2 * decap.c : IPSec tunnel support
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/fib/fib.h>
24 #include <vnet/ipsec/ipsec.h>
27 set_interface_spd_command_fn (vlib_main_t * vm,
28 unformat_input_t * input,
29 vlib_cli_command_t * cmd)
31 unformat_input_t _line_input, *line_input = &_line_input;
32 ipsec_main_t *im = &ipsec_main;
33 u32 sw_if_index = (u32) ~ 0;
36 clib_error_t *error = NULL;
38 if (!unformat_user (input, unformat_line_input, line_input))
42 (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main,
43 &sw_if_index, &spd_id))
45 else if (unformat (line_input, "del"))
49 error = clib_error_return (0, "parse error: '%U'",
50 format_unformat_error, line_input);
54 ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
57 unformat_free (line_input);
63 VLIB_CLI_COMMAND (set_interface_spd_command, static) = {
64 .path = "set interface ipsec spd",
66 "set interface ipsec spd <int> <id>",
67 .function = set_interface_spd_command_fn,
72 ipsec_sa_add_del_command_fn (vlib_main_t * vm,
73 unformat_input_t * input,
74 vlib_cli_command_t * cmd)
76 ipsec_main_t *im = &ipsec_main;
77 unformat_input_t _line_input, *line_input = &_line_input;
81 clib_error_t *error = NULL;
83 clib_memset (&sa, 0, sizeof (sa));
84 sa.tx_fib_index = ~((u32) 0); /* Only supported for ipsec interfaces */
86 if (!unformat_user (input, unformat_line_input, line_input))
89 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
91 if (unformat (line_input, "add %u", &sa.id))
93 else if (unformat (line_input, "del %u", &sa.id))
95 else if (unformat (line_input, "spi %u", &sa.spi))
97 else if (unformat (line_input, "esp"))
98 sa.protocol = IPSEC_PROTOCOL_ESP;
99 else if (unformat (line_input, "ah"))
101 sa.protocol = IPSEC_PROTOCOL_AH;
104 if (unformat (line_input, "crypto-key %U", unformat_hex_string, &ck))
105 sa.crypto_key_len = vec_len (ck);
108 (line_input, "crypto-alg %U", unformat_ipsec_crypto_alg,
111 if (sa.crypto_alg < IPSEC_CRYPTO_ALG_NONE ||
112 sa.crypto_alg >= IPSEC_CRYPTO_N_ALG)
114 error = clib_error_return (0, "unsupported crypto-alg: '%U'",
115 format_ipsec_crypto_alg,
121 if (unformat (line_input, "integ-key %U", unformat_hex_string, &ik))
122 sa.integ_key_len = vec_len (ik);
123 else if (unformat (line_input, "integ-alg %U", unformat_ipsec_integ_alg,
126 if (sa.integ_alg < IPSEC_INTEG_ALG_NONE ||
127 sa.integ_alg >= IPSEC_INTEG_N_ALG)
129 error = clib_error_return (0, "unsupported integ-alg: '%U'",
130 format_ipsec_integ_alg,
135 else if (unformat (line_input, "tunnel-src %U",
136 unformat_ip4_address, &sa.tunnel_src_addr.ip4))
138 else if (unformat (line_input, "tunnel-dst %U",
139 unformat_ip4_address, &sa.tunnel_dst_addr.ip4))
141 else if (unformat (line_input, "tunnel-src %U",
142 unformat_ip6_address, &sa.tunnel_src_addr.ip6))
145 sa.is_tunnel_ip6 = 1;
147 else if (unformat (line_input, "tunnel-dst %U",
148 unformat_ip6_address, &sa.tunnel_dst_addr.ip6))
151 sa.is_tunnel_ip6 = 1;
153 else if (unformat (line_input, "udp-encap"))
159 error = clib_error_return (0, "parse error: '%U'",
160 format_unformat_error, line_input);
165 if (sa.crypto_key_len > sizeof (sa.crypto_key))
166 sa.crypto_key_len = sizeof (sa.crypto_key);
168 if (sa.integ_key_len > sizeof (sa.integ_key))
169 sa.integ_key_len = sizeof (sa.integ_key);
172 memcpy (sa.crypto_key, ck, sa.crypto_key_len);
175 memcpy (sa.integ_key, ik, sa.integ_key_len);
179 error = ipsec_check_support_cb (im, &sa);
184 ipsec_add_del_sa (vm, &sa, is_add);
187 unformat_free (line_input);
193 VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = {
196 "ipsec sa [add|del]",
197 .function = ipsec_sa_add_del_command_fn,
201 static clib_error_t *
202 ipsec_spd_add_del_command_fn (vlib_main_t * vm,
203 unformat_input_t * input,
204 vlib_cli_command_t * cmd)
206 unformat_input_t _line_input, *line_input = &_line_input;
209 clib_error_t *error = NULL;
211 if (!unformat_user (input, unformat_line_input, line_input))
214 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
216 if (unformat (line_input, "add"))
218 else if (unformat (line_input, "del"))
220 else if (unformat (line_input, "%u", &spd_id))
224 error = clib_error_return (0, "parse error: '%U'",
225 format_unformat_error, line_input);
232 error = clib_error_return (0, "please specify SPD ID");
236 ipsec_add_del_spd (vm, spd_id, is_add);
239 unformat_free (line_input);
245 VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = {
248 "ipsec spd [add|del] <id>",
249 .function = ipsec_spd_add_del_command_fn,
254 static clib_error_t *
255 ipsec_policy_add_del_command_fn (vlib_main_t * vm,
256 unformat_input_t * input,
257 vlib_cli_command_t * cmd)
259 unformat_input_t _line_input, *line_input = &_line_input;
262 u32 tmp, tmp2, stat_index;
263 clib_error_t *error = NULL;
265 clib_memset (&p, 0, sizeof (p));
266 p.lport.stop = p.rport.stop = ~0;
267 p.laddr.stop.ip4.as_u32 = p.raddr.stop.ip4.as_u32 = (u32) ~ 0;
268 p.laddr.stop.ip6.as_u64[0] = p.laddr.stop.ip6.as_u64[1] = (u64) ~ 0;
269 p.raddr.stop.ip6.as_u64[0] = p.raddr.stop.ip6.as_u64[1] = (u64) ~ 0;
271 if (!unformat_user (input, unformat_line_input, line_input))
274 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
276 if (unformat (line_input, "add"))
278 else if (unformat (line_input, "del"))
280 else if (unformat (line_input, "spd %u", &p.id))
282 else if (unformat (line_input, "inbound"))
284 else if (unformat (line_input, "outbound"))
286 else if (unformat (line_input, "priority %d", &p.priority))
288 else if (unformat (line_input, "protocol %u", &tmp))
289 p.protocol = (u8) tmp;
292 (line_input, "action %U", unformat_ipsec_policy_action,
295 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
297 error = clib_error_return (0, "unsupported action: 'resolve'");
301 else if (unformat (line_input, "sa %u", &p.sa_id))
303 else if (unformat (line_input, "local-ip-range %U - %U",
304 unformat_ip4_address, &p.laddr.start.ip4,
305 unformat_ip4_address, &p.laddr.stop.ip4))
307 else if (unformat (line_input, "remote-ip-range %U - %U",
308 unformat_ip4_address, &p.raddr.start.ip4,
309 unformat_ip4_address, &p.raddr.stop.ip4))
311 else if (unformat (line_input, "local-ip-range %U - %U",
312 unformat_ip6_address, &p.laddr.start.ip6,
313 unformat_ip6_address, &p.laddr.stop.ip6))
317 else if (unformat (line_input, "remote-ip-range %U - %U",
318 unformat_ip6_address, &p.raddr.start.ip6,
319 unformat_ip6_address, &p.raddr.stop.ip6))
323 else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2))
329 if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2))
336 error = clib_error_return (0, "parse error: '%U'",
337 format_unformat_error, line_input);
342 /* Check if SA is for IPv6/AH which is not supported. Return error if TRUE. */
346 ipsec_main_t *im = &ipsec_main;
348 p1 = hash_get (im->sa_index_by_sa_id, p.sa_id);
352 clib_error_return (0, "SA with index %u not found", p.sa_id);
355 sa = pool_elt_at_index (im->sad, p1[0]);
356 if (sa && sa->protocol == IPSEC_PROTOCOL_AH && is_add && p.is_ipv6)
358 error = clib_error_return (0, "AH not supported for IPV6: '%U'",
359 format_unformat_error, line_input);
363 rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index);
366 vlib_cli_output (vm, "policy-index:%d", stat_index);
368 vlib_cli_output (vm, "error:%d", rv);
371 unformat_free (line_input);
377 VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = {
378 .path = "ipsec policy",
380 "ipsec policy [add|del] spd <id> priority <n> ",
381 .function = ipsec_policy_add_del_command_fn,
385 static clib_error_t *
386 set_ipsec_sa_key_command_fn (vlib_main_t * vm,
387 unformat_input_t * input,
388 vlib_cli_command_t * cmd)
390 unformat_input_t _line_input, *line_input = &_line_input;
393 clib_error_t *error = NULL;
395 clib_memset (&sa, 0, sizeof (sa));
397 if (!unformat_user (input, unformat_line_input, line_input))
400 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
402 if (unformat (line_input, "%u", &sa.id))
405 if (unformat (line_input, "crypto-key %U", unformat_hex_string, &ck))
406 sa.crypto_key_len = vec_len (ck);
408 if (unformat (line_input, "integ-key %U", unformat_hex_string, &ik))
409 sa.integ_key_len = vec_len (ik);
412 error = clib_error_return (0, "parse error: '%U'",
413 format_unformat_error, line_input);
418 if (sa.crypto_key_len > sizeof (sa.crypto_key))
419 sa.crypto_key_len = sizeof (sa.crypto_key);
421 if (sa.integ_key_len > sizeof (sa.integ_key))
422 sa.integ_key_len = sizeof (sa.integ_key);
425 strncpy ((char *) sa.crypto_key, (char *) ck, sa.crypto_key_len);
428 strncpy ((char *) sa.integ_key, (char *) ik, sa.integ_key_len);
430 ipsec_set_sa_key (vm, &sa);
433 unformat_free (line_input);
439 VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = {
440 .path = "set ipsec sa",
442 "set ipsec sa <id> crypto-key <key> integ-key <key>",
443 .function = set_ipsec_sa_key_command_fn,
447 static clib_error_t *
448 show_ipsec_command_fn (vlib_main_t * vm,
449 unformat_input_t * input, vlib_cli_command_t * cmd)
452 ipsec_main_t *im = &ipsec_main;
454 ipsec_tunnel_if_t *t;
455 vnet_hw_interface_t *hi;
458 u32 tx_table_id, spd_id, sw_if_index;
461 pool_foreach (sa, im->sad, ({
463 vlib_cli_output(vm, "sa %u spi %u mode %s protocol %s%s%s%s", sa->id, sa->spi,
464 sa->is_tunnel ? "tunnel" : "transport",
465 sa->protocol ? "esp" : "ah",
466 sa->udp_encap ? " udp-encap-enabled" : "",
467 sa->use_anti_replay ? " anti-replay" : "",
468 sa->use_esn ? " extended-sequence-number" : "");
469 if (sa->protocol == IPSEC_PROTOCOL_ESP) {
470 vlib_cli_output(vm, " crypto alg %U%s%U integrity alg %U%s%U",
471 format_ipsec_crypto_alg, sa->crypto_alg,
472 sa->crypto_alg ? " key " : "",
473 format_hex_bytes, sa->crypto_key, sa->crypto_key_len,
474 format_ipsec_integ_alg, sa->integ_alg,
475 sa->integ_alg ? " key " : "",
476 format_hex_bytes, sa->integ_key, sa->integ_key_len);
478 if (sa->is_tunnel && sa->is_tunnel_ip6) {
479 vlib_cli_output(vm, " tunnel src %U dst %U",
480 format_ip6_address, &sa->tunnel_src_addr.ip6,
481 format_ip6_address, &sa->tunnel_dst_addr.ip6);
482 } else if (sa->is_tunnel) {
483 vlib_cli_output(vm, " tunnel src %U dst %U",
484 format_ip4_address, &sa->tunnel_src_addr.ip4,
485 format_ip4_address, &sa->tunnel_dst_addr.ip4);
492 pool_foreach_index (i, im->spds, ({
493 vlib_cli_output(vm, "%U", format_ipsec_spd, i);
497 vlib_cli_output (vm, "SPD Bindings:");
499 hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
500 vlib_cli_output (vm, " %d -> %U", spd_id,
501 format_vnet_sw_if_index_name, im->vnet_main,
507 vlib_cli_output (vm, "tunnel interfaces");
509 pool_foreach (t, im->tunnel_interfaces, ({
510 if (t->hw_if_index == ~0)
512 hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
513 vlib_cli_output(vm, " %s seq", hi->name);
514 sa = pool_elt_at_index(im->sad, t->output_sa_index);
516 tx_table_id = fib_table_get_table_id(sa->tx_fib_index, FIB_PROTOCOL_IP4);
518 vlib_cli_output(vm, " seq %u seq-hi %u esn %u anti-replay %u udp-encap %u tx-table %u",
519 sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay, sa->udp_encap, tx_table_id);
520 vlib_cli_output(vm, " local-spi %u local-ip %U", sa->spi,
521 format_ip4_address, &sa->tunnel_src_addr.ip4);
522 vlib_cli_output(vm, " local-crypto %U %U",
523 format_ipsec_crypto_alg, sa->crypto_alg,
524 format_hex_bytes, sa->crypto_key, sa->crypto_key_len);
525 vlib_cli_output(vm, " local-integrity %U %U",
526 format_ipsec_integ_alg, sa->integ_alg,
527 format_hex_bytes, sa->integ_key, sa->integ_key_len);
528 sa = pool_elt_at_index(im->sad, t->input_sa_index);
529 vlib_cli_output(vm, " last-seq %u last-seq-hi %u esn %u anti-replay %u window %U",
530 sa->last_seq, sa->last_seq_hi, sa->use_esn,
532 format_ipsec_replay_window, sa->replay_window);
533 vlib_cli_output(vm, " remote-spi %u remote-ip %U", sa->spi,
534 format_ip4_address, &sa->tunnel_src_addr.ip4);
535 vlib_cli_output(vm, " remote-crypto %U %U",
536 format_ipsec_crypto_alg, sa->crypto_alg,
537 format_hex_bytes, sa->crypto_key, sa->crypto_key_len);
538 vlib_cli_output(vm, " remote-integrity %U %U",
539 format_ipsec_integ_alg, sa->integ_alg,
540 format_hex_bytes, sa->integ_key, sa->integ_key_len);
549 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
550 .path = "show ipsec",
551 .short_help = "show ipsec [backends]",
552 .function = show_ipsec_command_fn,
556 static clib_error_t *
557 ipsec_show_backends_command_fn (vlib_main_t * vm,
558 unformat_input_t * input,
559 vlib_cli_command_t * cmd)
561 ipsec_main_t *im = &ipsec_main;
564 (void) unformat (input, "verbose %u", &verbose);
566 vlib_cli_output (vm, "IPsec AH backends available:");
567 u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
568 ipsec_ah_backend_t *ab;
570 pool_foreach (ab, im->ah_backends, {
571 s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
572 ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
575 n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
576 s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
577 n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
578 s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
579 n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
580 s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
581 n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
582 s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
586 vlib_cli_output (vm, "%v", s);
588 vlib_cli_output (vm, "IPsec ESP backends available:");
589 s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
590 ipsec_esp_backend_t *eb;
592 pool_foreach (eb, im->esp_backends, {
593 s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
594 eb - im->esp_backends == im->esp_current_backend ? "yes"
598 n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
599 s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
600 n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
601 s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
602 n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
603 s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
604 n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
605 s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
609 vlib_cli_output (vm, "%v", s);
616 VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
617 .path = "show ipsec backends",
618 .short_help = "show ipsec backends",
619 .function = ipsec_show_backends_command_fn,
623 static clib_error_t *
624 ipsec_select_backend_command_fn (vlib_main_t * vm,
625 unformat_input_t * input,
626 vlib_cli_command_t * cmd)
629 ipsec_main_t *im = &ipsec_main;
631 if (pool_elts (im->sad) > 0)
633 return clib_error_return (0,
634 "Cannot change IPsec backend, while %u SA entries are configured",
635 pool_elts (im->sad));
638 unformat_input_t _line_input, *line_input = &_line_input;
639 /* Get a line of input. */
640 if (!unformat_user (input, unformat_line_input, line_input))
643 if (unformat (line_input, "ah"))
645 if (unformat (line_input, "%u", &backend_index))
647 if (ipsec_select_ah_backend (im, backend_index) < 0)
649 return clib_error_return (0, "Invalid AH backend index `%u'",
655 return clib_error_return (0, "Invalid backend index `%U'",
656 format_unformat_error, line_input);
659 else if (unformat (line_input, "esp"))
661 if (unformat (line_input, "%u", &backend_index))
663 if (ipsec_select_esp_backend (im, backend_index) < 0)
665 return clib_error_return (0, "Invalid ESP backend index `%u'",
671 return clib_error_return (0, "Invalid backend index `%U'",
672 format_unformat_error, line_input);
677 return clib_error_return (0, "Unknown input `%U'",
678 format_unformat_error, line_input);
685 VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
686 .path = "ipsec select backend",
687 .short_help = "ipsec select backend <ah|esp> <backend index>",
688 .function = ipsec_select_backend_command_fn,
693 static clib_error_t *
694 clear_ipsec_counters_command_fn (vlib_main_t * vm,
695 unformat_input_t * input,
696 vlib_cli_command_t * cmd)
698 vlib_clear_combined_counters (&ipsec_spd_policy_counters);
704 VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
705 .path = "clear ipsec counters",
706 .short_help = "clear ipsec counters",
707 .function = clear_ipsec_counters_command_fn,
711 static clib_error_t *
712 create_ipsec_tunnel_command_fn (vlib_main_t * vm,
713 unformat_input_t * input,
714 vlib_cli_command_t * cmd)
716 unformat_input_t _line_input, *line_input = &_line_input;
717 ipsec_add_del_tunnel_args_t a;
720 clib_error_t *error = NULL;
722 clib_memset (&a, 0, sizeof (a));
725 /* Get a line of input. */
726 if (!unformat_user (input, unformat_line_input, line_input))
729 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
732 (line_input, "local-ip %U", unformat_ip4_address, &a.local_ip))
736 (line_input, "remote-ip %U", unformat_ip4_address, &a.remote_ip))
738 else if (unformat (line_input, "local-spi %u", &a.local_spi))
740 else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
742 else if (unformat (line_input, "instance %u", &a.show_instance))
744 else if (unformat (line_input, "udp-encap"))
746 else if (unformat (line_input, "use-esn"))
748 else if (unformat (line_input, "use-anti-replay"))
750 else if (unformat (line_input, "tx-table %u", &a.tx_table_id))
752 else if (unformat (line_input, "del"))
756 error = clib_error_return (0, "unknown input `%U'",
757 format_unformat_error, line_input);
764 error = clib_error_return (0, "mandatory argument(s) missing");
768 rv = ipsec_add_del_tunnel_if (&a);
774 case VNET_API_ERROR_INVALID_VALUE:
776 error = clib_error_return (0,
777 "IPSec tunnel interface already exists...");
779 error = clib_error_return (0, "IPSec tunnel interface not exists...");
782 error = clib_error_return (0, "ipsec_register_interface returned %d",
788 unformat_free (line_input);
794 VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
795 .path = "create ipsec tunnel",
796 .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> "
797 "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] [use-esn] [use-anti-replay] "
798 "[tx-table <table-id>]",
799 .function = create_ipsec_tunnel_command_fn,
803 static clib_error_t *
804 set_interface_key_command_fn (vlib_main_t * vm,
805 unformat_input_t * input,
806 vlib_cli_command_t * cmd)
808 unformat_input_t _line_input, *line_input = &_line_input;
809 ipsec_main_t *im = &ipsec_main;
810 ipsec_if_set_key_type_t type = IPSEC_IF_SET_KEY_TYPE_NONE;
811 u32 hw_if_index = (u32) ~ 0;
814 clib_error_t *error = NULL;
816 if (!unformat_user (input, unformat_line_input, line_input))
819 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
821 if (unformat (line_input, "%U",
822 unformat_vnet_hw_interface, im->vnet_main, &hw_if_index))
826 (line_input, "local crypto %U", unformat_ipsec_crypto_alg, &alg))
827 type = IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO;
830 (line_input, "remote crypto %U", unformat_ipsec_crypto_alg, &alg))
831 type = IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO;
834 (line_input, "local integ %U", unformat_ipsec_integ_alg, &alg))
835 type = IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG;
838 (line_input, "remote integ %U", unformat_ipsec_integ_alg, &alg))
839 type = IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG;
840 else if (unformat (line_input, "%U", unformat_hex_string, &key))
844 error = clib_error_return (0, "parse error: '%U'",
845 format_unformat_error, line_input);
850 if (type == IPSEC_IF_SET_KEY_TYPE_NONE)
852 error = clib_error_return (0, "unknown key type");
856 if (alg > 0 && vec_len (key) == 0)
858 error = clib_error_return (0, "key is not specified");
862 if (hw_if_index == (u32) ~ 0)
864 error = clib_error_return (0, "interface not specified");
868 ipsec_set_interface_key (im->vnet_main, hw_if_index, type, alg, key);
872 unformat_free (line_input);
878 VLIB_CLI_COMMAND (set_interface_key_command, static) = {
879 .path = "set interface ipsec key",
881 "set interface ipsec key <int> <local|remote> <crypto|integ> <key type> <key>",
882 .function = set_interface_key_command_fn,
887 ipsec_cli_init (vlib_main_t * vm)
892 VLIB_INIT_FUNCTION (ipsec_cli_init);
896 * fd.io coding-style-patch-verification: ON
899 * eval: (c-set-style "gnu")