If specified, shows keys, otherwise redacts. This change sets this flag
in the existing CLI code (thus maintaining the old behavior). The use
case for not specifying the insecure flag (and thus redacting the keys
from the show output) is for log messages.
Type: feature
Signed-off-by: Christian E. Hopps <chopps@chopps.org>
Change-Id: I8c0ab6a9a8aba7c687a2559fa1a23fac9d0aa111
{
IPSEC_FORMAT_BRIEF = 0,
IPSEC_FORMAT_DETAIL = (1 << 0),
{
IPSEC_FORMAT_BRIEF = 0,
IPSEC_FORMAT_DETAIL = (1 << 0),
+ IPSEC_FORMAT_INSECURE = (1 << 1),
} ipsec_format_flags_t;
extern ipsec_main_t ipsec_main;
} ipsec_format_flags_t;
extern ipsec_main_t ipsec_main;
if (~0 == sai)
ipsec_sa_show_all (vm, im, detail);
else
if (~0 == sai)
ipsec_sa_show_all (vm, im, detail);
else
- vlib_cli_output (vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_DETAIL);
+ vlib_cli_output (vm, "%U", format_ipsec_sa, sai,
+ IPSEC_FORMAT_DETAIL | IPSEC_FORMAT_INSECURE);
format_ipsec_replay_window, sa->replay_window);
s = format (s, "\n crypto alg %U",
format_ipsec_crypto_alg, sa->crypto_alg);
format_ipsec_replay_window, sa->replay_window);
s = format (s, "\n crypto alg %U",
format_ipsec_crypto_alg, sa->crypto_alg);
+ if (sa->crypto_alg && (flags & IPSEC_FORMAT_INSECURE))
s = format (s, " key %U", format_ipsec_key, &sa->crypto_key);
s = format (s, " key %U", format_ipsec_key, &sa->crypto_key);
+ else
+ s = format (s, " key [redacted]");
s = format (s, "\n integrity alg %U",
format_ipsec_integ_alg, sa->integ_alg);
s = format (s, "\n integrity alg %U",
format_ipsec_integ_alg, sa->integ_alg);
+ if (sa->integ_alg && (flags & IPSEC_FORMAT_INSECURE))
s = format (s, " key %U", format_ipsec_key, &sa->integ_key);
s = format (s, " key %U", format_ipsec_key, &sa->integ_key);
+ else
+ s = format (s, " key [redacted]");
vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts);
s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes);
vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts);
s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes);