src/plugins/ikev2/ikev2_cli.c

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include <vlib/vlib.h>
  16 #include <vnet/vnet.h>
  17 #include <vnet/pg/pg.h>
  18 #include <vppinfra/error.h>
  19 #include <vnet/udp/udp.h>
  20 #include <vnet/ipsec/ipsec_sa.h>
  21 #include <plugins/ikev2/ikev2.h>
  22 #include <plugins/ikev2/ikev2_priv.h>
  23
  24 u8 *
  25 format_ikev2_id_type_and_data (u8 * s, va_list * args)
  26 {
  27   ikev2_id_t *id = va_arg (*args, ikev2_id_t *);
  28
  29   if (id->type == 0 || vec_len (id->data) == 0)
  30     return format (s, "none");
  31
  32   s = format (s, "%U", format_ikev2_id_type, id->type);
  33
  34   if (id->type == IKEV2_ID_TYPE_ID_FQDN ||
  35       id->type == IKEV2_ID_TYPE_ID_RFC822_ADDR)
  36     {
  37       s = format (s, " %v", id->data);
  38     }
  39   else
  40     {
  41       s =
  42         format (s, " %U", format_hex_bytes, &id->data,
  43                 (uword) (vec_len (id->data)));
  44     }
  45
  46   return s;
  47 }
  48
  49
  50 static clib_error_t *
  51 show_ikev2_sa_command_fn (vlib_main_t * vm,
  52                           unformat_input_t * input, vlib_cli_command_t * cmd)
  53 {
  54   ikev2_main_t *km = &ikev2_main;
  55   ikev2_main_per_thread_data_t *tkm;
  56   ikev2_sa_t *sa;
  57   ikev2_ts_t *ts;
  58   ikev2_child_sa_t *child;
  59   ikev2_sa_transform_t *tr;
  60
  61   vec_foreach (tkm, km->per_thread_data)
  62   {
  63     /* *INDENT-OFF* */
  64     pool_foreach (sa, tkm->sas, ({
  65       u8 * s = 0;
  66       vlib_cli_output(vm, " iip %U ispi %lx rip %U rspi %lx",
  67                       format_ip4_address, &sa->iaddr, sa->ispi,
  68                       format_ip4_address, &sa->raddr, sa->rspi);
  69
  70        tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
  71        s = format(s, "%U ", format_ikev2_sa_transform, tr);
  72
  73        tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
  74        s = format(s, "%U ", format_ikev2_sa_transform, tr);
  75
  76        tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
  77        s = format(s, "%U ", format_ikev2_sa_transform, tr);
  78
  79        tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_DH);
  80        s = format(s, "%U ", format_ikev2_sa_transform, tr);
  81
  82       vlib_cli_output(vm, " %v", s);
  83       vec_free(s);
  84
  85       vlib_cli_output(vm, "  nonce i:%U\n        r:%U",
  86                       format_hex_bytes, sa->i_nonce,  vec_len(sa->i_nonce),
  87                       format_hex_bytes, sa->r_nonce,  vec_len(sa->r_nonce));
  88
  89       vlib_cli_output(vm, "  SK_d    %U",
  90                       format_hex_bytes, sa->sk_d,  vec_len(sa->sk_d));
  91       if (sa->sk_ai)
  92         {
  93           vlib_cli_output(vm, "  SK_a  i:%U\n        r:%U",
  94                           format_hex_bytes, sa->sk_ai, vec_len(sa->sk_ai),
  95                           format_hex_bytes, sa->sk_ar, vec_len(sa->sk_ar));
  96         }
  97       vlib_cli_output(vm, "  SK_e  i:%U\n        r:%U",
  98                       format_hex_bytes, sa->sk_ei, vec_len(sa->sk_ei),
  99                       format_hex_bytes, sa->sk_er, vec_len(sa->sk_er));
 100       vlib_cli_output(vm, "  SK_p  i:%U\n        r:%U",
 101                       format_hex_bytes, sa->sk_pi, vec_len(sa->sk_pi),
 102                       format_hex_bytes, sa->sk_pr, vec_len(sa->sk_pr));
 103
 104       vlib_cli_output(vm, "  identifier (i) %U",
 105                       format_ikev2_id_type_and_data, &sa->i_id);
 106       vlib_cli_output(vm, "  identifier (r) %U",
 107                       format_ikev2_id_type_and_data, &sa->r_id);
 108
 109       vec_foreach(child, sa->childs)
 110         {
 111           vlib_cli_output(vm, "  child sa %u:", child - sa->childs);
 112
 113           tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
 114           s = format(s, "%U ", format_ikev2_sa_transform, tr);
 115
 116           tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
 117           s = format(s, "%U ", format_ikev2_sa_transform, tr);
 118
 119           tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ESN);
 120           s = format(s, "%U ", format_ikev2_sa_transform, tr);
 121
 122           vlib_cli_output(vm, "    %v", s);
 123           vec_free(s);
 124
 125           vlib_cli_output(vm, "    spi(i) %lx spi(r) %lx",
 126                           child->i_proposals ? child->i_proposals[0].spi : 0,
 127                           child->r_proposals ? child->r_proposals[0].spi : 0);
 128
 129           vlib_cli_output(vm, "    SK_e  i:%U\n          r:%U",
 130                           format_hex_bytes, child->sk_ei, vec_len(child->sk_ei),
 131                           format_hex_bytes, child->sk_er, vec_len(child->sk_er));
 132           if (child->sk_ai)
 133             {
 134               vlib_cli_output(vm, "    SK_a  i:%U\n          r:%U",
 135                               format_hex_bytes, child->sk_ai, vec_len(child->sk_ai),
 136                               format_hex_bytes, child->sk_ar, vec_len(child->sk_ar));
 137               vlib_cli_output(vm, "    traffic selectors (i):");
 138             }
 139           vec_foreach(ts, child->tsi)
 140             {
 141               vlib_cli_output(vm, "      %u type %u protocol_id %u addr "
 142                               "%U - %U port %u - %u",
 143                               ts - child->tsi,
 144                               ts->ts_type, ts->protocol_id,
 145                               format_ip4_address, &ts->start_addr,
 146                               format_ip4_address, &ts->end_addr,
 147                               clib_net_to_host_u16( ts->start_port),
 148                               clib_net_to_host_u16( ts->end_port));
 149             }
 150           vlib_cli_output(vm, "    traffic selectors (r):");
 151           vec_foreach(ts, child->tsr)
 152             {
 153               vlib_cli_output(vm, "      %u type %u protocol_id %u addr "
 154                               "%U - %U port %u - %u",
 155                               ts - child->tsr,
 156                               ts->ts_type, ts->protocol_id,
 157                               format_ip4_address, &ts->start_addr,
 158                               format_ip4_address, &ts->end_addr,
 159                               clib_net_to_host_u16( ts->start_port),
 160                               clib_net_to_host_u16( ts->end_port));
 161             }
 162         }
 163       vlib_cli_output(vm, "");
 164     }));
 165     /* *INDENT-ON* */
 166   }
 167   return 0;
 168 }
 169
 170 /* *INDENT-OFF* */
 171 VLIB_CLI_COMMAND (show_ikev2_sa_command, static) = {
 172     .path = "show ikev2 sa",
 173     .short_help = "show ikev2 sa",
 174     .function = show_ikev2_sa_command_fn,
 175 };
 176 /* *INDENT-ON* */
 177
 178 static clib_error_t *
 179 ikev2_profile_add_del_command_fn (vlib_main_t * vm,
 180                                   unformat_input_t * input,
 181                                   vlib_cli_command_t * cmd)
 182 {
 183   vnet_main_t *vnm = vnet_get_main ();
 184   unformat_input_t _line_input, *line_input = &_line_input;
 185   u8 *name = 0;
 186   clib_error_t *r = 0;
 187   u32 id_type;
 188   u8 *data = 0;
 189   u32 tmp1, tmp2, tmp3;
 190   u64 tmp4, tmp5;
 191   ip4_address_t ip4;
 192   ip4_address_t end_addr;
 193   u32 responder_sw_if_index = (u32) ~ 0;
 194   u32 tun_sw_if_index = (u32) ~ 0;
 195   ip4_address_t responder_ip4;
 196   ikev2_transform_encr_type_t crypto_alg;
 197   ikev2_transform_integ_type_t integ_alg;
 198   ikev2_transform_dh_type_t dh_type;
 199
 200   const char *valid_chars = "a-zA-Z0-9_";
 201
 202   if (!unformat_user (input, unformat_line_input, line_input))
 203     return 0;
 204
 205   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 206     {
 207       if (unformat (line_input, "add %U", unformat_token, valid_chars, &name))
 208         {
 209           r = ikev2_add_del_profile (vm, name, 1);
 210           goto done;
 211         }
 212       else
 213         if (unformat
 214             (line_input, "del %U", unformat_token, valid_chars, &name))
 215         {
 216           r = ikev2_add_del_profile (vm, name, 0);
 217           goto done;
 218         }
 219       else if (unformat (line_input, "set %U auth shared-key-mic string %v",
 220                          unformat_token, valid_chars, &name, &data))
 221         {
 222           r =
 223             ikev2_set_profile_auth (vm, name,
 224                                     IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
 225                                     0);
 226           goto done;
 227         }
 228       else if (unformat (line_input, "set %U auth shared-key-mic hex %U",
 229                          unformat_token, valid_chars, &name,
 230                          unformat_hex_string, &data))
 231         {
 232           r =
 233             ikev2_set_profile_auth (vm, name,
 234                                     IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
 235                                     1);
 236           goto done;
 237         }
 238       else if (unformat (line_input, "set %U auth rsa-sig cert-file %v",
 239                          unformat_token, valid_chars, &name, &data))
 240         {
 241           r =
 242             ikev2_set_profile_auth (vm, name, IKEV2_AUTH_METHOD_RSA_SIG, data,
 243                                     0);
 244           goto done;
 245         }
 246       else if (unformat (line_input, "set %U id local %U %U",
 247                          unformat_token, valid_chars, &name,
 248                          unformat_ikev2_id_type, &id_type,
 249                          unformat_ip4_address, &ip4))
 250         {
 251           data = vec_new (u8, 4);
 252           clib_memcpy (data, ip4.as_u8, 4);
 253           r =
 254             ikev2_set_profile_id (vm, name, (u8) id_type, data, /*local */ 1);
 255           goto done;
 256         }
 257       else if (unformat (line_input, "set %U id local %U 0x%U",
 258                          unformat_token, valid_chars, &name,
 259                          unformat_ikev2_id_type, &id_type,
 260                          unformat_hex_string, &data))
 261         {
 262           r =
 263             ikev2_set_profile_id (vm, name, (u8) id_type, data, /*local */ 1);
 264           goto done;
 265         }
 266       else if (unformat (line_input, "set %U id local %U %v",
 267                          unformat_token, valid_chars, &name,
 268                          unformat_ikev2_id_type, &id_type, &data))
 269         {
 270           r =
 271             ikev2_set_profile_id (vm, name, (u8) id_type, data, /*local */ 1);
 272           goto done;
 273         }
 274       else if (unformat (line_input, "set %U id remote %U %U",
 275                          unformat_token, valid_chars, &name,
 276                          unformat_ikev2_id_type, &id_type,
 277                          unformat_ip4_address, &ip4))
 278         {
 279           data = vec_new (u8, 4);
 280           clib_memcpy (data, ip4.as_u8, 4);
 281           r = ikev2_set_profile_id (vm, name, (u8) id_type, data,       /*remote */
 282                                     0);
 283           goto done;
 284         }
 285       else if (unformat (line_input, "set %U id remote %U 0x%U",
 286                          unformat_token, valid_chars, &name,
 287                          unformat_ikev2_id_type, &id_type,
 288                          unformat_hex_string, &data))
 289         {
 290           r = ikev2_set_profile_id (vm, name, (u8) id_type, data,       /*remote */
 291                                     0);
 292           goto done;
 293         }
 294       else if (unformat (line_input, "set %U id remote %U %v",
 295                          unformat_token, valid_chars, &name,
 296                          unformat_ikev2_id_type, &id_type, &data))
 297         {
 298           r = ikev2_set_profile_id (vm, name, (u8) id_type, data,       /*remote */
 299                                     0);
 300           goto done;
 301         }
 302       else if (unformat (line_input, "set %U traffic-selector local "
 303                          "ip-range %U - %U port-range %u - %u protocol %u",
 304                          unformat_token, valid_chars, &name,
 305                          unformat_ip4_address, &ip4,
 306                          unformat_ip4_address, &end_addr,
 307                          &tmp1, &tmp2, &tmp3))
 308         {
 309           r =
 310             ikev2_set_profile_ts (vm, name, (u8) tmp3, (u16) tmp1, (u16) tmp2,
 311                                   ip4, end_addr, /*local */ 1);
 312           goto done;
 313         }
 314       else if (unformat (line_input, "set %U traffic-selector remote "
 315                          "ip-range %U - %U port-range %u - %u protocol %u",
 316                          unformat_token, valid_chars, &name,
 317                          unformat_ip4_address, &ip4,
 318                          unformat_ip4_address, &end_addr,
 319                          &tmp1, &tmp2, &tmp3))
 320         {
 321           r =
 322             ikev2_set_profile_ts (vm, name, (u8) tmp3, (u16) tmp1, (u16) tmp2,
 323                                   ip4, end_addr, /*remote */ 0);
 324           goto done;
 325         }
 326       else if (unformat (line_input, "set %U responder %U %U",
 327                          unformat_token, valid_chars, &name,
 328                          unformat_vnet_sw_interface, vnm,
 329                          &responder_sw_if_index, unformat_ip4_address,
 330                          &responder_ip4))
 331         {
 332           r =
 333             ikev2_set_profile_responder (vm, name, responder_sw_if_index,
 334                                          responder_ip4);
 335           goto done;
 336         }
 337       else if (unformat (line_input, "set %U tunnel %U",
 338                          unformat_token, valid_chars, &name,
 339                          unformat_vnet_sw_interface, vnm, &tun_sw_if_index))
 340         {
 341           r = ikev2_set_profile_tunnel_interface (vm, name, tun_sw_if_index);
 342           goto done;
 343         }
 344       else
 345         if (unformat
 346             (line_input,
 347              "set %U ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
 348              unformat_token, valid_chars, &name,
 349              unformat_ikev2_transform_encr_type, &crypto_alg, &tmp1,
 350              unformat_ikev2_transform_integ_type, &integ_alg,
 351              unformat_ikev2_transform_dh_type, &dh_type))
 352         {
 353           r =
 354             ikev2_set_profile_ike_transforms (vm, name, crypto_alg, integ_alg,
 355                                               dh_type, tmp1);
 356           goto done;
 357         }
 358       else
 359         if (unformat
 360             (line_input,
 361              "set %U ike-crypto-alg %U %u ike-dh %U",
 362              unformat_token, valid_chars, &name,
 363              unformat_ikev2_transform_encr_type, &crypto_alg, &tmp1,
 364              unformat_ikev2_transform_dh_type, &dh_type))
 365         {
 366           r =
 367             ikev2_set_profile_ike_transforms (vm, name, crypto_alg,
 368                                               IKEV2_TRANSFORM_INTEG_TYPE_NONE,
 369                                               dh_type, tmp1);
 370           goto done;
 371         }
 372       else
 373         if (unformat
 374             (line_input,
 375              "set %U esp-crypto-alg %U %u esp-integ-alg %U",
 376              unformat_token, valid_chars, &name,
 377              unformat_ikev2_transform_encr_type, &crypto_alg, &tmp1,
 378              unformat_ikev2_transform_integ_type, &integ_alg))
 379         {
 380           r =
 381             ikev2_set_profile_esp_transforms (vm, name, crypto_alg, integ_alg,
 382                                               IKEV2_TRANSFORM_DH_TYPE_NONE,
 383                                               tmp1);
 384           goto done;
 385         }
 386       else if (unformat
 387                (line_input,
 388                 "set %U esp-crypto-alg %U %u",
 389                 unformat_token, valid_chars, &name,
 390                 unformat_ikev2_transform_encr_type, &crypto_alg, &tmp1))
 391         {
 392           r =
 393             ikev2_set_profile_esp_transforms (vm, name, crypto_alg, 0,
 394                                               IKEV2_TRANSFORM_DH_TYPE_NONE,
 395                                               tmp1);
 396           goto done;
 397         }
 398       else if (unformat (line_input, "set %U sa-lifetime %lu %u %u %lu",
 399                          unformat_token, valid_chars, &name,
 400                          &tmp4, &tmp1, &tmp2, &tmp5))
 401         {
 402           r =
 403             ikev2_set_profile_sa_lifetime (vm, name, tmp4, tmp1, tmp2, tmp5);
 404           goto done;
 405         }
 406       else if (unformat (line_input, "set %U udp-encap",
 407                          unformat_token, valid_chars, &name))
 408         {
 409           r = ikev2_set_profile_udp_encap (vm, name);
 410           goto done;
 411         }
 412       else if (unformat (line_input, "set %U ipsec-over-udp port %u",
 413                          unformat_token, valid_chars, &name, &tmp1))
 414         {
 415           int rv = ikev2_set_profile_ipsec_udp_port (vm, name, tmp1, 1);
 416           if (rv)
 417             r = clib_error_return (0, "Error: %U", format_vnet_api_errno, rv);
 418           goto done;
 419         }
 420       else
 421         break;
 422     }
 423
 424   r = clib_error_return (0, "parse error: '%U'",
 425                          format_unformat_error, line_input);
 426
 427 done:
 428   vec_free (name);
 429   vec_free (data);
 430   unformat_free (line_input);
 431   return r;
 432 }
 433
 434 /* *INDENT-OFF* */
 435 VLIB_CLI_COMMAND (ikev2_profile_add_del_command, static) = {
 436     .path = "ikev2 profile",
 437     .short_help =
 438     "ikev2 profile [add|del] <id>\n"
 439     "ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex]"
 440     " <data>\n"
 441     "ikev2 profile set <id> id <local|remote> <type> <data>\n"
 442     "ikev2 profile set <id> tunnel <interface>\n"
 443     "ikev2 profile set <id> udp-encap\n"
 444     "ikev2 profile set <id> traffic-selector <local|remote> ip-range "
 445     "<start-addr> - <end-addr> port-range <start-port> - <end-port> "
 446     "protocol <protocol-number>\n"
 447     "ikev2 profile set <id> responder <interface> <addr>\n"
 448     "ikev2 profile set <id> ike-crypto-alg <crypto alg> <key size> ike-integ-alg <integ alg> ike-dh <dh type>\n"
 449     "ikev2 profile set <id> esp-crypto-alg <crypto alg> <key size> "
 450       "[esp-integ-alg <integ alg>]\n"
 451     "ikev2 profile set <id> sa-lifetime <seconds> <jitter> <handover> <max bytes>",
 452     .function = ikev2_profile_add_del_command_fn,
 453 };
 454 /* *INDENT-ON* */
 455
 456 static clib_error_t *
 457 show_ikev2_profile_command_fn (vlib_main_t * vm,
 458                                unformat_input_t * input,
 459                                vlib_cli_command_t * cmd)
 460 {
 461   ikev2_main_t *km = &ikev2_main;
 462   ikev2_profile_t *p;
 463
 464   /* *INDENT-OFF* */
 465   pool_foreach (p, km->profiles, ({
 466     vlib_cli_output(vm, "profile %v", p->name);
 467
 468     if (p->auth.data)
 469       {
 470         if (p->auth.hex)
 471           vlib_cli_output(vm, "  auth-method %U auth data 0x%U",
 472                           format_ikev2_auth_method, p->auth.method,
 473                           format_hex_bytes, p->auth.data, vec_len(p->auth.data));
 474         else
 475           vlib_cli_output(vm, "  auth-method %U auth data %v",
 476                    format_ikev2_auth_method, p->auth.method, p->auth.data);
 477       }
 478
 479     if (p->loc_id.data)
 480       {
 481         if (p->loc_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
 482           vlib_cli_output(vm, "  local id-type %U data %U",
 483                           format_ikev2_id_type, p->loc_id.type,
 484                           format_ip4_address, p->loc_id.data);
 485         else if (p->loc_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
 486           vlib_cli_output(vm, "  local id-type %U data 0x%U",
 487                           format_ikev2_id_type, p->loc_id.type,
 488                           format_hex_bytes, p->loc_id.data,
 489                           vec_len(p->loc_id.data));
 490         else
 491           vlib_cli_output(vm, "  local id-type %U data %v",
 492                           format_ikev2_id_type, p->loc_id.type, p->loc_id.data);
 493       }
 494
 495     if (p->rem_id.data)
 496       {
 497         if (p->rem_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
 498           vlib_cli_output(vm, "  remote id-type %U data %U",
 499                           format_ikev2_id_type, p->rem_id.type,
 500                           format_ip4_address, p->rem_id.data);
 501         else if (p->rem_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
 502           vlib_cli_output(vm, "  remote id-type %U data 0x%U",
 503                           format_ikev2_id_type, p->rem_id.type,
 504                           format_hex_bytes, p->rem_id.data,
 505                           vec_len(p->rem_id.data));
 506         else
 507           vlib_cli_output(vm, "  remote id-type %U data %v",
 508                           format_ikev2_id_type, p->rem_id.type, p->rem_id.data);
 509       }
 510
 511     if (p->loc_ts.end_addr.as_u32)
 512       vlib_cli_output(vm, "  local traffic-selector addr %U - %U port %u - %u"
 513                       " protocol %u",
 514                       format_ip4_address, &p->loc_ts.start_addr,
 515                       format_ip4_address, &p->loc_ts.end_addr,
 516                       p->loc_ts.start_port, p->loc_ts.end_port,
 517                       p->loc_ts.protocol_id);
 518
 519     if (p->rem_ts.end_addr.as_u32)
 520       vlib_cli_output(vm, "  remote traffic-selector addr %U - %U port %u - %u"
 521                       " protocol %u",
 522                       format_ip4_address, &p->rem_ts.start_addr,
 523                       format_ip4_address, &p->rem_ts.end_addr,
 524                       p->rem_ts.start_port, p->rem_ts.end_port,
 525                       p->rem_ts.protocol_id);
 526     if (~0 != p->tun_itf)
 527       vlib_cli_output(vm, "  protected tunnel %U",
 528                       format_vnet_sw_if_index_name, vnet_get_main(), p->tun_itf);
 529     if (~0 != p->responder.sw_if_index)
 530       vlib_cli_output(vm, "  responder %U %U",
 531                       format_vnet_sw_if_index_name, vnet_get_main(), p->responder.sw_if_index,
 532                       format_ip4_address, &p->responder.ip4);
 533     if (p->udp_encap)
 534       vlib_cli_output(vm, "  udp-encap");
 535
 536     if (p->ipsec_over_udp_port != IPSEC_UDP_PORT_NONE)
 537       vlib_cli_output(vm, "  ipsec-over-udp port %d", p->ipsec_over_udp_port);
 538
 539     if (p->ike_ts.crypto_alg || p->ike_ts.integ_alg || p->ike_ts.dh_type || p->ike_ts.crypto_key_size)
 540       vlib_cli_output(vm, "  ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
 541                     format_ikev2_transform_encr_type, p->ike_ts.crypto_alg, p->ike_ts.crypto_key_size,
 542                     format_ikev2_transform_integ_type, p->ike_ts.integ_alg,
 543                     format_ikev2_transform_dh_type, p->ike_ts.dh_type);
 544
 545     if (p->esp_ts.crypto_alg || p->esp_ts.integ_alg || p->esp_ts.dh_type)
 546       vlib_cli_output(vm, "  esp-crypto-alg %U %u esp-integ-alg %U",
 547                     format_ikev2_transform_encr_type, p->esp_ts.crypto_alg, p->esp_ts.crypto_key_size,
 548                     format_ikev2_transform_integ_type, p->esp_ts.integ_alg);
 549
 550     vlib_cli_output(vm, "  lifetime %d jitter %d handover %d maxdata %d",
 551                     p->lifetime, p->lifetime_jitter, p->handover, p->lifetime_maxdata);
 552   }));
 553   /* *INDENT-ON* */
 554
 555   return 0;
 556 }
 557
 558 /* *INDENT-OFF* */
 559 VLIB_CLI_COMMAND (show_ikev2_profile_command, static) = {
 560     .path = "show ikev2 profile",
 561     .short_help = "show ikev2 profile",
 562     .function = show_ikev2_profile_command_fn,
 563 };
 564 /* *INDENT-ON* */
 565
 566 static clib_error_t *
 567 set_ikev2_liveness_period_fn (vlib_main_t * vm,
 568                               unformat_input_t * input,
 569                               vlib_cli_command_t * cmd)
 570 {
 571   unformat_input_t _line_input, *line_input = &_line_input;
 572   clib_error_t *r = 0;
 573   u32 period = 0, max_retries = 0;
 574
 575   if (!unformat_user (input, unformat_line_input, line_input))
 576     return 0;
 577
 578   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 579     {
 580       if (unformat (line_input, "%d %d", &period, &max_retries))
 581         {
 582           r = ikev2_set_liveness_params (period, max_retries);
 583           goto done;
 584         }
 585       else
 586         break;
 587     }
 588
 589   r = clib_error_return (0, "parse error: '%U'",
 590                          format_unformat_error, line_input);
 591
 592 done:
 593   unformat_free (line_input);
 594   return r;
 595 }
 596
 597 /* *INDENT-OFF* */
 598 VLIB_CLI_COMMAND (set_ikev2_liveness_command, static) = {
 599   .path = "ikev2 set liveness",
 600   .short_help = "ikev2 set liveness <period> <max-retires>",
 601   .function = set_ikev2_liveness_period_fn,
 602 };
 603 /* *INDENT-ON* */
 604
 605 static clib_error_t *
 606 set_ikev2_local_key_command_fn (vlib_main_t * vm,
 607                                 unformat_input_t * input,
 608                                 vlib_cli_command_t * cmd)
 609 {
 610   unformat_input_t _line_input, *line_input = &_line_input;
 611   clib_error_t *r = 0;
 612   u8 *data = 0;
 613
 614   if (!unformat_user (input, unformat_line_input, line_input))
 615     return 0;
 616
 617   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 618     {
 619       if (unformat (line_input, "%s", &data))
 620         {
 621           r = ikev2_set_local_key (vm, data);
 622           goto done;
 623         }
 624       else
 625         break;
 626     }
 627
 628   r = clib_error_return (0, "parse error: '%U'",
 629                          format_unformat_error, line_input);
 630
 631 done:
 632   vec_free (data);
 633   unformat_free (line_input);
 634   return r;
 635 }
 636
 637 /* *INDENT-OFF* */
 638 VLIB_CLI_COMMAND (set_ikev2_local_key_command, static) = {
 639     .path = "set ikev2 local key",
 640     .short_help =
 641     "set ikev2 local key <file>",
 642     .function = set_ikev2_local_key_command_fn,
 643 };
 644 /* *INDENT-ON* */
 645
 646
 647 static clib_error_t *
 648 ikev2_initiate_command_fn (vlib_main_t * vm,
 649                            unformat_input_t * input, vlib_cli_command_t * cmd)
 650 {
 651   unformat_input_t _line_input, *line_input = &_line_input;
 652   clib_error_t *r = 0;
 653   u8 *name = 0;
 654   u32 tmp1;
 655   u64 tmp2;
 656
 657   const char *valid_chars = "a-zA-Z0-9_";
 658
 659   if (!unformat_user (input, unformat_line_input, line_input))
 660     return 0;
 661
 662   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 663     {
 664       if (unformat
 665           (line_input, "sa-init %U", unformat_token, valid_chars, &name))
 666         {
 667           r = ikev2_initiate_sa_init (vm, name);
 668           goto done;
 669         }
 670       else if (unformat (line_input, "del-child-sa %x", &tmp1))
 671         {
 672           r = ikev2_initiate_delete_child_sa (vm, tmp1);
 673           goto done;
 674         }
 675       else if (unformat (line_input, "del-sa %lx", &tmp2))
 676         {
 677           r = ikev2_initiate_delete_ike_sa (vm, tmp2);
 678           goto done;
 679         }
 680       else if (unformat (line_input, "rekey-child-sa %x", &tmp1))
 681         {
 682           r = ikev2_initiate_rekey_child_sa (vm, tmp1);
 683           goto done;
 684         }
 685       else
 686         break;
 687     }
 688
 689   r = clib_error_return (0, "parse error: '%U'",
 690                          format_unformat_error, line_input);
 691
 692 done:
 693   vec_free (name);
 694   unformat_free (line_input);
 695   return r;
 696 }
 697
 698 /* *INDENT-OFF* */
 699 VLIB_CLI_COMMAND (ikev2_initiate_command, static) = {
 700     .path = "ikev2 initiate",
 701     .short_help =
 702         "ikev2 initiate sa-init <profile id>\n"
 703         "ikev2 initiate del-child-sa <child sa ispi>\n"
 704         "ikev2 initiate del-sa <sa ispi>\n"
 705         "ikev2 initiate rekey-child-sa <profile id> <child sa ispi>\n",
 706     .function = ikev2_initiate_command_fn,
 707 };
 708 /* *INDENT-ON* */
 709
 710 void
 711 ikev2_cli_reference (void)
 712 {
 713 }
 714
 715 static clib_error_t *
 716 ikev2_set_log_level_command_fn (vlib_main_t * vm,
 717                                 unformat_input_t * input,
 718                                 vlib_cli_command_t * cmd)
 719 {
 720   unformat_input_t _line_input, *line_input = &_line_input;
 721   u32 log_level = IKEV2_LOG_NONE;
 722   clib_error_t *error = 0;
 723
 724   /* Get a line of input. */
 725   if (!unformat_user (input, unformat_line_input, line_input))
 726     return 0;
 727
 728   if (!unformat (line_input, "%d", &log_level))
 729     {
 730       error = clib_error_return (0, "unknown input '%U'",
 731                                  format_unformat_error, line_input);
 732       goto done;
 733     }
 734   int rc = ikev2_set_log_level (log_level);
 735   if (rc < 0)
 736     error = clib_error_return (0, "setting log level failed!");
 737
 738 done:
 739   unformat_free (line_input);
 740   return error;
 741 }
 742
 743 /* *INDENT-OFF* */
 744 VLIB_CLI_COMMAND (ikev2_set_log_level_command, static) = {
 745   .path = "ikev2 set logging level",
 746   .function = ikev2_set_log_level_command_fn,
 747   .short_help = "ikev2 set logging level <0-5>",
 748 };
 749 /* *INDENT-ON* */
 750
 751 /*
 752  * fd.io coding-style-patch-verification: ON
 753  *
 754  * Local Variables:
 755  * eval: (c-set-style "gnu")
 756  * End:
 757  */