36 #define _(v,f,str) case IPSEC_POLICY_ACTION_##f: t = str; break; 54 #define _(f,str) case IPSEC_SPD_POLICY_##f: t = str; break; 67 u32 *r = va_arg (*args,
u32 *);
70 #define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_POLICY_ACTION_##f; 86 #define _(v,f,str) case IPSEC_CRYPTO_ALG_##f: t = (u8 *) str; break; 99 ipsec_crypto_alg_t *r = va_arg (*args, ipsec_crypto_alg_t *);
102 #define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_CRYPTO_ALG_##f; 118 #define _(v,f,str) case IPSEC_INTEG_ALG_##f: t = (u8 *) str; break; 122 s =
format (s,
"unknown");
131 ipsec_integ_alg_t *r = va_arg (*args, ipsec_integ_alg_t *);
134 #define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_INTEG_ALG_##f; 145 u64 w = va_arg (*args,
u64);
148 for (i = 0; i < 64; i++)
150 s =
format (s,
"%u", w & (1ULL << i) ? 1 : 0);
159 u32 pi = va_arg (*args,
u32);
167 s =
format (s,
" [%d] priority %d action %U type %U protocol ",
179 if (p->
policy == IPSEC_POLICY_ACTION_PROTECT)
188 s =
format (s,
"\n local addr range %U - %U port range %u - %u",
192 s =
format (s,
"\n remote addr range %U - %U port range %u - %u",
213 s =
format (s,
"No such SPD index: %d", si);
222 s = format (s, "\n %s:", n); \ 223 vec_foreach(i, spd->policies[IPSEC_SPD_POLICY_##v]) \ 225 s = format (s, "\n %U", format_ipsec_policy, *i); \ 263 #define _(v, f, str) if (flags & IPSEC_SA_FLAG_##f) s = format(s, "%s ", str); 272 u32 sai = va_arg (*args,
u32);
281 s =
format (s,
"No such SA index: %d", sai);
287 s =
format (s,
"[%d] sa %u (0x%x) spi %u (0x%08x) protocol:%s flags:[%U]",
295 s =
format (s,
"\n salt 0x%x", clib_net_to_host_u32 (sa->
salt));
296 s =
format (s,
"\n thread-indices [encrypt:%d decrypt:%d]",
299 s =
format (s,
"\n last-seq %u last-seq-hi %u window %U",
302 s =
format (s,
"\n crypto alg %U",
307 s =
format (s,
" key [redacted]");
308 s =
format (s,
"\n integrity alg %U",
310 if (sa->
integ_alg && (flags & IPSEC_FORMAT_INSECURE))
313 s =
format (s,
" key [redacted]");
314 s =
format (s,
"\n UDP:[src:%d dst:%d]",
321 if (ipsec_sa_is_set_IS_TUNNEL (sa))
325 s =
format (s,
"\n table-ID %d tunnel %U src %U dst %U flags %U",
331 if (!ipsec_sa_is_set_IS_INBOUND (sa))
334 format (s,
"\n resovle via fib-entry: %d",
336 s =
format (s,
"\n stacked on:");
352 return (
format (s,
"No such tunnel index: %d", itpi));
367 else if (flags & IPSEC_PROTECT_##a) \ 368 s = format (s, "%s", c); \ 369 foreach_ipsec_protect_flags 386 s =
format (s,
"\n output-sa:");
390 s =
format (s,
"\n input-sa:");
410 s =
format (s,
"remote:%U spi:%u (0x%08x) sa:%d tun:%d",
412 clib_net_to_host_u32 (spi),
413 clib_net_to_host_u32 (spi),
424 s =
format (s,
"remote:%U spi:%u (0x%08x) sa:%d tun:%d",
426 clib_net_to_host_u32 (kv->
key.
spi),
427 clib_net_to_host_u32 (kv->
key.
spi),
440 s =
format (s,
"[%d] %U %U",
ipsec_itf_t * ipsec_itf_get(index_t ii)
ip46_address_t tunnel_src_addr
vl_api_wireguard_peer_flags_t flags
vnet_main_t * vnet_get_main(void)
ip46_address_range_t laddr
struct ipsec6_tunnel_kv_t_::@463 key
#define foreach_ipsec_crypto_alg
enum ipsec_format_flags_t_ ipsec_format_flags_t
ipsec_integ_alg_t integ_alg
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Combined counter to hold both packets and byte differences.
#define foreach_ipsec_integ_alg
A Secruity Policy Database.
void ipsec_mk_key(ipsec_key_t *key, const u8 *data, u8 len)
format_function_t format_vnet_sw_if_index_name
description fragment has unexpected format
tunnel_encap_decap_flags_t tunnel_flags
u8 * format_ip_dscp(u8 *s, va_list *va)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
counter_t packets
packet counter
ipsec_tun_protect_t * ipsec_tun_protect_pool
Pool of tunnel protection objects.
fib_node_index_t fib_entry_index
ipsec_tun_lkup_result_t value
bool ip_address_is_zero(const ip_address_t *ip)
ipsec_spd_policy_type_t type
ip46_address_t tunnel_dst_addr
format_function_t format_ip46_address
A dedicated IPSec interface type.
ipsec_tun_lkup_result_t value
static void vlib_get_combined_counter(const vlib_combined_counter_main_t *cm, u32 index, vlib_counter_t *result)
Get the value of a combined counter, never called in the speed path Scrapes the entire set of per-thr...
sll srl srl sll sra u16x4 i
#define vec_free(V)
Free vector's memory (no header).
ipsec_policy_action_t policy
u8 * format_ip_address(u8 *s, va_list *args)
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body)
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
u8 data[IPSEC_KEY_MAX_LEN]
ipsec_policy_t * policies
u32 fib_table_get_table_id(u32 fib_index, fib_protocol_t proto)
Get the Table-ID of the FIB from protocol and index.
ipsec_protocol_t protocol
u8 * format_dpo_id(u8 *s, va_list *args)
Format a DPO_id_t oject.
counter_t bytes
byte counter
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
ip46_address_range_t raddr
u32 fn_locks
Number of dependents on this node.
ipsec_protect_flags_t itp_flags
u32 id
the User's ID for this policy
ipsec_crypto_alg_t crypto_alg
#define foreach_ipsec_spd_policy_type
u8 * format_tunnel_mode(u8 *s, va_list *args)
u8 * format_tunnel_encap_decap_flags(u8 *s, va_list *args)
static void ipsec4_tunnel_extract_key(const ipsec4_tunnel_kv_t *k, ip4_address_t *ip, u32 *spi)
enum ipsec_protect_flags_t_ ipsec_protect_flags_t