32 u32 sw_if_index = (
u32) ~ 0;
42 &sw_if_index, &spd_id))
44 else if (
unformat (line_input,
"del"))
63 .path =
"set interface ipsec spd",
65 "set interface ipsec spd <int> <id>",
82 memset (&sa, 0,
sizeof (sa));
91 else if (
unformat (line_input,
"del %u", &sa.
id))
95 else if (
unformat (line_input,
"esp"))
97 else if (
unformat (line_input,
"ah"))
109 if (sa.
crypto_alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
124 if (sa.
integ_alg < IPSEC_INTEG_ALG_SHA1_96 ||
133 else if (
unformat (line_input,
"tunnel-src %U",
136 else if (
unformat (line_input,
"tunnel-dst %U",
139 else if (
unformat (line_input,
"tunnel-src %U",
145 else if (
unformat (line_input,
"tunnel-dst %U",
191 "ipsec sa [add|del]",
213 else if (
unformat (line_input,
"del"))
215 else if (
unformat (line_input,
"%u", &spd_id))
243 "ipsec spd [add|del] <id>",
261 memset (&p, 0,
sizeof (p));
274 else if (
unformat (line_input,
"del"))
276 else if (
unformat (line_input,
"spd %u", &p.
id))
278 else if (
unformat (line_input,
"inbound"))
280 else if (
unformat (line_input,
"outbound"))
284 else if (
unformat (line_input,
"protocol %u", &tmp))
291 if (p.
policy == IPSEC_POLICY_ACTION_RESOLVE)
299 else if (
unformat (line_input,
"local-ip-range %U - %U",
303 else if (
unformat (line_input,
"remote-ip-range %U - %U",
307 else if (
unformat (line_input,
"local-ip-range %U - %U",
314 else if (
unformat (line_input,
"remote-ip-range %U - %U",
321 else if (
unformat (line_input,
"local-port-range %u - %u", &tmp, &tmp2))
327 if (
unformat (line_input,
"remote-port-range %u - %u", &tmp, &tmp2))
370 .path =
"ipsec policy",
372 "ipsec policy [add|del] spd <id> priority <n> ",
387 memset (&sa, 0,
sizeof (sa));
432 .path =
"set ipsec sa",
434 "set ipsec sa <id> crypto-key <key> integ-key <key>",
454 vlib_cli_output(vm,
"sa %u spi %u mode %s protocol %s", sa->id, sa->spi,
455 sa->is_tunnel ?
"tunnel" :
"transport",
456 sa->protocol ?
"esp" :
"ah");
457 if (sa->protocol == IPSEC_PROTOCOL_ESP) {
458 vlib_cli_output(vm,
" crypto alg %U%s%U integrity alg %U%s%U",
459 format_ipsec_crypto_alg, sa->crypto_alg,
460 sa->crypto_alg ?
" key " :
"",
461 format_hex_bytes, sa->crypto_key, sa->crypto_key_len,
462 format_ipsec_integ_alg, sa->integ_alg,
463 sa->integ_alg ?
" key " :
"",
464 format_hex_bytes, sa->integ_key, sa->integ_key_len);
466 if (sa->is_tunnel && sa->is_tunnel_ip6) {
467 vlib_cli_output(vm,
" tunnel src %U dst %U",
468 format_ip6_address, &sa->tunnel_src_addr.ip6,
469 format_ip6_address, &sa->tunnel_dst_addr.ip6);
470 } else if (sa->is_tunnel) {
471 vlib_cli_output(vm,
" tunnel src %U dst %U",
472 format_ip4_address, &sa->tunnel_src_addr.ip4,
473 format_ip4_address, &sa->tunnel_dst_addr.ip4);
481 vlib_cli_output(vm,
"spd %u", spd->id);
483 vlib_cli_output(vm,
" outbound policies");
484 vec_foreach(i, spd->ipv4_outbound_policies)
486 p = pool_elt_at_index(spd->policies, *i);
487 vlib_cli_output(vm,
" priority %d action %U protocol %s%s",
489 format_ipsec_policy_action, p->policy,
491 format(0,
"%U", format_ip_protocol, p->protocol) :
493 p->policy == IPSEC_POLICY_ACTION_PROTECT ?
494 format(0,
" sa %u", p->sa_id) :
496 vlib_cli_output(vm,
" local addr range %U - %U port range %u - %u",
497 format_ip4_address, &p->laddr.start.ip4,
498 format_ip4_address, &p->laddr.stop.ip4,
499 p->lport.start, p->lport.stop);
500 vlib_cli_output(vm,
" remte addr range %U - %U port range %u - %u",
501 format_ip4_address, &p->raddr.start.ip4,
502 format_ip4_address, &p->raddr.stop.ip4,
503 p->rport.start, p->rport.stop);
504 vlib_cli_output(vm,
" packets %u bytes %u", p->counter.packets,
509 p = pool_elt_at_index(spd->policies, *i);
510 vlib_cli_output(vm,
" priority %d action %U protocol %s%s",
512 format_ipsec_policy_action, p->policy,
514 format(0,
"%U", format_ip_protocol, p->protocol) :
516 p->policy == IPSEC_POLICY_ACTION_PROTECT ?
517 format(0,
" sa %u", p->sa_id) :
519 vlib_cli_output(vm,
" local addr range %U - %U port range %u - %u",
520 format_ip6_address, &p->laddr.start.ip6,
521 format_ip6_address, &p->laddr.stop.ip6,
522 p->lport.start, p->lport.stop);
523 vlib_cli_output(vm,
" remote addr range %U - %U port range %u - %u",
524 format_ip6_address, &p->raddr.start.ip6,
525 format_ip6_address, &p->raddr.stop.ip6,
526 p->rport.start, p->rport.stop);
527 vlib_cli_output(vm,
" packets %u bytes %u", p->counter.packets,
531 vec_foreach(
i, spd->ipv4_inbound_protect_policy_indices)
540 p->policy == IPSEC_POLICY_ACTION_PROTECT ?
541 format(0,
" sa %u", p->sa_id) :
546 p->lport.start, p->lport.stop);
550 p->rport.start, p->rport.stop);
554 vec_foreach(
i, spd->ipv4_inbound_policy_discard_and_bypass_indices)
563 p->policy == IPSEC_POLICY_ACTION_PROTECT ?
564 format(0,
" sa %u", p->sa_id) :
569 p->lport.start, p->lport.stop);
573 p->rport.start, p->rport.stop);
577 vec_foreach(
i, spd->ipv6_inbound_protect_policy_indices)
586 p->policy == IPSEC_POLICY_ACTION_PROTECT ?
587 format(0,
" sa %u", p->sa_id) :
592 p->lport.start, p->lport.stop);
596 p->rport.start, p->rport.stop);
600 vec_foreach(
i, spd->ipv6_inbound_policy_discard_and_bypass_indices)
609 p->policy == IPSEC_POLICY_ACTION_PROTECT ?
610 format(0,
" sa %u", p->sa_id) :
615 p->lport.start, p->lport.stop);
619 p->rport.start, p->rport.stop);
629 if (t->hw_if_index == ~0)
631 hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
632 vlib_cli_output(vm,
" %s seq", hi->name);
633 sa = pool_elt_at_index(im->sad, t->output_sa_index);
634 vlib_cli_output(vm,
" seq %u seq-hi %u esn %u anti-replay %u",
635 sa->seq, sa->seq_hi, sa->use_esn, sa->use_anti_replay);
636 vlib_cli_output(vm,
" local-spi %u local-ip %U", sa->spi,
637 format_ip4_address, &sa->tunnel_src_addr.ip4);
638 vlib_cli_output(vm,
" local-crypto %U %U",
639 format_ipsec_crypto_alg, sa->crypto_alg,
640 format_hex_bytes, sa->crypto_key, sa->crypto_key_len);
641 vlib_cli_output(vm,
" local-integrity %U %U",
642 format_ipsec_integ_alg, sa->integ_alg,
643 format_hex_bytes, sa->integ_key, sa->integ_key_len);
644 sa = pool_elt_at_index(im->sad, t->input_sa_index);
645 vlib_cli_output(vm,
" last-seq %u last-seq-hi %u esn %u anti-replay %u window %U",
646 sa->last_seq, sa->last_seq_hi, sa->use_esn,
648 format_ipsec_replay_window, sa->replay_window);
649 vlib_cli_output(vm,
" remote-spi %u remote-ip %U", sa->spi,
650 format_ip4_address, &sa->tunnel_src_addr.ip4);
651 vlib_cli_output(vm,
" remote-crypto %U %U",
652 format_ipsec_crypto_alg, sa->crypto_alg,
653 format_hex_bytes, sa->crypto_key, sa->crypto_key_len);
654 vlib_cli_output(vm,
" remote-integrity %U %U",
655 format_ipsec_integ_alg, sa->integ_alg,
656 format_hex_bytes, sa->integ_key, sa->integ_key_len);
664 .path =
"show ipsec",
665 .short_help =
"show ipsec",
681 pool_foreach(p, spd->policies, ({
682 p->counter.packets = p->counter.bytes = 0;
692 .path =
"clear ipsec counters",
693 .short_help =
"clear ipsec counters",
709 memset (&a, 0,
sizeof (a));
729 else if (
unformat (line_input,
"del"))
751 case VNET_API_ERROR_INVALID_VALUE:
754 "IPSec tunnel interface already exists...");
772 .path =
"create ipsec tunnel",
773 .short_help =
"create ipsec tunnel local-ip <addr> local-spi <spi> remote-ip <addr> remote-spi <spi>",
786 u32 hw_if_index = (
u32) ~ 0;
831 if (alg > 0 &&
vec_len (key) == 0)
837 if (hw_if_index == (
u32) ~ 0)
854 .path =
"set interface ipsec key",
856 "set interface ipsec key <int> <local|remote> <crypto|integ> <key type> <key>",
unformat_function_t unformat_vnet_hw_interface
int ipsec_set_interface_key(vnet_main_t *vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, u8 alg, u8 *key)
sll srl srl sll sra u16x4 i
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
ip46_address_t tunnel_src_addr
static clib_error_t * set_ipsec_sa_key_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
ipsec_integ_alg_t integ_alg
static clib_error_t * create_ipsec_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * set_interface_key_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
unformat_function_t unformat_vnet_sw_interface
static vlib_cli_command_t set_interface_key_command
(constructor) VLIB_CLI_COMMAND (set_interface_key_command)
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
static vlib_cli_command_t show_ipsec_command
(constructor) VLIB_CLI_COMMAND (show_ipsec_command)
#define VLIB_INIT_FUNCTION(x)
uword unformat_ipsec_integ_alg(unformat_input_t *input, va_list *args)
#define clib_error_return(e, args...)
ipsec_main_callbacks_t cb
u8 * format_ipsec_crypto_alg(u8 *s, va_list *args)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
static vlib_cli_command_t create_ipsec_tunnel_command
(constructor) VLIB_CLI_COMMAND (create_ipsec_tunnel_command)
static clib_error_t * ipsec_policy_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_error_t *(* check_support_cb)(ipsec_sa_t *sa)
static clib_error_t * set_interface_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
uword unformat_ipsec_crypto_alg(unformat_input_t *input, va_list *args)
ip46_address_range_t laddr
ip46_address_t tunnel_dst_addr
static clib_error_t * clear_ipsec_counters_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
#define vec_free(V)
Free vector's memory (no header).
uword * sa_index_by_sa_id
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
#define VLIB_CLI_COMMAND(x,...)
ip46_address_range_t raddr
ipsec_protocol_t protocol
uword unformat_ipsec_policy_action(unformat_input_t *input, va_list *args)
u8 * format_ipsec_integ_alg(u8 *s, va_list *args)
u8 * format_ipsec_policy_action(u8 *s, va_list *args)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
static clib_error_t * ipsec_sa_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
ipsec_crypto_alg_t crypto_alg
static clib_error_t * show_ipsec_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define vec_foreach(var, vec)
Vector iterator.
int ipsec_add_del_tunnel_if(ipsec_add_del_tunnel_args_t *args)
static clib_error_t * ipsec_spd_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
static vlib_cli_command_t clear_ipsec_counters_command
(constructor) VLIB_CLI_COMMAND (clear_ipsec_counters_command)