ipsec_format.c revision f62a8c01
1/*
2 * decap.c : IPSec tunnel support
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 *     http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
21#include <vnet/interface.h>
22#include <vnet/fib/fib_table.h>
23
24#include <vnet/ipsec/ipsec.h>
25#include <vnet/ipsec/ipsec_tun.h>
26
27u8 *
28format_ipsec_policy_action (u8 * s, va_list * args)
29{
30  u32 i = va_arg (*args, u32);
31  char *t = 0;
32
33  switch (i)
34    {
35#define _(v,f,str) case IPSEC_POLICY_ACTION_##f: t = str; break;
36      foreach_ipsec_policy_action
37#undef _
38    default:
39      s = format (s, "unknown");
40    }
41  s = format (s, "%s", t);
42  return s;
43}
44
45u8 *
46format_ipsec_policy_type (u8 * s, va_list * args)
47{
48  u32 i = va_arg (*args, u32);
49  char *t = 0;
50
51  switch (i)
52    {
53#define _(f,str) case IPSEC_SPD_POLICY_##f: t = str; break;
54      foreach_ipsec_spd_policy_type
55#undef _
56    default:
57      s = format (s, "unknown");
58    }
59  s = format (s, "%s", t);
60  return s;
61}
62
63uword
64unformat_ipsec_policy_action (unformat_input_t * input, va_list * args)
65{
66  u32 *r = va_arg (*args, u32 *);
67
68  if (0);
69#define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_POLICY_ACTION_##f;
70  foreach_ipsec_policy_action
71#undef _
72    else
73    return 0;
74  return 1;
75}
76
77u8 *
78format_ipsec_crypto_alg (u8 * s, va_list * args)
79{
80  u32 i = va_arg (*args, u32);
81  u8 *t = 0;
82
83  switch (i)
84    {
85#define _(v,f,str) case IPSEC_CRYPTO_ALG_##f: t = (u8 *) str; break;
86      foreach_ipsec_crypto_alg
87#undef _
88    default:
89      s = format (s, "unknown");
90    }
91  s = format (s, "%s", t);
92  return s;
93}
94
95uword
96unformat_ipsec_crypto_alg (unformat_input_t * input, va_list * args)
97{
98  u32 *r = va_arg (*args, u32 *);
99
100  if (0);
101#define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_CRYPTO_ALG_##f;
102  foreach_ipsec_crypto_alg
103#undef _
104    else
105    return 0;
106  return 1;
107}
108
109u8 *
110format_ipsec_integ_alg (u8 * s, va_list * args)
111{
112  u32 i = va_arg (*args, u32);
113  u8 *t = 0;
114
115  switch (i)
116    {
117#define _(v,f,str) case IPSEC_INTEG_ALG_##f: t = (u8 *) str; break;
118      foreach_ipsec_integ_alg
119#undef _
120    default:
121      s = format (s, "unknown");
122    }
123  s = format (s, "%s", t);
124  return s;
125}
126
127uword
128unformat_ipsec_integ_alg (unformat_input_t * input, va_list * args)
129{
130  u32 *r = va_arg (*args, u32 *);
131
132  if (0);
133#define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_INTEG_ALG_##f;
134  foreach_ipsec_integ_alg
135#undef _
136    else
137    return 0;
138  return 1;
139}
140
141u8 *
142format_ipsec_replay_window (u8 * s, va_list * args)
143{
144  u64 w = va_arg (*args, u64);
145  u8 i;
146
147  for (i = 0; i < 64; i++)
148    {
149      s = format (s, "%u", w & (1ULL << i) ? 1 : 0);
150    }
151
152  return s;
153}
154
155u8 *
156format_ipsec_policy (u8 * s, va_list * args)
157{
158  u32 pi = va_arg (*args, u32);
159  ip46_type_t ip_type = IP46_TYPE_IP4;
160  ipsec_main_t *im = &ipsec_main;
161  ipsec_policy_t *p;
162  vlib_counter_t counts;
163
164  p = pool_elt_at_index (im->policies, pi);
165
166  s = format (s, "  [%d] priority %d action %U type %U protocol ",
167	      pi, p->priority,
168	      format_ipsec_policy_action, p->policy,
169	      format_ipsec_policy_type, p->type);
170  if (p->protocol)
171    {
172      s = format (s, "%U", format_ip_protocol, p->protocol);
173    }
174  else
175    {
176      s = format (s, "any");
177    }
178  if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
179    {
180      s = format (s, " sa %u", p->sa_id);
181    }
182  if (p->is_ipv6)
183    {
184      ip_type = IP46_TYPE_IP6;
185    }
186
187  s = format (s, "\n     local addr range %U - %U port range %u - %u",
188	      format_ip46_address, &p->laddr.start, ip_type,
189	      format_ip46_address, &p->laddr.stop, ip_type,
190	      p->lport.start, p->lport.stop);
191  s = format (s, "\n     remote addr range %U - %U port range %u - %u",
192	      format_ip46_address, &p->raddr.start, ip_type,
193	      format_ip46_address, &p->raddr.stop, ip_type,
194	      p->rport.start, p->rport.stop);
195
196  vlib_get_combined_counter (&ipsec_spd_policy_counters, pi, &counts);
197  s = format (s, "\n     packets %u bytes %u", counts.packets, counts.bytes);
198
199  return (s);
200}
201
202u8 *
203format_ipsec_spd (u8 * s, va_list * args)
204{
205  u32 si = va_arg (*args, u32);
206  ipsec_main_t *im = &ipsec_main;
207  ipsec_spd_t *spd;
208  u32 *i;
209
210  if (pool_is_free_index (im->spds, si))
211    {
212      s = format (s, "No such SPD index: %d", si);
213      goto done;
214    }
215
216  spd = pool_elt_at_index (im->spds, si);
217
218  s = format (s, "spd %u", spd->id);
219
220#define _(v, n)                                                 \
221  s = format (s, "\n %s:", n);                                  \
222  vec_foreach(i, spd->policies[IPSEC_SPD_POLICY_##v])           \
223  {                                                             \
224    s = format (s, "\n %U", format_ipsec_policy, *i);           \
225  }
226  foreach_ipsec_spd_policy_type;
227#undef _
228
229done:
230  return (s);
231}
232
233u8 *
234format_ipsec_key (u8 * s, va_list * args)
235{
236  ipsec_key_t *key = va_arg (*args, ipsec_key_t *);
237
238  return (format (s, "%U", format_hex_bytes, key->data, key->len));
239}
240
241uword
242unformat_ipsec_key (unformat_input_t * input, va_list * args)
243{
244  ipsec_key_t *key = va_arg (*args, ipsec_key_t *);
245  u8 *data;
246
247  if (unformat (input, "%U", unformat_hex_string, &data))
248    {
249      ipsec_mk_key (key, data, vec_len (data));
250      vec_free (data);
251    }
252  else
253    return 0;
254  return 1;
255}
256
257u8 *
258format_ipsec_sa_flags (u8 * s, va_list * args)
259{
260  ipsec_sa_flags_t flags = va_arg (*args, int);
261
262#define _(v, f, str) if (flags & IPSEC_SA_FLAG_##f) s = format(s, "%s ", str);
263  foreach_ipsec_sa_flags
264#undef _
265    return (s);
266}
267
268u8 *
269format_ipsec_sa (u8 * s, va_list * args)
270{
271  u32 sai = va_arg (*args, u32);
272  ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t);
273  ipsec_main_t *im = &ipsec_main;
274  vlib_counter_t counts;
275  u32 tx_table_id;
276  ipsec_sa_t *sa;
277
278  if (pool_is_free_index (im->sad, sai))
279    {
280      s = format (s, "No such SA index: %d", sai);
281      goto done;
282    }
283
284  sa = pool_elt_at_index (im->sad, sai);
285
286  s = format (s, "[%d] sa %u (0x%x) spi %u (0x%08x) protocol:%s flags:[%U]",
287	      sai, sa->id, sa->id, sa->spi, sa->spi,
288	      sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags);
289
290  if (!(flags & IPSEC_FORMAT_DETAIL))
291    goto done;
292
293  s = format (s, "\n   locks %d", sa->node.fn_locks);
294  s = format (s, "\n   salt 0x%x", clib_net_to_host_u32 (sa->salt));
295  s = format (s, "\n   thread-indices [encrypt:%d decrypt:%d]",
296	      sa->encrypt_thread_index, sa->decrypt_thread_index);
297  s = format (s, "\n   seq %u seq-hi %u", sa->seq, sa->seq_hi);
298  s = format (s, "\n   last-seq %u last-seq-hi %u window %U",
299	      sa->last_seq, sa->last_seq_hi,
300	      format_ipsec_replay_window, sa->replay_window);
301  s = format (s, "\n   crypto alg %U",
302	      format_ipsec_crypto_alg, sa->crypto_alg);
303  if (sa->crypto_alg && (flags & IPSEC_FORMAT_INSECURE))
304    s = format (s, " key %U", format_ipsec_key, &sa->crypto_key);
305  else
306    s = format (s, " key [redacted]");
307  s = format (s, "\n   integrity alg %U",
308	      format_ipsec_integ_alg, sa->integ_alg);
309  if (sa->integ_alg && (flags & IPSEC_FORMAT_INSECURE))
310    s = format (s, " key %U", format_ipsec_key, &sa->integ_key);
311  else
312    s = format (s, " key [redacted]");
313
314  vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts);
315  s = format (s, "\n   packets %u bytes %u", counts.packets, counts.bytes);
316
317  if (ipsec_sa_is_set_IS_TUNNEL (sa))
318    {
319      tx_table_id = fib_table_get_table_id (sa->tx_fib_index,
320					    FIB_PROTOCOL_IP4);
321      s = format (s, "\n   table-ID %d tunnel src %U dst %U",
322		  tx_table_id,
323		  format_ip46_address, &sa->tunnel_src_addr, IP46_TYPE_ANY,
324		  format_ip46_address, &sa->tunnel_dst_addr, IP46_TYPE_ANY);
325      if (!ipsec_sa_is_set_IS_INBOUND (sa))
326	{
327	  s =
328	    format (s, "\n    resovle via fib-entry: %d",
329		    sa->fib_entry_index);
330	  s = format (s, "\n    stacked on:");
331	  s = format (s, "\n      %U", format_dpo_id, &sa->dpo, 6);
332	}
333    }
334
335done:
336  return (s);
337}
338
339u8 *
340format_ipsec_tun_protect (u8 * s, va_list * args)
341{
342  u32 itpi = va_arg (*args, u32);
343  ipsec_tun_protect_t *itp;
344  u32 sai;
345
346  if (pool_is_free_index (ipsec_protect_pool, itpi))
347    {
348      s = format (s, "No such tunnel index: %d", itpi);
349      goto done;
350    }
351
352  itp = pool_elt_at_index (ipsec_protect_pool, itpi);
353
354  s = format (s, "%U", format_vnet_sw_if_index_name,
355	      vnet_get_main (), itp->itp_sw_if_index);
356  s = format (s, "\n output-sa:");
357  s =
358    format (s, "\n  %U", format_ipsec_sa, itp->itp_out_sa,
359	    IPSEC_FORMAT_BRIEF);
360
361  s = format (s, "\n input-sa:");
362  /* *INDENT-OFF* */
363  FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
364  ({
365  s = format (s, "\n  %U", format_ipsec_sa, sai, IPSEC_FORMAT_BRIEF);
366  }));
367  /* *INDENT-ON* */
368
369done:
370  return (s);
371}
372
373u8 *
374format_ipsec4_tunnel_key (u8 * s, va_list * args)
375{
376  ipsec4_tunnel_key_t *key = va_arg (*args, ipsec4_tunnel_key_t *);
377
378  s = format (s, "remote:%U spi:%u (0x%08x)",
379	      format_ip4_address, &key->remote_ip,
380	      clib_net_to_host_u32 (key->spi),
381	      clib_net_to_host_u32 (key->spi));
382
383  return (s);
384}
385
386u8 *
387format_ipsec6_tunnel_key (u8 * s, va_list * args)
388{
389  ipsec6_tunnel_key_t *key = va_arg (*args, ipsec6_tunnel_key_t *);
390
391  s = format (s, "remote:%U spi:%u (0x%08x)",
392	      format_ip6_address, &key->remote_ip,
393	      clib_net_to_host_u32 (key->spi),
394	      clib_net_to_host_u32 (key->spi));
395
396  return (s);
397}
398
399/*
400 * fd.io coding-style-patch-verification: ON
401 *
402 * Local Variables:
403 * eval: (c-set-style "gnu")
404 * End:
405 */
406