Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * decap.c : IPSec tunnel support |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | #include <vnet/interface.h> |
Pierre Pfister | 4c422f9 | 2018-12-10 11:19:08 +0100 | [diff] [blame] | 22 | #include <vnet/fib/fib.h> |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 23 | #include <vnet/ipip/ipip.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 24 | |
| 25 | #include <vnet/ipsec/ipsec.h> |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 26 | #include <vnet/ipsec/ipsec_tun.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 27 | |
| 28 | static clib_error_t * |
| 29 | set_interface_spd_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 30 | unformat_input_t * input, |
| 31 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 32 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 33 | unformat_input_t _line_input, *line_input = &_line_input; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 34 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 35 | u32 sw_if_index = (u32) ~ 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 36 | u32 spd_id; |
| 37 | int is_add = 1; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 38 | clib_error_t *error = NULL; |
Benoît Ganne | 40aa27e | 2020-11-06 14:14:23 +0100 | [diff] [blame] | 39 | int err; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 40 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 41 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 42 | return 0; |
| 43 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 44 | if (unformat |
| 45 | (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main, |
| 46 | &sw_if_index, &spd_id)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 47 | ; |
| 48 | else if (unformat (line_input, "del")) |
| 49 | is_add = 0; |
| 50 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 51 | { |
| 52 | error = clib_error_return (0, "parse error: '%U'", |
| 53 | format_unformat_error, line_input); |
| 54 | goto done; |
| 55 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 56 | |
Benoît Ganne | 40aa27e | 2020-11-06 14:14:23 +0100 | [diff] [blame] | 57 | err = ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add); |
| 58 | switch (err) |
| 59 | { |
| 60 | case VNET_API_ERROR_SYSCALL_ERROR_1: |
| 61 | error = clib_error_return (0, "no such spd-id"); |
| 62 | break; |
| 63 | case VNET_API_ERROR_SYSCALL_ERROR_2: |
| 64 | error = clib_error_return (0, "spd already assigned"); |
| 65 | break; |
| 66 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 67 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 68 | done: |
| 69 | unformat_free (line_input); |
| 70 | |
| 71 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 72 | } |
| 73 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 74 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 75 | VLIB_CLI_COMMAND (set_interface_spd_command, static) = { |
| 76 | .path = "set interface ipsec spd", |
| 77 | .short_help = |
| 78 | "set interface ipsec spd <int> <id>", |
| 79 | .function = set_interface_spd_command_fn, |
| 80 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 81 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 82 | |
| 83 | static clib_error_t * |
| 84 | ipsec_sa_add_del_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 85 | unformat_input_t * input, |
| 86 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 87 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 88 | unformat_input_t _line_input, *line_input = &_line_input; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 89 | ipsec_crypto_alg_t crypto_alg; |
| 90 | ipsec_integ_alg_t integ_alg; |
| 91 | ipsec_protocol_t proto; |
| 92 | ipsec_sa_flags_t flags; |
| 93 | clib_error_t *error; |
Kingwel Xie | d3d1205 | 2019-03-07 06:34:30 -0500 | [diff] [blame] | 94 | ipsec_key_t ck = { 0 }; |
| 95 | ipsec_key_t ik = { 0 }; |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 96 | u32 id, spi, salt, sai; |
Mohammed Hawari | 048189e | 2021-02-05 19:04:42 +0100 | [diff] [blame] | 97 | int i = 0; |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 98 | u16 udp_src, udp_dst; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 99 | int is_add, rv; |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 100 | u32 m_args = 0; |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 101 | tunnel_t tun = {}; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 102 | |
Neale Ranns | 8dc75c0 | 2019-12-10 01:08:19 +0000 | [diff] [blame] | 103 | salt = 0; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 104 | error = NULL; |
| 105 | is_add = 0; |
| 106 | flags = IPSEC_SA_FLAG_NONE; |
| 107 | proto = IPSEC_PROTOCOL_ESP; |
Neale Ranns | e6be702 | 2019-06-04 15:37:34 +0000 | [diff] [blame] | 108 | integ_alg = IPSEC_INTEG_ALG_NONE; |
| 109 | crypto_alg = IPSEC_CRYPTO_ALG_NONE; |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 110 | udp_src = udp_dst = IPSEC_UDP_PORT_NONE; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 111 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 112 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 113 | return 0; |
| 114 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 115 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 116 | { |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 117 | if (unformat (line_input, "add %u", &id)) |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 118 | { |
| 119 | is_add = 1; |
| 120 | m_args |= 1 << 0; |
| 121 | } |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 122 | else if (unformat (line_input, "del %u", &id)) |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 123 | { |
| 124 | is_add = 0; |
| 125 | m_args |= 1 << 0; |
| 126 | } |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 127 | else if (unformat (line_input, "spi %u", &spi)) |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 128 | m_args |= 1 << 1; |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 129 | else if (unformat (line_input, "salt 0x%x", &salt)) |
Neale Ranns | 80f6fd5 | 2019-04-16 02:41:34 +0000 | [diff] [blame] | 130 | ; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 131 | else if (unformat (line_input, "esp")) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 132 | proto = IPSEC_PROTOCOL_ESP; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 133 | else if (unformat (line_input, "ah")) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 134 | proto = IPSEC_PROTOCOL_AH; |
| 135 | else if (unformat (line_input, "crypto-key %U", |
| 136 | unformat_ipsec_key, &ck)) |
| 137 | ; |
| 138 | else if (unformat (line_input, "crypto-alg %U", |
| 139 | unformat_ipsec_crypto_alg, &crypto_alg)) |
| 140 | ; |
| 141 | else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik)) |
| 142 | ; |
| 143 | else if (unformat (line_input, "integ-alg %U", |
| 144 | unformat_ipsec_integ_alg, &integ_alg)) |
| 145 | ; |
Damjan Marion | c50bcbd | 2022-05-08 20:48:37 +0200 | [diff] [blame^] | 146 | else if (unformat (line_input, "%U", unformat_tunnel, &tun)) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 147 | { |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 148 | flags |= IPSEC_SA_FLAG_IS_TUNNEL; |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 149 | if (AF_IP6 == tunnel_get_af (&tun)) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 150 | flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 151 | } |
Mohammed Hawari | 048189e | 2021-02-05 19:04:42 +0100 | [diff] [blame] | 152 | else if (unformat (line_input, "udp-src-port %d", &i)) |
| 153 | udp_src = i; |
| 154 | else if (unformat (line_input, "udp-dst-port %d", &i)) |
| 155 | udp_dst = i; |
Christian Hopps | 9997538 | 2020-07-17 09:53:18 -0400 | [diff] [blame] | 156 | else if (unformat (line_input, "inbound")) |
| 157 | flags |= IPSEC_SA_FLAG_IS_INBOUND; |
| 158 | else if (unformat (line_input, "use-anti-replay")) |
| 159 | flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY; |
| 160 | else if (unformat (line_input, "use-esn")) |
| 161 | flags |= IPSEC_SA_FLAG_USE_ESN; |
Radu Nicolau | 717de09 | 2018-08-03 10:37:24 +0100 | [diff] [blame] | 162 | else if (unformat (line_input, "udp-encap")) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 163 | flags |= IPSEC_SA_FLAG_UDP_ENCAP; |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 164 | else if (unformat (line_input, "async")) |
| 165 | flags |= IPSEC_SA_FLAG_IS_ASYNC; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 166 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 167 | { |
| 168 | error = clib_error_return (0, "parse error: '%U'", |
| 169 | format_unformat_error, line_input); |
| 170 | goto done; |
| 171 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 172 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 173 | |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 174 | if (!(m_args & 1)) |
| 175 | { |
| 176 | error = clib_error_return (0, "missing id"); |
| 177 | goto done; |
| 178 | } |
| 179 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 180 | if (is_add) |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 181 | { |
| 182 | if (!(m_args & 2)) |
| 183 | { |
| 184 | error = clib_error_return (0, "missing spi"); |
| 185 | goto done; |
| 186 | } |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 187 | rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg, &ck, integ_alg, |
| 188 | &ik, flags, clib_host_to_net_u32 (salt), |
| 189 | udp_src, udp_dst, &tun, &sai); |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 190 | } |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 191 | else |
Benoît Ganne | bdd8b57 | 2020-07-28 15:56:15 +0200 | [diff] [blame] | 192 | { |
| 193 | rv = ipsec_sa_unlock_id (id); |
| 194 | } |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 195 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 196 | if (rv) |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 197 | error = clib_error_return (0, "failed: %d", rv); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 198 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 199 | done: |
| 200 | unformat_free (line_input); |
| 201 | |
| 202 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 203 | } |
| 204 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 205 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 206 | VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = { |
| 207 | .path = "ipsec sa", |
| 208 | .short_help = |
| 209 | "ipsec sa [add|del]", |
| 210 | .function = ipsec_sa_add_del_command_fn, |
| 211 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 212 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 213 | |
| 214 | static clib_error_t * |
| 215 | ipsec_spd_add_del_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 216 | unformat_input_t * input, |
| 217 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 218 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 219 | unformat_input_t _line_input, *line_input = &_line_input; |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 220 | u32 spd_id = ~0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 221 | int is_add = ~0; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 222 | clib_error_t *error = NULL; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 223 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 224 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 225 | return 0; |
| 226 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 227 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 228 | { |
| 229 | if (unformat (line_input, "add")) |
| 230 | is_add = 1; |
| 231 | else if (unformat (line_input, "del")) |
| 232 | is_add = 0; |
| 233 | else if (unformat (line_input, "%u", &spd_id)) |
| 234 | ; |
| 235 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 236 | { |
| 237 | error = clib_error_return (0, "parse error: '%U'", |
| 238 | format_unformat_error, line_input); |
| 239 | goto done; |
| 240 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 241 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 242 | |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 243 | if (spd_id == ~0) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 244 | { |
| 245 | error = clib_error_return (0, "please specify SPD ID"); |
| 246 | goto done; |
| 247 | } |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 248 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 249 | ipsec_add_del_spd (vm, spd_id, is_add); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 250 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 251 | done: |
| 252 | unformat_free (line_input); |
| 253 | |
| 254 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 255 | } |
| 256 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 257 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 258 | VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = { |
| 259 | .path = "ipsec spd", |
| 260 | .short_help = |
| 261 | "ipsec spd [add|del] <id>", |
| 262 | .function = ipsec_spd_add_del_command_fn, |
| 263 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 264 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 265 | |
| 266 | |
| 267 | static clib_error_t * |
| 268 | ipsec_policy_add_del_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 269 | unformat_input_t * input, |
| 270 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 271 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 272 | unformat_input_t _line_input, *line_input = &_line_input; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 273 | ipsec_policy_t p; |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 274 | int rv, is_add = 0; |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 275 | u32 tmp, tmp2, stat_index, local_range_set, remote_range_set; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 276 | clib_error_t *error = NULL; |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 277 | u32 is_outbound; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 278 | |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 279 | clib_memset (&p, 0, sizeof (p)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 280 | p.lport.stop = p.rport.stop = ~0; |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 281 | remote_range_set = local_range_set = is_outbound = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 282 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 283 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 284 | return 0; |
| 285 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 286 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 287 | { |
| 288 | if (unformat (line_input, "add")) |
| 289 | is_add = 1; |
| 290 | else if (unformat (line_input, "del")) |
| 291 | is_add = 0; |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 292 | else if (unformat (line_input, "ip6")) |
| 293 | p.is_ipv6 = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 294 | else if (unformat (line_input, "spd %u", &p.id)) |
| 295 | ; |
| 296 | else if (unformat (line_input, "inbound")) |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 297 | is_outbound = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 298 | else if (unformat (line_input, "outbound")) |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 299 | is_outbound = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 300 | else if (unformat (line_input, "priority %d", &p.priority)) |
| 301 | ; |
| 302 | else if (unformat (line_input, "protocol %u", &tmp)) |
| 303 | p.protocol = (u8) tmp; |
| 304 | else |
| 305 | if (unformat |
| 306 | (line_input, "action %U", unformat_ipsec_policy_action, |
| 307 | &p.policy)) |
| 308 | { |
| 309 | if (p.policy == IPSEC_POLICY_ACTION_RESOLVE) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 310 | { |
| 311 | error = clib_error_return (0, "unsupported action: 'resolve'"); |
| 312 | goto done; |
| 313 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 314 | } |
| 315 | else if (unformat (line_input, "sa %u", &p.sa_id)) |
| 316 | ; |
| 317 | else if (unformat (line_input, "local-ip-range %U - %U", |
| 318 | unformat_ip4_address, &p.laddr.start.ip4, |
| 319 | unformat_ip4_address, &p.laddr.stop.ip4)) |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 320 | local_range_set = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 321 | else if (unformat (line_input, "remote-ip-range %U - %U", |
| 322 | unformat_ip4_address, &p.raddr.start.ip4, |
| 323 | unformat_ip4_address, &p.raddr.stop.ip4)) |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 324 | remote_range_set = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 325 | else if (unformat (line_input, "local-ip-range %U - %U", |
| 326 | unformat_ip6_address, &p.laddr.start.ip6, |
| 327 | unformat_ip6_address, &p.laddr.stop.ip6)) |
| 328 | { |
| 329 | p.is_ipv6 = 1; |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 330 | local_range_set = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 331 | } |
| 332 | else if (unformat (line_input, "remote-ip-range %U - %U", |
| 333 | unformat_ip6_address, &p.raddr.start.ip6, |
| 334 | unformat_ip6_address, &p.raddr.stop.ip6)) |
| 335 | { |
| 336 | p.is_ipv6 = 1; |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 337 | remote_range_set = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 338 | } |
| 339 | else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2)) |
| 340 | { |
| 341 | p.lport.start = tmp; |
| 342 | p.lport.stop = tmp2; |
| 343 | } |
| 344 | else |
| 345 | if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2)) |
| 346 | { |
| 347 | p.rport.start = tmp; |
| 348 | p.rport.stop = tmp2; |
| 349 | } |
| 350 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 351 | { |
| 352 | error = clib_error_return (0, "parse error: '%U'", |
| 353 | format_unformat_error, line_input); |
| 354 | goto done; |
| 355 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 356 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 357 | |
Neale Ranns | b1fd80f | 2020-05-12 13:33:56 +0000 | [diff] [blame] | 358 | if (!remote_range_set) |
| 359 | { |
| 360 | if (p.is_ipv6) |
| 361 | clib_memset (&p.raddr.stop.ip6, 0xff, 16); |
| 362 | else |
| 363 | clib_memset (&p.raddr.stop.ip4, 0xff, 4); |
| 364 | } |
| 365 | if (!local_range_set) |
| 366 | { |
| 367 | if (p.is_ipv6) |
| 368 | clib_memset (&p.laddr.stop.ip6, 0xff, 16); |
| 369 | else |
| 370 | clib_memset (&p.laddr.stop.ip4, 0xff, 4); |
| 371 | } |
| 372 | |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 373 | rv = ipsec_policy_mk_type (is_outbound, p.is_ipv6, p.policy, &p.type); |
| 374 | |
| 375 | if (rv) |
| 376 | { |
| 377 | error = clib_error_return (0, "unsupported policy type for:", |
| 378 | " outboud:%s %s action:%U", |
| 379 | (is_outbound ? "yes" : "no"), |
| 380 | (p.is_ipv6 ? "IPv4" : "IPv6"), |
| 381 | format_ipsec_policy_action, p.policy); |
| 382 | goto done; |
| 383 | } |
| 384 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 385 | rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index); |
| 386 | |
| 387 | if (!rv) |
| 388 | vlib_cli_output (vm, "policy-index:%d", stat_index); |
| 389 | else |
| 390 | vlib_cli_output (vm, "error:%d", rv); |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 391 | |
| 392 | done: |
| 393 | unformat_free (line_input); |
| 394 | |
| 395 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 396 | } |
| 397 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 398 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 399 | VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = { |
| 400 | .path = "ipsec policy", |
| 401 | .short_help = |
| 402 | "ipsec policy [add|del] spd <id> priority <n> ", |
| 403 | .function = ipsec_policy_add_del_command_fn, |
| 404 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 405 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 406 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 407 | static void |
Neale Ranns | 670027a | 2019-08-27 12:47:17 +0000 | [diff] [blame] | 408 | ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im, u8 detail) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 409 | { |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 410 | u32 sai; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 411 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 412 | /* *INDENT-OFF* */ |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 413 | pool_foreach_index (sai, ipsec_sa_pool) |
| 414 | { |
| 415 | vlib_cli_output (vm, "%U", format_ipsec_sa, sai, |
| 416 | (detail ? IPSEC_FORMAT_DETAIL : IPSEC_FORMAT_BRIEF)); |
| 417 | } |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 418 | /* *INDENT-ON* */ |
| 419 | } |
| 420 | |
| 421 | static void |
| 422 | ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im) |
| 423 | { |
| 424 | u32 spdi; |
| 425 | |
| 426 | /* *INDENT-OFF* */ |
Damjan Marion | b2c31b6 | 2020-12-13 21:47:40 +0100 | [diff] [blame] | 427 | pool_foreach_index (spdi, im->spds) { |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 428 | vlib_cli_output(vm, "%U", format_ipsec_spd, spdi); |
Damjan Marion | b2c31b6 | 2020-12-13 21:47:40 +0100 | [diff] [blame] | 429 | } |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 430 | |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 431 | if (im->output_flow_cache_flag) |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 432 | { |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 433 | vlib_cli_output (vm, "%U", format_ipsec_out_spd_flow_cache); |
| 434 | } |
| 435 | if (im->input_flow_cache_flag) |
| 436 | { |
| 437 | vlib_cli_output (vm, "%U", format_ipsec_in_spd_flow_cache); |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 438 | } |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 439 | /* *INDENT-ON* */ |
| 440 | } |
| 441 | |
| 442 | static void |
| 443 | ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im) |
| 444 | { |
| 445 | u32 spd_id, sw_if_index; |
Neale Ranns | d83c4a8 | 2019-06-14 06:48:27 -0700 | [diff] [blame] | 446 | ipsec_spd_t *spd; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 447 | |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 448 | vlib_cli_output (vm, "SPD Bindings:"); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 449 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 450 | /* *INDENT-OFF* */ |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 451 | hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({ |
Neale Ranns | d83c4a8 | 2019-06-14 06:48:27 -0700 | [diff] [blame] | 452 | spd = pool_elt_at_index (im->spds, spd_id); |
| 453 | vlib_cli_output (vm, " %d -> %U", spd->id, |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 454 | format_vnet_sw_if_index_name, im->vnet_main, |
| 455 | sw_if_index); |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 456 | })); |
| 457 | /* *INDENT-ON* */ |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 458 | } |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 459 | |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 460 | static walk_rc_t |
| 461 | ipsec_tun_protect_show_one (index_t itpi, void *ctx) |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 462 | { |
Neale Ranns | 2828721 | 2019-12-16 00:53:11 +0000 | [diff] [blame] | 463 | vlib_cli_output (ctx, "%U", format_ipsec_tun_protect_index, itpi); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 464 | |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 465 | return (WALK_CONTINUE); |
| 466 | } |
| 467 | |
| 468 | static void |
| 469 | ipsec_tunnel_show_all (vlib_main_t * vm) |
| 470 | { |
| 471 | ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 472 | } |
| 473 | |
| 474 | static clib_error_t * |
| 475 | show_ipsec_command_fn (vlib_main_t * vm, |
| 476 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 477 | { |
| 478 | ipsec_main_t *im = &ipsec_main; |
| 479 | |
Neale Ranns | 670027a | 2019-08-27 12:47:17 +0000 | [diff] [blame] | 480 | ipsec_sa_show_all (vm, im, 0); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 481 | ipsec_spd_show_all (vm, im); |
| 482 | ipsec_spd_bindings_show_all (vm, im); |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 483 | ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 484 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 485 | vlib_cli_output (vm, "IPSec async mode: %s", |
| 486 | (im->async_mode ? "on" : "off")); |
| 487 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 488 | return 0; |
| 489 | } |
| 490 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 491 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 492 | VLIB_CLI_COMMAND (show_ipsec_command, static) = { |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 493 | .path = "show ipsec all", |
| 494 | .short_help = "show ipsec all", |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 495 | .function = show_ipsec_command_fn, |
| 496 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 497 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 498 | |
| 499 | static clib_error_t * |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 500 | show_ipsec_sa_command_fn (vlib_main_t * vm, |
| 501 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 502 | { |
| 503 | ipsec_main_t *im = &ipsec_main; |
| 504 | u32 sai = ~0; |
Neale Ranns | 670027a | 2019-08-27 12:47:17 +0000 | [diff] [blame] | 505 | u8 detail = 0; |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 506 | |
| 507 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 508 | { |
| 509 | if (unformat (input, "%u", &sai)) |
| 510 | ; |
Neale Ranns | 670027a | 2019-08-27 12:47:17 +0000 | [diff] [blame] | 511 | if (unformat (input, "detail")) |
| 512 | detail = 1; |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 513 | else |
| 514 | break; |
| 515 | } |
| 516 | |
| 517 | if (~0 == sai) |
Neale Ranns | 670027a | 2019-08-27 12:47:17 +0000 | [diff] [blame] | 518 | ipsec_sa_show_all (vm, im, detail); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 519 | else |
Christian E. Hopps | 01d61e7 | 2019-09-27 14:43:22 -0400 | [diff] [blame] | 520 | vlib_cli_output (vm, "%U", format_ipsec_sa, sai, |
| 521 | IPSEC_FORMAT_DETAIL | IPSEC_FORMAT_INSECURE); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 522 | |
| 523 | return 0; |
| 524 | } |
| 525 | |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 526 | static clib_error_t * |
| 527 | clear_ipsec_sa_command_fn (vlib_main_t * vm, |
| 528 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 529 | { |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 530 | u32 sai = ~0; |
| 531 | |
| 532 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 533 | { |
| 534 | if (unformat (input, "%u", &sai)) |
| 535 | ; |
| 536 | else |
| 537 | break; |
| 538 | } |
| 539 | |
| 540 | if (~0 == sai) |
| 541 | { |
| 542 | /* *INDENT-OFF* */ |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 543 | pool_foreach_index (sai, ipsec_sa_pool) |
| 544 | { |
| 545 | ipsec_sa_clear (sai); |
| 546 | } |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 547 | /* *INDENT-ON* */ |
| 548 | } |
| 549 | else |
| 550 | { |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 551 | if (pool_is_free_index (ipsec_sa_pool, sai)) |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 552 | return clib_error_return (0, "unknown SA index: %d", sai); |
| 553 | else |
| 554 | ipsec_sa_clear (sai); |
| 555 | } |
| 556 | |
| 557 | return 0; |
| 558 | } |
| 559 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 560 | /* *INDENT-OFF* */ |
| 561 | VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = { |
| 562 | .path = "show ipsec sa", |
| 563 | .short_help = "show ipsec sa [index]", |
| 564 | .function = show_ipsec_sa_command_fn, |
| 565 | }; |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 566 | |
| 567 | VLIB_CLI_COMMAND (clear_ipsec_sa_command, static) = { |
| 568 | .path = "clear ipsec sa", |
| 569 | .short_help = "clear ipsec sa [index]", |
| 570 | .function = clear_ipsec_sa_command_fn, |
| 571 | }; |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 572 | /* *INDENT-ON* */ |
| 573 | |
| 574 | static clib_error_t * |
| 575 | show_ipsec_spd_command_fn (vlib_main_t * vm, |
| 576 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 577 | { |
| 578 | ipsec_main_t *im = &ipsec_main; |
| 579 | u8 show_bindings = 0; |
| 580 | u32 spdi = ~0; |
| 581 | |
| 582 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 583 | { |
| 584 | if (unformat (input, "%u", &spdi)) |
| 585 | ; |
| 586 | else if (unformat (input, "bindings")) |
| 587 | show_bindings = 1; |
| 588 | else |
| 589 | break; |
| 590 | } |
| 591 | |
| 592 | if (show_bindings) |
| 593 | ipsec_spd_bindings_show_all (vm, im); |
| 594 | else if (~0 != spdi) |
| 595 | vlib_cli_output (vm, "%U", format_ipsec_spd, spdi); |
| 596 | else |
| 597 | ipsec_spd_show_all (vm, im); |
| 598 | |
| 599 | return 0; |
| 600 | } |
| 601 | |
| 602 | /* *INDENT-OFF* */ |
| 603 | VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = { |
| 604 | .path = "show ipsec spd", |
| 605 | .short_help = "show ipsec spd [index]", |
| 606 | .function = show_ipsec_spd_command_fn, |
| 607 | }; |
| 608 | /* *INDENT-ON* */ |
| 609 | |
| 610 | static clib_error_t * |
| 611 | show_ipsec_tunnel_command_fn (vlib_main_t * vm, |
| 612 | unformat_input_t * input, |
| 613 | vlib_cli_command_t * cmd) |
| 614 | { |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 615 | ipsec_tunnel_show_all (vm); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 616 | |
| 617 | return 0; |
| 618 | } |
| 619 | |
| 620 | /* *INDENT-OFF* */ |
| 621 | VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = { |
| 622 | .path = "show ipsec tunnel", |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 623 | .short_help = "show ipsec tunnel", |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 624 | .function = show_ipsec_tunnel_command_fn, |
| 625 | }; |
| 626 | /* *INDENT-ON* */ |
| 627 | |
| 628 | static clib_error_t * |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 629 | ipsec_show_backends_command_fn (vlib_main_t * vm, |
| 630 | unformat_input_t * input, |
| 631 | vlib_cli_command_t * cmd) |
| 632 | { |
| 633 | ipsec_main_t *im = &ipsec_main; |
| 634 | u32 verbose = 0; |
| 635 | |
| 636 | (void) unformat (input, "verbose %u", &verbose); |
| 637 | |
| 638 | vlib_cli_output (vm, "IPsec AH backends available:"); |
| 639 | u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); |
| 640 | ipsec_ah_backend_t *ab; |
| 641 | /* *INDENT-OFF* */ |
Damjan Marion | b2c31b6 | 2020-12-13 21:47:40 +0100 | [diff] [blame] | 642 | pool_foreach (ab, im->ah_backends) { |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 643 | s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends, |
| 644 | ab - im->ah_backends == im->ah_current_backend ? "yes" : "no"); |
| 645 | if (verbose) { |
| 646 | vlib_node_t *n; |
| 647 | n = vlib_get_node (vm, ab->ah4_encrypt_node_index); |
| 648 | s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index); |
| 649 | n = vlib_get_node (vm, ab->ah4_decrypt_node_index); |
| 650 | s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index); |
| 651 | n = vlib_get_node (vm, ab->ah6_encrypt_node_index); |
| 652 | s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index); |
| 653 | n = vlib_get_node (vm, ab->ah6_decrypt_node_index); |
| 654 | s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index); |
| 655 | } |
Damjan Marion | b2c31b6 | 2020-12-13 21:47:40 +0100 | [diff] [blame] | 656 | } |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 657 | /* *INDENT-ON* */ |
| 658 | vlib_cli_output (vm, "%v", s); |
Damjan Marion | 8bea589 | 2022-04-04 22:40:45 +0200 | [diff] [blame] | 659 | vec_set_len (s, 0); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 660 | vlib_cli_output (vm, "IPsec ESP backends available:"); |
| 661 | s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); |
| 662 | ipsec_esp_backend_t *eb; |
| 663 | /* *INDENT-OFF* */ |
Damjan Marion | b2c31b6 | 2020-12-13 21:47:40 +0100 | [diff] [blame] | 664 | pool_foreach (eb, im->esp_backends) { |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 665 | s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends, |
| 666 | eb - im->esp_backends == im->esp_current_backend ? "yes" |
| 667 | : "no"); |
| 668 | if (verbose) { |
| 669 | vlib_node_t *n; |
| 670 | n = vlib_get_node (vm, eb->esp4_encrypt_node_index); |
| 671 | s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index); |
| 672 | n = vlib_get_node (vm, eb->esp4_decrypt_node_index); |
| 673 | s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index); |
| 674 | n = vlib_get_node (vm, eb->esp6_encrypt_node_index); |
| 675 | s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index); |
| 676 | n = vlib_get_node (vm, eb->esp6_decrypt_node_index); |
| 677 | s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index); |
| 678 | } |
Damjan Marion | b2c31b6 | 2020-12-13 21:47:40 +0100 | [diff] [blame] | 679 | } |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 680 | /* *INDENT-ON* */ |
| 681 | vlib_cli_output (vm, "%v", s); |
| 682 | |
| 683 | vec_free (s); |
| 684 | return 0; |
| 685 | } |
| 686 | |
| 687 | /* *INDENT-OFF* */ |
| 688 | VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = { |
| 689 | .path = "show ipsec backends", |
| 690 | .short_help = "show ipsec backends", |
| 691 | .function = ipsec_show_backends_command_fn, |
| 692 | }; |
| 693 | /* *INDENT-ON* */ |
| 694 | |
| 695 | static clib_error_t * |
| 696 | ipsec_select_backend_command_fn (vlib_main_t * vm, |
| 697 | unformat_input_t * input, |
| 698 | vlib_cli_command_t * cmd) |
| 699 | { |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 700 | unformat_input_t _line_input, *line_input = &_line_input; |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 701 | ipsec_main_t *im = &ipsec_main; |
| 702 | clib_error_t *error; |
| 703 | u32 backend_index; |
| 704 | |
| 705 | error = ipsec_rsc_in_use (im); |
| 706 | |
| 707 | if (error) |
| 708 | return error; |
| 709 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 710 | /* Get a line of input. */ |
| 711 | if (!unformat_user (input, unformat_line_input, line_input)) |
| 712 | return 0; |
| 713 | |
| 714 | if (unformat (line_input, "ah")) |
| 715 | { |
| 716 | if (unformat (line_input, "%u", &backend_index)) |
| 717 | { |
| 718 | if (ipsec_select_ah_backend (im, backend_index) < 0) |
| 719 | { |
| 720 | return clib_error_return (0, "Invalid AH backend index `%u'", |
| 721 | backend_index); |
| 722 | } |
| 723 | } |
| 724 | else |
| 725 | { |
| 726 | return clib_error_return (0, "Invalid backend index `%U'", |
| 727 | format_unformat_error, line_input); |
| 728 | } |
| 729 | } |
| 730 | else if (unformat (line_input, "esp")) |
| 731 | { |
| 732 | if (unformat (line_input, "%u", &backend_index)) |
| 733 | { |
| 734 | if (ipsec_select_esp_backend (im, backend_index) < 0) |
| 735 | { |
| 736 | return clib_error_return (0, "Invalid ESP backend index `%u'", |
| 737 | backend_index); |
| 738 | } |
| 739 | } |
| 740 | else |
| 741 | { |
| 742 | return clib_error_return (0, "Invalid backend index `%U'", |
| 743 | format_unformat_error, line_input); |
| 744 | } |
| 745 | } |
| 746 | else |
| 747 | { |
| 748 | return clib_error_return (0, "Unknown input `%U'", |
| 749 | format_unformat_error, line_input); |
| 750 | } |
| 751 | |
| 752 | return 0; |
| 753 | } |
| 754 | |
| 755 | /* *INDENT-OFF* */ |
| 756 | VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = { |
| 757 | .path = "ipsec select backend", |
| 758 | .short_help = "ipsec select backend <ah|esp> <backend index>", |
| 759 | .function = ipsec_select_backend_command_fn, |
| 760 | }; |
| 761 | |
| 762 | /* *INDENT-ON* */ |
| 763 | |
| 764 | static clib_error_t * |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 765 | clear_ipsec_counters_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 766 | unformat_input_t * input, |
| 767 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 768 | { |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 769 | vlib_clear_combined_counters (&ipsec_spd_policy_counters); |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 770 | vlib_clear_combined_counters (&ipsec_sa_counters); |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 771 | vlib_clear_simple_counters (&ipsec_sa_lost_counters); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 772 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 773 | return (NULL); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 774 | } |
| 775 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 776 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 777 | VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = { |
| 778 | .path = "clear ipsec counters", |
| 779 | .short_help = "clear ipsec counters", |
| 780 | .function = clear_ipsec_counters_command_fn, |
| 781 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 782 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 783 | |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 784 | static clib_error_t * |
| 785 | ipsec_tun_protect_cmd (vlib_main_t * vm, |
| 786 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 787 | { |
| 788 | unformat_input_t _line_input, *line_input = &_line_input; |
| 789 | u32 sw_if_index, is_del, sa_in, sa_out, *sa_ins = NULL; |
Neale Ranns | 2828721 | 2019-12-16 00:53:11 +0000 | [diff] [blame] | 790 | ip_address_t peer = { }; |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 791 | vnet_main_t *vnm; |
| 792 | |
| 793 | is_del = 0; |
| 794 | sw_if_index = ~0; |
| 795 | vnm = vnet_get_main (); |
| 796 | |
| 797 | if (!unformat_user (input, unformat_line_input, line_input)) |
| 798 | return 0; |
| 799 | |
| 800 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 801 | { |
| 802 | if (unformat (line_input, "del")) |
| 803 | is_del = 1; |
| 804 | else if (unformat (line_input, "add")) |
| 805 | is_del = 0; |
| 806 | else if (unformat (line_input, "sa-in %d", &sa_in)) |
| 807 | vec_add1 (sa_ins, sa_in); |
| 808 | else if (unformat (line_input, "sa-out %d", &sa_out)) |
| 809 | ; |
| 810 | else if (unformat (line_input, "%U", |
| 811 | unformat_vnet_sw_interface, vnm, &sw_if_index)) |
| 812 | ; |
Neale Ranns | 2828721 | 2019-12-16 00:53:11 +0000 | [diff] [blame] | 813 | else if (unformat (line_input, "%U", unformat_ip_address, &peer)) |
| 814 | ; |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 815 | else |
| 816 | return (clib_error_return (0, "unknown input '%U'", |
| 817 | format_unformat_error, line_input)); |
| 818 | } |
| 819 | |
| 820 | if (!is_del) |
Neale Ranns | 2828721 | 2019-12-16 00:53:11 +0000 | [diff] [blame] | 821 | ipsec_tun_protect_update (sw_if_index, &peer, sa_out, sa_ins); |
Eric Kinzie | 609d579 | 2020-10-13 20:02:11 -0400 | [diff] [blame] | 822 | else |
| 823 | ipsec_tun_protect_del (sw_if_index, &peer); |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 824 | |
| 825 | unformat_free (line_input); |
| 826 | return NULL; |
| 827 | } |
| 828 | |
| 829 | /** |
| 830 | * Protect tunnel with IPSEC |
| 831 | */ |
| 832 | /* *INDENT-OFF* */ |
| 833 | VLIB_CLI_COMMAND (ipsec_tun_protect_cmd_node, static) = |
| 834 | { |
| 835 | .path = "ipsec tunnel protect", |
| 836 | .function = ipsec_tun_protect_cmd, |
Eric Kinzie | 609d579 | 2020-10-13 20:02:11 -0400 | [diff] [blame] | 837 | .short_help = "ipsec tunnel protect <interface> input-sa <SA> output-sa <SA> [add|del]", |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 838 | // this is not MP safe |
| 839 | }; |
| 840 | /* *INDENT-ON* */ |
| 841 | |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 842 | |
| 843 | static clib_error_t * |
| 844 | ipsec_tun_protect_show (vlib_main_t * vm, |
| 845 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 846 | { |
| 847 | ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm); |
| 848 | |
| 849 | return NULL; |
| 850 | } |
| 851 | |
| 852 | /** |
| 853 | * show IPSEC tunnel protection |
| 854 | */ |
| 855 | /* *INDENT-OFF* */ |
| 856 | VLIB_CLI_COMMAND (ipsec_tun_protect_show_node, static) = |
| 857 | { |
| 858 | .path = "show ipsec protect", |
| 859 | .function = ipsec_tun_protect_show, |
| 860 | .short_help = "show ipsec protect", |
| 861 | }; |
| 862 | /* *INDENT-ON* */ |
| 863 | |
Neale Ranns | 7b4e52f | 2020-05-24 16:17:50 +0000 | [diff] [blame] | 864 | static int |
Neale Ranns | 302b25a | 2020-10-19 13:23:33 +0000 | [diff] [blame] | 865 | ipsec_tun_protect4_hash_show_one (clib_bihash_kv_8_16_t * kv, void *arg) |
Neale Ranns | 7b4e52f | 2020-05-24 16:17:50 +0000 | [diff] [blame] | 866 | { |
| 867 | ipsec4_tunnel_kv_t *ikv = (ipsec4_tunnel_kv_t *) kv; |
| 868 | vlib_main_t *vm = arg; |
| 869 | |
| 870 | vlib_cli_output (vm, " %U", format_ipsec4_tunnel_kv, ikv); |
| 871 | |
| 872 | return (BIHASH_WALK_CONTINUE); |
| 873 | } |
| 874 | |
| 875 | static int |
Neale Ranns | 302b25a | 2020-10-19 13:23:33 +0000 | [diff] [blame] | 876 | ipsec_tun_protect6_hash_show_one (clib_bihash_kv_24_16_t * kv, void *arg) |
Neale Ranns | 7b4e52f | 2020-05-24 16:17:50 +0000 | [diff] [blame] | 877 | { |
| 878 | ipsec6_tunnel_kv_t *ikv = (ipsec6_tunnel_kv_t *) kv; |
| 879 | vlib_main_t *vm = arg; |
| 880 | |
| 881 | vlib_cli_output (vm, " %U", format_ipsec6_tunnel_kv, ikv); |
| 882 | |
| 883 | return (BIHASH_WALK_CONTINUE); |
| 884 | } |
| 885 | |
Neale Ranns | 41afb33 | 2019-07-16 06:19:35 -0700 | [diff] [blame] | 886 | static clib_error_t * |
| 887 | ipsec_tun_protect_hash_show (vlib_main_t * vm, |
| 888 | unformat_input_t * input, |
| 889 | vlib_cli_command_t * cmd) |
| 890 | { |
| 891 | ipsec_main_t *im = &ipsec_main; |
| 892 | |
| 893 | { |
Neale Ranns | 41afb33 | 2019-07-16 06:19:35 -0700 | [diff] [blame] | 894 | vlib_cli_output (vm, "IPv4:"); |
| 895 | |
Neale Ranns | 302b25a | 2020-10-19 13:23:33 +0000 | [diff] [blame] | 896 | clib_bihash_foreach_key_value_pair_8_16 |
Neale Ranns | 7b4e52f | 2020-05-24 16:17:50 +0000 | [diff] [blame] | 897 | (&im->tun4_protect_by_key, ipsec_tun_protect4_hash_show_one, vm); |
Neale Ranns | 41afb33 | 2019-07-16 06:19:35 -0700 | [diff] [blame] | 898 | |
| 899 | vlib_cli_output (vm, "IPv6:"); |
| 900 | |
Neale Ranns | 302b25a | 2020-10-19 13:23:33 +0000 | [diff] [blame] | 901 | clib_bihash_foreach_key_value_pair_24_16 |
Neale Ranns | 7b4e52f | 2020-05-24 16:17:50 +0000 | [diff] [blame] | 902 | (&im->tun6_protect_by_key, ipsec_tun_protect6_hash_show_one, vm); |
Neale Ranns | 41afb33 | 2019-07-16 06:19:35 -0700 | [diff] [blame] | 903 | } |
| 904 | |
| 905 | return NULL; |
| 906 | } |
| 907 | |
| 908 | /** |
| 909 | * show IPSEC tunnel protection hash tables |
| 910 | */ |
| 911 | /* *INDENT-OFF* */ |
| 912 | VLIB_CLI_COMMAND (ipsec_tun_protect_hash_show_node, static) = |
| 913 | { |
| 914 | .path = "show ipsec protect-hash", |
| 915 | .function = ipsec_tun_protect_hash_show, |
| 916 | .short_help = "show ipsec protect-hash", |
| 917 | }; |
| 918 | /* *INDENT-ON* */ |
| 919 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 920 | clib_error_t * |
| 921 | ipsec_cli_init (vlib_main_t * vm) |
| 922 | { |
| 923 | return 0; |
| 924 | } |
| 925 | |
| 926 | VLIB_INIT_FUNCTION (ipsec_cli_init); |
| 927 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 928 | static clib_error_t * |
| 929 | set_async_mode_command_fn (vlib_main_t * vm, unformat_input_t * input, |
| 930 | vlib_cli_command_t * cmd) |
| 931 | { |
| 932 | unformat_input_t _line_input, *line_input = &_line_input; |
| 933 | int async_enable = 0; |
| 934 | |
| 935 | if (!unformat_user (input, unformat_line_input, line_input)) |
| 936 | return 0; |
| 937 | |
| 938 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 939 | { |
| 940 | if (unformat (line_input, "on")) |
| 941 | async_enable = 1; |
| 942 | else if (unformat (line_input, "off")) |
| 943 | async_enable = 0; |
| 944 | else |
| 945 | return (clib_error_return (0, "unknown input '%U'", |
| 946 | format_unformat_error, line_input)); |
| 947 | } |
| 948 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 949 | ipsec_set_async_mode (async_enable); |
| 950 | |
| 951 | unformat_free (line_input); |
| 952 | return (NULL); |
| 953 | } |
| 954 | |
| 955 | /* *INDENT-OFF* */ |
| 956 | VLIB_CLI_COMMAND (set_async_mode_command, static) = { |
| 957 | .path = "set ipsec async mode", |
| 958 | .short_help = "set ipsec async mode on|off", |
| 959 | .function = set_async_mode_command_fn, |
| 960 | }; |
| 961 | /* *INDENT-ON* */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 962 | |
| 963 | /* |
| 964 | * fd.io coding-style-patch-verification: ON |
| 965 | * |
| 966 | * Local Variables: |
| 967 | * eval: (c-set-style "gnu") |
| 968 | * End: |
| 969 | */ |