero, else IPv4
- @param remote_address_start - start of remote address range to match
- @param remote_address_stop - end of remote address range to match
- @param local_address_start - start of local address range to match
- @param local_address_stop - end of local address range to match
- @param protocol - protocol type to match [0 means any]
- @param remote_port_start - start of remote port range to match ...
- @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
- @param local_port_start - start of local port range to match ...
- @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
- @param policy - 0 = bypass (no IPsec processing), 1 = discard (discard packet with ICMP processing), 2 = resolve (send request to control plane for SA resolving, and discard without ICMP processing), 3 = protect (apply IPsec policy using following parameters)
- @param sa_id - SAD instance id (control plane allocated)
-
-*/
-
-define ipsec_spd_add_del_entry {
- u32 client_index;
- u32 context;
- u8 is_add;
-
- u32 spd_id;
- i32 priority;
- u8 is_outbound;
-
- // Selector
- u8 is_ipv6;
- u8 is_ip_any;
- u8 remote_address_start[16];
- u8 remote_address_stop[16];
- u8 local_address_start[16];
- u8 local_address_stop[16];
-
- u8 protocol;
-
- u16 remote_port_start;
- u16 remote_port_stop;
- u16 local_port_start;
- u16 local_port_stop;
-
- // Policy
- u8 policy;
- u32 sa_id;
-};
-
-/** \brief Reply for IPsec: Add/delete Security Policy Database entry
- @param context - returned sender context, to match reply w/ request
- @param retval - return code
-*/
-
-define ipsec_spd_add_del_entry_reply {
- u32 context;
- i32 retval;
-};
-
-/** \brief IPsec: Add/delete Security Association Database entry
- @param client_index - opaque cookie to identify the sender
- @param context - sender context, to match reply w/ request
- @param is_add - add SAD entry if non-zero, else delete
-
- @param sad_id - sad id
-
- @param spi - security parameter index
-
- @param protocol - 0 = AH, 1 = ESP
-
- @param crypto_algorithm - 0 = Null, 1 = AES-CBC-128, 2 = AES-CBC-192, 3 = AES-CBC-256, 4 = 3DES-CBC
- @param crypto_key_length - length of crypto_key in bytes
- @param crypto_key - crypto keying material
-
- @param integrity_algorithm - 0 = None, 1 = MD5-96, 2 = SHA1-96, 3 = SHA-256, 4 = SHA-384, 5=SHA-512
- @param integrity_key_length - length of integrity_key in bytes
- @param integrity_key - integrity keying material
-
- @param use_extended_sequence_number - use ESN when non-zero
-
- @param is_tunnel - IPsec tunnel mode if non-zero, else transport mode
- @param is_tunnel_ipv6 - IPsec tunnel mode is IPv6 if non-zero, else IPv4 tunnel only valid if is_tunnel is non-zero
- @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
- @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
-
- To be added:
- Anti-replay
- IPsec tunnel address copy mode (to support GDOI)
- */
-
-define ipsec_sad_add_del_entry {
- u32 client_index;
- u32 context;
- u8 is_add;
-
- u32 sad_id;
-
- u32 spi;
-
- u8 protocol;
-
- u8 crypto_algorithm;
- u8 crypto_key_length;
- u8 crypto_key[128];
-
- u8 integrity_algorithm;
- u8 integrity_key_length;
- u8 integrity_key[128];
-
- u8 use_extended_sequence_number;
-
- u8 is_tunnel;
- u8 is_tunnel_ipv6;
- u8 tunnel_src_address[16];
- u8 tunnel_dst_address[16];
-};
-
-/** \brief Reply for IPsec: Add/delete Security Association Database entry
- @param context - returned sender context, to match reply w/ request
- @param retval - return code
-*/
-
-define ipsec_sad_add_del_entry_reply {
- u32 context;
- i32 retval;