Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * decap.c : IPSec tunnel support |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | #include <vnet/interface.h> |
Pierre Pfister | 4c422f9 | 2018-12-10 11:19:08 +0100 | [diff] [blame] | 22 | #include <vnet/fib/fib.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 23 | |
| 24 | #include <vnet/ipsec/ipsec.h> |
| 25 | |
| 26 | static clib_error_t * |
| 27 | set_interface_spd_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 28 | unformat_input_t * input, |
| 29 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 30 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 31 | unformat_input_t _line_input, *line_input = &_line_input; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 32 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 33 | u32 sw_if_index = (u32) ~ 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 34 | u32 spd_id; |
| 35 | int is_add = 1; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 36 | clib_error_t *error = NULL; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 37 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 38 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 39 | return 0; |
| 40 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 41 | if (unformat |
| 42 | (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main, |
| 43 | &sw_if_index, &spd_id)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 44 | ; |
| 45 | else if (unformat (line_input, "del")) |
| 46 | is_add = 0; |
| 47 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 48 | { |
| 49 | error = clib_error_return (0, "parse error: '%U'", |
| 50 | format_unformat_error, line_input); |
| 51 | goto done; |
| 52 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 53 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 54 | ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 55 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 56 | done: |
| 57 | unformat_free (line_input); |
| 58 | |
| 59 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 60 | } |
| 61 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 62 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 63 | VLIB_CLI_COMMAND (set_interface_spd_command, static) = { |
| 64 | .path = "set interface ipsec spd", |
| 65 | .short_help = |
| 66 | "set interface ipsec spd <int> <id>", |
| 67 | .function = set_interface_spd_command_fn, |
| 68 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 69 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 70 | |
| 71 | static clib_error_t * |
| 72 | ipsec_sa_add_del_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 73 | unformat_input_t * input, |
| 74 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 75 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 76 | unformat_input_t _line_input, *line_input = &_line_input; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 77 | ip46_address_t tun_src = { }, tun_dst = |
| 78 | { |
| 79 | }; |
| 80 | ipsec_crypto_alg_t crypto_alg; |
| 81 | ipsec_integ_alg_t integ_alg; |
| 82 | ipsec_protocol_t proto; |
| 83 | ipsec_sa_flags_t flags; |
| 84 | clib_error_t *error; |
Kingwel Xie | d3d1205 | 2019-03-07 06:34:30 -0500 | [diff] [blame] | 85 | ipsec_key_t ck = { 0 }; |
| 86 | ipsec_key_t ik = { 0 }; |
Neale Ranns | 80f6fd5 | 2019-04-16 02:41:34 +0000 | [diff] [blame] | 87 | u32 id, spi, salt; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 88 | int is_add, rv; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 89 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 90 | error = NULL; |
| 91 | is_add = 0; |
| 92 | flags = IPSEC_SA_FLAG_NONE; |
| 93 | proto = IPSEC_PROTOCOL_ESP; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 94 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 95 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 96 | return 0; |
| 97 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 98 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 99 | { |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 100 | if (unformat (line_input, "add %u", &id)) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 101 | is_add = 1; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 102 | else if (unformat (line_input, "del %u", &id)) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 103 | is_add = 0; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 104 | else if (unformat (line_input, "spi %u", &spi)) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 105 | ; |
Neale Ranns | 80f6fd5 | 2019-04-16 02:41:34 +0000 | [diff] [blame] | 106 | else if (unformat (line_input, "salt %u", &salt)) |
| 107 | ; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 108 | else if (unformat (line_input, "esp")) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 109 | proto = IPSEC_PROTOCOL_ESP; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 110 | else if (unformat (line_input, "ah")) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 111 | proto = IPSEC_PROTOCOL_AH; |
| 112 | else if (unformat (line_input, "crypto-key %U", |
| 113 | unformat_ipsec_key, &ck)) |
| 114 | ; |
| 115 | else if (unformat (line_input, "crypto-alg %U", |
| 116 | unformat_ipsec_crypto_alg, &crypto_alg)) |
| 117 | ; |
| 118 | else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik)) |
| 119 | ; |
| 120 | else if (unformat (line_input, "integ-alg %U", |
| 121 | unformat_ipsec_integ_alg, &integ_alg)) |
| 122 | ; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 123 | else if (unformat (line_input, "tunnel-src %U", |
Kingwel Xie | 72b3bce | 2019-02-12 06:45:08 -0500 | [diff] [blame] | 124 | unformat_ip46_address, &tun_src, IP46_TYPE_ANY)) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 125 | { |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 126 | flags |= IPSEC_SA_FLAG_IS_TUNNEL; |
| 127 | if (!ip46_address_is_ip4 (&tun_src)) |
| 128 | flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 129 | } |
| 130 | else if (unformat (line_input, "tunnel-dst %U", |
Kingwel Xie | 72b3bce | 2019-02-12 06:45:08 -0500 | [diff] [blame] | 131 | unformat_ip46_address, &tun_dst, IP46_TYPE_ANY)) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 132 | ; |
Radu Nicolau | 717de09 | 2018-08-03 10:37:24 +0100 | [diff] [blame] | 133 | else if (unformat (line_input, "udp-encap")) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 134 | flags |= IPSEC_SA_FLAG_UDP_ENCAP; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 135 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 136 | { |
| 137 | error = clib_error_return (0, "parse error: '%U'", |
| 138 | format_unformat_error, line_input); |
| 139 | goto done; |
| 140 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 141 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 142 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 143 | if (is_add) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 144 | rv = ipsec_sa_add (id, spi, proto, crypto_alg, |
| 145 | &ck, integ_alg, &ik, flags, |
Neale Ranns | 80f6fd5 | 2019-04-16 02:41:34 +0000 | [diff] [blame] | 146 | 0, clib_host_to_net_u32 (salt), |
| 147 | &tun_src, &tun_dst, NULL); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 148 | else |
| 149 | rv = ipsec_sa_del (id); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 150 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 151 | if (rv) |
| 152 | clib_error_return (0, "failed"); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 153 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 154 | done: |
| 155 | unformat_free (line_input); |
| 156 | |
| 157 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 158 | } |
| 159 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 160 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 161 | VLIB_CLI_COMMAND (ipsec_sa_add_del_command, static) = { |
| 162 | .path = "ipsec sa", |
| 163 | .short_help = |
| 164 | "ipsec sa [add|del]", |
| 165 | .function = ipsec_sa_add_del_command_fn, |
| 166 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 167 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 168 | |
| 169 | static clib_error_t * |
| 170 | ipsec_spd_add_del_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 171 | unformat_input_t * input, |
| 172 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 173 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 174 | unformat_input_t _line_input, *line_input = &_line_input; |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 175 | u32 spd_id = ~0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 176 | int is_add = ~0; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 177 | clib_error_t *error = NULL; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 178 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 179 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 180 | return 0; |
| 181 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 182 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 183 | { |
| 184 | if (unformat (line_input, "add")) |
| 185 | is_add = 1; |
| 186 | else if (unformat (line_input, "del")) |
| 187 | is_add = 0; |
| 188 | else if (unformat (line_input, "%u", &spd_id)) |
| 189 | ; |
| 190 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 191 | { |
| 192 | error = clib_error_return (0, "parse error: '%U'", |
| 193 | format_unformat_error, line_input); |
| 194 | goto done; |
| 195 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 196 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 197 | |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 198 | if (spd_id == ~0) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 199 | { |
| 200 | error = clib_error_return (0, "please specify SPD ID"); |
| 201 | goto done; |
| 202 | } |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 203 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 204 | ipsec_add_del_spd (vm, spd_id, is_add); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 205 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 206 | done: |
| 207 | unformat_free (line_input); |
| 208 | |
| 209 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 210 | } |
| 211 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 212 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 213 | VLIB_CLI_COMMAND (ipsec_spd_add_del_command, static) = { |
| 214 | .path = "ipsec spd", |
| 215 | .short_help = |
| 216 | "ipsec spd [add|del] <id>", |
| 217 | .function = ipsec_spd_add_del_command_fn, |
| 218 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 219 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 220 | |
| 221 | |
| 222 | static clib_error_t * |
| 223 | ipsec_policy_add_del_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 224 | unformat_input_t * input, |
| 225 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 226 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 227 | unformat_input_t _line_input, *line_input = &_line_input; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 228 | ipsec_policy_t p; |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 229 | int rv, is_add = 0; |
| 230 | u32 tmp, tmp2, stat_index; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 231 | clib_error_t *error = NULL; |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 232 | u32 is_outbound; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 233 | |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 234 | clib_memset (&p, 0, sizeof (p)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 235 | p.lport.stop = p.rport.stop = ~0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 236 | p.laddr.stop.ip4.as_u32 = p.raddr.stop.ip4.as_u32 = (u32) ~ 0; |
| 237 | p.laddr.stop.ip6.as_u64[0] = p.laddr.stop.ip6.as_u64[1] = (u64) ~ 0; |
| 238 | p.raddr.stop.ip6.as_u64[0] = p.raddr.stop.ip6.as_u64[1] = (u64) ~ 0; |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 239 | is_outbound = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 240 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 241 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 242 | return 0; |
| 243 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 244 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 245 | { |
| 246 | if (unformat (line_input, "add")) |
| 247 | is_add = 1; |
| 248 | else if (unformat (line_input, "del")) |
| 249 | is_add = 0; |
| 250 | else if (unformat (line_input, "spd %u", &p.id)) |
| 251 | ; |
| 252 | else if (unformat (line_input, "inbound")) |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 253 | is_outbound = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 254 | else if (unformat (line_input, "outbound")) |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 255 | is_outbound = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 256 | else if (unformat (line_input, "priority %d", &p.priority)) |
| 257 | ; |
| 258 | else if (unformat (line_input, "protocol %u", &tmp)) |
| 259 | p.protocol = (u8) tmp; |
| 260 | else |
| 261 | if (unformat |
| 262 | (line_input, "action %U", unformat_ipsec_policy_action, |
| 263 | &p.policy)) |
| 264 | { |
| 265 | if (p.policy == IPSEC_POLICY_ACTION_RESOLVE) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 266 | { |
| 267 | error = clib_error_return (0, "unsupported action: 'resolve'"); |
| 268 | goto done; |
| 269 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 270 | } |
| 271 | else if (unformat (line_input, "sa %u", &p.sa_id)) |
| 272 | ; |
| 273 | else if (unformat (line_input, "local-ip-range %U - %U", |
| 274 | unformat_ip4_address, &p.laddr.start.ip4, |
| 275 | unformat_ip4_address, &p.laddr.stop.ip4)) |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 276 | ; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 277 | else if (unformat (line_input, "remote-ip-range %U - %U", |
| 278 | unformat_ip4_address, &p.raddr.start.ip4, |
| 279 | unformat_ip4_address, &p.raddr.stop.ip4)) |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 280 | ; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 281 | else if (unformat (line_input, "local-ip-range %U - %U", |
| 282 | unformat_ip6_address, &p.laddr.start.ip6, |
| 283 | unformat_ip6_address, &p.laddr.stop.ip6)) |
| 284 | { |
| 285 | p.is_ipv6 = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 286 | } |
| 287 | else if (unformat (line_input, "remote-ip-range %U - %U", |
| 288 | unformat_ip6_address, &p.raddr.start.ip6, |
| 289 | unformat_ip6_address, &p.raddr.stop.ip6)) |
| 290 | { |
| 291 | p.is_ipv6 = 1; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 292 | } |
| 293 | else if (unformat (line_input, "local-port-range %u - %u", &tmp, &tmp2)) |
| 294 | { |
| 295 | p.lport.start = tmp; |
| 296 | p.lport.stop = tmp2; |
Neale Ranns | 231c469 | 2019-03-18 17:11:28 +0000 | [diff] [blame] | 297 | p.lport.start = clib_host_to_net_u16 (p.lport.start); |
| 298 | p.lport.stop = clib_host_to_net_u16 (p.lport.stop); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 299 | } |
| 300 | else |
| 301 | if (unformat (line_input, "remote-port-range %u - %u", &tmp, &tmp2)) |
| 302 | { |
| 303 | p.rport.start = tmp; |
| 304 | p.rport.stop = tmp2; |
Neale Ranns | 231c469 | 2019-03-18 17:11:28 +0000 | [diff] [blame] | 305 | p.rport.start = clib_host_to_net_u16 (p.rport.start); |
| 306 | p.rport.stop = clib_host_to_net_u16 (p.rport.stop); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 307 | } |
| 308 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 309 | { |
| 310 | error = clib_error_return (0, "parse error: '%U'", |
| 311 | format_unformat_error, line_input); |
| 312 | goto done; |
| 313 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 314 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 315 | |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 316 | /* Check if SA is for IPv6/AH which is not supported. Return error if TRUE. */ |
| 317 | if (p.sa_id) |
| 318 | { |
| 319 | uword *p1; |
| 320 | ipsec_main_t *im = &ipsec_main; |
| 321 | ipsec_sa_t *sa = 0; |
| 322 | p1 = hash_get (im->sa_index_by_sa_id, p.sa_id); |
Klement Sekera | c2fc57e | 2018-06-28 14:20:12 +0200 | [diff] [blame] | 323 | if (!p1) |
| 324 | { |
| 325 | error = |
| 326 | clib_error_return (0, "SA with index %u not found", p.sa_id); |
| 327 | goto done; |
| 328 | } |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 329 | sa = pool_elt_at_index (im->sad, p1[0]); |
| 330 | if (sa && sa->protocol == IPSEC_PROTOCOL_AH && is_add && p.is_ipv6) |
| 331 | { |
| 332 | error = clib_error_return (0, "AH not supported for IPV6: '%U'", |
| 333 | format_unformat_error, line_input); |
| 334 | goto done; |
| 335 | } |
| 336 | } |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 337 | |
| 338 | rv = ipsec_policy_mk_type (is_outbound, p.is_ipv6, p.policy, &p.type); |
| 339 | |
| 340 | if (rv) |
| 341 | { |
| 342 | error = clib_error_return (0, "unsupported policy type for:", |
| 343 | " outboud:%s %s action:%U", |
| 344 | (is_outbound ? "yes" : "no"), |
| 345 | (p.is_ipv6 ? "IPv4" : "IPv6"), |
| 346 | format_ipsec_policy_action, p.policy); |
| 347 | goto done; |
| 348 | } |
| 349 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 350 | rv = ipsec_add_del_policy (vm, &p, is_add, &stat_index); |
| 351 | |
| 352 | if (!rv) |
| 353 | vlib_cli_output (vm, "policy-index:%d", stat_index); |
| 354 | else |
| 355 | vlib_cli_output (vm, "error:%d", rv); |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 356 | |
| 357 | done: |
| 358 | unformat_free (line_input); |
| 359 | |
| 360 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 361 | } |
| 362 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 363 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 364 | VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = { |
| 365 | .path = "ipsec policy", |
| 366 | .short_help = |
| 367 | "ipsec policy [add|del] spd <id> priority <n> ", |
| 368 | .function = ipsec_policy_add_del_command_fn, |
| 369 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 370 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 371 | |
| 372 | static clib_error_t * |
| 373 | set_ipsec_sa_key_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 374 | unformat_input_t * input, |
| 375 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 376 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 377 | unformat_input_t _line_input, *line_input = &_line_input; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 378 | clib_error_t *error = NULL; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 379 | ipsec_key_t ck, ik; |
| 380 | u32 id; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 381 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 382 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 383 | return 0; |
| 384 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 385 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 386 | { |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 387 | if (unformat (line_input, "%u", &id)) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 388 | ; |
| 389 | else |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 390 | if (unformat (line_input, "crypto-key %U", unformat_ipsec_key, &ck)) |
| 391 | ; |
| 392 | else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik)) |
| 393 | ; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 394 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 395 | { |
| 396 | error = clib_error_return (0, "parse error: '%U'", |
| 397 | format_unformat_error, line_input); |
| 398 | goto done; |
| 399 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 400 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 401 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 402 | ipsec_set_sa_key (id, &ck, &ik); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 403 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 404 | done: |
| 405 | unformat_free (line_input); |
| 406 | |
| 407 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 408 | } |
| 409 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 410 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 411 | VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = { |
| 412 | .path = "set ipsec sa", |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 413 | .short_help = "set ipsec sa <id> crypto-key <key> integ-key <key>", |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 414 | .function = set_ipsec_sa_key_command_fn, |
| 415 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 416 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 417 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 418 | static void |
| 419 | ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 420 | { |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 421 | u32 sai; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 422 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 423 | /* *INDENT-OFF* */ |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 424 | pool_foreach_index (sai, im->sad, ({ |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 425 | vlib_cli_output(vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_BRIEF); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 426 | })); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 427 | /* *INDENT-ON* */ |
| 428 | } |
| 429 | |
| 430 | static void |
| 431 | ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im) |
| 432 | { |
| 433 | u32 spdi; |
| 434 | |
| 435 | /* *INDENT-OFF* */ |
| 436 | pool_foreach_index (spdi, im->spds, ({ |
| 437 | vlib_cli_output(vm, "%U", format_ipsec_spd, spdi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 438 | })); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 439 | /* *INDENT-ON* */ |
| 440 | } |
| 441 | |
| 442 | static void |
| 443 | ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im) |
| 444 | { |
| 445 | u32 spd_id, sw_if_index; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 446 | |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 447 | vlib_cli_output (vm, "SPD Bindings:"); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 448 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 449 | /* *INDENT-OFF* */ |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 450 | hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({ |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 451 | vlib_cli_output (vm, " %d -> %U", spd_id, |
| 452 | format_vnet_sw_if_index_name, im->vnet_main, |
| 453 | sw_if_index); |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 454 | })); |
| 455 | /* *INDENT-ON* */ |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 456 | } |
Neale Ranns | 311124e | 2019-01-24 04:52:25 -0800 | [diff] [blame] | 457 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 458 | static void |
| 459 | ipsec_tunnel_show_all (vlib_main_t * vm, ipsec_main_t * im) |
| 460 | { |
| 461 | u32 ti; |
| 462 | |
| 463 | vlib_cli_output (vm, "Tunnel interfaces"); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 464 | /* *INDENT-OFF* */ |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 465 | pool_foreach_index (ti, im->tunnel_interfaces, ({ |
| 466 | vlib_cli_output(vm, " %U", format_ipsec_tunnel, ti); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 467 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 468 | /* *INDENT-ON* */ |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 469 | } |
| 470 | |
| 471 | static clib_error_t * |
| 472 | show_ipsec_command_fn (vlib_main_t * vm, |
| 473 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 474 | { |
| 475 | ipsec_main_t *im = &ipsec_main; |
| 476 | |
| 477 | ipsec_sa_show_all (vm, im); |
| 478 | ipsec_spd_show_all (vm, im); |
| 479 | ipsec_spd_bindings_show_all (vm, im); |
| 480 | ipsec_tunnel_show_all (vm, im); |
| 481 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 482 | return 0; |
| 483 | } |
| 484 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 485 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 486 | VLIB_CLI_COMMAND (show_ipsec_command, static) = { |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 487 | .path = "show ipsec all", |
| 488 | .short_help = "show ipsec all", |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 489 | .function = show_ipsec_command_fn, |
| 490 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 491 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 492 | |
| 493 | static clib_error_t * |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 494 | show_ipsec_sa_command_fn (vlib_main_t * vm, |
| 495 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 496 | { |
| 497 | ipsec_main_t *im = &ipsec_main; |
| 498 | u32 sai = ~0; |
| 499 | |
| 500 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 501 | { |
| 502 | if (unformat (input, "%u", &sai)) |
| 503 | ; |
| 504 | else |
| 505 | break; |
| 506 | } |
| 507 | |
| 508 | if (~0 == sai) |
| 509 | ipsec_sa_show_all (vm, im); |
| 510 | else |
| 511 | vlib_cli_output (vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_DETAIL); |
| 512 | |
| 513 | return 0; |
| 514 | } |
| 515 | |
| 516 | /* *INDENT-OFF* */ |
| 517 | VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = { |
| 518 | .path = "show ipsec sa", |
| 519 | .short_help = "show ipsec sa [index]", |
| 520 | .function = show_ipsec_sa_command_fn, |
| 521 | }; |
| 522 | /* *INDENT-ON* */ |
| 523 | |
| 524 | static clib_error_t * |
| 525 | show_ipsec_spd_command_fn (vlib_main_t * vm, |
| 526 | unformat_input_t * input, vlib_cli_command_t * cmd) |
| 527 | { |
| 528 | ipsec_main_t *im = &ipsec_main; |
| 529 | u8 show_bindings = 0; |
| 530 | u32 spdi = ~0; |
| 531 | |
| 532 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 533 | { |
| 534 | if (unformat (input, "%u", &spdi)) |
| 535 | ; |
| 536 | else if (unformat (input, "bindings")) |
| 537 | show_bindings = 1; |
| 538 | else |
| 539 | break; |
| 540 | } |
| 541 | |
| 542 | if (show_bindings) |
| 543 | ipsec_spd_bindings_show_all (vm, im); |
| 544 | else if (~0 != spdi) |
| 545 | vlib_cli_output (vm, "%U", format_ipsec_spd, spdi); |
| 546 | else |
| 547 | ipsec_spd_show_all (vm, im); |
| 548 | |
| 549 | return 0; |
| 550 | } |
| 551 | |
| 552 | /* *INDENT-OFF* */ |
| 553 | VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = { |
| 554 | .path = "show ipsec spd", |
| 555 | .short_help = "show ipsec spd [index]", |
| 556 | .function = show_ipsec_spd_command_fn, |
| 557 | }; |
| 558 | /* *INDENT-ON* */ |
| 559 | |
| 560 | static clib_error_t * |
| 561 | show_ipsec_tunnel_command_fn (vlib_main_t * vm, |
| 562 | unformat_input_t * input, |
| 563 | vlib_cli_command_t * cmd) |
| 564 | { |
| 565 | ipsec_main_t *im = &ipsec_main; |
| 566 | u32 ti = ~0; |
| 567 | |
| 568 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 569 | { |
| 570 | if (unformat (input, "%u", &ti)) |
| 571 | ; |
| 572 | else |
| 573 | break; |
| 574 | } |
| 575 | |
| 576 | if (~0 != ti) |
| 577 | vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti); |
| 578 | else |
| 579 | ipsec_tunnel_show_all (vm, im); |
| 580 | |
| 581 | return 0; |
| 582 | } |
| 583 | |
| 584 | /* *INDENT-OFF* */ |
| 585 | VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = { |
| 586 | .path = "show ipsec tunnel", |
| 587 | .short_help = "show ipsec tunnel [index]", |
| 588 | .function = show_ipsec_tunnel_command_fn, |
| 589 | }; |
| 590 | /* *INDENT-ON* */ |
| 591 | |
| 592 | static clib_error_t * |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 593 | ipsec_show_backends_command_fn (vlib_main_t * vm, |
| 594 | unformat_input_t * input, |
| 595 | vlib_cli_command_t * cmd) |
| 596 | { |
| 597 | ipsec_main_t *im = &ipsec_main; |
| 598 | u32 verbose = 0; |
| 599 | |
| 600 | (void) unformat (input, "verbose %u", &verbose); |
| 601 | |
| 602 | vlib_cli_output (vm, "IPsec AH backends available:"); |
| 603 | u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); |
| 604 | ipsec_ah_backend_t *ab; |
| 605 | /* *INDENT-OFF* */ |
| 606 | pool_foreach (ab, im->ah_backends, { |
| 607 | s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends, |
| 608 | ab - im->ah_backends == im->ah_current_backend ? "yes" : "no"); |
| 609 | if (verbose) { |
| 610 | vlib_node_t *n; |
| 611 | n = vlib_get_node (vm, ab->ah4_encrypt_node_index); |
| 612 | s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index); |
| 613 | n = vlib_get_node (vm, ab->ah4_decrypt_node_index); |
| 614 | s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index); |
| 615 | n = vlib_get_node (vm, ab->ah6_encrypt_node_index); |
| 616 | s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index); |
| 617 | n = vlib_get_node (vm, ab->ah6_decrypt_node_index); |
| 618 | s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index); |
| 619 | } |
| 620 | }); |
| 621 | /* *INDENT-ON* */ |
| 622 | vlib_cli_output (vm, "%v", s); |
| 623 | _vec_len (s) = 0; |
| 624 | vlib_cli_output (vm, "IPsec ESP backends available:"); |
| 625 | s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); |
| 626 | ipsec_esp_backend_t *eb; |
| 627 | /* *INDENT-OFF* */ |
| 628 | pool_foreach (eb, im->esp_backends, { |
| 629 | s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends, |
| 630 | eb - im->esp_backends == im->esp_current_backend ? "yes" |
| 631 | : "no"); |
| 632 | if (verbose) { |
| 633 | vlib_node_t *n; |
| 634 | n = vlib_get_node (vm, eb->esp4_encrypt_node_index); |
| 635 | s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index); |
| 636 | n = vlib_get_node (vm, eb->esp4_decrypt_node_index); |
| 637 | s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index); |
| 638 | n = vlib_get_node (vm, eb->esp6_encrypt_node_index); |
| 639 | s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index); |
| 640 | n = vlib_get_node (vm, eb->esp6_decrypt_node_index); |
| 641 | s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index); |
| 642 | } |
| 643 | }); |
| 644 | /* *INDENT-ON* */ |
| 645 | vlib_cli_output (vm, "%v", s); |
| 646 | |
| 647 | vec_free (s); |
| 648 | return 0; |
| 649 | } |
| 650 | |
| 651 | /* *INDENT-OFF* */ |
| 652 | VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = { |
| 653 | .path = "show ipsec backends", |
| 654 | .short_help = "show ipsec backends", |
| 655 | .function = ipsec_show_backends_command_fn, |
| 656 | }; |
| 657 | /* *INDENT-ON* */ |
| 658 | |
| 659 | static clib_error_t * |
| 660 | ipsec_select_backend_command_fn (vlib_main_t * vm, |
| 661 | unformat_input_t * input, |
| 662 | vlib_cli_command_t * cmd) |
| 663 | { |
| 664 | u32 backend_index; |
| 665 | ipsec_main_t *im = &ipsec_main; |
| 666 | |
| 667 | if (pool_elts (im->sad) > 0) |
| 668 | { |
| 669 | return clib_error_return (0, |
| 670 | "Cannot change IPsec backend, while %u SA entries are configured", |
| 671 | pool_elts (im->sad)); |
| 672 | } |
| 673 | |
| 674 | unformat_input_t _line_input, *line_input = &_line_input; |
| 675 | /* Get a line of input. */ |
| 676 | if (!unformat_user (input, unformat_line_input, line_input)) |
| 677 | return 0; |
| 678 | |
| 679 | if (unformat (line_input, "ah")) |
| 680 | { |
| 681 | if (unformat (line_input, "%u", &backend_index)) |
| 682 | { |
| 683 | if (ipsec_select_ah_backend (im, backend_index) < 0) |
| 684 | { |
| 685 | return clib_error_return (0, "Invalid AH backend index `%u'", |
| 686 | backend_index); |
| 687 | } |
| 688 | } |
| 689 | else |
| 690 | { |
| 691 | return clib_error_return (0, "Invalid backend index `%U'", |
| 692 | format_unformat_error, line_input); |
| 693 | } |
| 694 | } |
| 695 | else if (unformat (line_input, "esp")) |
| 696 | { |
| 697 | if (unformat (line_input, "%u", &backend_index)) |
| 698 | { |
| 699 | if (ipsec_select_esp_backend (im, backend_index) < 0) |
| 700 | { |
| 701 | return clib_error_return (0, "Invalid ESP backend index `%u'", |
| 702 | backend_index); |
| 703 | } |
| 704 | } |
| 705 | else |
| 706 | { |
| 707 | return clib_error_return (0, "Invalid backend index `%U'", |
| 708 | format_unformat_error, line_input); |
| 709 | } |
| 710 | } |
| 711 | else |
| 712 | { |
| 713 | return clib_error_return (0, "Unknown input `%U'", |
| 714 | format_unformat_error, line_input); |
| 715 | } |
| 716 | |
| 717 | return 0; |
| 718 | } |
| 719 | |
| 720 | /* *INDENT-OFF* */ |
| 721 | VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = { |
| 722 | .path = "ipsec select backend", |
| 723 | .short_help = "ipsec select backend <ah|esp> <backend index>", |
| 724 | .function = ipsec_select_backend_command_fn, |
| 725 | }; |
| 726 | |
| 727 | /* *INDENT-ON* */ |
| 728 | |
| 729 | static clib_error_t * |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 730 | clear_ipsec_counters_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 731 | unformat_input_t * input, |
| 732 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 733 | { |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 734 | vlib_clear_combined_counters (&ipsec_spd_policy_counters); |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 735 | vlib_clear_combined_counters (&ipsec_sa_counters); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 736 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 737 | return (NULL); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 738 | } |
| 739 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 740 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 741 | VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = { |
| 742 | .path = "clear ipsec counters", |
| 743 | .short_help = "clear ipsec counters", |
| 744 | .function = clear_ipsec_counters_command_fn, |
| 745 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 746 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 747 | |
| 748 | static clib_error_t * |
| 749 | create_ipsec_tunnel_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 750 | unformat_input_t * input, |
| 751 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 752 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 753 | unformat_input_t _line_input, *line_input = &_line_input; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 754 | ipsec_add_del_tunnel_args_t a; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 755 | int rv; |
| 756 | u32 num_m_args = 0; |
Kingwel Xie | 72b3bce | 2019-02-12 06:45:08 -0500 | [diff] [blame] | 757 | u8 ipv4_set = 0; |
| 758 | u8 ipv6_set = 0; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 759 | clib_error_t *error = NULL; |
Kingwel Xie | d3d1205 | 2019-03-07 06:34:30 -0500 | [diff] [blame] | 760 | ipsec_key_t rck = { 0 }; |
| 761 | ipsec_key_t lck = { 0 }; |
| 762 | ipsec_key_t lik = { 0 }; |
| 763 | ipsec_key_t rik = { 0 }; |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 764 | |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 765 | clib_memset (&a, 0, sizeof (a)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 766 | a.is_add = 1; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 767 | |
| 768 | /* Get a line of input. */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 769 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 770 | return 0; |
| 771 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 772 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 773 | { |
| 774 | if (unformat |
Kingwel Xie | 72b3bce | 2019-02-12 06:45:08 -0500 | [diff] [blame] | 775 | (line_input, "local-ip %U", unformat_ip46_address, &a.local_ip, |
| 776 | IP46_TYPE_ANY)) |
| 777 | { |
| 778 | ip46_address_is_ip4 (&a.local_ip) ? (ipv4_set = 1) : (ipv6_set = 1); |
| 779 | num_m_args++; |
| 780 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 781 | else |
| 782 | if (unformat |
Kingwel Xie | 72b3bce | 2019-02-12 06:45:08 -0500 | [diff] [blame] | 783 | (line_input, "remote-ip %U", unformat_ip46_address, &a.remote_ip, |
| 784 | IP46_TYPE_ANY)) |
| 785 | { |
| 786 | ip46_address_is_ip4 (&a.remote_ip) ? (ipv4_set = 1) : (ipv6_set = |
| 787 | 1); |
| 788 | num_m_args++; |
| 789 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 790 | else if (unformat (line_input, "local-spi %u", &a.local_spi)) |
| 791 | num_m_args++; |
| 792 | else if (unformat (line_input, "remote-spi %u", &a.remote_spi)) |
| 793 | num_m_args++; |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 794 | else if (unformat (line_input, "instance %u", &a.show_instance)) |
| 795 | a.renumber = 1; |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 796 | else if (unformat (line_input, "salt 0x%x", &a.salt)) |
| 797 | ; |
Radu Nicolau | 717de09 | 2018-08-03 10:37:24 +0100 | [diff] [blame] | 798 | else if (unformat (line_input, "udp-encap")) |
| 799 | a.udp_encap = 1; |
Kingwel Xie | 2baf942 | 2019-02-04 02:07:06 -0800 | [diff] [blame] | 800 | else if (unformat (line_input, "use-esn")) |
| 801 | a.esn = 1; |
| 802 | else if (unformat (line_input, "use-anti-replay")) |
| 803 | a.anti_replay = 1; |
Pierre Pfister | 4c422f9 | 2018-12-10 11:19:08 +0100 | [diff] [blame] | 804 | else if (unformat (line_input, "tx-table %u", &a.tx_table_id)) |
| 805 | ; |
Neale Ranns | fd06084 | 2019-03-04 13:44:42 +0000 | [diff] [blame] | 806 | else |
| 807 | if (unformat |
| 808 | (line_input, "local-crypto-key %U", unformat_ipsec_key, &lck)) |
| 809 | ; |
| 810 | else |
| 811 | if (unformat |
| 812 | (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck)) |
| 813 | ; |
| 814 | else if (unformat (line_input, "crypto-alg %U", |
| 815 | unformat_ipsec_crypto_alg, &a.crypto_alg)) |
| 816 | ; |
| 817 | else |
| 818 | if (unformat |
| 819 | (line_input, "local-integ-key %U", unformat_ipsec_key, &lik)) |
| 820 | ; |
| 821 | else |
| 822 | if (unformat |
| 823 | (line_input, "rmote-integ-key %U", unformat_ipsec_key, &rik)) |
| 824 | ; |
| 825 | else if (unformat (line_input, "integ-alg %U", |
| 826 | unformat_ipsec_integ_alg, &a.integ_alg)) |
| 827 | ; |
Kingwel Xie | 2baf942 | 2019-02-04 02:07:06 -0800 | [diff] [blame] | 828 | else if (unformat (line_input, "del")) |
| 829 | a.is_add = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 830 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 831 | { |
| 832 | error = clib_error_return (0, "unknown input `%U'", |
| 833 | format_unformat_error, line_input); |
| 834 | goto done; |
| 835 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 836 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 837 | |
| 838 | if (num_m_args < 4) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 839 | { |
| 840 | error = clib_error_return (0, "mandatory argument(s) missing"); |
| 841 | goto done; |
| 842 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 843 | |
Kingwel Xie | 72b3bce | 2019-02-12 06:45:08 -0500 | [diff] [blame] | 844 | if (ipv4_set && ipv6_set) |
| 845 | return clib_error_return (0, "both IPv4 and IPv6 addresses specified"); |
| 846 | |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 847 | a.is_ip6 = ipv6_set; |
| 848 | |
Neale Ranns | fd06084 | 2019-03-04 13:44:42 +0000 | [diff] [blame] | 849 | clib_memcpy (a.local_crypto_key, lck.data, lck.len); |
| 850 | a.local_crypto_key_len = lck.len; |
| 851 | clib_memcpy (a.remote_crypto_key, rck.data, rck.len); |
| 852 | a.remote_crypto_key_len = rck.len; |
| 853 | |
Kingwel Xie | d3d1205 | 2019-03-07 06:34:30 -0500 | [diff] [blame] | 854 | clib_memcpy (a.local_integ_key, lik.data, lik.len); |
Neale Ranns | fd06084 | 2019-03-04 13:44:42 +0000 | [diff] [blame] | 855 | a.local_integ_key_len = lck.len; |
Kingwel Xie | d3d1205 | 2019-03-07 06:34:30 -0500 | [diff] [blame] | 856 | clib_memcpy (a.remote_integ_key, rik.data, rik.len); |
Neale Ranns | fd06084 | 2019-03-04 13:44:42 +0000 | [diff] [blame] | 857 | a.remote_integ_key_len = rck.len; |
| 858 | |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 859 | rv = ipsec_add_del_tunnel_if (&a); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 860 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 861 | switch (rv) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 862 | { |
| 863 | case 0: |
| 864 | break; |
| 865 | case VNET_API_ERROR_INVALID_VALUE: |
| 866 | if (a.is_add) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 867 | error = clib_error_return (0, |
| 868 | "IPSec tunnel interface already exists..."); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 869 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 870 | error = clib_error_return (0, "IPSec tunnel interface not exists..."); |
| 871 | goto done; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 872 | default: |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 873 | error = clib_error_return (0, "ipsec_register_interface returned %d", |
| 874 | rv); |
| 875 | goto done; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 876 | } |
| 877 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 878 | done: |
| 879 | unformat_free (line_input); |
| 880 | |
| 881 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 882 | } |
| 883 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 884 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 885 | VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = { |
| 886 | .path = "create ipsec tunnel", |
Pierre Pfister | 4c422f9 | 2018-12-10 11:19:08 +0100 | [diff] [blame] | 887 | .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> " |
Kingwel Xie | 2baf942 | 2019-02-04 02:07:06 -0800 | [diff] [blame] | 888 | "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] [use-esn] [use-anti-replay] " |
Pierre Pfister | 4c422f9 | 2018-12-10 11:19:08 +0100 | [diff] [blame] | 889 | "[tx-table <table-id>]", |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 890 | .function = create_ipsec_tunnel_command_fn, |
| 891 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 892 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 893 | |
| 894 | static clib_error_t * |
| 895 | set_interface_key_command_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 896 | unformat_input_t * input, |
| 897 | vlib_cli_command_t * cmd) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 898 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 899 | unformat_input_t _line_input, *line_input = &_line_input; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 900 | ipsec_main_t *im = &ipsec_main; |
| 901 | ipsec_if_set_key_type_t type = IPSEC_IF_SET_KEY_TYPE_NONE; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 902 | u32 hw_if_index = (u32) ~ 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 903 | u32 alg; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 904 | u8 *key = 0; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 905 | clib_error_t *error = NULL; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 906 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 907 | if (!unformat_user (input, unformat_line_input, line_input)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 908 | return 0; |
| 909 | |
| 910 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 911 | { |
| 912 | if (unformat (line_input, "%U", |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 913 | unformat_vnet_hw_interface, im->vnet_main, &hw_if_index)) |
| 914 | ; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 915 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 916 | if (unformat |
| 917 | (line_input, "local crypto %U", unformat_ipsec_crypto_alg, &alg)) |
| 918 | type = IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO; |
| 919 | else |
| 920 | if (unformat |
| 921 | (line_input, "remote crypto %U", unformat_ipsec_crypto_alg, &alg)) |
| 922 | type = IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO; |
| 923 | else |
| 924 | if (unformat |
| 925 | (line_input, "local integ %U", unformat_ipsec_integ_alg, &alg)) |
| 926 | type = IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG; |
| 927 | else |
| 928 | if (unformat |
| 929 | (line_input, "remote integ %U", unformat_ipsec_integ_alg, &alg)) |
| 930 | type = IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG; |
| 931 | else if (unformat (line_input, "%U", unformat_hex_string, &key)) |
| 932 | ; |
| 933 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 934 | { |
| 935 | error = clib_error_return (0, "parse error: '%U'", |
| 936 | format_unformat_error, line_input); |
| 937 | goto done; |
| 938 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 939 | } |
| 940 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 941 | if (type == IPSEC_IF_SET_KEY_TYPE_NONE) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 942 | { |
| 943 | error = clib_error_return (0, "unknown key type"); |
| 944 | goto done; |
| 945 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 946 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 947 | if (alg > 0 && vec_len (key) == 0) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 948 | { |
| 949 | error = clib_error_return (0, "key is not specified"); |
| 950 | goto done; |
| 951 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 952 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 953 | if (hw_if_index == (u32) ~ 0) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 954 | { |
| 955 | error = clib_error_return (0, "interface not specified"); |
| 956 | goto done; |
| 957 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 958 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 959 | ipsec_set_interface_key (im->vnet_main, hw_if_index, type, alg, key); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 960 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 961 | done: |
| 962 | vec_free (key); |
| 963 | unformat_free (line_input); |
| 964 | |
| 965 | return error; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 966 | } |
| 967 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 968 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 969 | VLIB_CLI_COMMAND (set_interface_key_command, static) = { |
| 970 | .path = "set interface ipsec key", |
| 971 | .short_help = |
| 972 | "set interface ipsec key <int> <local|remote> <crypto|integ> <key type> <key>", |
| 973 | .function = set_interface_key_command_fn, |
| 974 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 975 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 976 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 977 | clib_error_t * |
| 978 | ipsec_cli_init (vlib_main_t * vm) |
| 979 | { |
| 980 | return 0; |
| 981 | } |
| 982 | |
| 983 | VLIB_INIT_FUNCTION (ipsec_cli_init); |
| 984 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 985 | |
| 986 | /* |
| 987 | * fd.io coding-style-patch-verification: ON |
| 988 | * |
| 989 | * Local Variables: |
| 990 | * eval: (c-set-style "gnu") |
| 991 | * End: |
| 992 | */ |