/* * decap.c : IPSec tunnel support * * Copyright (c) 2015 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include #include #include #include #include static clib_error_t * set_interface_spd_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; ipsec_main_t *im = &ipsec_main; u32 sw_if_index = (u32) ~ 0; u32 spd_id; int is_add = 1; clib_error_t *error = NULL; if (!unformat_user (input, unformat_line_input, line_input)) return 0; if (unformat (line_input, "%U %u", unformat_vnet_sw_interface, im->vnet_main, &sw_if_index, &spd_id)) ; else if (unformat (line_input, "del")) is_add = 0; else { error = clib_error_return (0, "parse error: '%U'", format_unformat_error, line_input); goto done; } ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add); done: unformat_free (line_input); return error; } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (set_interface_spd_command, static) = { .path = "set interface ipsec spd", .short_help = "set interface ipsec spd ", .function = set_interface_spd_command_fn, }; /* *INDENT-ON* */ static clib_error_t * ipsec_sa_add_del_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; ip46_address_t tun_src = { }, tun_dst = { }; ipsec_crypto_alg_t crypto_alg; ipsec_integ_alg_t integ_alg; ipsec_protocol_t proto; ipsec_sa_flags_t flags; clib_error_t *error; ipsec_key_t ck = { 0 }; ipsec_key_t ik = { 0 }; u32 id, spi, salt; int is_add, rv; error = NULL; is_add = 0; flags = IPSEC_SA_FLAG_NONE; proto = IPSEC_PROTOCOL_ESP; integ_alg = IPSEC_INTEG_ALG_NONE; crypto_alg = IPSEC_CRYPTO_ALG_NONE; if (!unformat_user (input, unformat_line_input, line_input)) return 0; while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) { if (unformat (line_input, "add %u", &id)) is_add = 1; else if (unformat (line_input, "del %u", &id)) is_add = 0; else if (unformat (line_input, "spi %u", &spi)) ; else if (unformat (line_input, "salt 0x%x", &salt)) ; else if (unformat (line_input, "esp")) proto = IPSEC_PROTOCOL_ESP; else if (unformat (line_input, "ah")) proto = IPSEC_PROTOCOL_AH; else if (unformat (line_input, "crypto-key %U", unformat_ipsec_key, &ck)) ; else if (unformat (line_input, "crypto-alg %U", unformat_ipsec_crypto_alg, &crypto_alg)) ; else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik)) ; else if (unformat (line_input, "integ-alg %U", unformat_ipsec_integ_alg, &integ_alg)) ; else if (unformat (line_input, "tunnel-src %U", unformat_ip46_address, &tun_src, IP46_TYPE_ANY)) { flags |= IPSEC_SA_FLAG_IS_TUNNEL; if (!ip46_address_is_ip4 (&tun_src)) flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6; } else if (unformat (line_input, "tunnel-dst %U", unformat_ip46_address, &tun_dst, IP46_TYPE_ANY)) ; else if (unformat (line_input, "udp-encap")) flags |= IPSEC_SA_FLAG_UDP_ENCAP; else { error = clib_error_return (0, "parse error: '%U'", format_unformat_error, line_input); goto done; } } if (is_add) rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg, &ck, integ_alg, &ik, flags, 0, clib_host_to_net_u32 (salt), &tun_src, &tun_dst, NULL); else rv = ipsec_sa_unlock_id (id); if (rv) error = clib_error_return (0, "failed"); done: unformat_free (line_input); return err

librte_pmd_fm10k.so.17.11 librte-pmd-fm10k17.11 #MINVER#
 DPDK_2.0@DPDK_2.0 16.04
# INFO: this library exports no symbols, essentially it is a driver that
# registers itself on load and is then only driven by callbacks.

"yes" : "no"); if (verbose) { vlib_node_t *n; n = vlib_get_node (vm, ab->ah4_encrypt_node_index); s = format (s, " enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index); n = vlib_get_node (vm, ab->ah4_decrypt_node_index); s = format (s, " dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index); n = vlib_get_node (vm, ab->ah6_encrypt_node_index); s = format (s, " enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index); n = vlib_get_node (vm, ab->ah6_decrypt_node_index); s = format (s, " dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index); } }); /* *INDENT-ON* */ vlib_cli_output (vm, "%v", s); _vec_len (s) = 0; vlib_cli_output (vm, "IPsec ESP backends available:"); s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active"); ipsec_esp_backend_t *eb; /* *INDENT-OFF* */ pool_foreach (eb, im->esp_backends, { s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends, eb - im->esp_backends == im->esp_current_backend ? "yes" : "no"); if (verbose) { vlib_node_t *n; n = vlib_get_node (vm, eb->esp4_encrypt_node_index); s = format (s, " enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index); n = vlib_get_node (vm, eb->esp4_decrypt_node_index); s = format (s, " dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index); n = vlib_get_node (vm, eb->esp6_encrypt_node_index); s = format (s, " enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index); n = vlib_get_node (vm, eb->esp6_decrypt_node_index); s = format (s, " dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index); } }); /* *INDENT-ON* */ vlib_cli_output (vm, "%v", s); vec_free (s); return 0; } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = { .path = "show ipsec backends", .short_help = "show ipsec backends", .function = ipsec_show_backends_command_fn, }; /* *INDENT-ON* */ static clib_error_t * ipsec_select_backend_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; ipsec_main_t *im = &ipsec_main; clib_error_t *error; u32 backend_index; error = ipsec_rsc_in_use (im); if (error) return error; /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; if (unformat (line_input, "ah")) { if (unformat (line_input, "%u", &backend_index)) { if (ipsec_select_ah_backend (im, backend_index) < 0) { return clib_error_return (0, "Invalid AH backend index `%u'", backend_index); } } else { return clib_error_return (0, "Invalid backend index `%U'", format_unformat_error, line_input); } } else if (unformat (line_input, "esp")) { if (unformat (line_input, "%u", &backend_index)) { if (ipsec_select_esp_backend (im, backend_index) < 0) { return clib_error_return (0, "Invalid ESP backend index `%u'", backend_index); } } else { return clib_error_return (0, "Invalid backend index `%U'", format_unformat_error, line_input); } } else { return clib_error_return (0, "Unknown input `%U'", format_unformat_error, line_input); } return 0; } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = { .path = "ipsec select backend", .short_help = "ipsec select backend ", .function = ipsec_select_backend_command_fn, }; /* *INDENT-ON* */ static clib_error_t * clear_ipsec_counters_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { vlib_clear_combined_counters (&ipsec_spd_policy_counters); vlib_clear_combined_counters (&ipsec_sa_counters); return (NULL); } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = { .path = "clear ipsec counters", .short_help = "clear ipsec counters", .function = clear_ipsec_counters_command_fn, }; /* *INDENT-ON* */ static clib_error_t * create_ipsec_tunnel_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; ipsec_add_del_tunnel_args_t a; int rv; u32 num_m_args = 0; u8 ipv4_set = 0; u8 ipv6_set = 0; clib_error_t *error = NULL; ipsec_key_t rck = { 0 }; ipsec_key_t lck = { 0 }; ipsec_key_t lik = { 0 }; ipsec_key_t rik = { 0 }; clib_memset (&a, 0, sizeof (a)); a.is_add = 1; /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) { if (unformat (line_input, "local-ip %U", unformat_ip46_address, &a.local_ip, IP46_TYPE_ANY)) { ip46_address_is_ip4 (&a.local_ip) ? (ipv4_set = 1) : (ipv6_set = 1); num_m_args++; } else if (unformat (line_input, "remote-ip %U", unformat_ip46_address, &a.remote_ip, IP46_TYPE_ANY)) { ip46_address_is_ip4 (&a.remote_ip) ? (ipv4_set = 1) : (ipv6_set = 1); num_m_args++; } else if (unformat (line_input, "local-spi %u", &a.local_spi)) num_m_args++; else if (unformat (line_input, "remote-spi %u", &a.remote_spi)) num_m_args++; else if (unformat (line_input, "instance %u", &a.show_instance)) a.renumber = 1; else if (unformat (line_input, "salt 0x%x", &a.salt)) ; else if (unformat (line_input, "udp-encap")) a.udp_encap = 1; else if (unformat (line_input, "use-esn")) a.esn = 1; else if (unformat (line_input, "use-anti-replay")) a.anti_replay = 1; else if (unformat (line_input, "tx-table %u", &a.tx_table_id)) ; else if (unformat (line_input, "local-crypto-key %U", unformat_ipsec_key, &lck)) ; else if (unformat (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck)) ; else if (unformat (line_input, "crypto-alg %U", unformat_ipsec_crypto_alg, &a.crypto_alg)) ; else if (unformat (line_input, "local-integ-key %U", unformat_ipsec_key, &lik)) ; else if (unformat (line_input, "remote-integ-key %U", unformat_ipsec_key, &rik)) ; else if (unformat (line_input, "integ-alg %U", unformat_ipsec_integ_alg, &a.integ_alg)) ; else if (unformat (line_input, "del")) a.is_add = 0; else { error = clib_error_return (0, "unknown input `%U'", format_unformat_error, line_input); goto done; } } if (num_m_args < 4) { error = clib_error_return (0, "mandatory argument(s) missing"); goto done; } if (ipv4_set && ipv6_set) return clib_error_return (0, "both IPv4 and IPv6 addresses specified"); a.is_ip6 = ipv6_set; clib_memcpy (a.local_crypto_key, lck.data, lck.len); a.local_crypto_key_len = lck.len; clib_memcpy (a.remote_crypto_key, rck.data, rck.len); a.remote_crypto_key_len = rck.len; clib_memcpy (a.local_integ_key, lik.data, lik.len); a.local_integ_key_len = lck.len; clib_memcpy (a.remote_integ_key, rik.data, rik.len); a.remote_integ_key_len = rck.len; rv = ipsec_add_del_tunnel_if (&a); switch (rv) { case 0: break; case VNET_API_ERROR_INVALID_VALUE: if (a.is_add) error = clib_error_return (0, "IPSec tunnel interface already exists..."); else error = clib_error_return (0, "IPSec tunnel interface not exists..."); goto done; default: error = clib_error_return (0, "ipsec_register_interface returned %d", rv); goto done; } done: unformat_free (line_input); return error; } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = { .path = "create ipsec tunnel", .short_help = "create ipsec tunnel local-ip local-spi " "remote-ip remote-spi [instance ] [udp-encap] [use-esn] [use-anti-replay] " "[tx-table ]", .function = create_ipsec_tunnel_command_fn, }; /* *INDENT-ON* */ static clib_error_t * ipsec_tun_protect_cmd (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; u32 sw_if_index, is_del, sa_in, sa_out, *sa_ins = NULL; vnet_main_t *vnm; is_del = 0; sw_if_index = ~0; vnm = vnet_get_main (); if (!unformat_user (input, unformat_line_input, line_input)) return 0; while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) { if (unformat (line_input, "del")) is_del = 1; else if (unformat (line_input, "add")) is_del = 0; else if (unformat (line_input, "sa-in %d", &sa_in)) vec_add1 (sa_ins, sa_in); else if (unformat (line_input, "sa-out %d", &sa_out)) ; else if (unformat (line_input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index)) ; else return (clib_error_return (0, "unknown input '%U'", format_unformat_error, line_input)); } if (!is_del) ipsec_tun_protect_update (sw_if_index, sa_out, sa_ins); unformat_free (line_input); return NULL; } /** * Protect tunnel with IPSEC */ /* *INDENT-OFF* */ VLIB_CLI_COMMAND (ipsec_tun_protect_cmd_node, static) = { .path = "ipsec tunnel protect", .function = ipsec_tun_protect_cmd, .short_help = "ipsec tunnel protect input-sa output-sa ", // this is not MP safe }; /* *INDENT-ON* */ static walk_rc_t ipsec_tun_protect_show_one (index_t itpi, void *ctx) { vlib_cli_output (ctx, "%U", format_ipsec_tun_protect, itpi); return (WALK_CONTINUE); } static clib_error_t * ipsec_tun_protect_show (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm); return NULL; } /** * show IPSEC tunnel protection */ /* *INDENT-OFF* */ VLIB_CLI_COMMAND (ipsec_tun_protect_show_node, static) = { .path = "show ipsec protect", .function = ipsec_tun_protect_show, .short_help = "show ipsec protect", }; /* *INDENT-ON* */ static clib_error_t * ipsec_tun_protect_hash_show (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { ipsec_main_t *im = &ipsec_main; { ipsec_tun_lkup_result_t value; ipsec4_tunnel_key_t key; vlib_cli_output (vm, "IPv4:"); /* *INDENT-OFF* */ hash_foreach(key.as_u64, value.as_u64, im->tun4_protect_by_key, ({ vlib_cli_output (vm, " %U", format_ipsec4_tunnel_key, &key); vlib_cli_output (vm, " tun:%d sa:%d", value.tun_index, value.sa_index); })); /* *INDENT-ON* */ } { ipsec_tun_lkup_result_t value; ipsec6_tunnel_key_t *key; vlib_cli_output (vm, "IPv6:"); /* *INDENT-OFF* */ hash_foreach_mem(key, value.as_u64, im->tun6_protect_by_key, ({ vlib_cli_output (vm, " %U", format_ipsec6_tunnel_key, key); vlib_cli_output (vm, " tun:%d sa:%d", value.tun_index, value.sa_index); })); /* *INDENT-ON* */ } return NULL; } /** * show IPSEC tunnel protection hash tables */ /* *INDENT-OFF* */ VLIB_CLI_COMMAND (ipsec_tun_protect_hash_show_node, static) = { .path = "show ipsec protect-hash", .function = ipsec_tun_protect_hash_show, .short_help = "show ipsec protect-hash", }; /* *INDENT-ON* */ clib_error_t * ipsec_cli_init (vlib_main_t * vm) { return 0; } VLIB_INIT_FUNCTION (ipsec_cli_init); /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */