go.ligato.io/vpp-agent/v3@v3.5.0/proto/ligato/vpp/ipsec/ipsec.proto

syntax = "proto3";

package ligato.vpp.ipsec;

option go_package = "go.ligato.io/vpp-agent/v3/proto/ligato/vpp/ipsec;vpp_ipsec";

import "ligato/annotations.proto";

/* Cryptographic algorithm for encryption */
enum CryptoAlg { // vpp/src/vnet/ipsec/ipsec_sa.h:22
    NONE_CRYPTO = 0;
    AES_CBC_128 = 1;
    AES_CBC_192 = 2;
    AES_CBC_256 = 3;
    AES_CTR_128 = 4;
    AES_CTR_192 = 5;
    AES_CTR_256 = 6;
    AES_GCM_128 = 7;
    AES_GCM_192 = 8;
    AES_GCM_256 = 9;
    DES_CBC = 10;
    DES3_CBC = 11;  // 3DES_CBC
}

/* Cryptographic algorithm for authentication */
enum IntegAlg { // vpp/src/vnet/ipsec/ipsec_sa.h:44
    NONE_INTEG = 0;
    MD5_96 = 1;         /* RFC2403 */
    SHA1_96 = 2;        /* RFC2404 */
    SHA_256_96 = 3;     /* draft-ietf-ipsec-ciph-sha-256-00 */
    SHA_256_128 = 4;    /* RFC4868 */
    SHA_384_192 = 5;    /* RFC4868 */
    SHA_512_256 = 6;    /* RFC4868 */
}

/* Security Policy Database (SPD) */
message SecurityPolicyDatabase {
    uint32 index = 1;                           /* Numerical security policy database index, serves as a unique identifier */

    message Interface {
        string name = 1;                        /* Name of the related interface */
    }
    repeated Interface interfaces = 2;          /* List of interfaces belonging to this SPD */

    message PolicyEntry {
        uint32 sa_index = 1;                    /* Security association index */

        int32 priority = 2;
        bool is_outbound = 3;

        string remote_addr_start = 4  [(ligato_options).type = IP];
        string remote_addr_stop = 5  [(ligato_options).type = IP];
        string local_addr_start = 6  [(ligato_options).type = IP];
        string local_addr_stop = 7  [(ligato_options).type = IP];

        uint32 protocol = 8;

        uint32 remote_port_start = 9  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
        uint32 remote_port_stop = 10  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
        uint32 local_port_start = 11  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
        uint32 local_port_stop = 12  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];

        enum Action {
            BYPASS = 0;
            DISCARD = 1;
            RESOLVE = 2;                        /* Note: this particular action is unused in VPP */
            PROTECT = 3;
        }
        Action action = 13;
    }
    // List of policy entries belonging to this SPD.
    // Deprecated and actually trying to use this will return an error.
    // Use separate model for Security Policy (SP) defined below.
    repeated PolicyEntry policy_entries = 3 [deprecated=true];
}

message SecurityPolicy {
    uint32 spd_index = 1;                   /* Security policy database index */
    uint32 sa_index = 2;                    /* Security association index */

    int32 priority = 3;
    bool is_outbound = 4;

    string remote_addr_start = 5  [(ligato_options).type = IP];
    string remote_addr_stop = 6  [(ligato_options).type = IP];
    string local_addr_start = 7  [(ligato_options).type = IP];
    string local_addr_stop = 8  [(ligato_options).type = IP];

    uint32 protocol = 9;

    uint32 remote_port_start = 10  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
    uint32 remote_port_stop = 11  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
    uint32 local_port_start = 12  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
    uint32 local_port_stop = 13  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];

    enum Action {
        BYPASS = 0;
        DISCARD = 1;
        RESOLVE = 2;                        /* Note: this particular action is unused in VPP */
        PROTECT = 3;
    }
    Action action = 14;
}

/* Security Association (SA) */
message SecurityAssociation {
    uint32 index = 1;               /* Numerical security association index, serves as a unique identifier */
    uint32 spi = 2;                 /* Security parameter index */

    enum IPSecProtocol {
        AH = 0;                     /* Authentication Header, provides a mechanism for authentication only */
        ESP = 1;                    /* Encapsulating Security Payload is for data confidentiality and authentication */
    }
    IPSecProtocol protocol = 3;

    CryptoAlg crypto_alg = 4;       /* Cryptographic algorithm for encryption */
    string crypto_key = 5;
    uint32 crypto_salt = 15;

    IntegAlg integ_alg = 6;         /* Cryptographic algorithm for authentication */
    string integ_key = 7;

    bool use_esn = 8;               /* Use extended sequence number */
    bool use_anti_replay = 9;       /* Use anti replay */

    string tunnel_src_addr = 10  [(ligato_options).type = IP];
    string tunnel_dst_addr = 11  [(ligato_options).type = IP];

    bool enable_udp_encap = 12;     /* Enable UDP encapsulation for NAT traversal */

    uint32 tunnel_src_port = 13  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
    uint32 tunnel_dst_port = 14  [(ligato_options).int_range = {minimum: 0 maximum: 65535}];
}

// TunnelProtection allows enabling IPSec tunnel protection on an existing interface
// (only IPIP tunnel interfaces are currently supported)
message TunnelProtection {
    // Name of the interface to be protected with IPSec.
    string interface = 1;

    // Outbound security associations identified by SA index.
    repeated uint32 sa_out = 2;

    // Inbound security associations identified by SA index.
    repeated uint32 sa_in = 3;

    // (Optional) Next hop IP address, used for multipoint tunnels.
    string next_hop_addr = 4  [(ligato_options).type = IP];
}