FD.io VPP  v19.08-27-gf4dcae4
Vector Packet Processing
ipsec.api
Go to the documentation of this file.
1 /* Hey Emacs use -*- mode: C -*- */
2 /*
3  * Copyright (c) 2015-2016 Cisco and/or its affiliates.
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at:
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 option version = "3.0.0";
18 
19 import "vnet/ip/ip_types.api";
20 import "vnet/interface_types.api";
21 
22 /** \brief IPsec: Add/delete Security Policy Database
23  @param client_index - opaque cookie to identify the sender
24  @param context - sender context, to match reply w/ request
25  @param is_add - add SPD if non-zero, else delete
26  @param spd_id - SPD instance id (control plane allocated)
27 */
28 
29 autoreply define ipsec_spd_add_del
30 {
35 };
36 
37 /** \brief IPsec: Add/delete SPD from interface
38 
39  @param client_index - opaque cookie to identify the sender
40  @param context - sender context, to match reply w/ request
41  @param is_add - add security mode if non-zero, else delete
42  @param sw_if_index - index of the interface
43  @param spd_id - SPD instance id to use for lookups
44 */
45 
46 
47 autoreply define ipsec_interface_add_del_spd
48 {
51 
55 };
56 
57 
59 {
60  /* bypass - no IPsec processing */
62  /* discard - discard packet with ICMP processing */
64  /* resolve - send request to control plane for SA resolving */
66  /* protect - apply IPsec policy using following parameters */
68 };
69 
70 /** \brief IPsec: Security Policy Database entry
71 
72  See RFC 4301, 4.4.1.1 on how to match packet to selectors
73 
74  @param spd_id - SPD instance id (control plane allocated)
75  @param priority - priority of SPD entry (non-unique value). Used to order SPD matching - higher priorities match before lower
76  @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
77  @param remote_address_start - start of remote address range to match
78  @param remote_address_stop - end of remote address range to match
79  @param local_address_start - start of local address range to match
80  @param local_address_stop - end of local address range to match
81  @param protocol - protocol type to match [0 means any] otherwise IANA value
82  @param remote_port_start - start of remote port range to match ...
83  @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
84  @param local_port_start - start of local port range to match ...
85  @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
86  @param policy - action to perform on match
87  @param sa_id - SAD instance id (control plane allocated)
88 */
89 typedef ipsec_spd_entry
90 {
91  u32 spd_id;
94 
96  vl_api_ipsec_spd_action_t policy;
98 
99  // Selector
100  vl_api_address_t remote_address_start;
101  vl_api_address_t remote_address_stop;
102  vl_api_address_t local_address_start;
103  vl_api_address_t local_address_stop;
104 
109 };
110 
111 /** \brief IPsec: Add/delete Security Policy Database entry
112 
113  @param client_index - opaque cookie to identify the sender
114  @param context - sender context, to match reply w/ request
115  @param is_add - add SPD if non-zero, else delete
116  @param entry - Description of the entry to add/dell
117 */
118 define ipsec_spd_entry_add_del
119 {
123  vl_api_ipsec_spd_entry_t entry;
124 };
125 
126 /** \brief IPsec: Reply Add/delete Security Policy Database entry
127 
128  @param context - sender context, to match reply w/ request
129  @param retval - success/fail rutrun code
130  @param stat_index - An index for the policy in the stats segment @ /net/ipec/policy
131 */
132 define ipsec_spd_entry_add_del_reply
133 {
137 };
138 
139 /** \brief Dump IPsec all SPD IDs
140  @param client_index - opaque cookie to identify the sender
141  @param context - sender context, to match reply w/ request
142 */
143 define ipsec_spds_dump {
146 };
147 
148 /** \brief Dump IPsec all SPD IDs response
149  @param client_index - opaque cookie to identify the sender
150  @param spd_id - SPD instance id (control plane allocated)
151  @param npolicies - number of policies in SPD
152 */
153 define ipsec_spds_details {
157 };
158 
159 /** \brief Dump ipsec policy database data
160  @param client_index - opaque cookie to identify the sender
161  @param context - sender context, to match reply w/ request
162  @param spd_id - SPD instance id
163  @param sa_id - SA id, optional, set to ~0 to see all policies in SPD
164 */
165 define ipsec_spd_dump {
170 };
171 
172 /** \brief IPsec policy database response
173  @param context - sender context which was passed in the request
174  €param entry - The SPD entry.
175  @param bytes - byte count of packets matching this policy
176  @param packets - count of packets matching this policy
177 */
178 define ipsec_spd_details {
180  vl_api_ipsec_spd_entry_t entry;
181 };
182 
183 /*
184  * @brief Support cryptographic algorithms
185  */
187 {
200 };
201 
202 /*
203  * @brief Supported Integrity Algorithms
204  */
206 {
208  /* RFC2403 */
210  /* RFC2404 */
212  /* draft-ietf-ipsec-ciph-sha-256-00 */
214  /* RFC4868 */
216  /* RFC4868 */
218  /* RFC4868 */
220 };
221 
223 {
225  /* Enable extended sequence numbers */
227  /* Enable Anti-replay */
229  /* IPsec tunnel mode if non-zero, else transport mode */
231  /* IPsec tunnel mode is IPv6 if non-zero,
232  * else IPv4 tunnel only valid if is_tunnel is non-zero */
234  /* enable UDP encapsulation for NAT traversal */
236 };
237 
239 {
242 };
243 
244 typedef key
245 {
246  /* the length of the key */
247  u8 length;
248  /* The data for the key */
249  u8 data[128];
250 };
251 
252 /** \brief IPsec: Security Association Database entry
253  @param client_index - opaque cookie to identify the sender
254  @param context - sender context, to match reply w/ request
255  @param is_add - add SAD entry if non-zero, else delete
256  @param sad_id - sad id
257  @param spi - security parameter index
258  @param protocol - 0 = AH, 1 = ESP
259  @param crypto_algorithm - a supported crypto algorithm
260  @param crypto_key - crypto keying material
261  @param integrity_algorithm - one of the supported algorithms
262  @param integrity_key - integrity keying material
263  @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
264  @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
265  @param tx_table_id - the FIB id used for encapsulated packets
266  @param salt - for use with counter mode ciphers
267  */
268 typedef ipsec_sad_entry
269 {
270  u32 sad_id;
271 
273 
274  vl_api_ipsec_proto_t protocol;
275 
276  vl_api_ipsec_crypto_alg_t crypto_algorithm;
277  vl_api_key_t crypto_key;
278 
279  vl_api_ipsec_integ_alg_t integrity_algorithm;
280  vl_api_key_t integrity_key;
281 
282  vl_api_ipsec_sad_flags_t flags;
283 
284  vl_api_address_t tunnel_src;
285  vl_api_address_t tunnel_dst;
288 };
289 
290 /** \brief IPsec: Add/delete Security Association Database entry
291  @param client_index - opaque cookie to identify the sender
292  @param context - sender context, to match reply w/ request
293  @param entry - Entry to add or delete
294  */
295 define ipsec_sad_entry_add_del
296 {
300  vl_api_ipsec_sad_entry_t entry;
301 };
302 define ipsec_sad_entry_add_del_reply
303 {
307 };
308 
309 /** \brief Add or Update Protection for a tunnel with IPSEC
310 
311  Tunnel protection directly associates an SA with all packets
312  ingress and egress on the tunnel. This could also be achieved by
313  assigning an SPD to the tunnel, but that would incur an unnessccary
314  SPD entry lookup.
315 
316  For tunnels the ESP acts on the post-encapsulated packet. So if this
317  packet:
318  +---------+------+
319  | Payload | O-IP |
320  +---------+------+
321  where O-IP is the overlay IP addrees that was routed into the tunnel,
322  the resulting encapsulated packet will be:
323  +---------+------+------+
324  | Payload | O-IP | T-IP |
325  +---------+------+------+
326  where T-IP is the tunnel's src.dst IP addresses.
327  If the SAs used for protection are in transport mode then the ESP is
328  inserted before T-IP, i.e.:
329  +---------+------+-----+------+
330  | Payload | O-IP | ESP | T-IP |
331  +---------+------+-----+------+
332  If the SAs used for protection are in tunnel mode then another
333  encapsulation occurs, i.e.:
334  +---------+------+------+-----+------+
335  | Payload | O-IP | T-IP | ESP | C-IP |
336  +---------+------+------+-----+------+
337  where C-IP are the crypto endpoint IP addresses defined as the tunnel
338  endpoints in the SA.
339  The mode for the inbound and outbound SA must be the same.
340 
341  @param client_index - opaque cookie to identify the sender
342  @param context - sender context, to match reply w/ request
343  @param sw_id_index - Tunnel interface to protect
344  @param sa_in - The ID [set] of inbound SAs
345  @param sa_out - The ID of outbound SA
346 */
347 typedef ipsec_tunnel_protect
348 {
349  vl_api_interface_index_t sw_if_index;
353 };
354 
355 autoreply define ipsec_tunnel_protect_update
356 {
359 
360  vl_api_ipsec_tunnel_protect_t tunnel;
361 };
362 
363 autoreply define ipsec_tunnel_protect_del
364 {
367 
368  vl_api_interface_index_t sw_if_index;
369 };
370 
371 define ipsec_tunnel_protect_dump
372 {
375  vl_api_interface_index_t sw_if_index;
376 };
377 
378 define ipsec_tunnel_protect_details
379 {
381  vl_api_ipsec_tunnel_protect_t tun;
382 };
383 
384 /** \brief IPsec: Get SPD interfaces
385  @param client_index - opaque cookie to identify the sender
386  @param context - sender context, to match reply w/ request
387  @param spd_index - SPD index
388  @param spd_index_valid - if 1 spd_index is used to filter
389  spd_index's, if 0 no filtering is done
390 */
391 define ipsec_spd_interface_dump {
396 };
397 
398 /** \brief IPsec: SPD interface response
399  @param context - sender context which was passed in the request
400  @param spd_index - SPD index
401  @param sw_if_index - index of the interface
402 */
403 define ipsec_spd_interface_details {
407 };
408 
409 /** \brief Add or delete IPsec tunnel interface
410  @param client_index - opaque cookie to identify the sender
411  @param context - sender context, to match reply w/ request
412  @param is_add - add IPsec tunnel interface if nonzero, else delete
413  @param is_ip6 - tunnel v6 or v4
414  @param esn - enable extended sequence numbers if nonzero, else disable
415  @param anti_replay - enable anti replay check if nonzero, else disable
416  @param local_ip - local IP address
417  @param remote_ip - IP address of remote IPsec peer
418  @param local_spi - SPI of outbound IPsec SA
419  @param remote_spi - SPI of inbound IPsec SA
420  @param crypto_alg - encryption algorithm ID
421  @param local_crypto_key_len - length of local crypto key in bytes
422  @param local_crypto_key - crypto key for outbound IPsec SA
423  @param remote_crypto_key_len - length of remote crypto key in bytes
424  @param remote_crypto_key - crypto key for inbound IPsec SA
425  @param integ_alg - integrity algorithm ID
426  @param local_integ_key_len - length of local integrity key in bytes
427  @param local_integ_key - integrity key for outbound IPsec SA
428  @param remote_integ_key_len - length of remote integrity key in bytes
429  @param remote_integ_key - integrity key for inbound IPsec SA
430  @param renumber - intf display name uses a specified instance if != 0
431  @param show_instance - instance to display for intf if renumber is set
432  @param udp_encap - enable UDP encapsulation for NAT traversal
433  @param tx_table_id - the FIB id used after packet encap
434  @param salt - for use with counter mode ciphers
435 */
436 define ipsec_tunnel_if_add_del {
442  vl_api_address_t local_ip;
443  vl_api_address_t remote_ip;
448  u8 local_crypto_key[128];
450  u8 remote_crypto_key[128];
453  u8 local_integ_key[128];
455  u8 remote_integ_key[128];
461 };
462 
463 /** \brief Add/delete IPsec tunnel interface response
464  @param context - sender context, to match reply w/ request
465  @param retval - return status
466  @param sw_if_index - sw_if_index of new interface (for successful add)
467 */
468 define ipsec_tunnel_if_add_del_reply {
472 };
473 
474 /** \brief Dump IPsec security association
475  @param client_index - opaque cookie to identify the sender
476  @param context - sender context, to match reply w/ request
477  @param sa_id - optional ID of an SA to dump, if ~0 dump all SAs in SAD
478 */
479 define ipsec_sa_dump {
483 };
484 
485 /** \brief IPsec security association database response
486  @param context - sender context which was passed in the request
487  @param sa_id - SA ID, policy-based SAs >=0, tunnel interface SAs = 0
488  @param sw_if_index - sw_if_index of tunnel interface, policy-based SAs = ~0
489  @param spi - security parameter index
490  @param protocol - IPsec protocol (value from ipsec_protocol_t)
491  @param crypto_alg - crypto algorithm (value from ipsec_crypto_alg_t)
492  @param crypto_key_len - length of crypto_key in bytes
493  @param crypto_key - crypto keying material
494  @param integ_alg - integrity algorithm (value from ipsec_integ_alg_t)
495  @param integ_key_len - length of integ_key in bytes
496  @param integ_key - integrity keying material
497  @param use_esn - using extended sequence numbers when non-zero
498  @param use_anti_replay - using anti-replay window when non-zero
499  @param is_tunnel - IPsec tunnel mode when non-zero, else transport mode
500  @param is_tunnel_ipv6 - If using tunnel mode, endpoints are IPv6
501  @param tunnel_src_addr - Tunnel source address if using tunnel mode
502  @param tunnel_dst_addr - Tunnel destination address is using tunnel mode
503  @param salt - 4 byte salt
504  @param seq - current sequence number for outbound
505  @param seq_hi - high 32 bits of ESN for outbound
506  @param last_seq - highest sequence number received inbound
507  @param last_seq_hi - high 32 bits of highest ESN received inbound
508  @param replay_window - bit map of seq nums received relative to last_seq if using anti-replay
509  @param total_data_size - total bytes sent or received
510  @param udp_encap - 1 if UDP encap enabled, 0 otherwise
511 */
512 define ipsec_sa_details {
514  vl_api_ipsec_sad_entry_t entry;
515 
521 
523 };
524 
525 /** \brief Set new SA on IPsec interface
526  @param client_index - opaque cookie to identify the sender
527  @param context - sender context, to match reply w/ request
528  @param sw_if_index - index of tunnel interface
529  @param sa_id - ID of SA to use
530  @param is_outbound - 1 if outbound (local) SA, 0 if inbound (remote)
531 */
532 autoreply define ipsec_tunnel_if_set_sa {
538 };
539 
540 /** \brief Dump IPsec backends
541  @param client_index - opaque cookie to identify the sender
542  @param context - sender context, to match reply w/ request
543 */
544 define ipsec_backend_dump {
547 };
548 
549 /** \brief IPsec backend details
550  @param name - name of the backend
551  @param protocol - IPsec protocol (value from ipsec_protocol_t)
552  @param index - backend index
553  @param active - set to 1 if the backend is active, otherwise 0
554 */
555 define ipsec_backend_details {
557  u8 name[128];
558  vl_api_ipsec_proto_t protocol;
561 };
562 
563 /** \brief Select IPsec backend
564  @param client_index - opaque cookie to identify the sender
565  @param context - sender context, to match reply w/ request
566  @param protocol - IPsec protocol (value from ipsec_protocol_t)
567  @param index - backend index
568 */
569 autoreply define ipsec_select_backend {
572  vl_api_ipsec_proto_t protocol;
574 };
575 
576 /*
577  * Local Variables:
578  * eval: (c-set-style "gnu")
579  * End:
580  */
581 
u32 tx_table_id
Definition: ipsec.api:286
typedef ipsec_sad_entry
IPsec: Security Association Database entry.
Definition: ipsec.api:269
u8 n_sa_in
Definition: ipsec.api:351
unsigned long u64
Definition: types.h:89
u32 context
Definition: ipsec.api:304
vl_api_ipsec_proto_t protocol
Definition: ipsec.api:558
vl_api_address_t local_address_stop
Definition: ipsec.api:103
u16 local_port_stop
Definition: ipsec.api:108
vl_api_address_t local_address_start
Definition: ipsec.api:102
vl_api_ipsec_spd_action_t policy
Definition: ipsec.api:96
vl_api_ipsec_crypto_alg_t crypto_algorithm
Definition: ipsec.api:276
u8 data[128]
Definition: ipsec.api:249
vl_api_key_t integrity_key
Definition: ipsec.api:280
u8 is_add
Definition: ipsec.api:122
unsigned char u8
Definition: types.h:56
vl_api_interface_index_t sw_if_index
Definition: ipsec.api:375
vl_api_address_t remote_ip
Definition: ipsec.api:443
vl_api_interface_index_t sw_if_index
Definition: ipsec.api:368
typedef ipsec_tunnel_protect
Add or Update Protection for a tunnel with IPSEC.
Definition: ipsec.api:348
vl_api_key_t crypto_key
Definition: ipsec.api:277
vl_api_interface_index_t sw_if_index
Definition: gre.api:50
vl_api_address_t remote_address_start
Definition: ipsec.api:100
vl_api_address_t local_ip
Definition: ipsec.api:442
unsigned int u32
Definition: types.h:88
ipsec_spd_action
Definition: ipsec.api:58
u32 context
Definition: ipsec.api:134
vl_api_address_t remote_address_stop
Definition: ipsec.api:101
u32 sa_in[n_sa_in]
Definition: ipsec.api:352
u32 sa_out
Definition: ipsec.api:350
u32 sa_id
Definition: ipsec.api:95
vl_api_ipsec_tunnel_protect_t tun
Definition: ipsec.api:381
unsigned short u16
Definition: types.h:57
typedef ipsec_spd_entry
IPsec: Security Policy Database entry.
Definition: ipsec.api:90
vl_api_ipsec_integ_alg_t integrity_algorithm
Definition: ipsec.api:279
u16 remote_port_stop
Definition: ipsec.api:106
vl_api_ipsec_tunnel_protect_t tunnel
Definition: ipsec.api:360
vl_api_ipsec_sad_flags_t flags
Definition: ipsec.api:282
u8 name[64]
Definition: memclnt.api:152
i32 priority
Definition: ipsec.api:92
ipsec_proto
Definition: ipsec.api:238
u32 client_index
Definition: ipsec.api:297
vl_api_ipsec_sad_entry_t entry
Definition: ipsec.api:300
vl_api_ipsec_proto_t protocol
Definition: ipsec.api:572
u8 is_outbound
Definition: ipsec.api:93
ipsec_sad_flags
Definition: ipsec.api:222
vl_api_ipsec_sad_entry_t entry
Definition: ipsec.api:514
signed int i32
Definition: types.h:77
u32 spi
Definition: ipsec.api:272
option version
Definition: ipsec.api:17
u32 stat_index
Definition: ipsec.api:136
u32 client_index
Definition: ipsec.api:120
ipsec_crypto_alg
Definition: ipsec.api:186
vl_api_ipsec_spd_entry_t entry
Definition: ipsec.api:180
vl_api_ipsec_spd_entry_t entry
Definition: ipsec.api:123
vl_api_address_t tunnel_src
Definition: ipsec.api:284
ipsec_integ_alg
Definition: ipsec.api:205
u16 remote_port_start
Definition: ipsec.api:105
typedef key
Definition: ipsec.api:245
u8 is_add
Definition: ipsec.api:299
u32 context
Definition: ipsec.api:121
u32 salt
Definition: ipsec.api:287
i32 retval
Definition: ipsec.api:305
u16 local_port_start
Definition: ipsec.api:107
i32 retval
Definition: ipsec.api:135
vl_api_address_t tunnel_dst
Definition: ipsec.api:285
u8 protocol
Definition: ipsec.api:97
u32 context
Definition: ipsec.api:298
u32 stat_index
Definition: ipsec.api:306