ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: add insecure option for format of SA

Browse Source 
If specified, shows keys, otherwise redacts. This change sets this flag
in the existing CLI code (thus maintaining the old behavior). The use
case for not specifying the insecure flag (and thus redacting the keys
from the show output) is for log messages.

Type: feature
Signed-off-by: Christian E. Hopps <chopps@chopps.org>
Change-Id: I8c0ab6a9a8aba7c687a2559fa1a23fac9d0aa111
This commit is contained in:
Christian E. Hopps
2019-09-27 14:43:22 -04:00
committed by Neale Ranns
parent 5a2426386d
commit 01d61e7881
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/vnet/ipsec/ipsec.h
View File

@ -173,6 +173,7 @@ typedef enum ipsec_format_flags_t_
{
IPSEC_FORMAT_BRIEF = 0,
IPSEC_FORMAT_DETAIL = (1 << 0),
IPSEC_FORMAT_INSECURE = (1 << 1),
} ipsec_format_flags_t;
extern ipsec_main_t ipsec_main;

3
src/vnet/ipsec/ipsec_cli.c
View File

@ -442,7 +442,8 @@ show_ipsec_sa_command_fn (vlib_main_t * vm,
if (~0 == sai)
ipsec_sa_show_all (vm, im, detail);
else
vlib_cli_output (vm, "%U", format_ipsec_sa, sai, IPSEC_FORMAT_DETAIL);
vlib_cli_output (vm, "%U", format_ipsec_sa, sai,
IPSEC_FORMAT_DETAIL | IPSEC_FORMAT_INSECURE);
return 0;
}

8
src/vnet/ipsec/ipsec_format.c
View File

@ -298,12 +298,16 @@ format_ipsec_sa (u8 * s, va_list * args)
format_ipsec_replay_window, sa->replay_window);
s = format (s, "\n crypto alg %U",
format_ipsec_crypto_alg, sa->crypto_alg);
if (sa->crypto_alg)
if (sa->crypto_alg && (flags & IPSEC_FORMAT_INSECURE))
s = format (s, " key %U", format_ipsec_key, &sa->crypto_key);
else
s = format (s, " key [redacted]");
s = format (s, "\n integrity alg %U",
format_ipsec_integ_alg, sa->integ_alg);
if (sa->integ_alg)
if (sa->integ_alg && (flags & IPSEC_FORMAT_INSECURE))
s = format (s, " key %U", format_ipsec_key, &sa->integ_key);
else
s = format (s, " key [redacted]");
vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts);
s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes);