4 files changed, 208 insertions, 31 deletions

diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 47b3ed370b8..c6ef1d0ca25 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -154,6 +154,12 @@ typedef struct
   ipsec_per_thread_data_t *ptd;
 } ipsec_main_t;
 
+typedef enum ipsec_format_flags_t_
+{
+  IPSEC_FORMAT_BRIEF = 0,
+  IPSEC_FORMAT_DETAIL = (1 << 0),
+} ipsec_format_flags_t;
+
 extern ipsec_main_t ipsec_main;
 
 clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index,
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 0f47c7b8427..b247d5d87c6 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -407,71 +407,186 @@ done:
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = {
     .path = "set ipsec sa",
-    .short_help =
-    "set ipsec sa <id> crypto-key <key> integ-key <key>",
+    .short_help = "set ipsec sa <id> crypto-key <key> integ-key <key>",
     .function = set_ipsec_sa_key_command_fn,
 };
 /* *INDENT-ON* */
 
-static clib_error_t *
-show_ipsec_command_fn (vlib_main_t * vm,
-		       unformat_input_t * input, vlib_cli_command_t * cmd)
+static void
+ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im)
 {
-  ipsec_main_t *im = &ipsec_main;
-  u32 spd_id, sw_if_index, sai;
-  vnet_hw_interface_t *hi;
-  ipsec_tunnel_if_t *t;
-  u8 *protocol = NULL;
-  u8 *policy = NULL;
-  u32 i;
+  u32 sai;
 
   /* *INDENT-OFF* */
   pool_foreach_index (sai, im->sad, ({
-     vlib_cli_output(vm, "%U", format_ipsec_sa, sai);
+    vlib_cli_output(vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_BRIEF);
   }));
-  pool_foreach_index (i, im->spds, ({
-    vlib_cli_output(vm, "%U", format_ipsec_spd, i);
+  /* *INDENT-ON* */
+}
+
+static void
+ipsec_spd_show_all (vlib_main_t * vm, ipsec_main_t * im)
+{
+  u32 spdi;
+
+  /* *INDENT-OFF* */
+  pool_foreach_index (spdi, im->spds, ({
+    vlib_cli_output(vm, "%U", format_ipsec_spd, spdi);
   }));
+  /* *INDENT-ON* */
+}
+
+static void
+ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im)
+{
+  u32 spd_id, sw_if_index;
 
   vlib_cli_output (vm, "SPD Bindings:");
 
+  /* *INDENT-OFF* */
   hash_foreach(sw_if_index, spd_id, im->spd_index_by_sw_if_index, ({
     vlib_cli_output (vm, "  %d -> %U", spd_id,
                      format_vnet_sw_if_index_name, im->vnet_main,
                      sw_if_index);
   }));
   /* *INDENT-ON* */
+}
 
-  vlib_cli_output (vm, "tunnel interfaces");
+static void
+ipsec_tunnel_show_all (vlib_main_t * vm, ipsec_main_t * im)
+{
+  u32 ti;
+
+  vlib_cli_output (vm, "Tunnel interfaces");
   /* *INDENT-OFF* */
-  pool_foreach (t, im->tunnel_interfaces, ({
-    if (t->hw_if_index == ~0)
-      continue;
-    hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
+  pool_foreach_index (ti, im->tunnel_interfaces, ({
+    vlib_cli_output(vm, "  %U", format_ipsec_tunnel, ti);
+  }));
+  /* *INDENT-ON* */
+}
 
-    vlib_cli_output(vm, "  %s", hi->name);
+static clib_error_t *
+show_ipsec_command_fn (vlib_main_t * vm,
+		       unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  ipsec_main_t *im = &ipsec_main;
 
-    vlib_cli_output(vm, "  out-bound sa");
-    vlib_cli_output(vm, "   %U", format_ipsec_sa, t->output_sa_index);
+  ipsec_sa_show_all (vm, im);
+  ipsec_spd_show_all (vm, im);
+  ipsec_spd_bindings_show_all (vm, im);
+  ipsec_tunnel_show_all (vm, im);
 
-    vlib_cli_output(vm, "  in-bound sa");
-    vlib_cli_output(vm, "   %U", format_ipsec_sa, t->input_sa_index);
-  }));
-  vec_free(policy);
-  vec_free(protocol);
-  /* *INDENT-ON* */
   return 0;
 }
 
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (show_ipsec_command, static) = {
-    .path = "show ipsec",
-    .short_help = "show ipsec [backends]",
+    .path = "show ipsec all",
+    .short_help = "show ipsec all",
     .function = show_ipsec_command_fn,
 };
 /* *INDENT-ON* */
 
 static clib_error_t *
+show_ipsec_sa_command_fn (vlib_main_t * vm,
+			  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  ipsec_main_t *im = &ipsec_main;
+  u32 sai = ~0;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%u", &sai))
+	;
+      else
+	break;
+    }
+
+  if (~0 == sai)
+    ipsec_sa_show_all (vm, im);
+  else
+    vlib_cli_output (vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_DETAIL);
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ipsec_sa_command, static) = {
+    .path = "show ipsec sa",
+    .short_help = "show ipsec sa [index]",
+    .function = show_ipsec_sa_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+show_ipsec_spd_command_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  ipsec_main_t *im = &ipsec_main;
+  u8 show_bindings = 0;
+  u32 spdi = ~0;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%u", &spdi))
+	;
+      else if (unformat (input, "bindings"))
+	show_bindings = 1;
+      else
+	break;
+    }
+
+  if (show_bindings)
+    ipsec_spd_bindings_show_all (vm, im);
+  else if (~0 != spdi)
+    vlib_cli_output (vm, "%U", format_ipsec_spd, spdi);
+  else
+    ipsec_spd_show_all (vm, im);
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ipsec_spd_command, static) = {
+    .path = "show ipsec spd",
+    .short_help = "show ipsec spd [index]",
+    .function = show_ipsec_spd_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+show_ipsec_tunnel_command_fn (vlib_main_t * vm,
+			      unformat_input_t * input,
+			      vlib_cli_command_t * cmd)
+{
+  ipsec_main_t *im = &ipsec_main;
+  u32 ti = ~0;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%u", &ti))
+	;
+      else
+	break;
+    }
+
+  if (~0 != ti)
+    vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti);
+  else
+    ipsec_tunnel_show_all (vm, im);
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
+    .path = "show ipsec tunnel",
+    .short_help = "show ipsec tunnel [index]",
+    .function = show_ipsec_tunnel_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
 ipsec_show_backends_command_fn (vlib_main_t * vm,
 				unformat_input_t * input,
 				vlib_cli_command_t * cmd)
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index c91a9ba632e..6e6007eed2a 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -203,6 +203,12 @@ format_ipsec_spd (u8 * s, va_list * args)
   ipsec_spd_t *spd;
   u32 *i;
 
+  if (pool_is_free_index (im->spds, si))
+    {
+      s = format (s, "No such SPD index: %d", si);
+      goto done;
+    }
+
   spd = pool_elt_at_index (im->spds, si);
 
   s = format (s, "spd %u", spd->id);
@@ -216,6 +222,7 @@ format_ipsec_spd (u8 * s, va_list * args)
   foreach_ipsec_spd_policy_type;
 #undef _
 
+done:
   return (s);
 }
 
@@ -260,11 +267,18 @@ u8 *
 format_ipsec_sa (u8 * s, va_list * args)
 {
   u32 sai = va_arg (*args, u32);
+  ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t);
   ipsec_main_t *im = &ipsec_main;
   vlib_counter_t counts;
   u32 tx_table_id;
   ipsec_sa_t *sa;
 
+  if (pool_is_free_index (im->sad, sai))
+    {
+      s = format (s, "No such SA index: %d", sai);
+      goto done;
+    }
+
   sa = pool_elt_at_index (im->sad, sai);
 
   s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U",
@@ -272,6 +286,10 @@ format_ipsec_sa (u8 * s, va_list * args)
 	      ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport",
 	      ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "",
 	      sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags);
+
+  if (!(flags & IPSEC_FORMAT_DETAIL))
+    goto done;
+
   s = format (s, "\n   seq %u seq-hi %u", sa->seq, sa->seq_hi);
   s = format (s, "\n   last-seq %u last-seq-hi %u window %U",
 	      sa->last_seq, sa->last_seq_hi,
@@ -306,6 +324,42 @@ format_ipsec_sa (u8 * s, va_list * args)
 	}
     }
 
+done:
+  return (s);
+}
+
+u8 *
+format_ipsec_tunnel (u8 * s, va_list * args)
+{
+  ipsec_main_t *im = &ipsec_main;
+  u32 ti = va_arg (*args, u32);
+  vnet_hw_interface_t *hi;
+  ipsec_tunnel_if_t *t;
+
+  if (pool_is_free_index (im->tunnel_interfaces, ti))
+    {
+      s = format (s, "No such tunnel index: %d", ti);
+      goto done;
+    }
+
+  t = pool_elt_at_index (im->tunnel_interfaces, ti);
+
+  if (t->hw_if_index == ~0)
+    goto done;
+
+  hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index);
+
+  s = format (s, "%s\n", hi->name);
+
+  s = format (s, "   out-bound sa: ");
+  s = format (s, "%U\n", format_ipsec_sa, t->output_sa_index,
+	      IPSEC_FORMAT_BRIEF);
+
+  s = format (s, "    in-bound sa: ");
+  s = format (s, "%U\n", format_ipsec_sa, t->input_sa_index,
+	      IPSEC_FORMAT_BRIEF);
+
+done:
   return (s);
 }
 
diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h
index 34a1721f4fc..1e7f9df7c93 100644
--- a/src/vnet/ipsec/ipsec_if.h
+++ b/src/vnet/ipsec/ipsec_if.h
@@ -116,6 +116,8 @@ extern int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
 extern int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index,
 				   u32 sa_id, u8 is_outbound);
 
+extern u8 *format_ipsec_tunnel (u8 * s, va_list * args);
+
 #endif /* __IPSEC_IF_H__ */
 
 /*