uword
unformat_ipsec_crypto_alg (unformat_input_t * input, va_list * args)
{
- u32 *r = va_arg (*args, u32 *);
+ ipsec_crypto_alg_t *r = va_arg (*args, ipsec_crypto_alg_t *);
if (0);
#define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_CRYPTO_ALG_##f;
uword
unformat_ipsec_integ_alg (unformat_input_t * input, va_list * args)
{
- u32 *r = va_arg (*args, u32 *);
+ ipsec_integ_alg_t *r = va_arg (*args, ipsec_integ_alg_t *);
if (0);
#define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_INTEG_ALG_##f;
return s;
}
-u8 *
-format_ipsec_policy (u8 * s, va_list * args)
+static u8 *
+format_ipsec_policy_with_suffix (u8 *s, va_list *args, u8 *suffix)
{
u32 pi = va_arg (*args, u32);
ip46_type_t ip_type = IP46_TYPE_IP4;
pi, p->priority,
format_ipsec_policy_action, p->policy,
format_ipsec_policy_type, p->type);
- if (p->protocol)
+ if (p->protocol != IPSEC_POLICY_PROTOCOL_ANY)
{
s = format (s, "%U", format_ip_protocol, p->protocol);
}
{
s = format (s, " sa %u", p->sa_id);
}
+ if (suffix)
+ s = format (s, " %s", suffix);
+
if (p->is_ipv6)
{
ip_type = IP46_TYPE_IP6;
return (s);
}
+u8 *
+format_ipsec_policy (u8 *s, va_list *args)
+{
+ return format_ipsec_policy_with_suffix (s, args, 0);
+}
+
+u8 *
+format_ipsec_policy_fp (u8 *s, va_list *args)
+{
+ return format_ipsec_policy_with_suffix (s, args, (u8 *) "<fast-path>");
+}
+
u8 *
format_ipsec_spd (u8 * s, va_list * args)
{
s = format (s, "spd %u", spd->id);
-#define _(v, n) \
- s = format (s, "\n %s:", n); \
- vec_foreach(i, spd->policies[IPSEC_SPD_POLICY_##v]) \
- { \
- s = format (s, "\n %U", format_ipsec_policy, *i); \
- }
+#define _(v, n) \
+ s = format (s, "\n %s:", n); \
+ vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_##v]) \
+ { \
+ s = format (s, "\n %U", format_ipsec_policy, *i); \
+ } \
+ vec_foreach (i, spd->fp_spd.fp_policies[IPSEC_SPD_POLICY_##v]) \
+ { \
+ s = format (s, "\n %U", format_ipsec_policy_fp, *i); \
+ }
foreach_ipsec_spd_policy_type;
#undef _
return (s);
}
+u8 *
+format_ipsec_out_spd_flow_cache (u8 *s, va_list *args)
+{
+ ipsec_main_t *im = &ipsec_main;
+
+ s = format (s, "\nipv4-outbound-spd-flow-cache-entries: %u",
+ im->ipsec4_out_spd_flow_cache_entries);
+
+ return (s);
+}
+
+u8 *
+format_ipsec_in_spd_flow_cache (u8 *s, va_list *args)
+{
+ ipsec_main_t *im = &ipsec_main;
+
+ s = format (s, "\nipv4-inbound-spd-flow-cache-entries: %u",
+ im->ipsec4_in_spd_flow_cache_entries);
+
+ return (s);
+}
+
u8 *
format_ipsec_key (u8 * s, va_list * args)
{
{
u32 sai = va_arg (*args, u32);
ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t);
- ipsec_main_t *im = &ipsec_main;
vlib_counter_t counts;
- u32 tx_table_id;
+ counter_t lost;
ipsec_sa_t *sa;
- if (pool_is_free_index (im->sad, sai))
+ if (pool_is_free_index (ipsec_sa_pool, sai))
{
s = format (s, "No such SA index: %d", sai);
goto done;
}
- sa = pool_elt_at_index (im->sad, sai);
+ sa = ipsec_sa_get (sai);
s = format (s, "[%d] sa %u (0x%x) spi %u (0x%08x) protocol:%s flags:[%U]",
sai, sa->id, sa->id, sa->spi, sa->spi,
s = format (s, "\n locks %d", sa->node.fn_locks);
s = format (s, "\n salt 0x%x", clib_net_to_host_u32 (sa->salt));
- s = format (s, "\n thread-indices [encrypt:%d decrypt:%d]",
- sa->encrypt_thread_index, sa->decrypt_thread_index);
+ s = format (s, "\n thread-index:%d", sa->thread_index);
s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi);
- s = format (s, "\n last-seq %u last-seq-hi %u window %U",
- sa->last_seq, sa->last_seq_hi,
- format_ipsec_replay_window, sa->replay_window);
+ s = format (s, "\n window %U", format_ipsec_replay_window,
+ sa->replay_window);
s = format (s, "\n crypto alg %U",
format_ipsec_crypto_alg, sa->crypto_alg);
if (sa->crypto_alg && (flags & IPSEC_FORMAT_INSECURE))
clib_host_to_net_u16 (sa->udp_hdr.dst_port));
vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts);
- s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes);
+ lost = vlib_get_simple_counter (&ipsec_sa_lost_counters, sai);
+ s = format (s, "\n tx/rx:[packets:%Ld bytes:%Ld], lost:[packets:%Ld]",
+ counts.packets, counts.bytes, lost);
if (ipsec_sa_is_set_IS_TUNNEL (sa))
- {
- tx_table_id = fib_table_get_table_id (sa->tx_fib_index,
- FIB_PROTOCOL_IP4);
- s = format (s, "\n table-ID %d tunnel %U src %U dst %U flags %U",
- tx_table_id,
- format_ip_dscp, sa->dscp,
- format_ip46_address, &sa->tunnel_src_addr, IP46_TYPE_ANY,
- format_ip46_address, &sa->tunnel_dst_addr, IP46_TYPE_ANY,
- format_tunnel_encap_decap_flags, sa->tunnel_flags);
- if (!ipsec_sa_is_set_IS_INBOUND (sa))
- {
- s =
- format (s, "\n resovle via fib-entry: %d",
- sa->fib_entry_index);
- s = format (s, "\n stacked on:");
- s = format (s, "\n %U", format_dpo_id, &sa->dpo, 6);
- }
- }
+ s = format (s, "\n%U", format_tunnel, &sa->tunnel, 3);
done:
return (s);