2 * decap.c : IPSec tunnel support
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/fib/fib.h>
24 #include <vnet/ipsec/ipsec.h>
27 set_interface_spd_command_fn (vlib_main_t * vm,
28 unformat_input_t * input,
29 vlib_cli_command_t * cmd)
31 unformat_input_t _line_input, *line_input = &_line_input;
32 ipsec_main_t *im = &ipsec_main;
33 u32 sw_if_index = (u32) ~ 0;
36 clib_error_t *error = NULL;
38 if (!unformat_user (input, unformat_line_input, line_input))
42 (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main,
43 &sw_if_index, &spd_id))
45 else if (unformat (line_input, "del"))
49 error = clib_error_return (0, "parse error: '%U'",
50 format_unformat_error, line_input);
54 ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
57 unformat_free (line_input);
63 VLIB_CLI_COMMAND (set_interface_spd_command, static) = {
64 .path = "set interface ipsec spd",
66 "set interface ipsec spd <int> <id>",
67 .function = set_interface_spd_command_fn,
72 ipsec_sa_add_del_command_fn (vlib_main_t * vm,
73 unformat_input_t * input,
74 vlib_cli_command_t * cmd)
76 ipsec_main_t *im = &ipsec_main;
77 unformat_input_t _line_input, *line_input = &_line_input;
81 clib_error_t *error = NULL;
83 clib_memset (&sa, 0, sizeof (sa));
84 sa.tx_fib_index = ~((u32) 0); /* Only supported for ipsec interfaces */
86 if (!unformat_user (input, unformat_line_input, line_input))
89 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
91 if (unformat (line_input, "add %u", &sa.id))
93 else if (unformat (line_input, "del %u", &sa.id))
95 else if (unformat (line_input, "spi %u", &sa.spi))
97 else if (unformat (line_input, "esp"))
98 sa.protocol = IPSEC_PROTOCOL_ESP;
99 else if (unformat (line_input, "ah"))
101 sa.protocol = IPSEC_PROTOCOL_AH;
104 if (unformat (line_input, "crypto-key %U", unformat_hex_string, &ck))
105 sa.crypto_key_len = vec_len (ck);
108 (line_input, "crypto-alg %U", unformat_ipsec_crypto_alg,
111 if (sa.crypto_alg < IPSEC_CRYPTO_ALG_NONE ||
112 sa.crypto_alg >= IPSEC_CRYPTO_N_ALG)
114 error = clib_error_return (0, "unsupported crypto-alg: '%U'",
115 format_ipsec_crypto_alg,
121 if (unformat (line_input, "integ-key %U", unformat_hex_string, &ik))
122 sa.integ_key_len = vec_len (ik);
123 else if (unformat (line_input, "integ-alg %U", unformat_ipsec_integ_alg,
126 if (sa.integ_alg < IPSEC_INTEG_ALG_NONE ||
127 sa.integ_alg >= IPSEC_INTEG_N_ALG)
129 error = clib_error_return (0, "unsupported integ-alg: '%U'",
130 format_ipsec_integ_alg,
135 else if (unformat (line_input, "tunnel-src %U",
136 unformat_ip4_address, &sa.tunnel_src_addr.ip4))
138 else if (unformat (line_input, "tunnel-dst %U",
139 unformat_ip4_address, &sa.tunnel_dst_addr.ip4))
141 else if (unformat (line_input, "tunnel-src %U",
142 unformat_ip6_address, &sa.tunnel_src_addr.ip6))
145 sa.is_tunnel_ip6 = 1;
147 else if (unformat (line_input, "tunnel-dst %U",
148 unformat_ip6_address, &sa.tunnel_dst_addr.ip6))
151 sa.is_tunnel_ip6 = 1;
153 else if (unformat (line_input, "udp-encap"))
159 error = clib_error_return (0, "parse error: '%U'",
160 format_unformat_error, line_input);
165 if (sa.crypto_key_len > sizeof (sa.crypto_key))
166 sa.crypto_key_len = sizeof (sa.crypto_key);
168 if (sa.integ_key_len > sizeof (sa.integ_key))
169 sa.integ_key_len = sizeof (sa.integ_key);
172 memcpy (sa.crypto_key, ck, sa.crypto_key_len);
175 memcpy (sa.integ_key, ik, sa.integ_key_len);
179 error = ipsec_check_support_cb (im, &sa);
184 ipsec_add_del_sa (vm, &sa, is_add);
187 unformat_free (line_input);
193 VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = {
196 "ipsec sa [add|del]",
197 .function = ipsec_sa_add_del_command_fn,
201 static clib_error_t *
202 ipsec_spd_add_del_command_fn (vlib_main_t * vm,
203 unformat_input_t * input,
204 vlib_cli_command_t * cmd)
206 unformat_input_t _line_input, *line_input = &_line_input;
209 clib_error_t *error = NULL;
211 if (!unformat_user (input, unformat_line_input, line_input))
214 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
216 if (unformat (line_input, "add"))
218 else if (unformat (line_input, "del"))
220 else if (unformat (line_input, "%u", &spd_id))
224 error = clib_error_return (0, "parse error: '%U'",
225 format_unformat_error, line_input);
232 error = clib_error_return (0, "please specify SPD ID");
236 ipsec_add_del_spd (vm, spd_id, is_add);
239 unformat_free (line_input);
245 VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = {
248 "ipsec spd [add|del] <id>",
249 .function = ipsec_spd_add_del_command_fn,
254 static clib_error_t *
255 ipsec_policy_add_del_command_fn (vlib_main_t * vm,
256 unformat_input_t * input,
257 vlib_cli_command_t * cmd)
259 unformat_input_t _line_input, *line_input = &_line_input;
264 clib_error_t *error = NULL;
266 clib_memset (&p, 0, sizeof (p));
267 p.lport.stop = p.rport.stop = ~0;
268 p.laddr.stop.ip4.as_u32 = p.raddr.stop.ip4.as_u32 = (u32) ~ 0;
269 p.laddr.stop.ip6.as_u64[0] = p.laddr.stop.ip6.as_u64[1] = (u64) ~ 0;
270 p.raddr.stop.ip6.as_u64[0] = p.raddr.stop.ip6.as_u64[1] = (u64) ~ 0;
272 if (!unformat_user (input, unformat_line_input, line_input))
275 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
277 if (unformat (line_input, "add"))
279 else if (unformat (line_input, "del"))
281 else if (unformat (line_input, "spd %u", &p.id))
283 else if (unformat (line_input, "inbound"))
285 else if (unformat (line_input, "outbound"))
287 else if (unformat (line_input, "priority %d", &p.priority))
289 else if (unformat (line_input, "protocol %u", &tmp))
290 p.protocol = (u8) tmp;
293 (line_input, "action %U", unformat_ipsec_policy_action,
296 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
298 error = clib_error_return (0, "unsupported action: 'resolve'");
302 else if (unformat (line_input, "sa %u", &p.sa_id))
304 else if (unformat (line_input, "local-ip-range %U - %U",
305 unformat_ip4_address, &p.laddr.start.ip4,
306 unformat_ip4_address, &p.laddr.stop.ip4))
308 else if (unformat (line_input, "remote-ip-range %U - %U",
309 unformat_ip4_address, &p.raddr.start.ip4,
310 unformat_ip4_address, &p.raddr.stop.ip4))
312 else if (unformat (line_input, "local-ip-range %U - %U",
313 unformat_ip6_address, &p.laddr.start.ip6,
314 unformat_ip6_address, &p.laddr.stop.ip6))
319 else if (unformat (line_input, "remote-ip-range %U - %U",
320 unformat_ip6_address, &p.raddr.start.ip6,
321 unformat_ip6_address, &p.raddr.stop.ip6))
326 else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2))
332 if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2))
339 error = clib_error_return (0, "parse error: '%U'",
340 format_unformat_error, line_input);
345 /* Check if SA is for IPv6/AH which is not supported. Return error if TRUE. */
349 ipsec_main_t *im = &ipsec_main;
351 p1 = hash_get (im->sa_index_by_sa_id, p.sa_id);
355 clib_error_return (0, "SA with index %u not found", p.sa_id);
358 sa = pool_elt_at_index (im->sad, p1[0]);
359 if (sa && sa->protocol == IPSEC_PROTOCOL_AH && is_add && p.is_ipv6)
361 error = clib_error_return (0, "AH not supported for IPV6: '%U'",
362 format_unformat_error, line_input);
366 ipsec_add_del_policy (vm, &p, is_add);
370 ipsec_add_del_policy (vm, &p, is_add);
374 unformat_free (line_input);
380 VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = {
381 .path = "ipsec policy",
383 "ipsec policy [add|del] spd <id> priority <n> ",
384 .function = ipsec_policy_add_del_command_fn,
388 static clib_error_t *
389 set_ipsec_sa_key_command_fn (vlib_main_t * vm,
390 unformat_input_t * input,
391 vlib_cli_command_t * cmd)
393 unformat_input_t _line_input, *line_input = &_line_input;
396 clib_error_t *error = NULL;
398 clib_memset (&sa, 0, sizeof (sa));
400 if (!unformat_user (input, unformat_line_input, line_input))
403 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
405 if (unformat (line_input, "%u", &sa.id))
408 if (unformat (line_input, "crypto-key %U", unformat_hex_string, &ck))
409 sa.crypto_key_len = vec_len (ck);
411 if (unformat (line_input, "integ-key %U", unformat_hex_string, &ik))
412 sa.integ_key_len = vec_len (ik);
415 error = clib_error_return (0, "parse error: '%U'",
416 format_unformat_error, line_input);
421 if (sa.crypto_key_len > sizeof (sa.crypto_key))
422 sa.crypto_key_len = sizeof (sa.crypto_key);
424 if (sa.integ_key_len > sizeof (sa.integ_key))
425 sa.integ_key_len = sizeof (sa.integ_key);
428 strncpy ((char *) sa.crypto_key, (char *) ck, sa.crypto_key_len);
431 strncpy ((char *) sa.integ_key, (char *) ik, sa.integ_key_len);
433 ipsec_set_sa_key (vm, &sa);
436 unformat_free (line_input);
442 VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = {
443 .path = "set ipsec sa",
445 "set ipsec sa <id> crypto-key <key> integ-key <key>",
446 .function = set_ipsec_sa_key_command_fn,
450 static clib_error_t *
451 show_ipsec_command_fn (vlib_main_t * vm,
452 unformat_input_t * input, vlib_cli_command_t * cmd)
457 ipsec_main_t *im = &ipsec_main;
459 ipsec_tunnel_if_t *t;
460 vnet_hw_interface_t *hi;
463 u32 tx_table_id, spd_id, sw_if_index;
466 pool_foreach (sa, im->sad, ({
468 vlib_cli_output(vm, "sa %u spi %u mode %s protocol %s%s%s%s", sa->id, sa->spi,
469 sa->is_tunnel ? "tunnel" : "transport",
470 sa->protocol ? "esp" : "ah",
471 sa->udp_encap ? " udp-encap-enabled" : "",
472 sa->use_anti_replay ? " anti-replay" : "",
473 sa->use_esn ? " extended-sequence-number" : "");
474 if (sa->protocol == IPSEC_PROTOCOL_ESP) {
475 vlib_cli_output(vm, " crypto alg %U%s%U integrity alg %U%s%U",
476 format_ipsec_crypto_alg, sa->crypto_alg,
477 sa->crypto_alg ? " key " : "",
478 format_hex_bytes, sa->crypto_key, sa->crypto_key_len,
479 format_ipsec_integ_alg, sa->integ_alg,
480 sa->integ_alg ? " key " : "",
481 format_hex_bytes, sa->integ_key, sa->integ_key_len);
483 if (sa->is_tunnel && sa->is_tunnel_ip6) {
484 vlib_cli_output(vm, " tunnel src %U dst %U",
485 format_ip6_address, &sa->tunnel_src_addr.ip6,
486 format_ip6_address, &sa->tunnel_dst_addr.ip6);
487 } else if (sa->is_tunnel) {
488 vlib_cli_output(vm, " tunnel src %U dst %U",
489 format_ip4_address, &sa->tunnel_src_addr.ip4,
490 format_ip4_address, &sa->tunnel_dst_addr.ip4);
497 pool_foreach (spd, im->spds, ({
498 vlib_cli_output(vm, "spd %u", spd->id);
500 vlib_cli_output(vm, " outbound policies");
501 vec_foreach(i, spd->ipv4_outbound_policies)
503 p = pool_elt_at_index(spd->policies, *i);
504 vec_reset_length(protocol);
505 vec_reset_length(policy);
507 protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
509 protocol = format(protocol, "any");
511 if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
512 policy = format(policy, " sa %u", p->sa_id);
515 vlib_cli_output(vm, " priority %d action %U protocol %v%v",
516 p->priority, format_ipsec_policy_action, p->policy,
518 vlib_cli_output(vm, " local addr range %U - %U port range %u - %u",
519 format_ip4_address, &p->laddr.start.ip4,
520 format_ip4_address, &p->laddr.stop.ip4,
521 p->lport.start, p->lport.stop);
522 vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u",
523 format_ip4_address, &p->raddr.start.ip4,
524 format_ip4_address, &p->raddr.stop.ip4,
525 p->rport.start, p->rport.stop);
526 vlib_cli_output(vm, " packets %u bytes %u", p->counter.packets,
529 vec_foreach(i, spd->ipv6_outbound_policies)
531 p = pool_elt_at_index(spd->policies, *i);
532 vec_reset_length(protocol);
533 vec_reset_length(policy);
535 protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
537 protocol = format(protocol, "any");
539 if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
540 policy = format(policy, " sa %u", p->sa_id);
542 vlib_cli_output(vm, " priority %d action %U protocol %v%v",
543 p->priority, format_ipsec_policy_action, p->policy,
545 vlib_cli_output(vm, " local addr range %U - %U port range %u - %u",
546 format_ip6_address, &p->laddr.start.ip6,
547 format_ip6_address, &p->laddr.stop.ip6,
548 p->lport.start, p->lport.stop);
549 vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u",
550 format_ip6_address, &p->raddr.start.ip6,
551 format_ip6_address, &p->raddr.stop.ip6,
552 p->rport.start, p->rport.stop);
553 vlib_cli_output(vm, " packets %u bytes %u", p->counter.packets,
556 vlib_cli_output(vm, " inbound policies");
557 vec_foreach(i, spd->ipv4_inbound_protect_policy_indices)
559 p = pool_elt_at_index(spd->policies, *i);
560 vec_reset_length(protocol);
561 vec_reset_length(policy);
563 protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
565 protocol = format(protocol, "any");
567 if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
568 policy = format(policy, " sa %u", p->sa_id);
570 vlib_cli_output(vm, " priority %d action %U protocol %v%v",
571 p->priority, format_ipsec_policy_action, p->policy,
573 vlib_cli_output(vm, " local addr range %U - %U port range %u - %u",
574 format_ip4_address, &p->laddr.start.ip4,
575 format_ip4_address, &p->laddr.stop.ip4,
576 p->lport.start, p->lport.stop);
577 vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u",
578 format_ip4_address, &p->raddr.start.ip4,
579 format_ip4_address, &p->raddr.stop.ip4,
580 p->rport.start, p->rport.stop);
581 vlib_cli_output(vm, " packets %u bytes %u", p->counter.packets,
584 vec_foreach(i, spd->ipv4_inbound_policy_discard_and_bypass_indices)
586 p = pool_elt_at_index(spd->policies, *i);
587 vec_reset_length(protocol);
588 vec_reset_length(policy);
590 protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
592 protocol = format(protocol, "any");
594 if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
595 policy = format(policy, " sa %u", p->sa_id);
597 vlib_cli_output(vm, " priority %d action %U protocol %v%v",
598 p->priority, format_ipsec_policy_action, p->policy,
600 vlib_cli_output(vm, " local addr range %U - %U port range %u - %u",
601 format_ip4_address, &p->laddr.start.ip4,
602 format_ip4_address, &p->laddr.stop.ip4,
603 p->lport.start, p->lport.stop);
604 vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u",
605 format_ip4_address, &p->raddr.start.ip4,
606 format_ip4_address, &p->raddr.stop.ip4,
607 p->rport.start, p->rport.stop);
608 vlib_cli_output(vm, " packets %u bytes %u", p->counter.packets,
611 vec_foreach(i, spd->ipv6_inbound_protect_policy_indices)
613 p = pool_elt_at_index(spd->policies, *i);
614 vec_reset_length(protocol);
615 vec_reset_length(policy);
617 protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
619 protocol = format(protocol, "any");
621 if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
622 policy = format(policy, " sa %u", p->sa_id);
624 vlib_cli_output(vm, " priority %d action %U protocol %v%v",
625 p->priority, format_ipsec_policy_action, p->policy,
627 vlib_cli_output(vm, " local addr range %U - %U port range %u - %u",
628 format_ip6_address, &p->laddr.start.ip6,
629 format_ip6_address, &p->laddr.stop.ip6,
630 p->lport.start, p->lport.stop);
631 vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u",
632 format_ip6_address, &p->raddr.start.ip6,
633 format_ip6_address, &p->raddr.stop.ip6,
634 p->rport.start, p->rport.stop);
635 vlib_cli_output(vm, " packets %u bytes %u", p->counter.packets,
638 vec_foreach(i, spd->ipv6_inbound_policy_discard_and_bypass_indices)
640 p = pool_elt_at_index(spd->policies, *i);
641 vec_reset_length(protocol);
642 vec_reset_length(policy);
644 protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
646 protocol = format(protocol, "any");
648 if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
649 policy = format(policy, " sa %u", p->sa_id);
651 vlib_cli_output(vm, " priority %d action %U protocol %v%v",
652 p->priority, format_ipsec_policy_action, p->policy,
654 vlib_cli_output(vm, " local addr range %U - %U port range %u - %u",
655 format_ip6_address, &p->laddr.start.ip6,
656 format_ip6_address, &p->laddr.stop.ip6,
657 p->lport.start, p->lport.stop);
658 vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u",
659 format_ip6_address, &p->raddr.start.ip6,
660 format_ip6_address, &p->raddr.stop.ip6,
661 p->rport.start, p->rport.stop);
662 vlib_cli_output(vm, " packets %u bytes %u", p->counter.packets,
668 vlib_cli_output (vm, "SPD Bindings:");
670 hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
671 vlib_cli_output (vm, " %d -> %U", spd_id,
672 format_vnet_sw_if_index_name, im->vnet_main,
678 vlib_cli_output (vm, "tunnel interfaces");
680 pool_foreach (t, im->tunnel_interfaces, ({
681 if (t->hw_if_index == ~0)
683 hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
684 vlib_cli_output(vm, " %s seq", hi->name);
685 sa = pool_elt_at_index(im->sad, t->output_sa_index);
687 tx_table_id = fib_table_get_table_id(sa->tx_fib_index, FIB_PROTOCOL_IP4);
689 vlib_cli_output(vm, " seq %u seq-hi %u esn %u anti-replay %u udp-encap %u tx-table %u",
690 sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay, sa->udp_encap, tx_table_id);
691 vlib_cli_output(vm, " local-spi %u local-ip %U", sa->spi,
692 format_ip4_address, &sa->tunnel_src_addr.ip4);
693 vlib_cli_output(vm, " local-crypto %U %U",
694 format_ipsec_crypto_alg, sa->crypto_alg,
695 format_hex_bytes, sa->crypto_key, sa->crypto_key_len);
696 vlib_cli_output(vm, " local-integrity %U %U",
697 format_ipsec_integ_alg, sa->integ_alg,
698 format_hex_bytes, sa->integ_key, sa->integ_key_len);
699 sa = pool_elt_at_index(im->sad, t->input_sa_index);
700 vlib_cli_output(vm, " last-seq %u last-seq-hi %u esn %u anti-replay %u window %U",
701 sa->last_seq, sa->last_seq_hi, sa->use_esn,
703 format_ipsec_replay_window, sa->replay_window);
704 vlib_cli_output(vm, " remote-spi %u remote-ip %U", sa->spi,
705 format_ip4_address, &sa->tunnel_src_addr.ip4);
706 vlib_cli_output(vm, " remote-crypto %U %U",
707 format_ipsec_crypto_alg, sa->crypto_alg,
708 format_hex_bytes, sa->crypto_key, sa->crypto_key_len);
709 vlib_cli_output(vm, " remote-integrity %U %U",
710 format_ipsec_integ_alg, sa->integ_alg,
711 format_hex_bytes, sa->integ_key, sa->integ_key_len);
720 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
721 .path = "show ipsec",
722 .short_help = "show ipsec [backends]",
723 .function = show_ipsec_command_fn,
727 static clib_error_t *
728 ipsec_show_backends_command_fn (vlib_main_t * vm,
729 unformat_input_t * input,
730 vlib_cli_command_t * cmd)
732 ipsec_main_t *im = &ipsec_main;
735 (void) unformat (input, "verbose %u", &verbose);
737 vlib_cli_output (vm, "IPsec AH backends available:");
738 u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
739 ipsec_ah_backend_t *ab;
741 pool_foreach (ab, im->ah_backends, {
742 s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
743 ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
746 n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
747 s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
748 n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
749 s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
750 n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
751 s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
752 n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
753 s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
757 vlib_cli_output (vm, "%v", s);
759 vlib_cli_output (vm, "IPsec ESP backends available:");
760 s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
761 ipsec_esp_backend_t *eb;
763 pool_foreach (eb, im->esp_backends, {
764 s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
765 eb - im->esp_backends == im->esp_current_backend ? "yes"
769 n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
770 s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
771 n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
772 s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
773 n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
774 s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
775 n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
776 s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
780 vlib_cli_output (vm, "%v", s);
787 VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
788 .path = "show ipsec backends",
789 .short_help = "show ipsec backends",
790 .function = ipsec_show_backends_command_fn,
794 static clib_error_t *
795 ipsec_select_backend_command_fn (vlib_main_t * vm,
796 unformat_input_t * input,
797 vlib_cli_command_t * cmd)
800 ipsec_main_t *im = &ipsec_main;
802 if (pool_elts (im->sad) > 0)
804 return clib_error_return (0,
805 "Cannot change IPsec backend, while %u SA entries are configured",
806 pool_elts (im->sad));
809 unformat_input_t _line_input, *line_input = &_line_input;
810 /* Get a line of input. */
811 if (!unformat_user (input, unformat_line_input, line_input))
814 if (unformat (line_input, "ah"))
816 if (unformat (line_input, "%u", &backend_index))
818 if (ipsec_select_ah_backend (im, backend_index) < 0)
820 return clib_error_return (0, "Invalid AH backend index `%u'",
826 return clib_error_return (0, "Invalid backend index `%U'",
827 format_unformat_error, line_input);
830 else if (unformat (line_input, "esp"))
832 if (unformat (line_input, "%u", &backend_index))
834 if (ipsec_select_esp_backend (im, backend_index) < 0)
836 return clib_error_return (0, "Invalid ESP backend index `%u'",
842 return clib_error_return (0, "Invalid backend index `%U'",
843 format_unformat_error, line_input);
848 return clib_error_return (0, "Unknown input `%U'",
849 format_unformat_error, line_input);
856 VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
857 .path = "ipsec select backend",
858 .short_help = "ipsec select backend <ah|esp> <backend index>",
859 .function = ipsec_select_backend_command_fn,
864 static clib_error_t *
865 clear_ipsec_counters_command_fn (vlib_main_t * vm,
866 unformat_input_t * input,
867 vlib_cli_command_t * cmd)
869 ipsec_main_t *im = &ipsec_main;
874 pool_foreach (spd, im->spds, ({
875 pool_foreach(p, spd->policies, ({
876 p->counter.packets = p->counter.bytes = 0;
885 VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
886 .path = "clear ipsec counters",
887 .short_help = "clear ipsec counters",
888 .function = clear_ipsec_counters_command_fn,
892 static clib_error_t *
893 create_ipsec_tunnel_command_fn (vlib_main_t * vm,
894 unformat_input_t * input,
895 vlib_cli_command_t * cmd)
897 unformat_input_t _line_input, *line_input = &_line_input;
898 ipsec_add_del_tunnel_args_t a;
901 clib_error_t *error = NULL;
903 clib_memset (&a, 0, sizeof (a));
906 /* Get a line of input. */
907 if (!unformat_user (input, unformat_line_input, line_input))
910 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
913 (line_input, "local-ip %U", unformat_ip4_address, &a.local_ip))
917 (line_input, "remote-ip %U", unformat_ip4_address, &a.remote_ip))
919 else if (unformat (line_input, "local-spi %u", &a.local_spi))
921 else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
923 else if (unformat (line_input, "instance %u", &a.show_instance))
925 else if (unformat (line_input, "del"))
927 else if (unformat (line_input, "udp-encap"))
929 else if (unformat (line_input, "tx-table %u", &a.tx_table_id))
933 error = clib_error_return (0, "unknown input `%U'",
934 format_unformat_error, line_input);
941 error = clib_error_return (0, "mandatory argument(s) missing");
945 rv = ipsec_add_del_tunnel_if (&a);
951 case VNET_API_ERROR_INVALID_VALUE:
953 error = clib_error_return (0,
954 "IPSec tunnel interface already exists...");
956 error = clib_error_return (0, "IPSec tunnel interface not exists...");
959 error = clib_error_return (0, "ipsec_register_interface returned %d",
965 unformat_free (line_input);
971 VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
972 .path = "create ipsec tunnel",
973 .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> "
974 "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] "
975 "[tx-table <table-id>]",
976 .function = create_ipsec_tunnel_command_fn,
980 static clib_error_t *
981 set_interface_key_command_fn (vlib_main_t * vm,
982 unformat_input_t * input,
983 vlib_cli_command_t * cmd)
985 unformat_input_t _line_input, *line_input = &_line_input;
986 ipsec_main_t *im = &ipsec_main;
987 ipsec_if_set_key_type_t type = IPSEC_IF_SET_KEY_TYPE_NONE;
988 u32 hw_if_index = (u32) ~ 0;
991 clib_error_t *error = NULL;
993 if (!unformat_user (input, unformat_line_input, line_input))
996 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
998 if (unformat (line_input, "%U",
999 unformat_vnet_hw_interface, im->vnet_main, &hw_if_index))
1003 (line_input, "local crypto %U", unformat_ipsec_crypto_alg, &alg))
1004 type = IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO;
1007 (line_input, "remote crypto %U", unformat_ipsec_crypto_alg, &alg))
1008 type = IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO;
1011 (line_input, "local integ %U", unformat_ipsec_integ_alg, &alg))
1012 type = IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG;
1015 (line_input, "remote integ %U", unformat_ipsec_integ_alg, &alg))
1016 type = IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG;
1017 else if (unformat (line_input, "%U", unformat_hex_string, &key))
1021 error = clib_error_return (0, "parse error: '%U'",
1022 format_unformat_error, line_input);
1027 if (type == IPSEC_IF_SET_KEY_TYPE_NONE)
1029 error = clib_error_return (0, "unknown key type");
1033 if (alg > 0 && vec_len (key) == 0)
1035 error = clib_error_return (0, "key is not specified");
1039 if (hw_if_index == (u32) ~ 0)
1041 error = clib_error_return (0, "interface not specified");
1045 ipsec_set_interface_key (im->vnet_main, hw_if_index, type, alg, key);
1049 unformat_free (line_input);
1055 VLIB_CLI_COMMAND (set_interface_key_command, static) = {
1056 .path = "set interface ipsec key",
1058 "set interface ipsec key <int> <local|remote> <crypto|integ> <key type> <key>",
1059 .function = set_interface_key_command_fn,
1064 ipsec_cli_init (vlib_main_t * vm)
1069 VLIB_INIT_FUNCTION (ipsec_cli_init);
1073 * fd.io coding-style-patch-verification: ON
1076 * eval: (c-set-style "gnu")