ipsec: infra for selecting backends

Change-Id: Ifa6d8391b1b2413a88b7720fc434e0bc849a149a
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

1 files changed, 139 insertions, 3 deletions

diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 4e382bdeab5..ee7dd404a87 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -174,8 +174,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
 
   if (is_add)
     {
-      ASSERT (im->cb.check_support_cb);
-      error = im->cb.check_support_cb (&sa);
+      error = ipsec_check_support_cb (im, &sa);
       if (error)
 	goto done;
     }
@@ -702,12 +701,149 @@ show_ipsec_command_fn (vlib_main_t * vm,
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
     .path = "show ipsec",
-    .short_help = "show ipsec",
+    .short_help = "show ipsec [backends]",
     .function = show_ipsec_command_fn,
 };
 /* *INDENT-ON* */
 
 static clib_error_t *
+ipsec_show_backends_command_fn (vlib_main_t * vm,
+				unformat_input_t * input,
+				vlib_cli_command_t * cmd)
+{
+  ipsec_main_t *im = &ipsec_main;
+  u32 verbose = 0;
+
+  (void) unformat (input, "verbose %u", &verbose);
+
+  vlib_cli_output (vm, "IPsec AH backends available:");
+  u8 *s = format (NULL, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
+  ipsec_ah_backend_t *ab;
+  /* *INDENT-OFF* */
+  pool_foreach (ab, im->ah_backends, {
+    s = format (s, "%=25s %=25u %=10s\n", ab->name, ab - im->ah_backends,
+                ab - im->ah_backends == im->ah_current_backend ? "yes" : "no");
+    if (verbose) {
+        vlib_node_t *n;
+        n = vlib_get_node (vm, ab->ah4_encrypt_node_index);
+        s = format (s, "     enc4 %s (next %d)\n", n->name, ab->ah4_encrypt_next_index);
+        n = vlib_get_node (vm, ab->ah4_decrypt_node_index);
+        s = format (s, "     dec4 %s (next %d)\n", n->name, ab->ah4_decrypt_next_index);
+        n = vlib_get_node (vm, ab->ah6_encrypt_node_index);
+        s = format (s, "     enc6 %s (next %d)\n", n->name, ab->ah6_encrypt_next_index);
+        n = vlib_get_node (vm, ab->ah6_decrypt_node_index);
+        s = format (s, "     dec6 %s (next %d)\n", n->name, ab->ah6_decrypt_next_index);
+    }
+  });
+  /* *INDENT-ON* */
+  vlib_cli_output (vm, "%v", s);
+  _vec_len (s) = 0;
+  vlib_cli_output (vm, "IPsec ESP backends available:");
+  s = format (s, "%=25s %=25s %=10s\n", "Name", "Index", "Active");
+  ipsec_esp_backend_t *eb;
+  /* *INDENT-OFF* */
+  pool_foreach (eb, im->esp_backends, {
+    s = format (s, "%=25s %=25u %=10s\n", eb->name, eb - im->esp_backends,
+                eb - im->esp_backends == im->esp_current_backend ? "yes"
+                                                                 : "no");
+    if (verbose) {
+        vlib_node_t *n;
+        n = vlib_get_node (vm, eb->esp4_encrypt_node_index);
+        s = format (s, "     enc4 %s (next %d)\n", n->name, eb->esp4_encrypt_next_index);
+        n = vlib_get_node (vm, eb->esp4_decrypt_node_index);
+        s = format (s, "     dec4 %s (next %d)\n", n->name, eb->esp4_decrypt_next_index);
+        n = vlib_get_node (vm, eb->esp6_encrypt_node_index);
+        s = format (s, "     enc6 %s (next %d)\n", n->name, eb->esp6_encrypt_next_index);
+        n = vlib_get_node (vm, eb->esp6_decrypt_node_index);
+        s = format (s, "     dec6 %s (next %d)\n", n->name, eb->esp6_decrypt_next_index);
+    }
+  });
+  /* *INDENT-ON* */
+  vlib_cli_output (vm, "%v", s);
+
+  vec_free (s);
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (ipsec_show_backends_command, static) = {
+    .path = "show ipsec backends",
+    .short_help = "show ipsec backends",
+    .function = ipsec_show_backends_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+ipsec_select_backend_command_fn (vlib_main_t * vm,
+				 unformat_input_t * input,
+				 vlib_cli_command_t * cmd)
+{
+  u32 backend_index;
+  ipsec_main_t *im = &ipsec_main;
+
+  if (pool_elts (im->sad) > 0)
+    {
+      return clib_error_return (0,
+				"Cannot change IPsec backend, while %u SA entries are configured",
+				pool_elts (im->sad));
+    }
+
+  unformat_input_t _line_input, *line_input = &_line_input;
+  /* Get a line of input. */
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  if (unformat (line_input, "ah"))
+    {
+      if (unformat (line_input, "%u", &backend_index))
+	{
+	  if (ipsec_select_ah_backend (im, backend_index) < 0)
+	    {
+	      return clib_error_return (0, "Invalid AH backend index `%u'",
+					backend_index);
+	    }
+	}
+      else
+	{
+	  return clib_error_return (0, "Invalid backend index `%U'",
+				    format_unformat_error, line_input);
+	}
+    }
+  else if (unformat (line_input, "esp"))
+    {
+      if (unformat (line_input, "%u", &backend_index))
+	{
+	  if (ipsec_select_esp_backend (im, backend_index) < 0)
+	    {
+	      return clib_error_return (0, "Invalid ESP backend index `%u'",
+					backend_index);
+	    }
+	}
+      else
+	{
+	  return clib_error_return (0, "Invalid backend index `%U'",
+				    format_unformat_error, line_input);
+	}
+    }
+  else
+    {
+      return clib_error_return (0, "Unknown input `%U'",
+				format_unformat_error, line_input);
+    }
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (ipsec_select_backend_command, static) = {
+    .path = "ipsec select backend",
+    .short_help = "ipsec select backend <ah|esp> <backend index>",
+    .function = ipsec_select_backend_command_fn,
+};
+
+/* *INDENT-ON* */
+
+static clib_error_t *
 clear_ipsec_counters_command_fn (vlib_main_t * vm,
 				 unformat_input_t * input,
 				 vlib_cli_command_t * cmd)