X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec.api;h=011b0d4b1ffab91176ffb8534951bd6748faef9c;hb=e04d09de8433213f3c3e8cdc5acaa7e2289d92de;hp=178bb75716867298e15558701460a17e106f38ca;hpb=7cd468a3d7dee7d6c92f69a0bb7061ae208ec727;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec.api b/src/vnet/ipsec/ipsec.api
index 178bb757168..011b0d4b1ff 100644
--- a/src/vnet/ipsec/ipsec.api
+++ b/src/vnet/ipsec/ipsec.api
@@ -20,7 +20,7 @@
     @param spd_id - SPD instance id (control plane allocated)
 */
 
-define ipsec_spd_add_del
+autoreply define ipsec_spd_add_del
 {
   u32 client_index;
   u32 context;
@@ -28,17 +28,6 @@ define ipsec_spd_add_del
   u32 spd_id;
 };
 
-/** \brief Reply for IPsec: Add/delete Security Policy Database entry
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-
-define ipsec_spd_add_del_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IPsec: Add/delete SPD from interface
 
     @param client_index - opaque cookie to identify the sender
@@ -49,7 +38,7 @@ define ipsec_spd_add_del_reply
 */
 
 
-define ipsec_interface_add_del_spd
+autoreply define ipsec_interface_add_del_spd
 {
   u32 client_index;
   u32 context;
@@ -59,17 +48,6 @@ define ipsec_interface_add_del_spd
   u32 spd_id;
 };
 
-/** \brief Reply for IPsec: Add/delete SPD from interface
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-
-define ipsec_interface_add_del_spd_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IPsec: Add/delete Security Policy Database entry
 
     See RFC 4301, 4.4.1.1 on how to match packet to selectors
@@ -95,7 +73,7 @@ define ipsec_interface_add_del_spd_reply
 
 */
 
-define ipsec_spd_add_del_entry
+autoreply define ipsec_spd_add_del_entry
 {
   u32 client_index;
   u32 context;
@@ -125,17 +103,6 @@ define ipsec_spd_add_del_entry
   u32 sa_id;
 };
 
-/** \brief Reply for IPsec: Add/delete Security Policy Database entry
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-
-define ipsec_spd_add_del_entry_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IPsec: Add/delete Security Association Database entry
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
@@ -167,7 +134,7 @@ define ipsec_spd_add_del_entry_reply
      IPsec tunnel address copy mode (to support GDOI)
  */
 
-define ipsec_sad_add_del_entry
+autoreply define ipsec_sad_add_del_entry
 {
   u32 client_index;
   u32 context;
@@ -195,17 +162,6 @@ define ipsec_sad_add_del_entry
   u8 tunnel_dst_address[16];
 };
 
-/** \brief Reply for IPsec: Add/delete Security Association Database entry
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-
-define ipsec_sad_add_del_entry_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IPsec: Update Security Association keys
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
@@ -219,7 +175,7 @@ define ipsec_sad_add_del_entry_reply
     @param integrity_key - integrity keying material
 */
 
-define ipsec_sa_set_key
+autoreply define ipsec_sa_set_key
 {
   u32 client_index;
   u32 context;
@@ -233,17 +189,6 @@ define ipsec_sa_set_key
   u8 integrity_key[128];
 };
 
-/** \brief Reply for IPsec: Update Security Association keys
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-
-define ipsec_sa_set_key_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IKEv2: Add/delete profile
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
@@ -251,7 +196,7 @@ define ipsec_sa_set_key_reply
     @param name - IKEv2 profile name
     @param is_add - Add IKEv2 profile if non-zero, else delete
 */
-define ikev2_profile_add_del
+autoreply define ikev2_profile_add_del
 {
   u32 client_index;
   u32 context;
@@ -260,16 +205,6 @@ define ikev2_profile_add_del
   u8 is_add;
 };
 
-/** \brief Reply for IKEv2: Add/delete profile
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-define ikev2_profile_add_del_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IKEv2: Set IKEv2 profile authentication method
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
@@ -280,7 +215,7 @@ define ikev2_profile_add_del_reply
     @param data_len - Authentication data length
     @param data - Authentication data (for rsa-sig cert file path)
 */
-define ikev2_profile_set_auth
+autoreply define ikev2_profile_set_auth
 {
   u32 client_index;
   u32 context;
@@ -292,16 +227,6 @@ define ikev2_profile_set_auth
   u8 data[0];
 };
 
-/** \brief Reply for IKEv2: Set IKEv2 profile authentication method
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-define ikev2_profile_set_auth_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IKEv2: Set IKEv2 profile local/remote identification
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
@@ -312,7 +237,7 @@ define ikev2_profile_set_auth_reply
     @param data_len - Identification data length
     @param data - Identification data
 */
-define ikev2_profile_set_id
+autoreply define ikev2_profile_set_id
 {
   u32 client_index;
   u32 context;
@@ -324,16 +249,6 @@ define ikev2_profile_set_id
   u8 data[0];
 };
 
-/** \brief Reply for IKEv2:
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
-*/
-define ikev2_profile_set_id_reply
-{
-  u32 context;
-  i32 retval;
-};
-
 /** \brief IKEv2: Set IKEv2 profile traffic selector parameters
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
@@ -346,7 +261,7 @@ define ikev2_profile_set_id_reply
     @param start_addr - The smallest address included in traffic selector
     @param end_addr - The largest address included in traffic selector
 */
-define ikev2_profile_set_ts
+autoreply define ikev2_profile_set_ts
 {
   u32 client_index;
   u32 context;
@@ -360,38 +275,165 @@ define ikev2_profile_set_ts
   u32 end_addr;
 };
 
-/** \brief Reply for IKEv2: Set IKEv2 profile traffic selector parameters
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
+/** \brief IKEv2: Set IKEv2 local RSA private key
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param key_file - Key file absolute path
 */
-define ikev2_profile_set_ts_reply
+autoreply define ikev2_set_local_key
 {
+  u32 client_index;
   u32 context;
-  i32 retval;
+
+  u8 key_file[256];
 };
 
-/** \brief IKEv2: Set IKEv2 local RSA private key
+/** \brief IKEv2: Set IKEv2 responder interface and IP address
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
 
-    @param key_file - Key file absolute path
+    @param name - IKEv2 profile name
+    @param sw_if_index - interface index
+    @param address - interface address
 */
-define ikev2_set_local_key
+autoreply define ikev2_set_responder
 {
   u32 client_index;
   u32 context;
 
-  u8 key_file[256];
+  u8 name[64];
+  u32 sw_if_index;
+  u8 address[4];
 };
 
-/** \brief Reply for IKEv2: Set IKEv2 local key
-    @param context - returned sender context, to match reply w/ request
-    @param retval - return code
+/** \brief IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296)
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param name - IKEv2 profile name
+    @param crypto_alg - encryption algorithm
+    @param crypto_key_size - encryption key size
+    @param integ_alg - integrity algorithm
+    @param dh_group - Diffie-Hellman group
+    
 */
-define ikev2_set_local_key_reply
+autoreply define ikev2_set_ike_transforms
 {
+  u32 client_index;
   u32 context;
-  i32 retval;
+
+  u8 name[64];
+  u32 crypto_alg;
+  u32 crypto_key_size;
+  u32 integ_alg;
+  u32 dh_group;
+};
+
+/** \brief IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296)
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param name - IKEv2 profile name
+    @param crypto_alg - encryption algorithm
+    @param crypto_key_size - encryption key size
+    @param integ_alg - integrity algorithm
+    @param dh_group - Diffie-Hellman group
+    
+*/
+autoreply define ikev2_set_esp_transforms
+{
+  u32 client_index;
+  u32 context;
+
+  u8 name[64];
+  u32 crypto_alg;
+  u32 crypto_key_size;
+  u32 integ_alg;
+  u32 dh_group;
+};
+
+/** \brief IKEv2: Set Child SA lifetime, limited by time and/or data
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param name - IKEv2 profile name
+    @param lifetime - SA maximum life time in seconds (0 to disable)
+    @param lifetime_jitter - Jitter added to prevent simultaneounus rekeying
+    @param handover - Hand over time
+    @param lifetime_maxdata - SA maximum life time in bytes (0 to disable)
+    
+*/
+autoreply define ikev2_set_sa_lifetime
+{
+  u32 client_index;
+  u32 context;
+
+  u8 name[64];
+  u64 lifetime;
+  u32 lifetime_jitter;
+  u32 handover;
+  u64 lifetime_maxdata;
+};
+
+/** \brief IKEv2: Initiate the SA_INIT exchange
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param name - IKEv2 profile name
+    
+*/
+autoreply define ikev2_initiate_sa_init
+{
+  u32 client_index;
+  u32 context;
+
+  u8 name[64];
+};
+
+/** \brief IKEv2: Initiate the delete IKE SA exchange
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param ispi - IKE SA initiator SPI
+    
+*/
+autoreply define ikev2_initiate_del_ike_sa
+{
+  u32 client_index;
+  u32 context;
+
+  u64 ispi;
+};
+
+/** \brief IKEv2: Initiate the delete Child SA exchange
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param ispi - Child SA initiator SPI
+    
+*/
+autoreply define ikev2_initiate_del_child_sa
+{
+  u32 client_index;
+  u32 context;
+
+  u32 ispi;
+};
+
+/** \brief IKEv2: Initiate the rekey Child SA exchange
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+
+    @param ispi - Child SA initiator SPI
+    
+*/
+autoreply define ikev2_initiate_rekey_child_sa
+{
+  u32 client_index;
+  u32 context;
+
+  u32 ispi;
 };
 
 /** \brief Dump ipsec policy database data
@@ -427,7 +469,6 @@ define ipsec_spd_dump {
     @param bytes - byte count of packets matching this policy
     @param packets - count of packets matching this policy
 */
-
 define ipsec_spd_details {
     u32 context;
     u32 spd_id;
@@ -449,9 +490,63 @@ define ipsec_spd_details {
     u64 packets;
 };
 
+/** \brief Add or delete IPsec tunnel interface
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_add - add IPsec tunnel interface if nonzero, else delete
+    @param esn - enable extended sequence numbers if nonzero, else disable
+    @param anti_replay - enable anti replay check if nonzero, else disable
+    @param local_ip - local IP address
+    @param remote_ip - IP address of remote IPsec peer
+    @param local_spi - SPI of outbound IPsec SA
+    @param remote_spi - SPI of inbound IPsec SA
+    @param crypto_alg - encryption algorithm ID
+    @param local_crypto_key_len - length of local crypto key in bytes
+    @param local_crypto_key - crypto key for outbound IPsec SA
+    @param remote_crypto_key_len - length of remote crypto key in bytes
+    @param remote_crypto_key - crypto key for inbound IPsec SA
+    @param integ_alg - integrity algorithm ID
+    @param local_integ_key_len - length of local integrity key in bytes
+    @param local_integ_key - integrity key for outbound IPsec SA
+    @param remote_integ_key_len - length of remote integrity key in bytes
+    @param remote_integ_key - integrity key for inbound IPsec SA
+*/
+define ipsec_tunnel_if_add_del {
+  u32 client_index;
+  u32 context;
+  u8 is_add;
+  u8 esn;
+  u8 anti_replay;
+  u8 local_ip[4];
+  u8 remote_ip[4];
+  u32 local_spi;
+  u32 remote_spi;
+  u8 crypto_alg;
+  u8 local_crypto_key_len;
+  u8 local_crypto_key[128];
+  u8 remote_crypto_key_len;
+  u8 remote_crypto_key[128];
+  u8 integ_alg;
+  u8 local_integ_key_len;
+  u8 local_integ_key[128];
+  u8 remote_integ_key_len;
+  u8 remote_integ_key[128];
+};
+
+/** \brief Add/delete IPsec tunnel interface response
+    @param context - sender context, to match reply w/ request
+    @param retval - return status
+    @param sw_if_index - sw_if_index of new interface (for successful add)
+*/
+define ipsec_tunnel_if_add_del_reply {
+  u32 context;
+  i32 retval;
+  u32 sw_if_index;
+};
+
 /*
  * Local Variables:
  * eval: (c-set-style "gnu")
  * End:
  */
- 
\ No newline at end of file
+