aboutsummaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec
diff options
context:
space:
mode:
authorMatus Fabian <matfabia@cisco.com>2018-10-02 01:13:25 -0700
committerDamjan Marion <dmarion@me.com>2018-10-02 12:31:41 +0000
commita9a0b2ce2daabc5479aa7722e3ec7023f8c6c0d5 (patch)
tree6c48a7470b97bcd6ab37c68eb5d66a7c4122bcc5 /src/vnet/ipsec
parentb192feba004e7a52b57ff9f68246b1c94e8b667b (diff)
IPsec: add API for SPDs dump (VPP-1363)
Change-Id: I36e6878712c394de629a9182d2af24c53a8f811d Signed-off-by: Matus Fabian <matfabia@cisco.com>
Diffstat (limited to 'src/vnet/ipsec')
-rw-r--r--src/vnet/ipsec/ipsec.api22
-rw-r--r--src/vnet/ipsec/ipsec_api.c39
2 files changed, 60 insertions, 1 deletions
diff --git a/src/vnet/ipsec/ipsec.api b/src/vnet/ipsec/ipsec.api
index 4279e208ec1..d6a28017fff 100644
--- a/src/vnet/ipsec/ipsec.api
+++ b/src/vnet/ipsec/ipsec.api
@@ -13,7 +13,7 @@
* limitations under the License.
*/
-option version = "1.0.0";
+option version = "2.0.0";
/** \brief IPsec: Add/delete Security Policy Database
@param client_index - opaque cookie to identify the sender
@@ -441,6 +441,26 @@ autoreply define ikev2_initiate_rekey_child_sa
u32 ispi;
};
+/** \brief Dump IPsec all SPD IDs
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+*/
+define ipsec_spds_dump {
+ u32 client_index;
+ u32 context;
+};
+
+/** \brief Dump IPsec all SPD IDs response
+ @param client_index - opaque cookie to identify the sender
+ @param spd_id - SPD instance id (control plane allocated)
+ @param npolicies - number of policies in SPD
+*/
+ define ipsec_spds_details {
+ u32 context;
+ u32 spd_id;
+ u32 npolicies;
+};
+
/** \brief Dump ipsec policy database data
@param client_index - opaque cookie to identify the sender
@param context - sender context, to match reply w/ request
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index ffc7f59fb8c..37daee0b64f 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -54,6 +54,7 @@ _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \
_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \
_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
_(IPSEC_SA_DUMP, ipsec_sa_dump) \
+_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \
_(IPSEC_SPD_DUMP, ipsec_spd_dump) \
_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
@@ -252,6 +253,44 @@ out:
}
static void
+send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
+ u32 context)
+{
+ vl_api_ipsec_spds_details_t *mp;
+
+ mp = vl_msg_api_alloc (sizeof (*mp));
+ memset (mp, 0, sizeof (*mp));
+ mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
+ mp->context = context;
+
+ mp->spd_id = htonl (spd->id);
+ mp->npolicies = htonl (pool_len (spd->policies));
+
+ vl_api_send_msg (reg, (u8 *) mp);
+}
+
+static void
+vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
+{
+ vl_api_registration_t *reg;
+ ipsec_main_t *im = &ipsec_main;
+ ipsec_spd_t *spd;
+#if WITH_LIBSSL > 0
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ /* *INDENT-OFF* */
+ pool_foreach (spd, im->spds, ({
+ send_ipsec_spds_details (spd, reg, mp->context);
+ }));
+ /* *INDENT-ON* */
+#else
+ clib_warning ("unimplemented");
+#endif
+}
+
+static void
send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
u32 context)
{