blob: 0b0ed6c4f12ce80f8f60f9af16edf45d750fbce4 [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * decap.c : IPSec tunnel support
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
21#include <vnet/interface.h>
Pierre Pfister4c422f92018-12-10 11:19:08 +010022#include <vnet/fib/fib.h>
Neale Ranns12989b52019-09-26 16:20:19 +000023#include <vnet/ipip/ipip.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070024
25#include <vnet/ipsec/ipsec.h>
Neale Rannsc87b66c2019-02-07 07:26:12 -080026#include <vnet/ipsec/ipsec_tun.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070027
28static clib_error_t *
29set_interface_spd_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070030 unformat_input_t * input,
31 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -070032{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070033 unformat_input_t _line_input, *line_input = &_line_input;
Ed Warnickecb9cada2015-12-08 15:45:58 -070034 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070035 u32 sw_if_index = (u32) ~ 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -070036 u32 spd_id;
37 int is_add = 1;
Billy McFalla9a20e72017-02-15 11:39:12 -050038 clib_error_t *error = NULL;
Benoît Ganne40aa27e2020-11-06 14:14:23 +010039 int err;
Ed Warnickecb9cada2015-12-08 15:45:58 -070040
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070041 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -070042 return 0;
43
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070044 if (unformat
45 (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main,
46 &sw_if_index, &spd_id))
Ed Warnickecb9cada2015-12-08 15:45:58 -070047 ;
48 else if (unformat (line_input, "del"))
49 is_add = 0;
50 else
Billy McFalla9a20e72017-02-15 11:39:12 -050051 {
52 error = clib_error_return (0, "parse error: '%U'",
53 format_unformat_error, line_input);
54 goto done;
55 }
Ed Warnickecb9cada2015-12-08 15:45:58 -070056
Benoît Ganne40aa27e2020-11-06 14:14:23 +010057 err = ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
58 switch (err)
59 {
60 case VNET_API_ERROR_SYSCALL_ERROR_1:
61 error = clib_error_return (0, "no such spd-id");
62 break;
63 case VNET_API_ERROR_SYSCALL_ERROR_2:
64 error = clib_error_return (0, "spd already assigned");
65 break;
66 }
Ed Warnickecb9cada2015-12-08 15:45:58 -070067
Billy McFalla9a20e72017-02-15 11:39:12 -050068done:
69 unformat_free (line_input);
70
71 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -070072}
73
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070074/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070075VLIB_CLI_COMMAND (set_interface_spd_command, static) = {
76 .path = "set interface ipsec spd",
77 .short_help =
78 "set interface ipsec spd <int> <id>",
79 .function = set_interface_spd_command_fn,
80};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070081/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070082
83static clib_error_t *
84ipsec_sa_add_del_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070085 unformat_input_t * input,
86 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -070087{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070088 unformat_input_t _line_input, *line_input = &_line_input;
Neale Ranns8d7c5022019-02-06 01:41:05 -080089 ip46_address_t tun_src = { }, tun_dst =
90 {
91 };
92 ipsec_crypto_alg_t crypto_alg;
93 ipsec_integ_alg_t integ_alg;
94 ipsec_protocol_t proto;
95 ipsec_sa_flags_t flags;
96 clib_error_t *error;
Kingwel Xied3d12052019-03-07 06:34:30 -050097 ipsec_key_t ck = { 0 };
98 ipsec_key_t ik = { 0 };
Neale Rannsabc56602020-04-01 09:45:23 +000099 u32 id, spi, salt, sai;
100 u16 udp_src, udp_dst;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800101 int is_add, rv;
Benoît Gannebdd8b572020-07-28 15:56:15 +0200102 u32 m_args = 0;
Neale Ranns041add72020-01-02 04:06:10 +0000103 ip_dscp_t dscp;
Benoît Ganne40aa27e2020-11-06 14:14:23 +0100104 u32 tx_table_id;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700105
Neale Ranns8dc75c02019-12-10 01:08:19 +0000106 salt = 0;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800107 error = NULL;
108 is_add = 0;
109 flags = IPSEC_SA_FLAG_NONE;
110 proto = IPSEC_PROTOCOL_ESP;
Neale Rannse6be7022019-06-04 15:37:34 +0000111 integ_alg = IPSEC_INTEG_ALG_NONE;
112 crypto_alg = IPSEC_CRYPTO_ALG_NONE;
Neale Rannsabc56602020-04-01 09:45:23 +0000113 udp_src = udp_dst = IPSEC_UDP_PORT_NONE;
Neale Ranns041add72020-01-02 04:06:10 +0000114 dscp = IP_DSCP_CS0;
Benoît Ganne40aa27e2020-11-06 14:14:23 +0100115 tx_table_id = 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700116
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700117 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700118 return 0;
119
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700120 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
121 {
Neale Ranns8d7c5022019-02-06 01:41:05 -0800122 if (unformat (line_input, "add %u", &id))
Benoît Gannebdd8b572020-07-28 15:56:15 +0200123 {
124 is_add = 1;
125 m_args |= 1 << 0;
126 }
Neale Ranns8d7c5022019-02-06 01:41:05 -0800127 else if (unformat (line_input, "del %u", &id))
Benoît Gannebdd8b572020-07-28 15:56:15 +0200128 {
129 is_add = 0;
130 m_args |= 1 << 0;
131 }
Neale Ranns8d7c5022019-02-06 01:41:05 -0800132 else if (unformat (line_input, "spi %u", &spi))
Benoît Gannebdd8b572020-07-28 15:56:15 +0200133 m_args |= 1 << 1;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800134 else if (unformat (line_input, "salt 0x%x", &salt))
Neale Ranns80f6fd52019-04-16 02:41:34 +0000135 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700136 else if (unformat (line_input, "esp"))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800137 proto = IPSEC_PROTOCOL_ESP;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700138 else if (unformat (line_input, "ah"))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800139 proto = IPSEC_PROTOCOL_AH;
140 else if (unformat (line_input, "crypto-key %U",
141 unformat_ipsec_key, &ck))
142 ;
143 else if (unformat (line_input, "crypto-alg %U",
144 unformat_ipsec_crypto_alg, &crypto_alg))
145 ;
146 else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik))
147 ;
148 else if (unformat (line_input, "integ-alg %U",
149 unformat_ipsec_integ_alg, &integ_alg))
150 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700151 else if (unformat (line_input, "tunnel-src %U",
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500152 unformat_ip46_address, &tun_src, IP46_TYPE_ANY))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700153 {
Neale Ranns8d7c5022019-02-06 01:41:05 -0800154 flags |= IPSEC_SA_FLAG_IS_TUNNEL;
155 if (!ip46_address_is_ip4 (&tun_src))
156 flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700157 }
158 else if (unformat (line_input, "tunnel-dst %U",
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500159 unformat_ip46_address, &tun_dst, IP46_TYPE_ANY))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800160 ;
Benoît Ganne40aa27e2020-11-06 14:14:23 +0100161 else if (unformat (line_input, "tx-table-id %d", &tx_table_id))
162 ;
Christian Hopps99975382020-07-17 09:53:18 -0400163 else if (unformat (line_input, "inbound"))
164 flags |= IPSEC_SA_FLAG_IS_INBOUND;
165 else if (unformat (line_input, "use-anti-replay"))
166 flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
167 else if (unformat (line_input, "use-esn"))
168 flags |= IPSEC_SA_FLAG_USE_ESN;
Radu Nicolau717de092018-08-03 10:37:24 +0100169 else if (unformat (line_input, "udp-encap"))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800170 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700171 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500172 {
173 error = clib_error_return (0, "parse error: '%U'",
174 format_unformat_error, line_input);
175 goto done;
176 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700177 }
Christian Hopps99975382020-07-17 09:53:18 -0400178 if ((flags & IPSEC_SA_FLAG_IS_INBOUND)
179 && !(flags & IPSEC_SA_FLAG_IS_TUNNEL))
180 {
181 error = clib_error_return (0, "inbound specified on non-tunnel SA");
182 goto done;
183 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700184
Benoît Gannebdd8b572020-07-28 15:56:15 +0200185 if (!(m_args & 1))
186 {
187 error = clib_error_return (0, "missing id");
188 goto done;
189 }
190
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000191 if (is_add)
Benoît Gannebdd8b572020-07-28 15:56:15 +0200192 {
193 if (!(m_args & 2))
194 {
195 error = clib_error_return (0, "missing spi");
196 goto done;
197 }
198 rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
199 &ck, integ_alg, &ik, flags,
Benoît Ganne40aa27e2020-11-06 14:14:23 +0100200 tx_table_id, clib_host_to_net_u32 (salt),
Neale Ranns041add72020-01-02 04:06:10 +0000201 &tun_src, &tun_dst,
202 TUNNEL_ENCAP_DECAP_FLAG_NONE, dscp,
203 &sai, udp_src, udp_dst);
Benoît Gannebdd8b572020-07-28 15:56:15 +0200204 }
Neale Ranns8d7c5022019-02-06 01:41:05 -0800205 else
Benoît Gannebdd8b572020-07-28 15:56:15 +0200206 {
207 rv = ipsec_sa_unlock_id (id);
208 }
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000209
Neale Ranns8d7c5022019-02-06 01:41:05 -0800210 if (rv)
Neale Rannse6be7022019-06-04 15:37:34 +0000211 error = clib_error_return (0, "failed");
Ed Warnickecb9cada2015-12-08 15:45:58 -0700212
Billy McFalla9a20e72017-02-15 11:39:12 -0500213done:
214 unformat_free (line_input);
215
216 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700217}
218
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700219/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700220VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = {
221 .path = "ipsec sa",
222 .short_help =
223 "ipsec sa [add|del]",
224 .function = ipsec_sa_add_del_command_fn,
225};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700226/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700227
228static clib_error_t *
229ipsec_spd_add_del_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700230 unformat_input_t * input,
231 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700232{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700233 unformat_input_t _line_input, *line_input = &_line_input;
Damjan Marion3f54b182016-08-16 11:27:02 +0200234 u32 spd_id = ~0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700235 int is_add = ~0;
Billy McFalla9a20e72017-02-15 11:39:12 -0500236 clib_error_t *error = NULL;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700237
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700238 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700239 return 0;
240
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700241 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
242 {
243 if (unformat (line_input, "add"))
244 is_add = 1;
245 else if (unformat (line_input, "del"))
246 is_add = 0;
247 else if (unformat (line_input, "%u", &spd_id))
248 ;
249 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500250 {
251 error = clib_error_return (0, "parse error: '%U'",
252 format_unformat_error, line_input);
253 goto done;
254 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700255 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700256
Damjan Marion3f54b182016-08-16 11:27:02 +0200257 if (spd_id == ~0)
Billy McFalla9a20e72017-02-15 11:39:12 -0500258 {
259 error = clib_error_return (0, "please specify SPD ID");
260 goto done;
261 }
Damjan Marion3f54b182016-08-16 11:27:02 +0200262
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700263 ipsec_add_del_spd (vm, spd_id, is_add);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700264
Billy McFalla9a20e72017-02-15 11:39:12 -0500265done:
266 unformat_free (line_input);
267
268 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700269}
270
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700271/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700272VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = {
273 .path = "ipsec spd",
274 .short_help =
275 "ipsec spd [add|del] <id>",
276 .function = ipsec_spd_add_del_command_fn,
277};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700278/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700279
280
281static clib_error_t *
282ipsec_policy_add_del_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700283 unformat_input_t * input,
284 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700285{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700286 unformat_input_t _line_input, *line_input = &_line_input;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700287 ipsec_policy_t p;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800288 int rv, is_add = 0;
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000289 u32 tmp, tmp2, stat_index, local_range_set, remote_range_set;
Billy McFalla9a20e72017-02-15 11:39:12 -0500290 clib_error_t *error = NULL;
Neale Ranns9f231d42019-03-19 10:06:00 +0000291 u32 is_outbound;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700292
Dave Barachb7b92992018-10-17 10:38:51 -0400293 clib_memset (&p, 0, sizeof (p));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700294 p.lport.stop = p.rport.stop = ~0;
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000295 remote_range_set = local_range_set = is_outbound = 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700296
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700297 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700298 return 0;
299
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700300 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
301 {
302 if (unformat (line_input, "add"))
303 is_add = 1;
304 else if (unformat (line_input, "del"))
305 is_add = 0;
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000306 else if (unformat (line_input, "ip6"))
307 p.is_ipv6 = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700308 else if (unformat (line_input, "spd %u", &p.id))
309 ;
310 else if (unformat (line_input, "inbound"))
Neale Ranns9f231d42019-03-19 10:06:00 +0000311 is_outbound = 0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700312 else if (unformat (line_input, "outbound"))
Neale Ranns9f231d42019-03-19 10:06:00 +0000313 is_outbound = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700314 else if (unformat (line_input, "priority %d", &p.priority))
315 ;
316 else if (unformat (line_input, "protocol %u", &tmp))
317 p.protocol = (u8) tmp;
318 else
319 if (unformat
320 (line_input, "action %U", unformat_ipsec_policy_action,
321 &p.policy))
322 {
323 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
Billy McFalla9a20e72017-02-15 11:39:12 -0500324 {
325 error = clib_error_return (0, "unsupported action: 'resolve'");
326 goto done;
327 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700328 }
329 else if (unformat (line_input, "sa %u", &p.sa_id))
330 ;
331 else if (unformat (line_input, "local-ip-range %U - %U",
332 unformat_ip4_address, &p.laddr.start.ip4,
333 unformat_ip4_address, &p.laddr.stop.ip4))
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000334 local_range_set = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700335 else if (unformat (line_input, "remote-ip-range %U - %U",
336 unformat_ip4_address, &p.raddr.start.ip4,
337 unformat_ip4_address, &p.raddr.stop.ip4))
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000338 remote_range_set = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700339 else if (unformat (line_input, "local-ip-range %U - %U",
340 unformat_ip6_address, &p.laddr.start.ip6,
341 unformat_ip6_address, &p.laddr.stop.ip6))
342 {
343 p.is_ipv6 = 1;
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000344 local_range_set = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700345 }
346 else if (unformat (line_input, "remote-ip-range %U - %U",
347 unformat_ip6_address, &p.raddr.start.ip6,
348 unformat_ip6_address, &p.raddr.stop.ip6))
349 {
350 p.is_ipv6 = 1;
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000351 remote_range_set = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700352 }
353 else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2))
354 {
355 p.lport.start = tmp;
356 p.lport.stop = tmp2;
357 }
358 else
359 if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2))
360 {
361 p.rport.start = tmp;
362 p.rport.stop = tmp2;
363 }
364 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500365 {
366 error = clib_error_return (0, "parse error: '%U'",
367 format_unformat_error, line_input);
368 goto done;
369 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700370 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700371
Neale Rannsb1fd80f2020-05-12 13:33:56 +0000372 if (!remote_range_set)
373 {
374 if (p.is_ipv6)
375 clib_memset (&p.raddr.stop.ip6, 0xff, 16);
376 else
377 clib_memset (&p.raddr.stop.ip4, 0xff, 4);
378 }
379 if (!local_range_set)
380 {
381 if (p.is_ipv6)
382 clib_memset (&p.laddr.stop.ip6, 0xff, 16);
383 else
384 clib_memset (&p.laddr.stop.ip4, 0xff, 4);
385 }
386
Neale Ranns9f231d42019-03-19 10:06:00 +0000387 rv = ipsec_policy_mk_type (is_outbound, p.is_ipv6, p.policy, &p.type);
388
389 if (rv)
390 {
391 error = clib_error_return (0, "unsupported policy type for:",
392 " outboud:%s %s action:%U",
393 (is_outbound ? "yes" : "no"),
394 (p.is_ipv6 ? "IPv4" : "IPv6"),
395 format_ipsec_policy_action, p.policy);
396 goto done;
397 }
398
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800399 rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index);
400
401 if (!rv)
402 vlib_cli_output (vm, "policy-index:%d", stat_index);
403 else
404 vlib_cli_output (vm, "error:%d", rv);
Billy McFalla9a20e72017-02-15 11:39:12 -0500405
406done:
407 unformat_free (line_input);
408
409 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700410}
411
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700412/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700413VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = {
414 .path = "ipsec policy",
415 .short_help =
416 "ipsec policy [add|del] spd <id> priority <n> ",
417 .function = ipsec_policy_add_del_command_fn,
418};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700419/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700420
Neale Rannsb294f102019-04-03 13:17:50 +0000421static void
Neale Ranns670027a2019-08-27 12:47:17 +0000422ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im, u8 detail)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700423{
Neale Rannsb294f102019-04-03 13:17:50 +0000424 u32 sai;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700425
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700426 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100427 pool_foreach_index (sai, im->sad) {
Neale Ranns670027a2019-08-27 12:47:17 +0000428 vlib_cli_output(vm, "%U", format_ipsec_sa, sai,
429 (detail ? IPSEC_FORMAT_DETAIL : IPSEC_FORMAT_BRIEF));
Damjan Marionb2c31b62020-12-13 21:47:40 +0100430 }
Neale Rannsb294f102019-04-03 13:17:50 +0000431 /* *INDENT-ON* */
432}
433
434static void
435ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im)
436{
437 u32 spdi;
438
439 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100440 pool_foreach_index (spdi, im->spds) {
Neale Rannsb294f102019-04-03 13:17:50 +0000441 vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
Damjan Marionb2c31b62020-12-13 21:47:40 +0100442 }
Neale Rannsb294f102019-04-03 13:17:50 +0000443 /* *INDENT-ON* */
444}
445
446static void
447ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im)
448{
449 u32 spd_id, sw_if_index;
Neale Rannsd83c4a82019-06-14 06:48:27 -0700450 ipsec_spd_t *spd;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700451
Neale Ranns311124e2019-01-24 04:52:25 -0800452 vlib_cli_output (vm, "SPD Bindings:");
Neale Ranns8d7c5022019-02-06 01:41:05 -0800453
Neale Rannsb294f102019-04-03 13:17:50 +0000454 /* *INDENT-OFF* */
Neale Ranns311124e2019-01-24 04:52:25 -0800455 hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
Neale Rannsd83c4a82019-06-14 06:48:27 -0700456 spd = pool_elt_at_index (im->spds, spd_id);
457 vlib_cli_output (vm, " %d -> %U", spd->id,
Neale Ranns8d7c5022019-02-06 01:41:05 -0800458 format_vnet_sw_if_index_name, im->vnet_main,
459 sw_if_index);
Neale Ranns311124e2019-01-24 04:52:25 -0800460 }));
461 /* *INDENT-ON* */
Neale Rannsb294f102019-04-03 13:17:50 +0000462}
Neale Ranns311124e2019-01-24 04:52:25 -0800463
Neale Ranns12989b52019-09-26 16:20:19 +0000464static walk_rc_t
465ipsec_tun_protect_show_one (index_t itpi, void *ctx)
Neale Rannsb294f102019-04-03 13:17:50 +0000466{
Neale Ranns28287212019-12-16 00:53:11 +0000467 vlib_cli_output (ctx, "%U", format_ipsec_tun_protect_index, itpi);
Neale Rannsb294f102019-04-03 13:17:50 +0000468
Neale Ranns12989b52019-09-26 16:20:19 +0000469 return (WALK_CONTINUE);
470}
471
472static void
473ipsec_tunnel_show_all (vlib_main_t * vm)
474{
475 ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm);
Neale Rannsb294f102019-04-03 13:17:50 +0000476}
477
478static clib_error_t *
479show_ipsec_command_fn (vlib_main_t * vm,
480 unformat_input_t * input, vlib_cli_command_t * cmd)
481{
482 ipsec_main_t *im = &ipsec_main;
483
Neale Ranns670027a2019-08-27 12:47:17 +0000484 ipsec_sa_show_all (vm, im, 0);
Neale Rannsb294f102019-04-03 13:17:50 +0000485 ipsec_spd_show_all (vm, im);
486 ipsec_spd_bindings_show_all (vm, im);
Neale Ranns12989b52019-09-26 16:20:19 +0000487 ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm);
Neale Rannsb294f102019-04-03 13:17:50 +0000488
Fan Zhangf5395782020-04-29 14:00:03 +0100489 vlib_cli_output (vm, "IPSec async mode: %s",
490 (im->async_mode ? "on" : "off"));
491
Ed Warnickecb9cada2015-12-08 15:45:58 -0700492 return 0;
493}
494
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700495/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700496VLIB_CLI_COMMAND (show_ipsec_command, static) = {
Neale Rannsb294f102019-04-03 13:17:50 +0000497 .path = "show ipsec all",
498 .short_help = "show ipsec all",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700499 .function = show_ipsec_command_fn,
500};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700501/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700502
503static clib_error_t *
Neale Rannsb294f102019-04-03 13:17:50 +0000504show_ipsec_sa_command_fn (vlib_main_t * vm,
505 unformat_input_t * input, vlib_cli_command_t * cmd)
506{
507 ipsec_main_t *im = &ipsec_main;
508 u32 sai = ~0;
Neale Ranns670027a2019-08-27 12:47:17 +0000509 u8 detail = 0;
Neale Rannsb294f102019-04-03 13:17:50 +0000510
511 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
512 {
513 if (unformat (input, "%u", &sai))
514 ;
Neale Ranns670027a2019-08-27 12:47:17 +0000515 if (unformat (input, "detail"))
516 detail = 1;
Neale Rannsb294f102019-04-03 13:17:50 +0000517 else
518 break;
519 }
520
521 if (~0 == sai)
Neale Ranns670027a2019-08-27 12:47:17 +0000522 ipsec_sa_show_all (vm, im, detail);
Neale Rannsb294f102019-04-03 13:17:50 +0000523 else
Christian E. Hopps01d61e72019-09-27 14:43:22 -0400524 vlib_cli_output (vm, "%U", format_ipsec_sa, sai,
525 IPSEC_FORMAT_DETAIL | IPSEC_FORMAT_INSECURE);
Neale Rannsb294f102019-04-03 13:17:50 +0000526
527 return 0;
528}
529
Neale Rannsc87b66c2019-02-07 07:26:12 -0800530static clib_error_t *
531clear_ipsec_sa_command_fn (vlib_main_t * vm,
532 unformat_input_t * input, vlib_cli_command_t * cmd)
533{
534 ipsec_main_t *im = &ipsec_main;
535 u32 sai = ~0;
536
537 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
538 {
539 if (unformat (input, "%u", &sai))
540 ;
541 else
542 break;
543 }
544
545 if (~0 == sai)
546 {
547 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100548 pool_foreach_index (sai, im->sad) {
Neale Rannsc87b66c2019-02-07 07:26:12 -0800549 ipsec_sa_clear(sai);
Damjan Marionb2c31b62020-12-13 21:47:40 +0100550 }
Neale Rannsc87b66c2019-02-07 07:26:12 -0800551 /* *INDENT-ON* */
552 }
553 else
554 {
555 if (pool_is_free_index (im->sad, sai))
556 return clib_error_return (0, "unknown SA index: %d", sai);
557 else
558 ipsec_sa_clear (sai);
559 }
560
561 return 0;
562}
563
Neale Rannsb294f102019-04-03 13:17:50 +0000564/* *INDENT-OFF* */
565VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = {
566 .path = "show ipsec sa",
567 .short_help = "show ipsec sa [index]",
568 .function = show_ipsec_sa_command_fn,
569};
Neale Rannsc87b66c2019-02-07 07:26:12 -0800570
571VLIB_CLI_COMMAND (clear_ipsec_sa_command, static) = {
572 .path = "clear ipsec sa",
573 .short_help = "clear ipsec sa [index]",
574 .function = clear_ipsec_sa_command_fn,
575};
Neale Rannsb294f102019-04-03 13:17:50 +0000576/* *INDENT-ON* */
577
578static clib_error_t *
579show_ipsec_spd_command_fn (vlib_main_t * vm,
580 unformat_input_t * input, vlib_cli_command_t * cmd)
581{
582 ipsec_main_t *im = &ipsec_main;
583 u8 show_bindings = 0;
584 u32 spdi = ~0;
585
586 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
587 {
588 if (unformat (input, "%u", &spdi))
589 ;
590 else if (unformat (input, "bindings"))
591 show_bindings = 1;
592 else
593 break;
594 }
595
596 if (show_bindings)
597 ipsec_spd_bindings_show_all (vm, im);
598 else if (~0 != spdi)
599 vlib_cli_output (vm, "%U", format_ipsec_spd, spdi);
600 else
601 ipsec_spd_show_all (vm, im);
602
603 return 0;
604}
605
606/* *INDENT-OFF* */
607VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = {
608 .path = "show ipsec spd",
609 .short_help = "show ipsec spd [index]",
610 .function = show_ipsec_spd_command_fn,
611};
612/* *INDENT-ON* */
613
614static clib_error_t *
615show_ipsec_tunnel_command_fn (vlib_main_t * vm,
616 unformat_input_t * input,
617 vlib_cli_command_t * cmd)
618{
Neale Ranns12989b52019-09-26 16:20:19 +0000619 ipsec_tunnel_show_all (vm);
Neale Rannsb294f102019-04-03 13:17:50 +0000620
621 return 0;
622}
623
624/* *INDENT-OFF* */
625VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
626 .path = "show ipsec tunnel",
Neale Ranns12989b52019-09-26 16:20:19 +0000627 .short_help = "show ipsec tunnel",
Neale Rannsb294f102019-04-03 13:17:50 +0000628 .function = show_ipsec_tunnel_command_fn,
629};
630/* *INDENT-ON* */
631
632static clib_error_t *
Klement Sekerab4d30532018-11-08 13:00:02 +0100633ipsec_show_backends_command_fn (vlib_main_t * vm,
634 unformat_input_t * input,
635 vlib_cli_command_t * cmd)
636{
637 ipsec_main_t *im = &ipsec_main;
638 u32 verbose = 0;
639
640 (void) unformat (input, "verbose %u", &verbose);
641
642 vlib_cli_output (vm, "IPsec AH backends available:");
643 u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
644 ipsec_ah_backend_t *ab;
645 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100646 pool_foreach (ab, im->ah_backends) {
Klement Sekerab4d30532018-11-08 13:00:02 +0100647 s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
648 ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
649 if (verbose) {
650 vlib_node_t *n;
651 n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
652 s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
653 n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
654 s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
655 n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
656 s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
657 n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
658 s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
659 }
Damjan Marionb2c31b62020-12-13 21:47:40 +0100660 }
Klement Sekerab4d30532018-11-08 13:00:02 +0100661 /* *INDENT-ON* */
662 vlib_cli_output (vm, "%v", s);
663 _vec_len (s) = 0;
664 vlib_cli_output (vm, "IPsec ESP backends available:");
665 s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
666 ipsec_esp_backend_t *eb;
667 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100668 pool_foreach (eb, im->esp_backends) {
Klement Sekerab4d30532018-11-08 13:00:02 +0100669 s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
670 eb - im->esp_backends == im->esp_current_backend ? "yes"
671 : "no");
672 if (verbose) {
673 vlib_node_t *n;
674 n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
675 s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
676 n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
677 s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
678 n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
679 s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
680 n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
681 s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
682 }
Damjan Marionb2c31b62020-12-13 21:47:40 +0100683 }
Klement Sekerab4d30532018-11-08 13:00:02 +0100684 /* *INDENT-ON* */
685 vlib_cli_output (vm, "%v", s);
686
687 vec_free (s);
688 return 0;
689}
690
691/* *INDENT-OFF* */
692VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
693 .path = "show ipsec backends",
694 .short_help = "show ipsec backends",
695 .function = ipsec_show_backends_command_fn,
696};
697/* *INDENT-ON* */
698
699static clib_error_t *
700ipsec_select_backend_command_fn (vlib_main_t * vm,
701 unformat_input_t * input,
702 vlib_cli_command_t * cmd)
703{
Klement Sekerab4d30532018-11-08 13:00:02 +0100704 unformat_input_t _line_input, *line_input = &_line_input;
Neale Rannse8915fc2019-04-23 20:57:55 -0400705 ipsec_main_t *im = &ipsec_main;
706 clib_error_t *error;
707 u32 backend_index;
708
709 error = ipsec_rsc_in_use (im);
710
711 if (error)
712 return error;
713
Klement Sekerab4d30532018-11-08 13:00:02 +0100714 /* Get a line of input. */
715 if (!unformat_user (input, unformat_line_input, line_input))
716 return 0;
717
718 if (unformat (line_input, "ah"))
719 {
720 if (unformat (line_input, "%u", &backend_index))
721 {
722 if (ipsec_select_ah_backend (im, backend_index) < 0)
723 {
724 return clib_error_return (0, "Invalid AH backend index `%u'",
725 backend_index);
726 }
727 }
728 else
729 {
730 return clib_error_return (0, "Invalid backend index `%U'",
731 format_unformat_error, line_input);
732 }
733 }
734 else if (unformat (line_input, "esp"))
735 {
736 if (unformat (line_input, "%u", &backend_index))
737 {
738 if (ipsec_select_esp_backend (im, backend_index) < 0)
739 {
740 return clib_error_return (0, "Invalid ESP backend index `%u'",
741 backend_index);
742 }
743 }
744 else
745 {
746 return clib_error_return (0, "Invalid backend index `%U'",
747 format_unformat_error, line_input);
748 }
749 }
750 else
751 {
752 return clib_error_return (0, "Unknown input `%U'",
753 format_unformat_error, line_input);
754 }
755
756 return 0;
757}
758
759/* *INDENT-OFF* */
760VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
761 .path = "ipsec select backend",
762 .short_help = "ipsec select backend <ah|esp> <backend index>",
763 .function = ipsec_select_backend_command_fn,
764};
765
766/* *INDENT-ON* */
767
768static clib_error_t *
Ed Warnickecb9cada2015-12-08 15:45:58 -0700769clear_ipsec_counters_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700770 unformat_input_t * input,
771 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700772{
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800773 vlib_clear_combined_counters (&ipsec_spd_policy_counters);
Neale Rannseba31ec2019-02-17 18:04:27 +0000774 vlib_clear_combined_counters (&ipsec_sa_counters);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700775
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800776 return (NULL);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700777}
778
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700779/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700780VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
781 .path = "clear ipsec counters",
782 .short_help = "clear ipsec counters",
783 .function = clear_ipsec_counters_command_fn,
784};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700785/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700786
Neale Rannsc87b66c2019-02-07 07:26:12 -0800787static clib_error_t *
788ipsec_tun_protect_cmd (vlib_main_t * vm,
789 unformat_input_t * input, vlib_cli_command_t * cmd)
790{
791 unformat_input_t _line_input, *line_input = &_line_input;
792 u32 sw_if_index, is_del, sa_in, sa_out, *sa_ins = NULL;
Neale Ranns28287212019-12-16 00:53:11 +0000793 ip_address_t peer = { };
Neale Rannsc87b66c2019-02-07 07:26:12 -0800794 vnet_main_t *vnm;
795
796 is_del = 0;
797 sw_if_index = ~0;
798 vnm = vnet_get_main ();
799
800 if (!unformat_user (input, unformat_line_input, line_input))
801 return 0;
802
803 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
804 {
805 if (unformat (line_input, "del"))
806 is_del = 1;
807 else if (unformat (line_input, "add"))
808 is_del = 0;
809 else if (unformat (line_input, "sa-in %d", &sa_in))
810 vec_add1 (sa_ins, sa_in);
811 else if (unformat (line_input, "sa-out %d", &sa_out))
812 ;
813 else if (unformat (line_input, "%U",
814 unformat_vnet_sw_interface, vnm, &sw_if_index))
815 ;
Neale Ranns28287212019-12-16 00:53:11 +0000816 else if (unformat (line_input, "%U", unformat_ip_address, &peer))
817 ;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800818 else
819 return (clib_error_return (0, "unknown input '%U'",
820 format_unformat_error, line_input));
821 }
822
823 if (!is_del)
Neale Ranns28287212019-12-16 00:53:11 +0000824 ipsec_tun_protect_update (sw_if_index, &peer, sa_out, sa_ins);
Eric Kinzie609d5792020-10-13 20:02:11 -0400825 else
826 ipsec_tun_protect_del (sw_if_index, &peer);
Neale Rannsc87b66c2019-02-07 07:26:12 -0800827
828 unformat_free (line_input);
829 return NULL;
830}
831
832/**
833 * Protect tunnel with IPSEC
834 */
835/* *INDENT-OFF* */
836VLIB_CLI_COMMAND (ipsec_tun_protect_cmd_node, static) =
837{
838 .path = "ipsec tunnel protect",
839 .function = ipsec_tun_protect_cmd,
Eric Kinzie609d5792020-10-13 20:02:11 -0400840 .short_help = "ipsec tunnel protect <interface> input-sa <SA> output-sa <SA> [add|del]",
Neale Rannsc87b66c2019-02-07 07:26:12 -0800841 // this is not MP safe
842};
843/* *INDENT-ON* */
844
Neale Rannsc87b66c2019-02-07 07:26:12 -0800845
846static clib_error_t *
847ipsec_tun_protect_show (vlib_main_t * vm,
848 unformat_input_t * input, vlib_cli_command_t * cmd)
849{
850 ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm);
851
852 return NULL;
853}
854
855/**
856 * show IPSEC tunnel protection
857 */
858/* *INDENT-OFF* */
859VLIB_CLI_COMMAND (ipsec_tun_protect_show_node, static) =
860{
861 .path = "show ipsec protect",
862 .function = ipsec_tun_protect_show,
863 .short_help = "show ipsec protect",
864};
865/* *INDENT-ON* */
866
Neale Ranns7b4e52f2020-05-24 16:17:50 +0000867static int
Neale Ranns302b25a2020-10-19 13:23:33 +0000868ipsec_tun_protect4_hash_show_one (clib_bihash_kv_8_16_t * kv, void *arg)
Neale Ranns7b4e52f2020-05-24 16:17:50 +0000869{
870 ipsec4_tunnel_kv_t *ikv = (ipsec4_tunnel_kv_t *) kv;
871 vlib_main_t *vm = arg;
872
873 vlib_cli_output (vm, " %U", format_ipsec4_tunnel_kv, ikv);
874
875 return (BIHASH_WALK_CONTINUE);
876}
877
878static int
Neale Ranns302b25a2020-10-19 13:23:33 +0000879ipsec_tun_protect6_hash_show_one (clib_bihash_kv_24_16_t * kv, void *arg)
Neale Ranns7b4e52f2020-05-24 16:17:50 +0000880{
881 ipsec6_tunnel_kv_t *ikv = (ipsec6_tunnel_kv_t *) kv;
882 vlib_main_t *vm = arg;
883
884 vlib_cli_output (vm, " %U", format_ipsec6_tunnel_kv, ikv);
885
886 return (BIHASH_WALK_CONTINUE);
887}
888
Neale Ranns41afb332019-07-16 06:19:35 -0700889static clib_error_t *
890ipsec_tun_protect_hash_show (vlib_main_t * vm,
891 unformat_input_t * input,
892 vlib_cli_command_t * cmd)
893{
894 ipsec_main_t *im = &ipsec_main;
895
896 {
Neale Ranns41afb332019-07-16 06:19:35 -0700897 vlib_cli_output (vm, "IPv4:");
898
Neale Ranns302b25a2020-10-19 13:23:33 +0000899 clib_bihash_foreach_key_value_pair_8_16
Neale Ranns7b4e52f2020-05-24 16:17:50 +0000900 (&im->tun4_protect_by_key, ipsec_tun_protect4_hash_show_one, vm);
Neale Ranns41afb332019-07-16 06:19:35 -0700901
902 vlib_cli_output (vm, "IPv6:");
903
Neale Ranns302b25a2020-10-19 13:23:33 +0000904 clib_bihash_foreach_key_value_pair_24_16
Neale Ranns7b4e52f2020-05-24 16:17:50 +0000905 (&im->tun6_protect_by_key, ipsec_tun_protect6_hash_show_one, vm);
Neale Ranns41afb332019-07-16 06:19:35 -0700906 }
907
908 return NULL;
909}
910
911/**
912 * show IPSEC tunnel protection hash tables
913 */
914/* *INDENT-OFF* */
915VLIB_CLI_COMMAND (ipsec_tun_protect_hash_show_node, static) =
916{
917 .path = "show ipsec protect-hash",
918 .function = ipsec_tun_protect_hash_show,
919 .short_help = "show ipsec protect-hash",
920};
921/* *INDENT-ON* */
922
Ed Warnickecb9cada2015-12-08 15:45:58 -0700923clib_error_t *
924ipsec_cli_init (vlib_main_t * vm)
925{
926 return 0;
927}
928
929VLIB_INIT_FUNCTION (ipsec_cli_init);
930
Fan Zhangf5395782020-04-29 14:00:03 +0100931static clib_error_t *
932set_async_mode_command_fn (vlib_main_t * vm, unformat_input_t * input,
933 vlib_cli_command_t * cmd)
934{
935 unformat_input_t _line_input, *line_input = &_line_input;
936 int async_enable = 0;
937
938 if (!unformat_user (input, unformat_line_input, line_input))
939 return 0;
940
941 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
942 {
943 if (unformat (line_input, "on"))
944 async_enable = 1;
945 else if (unformat (line_input, "off"))
946 async_enable = 0;
947 else
948 return (clib_error_return (0, "unknown input '%U'",
949 format_unformat_error, line_input));
950 }
951
952 vnet_crypto_request_async_mode (async_enable);
953 ipsec_set_async_mode (async_enable);
954
955 unformat_free (line_input);
956 return (NULL);
957}
958
959/* *INDENT-OFF* */
960VLIB_CLI_COMMAND (set_async_mode_command, static) = {
961 .path = "set ipsec async mode",
962 .short_help = "set ipsec async mode on|off",
963 .function = set_async_mode_command_fn,
964};
965/* *INDENT-ON* */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700966
967/*
968 * fd.io coding-style-patch-verification: ON
969 *
970 * Local Variables:
971 * eval: (c-set-style "gnu")
972 * End:
973 */