/* Hey Emacs use -*- mode: C -*- */ /* * Copyright (c) 2015-2020 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ option version = "1.0.1"; import "plugins/ikev2/ikev2_types.api"; import "vnet/ip/ip_types.api"; import "vnet/interface_types.api"; /** \brief Get the plugin version @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request */ define ikev2_plugin_get_version { u32 client_index; u32 context; }; /** \brief Reply to get the plugin version @param context - returned sender context, to match reply w/ request @param major - Incremented every time a known breaking behavior change is introduced @param minor - Incremented with small changes, may be used to avoid buggy versions */ define ikev2_plugin_get_version_reply { u32 context; u32 major; u32 minor; }; /** \brief Dump all profiles @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request */ define ikev2_profile_dump { u32 client_index; u32 context; option status="in_progress"; }; /** \brief Details about all profiles @param context - returned sender context, to match reply w/ request @param profile - profile element with encapsulated attributes */ define ikev2_profile_details { u32 context; vl_api_ikev2_profile_t profile; option status="in_progress"; }; /** \brief Dump all SAs @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request */ define ikev2_sa_dump { u32 client_index; u32 context; option status = "in_progress"; }; /** \brief Details about IKE SA @param context - sender context, to match reply w/ request @param retval - return code @param sa - SA data */ define ikev2_sa_details { u32 context; i32 retval; vl_api_ikev2_sa_t sa; option status = "in_progress"; }; /** \brief Dump child SA of specific SA @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param sa_index - index of specific sa */ define ikev2_child_sa_dump { u32 client_index; u32 context; u32 sa_index; option vat_help = "sa_index <index>"; option status = "in_progress"; }; /** \brief Child SA details @param context - sender context, to match reply w/ request @param retval - return code @param child_sa - child SA data */ define ikev2_child_sa_details { u32 context; i32 retval; vl_api_ikev2_child_sa_t child_sa; option status = "in_progress"; }; /** \brief get specific nonce @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param is_initiator - specify type initiator|responder of nonce @param sa_index - index of specific sa */ define ikev2_nonce_get { u32 client_index; u32 context; bool is_initiator; u32 sa_index; option vat_help = "initiator|responder sa_index <index>"; option status = "in_progress"; }; /** \brief reply on specific nonce @param context - sender context, to match reply w/ request @param retval - return code @param data_len - nonce length @param nonce - nonce data */ define ikev2_nonce_get_reply { u32 context; i32 retval; u32 data_len; u8 nonce[data_len]; option status = "in_progress"; }; /** \brief dump traffic selectors @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param is_initiator - specify type initiator|responder of nonce @param sa_index - index of specific sa @param child_sa_index - index of specific sa child of specific sa */ define ikev2_traffic_selector_dump { u32 client_index; u32 context; bool is_initiator; u32 sa_index; u32 child_sa_index; option vat_help = "initiator|responder sa_index <index> child_sa_index <index>"; option status = "in_progress"; }; /** \brief details on specific traffic selector @param context - sender context, to match reply w/ request @param retval - return code @param ts - traffic selector data */ define ikev2_traffic_selector_details { u32 context; i32 retval; vl_api_ikev2_ts_t ts; option status = "in_progress"; }; /** \brief IKEv2: Add/delete profile @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param is_add - Add IKEv2 profile if non-zero, else delete */ autoreply define ikev2_profile_add_del { u32 client_index; u32 context; string name[64]; bool is_add; option vat_help = "name <profile_name> [del]"; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 profile authentication method @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param auth_method - IKEv2 authentication method (shared-key-mic/rsa-sig) @param is_hex - Authentication data in hex format if non-zero, else string @param data_len - Authentication data length @param data - Authentication data (for rsa-sig cert file path) */ autoreply define ikev2_profile_set_auth { u32 client_index; u32 context; string name[64]; u8 auth_method; bool is_hex; u32 data_len; u8 data[data_len]; option vat_help = "name <profile_name> auth_method <method> (auth_data 0x<data> | auth_data <data>)"; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 profile local/remote identification @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param is_local - Identification is local if non-zero, else remote @param id_type - Identification type @param data_len - Identification data length @param data - Identification data */ autoreply define ikev2_profile_set_id { u32 client_index; u32 context; string name[64]; bool is_local; u8 id_type; u32 data_len; u8 data[data_len]; option vat_help = "name <profile_name> id_type <type> (id_data 0x<data> | id_data <data>) (local|remote)"; option status="in_progress"; }; /** \brief IKEv2: Disable NAT traversal @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name */ autoreply define ikev2_profile_disable_natt { u32 client_index; u32 context; string name[64]; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 profile traffic selector parameters @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param ts - traffic selector data */ autoreply define ikev2_profile_set_ts { u32 client_index; u32 context; string name[64]; vl_api_ikev2_ts_t ts; option vat_help = "name <profile_name> protocol <proto> start_port <port> end_port <port> start_addr <ip> end_addr <ip> (local|remote)"; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 local RSA private key @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param key_file - Key file absolute path */ autoreply define ikev2_set_local_key { u32 client_index; u32 context; string key_file[256]; option vat_help = "file <absolute_file_path>"; option status="in_progress"; }; /** \brief IKEv2: Set the tunnel interface which will be protected by IKE If this API is not called, a new tunnel will be created @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param sw_if_index - Of an existing tunnel */ autoreply define ikev2_set_tunnel_interface { u32 client_index; u32 context; string name[64]; vl_api_interface_index_t sw_if_index; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 responder interface and IP address @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param responder - responder data */ autoreply define ikev2_set_responder { u32 client_index; u32 context; string name[64]; vl_api_ikev2_responder_t responder; option vat_help = "<profile_name> interface <interface> address <addr>"; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296) @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param tr - IKE transforms */ autoreply define ikev2_set_ike_transforms { u32 client_index; u32 context; string name[64]; vl_api_ikev2_ike_transforms_t tr; option vat_help = "<profile_name> <crypto alg> <key size> <integrity alg> <DH group>"; option status="in_progress"; }; /** \brief IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296) @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param tr - ESP transforms */ autoreply define ikev2_set_esp_transforms { u32 client_index; u32 context; string name[64]; vl_api_ikev2_esp_transforms_t tr; option vat_help = "<profile_name> <crypto alg> <key size> <integrity alg>"; option status="in_progress"; }; /** \brief IKEv2: Set Child SA lifetime, limited by time and/or data @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name @param lifetime - SA maximum life time in seconds (0 to disable) @param lifetime_jitter - Jitter added to prevent simultaneous rekeying @param handover - Hand over time @param lifetime_maxdata - SA maximum life time in bytes (0 to disable) */ autoreply define ikev2_set_sa_lifetime { u32 client_index; u32 context; string name[64]; u64 lifetime; u32 lifetime_jitter; u32 handover; u64 lifetime_maxdata; option vat_help = "<profile_name> <seconds> <jitter> <handover> <max bytes>"; option status="in_progress"; }; /** \brief IKEv2: Initiate the SA_INIT exchange @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name */ autoreply define ikev2_initiate_sa_init { u32 client_index; u32 context; string name[64]; option vat_help = "<profile_name>"; option status="in_progress"; }; /** \brief IKEv2: Initiate the delete IKE SA exchange @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param ispi - IKE SA initiator SPI */ autoreply define ikev2_initiate_del_ike_sa { u32 client_index; u32 context; u64 ispi; option vat_help = "<ispi>"; option status="in_progress"; }; /** \brief IKEv2: Initiate the delete Child SA exchange @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param ispi - Child SA initiator SPI */ autoreply define ikev2_initiate_del_child_sa { u32 client_index; u32 context; u32 ispi; option vat_help = "<ispi>"; option status="in_progress"; }; /** \brief IKEv2: Initiate the rekey Child SA exchange @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param ispi - Child SA initiator SPI */ autoreply define ikev2_initiate_rekey_child_sa { u32 client_index; u32 context; u32 ispi; option vat_help = "<ispi>"; option status="in_progress"; }; /** \brief IKEv2: Set UDP encapsulation @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param name - IKEv2 profile name */ autoreply define ikev2_profile_set_udp_encap { u32 client_index; u32 context; string name[64]; option status="in_progress"; }; /** \brief IKEv2: Set/unset custom ipsec-over-udp port @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param is_set - whether set or unset custom port @param port - port number @param name - IKEv2 profile name */ autoreply define ikev2_profile_set_ipsec_udp_port { u32 client_index; u32 context; u8 is_set; u16 port; string name[64]; option status="in_progress"; }; /** \brief IKEv2: Set liveness parameters @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @param period - how often is liveness check performed @param max_retries - max retries for liveness check */ autoreply define ikev2_profile_set_liveness { u32 client_index; u32 context; u32 period; u32 max_retries; option status="in_progress"; }; /* * Local Variables: * eval: (c-set-style "gnu") * End: */