X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_cli.c;h=f96551429af4c31060aa85e02078e2997f5ac96f;hb=de847277c9879c014fb4557e884360a4e6492783;hp=3c1e26f22c001c634ec0090b5bf9196f6c65e1e6;hpb=d04b60bfa940e21ab4676a1cb3c15989748be40a;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 3c1e26f22c0..f96551429af 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -32,6 +32,7 @@ set_interface_spd_command_fn (vlib_main_t * vm,
   u32 sw_if_index = (u32) ~ 0;
   u32 spd_id;
   int is_add = 1;
+  clib_error_t *error = NULL;
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -43,14 +44,18 @@ set_interface_spd_command_fn (vlib_main_t * vm,
   else if (unformat (line_input, "del"))
     is_add = 0;
   else
-    return clib_error_return (0, "parse error: '%U'",
-			      format_unformat_error, line_input);
-
-  unformat_free (line_input);
+    {
+      error = clib_error_return (0, "parse error: '%U'",
+				 format_unformat_error, line_input);
+      goto done;
+    }
 
   ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
 
-  return 0;
+done:
+  unformat_free (line_input);
+
+  return error;
 }
 
 /* *INDENT-OFF* */
@@ -72,9 +77,9 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
   ipsec_sa_t sa;
   int is_add = ~0;
   u8 *ck = 0, *ik = 0;
-  clib_error_t *err = 0;
+  clib_error_t *error = NULL;
 
-  memset (&sa, 0, sizeof (sa));
+  clib_memset (&sa, 0, sizeof (sa));
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -90,8 +95,9 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
       else if (unformat (line_input, "esp"))
 	sa.protocol = IPSEC_PROTOCOL_ESP;
       else if (unformat (line_input, "ah"))
-	//sa.protocol = IPSEC_PROTOCOL_AH;
-	return clib_error_return (0, "unsupported security protocol 'AH'");
+	{
+	  sa.protocol = IPSEC_PROTOCOL_AH;
+	}
       else
 	if (unformat (line_input, "crypto-key %U", unformat_hex_string, &ck))
 	sa.crypto_key_len = vec_len (ck);
@@ -100,10 +106,14 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
 	    (line_input, "crypto-alg %U", unformat_ipsec_crypto_alg,
 	     &sa.crypto_alg))
 	{
-	  if (sa.crypto_alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
+	  if (sa.crypto_alg < IPSEC_CRYPTO_ALG_NONE ||
 	      sa.crypto_alg >= IPSEC_CRYPTO_N_ALG)
-	    return clib_error_return (0, "unsupported crypto-alg: '%U'",
-				      format_ipsec_crypto_alg, sa.crypto_alg);
+	    {
+	      error = clib_error_return (0, "unsupported crypto-alg: '%U'",
+					 format_ipsec_crypto_alg,
+					 sa.crypto_alg);
+	      goto done;
+	    }
 	}
       else
 	if (unformat (line_input, "integ-key %U", unformat_hex_string, &ik))
@@ -111,10 +121,14 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
       else if (unformat (line_input, "integ-alg %U", unformat_ipsec_integ_alg,
 			 &sa.integ_alg))
 	{
-	  if (sa.integ_alg < IPSEC_INTEG_ALG_SHA1_96 ||
+	  if (sa.integ_alg < IPSEC_INTEG_ALG_NONE ||
 	      sa.integ_alg >= IPSEC_INTEG_N_ALG)
-	    return clib_error_return (0, "unsupported integ-alg: '%U'",
-				      format_ipsec_integ_alg, sa.integ_alg);
+	    {
+	      error = clib_error_return (0, "unsupported integ-alg: '%U'",
+					 format_ipsec_integ_alg,
+					 sa.integ_alg);
+	      goto done;
+	    }
 	}
       else if (unformat (line_input, "tunnel-src %U",
 			 unformat_ip4_address, &sa.tunnel_src_addr.ip4))
@@ -134,13 +148,18 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
 	  sa.is_tunnel = 1;
 	  sa.is_tunnel_ip6 = 1;
 	}
+      else if (unformat (line_input, "udp-encap"))
+	{
+	  sa.udp_encap = 1;
+	}
       else
-	return clib_error_return (0, "parse error: '%U'",
-				  format_unformat_error, line_input);
+	{
+	  error = clib_error_return (0, "parse error: '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
     }
 
-  unformat_free (line_input);
-
   if (sa.crypto_key_len > sizeof (sa.crypto_key))
     sa.crypto_key_len = sizeof (sa.crypto_key);
 
@@ -148,22 +167,24 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
     sa.integ_key_len = sizeof (sa.integ_key);
 
   if (ck)
-    strncpy ((char *) sa.crypto_key, (char *) ck, sa.crypto_key_len);
+    memcpy (sa.crypto_key, ck, sa.crypto_key_len);
 
   if (ik)
-    strncpy ((char *) sa.integ_key, (char *) ik, sa.integ_key_len);
+    memcpy (sa.integ_key, ik, sa.integ_key_len);
 
   if (is_add)
     {
-      ASSERT (im->cb.check_support_cb);
-      err = im->cb.check_support_cb (&sa);
-      if (err)
-	return err;
+      error = ipsec_check_support_cb (im, &sa);
+      if (error)
+	goto done;
     }
 
   ipsec_add_del_sa (vm, &sa, is_add);
 
-  return 0;
+done:
+  unformat_free (line_input);
+
+  return error;
 }
 
 /* *INDENT-OFF* */
@@ -183,6 +204,7 @@ ipsec_spd_add_del_command_fn (vlib_main_t * vm,
   unformat_input_t _line_input, *line_input = &_line_input;
   u32 spd_id = ~0;
   int is_add = ~0;
+  clib_error_t *error = NULL;
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -196,18 +218,25 @@ ipsec_spd_add_del_command_fn (vlib_main_t * vm,
       else if (unformat (line_input, "%u", &spd_id))
 	;
       else
-	return clib_error_return (0, "parse error: '%U'",
-				  format_unformat_error, line_input);
+	{
+	  error = clib_error_return (0, "parse error: '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
     }
 
-  unformat_free (line_input);
-
   if (spd_id == ~0)
-    return clib_error_return (0, "please specify SPD ID");
+    {
+      error = clib_error_return (0, "please specify SPD ID");
+      goto done;
+    }
 
   ipsec_add_del_spd (vm, spd_id, is_add);
 
-  return 0;
+done:
+  unformat_free (line_input);
+
+  return error;
 }
 
 /* *INDENT-OFF* */
@@ -230,8 +259,9 @@ ipsec_policy_add_del_command_fn (vlib_main_t * vm,
   int is_add = 0;
   int is_ip_any = 1;
   u32 tmp, tmp2;
+  clib_error_t *error = NULL;
 
-  memset (&p, 0, sizeof (p));
+  clib_memset (&p, 0, sizeof (p));
   p.lport.stop = p.rport.stop = ~0;
   p.laddr.stop.ip4.as_u32 = p.raddr.stop.ip4.as_u32 = (u32) ~ 0;
   p.laddr.stop.ip6.as_u64[0] = p.laddr.stop.ip6.as_u64[1] = (u64) ~ 0;
@@ -262,7 +292,10 @@ ipsec_policy_add_del_command_fn (vlib_main_t * vm,
 	     &p.policy))
 	{
 	  if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
-	    return clib_error_return (0, "unsupported action: 'resolve'");
+	    {
+	      error = clib_error_return (0, "unsupported action: 'resolve'");
+	      goto done;
+	    }
 	}
       else if (unformat (line_input, "sa %u", &p.sa_id))
 	;
@@ -300,19 +333,45 @@ ipsec_policy_add_del_command_fn (vlib_main_t * vm,
 	  p.rport.stop = tmp2;
 	}
       else
-	return clib_error_return (0, "parse error: '%U'",
-				  format_unformat_error, line_input);
+	{
+	  error = clib_error_return (0, "parse error: '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
     }
 
-  unformat_free (line_input);
-
+  /* Check if SA is for IPv6/AH which is not supported. Return error if TRUE. */
+  if (p.sa_id)
+    {
+      uword *p1;
+      ipsec_main_t *im = &ipsec_main;
+      ipsec_sa_t *sa = 0;
+      p1 = hash_get (im->sa_index_by_sa_id, p.sa_id);
+      if (!p1)
+	{
+	  error =
+	    clib_error_return (0, "SA with index %u not found", p.sa_id);
+	  goto done;
+	}
+      sa = pool_elt_at_index (im->sad, p1[0]);
+      if (sa && sa->protocol == IPSEC_PROTOCOL_AH && is_add && p.is_ipv6)
+	{
+	  error = clib_error_return (0, "AH not supported for IPV6: '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
   ipsec_add_del_policy (vm, &p, is_add);
   if (is_ip_any)
     {
       p.is_ipv6 = 1;
       ipsec_add_del_policy (vm, &p, is_add);
     }
-  return 0;
+
+done:
+  unformat_free (line_input);
+
+  return error;
 }
 
 /* *INDENT-OFF* */
@@ -332,8 +391,9 @@ set_ipsec_sa_key_command_fn (vlib_main_t * vm,
   unformat_input_t _line_input, *line_input = &_line_input;
   ipsec_sa_t sa;
   u8 *ck = 0, *ik = 0;
+  clib_error_t *error = NULL;
 
-  memset (&sa, 0, sizeof (sa));
+  clib_memset (&sa, 0, sizeof (sa));
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -349,12 +409,13 @@ set_ipsec_sa_key_command_fn (vlib_main_t * vm,
 	if (unformat (line_input, "integ-key %U", unformat_hex_string, &ik))
 	sa.integ_key_len = vec_len (ik);
       else
-	return clib_error_return (0, "parse error: '%U'",
-				  format_unformat_error, line_input);
+	{
+	  error = clib_error_return (0, "parse error: '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
     }
 
-  unformat_free (line_input);
-
   if (sa.crypto_key_len > sizeof (sa.crypto_key))
     sa.crypto_key_len = sizeof (sa.crypto_key);
 
@@ -369,7 +430,10 @@ set_ipsec_sa_key_command_fn (vlib_main_t * vm,
 
   ipsec_set_sa_key (vm, &sa);
 
-  return 0;
+done:
+  unformat_free (line_input);
+
+  return error;
 }
 
 /* *INDENT-OFF* */
@@ -392,13 +456,18 @@ show_ipsec_command_fn (vlib_main_t * vm,
   u32 *i;
   ipsec_tunnel_if_t *t;
   vnet_hw_interface_t *hi;
+  u8 *protocol = NULL;
+  u8 *policy = NULL;
 
   /* *INDENT-OFF* */
   pool_foreach (sa, im->sad, ({
     if (sa->id) {
-      vlib_cli_output(vm, "sa %u spi %u mode %s protocol %s", sa->id, sa->spi,
+      vlib_cli_output(vm, "sa %u spi %u mode %s protocol %s%s%s%s", sa->id, sa->spi,
                       sa->is_tunnel ? "tunnel" : "transport",
-                      sa->protocol ? "esp" : "ah");
+                      sa->protocol ? "esp" : "ah",
+		      sa->udp_encap ? " udp-encap-enabled" : "",
+                      sa->use_anti_replay ? " anti-replay" : "",
+                      sa->use_esn ? " extended-sequence-number" : "");
       if (sa->protocol == IPSEC_PROTOCOL_ESP) {
         vlib_cli_output(vm, "  crypto alg %U%s%U integrity alg %U%s%U",
                         format_ipsec_crypto_alg, sa->crypto_alg,
@@ -429,20 +498,25 @@ show_ipsec_command_fn (vlib_main_t * vm,
     vec_foreach(i, spd->ipv4_outbound_policies)
       {
         p = pool_elt_at_index(spd->policies, *i);
-        vlib_cli_output(vm, "  priority %d action %U protocol %s%s",
-                        p->priority,
-                        format_ipsec_policy_action, p->policy,
-                        p->protocol ?
-                          format(0, "%U", format_ip_protocol, p->protocol) :
-                          (u8 *) "any",
-                        p->policy == IPSEC_POLICY_ACTION_PROTECT ?
-                          format(0, " sa %u", p->sa_id) :
-                          (u8 *) "");
+	vec_reset_length(protocol);
+	vec_reset_length(policy);
+	if (p->protocol) {
+	  protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
+	} else {
+	  protocol = format(protocol, "any");
+	}
+	if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
+	  policy = format(policy, " sa %u", p->sa_id);
+	}
+
+        vlib_cli_output(vm, "  priority %d action %U protocol %v%v",
+                        p->priority, format_ipsec_policy_action, p->policy,
+			protocol, policy);
         vlib_cli_output(vm, "   local addr range %U - %U port range %u - %u",
                         format_ip4_address, &p->laddr.start.ip4,
                         format_ip4_address, &p->laddr.stop.ip4,
                         p->lport.start, p->lport.stop);
-        vlib_cli_output(vm, "   remte addr range %U - %U port range %u - %u",
+        vlib_cli_output(vm, "   remote addr range %U - %U port range %u - %u",
                         format_ip4_address, &p->raddr.start.ip4,
                         format_ip4_address, &p->raddr.stop.ip4,
                         p->rport.start, p->rport.stop);
@@ -452,15 +526,19 @@ show_ipsec_command_fn (vlib_main_t * vm,
     vec_foreach(i, spd->ipv6_outbound_policies)
       {
         p = pool_elt_at_index(spd->policies, *i);
-        vlib_cli_output(vm, "  priority %d action %U protocol %s%s",
-                        p->priority,
-                        format_ipsec_policy_action, p->policy,
-                        p->protocol ?
-                          format(0, "%U", format_ip_protocol, p->protocol) :
-                          (u8 *) "any",
-                        p->policy == IPSEC_POLICY_ACTION_PROTECT ?
-                          format(0, " sa %u", p->sa_id) :
-                          (u8 *) "");
+	vec_reset_length(protocol);
+	vec_reset_length(policy);
+	if (p->protocol) {
+	  protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
+	} else {
+	  protocol = format(protocol, "any");
+	}
+	if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
+	  policy = format(policy, " sa %u", p->sa_id);
+	}
+        vlib_cli_output(vm, "  priority %d action %U protocol %v%v",
+                        p->priority, format_ipsec_policy_action, p->policy,
+			protocol, policy);
         vlib_cli_output(vm, "   local addr range %U - %U port range %u - %u",
                         format_ip6_address, &p->laddr.start.ip6,
                         format_ip6_address, &p->laddr.stop.ip6,
@@ -476,20 +554,24 @@ show_ipsec_command_fn (vlib_main_t * vm,
     vec_foreach(i, spd->ipv4_inbound_protect_policy_indices)
       {
         p = pool_elt_at_index(spd->policies, *i);
-        vlib_cli_output(vm, "  priority %d action %U protocol %s%s",
-                        p->priority,
-                        format_ipsec_policy_action, p->policy,
-                        p->protocol ?
-                          format(0, "%U", format_ip_protocol, p->protocol) :
-                          (u8 *) "any",
-                        p->policy == IPSEC_POLICY_ACTION_PROTECT ?
-                          format(0, " sa %u", p->sa_id) :
-                          (u8 *) "");
+	vec_reset_length(protocol);
+	vec_reset_length(policy);
+	if (p->protocol) {
+	  protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
+	} else {
+	  protocol = format(protocol, "any");
+	}
+	if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
+	  policy = format(policy, " sa %u", p->sa_id);
+	}
+        vlib_cli_output(vm, "  priority %d action %U protocol %v%v",
+                        p->priority, format_ipsec_policy_action, p->policy,
+			protocol, policy);
         vlib_cli_output(vm, "   local addr range %U - %U port range %u - %u",
                         format_ip4_address, &p->laddr.start.ip4,
                         format_ip4_address, &p->laddr.stop.ip4,
                         p->lport.start, p->lport.stop);
-        vlib_cli_output(vm, "   remte addr range %U - %U port range %u - %u",
+        vlib_cli_output(vm, "   remote addr range %U - %U port range %u - %u",
                         format_ip4_address, &p->raddr.start.ip4,
                         format_ip4_address, &p->raddr.stop.ip4,
                         p->rport.start, p->rport.stop);
@@ -499,20 +581,24 @@ show_ipsec_command_fn (vlib_main_t * vm,
     vec_foreach(i, spd->ipv4_inbound_policy_discard_and_bypass_indices)
       {
         p = pool_elt_at_index(spd->policies, *i);
-        vlib_cli_output(vm, "  priority %d action %U protocol %s%s",
-                        p->priority,
-                        format_ipsec_policy_action, p->policy,
-                        p->protocol ?
-                          format(0, "%U", format_ip_protocol, p->protocol) :
-                          (u8 *) "any",
-                        p->policy == IPSEC_POLICY_ACTION_PROTECT ?
-                          format(0, " sa %u", p->sa_id) :
-                          (u8 *) "");
+	vec_reset_length(protocol);
+	vec_reset_length(policy);
+	if (p->protocol) {
+	  protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
+	} else {
+	  protocol = format(protocol, "any");
+	}
+	if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
+	  policy = format(policy, " sa %u", p->sa_id);
+	}
+        vlib_cli_output(vm, "  priority %d action %U protocol %v%v",
+                        p->priority, format_ipsec_policy_action, p->policy,
+			protocol, policy);
         vlib_cli_output(vm, "   local addr range %U - %U port range %u - %u",
                         format_ip4_address, &p->laddr.start.ip4,
                         format_ip4_address, &p->laddr.stop.ip4,
                         p->lport.start, p->lport.stop);
-        vlib_cli_output(vm, "   remte addr range %U - %U port range %u - %u",
+        vlib_cli_output(vm, "   remote addr range %U - %U port range %u - %u",
                         format_ip4_address, &p->raddr.start.ip4,
                         format_ip4_address, &p->raddr.stop.ip4,
                         p->rport.start, p->rport.stop);
@@ -522,15 +608,19 @@ show_ipsec_command_fn (vlib_main_t * vm,
     vec_foreach(i, spd->ipv6_inbound_protect_policy_indices)
       {
         p = pool_elt_at_index(spd->policies, *i);
-        vlib_cli_output(vm, "  priority %d action %U protocol %s%s",
-                        p->priority,
-                        format_ipsec_policy_action, p->policy,
-                        p->protocol ?
-                          format(0, "%U", format_ip_protocol, p->protocol) :
-                          (u8 *) "any",
-                        p->policy == IPSEC_POLICY_ACTION_PROTECT ?
-                          format(0, " sa %u", p->sa_id) :
-                          (u8 *) "");
+	vec_reset_length(protocol);
+	vec_reset_length(policy);
+	if (p->protocol) {
+	  protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
+	} else {
+	  protocol = format(protocol, "any");
+	}
+	if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
+	  policy = format(policy, " sa %u", p->sa_id);
+	}
+        vlib_cli_output(vm, "  priority %d action %U protocol %v%v",
+                        p->priority, format_ipsec_policy_action, p->policy,
+			protocol, policy);
         vlib_cli_output(vm, "   local addr range %U - %U port range %u - %u",
                         format_ip6_address, &p->laddr.start.ip6,
                         format_ip6_address, &p->laddr.stop.ip6,
@@ -545,15 +635,19 @@ show_ipsec_command_fn (vlib_main_t * vm,
     vec_foreach(i, spd->ipv6_inbound_policy_discard_and_bypass_indices)
       {
         p = pool_elt_at_index(spd->policies, *i);
-        vlib_cli_output(vm, "  priority %d action %U protocol %s%s",
-                        p->priority,
-                        format_ipsec_policy_action, p->policy,
-                        p->protocol ?
-                          format(0, "%U", format_ip_protocol, p->protocol) :
-                          (u8 *) "any",
-                        p->policy == IPSEC_POLICY_ACTION_PROTECT ?
-                          format(0, " sa %u", p->sa_id) :
-                          (u8 *) "");
+	vec_reset_length(protocol);
+	vec_reset_length(policy);
+	if (p->protocol) {
+	  protocol = format(protocol, "%U", format_ip_protocol, p->protocol);
+	} else {
+	  protocol = format(protocol, "any");
+	}
+	if (p->policy == IPSEC_POLICY_ACTION_PROTECT) {
+	  policy = format(policy, " sa %u", p->sa_id);
+	}
+        vlib_cli_output(vm, "  priority %d action %U protocol %v%v",
+                        p->priority, format_ipsec_policy_action, p->policy,
+			protocol, policy);
         vlib_cli_output(vm, "   local addr range %U - %U port range %u - %u",
                         format_ip6_address, &p->laddr.start.ip6,
                         format_ip6_address, &p->laddr.stop.ip6,
@@ -576,8 +670,8 @@ show_ipsec_command_fn (vlib_main_t * vm,
     hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
     vlib_cli_output(vm, "  %s seq", hi->name);
     sa = pool_elt_at_index(im->sad, t->output_sa_index);
-    vlib_cli_output(vm, "   seq %u seq-hi %u esn %u anti-replay %u",
-                    sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay);
+    vlib_cli_output(vm, "   seq %u seq-hi %u esn %u anti-replay %u udp-encap %u",
+                    sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay, sa->udp_encap);
     vlib_cli_output(vm, "   local-spi %u local-ip %U", sa->spi,
                     format_ip4_address, &sa->tunnel_src_addr.ip4);
     vlib_cli_output(vm, "   local-crypto %U %U",
@@ -600,6 +694,8 @@ show_ipsec_command_fn (vlib_main_t * vm,
                     format_ipsec_integ_alg, sa->integ_alg,
                     format_hex_bytes, sa->integ_key, sa->integ_key_len);
   }));
+  vec_free(policy);
+  vec_free(protocol);
   /* *INDENT-ON* */
   return 0;
 }
@@ -607,11 +703,148 @@ show_ipsec_command_fn (vlib_main_t * vm,
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
     .path = "show ipsec",
-    .short_help = "show ipsec",
+    .short_help = "show ipsec [backends]",
     .function = show_ipsec_command_fn,
 };
 /* *INDENT-ON* */
 
+static clib_error_t *
+ipsec_show_backends_command_fn (vlib_main_t * vm,
+				unformat_input_t * input,
+				vlib_cli_command_t * cmd)
+{
+  ipsec_main_t *im = &ipsec_main;
+  u32 verbose = 0;
+
+  (void) unformat (input, "verbose %u", &verbose);
+
+  vlib_cli_output (vm, "IPsec AH backends available:");
+  u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
+  ipsec_ah_backend_t *ab;
+  /* *INDENT-OFF* */
+  pool_foreach (ab, im->ah_backends, {
+    s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
+                ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
+    if (verbose) {
+        vlib_node_t *n;
+        n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
+        s = format (s, "     enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
+        n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
+        s = format (s, "     dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
+        n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
+        s = format (s, "     enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
+        n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
+        s = format (s, "     dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
+    }
+  });
+  /* *INDENT-ON* */
+  vlib_cli_output (vm, "%v", s);
+  _vec_len (s) = 0;
+  vlib_cli_output (vm, "IPsec ESP backends available:");
+  s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
+  ipsec_esp_backend_t *eb;
+  /* *INDENT-OFF* */
+  pool_foreach (eb, im->esp_backends, {
+    s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
+                eb - im->esp_backends == im->esp_current_backend ? "yes"
+                                                                 : "no");
+    if (verbose) {
+        vlib_node_t *n;
+        n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
+        s = format (s, "     enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
+        n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
+        s = format (s, "     dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
+        n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
+        s = format (s, "     enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
+        n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
+        s = format (s, "     dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
+    }
+  });
+  /* *INDENT-ON* */
+  vlib_cli_output (vm, "%v", s);
+
+  vec_free (s);
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
+    .path = "show ipsec backends",
+    .short_help = "show ipsec backends",
+    .function = ipsec_show_backends_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+ipsec_select_backend_command_fn (vlib_main_t * vm,
+				 unformat_input_t * input,
+				 vlib_cli_command_t * cmd)
+{
+  u32 backend_index;
+  ipsec_main_t *im = &ipsec_main;
+
+  if (pool_elts (im->sad) > 0)
+    {
+      return clib_error_return (0,
+				"Cannot change IPsec backend, while %u SA entries are configured",
+				pool_elts (im->sad));
+    }
+
+  unformat_input_t _line_input, *line_input = &_line_input;
+  /* Get a line of input. */
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  if (unformat (line_input, "ah"))
+    {
+      if (unformat (line_input, "%u", &backend_index))
+	{
+	  if (ipsec_select_ah_backend (im, backend_index) < 0)
+	    {
+	      return clib_error_return (0, "Invalid AH backend index `%u'",
+					backend_index);
+	    }
+	}
+      else
+	{
+	  return clib_error_return (0, "Invalid backend index `%U'",
+				    format_unformat_error, line_input);
+	}
+    }
+  else if (unformat (line_input, "esp"))
+    {
+      if (unformat (line_input, "%u", &backend_index))
+	{
+	  if (ipsec_select_esp_backend (im, backend_index) < 0)
+	    {
+	      return clib_error_return (0, "Invalid ESP backend index `%u'",
+					backend_index);
+	    }
+	}
+      else
+	{
+	  return clib_error_return (0, "Invalid backend index `%U'",
+				    format_unformat_error, line_input);
+	}
+    }
+  else
+    {
+      return clib_error_return (0, "Unknown input `%U'",
+				format_unformat_error, line_input);
+    }
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
+    .path = "ipsec select backend",
+    .short_help = "ipsec select backend <ah|esp> <backend index>",
+    .function = ipsec_select_backend_command_fn,
+};
+
+/* *INDENT-ON* */
+
 static clib_error_t *
 clear_ipsec_counters_command_fn (vlib_main_t * vm,
 				 unformat_input_t * input,
@@ -649,8 +882,9 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
   ipsec_add_del_tunnel_args_t a;
   int rv;
   u32 num_m_args = 0;
+  clib_error_t *error = NULL;
 
-  memset (&a, 0, sizeof (a));
+  clib_memset (&a, 0, sizeof (a));
   a.is_add = 1;
 
   /* Get a line of input. */
@@ -670,16 +904,25 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
 	num_m_args++;
       else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
 	num_m_args++;
+      else if (unformat (line_input, "instance %u", &a.show_instance))
+	a.renumber = 1;
       else if (unformat (line_input, "del"))
 	a.is_add = 0;
+      else if (unformat (line_input, "udp-encap"))
+	a.udp_encap = 1;
       else
-	return clib_error_return (0, "unknown input `%U'",
-				  format_unformat_error, input);
+	{
+	  error = clib_error_return (0, "unknown input `%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
     }
-  unformat_free (line_input);
 
   if (num_m_args < 4)
-    return clib_error_return (0, "mandatory argument(s) missing");
+    {
+      error = clib_error_return (0, "mandatory argument(s) missing");
+      goto done;
+    }
 
   rv = ipsec_add_del_tunnel_if (&a);
 
@@ -689,22 +932,27 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
       break;
     case VNET_API_ERROR_INVALID_VALUE:
       if (a.is_add)
-	return clib_error_return (0,
-				  "IPSec tunnel interface already exists...");
+	error = clib_error_return (0,
+				   "IPSec tunnel interface already exists...");
       else
-	return clib_error_return (0, "IPSec tunnel interface not exists...");
+	error = clib_error_return (0, "IPSec tunnel interface not exists...");
+      goto done;
     default:
-      return clib_error_return (0, "ipsec_register_interface returned %d",
-				rv);
+      error = clib_error_return (0, "ipsec_register_interface returned %d",
+				 rv);
+      goto done;
     }
 
-  return 0;
+done:
+  unformat_free (line_input);
+
+  return error;
 }
 
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
   .path = "create ipsec tunnel",
-  .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> remote-ip <addr> remote-spi <spi>",
+  .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap]",
   .function = create_ipsec_tunnel_command_fn,
 };
 /* *INDENT-ON* */
@@ -720,6 +968,7 @@ set_interface_key_command_fn (vlib_main_t * vm,
   u32 hw_if_index = (u32) ~ 0;
   u32 alg;
   u8 *key = 0;
+  clib_error_t *error = NULL;
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -748,25 +997,38 @@ set_interface_key_command_fn (vlib_main_t * vm,
       else if (unformat (line_input, "%U", unformat_hex_string, &key))
 	;
       else
-	return clib_error_return (0, "parse error: '%U'",
-				  format_unformat_error, line_input);
+	{
+	  error = clib_error_return (0, "parse error: '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
     }
 
-  unformat_free (line_input);
-
   if (type == IPSEC_IF_SET_KEY_TYPE_NONE)
-    return clib_error_return (0, "unknown key type");
+    {
+      error = clib_error_return (0, "unknown key type");
+      goto done;
+    }
 
   if (alg > 0 && vec_len (key) == 0)
-    return clib_error_return (0, "key is not specified");
+    {
+      error = clib_error_return (0, "key is not specified");
+      goto done;
+    }
 
   if (hw_if_index == (u32) ~ 0)
-    return clib_error_return (0, "interface not specified");
+    {
+      error = clib_error_return (0, "interface not specified");
+      goto done;
+    }
 
   ipsec_set_interface_key (im->vnet_main, hw_if_index, type, alg, key);
+
+done:
   vec_free (key);
+  unformat_free (line_input);
 
-  return 0;
+  return error;
 }
 
 /* *INDENT-OFF* */