33 if (id->
type == IKEV2_ID_TYPE_ID_FQDN ||
34 id->
type == IKEV2_ID_TYPE_ID_RFC822_ADDR)
65 vlib_cli_output(vm,
" iip %U ispi %lx rip %U rspi %lx",
66 format_ip4_address, &sa->iaddr, sa->ispi,
67 format_ip4_address, &sa->raddr, sa->rspi);
69 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
70 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
72 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
73 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
75 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
76 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
78 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_DH);
79 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
81 vlib_cli_output(vm,
" %v", s);
84 vlib_cli_output(vm,
" nonce i:%U\n r:%U",
85 format_hex_bytes, sa->i_nonce, vec_len(sa->i_nonce),
86 format_hex_bytes, sa->r_nonce, vec_len(sa->r_nonce));
88 vlib_cli_output(vm,
" SK_d %U",
89 format_hex_bytes, sa->sk_d, vec_len(sa->sk_d));
90 vlib_cli_output(vm,
" SK_a i:%U\n r:%U",
91 format_hex_bytes, sa->sk_ai, vec_len(sa->sk_ai),
92 format_hex_bytes, sa->sk_ar, vec_len(sa->sk_ar));
93 vlib_cli_output(vm,
" SK_e i:%U\n r:%U",
94 format_hex_bytes, sa->sk_ei, vec_len(sa->sk_ei),
95 format_hex_bytes, sa->sk_er, vec_len(sa->sk_er));
96 vlib_cli_output(vm,
" SK_p i:%U\n r:%U",
97 format_hex_bytes, sa->sk_pi, vec_len(sa->sk_pi),
98 format_hex_bytes, sa->sk_pr, vec_len(sa->sk_pr));
100 vlib_cli_output(vm,
" identifier (i) %U",
101 format_ikev2_id_type_and_data, &sa->i_id);
102 vlib_cli_output(vm,
" identifier (r) %U",
103 format_ikev2_id_type_and_data, &sa->r_id);
105 vec_foreach(child, sa->childs)
107 vlib_cli_output(vm,
" child sa %u:", child - sa->childs);
109 tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
110 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
112 tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
113 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
115 tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ESN);
116 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
118 vlib_cli_output(vm,
" %v", s);
121 vlib_cli_output(vm,
" spi(i) %lx spi(r) %lx",
122 child->i_proposals ? child->i_proposals[0].spi : 0,
123 child->r_proposals ? child->r_proposals[0].spi : 0);
125 vlib_cli_output(vm,
" SK_e i:%U\n r:%U",
126 format_hex_bytes, child->sk_ei, vec_len(child->sk_ei),
127 format_hex_bytes, child->sk_er, vec_len(child->sk_er));
128 vlib_cli_output(vm,
" SK_a i:%U\n r:%U",
129 format_hex_bytes, child->sk_ai, vec_len(child->sk_ai),
130 format_hex_bytes, child->sk_ar, vec_len(child->sk_ar));
131 vlib_cli_output(vm,
" traffic selectors (i):");
132 vec_foreach(ts, child->tsi)
134 vlib_cli_output(vm,
" %u type %u protocol_id %u addr " 135 "%U - %U port %u - %u",
137 ts->ts_type, ts->protocol_id,
138 format_ip4_address, &ts->start_addr,
139 format_ip4_address, &ts->end_addr,
140 clib_net_to_host_u16( ts->start_port),
141 clib_net_to_host_u16( ts->end_port));
143 vlib_cli_output(vm,
" traffic selectors (r):");
144 vec_foreach(ts, child->tsr)
146 vlib_cli_output(vm,
" %u type %u protocol_id %u addr " 147 "%U - %U port %u - %u",
149 ts->ts_type, ts->protocol_id,
150 format_ip4_address, &ts->start_addr,
151 format_ip4_address, &ts->end_addr,
152 clib_net_to_host_u16( ts->start_port),
153 clib_net_to_host_u16( ts->end_port));
165 .path =
"show ikev2 sa",
166 .short_help =
"show ikev2 sa",
182 u32 tmp1, tmp2, tmp3;
186 u32 responder_sw_if_index = (
u32) ~ 0;
192 const char *valid_chars =
"a-zA-Z0-9_";
211 else if (
unformat (line_input,
"set %U auth shared-key-mic string %v",
216 IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
220 else if (
unformat (line_input,
"set %U auth shared-key-mic hex %U",
226 IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
230 else if (
unformat (line_input,
"set %U auth rsa-sig cert-file %v",
238 else if (
unformat (line_input,
"set %U id local %U %U",
249 else if (
unformat (line_input,
"set %U id local %U 0x%U",
258 else if (
unformat (line_input,
"set %U id local %U %v",
266 else if (
unformat (line_input,
"set %U id remote %U %U",
277 else if (
unformat (line_input,
"set %U id remote %U 0x%U",
286 else if (
unformat (line_input,
"set %U id remote %U %v",
294 else if (
unformat (line_input,
"set %U traffic-selector local " 295 "ip-range %U - %U port-range %u - %u protocol %u",
299 &tmp1, &tmp2, &tmp3))
306 else if (
unformat (line_input,
"set %U traffic-selector remote " 307 "ip-range %U - %U port-range %u - %u protocol %u",
311 &tmp1, &tmp2, &tmp3))
318 else if (
unformat (line_input,
"set %U responder %U %U",
332 "set %U ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
346 "set %U esp-crypto-alg %U %u esp-integ-alg %U esp-dh %U",
357 else if (
unformat (line_input,
"set %U sa-lifetime %lu %u %u %lu",
359 &tmp4, &tmp1, &tmp2, &tmp5))
381 .path =
"ikev2 profile",
383 "ikev2 profile [add|del] <id>\n" 384 "ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex]" 386 "ikev2 profile set <id> id <local|remote> <type> <data>\n" 387 "ikev2 profile set <id> traffic-selector <local|remote> ip-range " 388 "<start-addr> - <end-addr> port-range <start-port> - <end-port> " 389 "protocol <protocol-number>\n" 390 "ikev2 profile set <id> responder <interface> <addr>\n" 391 "ikev2 profile set <id> ike-crypto-alg <crypto alg> <key size> ike-integ-alg <integ alg> ike-dh <dh type>\n" 392 "ikev2 profile set <id> esp-crypto-alg <crypto alg> <key size> esp-integ-alg <integ alg> esp-dh <dh type>\n" 393 "ikev2 profile set <id> sa-lifetime <seconds> <jitter> <handover> <max bytes>",
408 vlib_cli_output(vm,
"profile %v", p->name);
413 vlib_cli_output(vm,
" auth-method %U auth data 0x%U",
414 format_ikev2_auth_method, p->auth.method,
415 format_hex_bytes, p->auth.data, vec_len(p->auth.data));
417 vlib_cli_output(vm,
" auth-method %U auth data %v",
418 format_ikev2_auth_method, p->auth.method, p->auth.data);
423 if (p->loc_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
424 vlib_cli_output(vm,
" local id-type %U data %U",
425 format_ikev2_id_type, p->loc_id.type,
426 format_ip4_address, p->loc_id.data);
427 else if (p->loc_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
428 vlib_cli_output(vm,
" local id-type %U data 0x%U",
429 format_ikev2_id_type, p->loc_id.type,
430 format_hex_bytes, p->loc_id.data,
431 vec_len(p->loc_id.data));
433 vlib_cli_output(vm,
" local id-type %U data %v",
434 format_ikev2_id_type, p->loc_id.type, p->loc_id.data);
439 if (p->rem_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
440 vlib_cli_output(vm,
" remote id-type %U data %U",
441 format_ikev2_id_type, p->rem_id.type,
442 format_ip4_address, p->rem_id.data);
443 else if (p->rem_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
444 vlib_cli_output(vm,
" remote id-type %U data 0x%U",
445 format_ikev2_id_type, p->rem_id.type,
446 format_hex_bytes, p->rem_id.data,
447 vec_len(p->rem_id.data));
449 vlib_cli_output(vm,
" remote id-type %U data %v",
450 format_ikev2_id_type, p->rem_id.type, p->rem_id.data);
454 vlib_cli_output(vm,
" local traffic-selector addr %U - %U port %u - %u" 462 vlib_cli_output(vm,
" remote traffic-selector addr %U - %U port %u - %u" 476 .path =
"show ikev2 profile",
477 .short_help =
"show ikev2 profile",
496 if (
unformat (line_input,
"%s", &data))
516 .path =
"set ikev2 local key",
518 "set ikev2 local key <file>",
534 const char *valid_chars =
"a-zA-Z0-9_";
547 else if (
unformat (line_input,
"del-child-sa %x", &tmp1))
552 else if (
unformat (line_input,
"del-sa %lx", &tmp2))
557 else if (
unformat (line_input,
"rekey-child-sa %x", &tmp1))
577 .path =
"ikev2 initiate",
579 "ikev2 initiate sa-init <profile id>\n" 580 "ikev2 initiate del-child-sa <child sa ispi>\n" 581 "ikev2 initiate del-sa <sa ispi>\n" 582 "ikev2 initiate rekey-child-sa <profile id> <child sa ispi>\n",
ikev2_main_per_thread_data_t * per_thread_data
u8 * format_ikev2_id_type_and_data(u8 *s, va_list *args)
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip4_address_t ip4)
ikev2_transform_integ_type_t
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
vnet_main_t * vnet_get_main(void)
uword unformat_ikev2_transform_encr_type(unformat_input_t *input, va_list *args)
ikev2_profile_t * profiles
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
uword unformat_ikev2_id_type(unformat_input_t *input, va_list *args)
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
unformat_function_t unformat_vnet_sw_interface
ikev2_transform_dh_type_t
static clib_error_t * show_ikev2_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
#define VLIB_INIT_FUNCTION(x)
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
uword unformat_ikev2_transform_dh_type(unformat_input_t *input, va_list *args)
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
#define clib_error_return(e, args...)
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip4_address_t start_addr, ip4_address_t end_addr, int is_local)
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
ikev2_transform_encr_type_t
#define vec_free(V)
Free vector's memory (no header).
#define clib_memcpy(a, b, c)
#define VLIB_CLI_COMMAND(x,...)
uword unformat_ikev2_transform_integ_type(unformat_input_t *input, va_list *args)
static clib_error_t * show_ikev2_profile_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
static clib_error_t * set_ikev2_local_key_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_error_t * ikev2_cli_init(vlib_main_t *vm)
#define vec_foreach(var, vec)
Vector iterator.
static clib_error_t * ikev2_profile_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
static clib_error_t * ikev2_initiate_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u8 * format_ikev2_id_type(u8 *s, va_list *args)