34 if (id->
type == IKEV2_ID_TYPE_ID_FQDN ||
35 id->
type == IKEV2_ID_TYPE_ID_RFC822_ADDR)
66 vlib_cli_output(vm,
" iip %U ispi %lx rip %U rspi %lx",
67 format_ip4_address, &sa->iaddr, sa->ispi,
68 format_ip4_address, &sa->raddr, sa->rspi);
70 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
71 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
73 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
74 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
76 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
77 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
79 tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_DH);
80 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
82 vlib_cli_output(vm,
" %v", s);
85 vlib_cli_output(vm,
" nonce i:%U\n r:%U",
86 format_hex_bytes, sa->i_nonce, vec_len(sa->i_nonce),
87 format_hex_bytes, sa->r_nonce, vec_len(sa->r_nonce));
89 vlib_cli_output(vm,
" SK_d %U",
90 format_hex_bytes, sa->sk_d, vec_len(sa->sk_d));
93 vlib_cli_output(vm,
" SK_a i:%U\n r:%U",
94 format_hex_bytes, sa->sk_ai, vec_len(sa->sk_ai),
95 format_hex_bytes, sa->sk_ar, vec_len(sa->sk_ar));
111 vlib_cli_output(vm,
" child sa %u:", child - sa->childs);
113 tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
114 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
116 tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
117 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
119 tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ESN);
120 s = format(s,
"%U ", format_ikev2_sa_transform, tr);
122 vlib_cli_output(vm,
" %v", s);
125 vlib_cli_output(vm,
" spi(i) %lx spi(r) %lx",
126 child->i_proposals ? child->i_proposals[0].spi : 0,
127 child->r_proposals ? child->r_proposals[0].spi : 0);
129 vlib_cli_output(vm,
" SK_e i:%U\n r:%U",
130 format_hex_bytes, child->sk_ei, vec_len(child->sk_ei),
131 format_hex_bytes, child->sk_er, vec_len(child->sk_er));
134 vlib_cli_output(vm,
" SK_a i:%U\n r:%U",
135 format_hex_bytes, child->sk_ai, vec_len(child->sk_ai),
136 format_hex_bytes, child->sk_ar, vec_len(child->sk_ar));
137 vlib_cli_output(vm,
" traffic selectors (i):");
141 vlib_cli_output(vm,
" %u type %u protocol_id %u addr " 142 "%U - %U port %u - %u",
144 ts->ts_type, ts->protocol_id,
145 format_ip4_address, &ts->start_addr,
146 format_ip4_address, &ts->end_addr,
147 clib_net_to_host_u16( ts->start_port),
148 clib_net_to_host_u16( ts->end_port));
154 "%U - %U port %u - %u",
160 clib_net_to_host_u16( ts->
end_port));
172 .path =
"show ikev2 sa",
173 .short_help =
"show ikev2 sa",
189 u32 tmp1, tmp2, tmp3;
193 u32 responder_sw_if_index = (
u32) ~ 0;
194 u32 tun_sw_if_index = (
u32) ~ 0;
200 const char *valid_chars =
"a-zA-Z0-9_";
219 else if (
unformat (line_input,
"set %U auth shared-key-mic string %v",
224 IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
228 else if (
unformat (line_input,
"set %U auth shared-key-mic hex %U",
234 IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data,
238 else if (
unformat (line_input,
"set %U auth rsa-sig cert-file %v",
246 else if (
unformat (line_input,
"set %U id local %U %U",
257 else if (
unformat (line_input,
"set %U id local %U 0x%U",
266 else if (
unformat (line_input,
"set %U id local %U %v",
274 else if (
unformat (line_input,
"set %U id remote %U %U",
285 else if (
unformat (line_input,
"set %U id remote %U 0x%U",
294 else if (
unformat (line_input,
"set %U id remote %U %v",
302 else if (
unformat (line_input,
"set %U traffic-selector local " 303 "ip-range %U - %U port-range %u - %u protocol %u",
307 &tmp1, &tmp2, &tmp3))
314 else if (
unformat (line_input,
"set %U traffic-selector remote " 315 "ip-range %U - %U port-range %u - %u protocol %u",
319 &tmp1, &tmp2, &tmp3))
326 else if (
unformat (line_input,
"set %U responder %U %U",
337 else if (
unformat (line_input,
"set %U tunnel %U",
347 "set %U ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
361 "set %U ike-crypto-alg %U %u ike-dh %U",
368 IKEV2_TRANSFORM_INTEG_TYPE_NONE,
375 "set %U esp-crypto-alg %U %u esp-integ-alg %U",
387 "set %U esp-crypto-alg %U %u",
395 else if (
unformat (line_input,
"set %U sa-lifetime %lu %u %u %lu",
397 &tmp4, &tmp1, &tmp2, &tmp5))
403 else if (
unformat (line_input,
"set %U udp-encap",
409 else if (
unformat (line_input,
"set %U ipsec-over-udp port %u",
433 .path =
"ikev2 profile",
435 "ikev2 profile [add|del] <id>\n" 436 "ikev2 profile set <id> auth [rsa-sig|shared-key-mic] [cert-file|string|hex]" 438 "ikev2 profile set <id> id <local|remote> <type> <data>\n" 439 "ikev2 profile set <id> tunnel <interface>\n" 440 "ikev2 profile set <id> udp-encap\n" 441 "ikev2 profile set <id> traffic-selector <local|remote> ip-range " 442 "<start-addr> - <end-addr> port-range <start-port> - <end-port> " 443 "protocol <protocol-number>\n" 444 "ikev2 profile set <id> responder <interface> <addr>\n" 445 "ikev2 profile set <id> ike-crypto-alg <crypto alg> <key size> ike-integ-alg <integ alg> ike-dh <dh type>\n" 446 "ikev2 profile set <id> esp-crypto-alg <crypto alg> <key size> " 447 "[esp-integ-alg <integ alg>]\n" 448 "ikev2 profile set <id> sa-lifetime <seconds> <jitter> <handover> <max bytes>",
463 vlib_cli_output(vm,
"profile %v", p->name);
468 vlib_cli_output(vm,
" auth-method %U auth data 0x%U",
469 format_ikev2_auth_method, p->auth.method,
470 format_hex_bytes, p->auth.data, vec_len(p->auth.data));
472 vlib_cli_output(vm,
" auth-method %U auth data %v",
473 format_ikev2_auth_method, p->auth.method, p->auth.data);
478 if (p->loc_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
479 vlib_cli_output(vm,
" local id-type %U data %U",
480 format_ikev2_id_type, p->loc_id.type,
481 format_ip4_address, p->loc_id.data);
482 else if (p->loc_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
483 vlib_cli_output(vm,
" local id-type %U data 0x%U",
484 format_ikev2_id_type, p->loc_id.type,
485 format_hex_bytes, p->loc_id.data,
486 vec_len(p->loc_id.data));
488 vlib_cli_output(vm,
" local id-type %U data %v",
489 format_ikev2_id_type, p->loc_id.type, p->loc_id.data);
494 if (p->rem_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR)
495 vlib_cli_output(vm,
" remote id-type %U data %U",
496 format_ikev2_id_type, p->rem_id.type,
497 format_ip4_address, p->rem_id.data);
498 else if (p->rem_id.type == IKEV2_ID_TYPE_ID_KEY_ID)
499 vlib_cli_output(vm,
" remote id-type %U data 0x%U",
500 format_ikev2_id_type, p->rem_id.type,
501 format_hex_bytes, p->rem_id.data,
502 vec_len(p->rem_id.data));
504 vlib_cli_output(vm,
" remote id-type %U data %v",
505 format_ikev2_id_type, p->rem_id.type, p->rem_id.data);
509 vlib_cli_output(vm,
" local traffic-selector addr %U - %U port %u - %u" 517 vlib_cli_output(vm,
" remote traffic-selector addr %U - %U port %u - %u" 537 vlib_cli_output(vm,
" ike-crypto-alg %U %u ike-integ-alg %U ike-dh %U",
557 .path =
"show ikev2 profile",
558 .short_help =
"show ikev2 profile",
570 u32 period = 0, max_retries = 0;
577 if (
unformat (line_input,
"%d %d", &period, &max_retries))
596 .path =
"ikev2 set liveness",
597 .short_help =
"ikev2 set liveness <period> <max-retires>",
616 if (
unformat (line_input,
"%s", &data))
636 .path =
"set ikev2 local key",
638 "set ikev2 local key <file>",
654 const char *valid_chars =
"a-zA-Z0-9_";
667 else if (
unformat (line_input,
"del-child-sa %x", &tmp1))
672 else if (
unformat (line_input,
"del-sa %lx", &tmp2))
677 else if (
unformat (line_input,
"rekey-child-sa %x", &tmp1))
697 .path =
"ikev2 initiate",
699 "ikev2 initiate sa-init <profile id>\n" 700 "ikev2 initiate del-child-sa <child sa ispi>\n" 701 "ikev2 initiate del-sa <sa ispi>\n" 702 "ikev2 initiate rekey-child-sa <profile id> <child sa ispi>\n",
725 if (!
unformat (line_input,
"%d", &log_level))
742 .path =
"ikev2 set logging level",
744 .short_help =
"ikev2 set logging level <0-5>",
ikev2_main_per_thread_data_t * per_thread_data
u8 * format_ikev2_id_type_and_data(u8 *s, va_list *args)
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip4_address_t ip4)
ikev2_transforms_set ike_ts
ikev2_transform_integ_type_t
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
vnet_main_t * vnet_get_main(void)
clib_error_t * ikev2_set_profile_udp_encap(vlib_main_t *vm, u8 *name)
uword unformat_ikev2_transform_encr_type(unformat_input_t *input, va_list *args)
ikev2_profile_t * profiles
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
uword unformat_ikev2_id_type(unformat_input_t *input, va_list *args)
clib_error_t * ikev2_set_profile_tunnel_interface(vlib_main_t *vm, u8 *name, u32 sw_if_index)
static clib_error_t * set_ikev2_liveness_period_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
unformat_function_t unformat_vnet_sw_interface
clib_error_t * ikev2_set_liveness_params(u32 period, u32 max_retries)
format_function_t format_vnet_sw_if_index_name
vnet_api_error_t ikev2_set_profile_ipsec_udp_port(vlib_main_t *vm, u8 *name, u16 port, u8 is_set)
#define clib_memcpy(d, s, n)
ikev2_transform_dh_type_t
static clib_error_t * show_ikev2_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
uword unformat_ikev2_transform_dh_type(unformat_input_t *input, va_list *args)
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
#define clib_error_return(e, args...)
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, u32 crypto_key_size)
ikev2_responder_t responder
int ikev2_set_log_level(ikev2_log_level_t log_level)
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
static u8 * format_vnet_api_errno(u8 *s, va_list *args)
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip4_address_t start_addr, ip4_address_t end_addr, int is_local)
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
ikev2_transform_encr_type_t
#define vec_free(V)
Free vector's memory (no header).
u8 * format_ikev2_transform_encr_type(u8 *s, va_list *args)
#define VLIB_CLI_COMMAND(x,...)
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
uword unformat_ikev2_transform_integ_type(unformat_input_t *input, va_list *args)
u8 * format_ikev2_transform_dh_type(u8 *s, va_list *args)
static clib_error_t * show_ikev2_profile_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u8 * format_ikev2_transform_integ_type(u8 *s, va_list *args)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
ikev2_child_sa_t * childs
static clib_error_t * set_ikev2_local_key_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
vl_api_ip4_address_t end_addr
#define vec_foreach(var, vec)
Vector iterator.
void ikev2_cli_reference(void)
static clib_error_t * ikev2_set_log_level_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * ikev2_profile_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
ikev2_transforms_set esp_ts
#define IPSEC_UDP_PORT_NONE
static clib_error_t * ikev2_initiate_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u8 * format_ikev2_id_type(u8 *s, va_list *args)