46 &sw_if_index, &spd_id))
48 else if (
unformat (line_input,
"del"))
60 case VNET_API_ERROR_SYSCALL_ERROR_1:
63 case VNET_API_ERROR_SYSCALL_ERROR_2:
76 .path =
"set interface ipsec spd",
78 "set interface ipsec spd <int> <id>",
89 ipsec_crypto_alg_t crypto_alg;
91 ipsec_protocol_t
proto;
106 flags = IPSEC_SA_FLAG_NONE;
108 integ_alg = IPSEC_INTEG_ALG_NONE;
109 crypto_alg = IPSEC_CRYPTO_ALG_NONE;
117 if (
unformat (line_input,
"add %u", &
id))
122 else if (
unformat (line_input,
"del %u", &
id))
127 else if (
unformat (line_input,
"spi %u", &spi))
129 else if (
unformat (line_input,
"salt 0x%x", &salt))
131 else if (
unformat (line_input,
"esp"))
133 else if (
unformat (line_input,
"ah"))
135 else if (
unformat (line_input,
"crypto-key %U",
138 else if (
unformat (line_input,
"crypto-alg %U",
143 else if (
unformat (line_input,
"integ-alg %U",
148 flags |= IPSEC_SA_FLAG_IS_TUNNEL;
150 flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
152 else if (
unformat (line_input,
"udp-src-port %d", &i))
154 else if (
unformat (line_input,
"udp-dst-port %d", &i))
156 else if (
unformat (line_input,
"inbound"))
157 flags |= IPSEC_SA_FLAG_IS_INBOUND;
158 else if (
unformat (line_input,
"use-anti-replay"))
159 flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
160 else if (
unformat (line_input,
"use-esn"))
161 flags |= IPSEC_SA_FLAG_USE_ESN;
162 else if (
unformat (line_input,
"udp-encap"))
163 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
164 else if (
unformat (line_input,
"async"))
165 flags |= IPSEC_SA_FLAG_IS_ASYNC;
188 &ik, flags, clib_host_to_net_u32 (salt),
189 udp_src, udp_dst, &tun, &sai);
209 "ipsec sa [add|del]",
231 else if (
unformat (line_input,
"del"))
233 else if (
unformat (line_input,
"%u", &spd_id))
261 "ipsec spd [add|del] <id>",
275 u32 tmp, tmp2, stat_index, local_range_set, remote_range_set;
281 remote_range_set = local_range_set = is_outbound = 0;
290 else if (
unformat (line_input,
"del"))
292 else if (
unformat (line_input,
"ip6"))
294 else if (
unformat (line_input,
"spd %u", &p.
id))
296 else if (
unformat (line_input,
"inbound"))
298 else if (
unformat (line_input,
"outbound"))
302 else if (
unformat (line_input,
"protocol %u", &tmp))
309 if (p.
policy == IPSEC_POLICY_ACTION_RESOLVE)
317 else if (
unformat (line_input,
"local-ip-range %U - %U",
321 else if (
unformat (line_input,
"remote-ip-range %U - %U",
324 remote_range_set = 1;
325 else if (
unformat (line_input,
"local-ip-range %U - %U",
332 else if (
unformat (line_input,
"remote-ip-range %U - %U",
337 remote_range_set = 1;
339 else if (
unformat (line_input,
"local-port-range %u - %u", &tmp, &tmp2))
345 if (
unformat (line_input,
"remote-port-range %u - %u", &tmp, &tmp2))
358 if (!remote_range_set)
365 if (!local_range_set)
378 " outboud:%s %s action:%U",
379 (is_outbound ?
"yes" :
"no"),
400 .path =
"ipsec policy",
402 "ipsec policy [add|del] spd <id> priority <n> ",
443 spd = pool_elt_at_index (im->spds, spd_id);
444 vlib_cli_output (vm,
" %d -> %U", spd->id,
445 format_vnet_sw_if_index_name, im->vnet_main,
484 .path =
"show ipsec all",
485 .short_help =
"show ipsec all",
553 .path =
"show ipsec sa",
554 .short_help =
"show ipsec sa [index]",
559 .path =
"clear ipsec sa",
560 .short_help =
"clear ipsec sa [index]",
570 u8 show_bindings = 0;
577 else if (
unformat (input,
"bindings"))
595 .path =
"show ipsec spd",
596 .short_help =
"show ipsec spd [index]",
613 .path =
"show ipsec tunnel",
614 .short_help =
"show ipsec tunnel",
627 (void)
unformat (input,
"verbose %u", &verbose);
630 u8 *s =
format (NULL,
"%=25s %=25s %=10s\n",
"Name",
"Index",
"Active");
652 s =
format (s,
"%=25s %=25s %=10s\n",
"Name",
"Index",
"Active");
680 .path =
"show ipsec backends",
681 .short_help =
"show ipsec backends",
707 if (
unformat (line_input,
"%u", &backend_index))
721 else if (
unformat (line_input,
"esp"))
723 if (
unformat (line_input,
"%u", &backend_index))
748 .path =
"ipsec select backend",
749 .short_help =
"ipsec select backend <ah|esp> <backend index>",
768 .path =
"clear ipsec counters",
769 .short_help =
"clear ipsec counters",
794 else if (
unformat (line_input,
"add"))
796 else if (
unformat (line_input,
"sa-in %d", &sa_in))
798 else if (
unformat (line_input,
"sa-out %d", &sa_out))
800 else if (
unformat (line_input,
"%U",
825 .path =
"ipsec tunnel protect",
827 .short_help =
"ipsec tunnel protect <interface> input-sa <SA> output-sa <SA> [add|del]",
848 .path =
"show ipsec protect",
850 .short_help =
"show ipsec protect",
862 return (BIHASH_WALK_CONTINUE);
873 return (BIHASH_WALK_CONTINUE);
886 clib_bihash_foreach_key_value_pair_8_16
891 clib_bihash_foreach_key_value_pair_24_16
904 .path =
"show ipsec protect-hash",
906 .short_help =
"show ipsec protect-hash",
923 int async_enable = 0;
932 else if (
unformat (line_input,
"off"))
947 .path =
"set ipsec async mode",
948 .short_help =
"set ipsec async mode on|off",
static clib_error_t * ipsec_select_backend_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static int ipsec_tun_protect6_hash_show_one(clib_bihash_kv_24_16_t *kv, void *arg)
u32 esp4_encrypt_next_index
#define pool_foreach_index(i, v)
vl_api_wireguard_peer_flags_t flags
#define pool_foreach(VAR, POOL)
Iterate through pool.
ip46_address_range_t laddr
static clib_error_t * show_ipsec_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
u32 esp4_decrypt_node_index
int ipsec_policy_mk_type(bool is_outbound, bool is_ipv6, ipsec_policy_action_t action, ipsec_spd_policy_type_t *type)
u32 ah6_decrypt_next_index
u32 esp6_decrypt_next_index
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
A representation of an IP tunnel config.
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
u32 ah4_encrypt_node_index
u32 esp6_encrypt_node_index
void ipsec_sa_clear(index_t sai)
ipsec_sa_t * ipsec_sa_pool
Pool of IPSec SAs.
uword unformat_tunnel(unformat_input_t *input, va_list *args)
unformat_function_t unformat_vnet_sw_interface
A Secruity Policy Database.
u32 ah6_decrypt_node_index
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
static void ipsec_tunnel_show_all(vlib_main_t *vm)
uword * spd_index_by_sw_if_index
enum walk_rc_t_ walk_rc_t
Walk return code.
u32 esp6_encrypt_next_index
clib_error_t * ipsec_rsc_in_use(ipsec_main_t *im)
u32 ah6_encrypt_node_index
void vlib_clear_combined_counters(vlib_combined_counter_main_t *cm)
Clear a collection of combined counters.
#define VLIB_INIT_FUNCTION(x)
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
u32 ah6_encrypt_next_index
description fragment has unexpected format
#define hash_foreach(key_var, value_var, h, body)
#define clib_error_return(e, args...)
int ipsec_sa_unlock_id(u32 id)
vnet_main_t * vnet_get_main(void)
clib_bihash_8_16_t tun4_protect_by_key
u32 esp6_decrypt_node_index
static clib_error_t * ipsec_tun_protect_show(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
vl_api_interface_index_t sw_if_index
static clib_error_t * ipsec_policy_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_bihash_24_16_t tun6_protect_by_key
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 salt, u16 src_port, u16 dst_port, const tunnel_t *tun, u32 *sa_out_index)
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add, u32 *stat_index)
Add/Delete a SPD.
u32 ah4_decrypt_next_index
static clib_error_t * set_interface_spd_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * set_async_mode_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * ipsec_show_backends_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
ipsec_spd_policy_type_t type
uword unformat_ip_address(unformat_input_t *input, va_list *args)
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
u32 esp4_encrypt_node_index
static void ipsec_spd_bindings_show_all(vlib_main_t *vm, ipsec_main_t *im)
static clib_error_t * clear_ipsec_counters_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u32 ah4_decrypt_node_index
static void ipsec_sa_show_all(vlib_main_t *vm, ipsec_main_t *im, u8 detail)
ipsec_ah_backend_t * ah_backends
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
sll srl srl sll sra u16x4 i
8 octet key, 8 octet key value pair
#define vec_free(V)
Free vector's memory (no header).
static clib_error_t * clear_ipsec_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
ipsec_policy_action_t policy
u32 ah4_encrypt_next_index
vnet_interface_main_t * im
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
#define VLIB_CLI_COMMAND(x,...)
static void ipsec_spd_show_all(vlib_main_t *vm, ipsec_main_t *im)
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
static clib_error_t * show_ipsec_sa_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * ipsec_tun_protect_cmd(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
ip46_address_range_t raddr
static clib_error_t * show_ipsec_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
static clib_error_t * ipsec_sa_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
u32 esp4_decrypt_next_index
vl_api_gbp_endpoint_tun_t tun
static int ipsec_tun_protect4_hash_show_one(clib_bihash_kv_8_16_t *kv, void *arg)
static clib_error_t * ipsec_tun_protect_hash_show(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
static clib_error_t * show_ipsec_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static vlib_node_t * vlib_get_node(vlib_main_t *vm, u32 i)
Get vlib node by index.
static walk_rc_t ipsec_tun_protect_show_one(index_t itpi, void *ctx)
void ipsec_set_async_mode(u32 is_enabled)
ipsec_esp_backend_t * esp_backends
static clib_error_t * ipsec_spd_add_del_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define IPSEC_UDP_PORT_NONE
ip_address_family_t tunnel_get_af(const tunnel_t *t)
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sas_in)