aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/acl/acl.api
blob: 0c230c5fd5477b4b824a7572d67926a6c0d0e233 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
/* Hey Emacs use -*- mode: C -*- */
/*
 * Copyright (c) 2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/** \file
    This file defines the vpp control-plane API messages
    used to control the ACL plugin
*/

option version = "1.0.1";

/** \brief Get the plugin version
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
*/

define acl_plugin_get_version
{
  u32 client_index;
  u32 context;
};

/** \brief Reply to get the plugin version
    @param context - returned sender context, to match reply w/ request
    @param major - Incremented every time a known breaking behavior change is introduced
    @param minor - Incremented with small changes, may be used to avoid buggy versions
*/

define acl_plugin_get_version_reply
{
  u32 context;
  u32 major;
  u32 minor;
};

/** \brief Control ping from client to api server request
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
*/
define acl_plugin_control_ping
{
  u32 client_index;
  u32 context;
};

/** \brief Control ping from the client to the server response
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param retval - return code for the request
    @param vpe_pid - the pid of the vpe, returned by the server
*/
define acl_plugin_control_ping_reply
{
  u32 context;
  i32 retval;
  u32 client_index;
  u32 vpe_pid;
};

/** \brief Get Connection table max entries
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
*/

define acl_plugin_get_conn_table_max_entries
{
  u32 client_index;
  u32 context;
};

/** \brief Reply to get connection table max entries
    @param context - sender context, to match reply w/ request
    @param conn_table_max_entries - the value of maximum entries of connection table
*/
define acl_plugin_get_conn_table_max_entries_reply
{
  u32 context;
  u64 conn_table_max_entries;
};

/** \brief Access List Rule entry
    @param is_permit - deny (0), permit (1), or permit+reflect(2) action on this rule.
    @param is_ipv6   - IP addresses in this rule are IPv6 (1) or IPv4 (0)
    @param src_ip_addr - Source prefix value
    @param src_ip_prefix_len - Source prefix length
    @param dst_ip_addr - Destination prefix value
    @param dst_ip_prefix_len - Destination prefix length
    @param proto - L4 protocol (http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
    @param srcport_or_icmptype_first - beginning of source port or ICMP4/6 type range
    @param srcport_or_icmptype_last - end of source port or ICMP4/6 type range
    @param dstport_or_icmpcode_first - beginning of destination port or ICMP4/6 code range
    @param dstport_or_icmpcode_last - end of destination port or ICMP4/6 code range
    @param tcp_flags_mask - if proto==6, match masked TCP flags with this value
    @param tcp_flags_value - if proto==6, mask to AND the TCP flags in the packet with
*/

typeonly manual_print define acl_rule
{
  u8 is_permit;
  u8 is_ipv6;
  u8 src_ip_addr[16];
  u8 src_ip_prefix_len;
  u8 dst_ip_addr[16];
  u8 dst_ip_prefix_len;
/*
 * L4 protocol. IANA number. 1 = ICMP, 58 = ICMPv6, 6 = TCP, 17 = UDP.
 * 0 => ignore L4 and ignore the ports/tcpflags when matching.
 */
  u8 proto;
/*
 * If the L4 protocol is TCP or UDP, the below
 * hold ranges of ports, else if the L4 is ICMP/ICMPv6
 * they hold ranges of ICMP(v6) types/codes.
 *
 * Ranges are inclusive, i.e. to match "any" TCP/UDP port,
 * use first=0,last=65535. For ICMP(v6),
 * use first=0,last=255.
 */
  u16 srcport_or_icmptype_first;
  u16 srcport_or_icmptype_last;
  u16 dstport_or_icmpcode_first;
  u16 dstport_or_icmpcode_last;
/*
 * for proto = 6, this matches if the
 * TCP flags in the packet, ANDed with tcp_flags_mask,
 * is equal to tcp_flags_value.
 */
  u8 tcp_flags_mask;
  u8 tcp_flags_value;
};

/** \brief MACIP Access List Rule entry
    @param is_permit - deny (0), permit (1) action on this rule.
    @param is_ipv6   - IP addresses in this rule are IPv6 (1) or IPv4 (0)
    @param src_mac - match masked source MAC address against this value
    @param src_mac_mask - AND source MAC address with this value before matching
    @param src_ip_addr - Source prefix value
    @param src_ip_prefix_len - Source prefix length
*/

typeonly manual_print define macip_acl_rule
{
  u8 is_permit;
  u8 is_ipv6;
/*
 * The source mac of the packet ANDed with src_mac_mask.
 * The source ip[46] address in the packet is matched
 * against src_ip_addr, with src_ip_prefix_len set to 0.
 *
 * For better performance, minimize the number of
 * (src_mac_mask, src_ip_prefix_len) combinations
 * in a MACIP ACL.
 */
  u8 src_mac[6];
  u8 src_mac_mask[6];
  u8 src_ip_addr[16];
  u8 src_ip_prefix_len;
};

/** \brief Replace an existing ACL in-place or create a new ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - an existing ACL entry (0..0xfffffffe) to replace, or 0xffffffff to make new ACL
    @param tag - a string value stored along with the ACL, for descriptive purposes
    @param count - number of ACL rules
    @r - Rules for this access-list
*/

manual_print manual_endian define acl_add_replace
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 to add, existing ACL# to replace */
  u8 tag[64]; /* What gets in here gets out in the corresponding tag field when dumping the ACLs. */
  u32 count;
  vl_api_acl_rule_t r[count];
};

/** \brief Reply to add/replace ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of the updated or newly created ACL
    @param retval 0 - no error
*/

define acl_add_replace_reply
{
  u32 context;
  u32 acl_index;
  i32 retval;
};

/** \brief Delete an ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - ACL index to delete
*/

autoreply manual_print define acl_del
{
  u32 client_index;
  u32 context;
  u32 acl_index;
};

/* acl_interface_add_del(_reply) to be deprecated in lieu of acl_interface_set_acl_list */
/** \brief Use acl_interface_set_acl_list instead
    Append/remove an ACL index to/from the list of ACLs checked for an interface
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param is_add - add or delete the ACL index from the list
    @param is_input - check the ACL on input (1) or output (0)
    @param sw_if_index - the interface to alter the list of ACLs on
    @param acl_index - index of ACL for the operation
*/

autoreply manual_print define acl_interface_add_del
{
  u32 client_index;
  u32 context;
  u8 is_add;
/*
 * is_input = 0 => ACL applied on interface egress
 * is_input = 1 => ACL applied on interface ingress
 */
  u8 is_input;
  u32 sw_if_index;
  u32 acl_index;
};

/** \brief Set the vector of input/output ACLs checked for an interface
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - the interface to alter the list of ACLs on
    @param count - total number of ACL indices in the vector
    @param n_input - this many first elements correspond to input ACLs, the rest - output
    @param acls - vector of ACL indices
*/

autoreply manual_print define acl_interface_set_acl_list
{
  u32 client_index;
  u32 context;
  u32 sw_if_index;
  u8 count;
  u8 n_input; /* First n_input ACLs are set as a list of input ACLs, the rest are applied as output */
  u32 acls[count];
};

/** \brief Reply to set the ACL list on an interface
    @param context - returned sender context, to match reply w/ request
    @param retval 0 - no error
*/

/** \brief Dump the specific ACL contents or all of the ACLs' contents
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - ACL index to dump, ~0 to dump all ACLs
*/

define acl_dump
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 for all ACLs */
};

/** \brief Details about a single ACL contents
    @param context - returned sender context, to match reply w/ request
    @param acl_index - ACL index whose contents are being sent in this message
    @param tag - Descriptive tag value which was supplied at ACL creation
    @param count - Number of rules in this ACL
    @param r - Array of rules within this ACL
*/

manual_endian manual_print define acl_details
{
  u32 context;
  u32 acl_index;
  u8 tag[64]; /* Same blob that was supplied to us when creating the ACL, one hopes. */
  u32 count;
  vl_api_acl_rule_t r[count];
};

/** \brief Dump the list(s) of ACL applied to specific or all interfaces
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - interface to dump the ACL list for
*/

define acl_interface_list_dump
{
  u32 client_index;
  u32 context;
  u32 sw_if_index; /* ~0 for all interfaces */
};

/** \brief Details about a single ACL contents
    @param context - returned sender context, to match reply w/ request
    @param sw_if_index - interface for which the list of ACLs is applied
    @param count - total length of acl indices vector
    @param n_input - this many of indices in the beginning are input ACLs, the rest - output
    @param acls - the vector of ACL indices
*/

define acl_interface_list_details
{
  u32 context;
  u32 sw_if_index;
  u8 count;
  u8 n_input;
  u32 acls[count];
};

/** \brief Add a MACIP ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param tag - descriptive value for this MACIP ACL
    @param count - number of rules in this MACIP ACL
    @param r - vector of MACIP ACL rules
*/

manual_endian manual_print define macip_acl_add
{
  u32 client_index;
  u32 context;
  u8 tag[64];
  u32 count;
  vl_api_macip_acl_rule_t r[count];
};

/** \brief Reply to add MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of the newly created MACIP ACL
    @param retval 0 - no error
*/

define macip_acl_add_reply
{
  u32 context;
  u32 acl_index;
  i32 retval;
};

/** \brief Add/Replace a MACIP ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - an existing MACIP ACL entry (0..0xfffffffe) to replace, or 0xffffffff to make new MACIP ACL
    @param tag - descriptive value for this MACIP ACL
    @param count - number of rules in this MACIP ACL
    @param r - vector of MACIP ACL rules
*/

manual_endian manual_print define macip_acl_add_replace
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 to add, existing MACIP ACL# to replace */
  u8 tag[64];
  u32 count;
  vl_api_macip_acl_rule_t r[count];
};

/** \brief Reply to add/replace MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of the newly created MACIP ACL
    @param retval 0 - no error
*/

define macip_acl_add_replace_reply
{
  u32 context;
  u32 acl_index;
  i32 retval;
};

/** \brief Delete a MACIP ACL
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - MACIP ACL index to delete
*/

autoreply manual_print define macip_acl_del
{
  u32 client_index;
  u32 context;
  u32 acl_index;
};

/** \brief Add or delete a MACIP ACL to/from interface
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param is_add - add (1) or delete (0) MACIP ACL from being used on an interface
    @param sw_if_index - interface to apply the action to
    @param acl_index - MACIP ACL index
*/

autoreply manual_print define macip_acl_interface_add_del
{
  u32 client_index;
  u32 context;
  u8 is_add;
  /* MACIP ACLs are always input */
  u32 sw_if_index;
  u32 acl_index;
};

/** \brief Dump one or all defined MACIP ACLs
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param acl_index - MACIP ACL index or ~0 to dump all MACIP ACLs
*/

define macip_acl_dump
{
  u32 client_index;
  u32 context;
  u32 acl_index; /* ~0 for all ACLs */
};

/** \brief Details about one MACIP ACL
    @param context - returned sender context, to match reply w/ request
    @param acl_index - index of this MACIP ACL
    @param tag - descriptive tag which was supplied during the creation
    @param count - length of the vector of MACIP ACL rules
    @param r - rules comprising this MACIP ACL
*/

manual_endian manual_print define macip_acl_details
{
  u32 context;
  u32 acl_index;
  u8 tag[64];
  u32 count;
  vl_api_macip_acl_rule_t r[count];
};

/** \brief Get the vector of MACIP ACL IDs applied to the interfaces
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
*/

define macip_acl_interface_get
{
  u32 client_index;
  u32 context;
};

/** \brief Reply with the vector of MACIP ACLs by sw_if_index
    @param context - returned sender context, to match reply w/ request
    @param count - total number of elements in the vector
    @param acls - the vector of active MACIP ACL indices per sw_if_index
*/

define macip_acl_interface_get_reply
{
  u32 context;
  u32 count;
  u32 acls[count];
};

/** \brief Dump the list(s) of MACIP ACLs applied to specific or all interfaces
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - interface to dump the MACIP ACL list for
*/

define macip_acl_interface_list_dump
{
  u32 client_index;
  u32 context;
  u32 sw_if_index; /* ~0 for all interfaces */
};

/** \brief Details about a single MACIP ACL contents
    @param context - returned sender context, to match reply w/ request
    @param sw_if_index - interface for which the list of MACIP ACLs is applied
    @param count - total length of acl indices vector
    @param acls - the vector of MACIP ACL indices
*/

define macip_acl_interface_list_details
{
  u32 context;
  u32 sw_if_index;
  u8 count;
  u32 acls[count];
};

/** \brief Set the ethertype whitelists on an interface. Takes effect when applying ACLs on the interface, so must be given prior.
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - the interface to alter the list of ACLs on
    @param count - total number of whitelisted ethertypes in the vector
    @param n_input - this many first elements correspond to input whitelisted ethertypes, the rest - output
    @param whitelist - vector of whitelisted ethertypes
*/

autoreply manual_print define acl_interface_set_etype_whitelist
{
  u32 client_index;
  u32 context;
  u32 sw_if_index;
  u8 count; /* Total number of ethertypes in the whitelist */
  u8 n_input; /* first n_input ethertypes are input, the rest - output */
  u16 whitelist[count];
};

/** \brief Dump the list(s) of Ethertype whitelists applied to specific or all interfaces
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param sw_if_index - interface to dump the ethertype whitelist for
*/

define acl_interface_etype_whitelist_dump
{
  u32 client_index;
  u32 context;
  u32 sw_if_index; /* ~0 for all interfaces */
};

/** \brief Details about ethertype whitelist on a single interface
    @param context - returned sender context, to match reply w/ request
    @param sw_if_index - interface for which the list of MACIP ACLs is applied
    @param count - total number of whitelisted ethertypes in the vector
    @param n_input - this many first elements correspond to input whitelisted ethertypes, the rest - output
    @param whitelist - vector of whitelisted ethertypes
*/

define acl_interface_etype_whitelist_details
{
  u32 context;
  u32 sw_if_index;
  u8 count;
  u8 n_input; /* first n_input ethertypes are input, the rest - output */
  u16 whitelist[count];
};

/** \brief Enable or disable incrementing ACL counters in stats segment by interface processing
    @param client_index - opaque cookie to identify the sender
    @param context - sender context, to match reply w/ request
    @param enable - whether to enable or disable incrementing the counters
*/

autoreply define acl_stats_intf_counters_enable
{
  u32 client_index;
  u32 context;
  bool enable;
};