From 7cd468a3d7dee7d6c92f69a0bb7061ae208ec727 Mon Sep 17 00:00:00 2001 From: Damjan Marion Date: Mon, 19 Dec 2016 23:05:39 +0100 Subject: Reorganize source tree to use single autotools instance Change-Id: I7b51f88292e057c6443b12224486f2d0c9f8ae23 Signed-off-by: Damjan Marion --- src/vnet/ipsec/ikev2_cli.c | 479 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 479 insertions(+) create mode 100644 src/vnet/ipsec/ikev2_cli.c (limited to 'src/vnet/ipsec/ikev2_cli.c') diff --git a/src/vnet/ipsec/ikev2_cli.c b/src/vnet/ipsec/ikev2_cli.c new file mode 100644 index 00000000000..1369c187775 --- /dev/null +++ b/src/vnet/ipsec/ikev2_cli.c @@ -0,0 +1,479 @@ +/* + * Copyright (c) 2015 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include +#include +#include +#include +#include +#include + +u8 * +format_ikev2_id_type_and_data (u8 * s, va_list * args) +{ + ikev2_id_t *id = va_arg (*args, ikev2_id_t *); + + if (id->type == 0 || vec_len (id->data) == 0) + return format (s, "none"); + + s = format (s, "%U", format_ikev2_id_type, id->type); + + if (id->type == IKEV2_ID_TYPE_ID_FQDN || + id->type == IKEV2_ID_TYPE_ID_RFC822_ADDR) + { + s = format (s, " %v", id->data); + } + else + { + s = + format (s, " %U", format_hex_bytes, &id->data, + (uword) (vec_len (id->data))); + } + + return s; +} + + +static clib_error_t * +show_ikev2_sa_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + ikev2_main_t *km = &ikev2_main; + ikev2_main_per_thread_data_t *tkm; + ikev2_sa_t *sa; + ikev2_ts_t *ts; + ikev2_child_sa_t *child; + ikev2_sa_transform_t *tr; + + vec_foreach (tkm, km->per_thread_data) + { + /* *INDENT-OFF* */ + pool_foreach (sa, tkm->sas, ({ + u8 * s = 0; + vlib_cli_output(vm, " iip %U ispi %lx rip %U rspi %lx", + format_ip4_address, &sa->iaddr, sa->ispi, + format_ip4_address, &sa->raddr, sa->rspi); + + tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + tr = ikev2_sa_get_td_for_type(sa->r_proposals, IKEV2_TRANSFORM_TYPE_DH); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + vlib_cli_output(vm, " %v", s); + vec_free(s); + + vlib_cli_output(vm, " nonce i:%U\n r:%U", + format_hex_bytes, sa->i_nonce, vec_len(sa->i_nonce), + format_hex_bytes, sa->r_nonce, vec_len(sa->r_nonce)); + + vlib_cli_output(vm, " SK_d %U", + format_hex_bytes, sa->sk_d, vec_len(sa->sk_d)); + vlib_cli_output(vm, " SK_a i:%U\n r:%U", + format_hex_bytes, sa->sk_ai, vec_len(sa->sk_ai), + format_hex_bytes, sa->sk_ar, vec_len(sa->sk_ar)); + vlib_cli_output(vm, " SK_e i:%U\n r:%U", + format_hex_bytes, sa->sk_ei, vec_len(sa->sk_ei), + format_hex_bytes, sa->sk_er, vec_len(sa->sk_er)); + vlib_cli_output(vm, " SK_p i:%U\n r:%U", + format_hex_bytes, sa->sk_pi, vec_len(sa->sk_pi), + format_hex_bytes, sa->sk_pr, vec_len(sa->sk_pr)); + + vlib_cli_output(vm, " identifier (i) %U", + format_ikev2_id_type_and_data, &sa->i_id); + vlib_cli_output(vm, " identifier (r) %U", + format_ikev2_id_type_and_data, &sa->r_id); + + vec_foreach(child, sa->childs) + { + vlib_cli_output(vm, " child sa %u:", child - sa->childs); + + tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + tr = ikev2_sa_get_td_for_type(child->r_proposals, IKEV2_TRANSFORM_TYPE_ESN); + s = format(s, "%U ", format_ikev2_sa_transform, tr); + + vlib_cli_output(vm, " %v", s); + vec_free(s); + + vlib_cli_output(vm, " spi(i) %lx spi(r) %lx", + child->i_proposals ? child->i_proposals[0].spi : 0, + child->r_proposals ? child->r_proposals[0].spi : 0); + + vlib_cli_output(vm, " SK_e i:%U\n r:%U", + format_hex_bytes, child->sk_ei, vec_len(child->sk_ei), + format_hex_bytes, child->sk_er, vec_len(child->sk_er)); + vlib_cli_output(vm, " SK_a i:%U\n r:%U", + format_hex_bytes, child->sk_ai, vec_len(child->sk_ai), + format_hex_bytes, child->sk_ar, vec_len(child->sk_ar)); + vlib_cli_output(vm, " traffic selectors (i):"); + vec_foreach(ts, child->tsi) + { + vlib_cli_output(vm, " %u type %u protocol_id %u addr " + "%U - %U port %u - %u", + ts - child->tsi, + ts->ts_type, ts->protocol_id, + format_ip4_address, &ts->start_addr, + format_ip4_address, &ts->end_addr, + clib_net_to_host_u16( ts->start_port), + clib_net_to_host_u16( ts->end_port)); + } + vlib_cli_output(vm, " traffic selectors (r):"); + vec_foreach(ts, child->tsr) + { + vlib_cli_output(vm, " %u type %u protocol_id %u addr " + "%U - %U port %u - %u", + ts - child->tsr, + ts->ts_type, ts->protocol_id, + format_ip4_address, &ts->start_addr, + format_ip4_address, &ts->end_addr, + clib_net_to_host_u16( ts->start_port), + clib_net_to_host_u16( ts->end_port)); + } + } + vlib_cli_output(vm, ""); + })); + /* *INDENT-ON* */ + } + return 0; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (show_ikev2_sa_command, static) = { + .path = "show ikev2 sa", + .short_help = "show ikev2 sa", + .function = show_ikev2_sa_command_fn, +}; +/* *INDENT-ON* */ + +static clib_error_t * +ikev2_profile_add_del_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + u8 *name = 0; + clib_error_t *r = 0; + u32 id_type; + u8 *data = 0; + u32 tmp1, tmp2, tmp3; + ip4_address_t ip4; + ip4_address_t end_addr; + + const char *valid_chars = "a-zA-Z0-9_"; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "add %U", unformat_token, valid_chars, &name)) + { + r = ikev2_add_del_profile (vm, name, 1); + goto done; + } + else + if (unformat + (line_input, "del %U", unformat_token, valid_chars, &name)) + { + r = ikev2_add_del_profile (vm, name, 0); + goto done; + } + else if (unformat (line_input, "set %U auth shared-key-mic string %v", + unformat_token, valid_chars, &name, &data)) + { + r = + ikev2_set_profile_auth (vm, name, + IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data, + 0); + goto done; + } + else if (unformat (line_input, "set %U auth shared-key-mic hex %U", + unformat_token, valid_chars, &name, + unformat_hex_string, &data)) + { + r = + ikev2_set_profile_auth (vm, name, + IKEV2_AUTH_METHOD_SHARED_KEY_MIC, data, + 1); + goto done; + } + else if (unformat (line_input, "set %U auth rsa-sig cert-file %v", + unformat_token, valid_chars, &name, &data)) + { + r = + ikev2_set_profile_auth (vm, name, IKEV2_AUTH_METHOD_RSA_SIG, data, + 0); + goto done; + } + else if (unformat (line_input, "set %U id local %U %U", + unformat_token, valid_chars, &name, + unformat_ikev2_id_type, &id_type, + unformat_ip4_address, &ip4)) + { + data = vec_new (u8, 4); + clib_memcpy (data, ip4.as_u8, 4); + r = + ikev2_set_profile_id (vm, name, (u8) id_type, data, /*local */ 1); + goto done; + } + else if (unformat (line_input, "set %U id local %U 0x%U", + unformat_token, valid_chars, &name, + unformat_ikev2_id_type, &id_type, + unformat_hex_string, &data)) + { + r = + ikev2_set_profile_id (vm, name, (u8) id_type, data, /*local */ 1); + goto done; + } + else if (unformat (line_input, "set %U id local %U %v", + unformat_token, valid_chars, &name, + unformat_ikev2_id_type, &id_type, &data)) + { + r = + ikev2_set_profile_id (vm, name, (u8) id_type, data, /*local */ 1); + goto done; + } + else if (unformat (line_input, "set %U id remote %U %U", + unformat_token, valid_chars, &name, + unformat_ikev2_id_type, &id_type, + unformat_ip4_address, &ip4)) + { + data = vec_new (u8, 4); + clib_memcpy (data, ip4.as_u8, 4); + r = ikev2_set_profile_id (vm, name, (u8) id_type, data, /*remote */ + 0); + goto done; + } + else if (unformat (line_input, "set %U id remote %U 0x%U", + unformat_token, valid_chars, &name, + unformat_ikev2_id_type, &id_type, + unformat_hex_string, &data)) + { + r = ikev2_set_profile_id (vm, name, (u8) id_type, data, /*remote */ + 0); + goto done; + } + else if (unformat (line_input, "set %U id remote %U %v", + unformat_token, valid_chars, &name, + unformat_ikev2_id_type, &id_type, &data)) + { + r = ikev2_set_profile_id (vm, name, (u8) id_type, data, /*remote */ + 0); + goto done; + } + else if (unformat (line_input, "set %U traffic-selector local " + "ip-range %U - %U port-range %u - %u protocol %u", + unformat_token, valid_chars, &name, + unformat_ip4_address, &ip4, + unformat_ip4_address, &end_addr, + &tmp1, &tmp2, &tmp3)) + { + r = + ikev2_set_profile_ts (vm, name, (u8) tmp3, (u16) tmp1, (u16) tmp2, + ip4, end_addr, /*local */ 1); + goto done; + } + else if (unformat (line_input, "set %U traffic-selector remote " + "ip-range %U - %U port-range %u - %u protocol %u", + unformat_token, valid_chars, &name, + unformat_ip4_address, &ip4, + unformat_ip4_address, &end_addr, + &tmp1, &tmp2, &tmp3)) + { + r = + ikev2_set_profile_ts (vm, name, (u8) tmp3, (u16) tmp1, (u16) tmp2, + ip4, end_addr, /*remote */ 0); + goto done; + } + else + break; + } + + r = clib_error_return (0, "parse error: '%U'", + format_unformat_error, line_input); + +done: + vec_free (name); + vec_free (data); + unformat_free (line_input); + return r; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (ikev2_profile_add_del_command, static) = { + .path = "ikev2 profile", + .short_help = + "ikev2 profile [add|del] \n" + "ikev2 profile set auth [rsa-sig|shared-key-mic] [cert-file|string|hex]" + " \n" + "ikev2 profile set id \n" + "ikev2 profile set traffic-selector ip-range " + " - port-range - " + "protocol ", + .function = ikev2_profile_add_del_command_fn, +}; +/* *INDENT-ON* */ + +static clib_error_t * +show_ikev2_profile_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + ikev2_main_t *km = &ikev2_main; + ikev2_profile_t *p; + + /* *INDENT-OFF* */ + pool_foreach (p, km->profiles, ({ + vlib_cli_output(vm, "profile %v", p->name); + + if (p->auth.data) + { + if (p->auth.hex) + vlib_cli_output(vm, " auth-method %U auth data 0x%U", + format_ikev2_auth_method, p->auth.method, + format_hex_bytes, p->auth.data, vec_len(p->auth.data)); + else + vlib_cli_output(vm, " auth-method %U auth data %v", + format_ikev2_auth_method, p->auth.method, p->auth.data); + } + + if (p->loc_id.data) + { + if (p->loc_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR) + vlib_cli_output(vm, " local id-type %U data %U", + format_ikev2_id_type, p->loc_id.type, + format_ip4_address, p->loc_id.data); + else if (p->loc_id.type == IKEV2_ID_TYPE_ID_KEY_ID) + vlib_cli_output(vm, " local id-type %U data 0x%U", + format_ikev2_id_type, p->loc_id.type, + format_hex_bytes, p->loc_id.data, + vec_len(p->loc_id.data)); + else + vlib_cli_output(vm, " local id-type %U data %v", + format_ikev2_id_type, p->loc_id.type, p->loc_id.data); + } + + if (p->rem_id.data) + { + if (p->rem_id.type == IKEV2_ID_TYPE_ID_IPV4_ADDR) + vlib_cli_output(vm, " remote id-type %U data %U", + format_ikev2_id_type, p->rem_id.type, + format_ip4_address, p->rem_id.data); + else if (p->rem_id.type == IKEV2_ID_TYPE_ID_KEY_ID) + vlib_cli_output(vm, " remote id-type %U data 0x%U", + format_ikev2_id_type, p->rem_id.type, + format_hex_bytes, p->rem_id.data, + vec_len(p->rem_id.data)); + else + vlib_cli_output(vm, " remote id-type %U data %v", + format_ikev2_id_type, p->rem_id.type, p->rem_id.data); + } + + if (p->loc_ts.end_addr.as_u32) + vlib_cli_output(vm, " local traffic-selector addr %U - %U port %u - %u" + " protocol %u", + format_ip4_address, &p->loc_ts.start_addr, + format_ip4_address, &p->loc_ts.end_addr, + p->loc_ts.start_port, p->loc_ts.end_port, + p->loc_ts.protocol_id); + + if (p->rem_ts.end_addr.as_u32) + vlib_cli_output(vm, " remote traffic-selector addr %U - %U port %u - %u" + " protocol %u", + format_ip4_address, &p->rem_ts.start_addr, + format_ip4_address, &p->rem_ts.end_addr, + p->rem_ts.start_port, p->rem_ts.end_port, + p->rem_ts.protocol_id); + })); + /* *INDENT-ON* */ + + return 0; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (show_ikev2_profile_command, static) = { + .path = "show ikev2 profile", + .short_help = "show ikev2 profile", + .function = show_ikev2_profile_command_fn, +}; +/* *INDENT-ON* */ + +static clib_error_t * +set_ikev2_local_key_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + clib_error_t *r = 0; + u8 *data = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "%s", &data)) + { + r = ikev2_set_local_key (vm, data); + goto done; + } + else + break; + } + + r = clib_error_return (0, "parse error: '%U'", + format_unformat_error, line_input); + +done: + vec_free (data); + unformat_free (line_input); + return r; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (set_ikev2_local_key_command, static) = { + .path = "set ikev2 local key", + .short_help = + "set ikev2 local key ", + .function = set_ikev2_local_key_command_fn, +}; +/* *INDENT-ON* */ + +clib_error_t * +ikev2_cli_init (vlib_main_t * vm) +{ + return 0; +} + +VLIB_INIT_FUNCTION (ikev2_cli_init); + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ -- cgit 1.2.3-korg