path: root/src/vnet/ipsec/ipsec_types.api

/* Hey Emacs use -*- mode: C -*- */
/*
 * Copyright (c) 2015-2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

option version = "3.0.1";

import "vnet/ip/ip_types.api";
import "vnet/tunnel/tunnel_types.api";

/*
 * @brief Support cryptographic algorithms
 */
enum ipsec_crypto_alg
{
  IPSEC_API_CRYPTO_ALG_NONE = 0,
  IPSEC_API_CRYPTO_ALG_AES_CBC_128,
  IPSEC_API_CRYPTO_ALG_AES_CBC_192,
  IPSEC_API_CRYPTO_ALG_AES_CBC_256,
  IPSEC_API_CRYPTO_ALG_AES_CTR_128,
  IPSEC_API_CRYPTO_ALG_AES_CTR_192,
  IPSEC_API_CRYPTO_ALG_AES_CTR_256,
  IPSEC_API_CRYPTO_ALG_AES_GCM_128,
  IPSEC_API_CRYPTO_ALG_AES_GCM_192,
  IPSEC_API_CRYPTO_ALG_AES_GCM_256,
  IPSEC_API_CRYPTO_ALG_DES_CBC,
  IPSEC_API_CRYPTO_ALG_3DES_CBC,
  IPSEC_API_CRYPTO_ALG_CHACHA20_POLY1305 [backwards_compatible],
  IPSEC_API_CRYPTO_ALG_AES_NULL_GMAC_128 [backwards_compatible],
  IPSEC_API_CRYPTO_ALG_AES_NULL_GMAC_192 [backwards_compatible],
  IPSEC_API_CRYPTO_ALG_AES_NULL_GMAC_256 [backwards_compatible],
};

/*
 * @brief Supported Integrity Algorithms
 */
enum ipsec_integ_alg
{
  IPSEC_API_INTEG_ALG_NONE = 0,
  /* RFC2403 */
  IPSEC_API_INTEG_ALG_MD5_96,
  /* RFC2404 */
  IPSEC_API_INTEG_ALG_SHA1_96,
  /* draft-ietf-ipsec-ciph-sha-256-00 */
  IPSEC_API_INTEG_ALG_SHA_256_96,
  /* RFC4868 */
  IPSEC_API_INTEG_ALG_SHA_256_128,
  /* RFC4868 */
  IPSEC_API_INTEG_ALG_SHA_384_192,
  /* RFC4868 */
  IPSEC_API_INTEG_ALG_SHA_512_256,
};

enum ipsec_sad_flags
{
  IPSEC_API_SAD_FLAG_NONE = 0,
  /* Enable extended sequence numbers */
  IPSEC_API_SAD_FLAG_USE_ESN = 0x01,
  /* Enable Anti-replay */
  IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY = 0x02,
  /* IPsec tunnel mode if non-zero, else transport mode */
  IPSEC_API_SAD_FLAG_IS_TUNNEL = 0x04,
  /* IPsec tunnel mode is IPv6 if non-zero,
   *  else IPv4 tunnel only valid if is_tunnel is non-zero
   *  DEPRECATED - the user does not need to set this it is
   *               derived from the tunnel's address types.
   */
  IPSEC_API_SAD_FLAG_IS_TUNNEL_V6 = 0x08,
  /* enable UDP encapsulation for NAT traversal */
  IPSEC_API_SAD_FLAG_UDP_ENCAP = 0x10,
  /* IPsec SA is for inbound traffic */
  IPSEC_API_SAD_FLAG_IS_INBOUND = 0x40,
  /* IPsec SA uses an Async driver */
  IPSEC_API_SAD_FLAG_ASYNC = 0x80 [backwards_compatible],
};

enum ipsec_proto
{
  IPSEC_API_PROTO_ESP = 50,
  IPSEC_API_PROTO_AH = 51,
};

typedef key
{
  /* the length of the key */
  u8 length;
  /* The data for the key */
  u8 data[128];
};

enum ipsec_spd_action
{
  /* bypass - no IPsec processing */
  IPSEC_API_SPD_ACTION_BYPASS = 0,
  /* discard - discard packet with ICMP processing */
  IPSEC_API_SPD_ACTION_DISCARD,
  /* resolve - send request to control plane for SA resolving */
  IPSEC_API_SPD_ACTION_RESOLVE,
  /* protect - apply IPsec policy using following parameters */
  IPSEC_API_SPD_ACTION_PROTECT,
};

/** \brief IPsec: Security Policy Database entry

    See RFC 4301, 4.4.1.1 on how to match packet to selectors

    @param spd_id - SPD instance id (control plane allocated)
    @param priority - priority of SPD entry (non-unique value).  Used to order SPD matching - higher priorities match before lower
    @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
    @param remote_address_start - start of remote address range to match
    @param remote_address_stop - end of remote address range to match
    @param local_address_start - start of local address range to match
    @param local_address_stop - end of local address range to match
    @param protocol - protocol type to match [0 means any] otherwise IANA value
    @param remote_port_start - start of remote port range to match ...
    @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
    @param local_port_start - start of local port range to match ...
    @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
    @param policy - action to perform on match
    @param sa_id - SAD instance id (control plane allocated)
*/
typedef ipsec_spd_entry
{
  u32 spd_id;
  i32 priority;
  bool is_outbound;

  u32 sa_id;
  vl_api_ipsec_spd_action_t policy;
  /* Which protocol?? */
  u8 protocol;

  // Selector
  vl_api_address_t remote_address_start;
  vl_api_address_t remote_address_stop;
  vl_api_address_t local_address_start;
  vl_api_address_t local_address_stop;

  u16 remote_port_start;
  u16 remote_port_stop;
  u16 local_port_start;
  u16 local_port_stop;
};

/** \brief IPsec: Security Policy Database entry v2

    See RFC 4301, 4.4.1.1 on how to match packet to selectors

    @param spd_id - SPD instance id (control plane allocated)
    @param priority - priority of SPD entry (non-unique value).  Used to order SPD matching - higher priorities match before lower
    @param is_outbound - entry applies to outbound traffic if non-zero, otherwise applies to inbound traffic
    @param remote_address_start - start of remote address range to match
    @param remote_address_stop - end of remote address range to match
    @param local_address_start - start of local address range to match
    @param local_address_stop - end of local address range to match
    @param protocol - protocol type to match [255 means any] otherwise IANA value
    @param remote_port_start - start of remote port range to match ...
    @param remote_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
    @param local_port_start - start of local port range to match ...
    @param local_port_stop - end of remote port range to match [0 to 65535 means ANY, 65535 to 0 means OPAQUE]
    @param policy - action to perform on match
    @param sa_id - SAD instance id (control plane allocated)
*/
typedef ipsec_spd_entry_v2
{
  u32 spd_id;
  i32 priority;
  bool is_outbound;

  u32 sa_id;
  vl_api_ipsec_spd_action_t policy;
  u8 protocol;

  // Selector
  vl_api_address_t remote_address_start;
  vl_api_address_t remote_address_stop;
  vl_api_address_t local_address_start;
  vl_api_address_t local_address_stop;

  u16 remote_port_start;
  u16 remote_port_stop;
  u16 local_port_start;
  u16 local_port_stop;
};


/** \brief IPsec: Security Association Database entry
    @param sad_id - sad id
    @param spi - security parameter index
    @param protocol - 0 = AH, 1 = ESP
    @param crypto_algorithm - a supported crypto algorithm
    @param crypto_key - crypto keying material
    @param integrity_algorithm - one of the supported algorithms
    @param integrity_key - integrity keying material
    @param flags - SA flags (see ipsec_sad_flags above)
    @param tunnel_src_address - IPsec tunnel source address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
    @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero
    @param tx_table_id - the FIB id used for encapsulated packets
    @param salt - for use with counter mode ciphers
    @param udp_src_port - If using UDP Encapsulation, use this source port for
                          TX. It is ignored for RX.
    @param udp_dst_port - If using UDP Encapsulation, use this destination port
                          for TX. Expect traffic on this port for RX.
    @param tunnel_flags - Flags controlling the copying of encap/decap value
    @param dscp - Fixed DSCP vaule for tunnel encap
 */

typedef ipsec_sad_entry
{
  u32 sad_id;

  u32 spi;

  vl_api_ipsec_proto_t protocol;

  vl_api_ipsec_crypto_alg_t crypto_algorithm;
  vl_api_key_t crypto_key;

  vl_api_ipsec_integ_alg_t integrity_algorithm;
  vl_api_key_t integrity_key;

  vl_api_ipsec_sad_flags_t flags;

  vl_api_address_t tunnel_src;
  vl_api_address_t tunnel_dst;
  u32 tx_table_id;
  u32 salt;
  u16 udp_src_port [default=4500];
  u16 udp_dst_port [default=4500];
};

typedef ipsec_sad_entry_v2
{
  u32 sad_id;

  u32 spi;

  vl_api_ipsec_proto_t protocol;

  vl_api_ipsec_crypto_alg_t crypto_algorithm;
  vl_api_key_t crypto_key;

  vl_api_ipsec_integ_alg_t integrity_algorithm;
  vl_api_key_t integrity_key;

  vl_api_ipsec_sad_flags_t flags;

  vl_api_address_t tunnel_src;
  vl_api_address_t tunnel_dst;
  vl_api_tunnel_encap_decap_flags_t tunnel_flags;
  vl_api_ip_dscp_t dscp;
  u32 tx_table_id;
  u32 salt;
  u16 udp_src_port [default=4500];
  u16 udp_dst_port [default=4500];
};

typedef ipsec_sad_entry_v3
{
  u32 sad_id;
  u32 spi;

  vl_api_ipsec_proto_t protocol;

  vl_api_ipsec_crypto_alg_t crypto_algorithm;
  vl_api_key_t crypto_key;

  vl_api_ipsec_integ_alg_t integrity_algorithm;
  vl_api_key_t integrity_key;

  vl_api_ipsec_sad_flags_t flags;

  vl_api_tunnel_t tunnel;

  u32 salt;
  u16 udp_src_port [default=4500];
  u16 udp_dst_port [default=4500];
};

/** \brief IPsec: Security Association Database entry
    @param sad_id - sad id
    @param spi - security parameter index
    @param protocol - 0 = AH, 1 = ESP
    @param crypto_algorithm - a supported crypto algorithm
    @param crypto_key - crypto keying material
    @param integrity_algorithm - one of the supported algorithms
    @param integrity_key - integrity keying material
    @param flags - SA flags (see ipsec_sad_flags above)
    @param tunnel - tunnel description (see vnet/tunnel/tunnel_types.api)
    @param salt - for use with counter mode ciphers
    @param udp_src_port - If using UDP Encapsulation, use this source port for
                          TX. It is ignored for RX.
    @param udp_dst_port - If using UDP Encapsulation, use this destination port
                          for TX. Expect traffic on this port for RX.
    @param anti_replay_window_size - AR window size to use. The supplied value is round up to the nearest power of 2.
 */
typedef ipsec_sad_entry_v4
{
  u32 sad_id;
  u32 spi;

  vl_api_ipsec_proto_t protocol;

  vl_api_ipsec_crypto_alg_t crypto_algorithm;
  vl_api_key_t crypto_key;

  vl_api_ipsec_integ_alg_t integrity_algorithm;
  vl_api_key_t integrity_key;

  vl_api_ipsec_sad_flags_t flags;

  vl_api_tunnel_t tunnel;

  u32 salt;
  u16 udp_src_port [default=4500];
  u16 udp_dst_port [default=4500];

  u32 anti_replay_window_size [default=64];
};

/*
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */