aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/vnet/ipsec/ipsec.h6
-rw-r--r--src/vnet/ipsec/ipsec_cli.c177
-rw-r--r--src/vnet/ipsec/ipsec_format.c54
-rw-r--r--src/vnet/ipsec/ipsec_if.h2
4 files changed, 208 insertions, 31 deletions
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 47b3ed370b8..c6ef1d0ca25 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -154,6 +154,12 @@ typedef struct
ipsec_per_thread_data_t *ptd;
} ipsec_main_t;
+typedef enum ipsec_format_flags_t_
+{
+ IPSEC_FORMAT_BRIEF = 0,
+ IPSEC_FORMAT_DETAIL = (1 << 0),
+} ipsec_format_flags_t;
+
extern ipsec_main_t ipsec_main;
clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index,
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 0f47c7b8427..b247d5d87c6 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -407,71 +407,186 @@ done:
/* *INDENT-OFF* */
VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = {
.path = "set ipsec sa",
- .short_help =
- "set ipsec sa <id> crypto-key <key> integ-key <key>",
+ .short_help = "set ipsec sa <id> crypto-key <key> integ-key <key>",
.function = set_ipsec_sa_key_command_fn,
};
/* *INDENT-ON* */
-static clib_error_t *
-show_ipsec_command_fn (vlib_main_t * vm,
- unformat_input_t * input, vlib_cli_command_t * cmd)
+static void
+ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im)
{
- ipsec_main_t *im = &ipsec_main;
- u32 spd_id, sw_if_index, sai;
- vnet_hw_interface_t *hi;
- ipsec_tunnel_if_t *t;
- u8 *protocol = NULL;
- u8 *policy = NULL;
- u32 i;
+ u32 sai;
/* *INDENT-OFF* */
pool_foreach_index (sai, im->sad, ({
- vlib_cli_output(vm, "%U", format_ipsec_sa, sai);
+ vlib_cli_output(vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_BRIEF);
}));
- pool_foreach_index (i, im->spds, ({
- vlib_cli_output(vm, "%U", format_ipsec_spd, i);
+ /* *INDENT-ON* */
+}
+
+static void
+ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im)
+{
+ u32 spdi;
+
+ /* *INDENT-OFF* */
+ pool_foreach_index (spdi, im->spds, ({
+ vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
}));
+ /* *INDENT-ON* */
+}
+
+static void
+ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im)
+{
+ u32 spd_id, sw_if_index;
vlib_cli_output (vm, "SPD Bindings:");
+ /* *INDENT-OFF* */
hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
vlib_cli_output (vm, " %d -> %U", spd_id,
format_vnet_sw_if_index_name, im->vnet_main,
sw_if_index);
}));
/* *INDENT-ON* */
+}
- vlib_cli_output (vm, "tunnel interfaces");
+static void
+ipsec_tunnel_show_all (vlib_main_t * vm, ipsec_main_t * im)
+{
+ u32 ti;
+
+ vlib_cli_output (vm, "Tunnel interfaces");
/* *INDENT-OFF* */
- pool_foreach (t, im->tunnel_interfaces, ({
- if (t->hw_if_index == ~0)
- continue;
- hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
+ pool_foreach_index (ti, im->tunnel_interfaces, ({
+ vlib_cli_output(vm, " %U", format_ipsec_tunnel, ti);
+ }));
+ /* *INDENT-ON* */
+}
- vlib_cli_output(vm, " %s", hi->name);
+static clib_error_t *
+show_ipsec_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ ipsec_main_t *im = &ipsec_main;
- vlib_cli_output(vm, " out-bound sa");
- vlib_cli_output(vm, " %U", format_ipsec_sa, t->output_sa_index);
+ ipsec_sa_show_all (vm, im);
+ ipsec_spd_show_all (vm, im);
+ ipsec_spd_bindings_show_all (vm, im);
+ ipsec_tunnel_show_all (vm, im);
- vlib_cli_output(vm, " in-bound sa");
- vlib_cli_output(vm, " %U", format_ipsec_sa, t->input_sa_index);
- }));
- vec_free(policy);
- vec_free(protocol);
- /* *INDENT-ON* */
return 0;
}
/* *INDENT-OFF* */
VLIB_CLI_COMMAND (show_ipsec_command, static) = {
- .path = "show ipsec",
- .short_help = "show ipsec [backends]",
+ .path = "show ipsec all",
+ .short_help = "show ipsec all",
.function = show_ipsec_command_fn,
};
/* *INDENT-ON* */
static clib_error_t *
+show_ipsec_sa_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ ipsec_main_t *im = &ipsec_main;
+ u32 sai = ~0;
+
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "%u", &sai))
+ ;
+ else
+ break;
+ }
+
+ if (~0 == sai)
+ ipsec_sa_show_all (vm, im);
+ else
+ vlib_cli_output (vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_DETAIL);
+
+ return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = {
+ .path = "show ipsec sa",
+ .short_help = "show ipsec sa [index]",
+ .function = show_ipsec_sa_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+show_ipsec_spd_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ ipsec_main_t *im = &ipsec_main;
+ u8 show_bindings = 0;
+ u32 spdi = ~0;
+
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "%u", &spdi))
+ ;
+ else if (unformat (input, "bindings"))
+ show_bindings = 1;
+ else
+ break;
+ }
+
+ if (show_bindings)
+ ipsec_spd_bindings_show_all (vm, im);
+ else if (~0 != spdi)
+ vlib_cli_output (vm, "%U", format_ipsec_spd, spdi);
+ else
+ ipsec_spd_show_all (vm, im);
+
+ return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = {
+ .path = "show ipsec spd",
+ .short_help = "show ipsec spd [index]",
+ .function = show_ipsec_spd_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+show_ipsec_tunnel_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ ipsec_main_t *im = &ipsec_main;
+ u32 ti = ~0;
+
+ while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (input, "%u", &ti))
+ ;
+ else
+ break;
+ }
+
+ if (~0 != ti)
+ vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti);
+ else
+ ipsec_tunnel_show_all (vm, im);
+
+ return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
+ .path = "show ipsec tunnel",
+ .short_help = "show ipsec tunnel [index]",
+ .function = show_ipsec_tunnel_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
ipsec_show_backends_command_fn (vlib_main_t * vm,
unformat_input_t * input,
vlib_cli_command_t * cmd)
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index c91a9ba632e..6e6007eed2a 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -203,6 +203,12 @@ format_ipsec_spd (u8 * s, va_list * args)
ipsec_spd_t *spd;
u32 *i;
+ if (pool_is_free_index (im->spds, si))
+ {
+ s = format (s, "No such SPD index: %d", si);
+ goto done;
+ }
+
spd = pool_elt_at_index (im->spds, si);
s = format (s, "spd %u", spd->id);
@@ -216,6 +222,7 @@ format_ipsec_spd (u8 * s, va_list * args)
foreach_ipsec_spd_policy_type;
#undef _
+done:
return (s);
}
@@ -260,11 +267,18 @@ u8 *
format_ipsec_sa (u8 * s, va_list * args)
{
u32 sai = va_arg (*args, u32);
+ ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t);
ipsec_main_t *im = &ipsec_main;
vlib_counter_t counts;
u32 tx_table_id;
ipsec_sa_t *sa;
+ if (pool_is_free_index (im->sad, sai))
+ {
+ s = format (s, "No such SA index: %d", sai);
+ goto done;
+ }
+
sa = pool_elt_at_index (im->sad, sai);
s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U",
@@ -272,6 +286,10 @@ format_ipsec_sa (u8 * s, va_list * args)
ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport",
ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "",
sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags);
+
+ if (!(flags & IPSEC_FORMAT_DETAIL))
+ goto done;
+
s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi);
s = format (s, "\n last-seq %u last-seq-hi %u window %U",
sa->last_seq, sa->last_seq_hi,
@@ -306,6 +324,42 @@ format_ipsec_sa (u8 * s, va_list * args)
}
}
+done:
+ return (s);
+}
+
+u8 *
+format_ipsec_tunnel (u8 * s, va_list * args)
+{
+ ipsec_main_t *im = &ipsec_main;
+ u32 ti = va_arg (*args, u32);
+ vnet_hw_interface_t *hi;
+ ipsec_tunnel_if_t *t;
+
+ if (pool_is_free_index (im->tunnel_interfaces, ti))
+ {
+ s = format (s, "No such tunnel index: %d", ti);
+ goto done;
+ }
+
+ t = pool_elt_at_index (im->tunnel_interfaces, ti);
+
+ if (t->hw_if_index == ~0)
+ goto done;
+
+ hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
+
+ s = format (s, "%s\n", hi->name);
+
+ s = format (s, " out-bound sa: ");
+ s = format (s, "%U\n", format_ipsec_sa, t->output_sa_index,
+ IPSEC_FORMAT_BRIEF);
+
+ s = format (s, " in-bound sa: ");
+ s = format (s, "%U\n", format_ipsec_sa, t->input_sa_index,
+ IPSEC_FORMAT_BRIEF);
+
+done:
return (s);
}
diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h
index 34a1721f4fc..1e7f9df7c93 100644
--- a/src/vnet/ipsec/ipsec_if.h
+++ b/src/vnet/ipsec/ipsec_if.h
@@ -116,6 +116,8 @@ extern int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
extern int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index,
u32 sa_id, u8 is_outbound);
+extern u8 *format_ipsec_tunnel (u8 * s, va_list * args);
+
#endif /* __IPSEC_IF_H__ */
/*