FD.io VPP  v19.08-27-gf4dcae4
Vector Packet Processing
ipsec_cli.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/fib/fib.h>
23 
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/ipsec_tun.h>
26 
27 static clib_error_t *
29  unformat_input_t * input,
30  vlib_cli_command_t * cmd)
31 {
32  unformat_input_t _line_input, *line_input = &_line_input;
33  ipsec_main_t *im = &ipsec_main;
34  u32 sw_if_index = (u32) ~ 0;
35  u32 spd_id;
36  int is_add = 1;
37  clib_error_t *error = NULL;
38 
39  if (!unformat_user (input, unformat_line_input, line_input))
40  return 0;
41 
42  if (unformat
43  (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main,
44  &sw_if_index, &spd_id))
45  ;
46  else if (unformat (line_input, "del"))
47  is_add = 0;
48  else
49  {
50  error = clib_error_return (0, "parse error: '%U'",
51  format_unformat_error, line_input);
52  goto done;
53  }
54 
55  ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
56 
57 done:
58  unformat_free (line_input);
59 
60  return error;
61 }
62 
63 /* *INDENT-OFF* */
64 VLIB_CLI_COMMAND (set_interface_spd_command, static) = {
65  .path = "set interface ipsec spd",
66  .short_help =
67  "set interface ipsec spd <int> <id>",
68  .function = set_interface_spd_command_fn,
69 };
70 /* *INDENT-ON* */
71 
72 static clib_error_t *
74  unformat_input_t * input,
75  vlib_cli_command_t * cmd)
76 {
77  unformat_input_t _line_input, *line_input = &_line_input;
78  ip46_address_t tun_src = { }, tun_dst =
79  {
80  };
81  ipsec_crypto_alg_t crypto_alg;
82  ipsec_integ_alg_t integ_alg;
85  clib_error_t *error;
86  ipsec_key_t ck = { 0 };
87  ipsec_key_t ik = { 0 };
88  u32 id, spi, salt;
89  int is_add, rv;
90 
91  error = NULL;
92  is_add = 0;
93  flags = IPSEC_SA_FLAG_NONE;
94  proto = IPSEC_PROTOCOL_ESP;
95  integ_alg = IPSEC_INTEG_ALG_NONE;
96  crypto_alg = IPSEC_CRYPTO_ALG_NONE;
97 
98  if (!unformat_user (input, unformat_line_input, line_input))
99  return 0;
100 
101  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
102  {
103  if (unformat (line_input, "add %u", &id))
104  is_add = 1;
105  else if (unformat (line_input, "del %u", &id))
106  is_add = 0;
107  else if (unformat (line_input, "spi %u", &spi))
108  ;
109  else if (unformat (line_input, "salt 0x%x", &salt))
110  ;
111  else if (unformat (line_input, "esp"))
112  proto = IPSEC_PROTOCOL_ESP;
113  else if (unformat (line_input, "ah"))
114  proto = IPSEC_PROTOCOL_AH;
115  else if (unformat (line_input, "crypto-key %U",
116  unformat_ipsec_key, &ck))
117  ;
118  else if (unformat (line_input, "crypto-alg %U",
119  unformat_ipsec_crypto_alg, &crypto_alg))
120  ;
121  else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik))
122  ;
123  else if (unformat (line_input, "integ-alg %U",
124  unformat_ipsec_integ_alg, &integ_alg))
125  ;
126  else if (unformat (line_input, "tunnel-src %U",
128  {
129  flags |= IPSEC_SA_FLAG_IS_TUNNEL;
130  if (!ip46_address_is_ip4 (&tun_src))
131  flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
132  }
133  else if (unformat (line_input, "tunnel-dst %U",
135  ;
136  else if (unformat (line_input, "udp-encap"))
137  flags |= IPSEC_SA_FLAG_UDP_ENCAP;
138  else
139  {
140  error = clib_error_return (0, "parse error: '%U'",
141  format_unformat_error, line_input);
142  goto done;
143  }
144  }
145 
146  if (is_add)
147  rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
148  &ck, integ_alg, &ik, flags,
149  0, clib_host_to_net_u32 (salt),
150  &tun_src, &tun_dst, NULL);
151  else
152  rv = ipsec_sa_unlock_id (id);
153 
154  if (rv)
155  error = clib_error_return (0, "failed");
156 
157 done:
158  unformat_free (line_input);
159 
160  return error;
161 }
162 
163 /* *INDENT-OFF* */
164 VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = {
165  .path = "ipsec sa",
166  .short_help =
167  "ipsec sa [add|del]",
168  .function = ipsec_sa_add_del_command_fn,
169 };
170 /* *INDENT-ON* */
171 
172 static clib_error_t *
174  unformat_input_t * input,
175  vlib_cli_command_t * cmd)
176 {
177  unformat_input_t _line_input, *line_input = &_line_input;
178  u32 spd_id = ~0;
179  int is_add = ~0;
180  clib_error_t *error = NULL;
181 
182  if (!unformat_user (input, unformat_line_input, line_input))
183  return 0;
184 
185  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
186  {
187  if (unformat (line_input, "add"))
188  is_add = 1;
189  else if (unformat (line_input, "del"))
190  is_add = 0;
191  else if (unformat (line_input, "%u", &spd_id))
192  ;
193  else
194  {
195  error = clib_error_return (0, "parse error: '%U'",
196  format_unformat_error, line_input);
197  goto done;
198  }
199  }
200 
201  if (spd_id == ~0)
202  {
203  error = clib_error_return (0, "please specify SPD ID");
204  goto done;
205  }
206 
207  ipsec_add_del_spd (vm, spd_id, is_add);
208 
209 done:
210  unformat_free (line_input);
211 
212  return error;
213 }
214 
215 /* *INDENT-OFF* */
216 VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = {
217  .path = "ipsec spd",
218  .short_help =
219  "ipsec spd [add|del] <id>",
220  .function = ipsec_spd_add_del_command_fn,
221 };
222 /* *INDENT-ON* */
223 
224 
225 static clib_error_t *
227  unformat_input_t * input,
228  vlib_cli_command_t * cmd)
229 {
230  unformat_input_t _line_input, *line_input = &_line_input;
231  ipsec_policy_t p;
232  int rv, is_add = 0;
233  u32 tmp, tmp2, stat_index;
234  clib_error_t *error = NULL;
236 
237  clib_memset (&p, 0, sizeof (p));
238  p.lport.stop = p.rport.stop = ~0;
239  is_outbound = 0;
240 
241  if (!unformat_user (input, unformat_line_input, line_input))
242  return 0;
243 
244  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
245  {
246  if (unformat (line_input, "add"))
247  is_add = 1;
248  else if (unformat (line_input, "del"))
249  is_add = 0;
250  else if (unformat (line_input, "spd %u", &p.id))
251  ;
252  else if (unformat (line_input, "inbound"))
253  is_outbound = 0;
254  else if (unformat (line_input, "outbound"))
255  is_outbound = 1;
256  else if (unformat (line_input, "priority %d", &p.priority))
257  ;
258  else if (unformat (line_input, "protocol %u", &tmp))
259  p.protocol = (u8) tmp;
260  else
261  if (unformat
262  (line_input, "action %U", unformat_ipsec_policy_action,
263  &p.policy))
264  {
265  if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
266  {
267  error = clib_error_return (0, "unsupported action: 'resolve'");
268  goto done;
269  }
270  }
271  else if (unformat (line_input, "sa %u", &p.sa_id))
272  ;
273  else if (unformat (line_input, "local-ip-range %U - %U",
276  ;
277  else if (unformat (line_input, "remote-ip-range %U - %U",
280  ;
281  else if (unformat (line_input, "local-ip-range %U - %U",
284  {
285  p.is_ipv6 = 1;
286  }
287  else if (unformat (line_input, "remote-ip-range %U - %U",
290  {
291  p.is_ipv6 = 1;
292  }
293  else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2))
294  {
295  p.lport.start = tmp;
296  p.lport.stop = tmp2;
297  }
298  else
299  if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2))
300  {
301  p.rport.start = tmp;
302  p.rport.stop = tmp2;
303  }
304  else
305  {
306  error = clib_error_return (0, "parse error: '%U'",
307  format_unformat_error, line_input);
308  goto done;
309  }
310  }
311 
312  rv = ipsec_policy_mk_type (is_outbound, p.is_ipv6, p.policy, &p.type);
313 
314  if (rv)
315  {
316  error = clib_error_return (0, "unsupported policy type for:",
317  " outboud:%s %s action:%U",
318  (is_outbound ? "yes" : "no"),
319  (p.is_ipv6 ? "IPv4" : "IPv6"),
321  goto done;
322  }
323 
324  rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index);
325 
326  if (!rv)
327  vlib_cli_output (vm, "policy-index:%d", stat_index);
328  else
329  vlib_cli_output (vm, "error:%d", rv);
330 
331 done:
332  unformat_free (line_input);
333 
334  return error;
335 }
336 
337 /* *INDENT-OFF* */
338 VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = {
339  .path = "ipsec policy",
340  .short_help =
341  "ipsec policy [add|del] spd <id> priority <n> ",
343 };
344 /* *INDENT-ON* */
345 
346 static void
348 {
349  u32 sai;
350 
351  /* *INDENT-OFF* */
352  pool_foreach_index (sai, im->sad, ({
353  vlib_cli_output(vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_BRIEF);
354  }));
355  /* *INDENT-ON* */
356 }
357 
358 static void
360 {
361  u32 spdi;
362 
363  /* *INDENT-OFF* */
364  pool_foreach_index (spdi, im->spds, ({
365  vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
366  }));
367  /* *INDENT-ON* */
368 }
369 
370 static void
372 {
373  u32 spd_id, sw_if_index;
374  ipsec_spd_t *spd;
375 
376  vlib_cli_output (vm, "SPD Bindings:");
377 
378  /* *INDENT-OFF* */
379  hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
380  spd = pool_elt_at_index (im->spds, spd_id);
381  vlib_cli_output (vm, " %d -> %U", spd->id,
382  format_vnet_sw_if_index_name, im->vnet_main,
383  sw_if_index);
384  }));
385  /* *INDENT-ON* */
386 }
387 
388 static void
390 {
391  u32 ti;
392 
393  vlib_cli_output (vm, "Tunnel interfaces");
394  /* *INDENT-OFF* */
396  vlib_cli_output(vm, " %U", format_ipsec_tunnel, ti);
397  }));
398  /* *INDENT-ON* */
399 }
400 
401 static clib_error_t *
403  unformat_input_t * input, vlib_cli_command_t * cmd)
404 {
405  ipsec_main_t *im = &ipsec_main;
406 
407  ipsec_sa_show_all (vm, im);
408  ipsec_spd_show_all (vm, im);
410  ipsec_tunnel_show_all (vm, im);
411 
412  return 0;
413 }
414 
415 /* *INDENT-OFF* */
416 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
417  .path = "show ipsec all",
418  .short_help = "show ipsec all",
419  .function = show_ipsec_command_fn,
420 };
421 /* *INDENT-ON* */
422 
423 static clib_error_t *
425  unformat_input_t * input, vlib_cli_command_t * cmd)
426 {
427  ipsec_main_t *im = &ipsec_main;
428  u32 sai = ~0;
429 
431  {
432  if (unformat (input, "%u", &sai))
433  ;
434  else
435  break;
436  }
437 
438  if (~0 == sai)
439  ipsec_sa_show_all (vm, im);
440  else
442 
443  return 0;
444 }
445 
446 static clib_error_t *
448  unformat_input_t * input, vlib_cli_command_t * cmd)
449 {
450  ipsec_main_t *im = &ipsec_main;
451  u32 sai = ~0;
452 
454  {
455  if (unformat (input, "%u", &sai))
456  ;
457  else
458  break;
459  }
460 
461  if (~0 == sai)
462  {
463  /* *INDENT-OFF* */
464  pool_foreach_index (sai, im->sad, ({
465  ipsec_sa_clear(sai);
466  }));
467  /* *INDENT-ON* */
468  }
469  else
470  {
471  if (pool_is_free_index (im->sad, sai))
472  return clib_error_return (0, "unknown SA index: %d", sai);
473  else
474  ipsec_sa_clear (sai);
475  }
476 
477  return 0;
478 }
479 
480 /* *INDENT-OFF* */
481 VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = {
482  .path = "show ipsec sa",
483  .short_help = "show ipsec sa [index]",
484  .function = show_ipsec_sa_command_fn,
485 };
486 
487 VLIB_CLI_COMMAND (clear_ipsec_sa_command, static) = {
488  .path = "clear ipsec sa",
489  .short_help = "clear ipsec sa [index]",
490  .function = clear_ipsec_sa_command_fn,
491 };
492 /* *INDENT-ON* */
493 
494 static clib_error_t *
496  unformat_input_t * input, vlib_cli_command_t * cmd)
497 {
498  ipsec_main_t *im = &ipsec_main;
499  u8 show_bindings = 0;
500  u32 spdi = ~0;
501 
503  {
504  if (unformat (input, "%u", &spdi))
505  ;
506  else if (unformat (input, "bindings"))
507  show_bindings = 1;
508  else
509  break;
510  }
511 
512  if (show_bindings)
514  else if (~0 != spdi)
515  vlib_cli_output (vm, "%U", format_ipsec_spd, spdi);
516  else
517  ipsec_spd_show_all (vm, im);
518 
519  return 0;
520 }
521 
522 /* *INDENT-OFF* */
523 VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = {
524  .path = "show ipsec spd",
525  .short_help = "show ipsec spd [index]",
526  .function = show_ipsec_spd_command_fn,
527 };
528 /* *INDENT-ON* */
529 
530 static clib_error_t *
532  unformat_input_t * input,
533  vlib_cli_command_t * cmd)
534 {
535  ipsec_main_t *im = &ipsec_main;
536  u32 ti = ~0;
537 
539  {
540  if (unformat (input, "%u", &ti))
541  ;
542  else
543  break;
544  }
545 
546  if (~0 != ti)
547  vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti);
548  else
549  ipsec_tunnel_show_all (vm, im);
550 
551  return 0;
552 }
553 
554 /* *INDENT-OFF* */
555 VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
556  .path = "show ipsec tunnel",
557  .short_help = "show ipsec tunnel [index]",
558  .function = show_ipsec_tunnel_command_fn,
559 };
560 /* *INDENT-ON* */
561 
562 static clib_error_t *
564  unformat_input_t * input,
565  vlib_cli_command_t * cmd)
566 {
567  ipsec_main_t *im = &ipsec_main;
568  u32 verbose = 0;
569 
570  (void) unformat (input, "verbose %u", &verbose);
571 
572  vlib_cli_output (vm, "IPsec AH backends available:");
573  u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
574  ipsec_ah_backend_t *ab;
575  /* *INDENT-OFF* */
576  pool_foreach (ab, im->ah_backends, {
577  s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
578  ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
579  if (verbose) {
580  vlib_node_t *n;
581  n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
582  s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
583  n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
584  s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
585  n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
586  s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
587  n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
588  s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
589  }
590  });
591  /* *INDENT-ON* */
592  vlib_cli_output (vm, "%v", s);
593  _vec_len (s) = 0;
594  vlib_cli_output (vm, "IPsec ESP backends available:");
595  s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
597  /* *INDENT-OFF* */
598  pool_foreach (eb, im->esp_backends, {
599  s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
600  eb - im->esp_backends == im->esp_current_backend ? "yes"
601  : "no");
602  if (verbose) {
603  vlib_node_t *n;
604  n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
605  s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
606  n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
607  s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
608  n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
609  s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
610  n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
611  s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
612  }
613  });
614  /* *INDENT-ON* */
615  vlib_cli_output (vm, "%v", s);
616 
617  vec_free (s);
618  return 0;
619 }
620 
621 /* *INDENT-OFF* */
622 VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
623  .path = "show ipsec backends",
624  .short_help = "show ipsec backends",
625  .function = ipsec_show_backends_command_fn,
626 };
627 /* *INDENT-ON* */
628 
629 static clib_error_t *
631  unformat_input_t * input,
632  vlib_cli_command_t * cmd)
633 {
634  unformat_input_t _line_input, *line_input = &_line_input;
635  ipsec_main_t *im = &ipsec_main;
636  clib_error_t *error;
637  u32 backend_index;
638 
639  error = ipsec_rsc_in_use (im);
640 
641  if (error)
642  return error;
643 
644  /* Get a line of input. */
645  if (!unformat_user (input, unformat_line_input, line_input))
646  return 0;
647 
648  if (unformat (line_input, "ah"))
649  {
650  if (unformat (line_input, "%u", &backend_index))
651  {
652  if (ipsec_select_ah_backend (im, backend_index) < 0)
653  {
654  return clib_error_return (0, "Invalid AH backend index `%u'",
655  backend_index);
656  }
657  }
658  else
659  {
660  return clib_error_return (0, "Invalid backend index `%U'",
661  format_unformat_error, line_input);
662  }
663  }
664  else if (unformat (line_input, "esp"))
665  {
666  if (unformat (line_input, "%u", &backend_index))
667  {
668  if (ipsec_select_esp_backend (im, backend_index) < 0)
669  {
670  return clib_error_return (0, "Invalid ESP backend index `%u'",
671  backend_index);
672  }
673  }
674  else
675  {
676  return clib_error_return (0, "Invalid backend index `%U'",
677  format_unformat_error, line_input);
678  }
679  }
680  else
681  {
682  return clib_error_return (0, "Unknown input `%U'",
683  format_unformat_error, line_input);
684  }
685 
686  return 0;
687 }
688 
689 /* *INDENT-OFF* */
690 VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
691  .path = "ipsec select backend",
692  .short_help = "ipsec select backend <ah|esp> <backend index>",
694 };
695 
696 /* *INDENT-ON* */
697 
698 static clib_error_t *
700  unformat_input_t * input,
701  vlib_cli_command_t * cmd)
702 {
705 
706  return (NULL);
707 }
708 
709 /* *INDENT-OFF* */
710 VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
711  .path = "clear ipsec counters",
712  .short_help = "clear ipsec counters",
714 };
715 /* *INDENT-ON* */
716 
717 static clib_error_t *
719  unformat_input_t * input,
720  vlib_cli_command_t * cmd)
721 {
722  unformat_input_t _line_input, *line_input = &_line_input;
724  int rv;
725  u32 num_m_args = 0;
726  u8 ipv4_set = 0;
727  u8 ipv6_set = 0;
728  clib_error_t *error = NULL;
729  ipsec_key_t rck = { 0 };
730  ipsec_key_t lck = { 0 };
731  ipsec_key_t lik = { 0 };
732  ipsec_key_t rik = { 0 };
733 
734  clib_memset (&a, 0, sizeof (a));
735  a.is_add = 1;
736 
737  /* Get a line of input. */
738  if (!unformat_user (input, unformat_line_input, line_input))
739  return 0;
740 
741  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
742  {
743  if (unformat
744  (line_input, "local-ip %U", unformat_ip46_address, &a.local_ip,
745  IP46_TYPE_ANY))
746  {
747  ip46_address_is_ip4 (&a.local_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
748  num_m_args++;
749  }
750  else
751  if (unformat
752  (line_input, "remote-ip %U", unformat_ip46_address, &a.remote_ip,
753  IP46_TYPE_ANY))
754  {
755  ip46_address_is_ip4 (&a.remote_ip) ? (ipv4_set = 1) : (ipv6_set =
756  1);
757  num_m_args++;
758  }
759  else if (unformat (line_input, "local-spi %u", &a.local_spi))
760  num_m_args++;
761  else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
762  num_m_args++;
763  else if (unformat (line_input, "instance %u", &a.show_instance))
764  a.renumber = 1;
765  else if (unformat (line_input, "salt 0x%x", &a.salt))
766  ;
767  else if (unformat (line_input, "udp-encap"))
768  a.udp_encap = 1;
769  else if (unformat (line_input, "use-esn"))
770  a.esn = 1;
771  else if (unformat (line_input, "use-anti-replay"))
772  a.anti_replay = 1;
773  else if (unformat (line_input, "tx-table %u", &a.tx_table_id))
774  ;
775  else
776  if (unformat
777  (line_input, "local-crypto-key %U", unformat_ipsec_key, &lck))
778  ;
779  else
780  if (unformat
781  (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck))
782  ;
783  else if (unformat (line_input, "crypto-alg %U",
785  ;
786  else
787  if (unformat
788  (line_input, "local-integ-key %U", unformat_ipsec_key, &lik))
789  ;
790  else
791  if (unformat
792  (line_input, "remote-integ-key %U", unformat_ipsec_key, &rik))
793  ;
794  else if (unformat (line_input, "integ-alg %U",
796  ;
797  else if (unformat (line_input, "del"))
798  a.is_add = 0;
799  else
800  {
801  error = clib_error_return (0, "unknown input `%U'",
802  format_unformat_error, line_input);
803  goto done;
804  }
805  }
806 
807  if (num_m_args < 4)
808  {
809  error = clib_error_return (0, "mandatory argument(s) missing");
810  goto done;
811  }
812 
813  if (ipv4_set && ipv6_set)
814  return clib_error_return (0, "both IPv4 and IPv6 addresses specified");
815 
816  a.is_ip6 = ipv6_set;
817 
818  clib_memcpy (a.local_crypto_key, lck.data, lck.len);
819  a.local_crypto_key_len = lck.len;
820  clib_memcpy (a.remote_crypto_key, rck.data, rck.len);
821  a.remote_crypto_key_len = rck.len;
822 
823  clib_memcpy (a.local_integ_key, lik.data, lik.len);
824  a.local_integ_key_len = lck.len;
825  clib_memcpy (a.remote_integ_key, rik.data, rik.len);
826  a.remote_integ_key_len = rck.len;
827 
828  rv = ipsec_add_del_tunnel_if (&a);
829 
830  switch (rv)
831  {
832  case 0:
833  break;
834  case VNET_API_ERROR_INVALID_VALUE:
835  if (a.is_add)
836  error = clib_error_return (0,
837  "IPSec tunnel interface already exists...");
838  else
839  error = clib_error_return (0, "IPSec tunnel interface not exists...");
840  goto done;
841  default:
842  error = clib_error_return (0, "ipsec_register_interface returned %d",
843  rv);
844  goto done;
845  }
846 
847 done:
848  unformat_free (line_input);
849 
850  return error;
851 }
852 
853 /* *INDENT-OFF* */
854 VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
855  .path = "create ipsec tunnel",
856  .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> "
857  "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] [use-esn] [use-anti-replay] "
858  "[tx-table <table-id>]",
859  .function = create_ipsec_tunnel_command_fn,
860 };
861 /* *INDENT-ON* */
862 
863 static clib_error_t *
865  unformat_input_t * input, vlib_cli_command_t * cmd)
866 {
867  unformat_input_t _line_input, *line_input = &_line_input;
868  u32 sw_if_index, is_del, sa_in, sa_out, *sa_ins = NULL;
869  vnet_main_t *vnm;
870 
871  is_del = 0;
872  sw_if_index = ~0;
873  vnm = vnet_get_main ();
874 
875  if (!unformat_user (input, unformat_line_input, line_input))
876  return 0;
877 
878  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
879  {
880  if (unformat (line_input, "del"))
881  is_del = 1;
882  else if (unformat (line_input, "add"))
883  is_del = 0;
884  else if (unformat (line_input, "sa-in %d", &sa_in))
885  vec_add1 (sa_ins, sa_in);
886  else if (unformat (line_input, "sa-out %d", &sa_out))
887  ;
888  else if (unformat (line_input, "%U",
889  unformat_vnet_sw_interface, vnm, &sw_if_index))
890  ;
891  else
892  return (clib_error_return (0, "unknown input '%U'",
893  format_unformat_error, line_input));
894  }
895 
896  if (!is_del)
897  ipsec_tun_protect_update (sw_if_index, sa_out, sa_ins);
898 
899  unformat_free (line_input);
900  return NULL;
901 }
902 
903 /**
904  * Protect tunnel with IPSEC
905  */
906 /* *INDENT-OFF* */
907 VLIB_CLI_COMMAND (ipsec_tun_protect_cmd_node, static) =
908 {
909  .path = "ipsec tunnel protect",
910  .function = ipsec_tun_protect_cmd,
911  .short_help = "ipsec tunnel protect <interface> input-sa <SA> output-sa <SA>",
912  // this is not MP safe
913 };
914 /* *INDENT-ON* */
915 
916 static walk_rc_t
918 {
919  vlib_cli_output (ctx, "%U", format_ipsec_tun_protect, itpi);
920 
921  return (WALK_CONTINUE);
922 }
923 
924 static clib_error_t *
926  unformat_input_t * input, vlib_cli_command_t * cmd)
927 {
929 
930  return NULL;
931 }
932 
933 /**
934  * show IPSEC tunnel protection
935  */
936 /* *INDENT-OFF* */
937 VLIB_CLI_COMMAND (ipsec_tun_protect_show_node, static) =
938 {
939  .path = "show ipsec protect",
940  .function = ipsec_tun_protect_show,
941  .short_help = "show ipsec protect",
942 };
943 /* *INDENT-ON* */
944 
945 static clib_error_t *
947  unformat_input_t * input,
948  vlib_cli_command_t * cmd)
949 {
950  ipsec_main_t *im = &ipsec_main;
951 
952  {
954  ipsec4_tunnel_key_t key;
955 
956  vlib_cli_output (vm, "IPv4:");
957 
958  /* *INDENT-OFF* */
959  hash_foreach(key.as_u64, value.as_u64, im->tun4_protect_by_key,
960  ({
961  vlib_cli_output (vm, " %U", format_ipsec4_tunnel_key, &key);
962  vlib_cli_output (vm, " tun:%d sa:%d", value.tun_index, value.sa_index);
963  }));
964  /* *INDENT-ON* */
965  }
966 
967  {
969  ipsec6_tunnel_key_t *key;
970 
971  vlib_cli_output (vm, "IPv6:");
972 
973  /* *INDENT-OFF* */
975  ({
976  vlib_cli_output (vm, " %U", format_ipsec6_tunnel_key, key);
977  vlib_cli_output (vm, " tun:%d sa:%d", value.tun_index, value.sa_index);
978  }));
979  /* *INDENT-ON* */
980  }
981 
982  return NULL;
983 }
984 
985 /**
986  * show IPSEC tunnel protection hash tables
987  */
988 /* *INDENT-OFF* */
989 VLIB_CLI_COMMAND (ipsec_tun_protect_hash_show_node, static) =
990 {
991  .path = "show ipsec protect-hash",
992  .function = ipsec_tun_protect_hash_show,
993  .short_help = "show ipsec protect-hash",
994 };
995 /* *INDENT-ON* */
996 
997 clib_error_t *
999 {
1000  return 0;
1001 }
1002 
1004 
1005 
1006 /*
1007  * fd.io coding-style-patch-verification: ON
1008  *
1009  * Local Variables:
1010  * eval: (c-set-style "gnu")
1011  * End:
1012  */
static clib_error_t * ipsec_select_backend_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:630
ipsec_spd_t * spds
Definition: ipsec.h:95
u32 flags
Definition: vhost_user.h:141
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:102
uword * tun6_protect_by_key
Definition: ipsec.h:119
a
Definition: bitmap.h:538
vnet_main_t * vnet_get_main(void)
Definition: misc.c:46
ip46_address_t local_ip
Definition: ipsec_if.h:38
ipsec_integ_alg_t
Definition: ipsec_sa.h:58
ip46_address_range_t laddr
#define NULL
Definition: clib.h:58
static clib_error_t * show_ipsec_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:495
int ipsec_policy_mk_type(bool is_outbound, bool is_ipv6, ipsec_policy_action_t action, ipsec_spd_policy_type_t *type)
static clib_error_t * create_ipsec_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:718
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:41
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:522
ipsec_protocol_t
Definition: ipsec_sa.h:66
int ipsec_add_del_tunnel_if(ipsec_add_del_tunnel_args_t *args)
Definition: ipsec_if.c:214
void ipsec_sa_clear(index_t sai)
Definition: ipsec_sa.c:348
uword unformat_user(unformat_input_t *input, unformat_function_t *func,...)
Definition: unformat.c:989
clib_memset(h->entries, 0, sizeof(h->entries[0])*entries)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
Definition: ipsec.c:218
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
unformat_function_t unformat_vnet_sw_interface
A Secruity Policy Database.
Definition: ipsec_spd.h:44
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
Definition: ipsec_tun.c:379
unsigned char u8
Definition: types.h:56
uword * spd_index_by_sw_if_index
Definition: ipsec.h:112
#define clib_memcpy(d, s, n)
Definition: string.h:180
enum walk_rc_t_ walk_rc_t
Walk return code.
void vlib_clear_combined_counters(vlib_combined_counter_main_t *cm)
Clear a collection of combined counters.
Definition: counter.c:61
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:493
unformat_function_t unformat_ip4_address
Definition: format.h:70
vl_api_interface_index_t sw_if_index
Definition: gre.api:50
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:173
ipsec_main_t ipsec_main
Definition: ipsec.c:28
u8 * format_ipsec_tun_protect(u8 *s, va_list *args)
Definition: ipsec_format.c:368
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
Definition: ipsec.c:241
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
uword unformat_ipsec_crypto_alg(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:96
#define clib_error_return(e, args...)
Definition: error.h:99
int ipsec_sa_unlock_id(u32 id)
Definition: ipsec_sa.c:332
port_range_t rport
u8 * format_ipsec_sa(u8 *s, va_list *args)
Definition: ipsec_format.c:269
unsigned int u32
Definition: types.h:88
static void ipsec_tunnel_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:389
u32 sa_in[n_sa_in]
Definition: ipsec.api:352
static clib_error_t * ipsec_tun_protect_show(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:925
unformat_function_t unformat_line_input
Definition: format.h:283
u32 sa_out
Definition: ipsec.api:350
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
u8 * format_ipsec_spd(u8 *s, va_list *args)
Definition: ipsec_format.c:203
static clib_error_t * ipsec_policy_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:226
long ctx[MAX_CONNS]
Definition: main.c:144
vnet_main_t * vnet_main
Definition: ipsec.h:108
struct _unformat_input_t unformat_input_t
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add, u32 *stat_index)
Add/Delete a SPD.
static clib_error_t * set_interface_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:28
ip46_address_t remote_ip
Definition: ipsec_if.h:38
u8 * format_ipsec_tunnel(u8 *s, va_list *args)
Definition: ipsec_format.c:334
clib_error_t * ipsec_rsc_in_use(ipsec_main_t *im)
Definition: ipsec.c:201
static clib_error_t * ipsec_show_backends_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:563
ipsec_spd_policy_type_t type
#define hash_foreach_mem(key_var, value_var, h, body)
Definition: hash.h:461
static void ipsec_spd_bindings_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:371
static clib_error_t * clear_ipsec_counters_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:699
#define ip46_address_is_ip4(ip46)
Definition: ip6_packet.h:88
unformat_function_t unformat_ip6_address
Definition: format.h:91
ipsec_crypto_alg_t crypto_alg
Definition: ipsec_if.h:41
#define UNFORMAT_END_OF_INPUT
Definition: format.h:145
vlib_main_t * vm
Definition: buffer.c:312
int ipsec_tun_protect_update(u32 sw_if_index, u32 sa_out, u32 *sas_in)
Definition: ipsec_tun.c:233
ipsec_ah_backend_t * ah_backends
Definition: ipsec.h:150
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:998
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:341
static clib_error_t * clear_ipsec_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:447
ipsec_policy_action_t policy
ip46_address_t start
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
u8 is_outbound
Definition: ipsec.api:93
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
Definition: pool.h:283
A Secruity Policy.
#define VLIB_CLI_COMMAND(x,...)
Definition: cli.h:155
static void ipsec_spd_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:359
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
Definition: ipsec_sa.c:27
u8 value
Definition: qos.api:53
u32 spi
Definition: ipsec.api:272
ipsec_integ_alg_t integ_alg
Definition: ipsec_if.h:46
ipsec_sa_t * sad
Definition: ipsec.h:97
static clib_error_t * show_ipsec_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:424
uword unformat_ipsec_integ_alg(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:128
static clib_error_t * ipsec_tun_protect_cmd(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:864
u8 * format_ipsec_policy_action(u8 *s, va_list *args)
Definition: ipsec_format.c:28
uword unformat_ipsec_policy_action(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:64
unformat_function_t unformat_ip46_address
Definition: format.h:65
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index)
Definition: ipsec_sa.c:127
ip46_address_range_t raddr
static clib_error_t * show_ipsec_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:531
static void unformat_free(unformat_input_t *i)
Definition: format.h:163
ipsec_crypto_alg_t
Definition: ipsec_sa.h:36
typedef key
Definition: ipsec.api:245
static clib_error_t * ipsec_sa_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:73
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
Definition: ipsec_spd.c:63
static clib_error_t * ipsec_tun_protect_hash_show(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:946
u8 * format_unformat_error(u8 *s, va_list *va)
Definition: unformat.c:91
port_range_t lport
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
Definition: ipsec_spd.c:20
static clib_error_t * show_ipsec_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:402
static walk_rc_t ipsec_tun_protect_show_one(index_t itpi, void *ctx)
Definition: ipsec_cli.c:917
u32 id
Definition: udp.api:45
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:538
static clib_error_t * ipsec_spd_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: ipsec_cli.c:173
u32 salt
Definition: ipsec.api:287
uword unformat_ipsec_key(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:242
static void ipsec_sa_show_all(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec_cli.c:347
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
Definition: cli.c:768
uword unformat(unformat_input_t *i, const char *fmt,...)
Definition: unformat.c:978
vl_api_fib_path_nh_proto_t proto
Definition: fib_types.api:125
static uword unformat_check_input(unformat_input_t *i)
Definition: format.h:171
uword * tun4_protect_by_key
Definition: ipsec.h:118