FD.io VPP  v19.08.1-401-g8e4ed521a
Vector Packet Processing
ipsec_cli.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/fib/fib.h>
23 
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/ipsec_tun.h>
26 
27 static clib_error_t *
29  unformat_input_t * input,
30  vlib_cli_command_t * cmd)
31 {
32  unformat_input_t _line_input, *line_input = &_line_input;
33  ipsec_main_t *im = &ipsec_main;
34  u32 sw_if_index = (u32) ~ 0;
35  u32 spd_id;
36  int is_add = 1;
37  clib_error_t *error = NULL;
38 
39  if (!unformat_user (input, unformat_line_input, line_input))
40  return 0;
41 
42  if (unformat
43  (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main,
44  &sw_if_index, &spd_id))
45  ;
46  else if (unformat (line_input, "del"))
47  is_add = 0;
48  else
49  {
50  error = clib_error_return (0, "parse error: '%U'",
51  format_unformat_error, line_input);
52  goto done;
53  }
54 
55  ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
56 
57 done:
58  unformat_free (line_input);
59 
60  return error;
61 }
62 
63 /* *INDENT-OFF* */
64 VLIB_CLI_COMMAND (set_interface_spd_command, static) = {
65  .path = "set interface ipsec spd",
66  .short_help =
67  "set interface ipsec spd <int> <id>",
68  .function = set_interface_spd_command_fn,
69 };
70 /* *INDENT-ON* */
71 
72 static clib_error_t *
74  unformat_input_t * input,
75  vlib_cli_command_t * cmd)
76 {
77  unformat_input_t _line_input, *line_input = &_line_input;
78  ip46_address_t tun_src = { }, tun_dst =
79  {
80  };
81  ipsec_crypto_alg_t crypto_alg;
82  ipsec_integ_alg_t integ_alg;
85  clib_error_t *error;
86  ipsec_key_t ck = { 0 };
87  ipsec_key_t ik = { 0 };
88  u32 id, spi, salt;
89  int is_add, rv;
90 
91  error = NULL;
92  is_add = 0;
93  flags = IPSEC_SA_FLAG_NONE;
94  proto = IPSEC_PROTOCOL_ESP;
95  integ_alg = IPSEC_INTEG_ALG_NONE;
96  crypto_alg = IPSEC_CRYPTO_ALG_NONE;
97 
98  if (!unformat_user (input, unformat_line_input, line_input))
99  return 0;
100 
101  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
102  {
103  if (unformat (line_input, "add %u", &id))
104  is_add = 1;
105  else if (unformat (line_input, "del %u", &id))
106  is_add = 0;
107  else if (unformat (line_input, "spi %u", &spi))
108  ;
109  else if (unformat (line_input, "salt 0x%x", &salt))
110  ;
111  else if (unformat (line_input, "esp"))
112  proto = IPSEC_PROTOCOL_ESP;
113  else if (unformat (line_input, "ah"))
114  proto = IPSEC_PROTOCOL_AH;
115  else if (unformat (line_input, "crypto-key %U",
116  unformat_ipsec_key, &ck))
117  ;
118  else if (unformat (line_input, "crypto-alg %U",
119  unformat_ipsec_crypto_alg, &crypto_alg))
120  ;
121  else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik))
122  ;
123  else if (unformat (line_input, "integ-alg %U",
124  unformat_ipsec_integ_alg, &integ_alg))
125  ;
126  else if (unformat (line_input, "tunnel-src %U",
128  {
129  flags |= IPSEC_SA_FLAG_IS_TUNNEL;
130  if (!ip46_address_is_ip4 (&tun_src))
131  flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
132  }
133  else if (unformat (line_input, "tunnel-dst %U",
135  ;
136  else if (unformat (line_input, "udp-encap"))
137  flags |= IPSEC_SA_FLAG_UDP_ENCAP;
138  else
139  {
140  error = clib_error_return (0, "parse error: '%U'",
141  format_unformat_error, line_input);
142  goto done;
143  }
144  }
145 
146  if (is_add)
147  rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
148  &ck, integ_alg, &ik, flags,
149  0, clib_host_to_net_u32 (salt),
150  &tun_src, &tun_dst, NULL);
151  else
152  rv = ipsec_sa_unlock_id (id);
153 
154  if (rv)
155  error = clib_error_return (0, "failed");
156 
157 done:
158  unformat_free (line_input);
159 
160  return error;
161 }
162 
163 /* *INDENT-OFF* */
164 VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = {
165  .path = "ipsec sa",
166  .short_help =
167  "ipsec sa [add|del]",
168  .function = ipsec_sa_add_del_command_fn,
169 };
170 /* *INDENT-ON* */
171 
172 static clib_error_t *
174  unformat_input_t * input,
175  vlib_cli_command_t * cmd)
176 {
177  unformat_input_t _line_input, *line_input = &_line_input;
178  u32 spd_id = ~0;
179  int is_add = ~0;
180  clib_error_t *error = NULL;
181 
182  if (!unformat_user (input, unformat_line_input, line_input))
183  return 0;
184 
185  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
186  {
187  if (unformat (line_input, "add"))
188  is_add = 1;
189  else if (unformat (line_input, "del"))
190  is_add = 0;
191  else if (unformat (line_input, "%u", &spd_id))
192  ;
193  else
194  {
195  error = clib_error_return (0, "parse error: '%U'",
196  format_unformat_error, line_input);
197  goto done;
198  }
199  }
200 
201  if (spd_id == ~0)
202  {
203  error = clib_error_return (0, "please specify SPD ID");
204  goto done;
205  }
206 
207  ipsec_add_del_spd (vm, spd_id, is_add);
208 
209 done:
210  unformat_free (line_input);
211 
212  return error;
213 }
214 
215 /* *INDENT-OFF* */
216 VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = {
217  .path = "ipsec spd",
218  .short_help =
219  "ipsec spd [add|del] <id>",
220  .function = ipsec_spd_add_del_command_fn,
221 };
222 /* *INDENT-ON* */
223 
224 
225 static clib_error_t *
227  unformat_input_t * input,
228  vlib_cli_command_t * cmd)
229 {
230  unformat_input_t _line_input, *line_input = &_line_input;
231  ipsec_policy_t p;
232  int rv, is_add = 0;
233  u32 tmp, tmp2, stat_index;
234  clib_error_t *error = NULL;
236 
237  clib_memset (&p, 0, sizeof (p));
238  p.lport.stop = p.rport.stop = ~0;
239  is_outbound = 0;
240 
241  if (!unformat_user (input, unformat_line_input, line_input))
242  return 0;
243 
244  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
245  {
246  if (unformat (line_input, "add"))
247  is_add = 1;
248  else if (unformat (line_input, "del"))
249  is_add = 0;
250  else if (unformat (line_input, "spd %u", &p.id))
251  ;
252  else if (unformat (line_input, "inbound"))
253  is_outbound = 0;
254  else if (unformat (line_input, "outbound"))
255  is_outbound = 1;
256  else if (unformat (line_input, "priority %d", &p.priority))
257  ;
258  else if (unformat (line_input, "protocol %u", &tmp))
259  p.protocol = (u8) tmp;
260  else
261  if (unformat
262  (line_input, "action %U", unformat_ipsec_policy_action,
263  &p.policy))
264  {
265  if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
266  {
267  error = clib_error_return (0, "unsupported action: 'resolve'");
268  goto done;
269  }
270  }
271  else if (unformat (line_input, "sa %u", &p.sa_id))
272  ;
273  else if (unformat (line_input, "local-ip-range %U - %U",
276  ;
277  else if (unformat (line_input, "remote-ip-range %U - %U",
280  ;
281  else if (unformat (line_input, "local-ip-range %U - %U",
284  {
285  p.is_ipv6 = 1;
286  }
287  else if (unformat (line_input, "remote-ip-range %U - %U",
290  {
291  p.is_ipv6 = 1;
292  }
293  else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2))
294  {
295  p.lport.start = tmp;
296  p.lport.stop = tmp2;
297  }
298  else
299  if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2))
300  {
301  p.rport.start = tmp;
302  p.rport.stop = tmp2;
303  }
304  else
305  {
306  error = clib_error_return (0, "parse error: '%U'",
307  format_unformat_error, line_input);
308  goto done;
309  }
310  }
311 
312  rv = ipsec_policy_mk_type (is_outbound, p.is_ipv6, p.policy, &p.type);
313 
314  if (rv)
315  {
316  error = clib_error_return (0, "unsupported policy type for:",
317  " outboud:%s %s action:%U",
318  (is_outbound ? "yes" : "no"),
319  (p.is_ipv6 ? "IPv4" : "IPv6"),
321  goto done;
322  }
323 
324  rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index);
325 
326  if (!rv)
327  vlib_cli_output (vm, "policy-index:%d", stat_index);
328  else
329  vlib_cli_output (vm, "error:%d", rv);
330 
331 done:
332  unformat_free (line_input);
333 
334  return error;
335 }
336 
337 /* *INDENT-OFF* */
338 VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = {
339  .path = "ipsec policy",
340  .short_help =
341  "ipsec policy [add|del] spd <id> priority <n> ",
343 };
344 /* *INDENT-ON* */
345 
346 static void
348 {
349  u32 sai;
350 
351  /* *INDENT-OFF* */
352  pool_foreach_index (sai, im->sad, ({
353  vlib_cli_output(vm, "%U", format_ipsec_sa, sai,
354  (detail ? IPSEC_FORMAT_DETAIL : IPSEC_FORMAT_BRIEF));
355  }));
356  /* *INDENT-ON* */
357 }
358 
359 static void
361 {
362  u32 spdi;
363 
364  /* *INDENT-OFF* */
365  pool_foreach_index (spdi, im->spds, ({
366  vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
367  }));
368  /* *INDENT-ON* */
369 }
370 
371 static void
373 {
374  u32 spd_id, sw_if_index;
375  ipsec_spd_t *spd;
376 
377  vlib_cli_output (vm, "SPD Bindings:");
378 
379  /* *INDENT-OFF* */
380  hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
381  spd = pool_elt_at_index (im->spds, spd_id);
382  vlib_cli_output (vm, " %d -> %U", spd->id,
383  format_vnet_sw_if_index_name, im->vnet_main,
384  sw_if_index);
385  }));
386  /* *INDENT-ON* */
387 }
388 
389 static void
391 {
392  u32 ti;
393 
394  vlib_cli_output (vm, "Tunnel interfaces");
395  /* *INDENT-OFF* */
397  vlib_cli_output(vm, " %U", format_ipsec_tunnel, ti);
398  }));
399  /* *INDENT-ON* */
400 }
401 
402 static clib_error_t *
404  unformat_input_t * input, vlib_cli_command_t * cmd)
405 {
406  ipsec_main_t *im = &ipsec_main;
407 
408  ipsec_sa_show_all (vm, im, 0);
409  ipsec_spd_show_all (vm, im);
411  ipsec_tunnel_show_all (vm, im);
412 
413  return 0;
414 }
415 
416 /* *INDENT-OFF* */
417 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
418  .path = "show ipsec all",
419  .short_help = "show ipsec all",
420  .function = show_ipsec_command_fn,
421 };
422 /* *INDENT-ON* */
423 
424 static clib_error_t *
426  unformat_input_t * input, vlib_cli_command_t * cmd)
427 {
428  ipsec_main_t *im = &ipsec_main;
429  u32 sai = ~0;
430  u8 detail = 0;
431 
433  {
434  if (unformat (input, "%u", &sai))
435  ;
436  if (unformat (input, "detail"))
437  detail = 1;
438  else
439  break;
440  }
441 
442  if (~0 == sai)
443  ipsec_sa_show_all (vm, im, detail);
444  else
445  vlib_cli_output (vm, "%U", format_ipsec_sa, sai,
447 
448  return 0;
449 }
450 
451 static clib_error_t *
453  unformat_input_t * input, vlib_cli_command_t * cmd)
454 {
455  ipsec_main_t *im = &ipsec_main;
456  u32 sai = ~0;
457 
459  {
460  if (unformat (input, "%u", &sai))
461  ;
462  else
463  break;
464  }
465 
466  if (~0 == sai)
467  {
468  /* *INDENT-OFF* */
469  pool_foreach_index (sai, im->sad, ({
470  ipsec_sa_clear(sai);
471  }));
472  /* *INDENT-ON* */
473  }
474  else
475  {
476  if (pool_is_free_index (im->sad, sai))
477  return clib_error_return (0, "unknown SA index: %d", sai);
478  else
479  ipsec_sa_clear (sai);
480  }
481 
482  return 0;
483 }
484 
485 /* *INDENT-OFF* */
486 VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = {
487  .path = "show ipsec sa",
488  .short_help = "show ipsec sa [index]",
489  .function = show_ipsec_sa_command_fn,
490 };
491 
492 VLIB_CLI_COMMAND (clear_ipsec_sa_command, static) = {
493  .path = "clear ipsec sa",
494  .short_help = "clear ipsec sa [index]",
495  .function = clear_ipsec_sa_command_fn,
496 };
497 /* *INDENT-ON* */
498 
499 static clib_error_t *
501  unformat_input_t * input, vlib_cli_command_t * cmd)
502 {
503  ipsec_main_t *im = &ipsec_main;
504  u8 show_bindings = 0;
505  u32 spdi = ~0;
506 
508  {
509  if (unformat (input, "%u", &spdi))
510  ;
511  else if (unformat (input, "bindings"))
512  show_bindings = 1;
513  else
514  break;
515  }
516 
517  if (show_bindings)
519  else if (~0 != spdi)
520  vlib_cli_output (vm, "%U", format_ipsec_spd, spdi);
521  else
522  ipsec_spd_show_all (vm, im);
523 
524  return 0;
525 }
526 
527 /* *INDENT-OFF* */
528 VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = {
529  .path = "show ipsec spd",
530  .short_help = "show ipsec spd [index]",
531  .function = show_ipsec_spd_command_fn,
532 };
533 /* *INDENT-ON* */
534 
535 static clib_error_t *
537  unformat_input_t * input,
538  vlib_cli_command_t * cmd)
539 {
540  ipsec_main_t *im = &ipsec_main;
541  u32 ti = ~0;
542 
544  {
545  if (unformat (input, "%u", &ti))
546  ;
547  else
548  break;
549  }
550 
551  if (~0 != ti)
552  vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti);
553  else
554  ipsec_tunnel_show_all (vm, im);
555 
556  return 0;
557 }
558 
559 /* *INDENT-OFF* */
560 VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
561  .path = "show ipsec tunnel",
562  .short_help = "show ipsec tunnel [index]",
563  .function = show_ipsec_tunnel_command_fn,
564 };
565 /* *INDENT-ON* */
566 
567 static clib_error_t *
569  unformat_input_t * input,
570  vlib_cli_command_t * cmd)
571 {
572  ipsec_main_t *im = &ipsec_main;
573  u32 verbose = 0;
574 
575  (void) unformat (input, "verbose %u", &verbose);
576 
577  vlib_cli_output (vm, "IPsec AH backends available:");
578  u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
579  ipsec_ah_backend_t *ab;
580  /* *INDENT-OFF* */
581  pool_foreach (ab, im->ah_backends, {
582  s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
583  ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
584  if (verbose) {
585  vlib_node_t *n;
586  n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
587  s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
588  n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
589  s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
590  n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
591  s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
592  n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
593  s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
594  }
595  });
596  /* *INDENT-ON* */
597  vlib_cli_output (vm, "%v", s);
598  _vec_len (s) = 0;
599  vlib_cli_output (vm, "IPsec ESP backends available:");
600  s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
602  /* *INDENT-OFF* */
603  pool_foreach (eb, im->esp_backends, {
604  s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
605  eb - im->esp_backends == im->esp_current_backend ? "yes"
606  : "no");
607  if (verbose) {
608  vlib_node_t *n;
609  n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
610  s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
611  n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
612  s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
613  n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
614  s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
615  n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
616  s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
617  }
618  });
619  /* *INDENT-ON* */
620  vlib_cli_output (vm, "%v", s);
621 
622  vec_free (s);
623  return 0;
624 }
625 
626 /* *INDENT-OFF* */
627 VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
628  .path = "show ipsec backends",
629  .short_help = "show ipsec backends",
630  .function = ipsec_show_backends_command_fn,
631 };
632 /* *INDENT-ON* */
633 
634 static clib_error_t *
636  unformat_input_t * input,
637  vlib_cli_command_t * cmd)
638 {
639  unformat_input_t _line_input, *line_input = &_line_input;
640  ipsec_main_t *im = &ipsec_main;
641  clib_error_t *error;
642  u32 backend_index;
643 
644  error = ipsec_rsc_in_use (im);
645 
646  if (error)
647  return error;
648 
649  /* Get a line of input. */
650  if (!unformat_user (input, unformat_line_input, line_input))
651  return 0;
652 
653  if (unformat (line_input, "ah"))
654  {
655  if (unformat (line_input, "%u", &backend_index))
656  {
657  if (ipsec_select_ah_backend (im, backend_index) < 0)
658  {
659  return clib_error_return (0, "Invalid AH backend index `%u'",
660  backend_index);
661  }
662  }
663  else
664  {
665  return clib_error_return (0, "Invalid backend index `%U'",
666  format_unformat_error, line_input);
667  }
668  }
669  else if (unformat (line_input, "esp"))
670  {
671  if (unformat (line_input, "%u", &backend_index))
672  {
673  if (ipsec_select_esp_backend (im, backend_index) < 0)
674  {
675  return clib_error_return (0, "Invalid ESP backend index `%u'",
676  backend_index);
677  }
678  }
679  else
680  {
681  return clib_error_return (0, "Invalid backend index `%U'",
682  format_unformat_error, line_input);
683  }
684  }
685  else
686  {
687  return clib_error_return (0, "Unknown input `%U'",
688  format_unformat_error, line_input);
689  }
690 
691  return 0;
692 }
693 
694 /* *INDENT-OFF* */
695 VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
696  .path = "ipsec select backend",
697  .short_help = "ipsec select backend <ah|esp> <backend index>",
699 };
700 
701 /* *INDENT-ON* */
702 
703 static clib_error_t *
705  unformat_input_t * input,
706  vlib_cli_command_t * cmd)
707 {
710 
711  return (NULL);
712 }
713 
714 /* *INDENT-OFF* */
715 VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
716  .path = "clear ipsec counters",
717  .short_help = "clear ipsec counters",
719 };
720 /* *INDENT-ON* */
721 
722 static clib_error_t *
724  unformat_input_t * input,
725  vlib_cli_command_t * cmd)
726 {
727  unformat_input_t _line_input, *line_input = &_line_input;
729  int rv;
730  u32 num_m_args = 0;
731  u8 ipv4_set = 0;
732  u8 ipv6_set = 0;
733  clib_error_t *error = NULL;
734  ipsec_key_t rck = { 0 };
735  ipsec_key_t lck = { 0 };
736  ipsec_key_t lik = { 0 };
737  ipsec_key_t rik = { 0 };
738 
739  clib_memset (&a, 0, sizeof (a));
740  a.is_add = 1;
741 
742  /* Get a line of input. */
743  if (!unformat_user (input, unformat_line_input, line_input))
744  return 0;
745 
746  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
747  {
748  if (unformat
749  (line_input, "local-ip %U", unformat_ip46_address, &a.local_ip,
750  IP46_TYPE_ANY))
751  {
752  ip46_address_is_ip4 (&a.local_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
753  num_m_args++;
754  }
755  else
756  if (unformat
757  (line_input, "remote-ip %U", unformat_ip46_address, &a.remote_ip,
758  IP46_TYPE_ANY))
759  {
760  ip46_address_is_ip4 (&a.remote_ip) ? (ipv4_set = 1) : (ipv6_set =
761  1);
762  num_m_args++;
763  }
764  else if (unformat (line_input, "local-spi %u", &a.local_spi))
765  num_m_args++;
766  else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
767  num_m_args++;
768  else if (unformat (line_input, "instance %u", &a.show_instance))
769  a.renumber = 1;
770  else if (unformat (line_input, "salt 0x%x", &a.salt))
771  ;
772  else if (unformat (line_input, "udp-encap"))
773  a.udp_encap = 1;
774  else if (unformat (line_input, "use-esn"))
775  a.esn = 1;
776  else if (unformat (line_input, "use-anti-replay"))
777  a.anti_replay = 1;
778  else if (unformat (line_input, "tx-table %u", &a.tx_table_id))
779  ;
780  else
781  if (unformat
782  (line_input, "local-crypto-key %U", unformat_ipsec_key, &lck))
783  ;
784  else
785  if (unformat
786  (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck))
787  ;
788  else if (unformat (line_input, "crypto-alg %U",
790  ;
791  else
792  if (unformat
793  (line_input, "local-integ-key %U", unformat_ipsec_key, &lik))
794  ;
795  else
796  if (unformat
797  (line_input, "remote-integ-key %U", unformat_ipsec_key, &rik))
798  ;
799  else if (unformat (line_input, "integ-alg %U",
801  ;
802  else if (unformat (line_input, "del"))
803  a.is_add = 0;
804  else
805  {
806  error = clib_error_return (0, "unknown input `%U'",
807  format_unformat_error, line_input);
808  goto done;
809  }
810  }
811 
812  if (num_m_args < 4)
813  {
814  error = clib_error_return (0, "mandatory argument(s) missing");
815  goto done;
816  }
817 
818  if (ipv4_set && ipv6_set)
819  return clib_error_return (0, "both IPv4 and IPv6 addresses specified");
820 
821  a.is_ip6 = ipv6_set;
822 
823  clib_memcpy (a.local_crypto_key, lck.data, lck.len);
824  a.local_crypto_key_len = lck.len;
825  clib_memcpy (a.remote_crypto_key, rck.data, rck.len);
826  a.remote_crypto_key_len = rck.len;
827 
828  clib_memcpy (a.local_integ_key, lik.data, lik.len);
829  a.local_integ_key_len = lck.len;
830  clib_memcpy (a.remote_integ_key, rik.data, rik.len);
831  a.remote_integ_key_len = rck.len;
832 
833  rv = ipsec_add_del_tunnel_if (&a);
834 
835  switch (rv)
836  {
837  case 0:
838  break;
839  case VNET_API_ERROR_INVALID_VALUE:
840  if (a.is_add)
841  error = clib_error_return (0,
842  "IPSec tunnel interface already exists...");
843  else
844  error = clib_error_return (0, "IPSec tunnel interface not exists...");
845  goto done;
846  default:
847  error = clib_error_return (0, "ipsec_register_interface returned %d",
848  rv);
849  goto done;
850  }
851 
852 done:
853  unformat_free (line_input);
854 
855  return error;
856 }
857 
858 /* *INDENT-OFF* */
859 VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
860  .path = "create ipsec tunnel",
861  .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> "
862  "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] [use-esn] [use-anti-replay] "
863  "[tx-table <table-id>]",
864  .function = create_ipsec_tunnel_command_fn,
865 };
866 /* *INDENT-ON* */
867 
868 static clib_error_t *
870  unformat_input_t * input, vlib_cli_command_t * cmd)
871 {
872  unformat_input_t _line_input, *line_input = &_line_input;
873  u32 sw_if_index, is_del, sa_in, sa_out, *sa_ins = NULL;
874  vnet_main_t *vnm;
875 
876  is_del = 0;
877  sw_if_index = ~0;
878  vnm = vnet_get_main ();
879 
880  if (!unformat_user (input, unformat_line_input, line_input))
881  return 0;
882 
883  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
884  {
885  if (unformat (line_input, "del"))
886  is_del = 1;
887  else if (unformat (line_input, "add"))
888  is_del = 0;
889  else if (unformat (line_input, "sa-in %d", &sa_in))
890  vec_add1 (sa_ins, sa_in);
891  else if (unformat (line_input, "sa-out %d", &sa_out))
892  ;
893  else if (unformat (line_input, "%U",
894  unformat_vnet_sw_interface, vnm, &sw_if_index))
895  ;
896  else
897  return (clib_error_return (0, "unknown input '%U'",
898  format_unformat_error, line_input));
899  }
900 
901  if (!is_del)
902  ipsec_tun_protect_update (sw_if_index, sa_out, sa_ins);
903 
904  unformat_free (line_input);
905  return NULL;
906 }
907 
908 /**
909  * Protect tunnel with IPSEC
910  */
911 /* *INDENT-OFF* */
912 VLIB_CLI_COMMAND (ipsec_tun_protect_cmd_node, static) =
913 {
914  .path = "ipsec tunnel protect",
915  .function = ipsec_tun_protect_cmd,
916  .short_help = "ipsec tunnel protect <interface> input-sa <SA> output-sa <SA>",
917  // this is not MP safe
918 };
919 /* *INDENT-ON* */
920 
921 static walk_rc_t
923 {
924  vlib_cli_output (ctx, "%U", format_ipsec_tun_protect, itpi);
925 
926  return (WALK_CONTINUE);
927 }
928 
929 static clib_error_t *
931  unformat_input_t * input, vlib_cli_command_t * cmd)
932 {
934 
935  return NULL;
936 }
937 
938 /**
939  * show IPSEC tunnel protection
940  */
941 /* *INDENT-OFF* */
942 VLIB_CLI_COMMAND (ipsec_tun_protect_show_node, static) =
943 {
944  .path = "show ipsec protect",
945  .function = ipsec_tun_protect_show,
946  .short_help = "show ipsec protect",
947 };
948 /* *INDENT-ON* */
949 
950 static clib_error_t *
952  unformat_input_t * input,
953  vlib_cli_command_t * cmd)
954 {
955  ipsec_main_t *im = &ipsec_main;
956 
957  {
959  ipsec4_tunnel_key_t key;
960 
961  vlib_cli_output (vm, "IPv4:");
962 
963  /* *INDENT-OFF* */
964  hash_foreach(key.as_u64, value.as_u64, im->tun4_protect_by_key,
965  ({
966  vlib_cli_output (vm, " %U", format_ipsec4_tunnel_key, &key);
967  vlib_cli_output (vm, " tun:%d sa:%d", value.tun_index, value.sa_index);
968  }));
969  /* *INDENT-ON* */
970  }
971 
972  {
974  ipsec6_tunnel_key_t *key;
975 
976  vlib_cli_output (vm, "IPv6:");
977 
978  /* *INDENT-OFF* */
980  ({
981  vlib_cli_output (vm, " %U", format_ipsec6_tunnel_key, key);
982  vlib_cli_output (vm, " tun:%d sa:%d", value.tun_index, value.sa_index);
983  }));
984  /* *INDENT-ON* */
985  }
986 
987  return NULL;
988 }
989 
990 /**
991  * show IPSEC tunnel protection hash tables
992  */
993 /* *INDENT-OFF* */
994 VLIB_CLI_COMMAND (ipsec_tun_protect_hash_show_node, static) =
995 {
996  .path = "show ipsec protect-hash",
997  .function = ipsec_tun_protect_hash_show,
998  .short_help = "show ipsec protect-hash",
999 };
1000 /* *INDENT-ON* */
1001 
1002 clib_error_t *
1004 {
1005  return 0;
1006 }
1007 
1009 
1010 
1011 /*
1012  * fd.io coding-style-patch-verification: ON
1013  *
1014  * Local Variables:
1015  * eval: (c-set-style "gnu")
1016  * End:
1017  */
static clib_error_t * ipsec_select_backend_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:635
ipsec_spd_t * spds
Definition: ipsec.h:95
u32 flags
Definition: vhost_user.h:141
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:102
uword * tun6_protect_by_key
Definition: ipsec.h:119
a
Definition: bitmap.h:538
vnet_main_t * vnet_get_main(void)
Definition: misc.c:46
ip46_address_t local_ip
Definition: ipsec_if.h:38
ipsec_integ_alg_t
Definition: ipsec_sa.h:58
ip46_address_range_t laddr
#define NULL
Definition: clib.h:58
static clib_error_t * show_ipsec_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:500
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
int ipsec_policy_mk_type(bool is_outbound, bool is_ipv6, ipsec_policy_action_t action, ipsec_spd_policy_type_t *type)
static clib_error_t * create_ipsec_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:723
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:41
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:522
ipsec_protocol_t
Definition: ipsec_sa.h:66
int ipsec_add_del_tunnel_if(ipsec_add_del_tunnel_args_t *args)
Definition: ipsec_if.c:214
void ipsec_sa_clear(index_t sai)
Definition: ipsec_sa.c:348
uword unformat_user(unformat_input_t *input, unformat_function_t *func,...)
Definition: unformat.c:989
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
Definition: ipsec.c:218
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
unformat_function_t unformat_vnet_sw_interface
A Secruity Policy Database.
Definition: ipsec_spd.h:44
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
Definition: ipsec_tun.c:370
unsigned char u8
Definition: types.h:56
uword * spd_index_by_sw_if_index
Definition: ipsec.h:112
#define clib_memcpy(d, s, n)
Definition: string.h:180
enum walk_rc_t_ walk_rc_t
Walk return code.
void vlib_clear_combined_counters(vlib_combined_counter_main_t *cm)
Clear a collection of combined counters.
Definition: counter.c:61
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:493
unformat_function_t unformat_ip4_address
Definition: format.h:70
vl_api_interface_index_t sw_if_index
Definition: gre.api:50
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:173
ipsec_main_t ipsec_main
Definition: ipsec.c:28
u8 * format_ipsec_tun_protect(u8 *s, va_list *args)
Definition: ipsec_format.c:372
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
Definition: ipsec.c:241
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
uword unformat_ipsec_crypto_alg(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:96
#define clib_error_return(e, args...)
Definition: error.h:99
int ipsec_sa_unlock_id(u32 id)
Definition: ipsec_sa.c:332
port_range_t rport
u8 * format_ipsec_sa(u8 *s, va_list *args)
Definition: ipsec_format.c:269
unsigned int u32
Definition: types.h:88
static void ipsec_tunnel_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:390
u32 sa_in[n_sa_in]
Definition: ipsec.api:354
static clib_error_t * ipsec_tun_protect_show(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:930
unformat_function_t unformat_line_input
Definition: format.h:283
u32 sa_out
Definition: ipsec.api:352
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
u8 * format_ipsec_spd(u8 *s, va_list *args)
Definition: ipsec_format.c:203
static clib_error_t * ipsec_policy_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:226
long ctx[MAX_CONNS]
Definition: main.c:144
vnet_main_t * vnet_main
Definition: ipsec.h:108
struct _unformat_input_t unformat_input_t
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add, u32 *stat_index)
Add/Delete a SPD.
static clib_error_t * set_interface_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:28
ip46_address_t remote_ip
Definition: ipsec_if.h:38
u8 * format_ipsec_tunnel(u8 *s, va_list *args)
Definition: ipsec_format.c:338
clib_error_t * ipsec_rsc_in_use(ipsec_main_t *im)
Definition: ipsec.c:201
static clib_error_t * ipsec_show_backends_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:568
ipsec_spd_policy_type_t type
#define hash_foreach_mem(key_var, value_var, h, body)
Definition: hash.h:461
static void ipsec_spd_bindings_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:372
static clib_error_t * clear_ipsec_counters_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:704
#define ip46_address_is_ip4(ip46)
Definition: ip6_packet.h:88
unformat_function_t unformat_ip6_address
Definition: format.h:91
ipsec_crypto_alg_t crypto_alg
Definition: ipsec_if.h:41
#define UNFORMAT_END_OF_INPUT
Definition: format.h:145
static void ipsec_sa_show_all(vlib_main_t *vm, ipsec_main_t *im, u8 detail)
Definition: ipsec_cli.c:347
vlib_main_t * vm
Definition: buffer.c:323
int ipsec_tun_protect_update(u32 sw_if_index, u32 sa_out, u32 *sas_in)
Definition: ipsec_tun.c:224
ipsec_ah_backend_t * ah_backends
Definition: ipsec.h:150
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:1003
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:341
static clib_error_t * clear_ipsec_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:452
ipsec_policy_action_t policy
ip46_address_t start
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
u8 is_outbound
Definition: ipsec.api:93
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
Definition: pool.h:283
A Secruity Policy.
#define VLIB_CLI_COMMAND(x,...)
Definition: cli.h:161
static void ipsec_spd_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:360
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
Definition: ipsec_sa.c:27
u8 value
Definition: qos.api:53
u32 spi
Definition: ipsec.api:274
ipsec_integ_alg_t integ_alg
Definition: ipsec_if.h:46
ipsec_sa_t * sad
Definition: ipsec.h:97
static clib_error_t * show_ipsec_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:425
uword unformat_ipsec_integ_alg(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:128
static clib_error_t * ipsec_tun_protect_cmd(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:869
u8 * format_ipsec_policy_action(u8 *s, va_list *args)
Definition: ipsec_format.c:28
uword unformat_ipsec_policy_action(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:64
unformat_function_t unformat_ip46_address
Definition: format.h:65
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index)
Definition: ipsec_sa.c:127
ip46_address_range_t raddr
static clib_error_t * show_ipsec_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:536
static void unformat_free(unformat_input_t *i)
Definition: format.h:163
ipsec_crypto_alg_t
Definition: ipsec_sa.h:36
typedef key
Definition: ipsec.api:247
static clib_error_t * ipsec_sa_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:73
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
Definition: ipsec_spd.c:63
static clib_error_t * ipsec_tun_protect_hash_show(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:951
u8 * format_unformat_error(u8 *s, va_list *va)
Definition: unformat.c:91
port_range_t lport
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
Definition: ipsec_spd.c:20
static clib_error_t * show_ipsec_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:403
static walk_rc_t ipsec_tun_protect_show_one(index_t itpi, void *ctx)
Definition: ipsec_cli.c:922
u32 id
Definition: udp.api:45
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:538
static clib_error_t * ipsec_spd_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:173
u32 salt
Definition: ipsec.api:289
uword unformat_ipsec_key(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:242
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
Definition: cli.c:772
uword unformat(unformat_input_t *i, const char *fmt,...)
Definition: unformat.c:978
vl_api_fib_path_nh_proto_t proto
Definition: fib_types.api:125
static uword unformat_check_input(unformat_input_t *i)
Definition: format.h:171
uword * tun4_protect_by_key
Definition: ipsec.h:118