X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec.api;h=72677d6e0ea634c9317bb6a8a1e87779bf8c52e7;hb=12989b538;hp=91d21d4dce991e7adc2caf835defb693da254cb4;hpb=eba31ecebed1a7d168da17194cab7a8955761f2b;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec.api b/src/vnet/ipsec/ipsec.api
index 91d21d4dce9..72677d6e0ea 100644
--- a/src/vnet/ipsec/ipsec.api
+++ b/src/vnet/ipsec/ipsec.api
@@ -17,6 +17,7 @@
 option version = "3.0.0";
 
 import "vnet/ip/ip_types.api";
+import "vnet/interface_types.api";
 
 /** \brief IPsec: Add/delete Security Policy Database
     @param client_index - opaque cookie to identify the sender
@@ -222,7 +223,7 @@ enum ipsec_sad_flags
 {
   IPSEC_API_SAD_FLAG_NONE = 0,
   /* Enable extended sequence numbers */
-  IPSEC_API_SAD_FLAG_USE_EXTENDED_SEQ_NUM = 0x01,
+  IPSEC_API_SAD_FLAG_USE_ESN = 0x01,
   /* Enable Anti-replay */
   IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02,
   /* IPsec tunnel mode if non-zero, else transport mode */
@@ -232,10 +233,6 @@ enum ipsec_sad_flags
   IPSEC_API_SAD_FLAG_IS_TUNNEL_V6 = 0x08,
   /* enable UDP encapsulation for NAT traversal */
   IPSEC_API_SAD_FLAG_UDP_ENCAP = 0x10,
-
-  /* come-on Ole please fix this */
-  IPSEC_API_SAD_COMBO_12 = 12,
-  IPSEC_API_SAD_COMBO_20 = 20,
 };
 
 enum ipsec_proto
@@ -266,6 +263,7 @@ typedef key
     @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
     @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
     @param tx_table_id - the FIB id used for encapsulated packets
+    @param salt - for use with counter mode ciphers
  */
 typedef ipsec_sad_entry
 {
@@ -286,6 +284,7 @@ typedef ipsec_sad_entry
   vl_api_address_t tunnel_src;
   vl_api_address_t tunnel_dst;
   u32 tx_table_id;
+  u32 salt;
 };
 
 /** \brief IPsec: Add/delete Security Association Database entry
@@ -307,272 +306,82 @@ define ipsec_sad_entry_add_del_reply
   u32 stat_index;
 };
 
-/** \brief IPsec: Update Security Association keys
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param sa_id - sa id
-
-    @param crypto_key - crypto keying material
-    @param integrity_key - integrity keying material
-*/
-
-autoreply define ipsec_sa_set_key
-{
-  u32 client_index;
-  u32 context;
-
-  u32 sa_id;
-
-  vl_api_key_t crypto_key;
-  vl_api_key_t integrity_key;
-};
-
-/** \brief IKEv2: Add/delete profile
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param is_add - Add IKEv2 profile if non-zero, else delete
-*/
-autoreply define ikev2_profile_add_del
-{
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-  u8 is_add;
-};
-
-/** \brief IKEv2: Set IKEv2 profile authentication method
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param auth_method - IKEv2 authentication method (shared-key-mic/rsa-sig)
-    @param is_hex - Authentication data in hex format if non-zero, else string
-    @param data_len - Authentication data length
-    @param data - Authentication data (for rsa-sig cert file path)
-*/
-autoreply define ikev2_profile_set_auth
-{
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-  u8 auth_method;
-  u8 is_hex;
-  u32 data_len;
-  u8 data[data_len];
-};
-
-/** \brief IKEv2: Set IKEv2 profile local/remote identification
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param is_local - Identification is local if non-zero, else remote
-    @param id_type - Identification type
-    @param data_len - Identification data length
-    @param data - Identification data
-*/
-autoreply define ikev2_profile_set_id
-{
-  u32 client_index;
-  u32 context;
+/** \brief Add or Update Protection for a tunnel with IPSEC
+
+    Tunnel protection directly associates an SA with all packets
+    ingress and egress on the tunnel. This could also be achieved by
+    assigning an SPD to the tunnel, but that would incur an unnessccary
+    SPD entry lookup.
+
+    For tunnels the ESP acts on the post-encapsulated packet. So if this
+    packet:
+      +---------+------+
+      | Payload | O-IP |
+      +---------+------+
+    where O-IP is the overlay IP addrees that was routed into the tunnel,
+    the resulting encapsulated packet will be:
+      +---------+------+------+
+      | Payload | O-IP | T-IP |
+      +---------+------+------+
+    where T-IP is the tunnel's src.dst IP addresses.
+    If the SAs used for protection are in transport mode then the ESP is
+    inserted before T-IP, i.e.:
+      +---------+------+-----+------+
+      | Payload | O-IP | ESP | T-IP |
+      +---------+------+-----+------+
+    If the SAs used for protection are in tunnel mode then another
+    encapsulation occurs, i.e.:
+      +---------+------+------+-----+------+
+      | Payload | O-IP | T-IP | ESP | C-IP |
+      +---------+------+------+-----+------+
+    where C-IP are the crypto endpoint IP addresses defined as the tunnel
+    endpoints in the SA.
+    The mode for the inbound and outbound SA must be the same.
 
-  u8 name[64];
-  u8 is_local;
-  u8 id_type;
-  u32 data_len;
-  u8 data[data_len];
-};
-
-/** \brief IKEv2: Set IKEv2 profile traffic selector parameters
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param is_local - Traffic selector is local if non-zero, else remote
-    @param proto - Traffic selector IP protocol (if zero not relevant)
-    @param start_port - The smallest port number allowed by traffic selector
-    @param end_port - The largest port number allowed by traffic selector
-    @param start_addr - The smallest address included in traffic selector
-    @param end_addr - The largest address included in traffic selector
+    @param sw_id_index - Tunnel interface to protect
+    @param sa_in - The ID [set] of inbound SAs
+    @param sa_out - The ID of outbound SA
 */
-autoreply define ikev2_profile_set_ts
+typedef ipsec_tunnel_protect
 {
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-  u8 is_local;
-  u8 proto;
-  u16 start_port;
-  u16 end_port;
-  u32 start_addr;
-  u32 end_addr;
+  vl_api_interface_index_t sw_if_index;
+  u32 sa_out;
+  u8 n_sa_in;
+  u32 sa_in[n_sa_in];
 };
 
-/** \brief IKEv2: Set IKEv2 local RSA private key
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param key_file - Key file absolute path
-*/
-autoreply define ikev2_set_local_key
+autoreply define ipsec_tunnel_protect_update
 {
   u32 client_index;
   u32 context;
 
-  u8 key_file[256];
+  vl_api_ipsec_tunnel_protect_t tunnel;
 };
 
-/** \brief IKEv2: Set IKEv2 responder interface and IP address
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param sw_if_index - interface index
-    @param address - interface address
-*/
-autoreply define ikev2_set_responder
+autoreply define ipsec_tunnel_protect_del
 {
   u32 client_index;
   u32 context;
 
-  u8 name[64];
-  u32 sw_if_index;
-  u8 address[4];
+  vl_api_interface_index_t sw_if_index;
 };
 
-/** \brief IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296)
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param crypto_alg - encryption algorithm
-    @param crypto_key_size - encryption key size
-    @param integ_alg - integrity algorithm
-    @param dh_group - Diffie-Hellman group
-    
-*/
-autoreply define ikev2_set_ike_transforms
-{
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-  u32 crypto_alg;
-  u32 crypto_key_size;
-  u32 integ_alg;
-  u32 dh_group;
-};
-
-/** \brief IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296)
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param crypto_alg - encryption algorithm
-    @param crypto_key_size - encryption key size
-    @param integ_alg - integrity algorithm
-    @param dh_group - Diffie-Hellman group
-    
-*/
-autoreply define ikev2_set_esp_transforms
-{
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-  u32 crypto_alg;
-  u32 crypto_key_size;
-  u32 integ_alg;
-  u32 dh_group;
-};
-
-/** \brief IKEv2: Set Child SA lifetime, limited by time and/or data
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    @param lifetime - SA maximum life time in seconds (0 to disable)
-    @param lifetime_jitter - Jitter added to prevent simultaneous rekeying
-    @param handover - Hand over time
-    @param lifetime_maxdata - SA maximum life time in bytes (0 to disable)
-    
-*/
-autoreply define ikev2_set_sa_lifetime
-{
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-  u64 lifetime;
-  u32 lifetime_jitter;
-  u32 handover;
-  u64 lifetime_maxdata;
-};
-
-/** \brief IKEv2: Initiate the SA_INIT exchange
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param name - IKEv2 profile name
-    
-*/
-autoreply define ikev2_initiate_sa_init
-{
-  u32 client_index;
-  u32 context;
-
-  u8 name[64];
-};
-
-/** \brief IKEv2: Initiate the delete IKE SA exchange
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param ispi - IKE SA initiator SPI
-    
-*/
-autoreply define ikev2_initiate_del_ike_sa
-{
-  u32 client_index;
-  u32 context;
-
-  u64 ispi;
-};
-
-/** \brief IKEv2: Initiate the delete Child SA exchange
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param ispi - Child SA initiator SPI
-    
-*/
-autoreply define ikev2_initiate_del_child_sa
+/**
+ * @brief Dump all tunnel protections
+ */
+define ipsec_tunnel_protect_dump
 {
   u32 client_index;
   u32 context;
-
-  u32 ispi;
+  vl_api_interface_index_t sw_if_index;
 };
 
-/** \brief IKEv2: Initiate the rekey Child SA exchange
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-
-    @param ispi - Child SA initiator SPI
-    
-*/
-autoreply define ikev2_initiate_rekey_child_sa
+define ipsec_tunnel_protect_details
 {
-  u32 client_index;
   u32 context;
-
-  u32 ispi;
+  vl_api_ipsec_tunnel_protect_t tun;
 };
 
 /** \brief IPsec: Get SPD interfaces
@@ -601,9 +410,14 @@ define ipsec_spd_interface_details {
 };
 
 /** \brief Add or delete IPsec tunnel interface
+
+    !!DEPRECATED!!
+         use the tunnel protect APIs instead
+
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
     @param is_add - add IPsec tunnel interface if nonzero, else delete
+    @param is_ip6 - tunnel v6 or v4
     @param esn - enable extended sequence numbers if nonzero, else disable
     @param anti_replay - enable anti replay check if nonzero, else disable
     @param local_ip - local IP address
@@ -624,6 +438,7 @@ define ipsec_spd_interface_details {
     @param show_instance - instance to display for intf if renumber is set
     @param udp_encap - enable UDP encapsulation for NAT traversal
     @param tx_table_id - the FIB id used after packet encap
+    @param salt - for use with counter mode ciphers
 */
 define ipsec_tunnel_if_add_del {
   u32 client_index;
@@ -631,8 +446,8 @@ define ipsec_tunnel_if_add_del {
   u8 is_add;
   u8 esn;
   u8 anti_replay;
-  u8 local_ip[4];
-  u8 remote_ip[4];
+  vl_api_address_t local_ip;
+  vl_api_address_t remote_ip;
   u32 local_spi;
   u32 remote_spi;
   u8 crypto_alg;
@@ -649,6 +464,7 @@ define ipsec_tunnel_if_add_del {
   u32 show_instance;
   u8 udp_encap;
   u32 tx_table_id;
+  u32 salt;
 };
 
 /** \brief Add/delete IPsec tunnel interface response
@@ -713,26 +529,10 @@ define ipsec_sa_details {
   u64 total_data_size;
 };
 
-/** \brief Set key on IPsec interface
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param sw_if_index - index of tunnel interface
-    @param key_type - type of key being set
-    @param alg - algorithm used with key
-    @param key_len - length key in bytes
-    @param key - key
-*/
-autoreply define ipsec_tunnel_if_set_key {
-  u32 client_index;
-  u32 context;
-  u32 sw_if_index;
-  u8 key_type;
-  u8 alg;
-  u8 key_len;
-  u8 key[128];
-};
-
 /** \brief Set new SA on IPsec interface
+
+    !! DEPRECATED !!
+
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
     @param sw_if_index - index of tunnel interface