X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec.api;h=bb9e8056251d08a6a3540d7e5cd61dee288c7df9;hb=f2922422d972644e67d1ca989e40cd0100ecb06d;hp=92c39acefd660749c40b1ab95567eeece460c56d;hpb=17dcec0b940374127f6e1e004fb3ec261a0a3709;p=vpp.git diff --git a/src/vnet/ipsec/ipsec.api b/src/vnet/ipsec/ipsec.api index 92c39acefd6..bb9e8056251 100644 --- a/src/vnet/ipsec/ipsec.api +++ b/src/vnet/ipsec/ipsec.api @@ -96,7 +96,6 @@ typedef ipsec_spd_entry u8 protocol; // Selector - u8 is_ip_any; vl_api_address_t remote_address_start; vl_api_address_t remote_address_stop; vl_api_address_t local_address_start; @@ -115,7 +114,7 @@ typedef ipsec_spd_entry @param is_add - add SPD if non-zero, else delete @param entry - Description of the entry to add/dell */ -autoreply define ipsec_spd_entry_add_del +define ipsec_spd_entry_add_del { u32 client_index; u32 context; @@ -123,6 +122,19 @@ autoreply define ipsec_spd_entry_add_del vl_api_ipsec_spd_entry_t entry; }; +/** \brief IPsec: Reply Add/delete Security Policy Database entry + + @param context - sender context, to match reply w/ request + @param retval - success/fail rutrun code + @param stat_index - An index for the policy in the stats segment @ /net/ipec/policy +*/ +define ipsec_spd_entry_add_del_reply +{ + u32 context; + i32 retval; + u32 stat_index; +}; + /** \brief Dump IPsec all SPD IDs @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @@ -165,8 +177,6 @@ define ipsec_spd_dump { define ipsec_spd_details { u32 context; vl_api_ipsec_spd_entry_t entry; - u64 bytes; - u64 packets; }; /* @@ -212,7 +222,7 @@ enum ipsec_sad_flags { IPSEC_API_SAD_FLAG_NONE = 0, /* Enable extended sequence numbers */ - IPSEC_API_SAD_FLAG_USE_EXTENDED_SEQ_NUM = 0x01, + IPSEC_API_SAD_FLAG_USE_ESN = 0x01, /* Enable Anti-replay */ IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02, /* IPsec tunnel mode if non-zero, else transport mode */ @@ -251,6 +261,8 @@ typedef key @param integrity_key - integrity keying material @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero + @param tx_table_id - the FIB id used for encapsulated packets + @param salt - for use with counter mode ciphers */ typedef ipsec_sad_entry { @@ -270,6 +282,8 @@ typedef ipsec_sad_entry vl_api_address_t tunnel_src; vl_api_address_t tunnel_dst; + u32 tx_table_id; + u32 salt; }; /** \brief IPsec: Add/delete Security Association Database entry @@ -277,280 +291,18 @@ typedef ipsec_sad_entry @param context - sender context, to match reply w/ request @param entry - Entry to add or delete */ -autoreply define ipsec_sad_entry_add_del +define ipsec_sad_entry_add_del { u32 client_index; u32 context; u8 is_add; vl_api_ipsec_sad_entry_t entry; }; - -/** \brief IPsec: Update Security Association keys - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param sa_id - sa id - - @param crypto_key - crypto keying material - @param integrity_key - integrity keying material -*/ - -autoreply define ipsec_sa_set_key -{ - u32 client_index; - u32 context; - - u32 sa_id; - - vl_api_key_t crypto_key; - vl_api_key_t integrity_key; -}; - -/** \brief IKEv2: Add/delete profile - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param is_add - Add IKEv2 profile if non-zero, else delete -*/ -autoreply define ikev2_profile_add_del -{ - u32 client_index; - u32 context; - - u8 name[64]; - u8 is_add; -}; - -/** \brief IKEv2: Set IKEv2 profile authentication method - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param auth_method - IKEv2 authentication method (shared-key-mic/rsa-sig) - @param is_hex - Authentication data in hex format if non-zero, else string - @param data_len - Authentication data length - @param data - Authentication data (for rsa-sig cert file path) -*/ -autoreply define ikev2_profile_set_auth -{ - u32 client_index; - u32 context; - - u8 name[64]; - u8 auth_method; - u8 is_hex; - u32 data_len; - u8 data[data_len]; -}; - -/** \brief IKEv2: Set IKEv2 profile local/remote identification - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param is_local - Identification is local if non-zero, else remote - @param id_type - Identification type - @param data_len - Identification data length - @param data - Identification data -*/ -autoreply define ikev2_profile_set_id -{ - u32 client_index; - u32 context; - - u8 name[64]; - u8 is_local; - u8 id_type; - u32 data_len; - u8 data[data_len]; -}; - -/** \brief IKEv2: Set IKEv2 profile traffic selector parameters - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param is_local - Traffic selector is local if non-zero, else remote - @param proto - Traffic selector IP protocol (if zero not relevant) - @param start_port - The smallest port number allowed by traffic selector - @param end_port - The largest port number allowed by traffic selector - @param start_addr - The smallest address included in traffic selector - @param end_addr - The largest address included in traffic selector -*/ -autoreply define ikev2_profile_set_ts -{ - u32 client_index; - u32 context; - - u8 name[64]; - u8 is_local; - u8 proto; - u16 start_port; - u16 end_port; - u32 start_addr; - u32 end_addr; -}; - -/** \brief IKEv2: Set IKEv2 local RSA private key - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param key_file - Key file absolute path -*/ -autoreply define ikev2_set_local_key -{ - u32 client_index; - u32 context; - - u8 key_file[256]; -}; - -/** \brief IKEv2: Set IKEv2 responder interface and IP address - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param sw_if_index - interface index - @param address - interface address -*/ -autoreply define ikev2_set_responder -{ - u32 client_index; - u32 context; - - u8 name[64]; - u32 sw_if_index; - u8 address[4]; -}; - -/** \brief IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296) - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param crypto_alg - encryption algorithm - @param crypto_key_size - encryption key size - @param integ_alg - integrity algorithm - @param dh_group - Diffie-Hellman group - -*/ -autoreply define ikev2_set_ike_transforms -{ - u32 client_index; - u32 context; - - u8 name[64]; - u32 crypto_alg; - u32 crypto_key_size; - u32 integ_alg; - u32 dh_group; -}; - -/** \brief IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296) - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param crypto_alg - encryption algorithm - @param crypto_key_size - encryption key size - @param integ_alg - integrity algorithm - @param dh_group - Diffie-Hellman group - -*/ -autoreply define ikev2_set_esp_transforms -{ - u32 client_index; - u32 context; - - u8 name[64]; - u32 crypto_alg; - u32 crypto_key_size; - u32 integ_alg; - u32 dh_group; -}; - -/** \brief IKEv2: Set Child SA lifetime, limited by time and/or data - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - @param lifetime - SA maximum life time in seconds (0 to disable) - @param lifetime_jitter - Jitter added to prevent simultaneous rekeying - @param handover - Hand over time - @param lifetime_maxdata - SA maximum life time in bytes (0 to disable) - -*/ -autoreply define ikev2_set_sa_lifetime +define ipsec_sad_entry_add_del_reply { - u32 client_index; u32 context; - - u8 name[64]; - u64 lifetime; - u32 lifetime_jitter; - u32 handover; - u64 lifetime_maxdata; -}; - -/** \brief IKEv2: Initiate the SA_INIT exchange - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param name - IKEv2 profile name - -*/ -autoreply define ikev2_initiate_sa_init -{ - u32 client_index; - u32 context; - - u8 name[64]; -}; - -/** \brief IKEv2: Initiate the delete IKE SA exchange - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param ispi - IKE SA initiator SPI - -*/ -autoreply define ikev2_initiate_del_ike_sa -{ - u32 client_index; - u32 context; - - u64 ispi; -}; - -/** \brief IKEv2: Initiate the delete Child SA exchange - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param ispi - Child SA initiator SPI - -*/ -autoreply define ikev2_initiate_del_child_sa -{ - u32 client_index; - u32 context; - - u32 ispi; -}; - -/** \brief IKEv2: Initiate the rekey Child SA exchange - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param ispi - Child SA initiator SPI - -*/ -autoreply define ikev2_initiate_rekey_child_sa -{ - u32 client_index; - u32 context; - - u32 ispi; + i32 retval; + u32 stat_index; }; /** \brief IPsec: Get SPD interfaces @@ -582,6 +334,7 @@ define ipsec_spd_interface_details { @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param is_add - add IPsec tunnel interface if nonzero, else delete + @param is_ip6 - tunnel v6 or v4 @param esn - enable extended sequence numbers if nonzero, else disable @param anti_replay - enable anti replay check if nonzero, else disable @param local_ip - local IP address @@ -602,6 +355,7 @@ define ipsec_spd_interface_details { @param show_instance - instance to display for intf if renumber is set @param udp_encap - enable UDP encapsulation for NAT traversal @param tx_table_id - the FIB id used after packet encap + @param salt - for use with counter mode ciphers */ define ipsec_tunnel_if_add_del { u32 client_index; @@ -609,8 +363,8 @@ define ipsec_tunnel_if_add_del { u8 is_add; u8 esn; u8 anti_replay; - u8 local_ip[4]; - u8 remote_ip[4]; + vl_api_address_t local_ip; + vl_api_address_t remote_ip; u32 local_spi; u32 remote_spi; u8 crypto_alg; @@ -627,6 +381,7 @@ define ipsec_tunnel_if_add_del { u32 show_instance; u8 udp_encap; u32 tx_table_id; + u32 salt; }; /** \brief Add/delete IPsec tunnel interface response @@ -677,60 +432,18 @@ define ipsec_sa_dump { @param replay_window - bit map of seq nums received relative to last_seq if using anti-replay @param total_data_size - total bytes sent or received @param udp_encap - 1 if UDP encap enabled, 0 otherwise - @param tx_table_id - the FIB id used for encapsulated packets */ define ipsec_sa_details { u32 context; - u32 sa_id; - u32 sw_if_index; - - u32 spi; - u8 protocol; - - u8 crypto_alg; - u8 crypto_key_len; - u8 crypto_key[128]; - - u8 integ_alg; - u8 integ_key_len; - u8 integ_key[128]; - - u8 use_esn; - u8 use_anti_replay; - - u8 is_tunnel; - u8 is_tunnel_ip6; - u8 tunnel_src_addr[16]; - u8 tunnel_dst_addr[16]; + vl_api_ipsec_sad_entry_t entry; + u32 sw_if_index; u32 salt; u64 seq_outbound; u64 last_seq_inbound; u64 replay_window; u64 total_data_size; - u8 udp_encap; - - u32 tx_table_id; -}; - -/** \brief Set key on IPsec interface - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param sw_if_index - index of tunnel interface - @param key_type - type of key being set - @param alg - algorithm used with key - @param key_len - length key in bytes - @param key - key -*/ -autoreply define ipsec_tunnel_if_set_key { - u32 client_index; - u32 context; - u32 sw_if_index; - u8 key_type; - u8 alg; - u8 key_len; - u8 key[128]; }; /** \brief Set new SA on IPsec interface