blob: b6bdc40fd1acb69c15bd5ced987149c4a2d4473a [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * decap.c : IPSec tunnel support
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
21#include <vnet/interface.h>
Pierre Pfister4c422f92018-12-10 11:19:08 +010022#include <vnet/fib/fib.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070023
24#include <vnet/ipsec/ipsec.h>
25
26static clib_error_t *
27set_interface_spd_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070028 unformat_input_t * input,
29 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -070030{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070031 unformat_input_t _line_input, *line_input = &_line_input;
Ed Warnickecb9cada2015-12-08 15:45:58 -070032 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070033 u32 sw_if_index = (u32) ~ 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -070034 u32 spd_id;
35 int is_add = 1;
Billy McFalla9a20e72017-02-15 11:39:12 -050036 clib_error_t *error = NULL;
Ed Warnickecb9cada2015-12-08 15:45:58 -070037
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070038 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -070039 return 0;
40
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070041 if (unformat
42 (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main,
43 &sw_if_index, &spd_id))
Ed Warnickecb9cada2015-12-08 15:45:58 -070044 ;
45 else if (unformat (line_input, "del"))
46 is_add = 0;
47 else
Billy McFalla9a20e72017-02-15 11:39:12 -050048 {
49 error = clib_error_return (0, "parse error: '%U'",
50 format_unformat_error, line_input);
51 goto done;
52 }
Ed Warnickecb9cada2015-12-08 15:45:58 -070053
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070054 ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
Ed Warnickecb9cada2015-12-08 15:45:58 -070055
Billy McFalla9a20e72017-02-15 11:39:12 -050056done:
57 unformat_free (line_input);
58
59 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -070060}
61
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070062/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070063VLIB_CLI_COMMAND (set_interface_spd_command, static) = {
64 .path = "set interface ipsec spd",
65 .short_help =
66 "set interface ipsec spd <int> <id>",
67 .function = set_interface_spd_command_fn,
68};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070069/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070070
71static clib_error_t *
72ipsec_sa_add_del_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070073 unformat_input_t * input,
74 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -070075{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070076 unformat_input_t _line_input, *line_input = &_line_input;
Neale Ranns8d7c5022019-02-06 01:41:05 -080077 ip46_address_t tun_src = { }, tun_dst =
78 {
79 };
80 ipsec_crypto_alg_t crypto_alg;
81 ipsec_integ_alg_t integ_alg;
82 ipsec_protocol_t proto;
83 ipsec_sa_flags_t flags;
84 clib_error_t *error;
Kingwel Xied3d12052019-03-07 06:34:30 -050085 ipsec_key_t ck = { 0 };
86 ipsec_key_t ik = { 0 };
Neale Ranns80f6fd52019-04-16 02:41:34 +000087 u32 id, spi, salt;
Neale Ranns8d7c5022019-02-06 01:41:05 -080088 int is_add, rv;
Ed Warnickecb9cada2015-12-08 15:45:58 -070089
Neale Ranns8d7c5022019-02-06 01:41:05 -080090 error = NULL;
91 is_add = 0;
92 flags = IPSEC_SA_FLAG_NONE;
93 proto = IPSEC_PROTOCOL_ESP;
Ed Warnickecb9cada2015-12-08 15:45:58 -070094
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070095 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -070096 return 0;
97
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070098 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
99 {
Neale Ranns8d7c5022019-02-06 01:41:05 -0800100 if (unformat (line_input, "add %u", &id))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700101 is_add = 1;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800102 else if (unformat (line_input, "del %u", &id))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700103 is_add = 0;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800104 else if (unformat (line_input, "spi %u", &spi))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700105 ;
Neale Ranns80f6fd52019-04-16 02:41:34 +0000106 else if (unformat (line_input, "salt %u", &salt))
107 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700108 else if (unformat (line_input, "esp"))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800109 proto = IPSEC_PROTOCOL_ESP;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700110 else if (unformat (line_input, "ah"))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800111 proto = IPSEC_PROTOCOL_AH;
112 else if (unformat (line_input, "crypto-key %U",
113 unformat_ipsec_key, &ck))
114 ;
115 else if (unformat (line_input, "crypto-alg %U",
116 unformat_ipsec_crypto_alg, &crypto_alg))
117 ;
118 else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik))
119 ;
120 else if (unformat (line_input, "integ-alg %U",
121 unformat_ipsec_integ_alg, &integ_alg))
122 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700123 else if (unformat (line_input, "tunnel-src %U",
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500124 unformat_ip46_address, &tun_src, IP46_TYPE_ANY))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700125 {
Neale Ranns8d7c5022019-02-06 01:41:05 -0800126 flags |= IPSEC_SA_FLAG_IS_TUNNEL;
127 if (!ip46_address_is_ip4 (&tun_src))
128 flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700129 }
130 else if (unformat (line_input, "tunnel-dst %U",
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500131 unformat_ip46_address, &tun_dst, IP46_TYPE_ANY))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800132 ;
Radu Nicolau717de092018-08-03 10:37:24 +0100133 else if (unformat (line_input, "udp-encap"))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800134 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700135 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500136 {
137 error = clib_error_return (0, "parse error: '%U'",
138 format_unformat_error, line_input);
139 goto done;
140 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700141 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700142
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000143 if (is_add)
Neale Ranns8d7c5022019-02-06 01:41:05 -0800144 rv = ipsec_sa_add (id, spi, proto, crypto_alg,
145 &ck, integ_alg, &ik, flags,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000146 0, clib_host_to_net_u32 (salt),
147 &tun_src, &tun_dst, NULL);
Neale Ranns8d7c5022019-02-06 01:41:05 -0800148 else
149 rv = ipsec_sa_del (id);
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000150
Neale Ranns8d7c5022019-02-06 01:41:05 -0800151 if (rv)
152 clib_error_return (0, "failed");
Ed Warnickecb9cada2015-12-08 15:45:58 -0700153
Billy McFalla9a20e72017-02-15 11:39:12 -0500154done:
155 unformat_free (line_input);
156
157 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700158}
159
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700160/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700161VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = {
162 .path = "ipsec sa",
163 .short_help =
164 "ipsec sa [add|del]",
165 .function = ipsec_sa_add_del_command_fn,
166};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700167/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700168
169static clib_error_t *
170ipsec_spd_add_del_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700171 unformat_input_t * input,
172 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700173{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700174 unformat_input_t _line_input, *line_input = &_line_input;
Damjan Marion3f54b182016-08-16 11:27:02 +0200175 u32 spd_id = ~0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700176 int is_add = ~0;
Billy McFalla9a20e72017-02-15 11:39:12 -0500177 clib_error_t *error = NULL;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700178
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700179 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700180 return 0;
181
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700182 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
183 {
184 if (unformat (line_input, "add"))
185 is_add = 1;
186 else if (unformat (line_input, "del"))
187 is_add = 0;
188 else if (unformat (line_input, "%u", &spd_id))
189 ;
190 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500191 {
192 error = clib_error_return (0, "parse error: '%U'",
193 format_unformat_error, line_input);
194 goto done;
195 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700196 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700197
Damjan Marion3f54b182016-08-16 11:27:02 +0200198 if (spd_id == ~0)
Billy McFalla9a20e72017-02-15 11:39:12 -0500199 {
200 error = clib_error_return (0, "please specify SPD ID");
201 goto done;
202 }
Damjan Marion3f54b182016-08-16 11:27:02 +0200203
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700204 ipsec_add_del_spd (vm, spd_id, is_add);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700205
Billy McFalla9a20e72017-02-15 11:39:12 -0500206done:
207 unformat_free (line_input);
208
209 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700210}
211
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700212/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700213VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = {
214 .path = "ipsec spd",
215 .short_help =
216 "ipsec spd [add|del] <id>",
217 .function = ipsec_spd_add_del_command_fn,
218};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700219/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700220
221
222static clib_error_t *
223ipsec_policy_add_del_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700224 unformat_input_t * input,
225 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700226{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700227 unformat_input_t _line_input, *line_input = &_line_input;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700228 ipsec_policy_t p;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800229 int rv, is_add = 0;
230 u32 tmp, tmp2, stat_index;
Billy McFalla9a20e72017-02-15 11:39:12 -0500231 clib_error_t *error = NULL;
Neale Ranns9f231d42019-03-19 10:06:00 +0000232 u32 is_outbound;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700233
Dave Barachb7b92992018-10-17 10:38:51 -0400234 clib_memset (&p, 0, sizeof (p));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700235 p.lport.stop = p.rport.stop = ~0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700236 p.laddr.stop.ip4.as_u32 = p.raddr.stop.ip4.as_u32 = (u32) ~ 0;
237 p.laddr.stop.ip6.as_u64[0] = p.laddr.stop.ip6.as_u64[1] = (u64) ~ 0;
238 p.raddr.stop.ip6.as_u64[0] = p.raddr.stop.ip6.as_u64[1] = (u64) ~ 0;
Neale Ranns9f231d42019-03-19 10:06:00 +0000239 is_outbound = 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700240
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700241 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700242 return 0;
243
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700244 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
245 {
246 if (unformat (line_input, "add"))
247 is_add = 1;
248 else if (unformat (line_input, "del"))
249 is_add = 0;
250 else if (unformat (line_input, "spd %u", &p.id))
251 ;
252 else if (unformat (line_input, "inbound"))
Neale Ranns9f231d42019-03-19 10:06:00 +0000253 is_outbound = 0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700254 else if (unformat (line_input, "outbound"))
Neale Ranns9f231d42019-03-19 10:06:00 +0000255 is_outbound = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700256 else if (unformat (line_input, "priority %d", &p.priority))
257 ;
258 else if (unformat (line_input, "protocol %u", &tmp))
259 p.protocol = (u8) tmp;
260 else
261 if (unformat
262 (line_input, "action %U", unformat_ipsec_policy_action,
263 &p.policy))
264 {
265 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
Billy McFalla9a20e72017-02-15 11:39:12 -0500266 {
267 error = clib_error_return (0, "unsupported action: 'resolve'");
268 goto done;
269 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700270 }
271 else if (unformat (line_input, "sa %u", &p.sa_id))
272 ;
273 else if (unformat (line_input, "local-ip-range %U - %U",
274 unformat_ip4_address, &p.laddr.start.ip4,
275 unformat_ip4_address, &p.laddr.stop.ip4))
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800276 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700277 else if (unformat (line_input, "remote-ip-range %U - %U",
278 unformat_ip4_address, &p.raddr.start.ip4,
279 unformat_ip4_address, &p.raddr.stop.ip4))
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800280 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700281 else if (unformat (line_input, "local-ip-range %U - %U",
282 unformat_ip6_address, &p.laddr.start.ip6,
283 unformat_ip6_address, &p.laddr.stop.ip6))
284 {
285 p.is_ipv6 = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700286 }
287 else if (unformat (line_input, "remote-ip-range %U - %U",
288 unformat_ip6_address, &p.raddr.start.ip6,
289 unformat_ip6_address, &p.raddr.stop.ip6))
290 {
291 p.is_ipv6 = 1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700292 }
293 else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2))
294 {
295 p.lport.start = tmp;
296 p.lport.stop = tmp2;
Neale Ranns231c4692019-03-18 17:11:28 +0000297 p.lport.start = clib_host_to_net_u16 (p.lport.start);
298 p.lport.stop = clib_host_to_net_u16 (p.lport.stop);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700299 }
300 else
301 if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2))
302 {
303 p.rport.start = tmp;
304 p.rport.stop = tmp2;
Neale Ranns231c4692019-03-18 17:11:28 +0000305 p.rport.start = clib_host_to_net_u16 (p.rport.start);
306 p.rport.stop = clib_host_to_net_u16 (p.rport.stop);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700307 }
308 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500309 {
310 error = clib_error_return (0, "parse error: '%U'",
311 format_unformat_error, line_input);
312 goto done;
313 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700314 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700315
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800316 /* Check if SA is for IPv6/AH which is not supported. Return error if TRUE. */
317 if (p.sa_id)
318 {
319 uword *p1;
320 ipsec_main_t *im = &ipsec_main;
321 ipsec_sa_t *sa = 0;
322 p1 = hash_get (im->sa_index_by_sa_id, p.sa_id);
Klement Sekerac2fc57e2018-06-28 14:20:12 +0200323 if (!p1)
324 {
325 error =
326 clib_error_return (0, "SA with index %u not found", p.sa_id);
327 goto done;
328 }
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800329 sa = pool_elt_at_index (im->sad, p1[0]);
330 if (sa && sa->protocol == IPSEC_PROTOCOL_AH && is_add && p.is_ipv6)
331 {
332 error = clib_error_return (0, "AH not supported for IPV6: '%U'",
333 format_unformat_error, line_input);
334 goto done;
335 }
336 }
Neale Ranns9f231d42019-03-19 10:06:00 +0000337
338 rv = ipsec_policy_mk_type (is_outbound, p.is_ipv6, p.policy, &p.type);
339
340 if (rv)
341 {
342 error = clib_error_return (0, "unsupported policy type for:",
343 " outboud:%s %s action:%U",
344 (is_outbound ? "yes" : "no"),
345 (p.is_ipv6 ? "IPv4" : "IPv6"),
346 format_ipsec_policy_action, p.policy);
347 goto done;
348 }
349
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800350 rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index);
351
352 if (!rv)
353 vlib_cli_output (vm, "policy-index:%d", stat_index);
354 else
355 vlib_cli_output (vm, "error:%d", rv);
Billy McFalla9a20e72017-02-15 11:39:12 -0500356
357done:
358 unformat_free (line_input);
359
360 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700361}
362
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700363/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700364VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = {
365 .path = "ipsec policy",
366 .short_help =
367 "ipsec policy [add|del] spd <id> priority <n> ",
368 .function = ipsec_policy_add_del_command_fn,
369};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700370/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700371
372static clib_error_t *
373set_ipsec_sa_key_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700374 unformat_input_t * input,
375 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700376{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700377 unformat_input_t _line_input, *line_input = &_line_input;
Billy McFalla9a20e72017-02-15 11:39:12 -0500378 clib_error_t *error = NULL;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800379 ipsec_key_t ck, ik;
380 u32 id;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700381
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700382 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700383 return 0;
384
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700385 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
386 {
Neale Ranns8d7c5022019-02-06 01:41:05 -0800387 if (unformat (line_input, "%u", &id))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700388 ;
389 else
Neale Ranns8d7c5022019-02-06 01:41:05 -0800390 if (unformat (line_input, "crypto-key %U", unformat_ipsec_key, &ck))
391 ;
392 else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik))
393 ;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700394 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500395 {
396 error = clib_error_return (0, "parse error: '%U'",
397 format_unformat_error, line_input);
398 goto done;
399 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700400 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700401
Neale Ranns8d7c5022019-02-06 01:41:05 -0800402 ipsec_set_sa_key (id, &ck, &ik);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700403
Billy McFalla9a20e72017-02-15 11:39:12 -0500404done:
405 unformat_free (line_input);
406
407 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700408}
409
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700410/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700411VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = {
412 .path = "set ipsec sa",
Neale Rannsb294f102019-04-03 13:17:50 +0000413 .short_help = "set ipsec sa <id> crypto-key <key> integ-key <key>",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700414 .function = set_ipsec_sa_key_command_fn,
415};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700416/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700417
Neale Rannsb294f102019-04-03 13:17:50 +0000418static void
419ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700420{
Neale Rannsb294f102019-04-03 13:17:50 +0000421 u32 sai;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700422
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700423 /* *INDENT-OFF* */
Neale Ranns8d7c5022019-02-06 01:41:05 -0800424 pool_foreach_index (sai, im->sad, ({
Neale Rannsb294f102019-04-03 13:17:50 +0000425 vlib_cli_output(vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_BRIEF);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700426 }));
Neale Rannsb294f102019-04-03 13:17:50 +0000427 /* *INDENT-ON* */
428}
429
430static void
431ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im)
432{
433 u32 spdi;
434
435 /* *INDENT-OFF* */
436 pool_foreach_index (spdi, im->spds, ({
437 vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700438 }));
Neale Rannsb294f102019-04-03 13:17:50 +0000439 /* *INDENT-ON* */
440}
441
442static void
443ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im)
444{
445 u32 spd_id, sw_if_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700446
Neale Ranns311124e2019-01-24 04:52:25 -0800447 vlib_cli_output (vm, "SPD Bindings:");
Neale Ranns8d7c5022019-02-06 01:41:05 -0800448
Neale Rannsb294f102019-04-03 13:17:50 +0000449 /* *INDENT-OFF* */
Neale Ranns311124e2019-01-24 04:52:25 -0800450 hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
Neale Ranns8d7c5022019-02-06 01:41:05 -0800451 vlib_cli_output (vm, " %d -> %U", spd_id,
452 format_vnet_sw_if_index_name, im->vnet_main,
453 sw_if_index);
Neale Ranns311124e2019-01-24 04:52:25 -0800454 }));
455 /* *INDENT-ON* */
Neale Rannsb294f102019-04-03 13:17:50 +0000456}
Neale Ranns311124e2019-01-24 04:52:25 -0800457
Neale Rannsb294f102019-04-03 13:17:50 +0000458static void
459ipsec_tunnel_show_all (vlib_main_t * vm, ipsec_main_t * im)
460{
461 u32 ti;
462
463 vlib_cli_output (vm, "Tunnel interfaces");
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700464 /* *INDENT-OFF* */
Neale Rannsb294f102019-04-03 13:17:50 +0000465 pool_foreach_index (ti, im->tunnel_interfaces, ({
466 vlib_cli_output(vm, " %U", format_ipsec_tunnel, ti);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700467 }));
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700468 /* *INDENT-ON* */
Neale Rannsb294f102019-04-03 13:17:50 +0000469}
470
471static clib_error_t *
472show_ipsec_command_fn (vlib_main_t * vm,
473 unformat_input_t * input, vlib_cli_command_t * cmd)
474{
475 ipsec_main_t *im = &ipsec_main;
476
477 ipsec_sa_show_all (vm, im);
478 ipsec_spd_show_all (vm, im);
479 ipsec_spd_bindings_show_all (vm, im);
480 ipsec_tunnel_show_all (vm, im);
481
Ed Warnickecb9cada2015-12-08 15:45:58 -0700482 return 0;
483}
484
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700485/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700486VLIB_CLI_COMMAND (show_ipsec_command, static) = {
Neale Rannsb294f102019-04-03 13:17:50 +0000487 .path = "show ipsec all",
488 .short_help = "show ipsec all",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700489 .function = show_ipsec_command_fn,
490};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700491/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700492
493static clib_error_t *
Neale Rannsb294f102019-04-03 13:17:50 +0000494show_ipsec_sa_command_fn (vlib_main_t * vm,
495 unformat_input_t * input, vlib_cli_command_t * cmd)
496{
497 ipsec_main_t *im = &ipsec_main;
498 u32 sai = ~0;
499
500 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
501 {
502 if (unformat (input, "%u", &sai))
503 ;
504 else
505 break;
506 }
507
508 if (~0 == sai)
509 ipsec_sa_show_all (vm, im);
510 else
511 vlib_cli_output (vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_DETAIL);
512
513 return 0;
514}
515
516/* *INDENT-OFF* */
517VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = {
518 .path = "show ipsec sa",
519 .short_help = "show ipsec sa [index]",
520 .function = show_ipsec_sa_command_fn,
521};
522/* *INDENT-ON* */
523
524static clib_error_t *
525show_ipsec_spd_command_fn (vlib_main_t * vm,
526 unformat_input_t * input, vlib_cli_command_t * cmd)
527{
528 ipsec_main_t *im = &ipsec_main;
529 u8 show_bindings = 0;
530 u32 spdi = ~0;
531
532 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
533 {
534 if (unformat (input, "%u", &spdi))
535 ;
536 else if (unformat (input, "bindings"))
537 show_bindings = 1;
538 else
539 break;
540 }
541
542 if (show_bindings)
543 ipsec_spd_bindings_show_all (vm, im);
544 else if (~0 != spdi)
545 vlib_cli_output (vm, "%U", format_ipsec_spd, spdi);
546 else
547 ipsec_spd_show_all (vm, im);
548
549 return 0;
550}
551
552/* *INDENT-OFF* */
553VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = {
554 .path = "show ipsec spd",
555 .short_help = "show ipsec spd [index]",
556 .function = show_ipsec_spd_command_fn,
557};
558/* *INDENT-ON* */
559
560static clib_error_t *
561show_ipsec_tunnel_command_fn (vlib_main_t * vm,
562 unformat_input_t * input,
563 vlib_cli_command_t * cmd)
564{
565 ipsec_main_t *im = &ipsec_main;
566 u32 ti = ~0;
567
568 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
569 {
570 if (unformat (input, "%u", &ti))
571 ;
572 else
573 break;
574 }
575
576 if (~0 != ti)
577 vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti);
578 else
579 ipsec_tunnel_show_all (vm, im);
580
581 return 0;
582}
583
584/* *INDENT-OFF* */
585VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
586 .path = "show ipsec tunnel",
587 .short_help = "show ipsec tunnel [index]",
588 .function = show_ipsec_tunnel_command_fn,
589};
590/* *INDENT-ON* */
591
592static clib_error_t *
Klement Sekerab4d30532018-11-08 13:00:02 +0100593ipsec_show_backends_command_fn (vlib_main_t * vm,
594 unformat_input_t * input,
595 vlib_cli_command_t * cmd)
596{
597 ipsec_main_t *im = &ipsec_main;
598 u32 verbose = 0;
599
600 (void) unformat (input, "verbose %u", &verbose);
601
602 vlib_cli_output (vm, "IPsec AH backends available:");
603 u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
604 ipsec_ah_backend_t *ab;
605 /* *INDENT-OFF* */
606 pool_foreach (ab, im->ah_backends, {
607 s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
608 ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
609 if (verbose) {
610 vlib_node_t *n;
611 n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
612 s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
613 n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
614 s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
615 n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
616 s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
617 n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
618 s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
619 }
620 });
621 /* *INDENT-ON* */
622 vlib_cli_output (vm, "%v", s);
623 _vec_len (s) = 0;
624 vlib_cli_output (vm, "IPsec ESP backends available:");
625 s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
626 ipsec_esp_backend_t *eb;
627 /* *INDENT-OFF* */
628 pool_foreach (eb, im->esp_backends, {
629 s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
630 eb - im->esp_backends == im->esp_current_backend ? "yes"
631 : "no");
632 if (verbose) {
633 vlib_node_t *n;
634 n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
635 s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
636 n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
637 s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
638 n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
639 s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
640 n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
641 s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
642 }
643 });
644 /* *INDENT-ON* */
645 vlib_cli_output (vm, "%v", s);
646
647 vec_free (s);
648 return 0;
649}
650
651/* *INDENT-OFF* */
652VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
653 .path = "show ipsec backends",
654 .short_help = "show ipsec backends",
655 .function = ipsec_show_backends_command_fn,
656};
657/* *INDENT-ON* */
658
659static clib_error_t *
660ipsec_select_backend_command_fn (vlib_main_t * vm,
661 unformat_input_t * input,
662 vlib_cli_command_t * cmd)
663{
664 u32 backend_index;
665 ipsec_main_t *im = &ipsec_main;
666
667 if (pool_elts (im->sad) > 0)
668 {
669 return clib_error_return (0,
670 "Cannot change IPsec backend, while %u SA entries are configured",
671 pool_elts (im->sad));
672 }
673
674 unformat_input_t _line_input, *line_input = &_line_input;
675 /* Get a line of input. */
676 if (!unformat_user (input, unformat_line_input, line_input))
677 return 0;
678
679 if (unformat (line_input, "ah"))
680 {
681 if (unformat (line_input, "%u", &backend_index))
682 {
683 if (ipsec_select_ah_backend (im, backend_index) < 0)
684 {
685 return clib_error_return (0, "Invalid AH backend index `%u'",
686 backend_index);
687 }
688 }
689 else
690 {
691 return clib_error_return (0, "Invalid backend index `%U'",
692 format_unformat_error, line_input);
693 }
694 }
695 else if (unformat (line_input, "esp"))
696 {
697 if (unformat (line_input, "%u", &backend_index))
698 {
699 if (ipsec_select_esp_backend (im, backend_index) < 0)
700 {
701 return clib_error_return (0, "Invalid ESP backend index `%u'",
702 backend_index);
703 }
704 }
705 else
706 {
707 return clib_error_return (0, "Invalid backend index `%U'",
708 format_unformat_error, line_input);
709 }
710 }
711 else
712 {
713 return clib_error_return (0, "Unknown input `%U'",
714 format_unformat_error, line_input);
715 }
716
717 return 0;
718}
719
720/* *INDENT-OFF* */
721VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
722 .path = "ipsec select backend",
723 .short_help = "ipsec select backend <ah|esp> <backend index>",
724 .function = ipsec_select_backend_command_fn,
725};
726
727/* *INDENT-ON* */
728
729static clib_error_t *
Ed Warnickecb9cada2015-12-08 15:45:58 -0700730clear_ipsec_counters_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700731 unformat_input_t * input,
732 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700733{
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800734 vlib_clear_combined_counters (&ipsec_spd_policy_counters);
Neale Rannseba31ec2019-02-17 18:04:27 +0000735 vlib_clear_combined_counters (&ipsec_sa_counters);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700736
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800737 return (NULL);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700738}
739
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700740/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700741VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
742 .path = "clear ipsec counters",
743 .short_help = "clear ipsec counters",
744 .function = clear_ipsec_counters_command_fn,
745};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700746/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700747
748static clib_error_t *
749create_ipsec_tunnel_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700750 unformat_input_t * input,
751 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700752{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700753 unformat_input_t _line_input, *line_input = &_line_input;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700754 ipsec_add_del_tunnel_args_t a;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700755 int rv;
756 u32 num_m_args = 0;
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500757 u8 ipv4_set = 0;
758 u8 ipv6_set = 0;
Billy McFalla9a20e72017-02-15 11:39:12 -0500759 clib_error_t *error = NULL;
Kingwel Xied3d12052019-03-07 06:34:30 -0500760 ipsec_key_t rck = { 0 };
761 ipsec_key_t lck = { 0 };
762 ipsec_key_t lik = { 0 };
763 ipsec_key_t rik = { 0 };
Matthew Smith2838a232016-06-21 16:05:09 -0500764
Dave Barachb7b92992018-10-17 10:38:51 -0400765 clib_memset (&a, 0, sizeof (a));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700766 a.is_add = 1;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700767
768 /* Get a line of input. */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700769 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700770 return 0;
771
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700772 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
773 {
774 if (unformat
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500775 (line_input, "local-ip %U", unformat_ip46_address, &a.local_ip,
776 IP46_TYPE_ANY))
777 {
778 ip46_address_is_ip4 (&a.local_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
779 num_m_args++;
780 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700781 else
782 if (unformat
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500783 (line_input, "remote-ip %U", unformat_ip46_address, &a.remote_ip,
784 IP46_TYPE_ANY))
785 {
786 ip46_address_is_ip4 (&a.remote_ip) ? (ipv4_set = 1) : (ipv6_set =
787 1);
788 num_m_args++;
789 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700790 else if (unformat (line_input, "local-spi %u", &a.local_spi))
791 num_m_args++;
792 else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
793 num_m_args++;
Matthew Smith8e1039a2018-04-12 07:32:56 -0500794 else if (unformat (line_input, "instance %u", &a.show_instance))
795 a.renumber = 1;
Neale Ranns47feb112019-04-11 15:14:07 +0000796 else if (unformat (line_input, "salt 0x%x", &a.salt))
797 ;
Radu Nicolau717de092018-08-03 10:37:24 +0100798 else if (unformat (line_input, "udp-encap"))
799 a.udp_encap = 1;
Kingwel Xie2baf9422019-02-04 02:07:06 -0800800 else if (unformat (line_input, "use-esn"))
801 a.esn = 1;
802 else if (unformat (line_input, "use-anti-replay"))
803 a.anti_replay = 1;
Pierre Pfister4c422f92018-12-10 11:19:08 +0100804 else if (unformat (line_input, "tx-table %u", &a.tx_table_id))
805 ;
Neale Rannsfd060842019-03-04 13:44:42 +0000806 else
807 if (unformat
808 (line_input, "local-crypto-key %U", unformat_ipsec_key, &lck))
809 ;
810 else
811 if (unformat
812 (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck))
813 ;
814 else if (unformat (line_input, "crypto-alg %U",
815 unformat_ipsec_crypto_alg, &a.crypto_alg))
816 ;
817 else
818 if (unformat
819 (line_input, "local-integ-key %U", unformat_ipsec_key, &lik))
820 ;
821 else
822 if (unformat
823 (line_input, "rmote-integ-key %U", unformat_ipsec_key, &rik))
824 ;
825 else if (unformat (line_input, "integ-alg %U",
826 unformat_ipsec_integ_alg, &a.integ_alg))
827 ;
Kingwel Xie2baf9422019-02-04 02:07:06 -0800828 else if (unformat (line_input, "del"))
829 a.is_add = 0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700830 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500831 {
832 error = clib_error_return (0, "unknown input `%U'",
833 format_unformat_error, line_input);
834 goto done;
835 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700836 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700837
838 if (num_m_args < 4)
Billy McFalla9a20e72017-02-15 11:39:12 -0500839 {
840 error = clib_error_return (0, "mandatory argument(s) missing");
841 goto done;
842 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700843
Kingwel Xie72b3bce2019-02-12 06:45:08 -0500844 if (ipv4_set && ipv6_set)
845 return clib_error_return (0, "both IPv4 and IPv6 addresses specified");
846
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400847 a.is_ip6 = ipv6_set;
848
Neale Rannsfd060842019-03-04 13:44:42 +0000849 clib_memcpy (a.local_crypto_key, lck.data, lck.len);
850 a.local_crypto_key_len = lck.len;
851 clib_memcpy (a.remote_crypto_key, rck.data, rck.len);
852 a.remote_crypto_key_len = rck.len;
853
Kingwel Xied3d12052019-03-07 06:34:30 -0500854 clib_memcpy (a.local_integ_key, lik.data, lik.len);
Neale Rannsfd060842019-03-04 13:44:42 +0000855 a.local_integ_key_len = lck.len;
Kingwel Xied3d12052019-03-07 06:34:30 -0500856 clib_memcpy (a.remote_integ_key, rik.data, rik.len);
Neale Rannsfd060842019-03-04 13:44:42 +0000857 a.remote_integ_key_len = rck.len;
858
Matthew Smith2838a232016-06-21 16:05:09 -0500859 rv = ipsec_add_del_tunnel_if (&a);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700860
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700861 switch (rv)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700862 {
863 case 0:
864 break;
865 case VNET_API_ERROR_INVALID_VALUE:
866 if (a.is_add)
Billy McFalla9a20e72017-02-15 11:39:12 -0500867 error = clib_error_return (0,
868 "IPSec tunnel interface already exists...");
Ed Warnickecb9cada2015-12-08 15:45:58 -0700869 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500870 error = clib_error_return (0, "IPSec tunnel interface not exists...");
871 goto done;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700872 default:
Billy McFalla9a20e72017-02-15 11:39:12 -0500873 error = clib_error_return (0, "ipsec_register_interface returned %d",
874 rv);
875 goto done;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700876 }
877
Billy McFalla9a20e72017-02-15 11:39:12 -0500878done:
879 unformat_free (line_input);
880
881 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700882}
883
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700884/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700885VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
886 .path = "create ipsec tunnel",
Pierre Pfister4c422f92018-12-10 11:19:08 +0100887 .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> "
Kingwel Xie2baf9422019-02-04 02:07:06 -0800888 "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] [use-esn] [use-anti-replay] "
Pierre Pfister4c422f92018-12-10 11:19:08 +0100889 "[tx-table <table-id>]",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700890 .function = create_ipsec_tunnel_command_fn,
891};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700892/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700893
894static clib_error_t *
895set_interface_key_command_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700896 unformat_input_t * input,
897 vlib_cli_command_t * cmd)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700898{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700899 unformat_input_t _line_input, *line_input = &_line_input;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700900 ipsec_main_t *im = &ipsec_main;
901 ipsec_if_set_key_type_t type = IPSEC_IF_SET_KEY_TYPE_NONE;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700902 u32 hw_if_index = (u32) ~ 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700903 u32 alg;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700904 u8 *key = 0;
Billy McFalla9a20e72017-02-15 11:39:12 -0500905 clib_error_t *error = NULL;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700906
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700907 if (!unformat_user (input, unformat_line_input, line_input))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700908 return 0;
909
910 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
911 {
912 if (unformat (line_input, "%U",
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700913 unformat_vnet_hw_interface, im->vnet_main, &hw_if_index))
914 ;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700915 else
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700916 if (unformat
917 (line_input, "local crypto %U", unformat_ipsec_crypto_alg, &alg))
918 type = IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO;
919 else
920 if (unformat
921 (line_input, "remote crypto %U", unformat_ipsec_crypto_alg, &alg))
922 type = IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO;
923 else
924 if (unformat
925 (line_input, "local integ %U", unformat_ipsec_integ_alg, &alg))
926 type = IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG;
927 else
928 if (unformat
929 (line_input, "remote integ %U", unformat_ipsec_integ_alg, &alg))
930 type = IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG;
931 else if (unformat (line_input, "%U", unformat_hex_string, &key))
932 ;
933 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500934 {
935 error = clib_error_return (0, "parse error: '%U'",
936 format_unformat_error, line_input);
937 goto done;
938 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700939 }
940
Ed Warnickecb9cada2015-12-08 15:45:58 -0700941 if (type == IPSEC_IF_SET_KEY_TYPE_NONE)
Billy McFalla9a20e72017-02-15 11:39:12 -0500942 {
943 error = clib_error_return (0, "unknown key type");
944 goto done;
945 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700946
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700947 if (alg > 0 && vec_len (key) == 0)
Billy McFalla9a20e72017-02-15 11:39:12 -0500948 {
949 error = clib_error_return (0, "key is not specified");
950 goto done;
951 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700952
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700953 if (hw_if_index == (u32) ~ 0)
Billy McFalla9a20e72017-02-15 11:39:12 -0500954 {
955 error = clib_error_return (0, "interface not specified");
956 goto done;
957 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700958
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700959 ipsec_set_interface_key (im->vnet_main, hw_if_index, type, alg, key);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700960
Billy McFalla9a20e72017-02-15 11:39:12 -0500961done:
962 vec_free (key);
963 unformat_free (line_input);
964
965 return error;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700966}
967
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700968/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700969VLIB_CLI_COMMAND (set_interface_key_command, static) = {
970 .path = "set interface ipsec key",
971 .short_help =
972 "set interface ipsec key <int> <local|remote> <crypto|integ> <key type> <key>",
973 .function = set_interface_key_command_fn,
974};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700975/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700976
Ed Warnickecb9cada2015-12-08 15:45:58 -0700977clib_error_t *
978ipsec_cli_init (vlib_main_t * vm)
979{
980 return 0;
981}
982
983VLIB_INIT_FUNCTION (ipsec_cli_init);
984
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700985
986/*
987 * fd.io coding-style-patch-verification: ON
988 *
989 * Local Variables:
990 * eval: (c-set-style "gnu")
991 * End:
992 */