X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_cli.c;h=9c64822c37fde9175deab0509a926f49ddcdfd79;hb=6221927e9bad39c2856e844f8bc38947cb447f73;hp=6a97b7bc8d9ad8fc4862019c16f4fc382a557a7b;hpb=c2fc57e8df45c0ddcd39c8b3d34e1b02e290e5ab;p=vpp.git diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c index 6a97b7bc8d9..9c64822c37f 100644 --- a/src/vnet/ipsec/ipsec_cli.c +++ b/src/vnet/ipsec/ipsec_cli.c @@ -79,7 +79,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm, u8 *ck = 0, *ik = 0; clib_error_t *error = NULL; - memset (&sa, 0, sizeof (sa)); + clib_memset (&sa, 0, sizeof (sa)); if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -148,6 +148,10 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm, sa.is_tunnel = 1; sa.is_tunnel_ip6 = 1; } + else if (unformat (line_input, "udp-encap")) + { + sa.udp_encap = 1; + } else { error = clib_error_return (0, "parse error: '%U'", @@ -163,20 +167,19 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm, sa.integ_key_len = sizeof (sa.integ_key); if (ck) - strncpy ((char *) sa.crypto_key, (char *) ck, sa.crypto_key_len); + memcpy (sa.crypto_key, ck, sa.crypto_key_len); if (ik) - strncpy ((char *) sa.integ_key, (char *) ik, sa.integ_key_len); + memcpy (sa.integ_key, ik, sa.integ_key_len); if (is_add) { - ASSERT (im->cb.check_support_cb); - error = im->cb.check_support_cb (&sa); + error = ipsec_check_support_cb (im, &sa); if (error) goto done; } - ipsec_add_del_sa (vm, &sa, is_add, 0 /* enable nat traversal */ ); + ipsec_add_del_sa (vm, &sa, is_add); done: unformat_free (line_input); @@ -258,7 +261,7 @@ ipsec_policy_add_del_command_fn (vlib_main_t * vm, u32 tmp, tmp2; clib_error_t *error = NULL; - memset (&p, 0, sizeof (p)); + clib_memset (&p, 0, sizeof (p)); p.lport.stop = p.rport.stop = ~0; p.laddr.stop.ip4.as_u32 = p.raddr.stop.ip4.as_u32 = (u32) ~ 0; p.laddr.stop.ip6.as_u64[0] = p.laddr.stop.ip6.as_u64[1] = (u64) ~ 0; @@ -390,7 +393,7 @@ set_ipsec_sa_key_command_fn (vlib_main_t * vm, u8 *ck = 0, *ik = 0; clib_error_t *error = NULL; - memset (&sa, 0, sizeof (sa)); + clib_memset (&sa, 0, sizeof (sa)); if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -511,7 +514,7 @@ show_ipsec_command_fn (vlib_main_t * vm, format_ip4_address, &p->laddr.start.ip4, format_ip4_address, &p->laddr.stop.ip4, p->lport.start, p->lport.stop); - vlib_cli_output(vm, " remte addr range %U - %U port range %u - %u", + vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u", format_ip4_address, &p->raddr.start.ip4, format_ip4_address, &p->raddr.stop.ip4, p->rport.start, p->rport.stop); @@ -566,7 +569,7 @@ show_ipsec_command_fn (vlib_main_t * vm, format_ip4_address, &p->laddr.start.ip4, format_ip4_address, &p->laddr.stop.ip4, p->lport.start, p->lport.stop); - vlib_cli_output(vm, " remte addr range %U - %U port range %u - %u", + vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u", format_ip4_address, &p->raddr.start.ip4, format_ip4_address, &p->raddr.stop.ip4, p->rport.start, p->rport.stop); @@ -593,7 +596,7 @@ show_ipsec_command_fn (vlib_main_t * vm, format_ip4_address, &p->laddr.start.ip4, format_ip4_address, &p->laddr.stop.ip4, p->lport.start, p->lport.stop); - vlib_cli_output(vm, " remte addr range %U - %U port range %u - %u", + vlib_cli_output(vm, " remote addr range %U - %U port range %u - %u", format_ip4_address, &p->raddr.start.ip4, format_ip4_address, &p->raddr.stop.ip4, p->rport.start, p->rport.stop); @@ -665,8 +668,8 @@ show_ipsec_command_fn (vlib_main_t * vm, hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index); vlib_cli_output(vm, " %s seq", hi->name); sa = pool_elt_at_index(im->sad, t->output_sa_index); - vlib_cli_output(vm, " seq %u seq-hi %u esn %u anti-replay %u", - sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay); + vlib_cli_output(vm, " seq %u seq-hi %u esn %u anti-replay %u udp-encap %u", + sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay, sa->udp_encap); vlib_cli_output(vm, " local-spi %u local-ip %U", sa->spi, format_ip4_address, &sa->tunnel_src_addr.ip4); vlib_cli_output(vm, " local-crypto %U %U", @@ -698,11 +701,148 @@ show_ipsec_command_fn (vlib_main_t * vm, /* *INDENT-OFF* */ VLIB_CLI_COMMAND (show_ipsec_command, static) = { .path = "show ipsec", - .short_help = "show ipsec", + .short_help = "show ipsec [backends]", .function = show_ipsec_command_fn, }; /* *INDENT-ON* */ +static clib_error_t * +ipsec_show_backends_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + ipsec_main_t *im = &ipsec_main; + u32 verbose = 0; + + (void) unformat (input, "verbose %u", &verbose); + + vlib_cli_output (vm, "IPsec AH backends available:"); + u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); + ipsec_ah_backend_t *ab; + /* *INDENT-OFF* */ + pool_foreach (ab, im->ah_backends, { + s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends, + ab - im->ah_backends == im->ah_current_backend ? "yes" : "no"); + if (verbose) { + vlib_node_t *n; + n = vlib_get_node (vm, ab->ah4_encrypt_node_index); + s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index); + n = vlib_get_node (vm, ab->ah4_decrypt_node_index); + s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index); + n = vlib_get_node (vm, ab->ah6_encrypt_node_index); + s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index); + n = vlib_get_node (vm, ab->ah6_decrypt_node_index); + s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index); + } + }); + /* *INDENT-ON* */ + vlib_cli_output (vm, "%v", s); + _vec_len (s) = 0; + vlib_cli_output (vm, "IPsec ESP backends available:"); + s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); + ipsec_esp_backend_t *eb; + /* *INDENT-OFF* */ + pool_foreach (eb, im->esp_backends, { + s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends, + eb - im->esp_backends == im->esp_current_backend ? "yes" + : "no"); + if (verbose) { + vlib_node_t *n; + n = vlib_get_node (vm, eb->esp4_encrypt_node_index); + s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index); + n = vlib_get_node (vm, eb->esp4_decrypt_node_index); + s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index); + n = vlib_get_node (vm, eb->esp6_encrypt_node_index); + s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index); + n = vlib_get_node (vm, eb->esp6_decrypt_node_index); + s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index); + } + }); + /* *INDENT-ON* */ + vlib_cli_output (vm, "%v", s); + + vec_free (s); + return 0; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = { + .path = "show ipsec backends", + .short_help = "show ipsec backends", + .function = ipsec_show_backends_command_fn, +}; +/* *INDENT-ON* */ + +static clib_error_t * +ipsec_select_backend_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + u32 backend_index; + ipsec_main_t *im = &ipsec_main; + + if (pool_elts (im->sad) > 0) + { + return clib_error_return (0, + "Cannot change IPsec backend, while %u SA entries are configured", + pool_elts (im->sad)); + } + + unformat_input_t _line_input, *line_input = &_line_input; + /* Get a line of input. */ + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + if (unformat (line_input, "ah")) + { + if (unformat (line_input, "%u", &backend_index)) + { + if (ipsec_select_ah_backend (im, backend_index) < 0) + { + return clib_error_return (0, "Invalid AH backend index `%u'", + backend_index); + } + } + else + { + return clib_error_return (0, "Invalid backend index `%U'", + format_unformat_error, line_input); + } + } + else if (unformat (line_input, "esp")) + { + if (unformat (line_input, "%u", &backend_index)) + { + if (ipsec_select_esp_backend (im, backend_index) < 0) + { + return clib_error_return (0, "Invalid ESP backend index `%u'", + backend_index); + } + } + else + { + return clib_error_return (0, "Invalid backend index `%U'", + format_unformat_error, line_input); + } + } + else + { + return clib_error_return (0, "Unknown input `%U'", + format_unformat_error, line_input); + } + + return 0; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = { + .path = "ipsec select backend", + .short_help = "ipsec select backend ", + .function = ipsec_select_backend_command_fn, +}; + +/* *INDENT-ON* */ + static clib_error_t * clear_ipsec_counters_command_fn (vlib_main_t * vm, unformat_input_t * input, @@ -742,7 +882,7 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm, u32 num_m_args = 0; clib_error_t *error = NULL; - memset (&a, 0, sizeof (a)); + clib_memset (&a, 0, sizeof (a)); a.is_add = 1; /* Get a line of input. */ @@ -766,6 +906,8 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm, a.renumber = 1; else if (unformat (line_input, "del")) a.is_add = 0; + else if (unformat (line_input, "udp-encap")) + a.udp_encap = 1; else { error = clib_error_return (0, "unknown input `%U'", @@ -808,7 +950,7 @@ done: /* *INDENT-OFF* */ VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = { .path = "create ipsec tunnel", - .short_help = "create ipsec tunnel local-ip local-spi remote-ip remote-spi [instance ]", + .short_help = "create ipsec tunnel local-ip local-spi remote-ip remote-spi [instance ] [udp-encap]", .function = create_ipsec_tunnel_command_fn, }; /* *INDENT-ON* */