1 /* Hey Emacs use -*- mode: C -*- */
3 * Copyright (c) 2015-2016 Cisco and/or its affiliates.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 option version = "3.0.0";
19 import "vnet/ip/ip_types.api";
21 /** \brief IPsec: Add/delete Security Policy Database
22 @param client_index - opaque cookie to identify the sender
23 @param context - sender context, to match reply w/ request
24 @param is_add - add SPD if non-zero, else delete
25 @param spd_id - SPD instance id (control plane allocated)
28 autoreply define ipsec_spd_add_del
36 /** \brief IPsec: Add/delete SPD from interface
38 @param client_index - opaque cookie to identify the sender
39 @param context - sender context, to match reply w/ request
40 @param is_add - add security mode if non-zero, else delete
41 @param sw_if_index - index of the interface
42 @param spd_id - SPD instance id to use for lookups
46 autoreply define ipsec_interface_add_del_spd
59 /* bypass - no IPsec processing */
60 IPSEC_API_SPD_ACTION_BYPASS = 0,
61 /* discard - discard packet with ICMP processing */
62 IPSEC_API_SPD_ACTION_DISCARD,
63 /* resolve - send request to control plane for SA resolving */
64 IPSEC_API_SPD_ACTION_RESOLVE,
65 /* protect - apply IPsec policy using following parameters */
66 IPSEC_API_SPD_ACTION_PROTECT,
69 /** \brief IPsec: Security Policy Database entry
71 See RFC 4301, 4.4.1.1 on how to match packet to selectors
73 @param spd_id - SPD instance id (control plane allocated)
74 @param priority - priority of SPD entry (non-unique value). Used to order SPD matching - higher priorities match before lower
75 @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
76 @param remote_address_start - start of remote address range to match
77 @param remote_address_stop - end of remote address range to match
78 @param local_address_start - start of local address range to match
79 @param local_address_stop - end of local address range to match
80 @param protocol - protocol type to match [0 means any] otherwise IANA value
81 @param remote_port_start - start of remote port range to match ...
82 @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
83 @param local_port_start - start of local port range to match ...
84 @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
85 @param policy - action to perform on match
86 @param sa_id - SAD instance id (control plane allocated)
88 typedef ipsec_spd_entry
95 vl_api_ipsec_spd_action_t policy;
100 vl_api_address_t remote_address_start;
101 vl_api_address_t remote_address_stop;
102 vl_api_address_t local_address_start;
103 vl_api_address_t local_address_stop;
105 u16 remote_port_start;
106 u16 remote_port_stop;
107 u16 local_port_start;
111 /** \brief IPsec: Add/delete Security Policy Database entry
113 @param client_index - opaque cookie to identify the sender
114 @param context - sender context, to match reply w/ request
115 @param is_add - add SPD if non-zero, else delete
116 @param entry - Description of the entry to add/dell
118 autoreply define ipsec_spd_entry_add_del
123 vl_api_ipsec_spd_entry_t entry;
126 /** \brief Dump IPsec all SPD IDs
127 @param client_index - opaque cookie to identify the sender
128 @param context - sender context, to match reply w/ request
130 define ipsec_spds_dump {
135 /** \brief Dump IPsec all SPD IDs response
136 @param client_index - opaque cookie to identify the sender
137 @param spd_id - SPD instance id (control plane allocated)
138 @param npolicies - number of policies in SPD
140 define ipsec_spds_details {
146 /** \brief Dump ipsec policy database data
147 @param client_index - opaque cookie to identify the sender
148 @param context - sender context, to match reply w/ request
149 @param spd_id - SPD instance id
150 @param sa_id - SA id, optional, set to ~0 to see all policies in SPD
152 define ipsec_spd_dump {
159 /** \brief IPsec policy database response
160 @param context - sender context which was passed in the request
161 €param entry - The SPD entry.
162 @param bytes - byte count of packets matching this policy
163 @param packets - count of packets matching this policy
165 define ipsec_spd_details {
167 vl_api_ipsec_spd_entry_t entry;
173 * @brief Support cryptographic algorithms
175 enum ipsec_crypto_alg
177 IPSEC_API_CRYPTO_ALG_NONE = 0,
178 IPSEC_API_CRYPTO_ALG_AES_CBC_128,
179 IPSEC_API_CRYPTO_ALG_AES_CBC_192,
180 IPSEC_API_CRYPTO_ALG_AES_CBC_256,
181 IPSEC_API_CRYPTO_ALG_AES_CTR_128,
182 IPSEC_API_CRYPTO_ALG_AES_CTR_192,
183 IPSEC_API_CRYPTO_ALG_AES_CTR_256,
184 IPSEC_API_CRYPTO_ALG_AES_GCM_128,
185 IPSEC_API_CRYPTO_ALG_AES_GCM_192,
186 IPSEC_API_CRYPTO_ALG_AES_GCM_256,
187 IPSEC_API_CRYPTO_ALG_DES_CBC,
188 IPSEC_API_CRYPTO_ALG_3DES_CBC,
192 * @brief Supported Integrity Algorithms
196 IPSEC_API_INTEG_ALG_NONE = 0,
198 IPSEC_API_INTEG_ALG_MD5_96,
200 IPSEC_API_INTEG_ALG_SHA1_96,
201 /* draft-ietf-ipsec-ciph-sha-256-00 */
202 IPSEC_API_INTEG_ALG_SHA_256_96,
204 IPSEC_API_INTEG_ALG_SHA_256_128,
206 IPSEC_API_INTEG_ALG_SHA_384_192,
208 IPSEC_API_INTEG_ALG_SHA_512_256,
213 IPSEC_API_SAD_FLAG_NONE = 0,
214 /* Enable extended sequence numbers */
215 IPSEC_API_SAD_FLAG_USE_EXTENDED_SEQ_NUM = 0x01,
216 /* Enable Anti-replay */
217 IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02,
218 /* IPsec tunnel mode if non-zero, else transport mode */
219 IPSEC_API_SAD_FLAG_IS_TUNNEL = 0x04,
220 /* IPsec tunnel mode is IPv6 if non-zero,
221 * else IPv4 tunnel only valid if is_tunnel is non-zero */
222 IPSEC_API_SAD_FLAG_IS_TUNNEL_V6 = 0x08,
223 /* enable UDP encapsulation for NAT traversal */
224 IPSEC_API_SAD_FLAG_UDP_ENCAP = 0x10,
235 /* the length of the key */
237 /* The data for the key */
241 /** \brief IPsec: Security Association Database entry
242 @param client_index - opaque cookie to identify the sender
243 @param context - sender context, to match reply w/ request
244 @param is_add - add SAD entry if non-zero, else delete
245 @param sad_id - sad id
246 @param spi - security parameter index
247 @param protocol - 0 = AH, 1 = ESP
248 @param crypto_algorithm - a supported crypto algorithm
249 @param crypto_key - crypto keying material
250 @param integrity_algorithm - one of the supported algorithms
251 @param integrity_key - integrity keying material
252 @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
253 @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
255 typedef ipsec_sad_entry
261 vl_api_ipsec_proto_t protocol;
263 vl_api_ipsec_crypto_alg_t crypto_algorithm;
264 vl_api_key_t crypto_key;
266 vl_api_ipsec_integ_alg_t integrity_algorithm;
267 vl_api_key_t integrity_key;
269 vl_api_ipsec_sad_flags_t flags;
271 vl_api_address_t tunnel_src;
272 vl_api_address_t tunnel_dst;
275 /** \brief IPsec: Add/delete Security Association Database entry
276 @param client_index - opaque cookie to identify the sender
277 @param context - sender context, to match reply w/ request
278 @param entry - Entry to add or delete
280 autoreply define ipsec_sad_entry_add_del
285 vl_api_ipsec_sad_entry_t entry;
288 /** \brief IPsec: Update Security Association keys
289 @param client_index - opaque cookie to identify the sender
290 @param context - sender context, to match reply w/ request
294 @param crypto_key - crypto keying material
295 @param integrity_key - integrity keying material
298 autoreply define ipsec_sa_set_key
305 vl_api_key_t crypto_key;
306 vl_api_key_t integrity_key;
309 /** \brief IKEv2: Add/delete profile
310 @param client_index - opaque cookie to identify the sender
311 @param context - sender context, to match reply w/ request
313 @param name - IKEv2 profile name
314 @param is_add - Add IKEv2 profile if non-zero, else delete
316 autoreply define ikev2_profile_add_del
325 /** \brief IKEv2: Set IKEv2 profile authentication method
326 @param client_index - opaque cookie to identify the sender
327 @param context - sender context, to match reply w/ request
329 @param name - IKEv2 profile name
330 @param auth_method - IKEv2 authentication method (shared-key-mic/rsa-sig)
331 @param is_hex - Authentication data in hex format if non-zero, else string
332 @param data_len - Authentication data length
333 @param data - Authentication data (for rsa-sig cert file path)
335 autoreply define ikev2_profile_set_auth
347 /** \brief IKEv2: Set IKEv2 profile local/remote identification
348 @param client_index - opaque cookie to identify the sender
349 @param context - sender context, to match reply w/ request
351 @param name - IKEv2 profile name
352 @param is_local - Identification is local if non-zero, else remote
353 @param id_type - Identification type
354 @param data_len - Identification data length
355 @param data - Identification data
357 autoreply define ikev2_profile_set_id
369 /** \brief IKEv2: Set IKEv2 profile traffic selector parameters
370 @param client_index - opaque cookie to identify the sender
371 @param context - sender context, to match reply w/ request
373 @param name - IKEv2 profile name
374 @param is_local - Traffic selector is local if non-zero, else remote
375 @param proto - Traffic selector IP protocol (if zero not relevant)
376 @param start_port - The smallest port number allowed by traffic selector
377 @param end_port - The largest port number allowed by traffic selector
378 @param start_addr - The smallest address included in traffic selector
379 @param end_addr - The largest address included in traffic selector
381 autoreply define ikev2_profile_set_ts
395 /** \brief IKEv2: Set IKEv2 local RSA private key
396 @param client_index - opaque cookie to identify the sender
397 @param context - sender context, to match reply w/ request
399 @param key_file - Key file absolute path
401 autoreply define ikev2_set_local_key
409 /** \brief IKEv2: Set IKEv2 responder interface and IP address
410 @param client_index - opaque cookie to identify the sender
411 @param context - sender context, to match reply w/ request
413 @param name - IKEv2 profile name
414 @param sw_if_index - interface index
415 @param address - interface address
417 autoreply define ikev2_set_responder
427 /** \brief IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296)
428 @param client_index - opaque cookie to identify the sender
429 @param context - sender context, to match reply w/ request
431 @param name - IKEv2 profile name
432 @param crypto_alg - encryption algorithm
433 @param crypto_key_size - encryption key size
434 @param integ_alg - integrity algorithm
435 @param dh_group - Diffie-Hellman group
438 autoreply define ikev2_set_ike_transforms
450 /** \brief IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296)
451 @param client_index - opaque cookie to identify the sender
452 @param context - sender context, to match reply w/ request
454 @param name - IKEv2 profile name
455 @param crypto_alg - encryption algorithm
456 @param crypto_key_size - encryption key size
457 @param integ_alg - integrity algorithm
458 @param dh_group - Diffie-Hellman group
461 autoreply define ikev2_set_esp_transforms
473 /** \brief IKEv2: Set Child SA lifetime, limited by time and/or data
474 @param client_index - opaque cookie to identify the sender
475 @param context - sender context, to match reply w/ request
477 @param name - IKEv2 profile name
478 @param lifetime - SA maximum life time in seconds (0 to disable)
479 @param lifetime_jitter - Jitter added to prevent simultaneous rekeying
480 @param handover - Hand over time
481 @param lifetime_maxdata - SA maximum life time in bytes (0 to disable)
484 autoreply define ikev2_set_sa_lifetime
493 u64 lifetime_maxdata;
496 /** \brief IKEv2: Initiate the SA_INIT exchange
497 @param client_index - opaque cookie to identify the sender
498 @param context - sender context, to match reply w/ request
500 @param name - IKEv2 profile name
503 autoreply define ikev2_initiate_sa_init
511 /** \brief IKEv2: Initiate the delete IKE SA exchange
512 @param client_index - opaque cookie to identify the sender
513 @param context - sender context, to match reply w/ request
515 @param ispi - IKE SA initiator SPI
518 autoreply define ikev2_initiate_del_ike_sa
526 /** \brief IKEv2: Initiate the delete Child SA exchange
527 @param client_index - opaque cookie to identify the sender
528 @param context - sender context, to match reply w/ request
530 @param ispi - Child SA initiator SPI
533 autoreply define ikev2_initiate_del_child_sa
541 /** \brief IKEv2: Initiate the rekey Child SA exchange
542 @param client_index - opaque cookie to identify the sender
543 @param context - sender context, to match reply w/ request
545 @param ispi - Child SA initiator SPI
548 autoreply define ikev2_initiate_rekey_child_sa
556 /** \brief IPsec: Get SPD interfaces
557 @param client_index - opaque cookie to identify the sender
558 @param context - sender context, to match reply w/ request
559 @param spd_index - SPD index
560 @param spd_index_valid - if 1 spd_index is used to filter
561 spd_index's, if 0 no filtering is done
563 define ipsec_spd_interface_dump {
570 /** \brief IPsec: SPD interface response
571 @param context - sender context which was passed in the request
572 @param spd_index - SPD index
573 @param sw_if_index - index of the interface
575 define ipsec_spd_interface_details {
581 /** \brief Add or delete IPsec tunnel interface
582 @param client_index - opaque cookie to identify the sender
583 @param context - sender context, to match reply w/ request
584 @param is_add - add IPsec tunnel interface if nonzero, else delete
585 @param esn - enable extended sequence numbers if nonzero, else disable
586 @param anti_replay - enable anti replay check if nonzero, else disable
587 @param local_ip - local IP address
588 @param remote_ip - IP address of remote IPsec peer
589 @param local_spi - SPI of outbound IPsec SA
590 @param remote_spi - SPI of inbound IPsec SA
591 @param crypto_alg - encryption algorithm ID
592 @param local_crypto_key_len - length of local crypto key in bytes
593 @param local_crypto_key - crypto key for outbound IPsec SA
594 @param remote_crypto_key_len - length of remote crypto key in bytes
595 @param remote_crypto_key - crypto key for inbound IPsec SA
596 @param integ_alg - integrity algorithm ID
597 @param local_integ_key_len - length of local integrity key in bytes
598 @param local_integ_key - integrity key for outbound IPsec SA
599 @param remote_integ_key_len - length of remote integrity key in bytes
600 @param remote_integ_key - integrity key for inbound IPsec SA
601 @param renumber - intf display name uses a specified instance if != 0
602 @param show_instance - instance to display for intf if renumber is set
603 @param udp_encap - enable UDP encapsulation for NAT traversal
604 @param tx_table_id - the FIB id used after packet encap
606 define ipsec_tunnel_if_add_del {
617 u8 local_crypto_key_len;
618 u8 local_crypto_key[128];
619 u8 remote_crypto_key_len;
620 u8 remote_crypto_key[128];
622 u8 local_integ_key_len;
623 u8 local_integ_key[128];
624 u8 remote_integ_key_len;
625 u8 remote_integ_key[128];
632 /** \brief Add/delete IPsec tunnel interface response
633 @param context - sender context, to match reply w/ request
634 @param retval - return status
635 @param sw_if_index - sw_if_index of new interface (for successful add)
637 define ipsec_tunnel_if_add_del_reply {
643 /** \brief Dump IPsec security association
644 @param client_index - opaque cookie to identify the sender
645 @param context - sender context, to match reply w/ request
646 @param sa_id - optional ID of an SA to dump, if ~0 dump all SAs in SAD
648 define ipsec_sa_dump {
654 /** \brief IPsec security association database response
655 @param context - sender context which was passed in the request
656 @param sa_id - SA ID, policy-based SAs >=0, tunnel interface SAs = 0
657 @param sw_if_index - sw_if_index of tunnel interface, policy-based SAs = ~0
658 @param spi - security parameter index
659 @param protocol - IPsec protocol (value from ipsec_protocol_t)
660 @param crypto_alg - crypto algorithm (value from ipsec_crypto_alg_t)
661 @param crypto_key_len - length of crypto_key in bytes
662 @param crypto_key - crypto keying material
663 @param integ_alg - integrity algorithm (value from ipsec_integ_alg_t)
664 @param integ_key_len - length of integ_key in bytes
665 @param integ_key - integrity keying material
666 @param use_esn - using extended sequence numbers when non-zero
667 @param use_anti_replay - using anti-replay window when non-zero
668 @param is_tunnel - IPsec tunnel mode when non-zero, else transport mode
669 @param is_tunnel_ipv6 - If using tunnel mode, endpoints are IPv6
670 @param tunnel_src_addr - Tunnel source address if using tunnel mode
671 @param tunnel_dst_addr - Tunnel destination address is using tunnel mode
672 @param salt - 4 byte salt
673 @param seq - current sequence number for outbound
674 @param seq_hi - high 32 bits of ESN for outbound
675 @param last_seq - highest sequence number received inbound
676 @param last_seq_hi - high 32 bits of highest ESN received inbound
677 @param replay_window - bit map of seq nums received relative to last_seq if using anti-replay
678 @param total_data_size - total bytes sent or received
679 @param udp_encap - 1 if UDP encap enabled, 0 otherwise
680 @param tx_table_id - the FIB id used for encapsulated packets
682 define ipsec_sa_details {
703 u8 tunnel_src_addr[16];
704 u8 tunnel_dst_addr[16];
708 u64 last_seq_inbound;
717 /** \brief Set key on IPsec interface
718 @param client_index - opaque cookie to identify the sender
719 @param context - sender context, to match reply w/ request
720 @param sw_if_index - index of tunnel interface
721 @param key_type - type of key being set
722 @param alg - algorithm used with key
723 @param key_len - length key in bytes
726 autoreply define ipsec_tunnel_if_set_key {
736 /** \brief Set new SA on IPsec interface
737 @param client_index - opaque cookie to identify the sender
738 @param context - sender context, to match reply w/ request
739 @param sw_if_index - index of tunnel interface
740 @param sa_id - ID of SA to use
741 @param is_outbound - 1 if outbound (local) SA, 0 if inbound (remote)
743 autoreply define ipsec_tunnel_if_set_sa {
751 /** \brief Dump IPsec backends
752 @param client_index - opaque cookie to identify the sender
753 @param context - sender context, to match reply w/ request
755 define ipsec_backend_dump {
760 /** \brief IPsec backend details
761 @param name - name of the backend
762 @param protocol - IPsec protocol (value from ipsec_protocol_t)
763 @param index - backend index
764 @param active - set to 1 if the backend is active, otherwise 0
766 define ipsec_backend_details {
769 vl_api_ipsec_proto_t protocol;
774 /** \brief Select IPsec backend
775 @param client_index - opaque cookie to identify the sender
776 @param context - sender context, to match reply w/ request
777 @param protocol - IPsec protocol (value from ipsec_protocol_t)
778 @param index - backend index
780 autoreply define ipsec_select_backend {
783 vl_api_ipsec_proto_t protocol;
789 * eval: (c-set-style "gnu")