aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/acl/acl.api
blob: d981338d38ceb705b9d6252894c034276307978a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
/* Hey Emacs use -*- mode: C -*- */
/*
 * Copyright (c) 2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/** \file
    This file defines the vpp control-plane API messages
    used to control the ACL plugin
*/


/** \brief Get the plugin version
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
*/

define acl_plugin_get_version
{
  u32 client_index;
  u32 context;
};

/** \brief Reply to get the plugin version
    @param context - returned sender context, to match reply w/ request
    @param major - Incremented every time a known breaking behavior change is introduced
    @param minor - Incremented with small changes, may be used to avoid buggy versions
*/

define acl_plugin_get_version_reply
{
  u32 context;
  u32 major;
  u32 minor;
};

/** \brief Access List Rule entry
    @param is_permit - deny (0), permit (1), or permit+reflect(2) action on this rule.
    @param is_ipv6   - IP addresses in this rule are IPv6 (1) or IPv4 (0)
    @param src_ip_addr - Source prefix value
    @param src_ip_prefix_len - Source prefix length
    @param dst_ip_addr - Destination prefix value
    @param dst_ip_prefix_len - Destination prefix length
    @param proto - L4 protocol (http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
    @param srcport_or_icmptype_first - beginning of source port or ICMP4/6 type range
    @param srcport_or_icmptype_last - end of source port or ICMP4/6 type range
    @param dstport_or_icmpcode_first - beginning of destination port or ICMP4/6 code range
    @param dstport_or_icmpcode_last - end of destination port or ICMP4/6 code range
    @param tcp_flags_mask - if proto==6, match masked TCP flags with this value
    @param tcp_flags_value - if proto==6, mask to AND the TCP flags in the packet with
*/

typeonly manual_print define acl_rule
{
  u8 is_permit;
  u8 is_ipv6;
  u8 src_ip_addr[16];
  u8 src_ip_prefix_len;
  u8 dst_ip_addr[16];
  u8 dst_ip_prefix_len;
/*
 * L4 protocol. IANA number. 1 = ICMP, 58 = ICMPv6, 6 = TCP, 17 = UDP.
 * 0 => ignore L4 and ignore the ports/tcpflags when matching.
 */
  u8 proto;
/*
 * If the L4 protocol is TCP or UDP, the below
 * hold ranges of ports, else if the L4 is ICMP/ICMPv6
 * they hold ranges of ICMP(v6) types/codes.
 *
 * Ranges are inclusive, i.e. to match "any" TCP/UDP port,
 * use first=0,last=65535. For ICMP(v6),
 * use first=0,last=255.
 */
  u16 srcport_or_icmptype_first;
  u16 srcport_or_icmptype_last;
  u16 dstport_or_icmpcode_first;
  u16 dstport_or_icmpcode_last;
/*
 * for proto = 6, this matches if the
 * TCP flags in the packet, ANDed with tcp_flags_mask,
 * is equal to tcp_flags_value.
 */
  u8 tcp_flags_mask;
  u8 tcp_flags_value;
};

/** \brief MACIP Access List Rule entry
    @param is_permit - deny (0), permit (1) action on this rule.
    @param is_ipv6   - IP addresses in this rule are IPv6 (1) or IPv4 (0)
    @param src_mac - match masked source MAC address against this value
    @param src_mac_mask - AND source MAC address with this value before matching
    @param src_ip_addr - Source prefix value
    @param src_ip_prefix_len - Source prefix length
*/

typeonly manual_print define macip_acl_rule
{
  u8 is_permit;
  u8 is_ipv6;
/*
 * The source mac of the packet ANDed with src_mac_mask.
 * The source ip[46] address in the packet is matched
 * against src_ip_addr, with src_ip_prefix_len set to 0.
 *
 * For better performance, minimize the number of
 * (src_mac_mask, src_ip_prefix_len) combinations
 * in a MACIP ACL.
 */
  u8 src_mac[6];
  u8 src_mac_mask[6];
  u8 src_ip_addr[16];
  u8 src_ip_prefix_len;
};

/** \brief Replace an existing ACL in-place or create a new ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - an existing ACL entry (0..0xfffffffe) to replace, or 0xffffffff to make new ACL
    @param tag - a string value stored along with the ACL, for descriptive purposes
    @param count - number of ACL rules
    @r - Rules for this access-list
*/

manual_print manual_endian define acl_add_replace
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 to add, existing ACL# to replace */
  u8 tag[64]; /* What gets in here gets out in the corresponding tag field when dumping the ACLs. */
  u32 count;
  vl_api_acl_rule_t r[count];
};

/** \brief Reply to add/replace ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of the updated or newly created ACL
    @param retval 0 - no error
*/

define acl_add_replace_reply
{
  u32 context;
  u32 acl_index;
  i32 retval;
};

/** \brief Delete an ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - ACL index to delete
*/

manual_print define acl_del
{
  u32 client_index;
  u32 context;
  u32 acl_index;
};

/** \brief Reply to delete the ACL
    @param context - returned sender context, to match reply w/ request
    @param retval 0 - no error
*/

define acl_del_reply
{
  u32 context;
  i32 retval;
};

/* acl_interface_add_del(_reply) to be deprecated in lieu of acl_interface_set_acl_list */
/** \brief Use acl_interface_set_acl_list instead
    Append/remove an ACL index to/from the list of ACLs checked for an interface
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param is_add - add or delete the ACL index from the list
    @param is_input - check the ACL on input (1) or output (0)
    @param sw_if_index - the interface to alter the list of ACLs on
    @param acl_index - index of ACL for the operation
*/

manual_print define acl_interface_add_del
{
  u32 client_index;
  u32 context;
  u8 is_add;
/*
 * is_input = 0 => ACL applied on interface egress
 * is_input = 1 => ACL applied on interface ingress
 */
  u8 is_input;
  u32 sw_if_index;
  u32 acl_index;
};

/** \brief Reply to alter the ACL list
    @param context - returned sender context, to match reply w/ request
    @param retval 0 - no error
*/

define acl_interface_add_del_reply
{
  u32 context;
  i32 retval;
};

/** \brief Set the vector of input/output ACLs checked for an interface
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - the interface to alter the list of ACLs on
    @param count - total number of ACL indices in the vector
    @param n_input - this many first elements correspond to input ACLs, the rest - output
    @param acls - vector of ACL indices
*/

manual_print define acl_interface_set_acl_list
{
  u32 client_index;
  u32 context;
  u32 sw_if_index;
  u8 count;
  u8 n_input; /* First n_input ACLs are set as a list of input ACLs, the rest are applied as output */
  u32 acls[count];
};

/** \brief Reply to set the ACL list on an interface
    @param context - returned sender context, to match reply w/ request
    @param retval 0 - no error
*/

define acl_interface_set_acl_list_reply
{
  u32 context;
  i32 retval;
};

/** \brief Dump the specific ACL contents or all of the ACLs' contents
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - ACL index to dump, ~0 to dump all ACLs
*/

define acl_dump
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 for all ACLs */
};

/** \brief Details about a single ACL contents
    @param context - returned sender context, to match reply w/ request
    @param acl_index - ACL index whose contents are being sent in this message
    @param tag - Descriptive tag value which was supplied at ACL creation
    @param count - Number of rules in this ACL
    @param r - Array of rules within this ACL
*/

manual_endian manual_print define acl_details
{
  u32 context;
  u32 acl_index;
  u8 tag[64]; /* Same blob that was supplied to us when creating the ACL, one hopes. */
  u32 count;
  vl_api_acl_rule_t r[count];
};

/** \brief Dump the list(s) of ACL applied to specific or all interfaces
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - interface to dump the ACL list for
*/

define acl_interface_list_dump
{
  u32 client_index;
  u32 context;
  u32 sw_if_index; /* ~0 for all interfaces */
};

/** \brief Details about a single ACL contents
    @param context - returned sender context, to match reply w/ request
    @param sw_if_index - interface for which the list of ACLs is applied
    @param count - total length of acl indices vector
    @param n_input - this many of indices in the beginning are input ACLs, the rest - output
    @param acls - the vector of ACL indices
*/

define acl_interface_list_details
{
  u32 context;
  u32 sw_if_index;
  u8 count;
  u8 n_input;
  u32 acls[count];
};

/** \brief Add a MACIP ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param tag - descriptive value for this MACIP ACL
    @param count - number of rules in this ACL
    @param r - vector of MACIP ACL rules
*/

manual_endian manual_print define macip_acl_add
{
  u32 client_index;
  u32 context;
  u8 tag[64];
  u32 count;
  vl_api_macip_acl_rule_t r[count];
};

/** \brief Reply to add MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of the newly created ACL
    @param retval 0 - no error
*/

define macip_acl_add_reply
{
  u32 context;
  u32 acl_index;
  i32 retval;
};

/** \brief Delete a MACIP ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - MACIP ACL index to delete
*/

manual_print define macip_acl_del
{
  u32 client_index;
  u32 context;
  u32 acl_index;
};

/** \brief Reply to delete the MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param retval 0 - no error
*/

define macip_acl_del_reply
{
  u32 context;
  i32 retval;
};

/** \brief Add or delete a MACIP ACL to/from interface
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param is_add - add (1) or delete (0) ACL from being used on an interface
    @param sw_if_index - interface to apply the action to
    @param acl_index - MACIP ACL index
*/

manual_print define macip_acl_interface_add_del
{
  u32 client_index;
  u32 context;
  u8 is_add;
  /* macip ACLs are always input */
  u32 sw_if_index;
  u32 acl_index;
};

/** \brief Reply to apply/unapply  the MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param retval 0 - no error
*/

define macip_acl_interface_add_del_reply
{
  u32 context;
  i32 retval;
};

/** \brief Dump one or all defined MACIP ACLs
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - MACIP ACL index or ~0 to dump all ACLs
*/

define macip_acl_dump
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 for all ACLs */
};

/** \brief Details about one MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of this MACIP ACL
    @param tag - descriptive tag which was supplied during the creation
    @param count - length of the vector of MACIP ACL rules
    @param r - rules comprising this ACL
*/

manual_endian manual_print define macip_acl_details
{
  u32 context;
  u32 acl_index;
  u8 tag[64];
  u32 count;
  vl_api_macip_acl_rule_t r[count];
};

/** \brief Get the vector of MACIP ACL IDs applied to the interfaces
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
*/

define macip_acl_interface_get
{
  u32 client_index;
  u32 context;
};

/** \brief Reply with the vector of MACIP ACLs by sw_if_index
    @param context - returned sender context, to match reply w/ request
    @param count - total number of elements in the vector
    @param acls - the vector of active MACACL indices per sw_if_index
*/

define macip_acl_interface_get_reply
{
  u32 context;
  u32 count;
  u32 acls[count];
};