34 if (id->
type == IKEV2_ID_TYPE_ID_FQDN ||
35 id->
type == IKEV2_ID_TYPE_ID_RFC822_ADDR)
55 s =
format (s,
"%u type %u protocol_id %u addr " 56 "%U - %U port %u - %u\n",
61 clib_net_to_host_u16 (ts->
end_port));
77 s =
format (s,
"child sa %u:", index);
80 IKEV2_TRANSFORM_TYPE_ENCR);
84 IKEV2_TRANSFORM_TYPE_INTEG);
88 IKEV2_TRANSFORM_TYPE_ESN);
98 s =
format (s,
"%USK_e i:%U\n%Ur:%U\n",
105 s =
format (s,
"%USK_a i:%U\n%Ur:%U\n",
124 int details = va_arg (*va,
int);
129 s =
format (s,
"iip %U ispi %lx rip %U rspi %lx",
151 s =
format (s,
"nonce i:%U\n%Ur:%U\n",
160 s =
format (s,
"%USK_a i:%U\n%Ur:%U\n",
166 s =
format (s,
"%USK_e i:%U\n%Ur:%U\n",
171 s =
format (s,
"%USK_p i:%U\n%Ur:%U\n",
177 s =
format (s,
"%Uidentifier (i) %U\n",
180 s =
format (s,
"%Uidentifier (r) %U\n",
203 int details = 0, show_one = 0;
209 if (
unformat (line_input,
"rspi %lx", &rspi))
213 else if (
unformat (line_input,
"details"))
227 if (sa->rspi == rspi)
229 s = format (s,
"%U\n", format_ikev2_sa, sa, 1);
246 .path =
"show ikev2 sa",
247 .short_help =
"show ikev2 sa [rspi <rspi>] [details]",
263 .path =
"ikev2 dpd disable",
264 .short_help =
"ikev2 dpd disable",
272 u8 **string_return = va_arg (*va,
u8 **);
273 const char *token_chars =
"a-zA-Z0-9_";
297 u32 tmp1, tmp2, tmp3;
300 u32 responder_sw_if_index = (
u32) ~ 0;
301 u32 tun_sw_if_index = (
u32) ~ 0;
321 else if (
unformat (line_input,
"set %U auth shared-key-mic string %v",
326 IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
330 else if (
unformat (line_input,
"set %U auth shared-key-mic hex %U",
336 IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
340 else if (
unformat (line_input,
"set %U auth rsa-sig cert-file %v",
348 else if (
unformat (line_input,
"set %U id local %U %U",
359 else if (
unformat (line_input,
"set %U id local %U 0x%U",
368 else if (
unformat (line_input,
"set %U id local %U %v",
376 else if (
unformat (line_input,
"set %U id remote %U %U",
387 else if (
unformat (line_input,
"set %U id remote %U 0x%U",
396 else if (
unformat (line_input,
"set %U id remote %U %v",
404 else if (
unformat (line_input,
"set %U traffic-selector local " 405 "ip-range %U - %U port-range %u - %u protocol %u",
415 else if (
unformat (line_input,
"set %U traffic-selector remote " 416 "ip-range %U - %U port-range %u - %u protocol %u",
426 else if (
unformat (line_input,
"set %U responder %U %U",
435 else if (
unformat (line_input,
"set %U tunnel %U",
445 "set %U ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
459 "set %U ike-crypto-alg %U %u ike-dh %U",
466 IKEV2_TRANSFORM_INTEG_TYPE_NONE,
473 "set %U esp-crypto-alg %U %u esp-integ-alg %U",
485 "set %U esp-crypto-alg %U %u",
493 else if (
unformat (line_input,
"set %U sa-lifetime %lu %u %u %lu",
495 &tmp4, &tmp1, &tmp2, &tmp5))
501 else if (
unformat (line_input,
"set %U udp-encap",
507 else if (
unformat (line_input,
"set %U ipsec-over-udp port %u",
515 else if (
unformat (line_input,
"set %U disable natt",
537 .path =
"ikev2 profile",
539 "ikev2 profile [add|del] <id>\n" 540 "ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex]" 542 "ikev2 profile set <id> id <local|remote> <type> <data>\n" 543 "ikev2 profile set <id> tunnel <interface>\n" 544 "ikev2 profile set <id> udp-encap\n" 545 "ikev2 profile set <id> traffic-selector <local|remote> ip-range " 546 "<start-addr> - <end-addr> port-range <start-port> - <end-port> " 547 "protocol <protocol-number>\n" 548 "ikev2 profile set <id> responder <interface> <addr>\n" 549 "ikev2 profile set <id> ike-crypto-alg <crypto alg> <key size> ike-integ-alg <integ alg> ike-dh <dh type>\n" 550 "ikev2 profile set <id> esp-crypto-alg <crypto alg> <key size> " 551 "[esp-integ-alg <integ alg>]\n" 552 "ikev2 profile set <id> sa-lifetime <seconds> <jitter> <handover> <max bytes>" 553 "ikev2 profile set <id> disable natt\n",
568 vlib_cli_output(vm,
"profile %v", p->name);
573 vlib_cli_output(vm,
" auth-method %U auth data 0x%U",
574 format_ikev2_auth_method, p->auth.method,
575 format_hex_bytes, p->auth.data, vec_len(p->auth.data));
577 vlib_cli_output(vm,
" auth-method %U auth data %v",
578 format_ikev2_auth_method, p->auth.method, p->auth.data);
583 if (p->loc_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
584 vlib_cli_output(vm,
" local id-type %U data %U",
585 format_ikev2_id_type, p->loc_id.type,
586 format_ip_address, p->loc_id.data);
587 else if (p->loc_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
588 vlib_cli_output(vm,
" local id-type %U data 0x%U",
589 format_ikev2_id_type, p->loc_id.type,
590 format_hex_bytes, p->loc_id.data,
591 vec_len(p->loc_id.data));
593 vlib_cli_output(vm,
" local id-type %U data %v",
594 format_ikev2_id_type, p->loc_id.type, p->loc_id.data);
599 if (p->rem_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
600 vlib_cli_output(vm,
" remote id-type %U data %U",
601 format_ikev2_id_type, p->rem_id.type,
602 format_ip_address, p->rem_id.data);
603 else if (p->rem_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
604 vlib_cli_output(vm,
" remote id-type %U data 0x%U",
605 format_ikev2_id_type, p->rem_id.type,
606 format_hex_bytes, p->rem_id.data,
607 vec_len(p->rem_id.data));
609 vlib_cli_output(vm,
" remote id-type %U data %v",
610 format_ikev2_id_type, p->rem_id.type, p->rem_id.data);
614 vlib_cli_output(vm,
" local traffic-selector addr %U - %U port %u - %u" 622 vlib_cli_output(vm,
" remote traffic-selector addr %U - %U port %u - %u" 645 vlib_cli_output(vm,
" ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
665 .path =
"show ikev2 profile",
666 .short_help =
"show ikev2 profile",
678 u32 period = 0, max_retries = 0;
685 if (
unformat (line_input,
"%d %d", &period, &max_retries))
704 .path =
"ikev2 set liveness",
705 .short_help =
"ikev2 set liveness <period> <max-retires>",
724 if (
unformat (line_input,
"%s", &data))
744 .path =
"set ikev2 local key",
746 "set ikev2 local key <file>",
772 else if (
unformat (line_input,
"del-child-sa %x", &tmp1))
777 else if (
unformat (line_input,
"del-sa %lx", &tmp2))
782 else if (
unformat (line_input,
"rekey-child-sa %x", &tmp1))
802 .path =
"ikev2 initiate",
804 "ikev2 initiate sa-init <profile id>\n" 805 "ikev2 initiate del-child-sa <child sa ispi>\n" 806 "ikev2 initiate del-sa <sa ispi>\n" 807 "ikev2 initiate rekey-child-sa <child sa ispi>\n",
830 if (!
unformat (line_input,
"%d", &log_level))
847 .path =
"ikev2 set logging level",
849 .short_help =
"ikev2 set logging level <0-5>",
ikev2_main_per_thread_data_t * per_thread_data
clib_error_t * ikev2_profile_natt_disable(u8 *name)
vl_api_address_t end_addr
u8 * format_ikev2_id_type_and_data(u8 *s, va_list *args)
ikev2_transforms_set ike_ts
ikev2_transform_integ_type_t
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
vnet_main_t * vnet_get_main(void)
ikev2_traffic_selector_type_t ts_type
clib_error_t * ikev2_set_profile_udp_encap(vlib_main_t *vm, u8 *name)
uword unformat_ikev2_transform_encr_type(unformat_input_t *input, va_list *args)
ikev2_profile_t * profiles
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
u8 * format_ikev2_sa_transform(u8 *s, va_list *args)
uword unformat_ikev2_id_type(unformat_input_t *input, va_list *args)
u16 ip_address_size(const ip_address_t *a)
clib_error_t * ikev2_set_profile_tunnel_interface(vlib_main_t *vm, u8 *name, u32 sw_if_index)
static clib_error_t * set_ikev2_liveness_period_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
unformat_function_t unformat_vnet_sw_interface
clib_error_t * ikev2_set_liveness_params(u32 period, u32 max_retries)
format_function_t format_vnet_sw_if_index_name
vnet_api_error_t ikev2_set_profile_ipsec_udp_port(vlib_main_t *vm, u8 *name, u16 port, u8 is_set)
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
#define clib_memcpy(d, s, n)
ikev2_transform_dh_type_t
static clib_error_t * show_ikev2_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
ikev2_sa_proposal_t * r_proposals
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
uword unformat_ikev2_transform_dh_type(unformat_input_t *input, va_list *args)
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
static u8 * format_ikev2_child_sa(u8 *s, va_list *va)
static u8 * format_ikev2_traffic_selector(u8 *s, va_list *va)
#define clib_error_return(e, args...)
static clib_error_t * ikev2_disable_dpd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, u32 crypto_key_size)
ikev2_responder_t responder
int ikev2_set_log_level(ikev2_log_level_t log_level)
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
ikev2_sa_proposal_t * i_proposals
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
bool ip_address_is_zero(const ip_address_t *ip)
uword unformat_ip_address(unformat_input_t *input, va_list *args)
static u8 * format_vnet_api_errno(u8 *s, va_list *args)
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
ikev2_transform_encr_type_t
#define vec_free(V)
Free vector's memory (no header).
u8 * format_ip_address(u8 *s, va_list *args)
static uword unformat_ikev2_token(unformat_input_t *input, va_list *va)
u8 * format_ikev2_transform_encr_type(u8 *s, va_list *args)
ikev2_sa_proposal_t * r_proposals
#define VLIB_CLI_COMMAND(x,...)
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
uword unformat_ikev2_transform_integ_type(unformat_input_t *input, va_list *args)
u8 * format_ikev2_transform_dh_type(u8 *s, va_list *args)
static u8 * format_ikev2_sa(u8 *s, va_list *va)
static clib_error_t * show_ikev2_profile_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u8 * format_ikev2_transform_integ_type(u8 *s, va_list *args)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip_address_t addr)
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
ikev2_child_sa_t * childs
static clib_error_t * set_ikev2_local_key_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define vec_foreach(var, vec)
Vector iterator.
void ikev2_cli_reference(void)
static clib_error_t * ikev2_set_log_level_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * ikev2_profile_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
ikev2_transforms_set esp_ts
u8 * ip_addr_bytes(ip_address_t *ip)
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip_address_t start_addr, ip_address_t end_addr, int is_local)
#define IPSEC_UDP_PORT_NONE
static clib_error_t * ikev2_initiate_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u8 * format_ikev2_id_type(u8 *s, va_list *args)
void ikev2_disable_dpd(void)