auth.c (11838B)
1 /* 2 * 3 * This license is set out in https://raw.githubusercontent.com/Broadcom-Network-Switching-Software/OpenBCM/master/Legal/LICENSE file. 4 * 5 * Copyright 2007-2019 Broadcom Inc. All rights reserved. 6 * 7 * Auth (802.1x) CLI commands 8 */ 9 10 #include <appl/diag/system.h> 11 #include <appl/diag/parse.h> 12 #include <appl/diag/dport.h> 13 #include <shared/bsl.h> 14 #include <bcm/error.h> 15 #include <bcm/auth.h> 16 #include <bcm/debug.h> 17 18 19 cmd_result_t 20 cmd_esw_auth(int unit, args_t *a) 21 { 22 char *subcmd; 23 parse_table_t pt; 24 cmd_result_t retCode; 25 int ingress; 26 uint32 mode; 27 int l2ena, ilink; 28 int port, dport, r; 29 bcm_pbmp_t pbmp; 30 bcm_port_config_t pcfg; 31 sal_mac_addr_t mac; 32 char *mac_str; 33 34 UNSUPPORTED_COMMAND(unit, SOC_CHIP_BCM5670, a); 35 UNSUPPORTED_COMMAND(unit, SOC_CHIP_BCM5675, a); 36 37 if (!sh_check_attached(ARG_CMD(a), unit)) { 38 return CMD_FAIL; 39 } 40 41 if ((subcmd = ARG_GET(a)) == NULL) { 42 return CMD_USAGE; 43 } 44 45 if (bcm_port_config_get(unit, &pcfg) != BCM_E_NONE) { 46 cli_out("%s: Error: bcm ports not initialized\n", ARG_CMD(a)); 47 return CMD_FAIL; 48 } 49 50 ingress = 0; 51 mode = 0; 52 l2ena = 0; 53 ilink = 0; 54 sal_memset(mac, 0, sizeof(sal_mac_addr_t)); 55 BCM_PBMP_CLEAR(pbmp); 56 57 if (sal_strcasecmp(subcmd, "mac") == 0) { 58 if ((subcmd = ARG_GET(a)) == NULL) 59 return CMD_USAGE; 60 61 if (sal_strcasecmp(subcmd, "init") == 0) { 62 mac_str = soc_property_get_str(unit, spn_STATION_MAC_ADDRESS); 63 if (!mac_str) { 64 cli_out("station_mac_address not set\n"); 65 return CMD_FAIL; 66 } 67 68 if (parse_macaddr(mac_str, mac) < 0 ) { 69 cli_out("ERROR: %s %s failed: No valid MAC address configured\n", 70 ARG_CMD(a), subcmd); 71 return CMD_FAIL; 72 } 73 r = bcm_auth_mac_add(unit, -1, mac); 74 if (r < 0) { 75 cli_out("ERROR: %s %s failed: %s\n", 76 ARG_CMD(a), subcmd, bcm_errmsg(r)); 77 return CMD_FAIL; 78 } 79 cli_out("All ports set to MAC address " 80 "%02x:%02x:%02x:%02x:%02x:%02x\n", 81 mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); 82 return CMD_OK; 83 } 84 85 if (sal_strcasecmp(subcmd, "add") == 0) { 86 parse_table_init(unit, &pt); 87 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 88 (void *)(0), &pbmp, NULL); 89 parse_table_add(&pt, "Mac", PQ_DFL | PQ_MAC, 0, 90 (void *)mac, 0); 91 if (!parseEndOk(a, &pt, &retCode)) 92 return retCode; 93 94 BCM_PBMP_AND(pbmp, pcfg.e); 95 /* coverity[overrun-local] */ 96 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 97 r = bcm_auth_mac_add(unit, port, mac); 98 99 if (r < 0) { 100 cli_out("ERROR: %s %s port %s failed: %s\n", 101 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 102 bcm_errmsg(r)); 103 return CMD_FAIL; 104 } 105 cli_out("port %s MAC address " 106 "%02x:%02x:%02x:%02x:%02x:%02x set.\n", 107 SOC_PORT_NAME(unit, port),mac[0],mac[1],mac[2], 108 mac[3],mac[4],mac[5]); 109 } 110 return CMD_OK; 111 } 112 113 if (sal_strcasecmp(subcmd, "del") == 0) { 114 parse_table_init(unit, &pt); 115 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 116 (void *)(0), &pbmp, NULL); 117 parse_table_add(&pt, "Mac", PQ_DFL | PQ_MAC, 0, 118 (void *)mac, 0); 119 if (!parseEndOk(a, &pt, &retCode)) 120 return retCode; 121 122 BCM_PBMP_AND(pbmp, pcfg.e); 123 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 124 r = bcm_auth_mac_delete(unit, port, mac); 125 126 if (r < 0) { 127 cli_out("ERROR: %s %s port %s failed: %s\n", 128 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 129 bcm_errmsg(r)); 130 return CMD_FAIL; 131 } 132 cli_out("port %s MAC address " 133 "%02x:%02x:%02x:%02x:%02x:%02x deleted.\n", 134 BCM_PORT_NAME(unit, port),mac[0],mac[1],mac[2], 135 mac[3],mac[4],mac[5]); 136 } 137 return CMD_OK; 138 } 139 140 if (sal_strcasecmp(subcmd, "clear") == 0) { 141 parse_table_init(unit, &pt); 142 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 143 (void *)(0), &pbmp, NULL); 144 if (!parseEndOk(a, &pt, &retCode)) 145 return retCode; 146 147 BCM_PBMP_AND(pbmp, pcfg.e); 148 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 149 r = bcm_auth_mac_delete_all(unit, port); 150 151 if (r < 0) { 152 cli_out("ERROR: %s %s port %s failed: %s\n", 153 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 154 bcm_errmsg(r)); 155 return CMD_FAIL; 156 } 157 cli_out("port %s all MAC addresses deleted.\n", 158 BCM_PORT_NAME(unit, port)); 159 } 160 return CMD_OK; 161 } 162 } 163 164 if (sal_strcasecmp(subcmd, "block") == 0) { 165 parse_table_init(unit, &pt); 166 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 167 (void *)(0), &pbmp, NULL); 168 parse_table_add(&pt, "IngressOnly", PQ_BOOL|PQ_DFL, 169 0, &ingress, 0); 170 if (!parseEndOk(a, &pt, &retCode)) 171 return retCode; 172 173 if (ingress) { 174 mode = BCM_AUTH_MODE_UNAUTH | BCM_AUTH_BLOCK_IN; 175 } 176 else { 177 mode = BCM_AUTH_MODE_UNAUTH | BCM_AUTH_BLOCK_INOUT; 178 } 179 180 BCM_PBMP_AND(pbmp, pcfg.e); 181 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 182 r = bcm_auth_mode_set(unit, port, mode); 183 184 if (r < 0) { 185 cli_out("ERROR: %s %s port %s failed: %s\n", 186 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 187 bcm_errmsg(r)); 188 return CMD_FAIL; 189 } 190 cli_out("port %s blocked in %s direction(s).\n", 191 BCM_PORT_NAME(unit, port), ingress ? "ingress" : "all"); 192 } 193 return CMD_OK; 194 } 195 196 if (sal_strcasecmp(subcmd, "unblock") == 0) { 197 parse_table_init(unit, &pt); 198 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 199 (void *)(0), &pbmp, NULL); 200 if (!parseEndOk(a, &pt, &retCode)) 201 return retCode; 202 203 mode = BCM_AUTH_MODE_UNCONTROLLED; 204 205 BCM_PBMP_AND(pbmp, pcfg.e); 206 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 207 r = bcm_auth_mode_set(unit, port, mode); 208 209 if (r < 0) { 210 cli_out("ERROR: %s %s port %s failed: %s\n", 211 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 212 bcm_errmsg(r)); 213 return CMD_FAIL; 214 } 215 cli_out("port %s unblock - all traffic allowed now.\n", 216 BCM_PORT_NAME(unit, port)); 217 } 218 return CMD_OK; 219 } 220 221 if (sal_strcasecmp(subcmd, "enable") == 0) { 222 parse_table_init(unit, &pt); 223 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 224 (void *)(0), &pbmp, NULL); 225 parse_table_add(&pt, "LearnEnable", PQ_BOOL|PQ_DFL, 226 0, &l2ena, 0); 227 parse_table_add(&pt, "IgnorLink", PQ_BOOL|PQ_DFL, 228 0, &ilink, 0); 229 if (!parseEndOk(a, &pt, &retCode)) { 230 return retCode; 231 } 232 233 mode = BCM_AUTH_MODE_AUTH; 234 if (l2ena) { 235 mode |= BCM_AUTH_LEARN; 236 } 237 if (ilink) { 238 mode |= BCM_AUTH_IGNORE_LINK; 239 } 240 241 BCM_PBMP_AND(pbmp, pcfg.e); 242 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 243 r = bcm_auth_mode_set(unit, port, mode); 244 245 if (r < 0) { 246 cli_out("ERROR: %s %s port %s failed: %s\n", 247 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 248 bcm_errmsg(r)); 249 return CMD_FAIL; 250 } 251 cli_out("port %s authorization enabled.\n", 252 BCM_PORT_NAME(unit, port)); 253 } 254 return CMD_OK; 255 } 256 257 if (sal_strcasecmp(subcmd, "disable") == 0) { 258 parse_table_init(unit, &pt); 259 parse_table_add(&pt, "PortBitMap", PQ_DFL|PQ_PBMP|PQ_BCM, 260 (void *)(0), &pbmp, NULL); 261 if (!parseEndOk( a, &pt, &retCode)) 262 return retCode; 263 264 mode = BCM_AUTH_MODE_UNAUTH | BCM_AUTH_BLOCK_INOUT; 265 266 BCM_PBMP_AND(pbmp, pcfg.e); 267 DPORT_BCM_PBMP_ITER(unit, pbmp, dport, port) { 268 r = bcm_auth_mode_set(unit, port, mode); 269 270 if (r < 0) { 271 cli_out("ERROR: %s %s port %s failed: %s\n", 272 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 273 bcm_errmsg(r)); 274 return CMD_FAIL; 275 } 276 cli_out("port %s authorization disable - no traffic allowed.\n", 277 BCM_PORT_NAME(unit, port)); 278 } 279 return CMD_OK; 280 } 281 282 if (sal_strcasecmp(subcmd, "init") == 0) { 283 if ((r = bcm_auth_init(unit)) < 0) { 284 cli_out("%s: error initializing: %s\n", ARG_CMD(a), bcm_errmsg(r)); 285 } 286 return CMD_OK; 287 } 288 289 if (sal_strcasecmp(subcmd, "detach") == 0) { 290 r = bcm_auth_detach(unit); 291 if (r < 0) { 292 cli_out("ERROR: %s %s failed: %s\n", 293 ARG_CMD(a), subcmd, bcm_errmsg(r)); 294 return CMD_FAIL; 295 } 296 return CMD_OK; 297 } 298 299 if (sal_strcasecmp(subcmd, "show") == 0) { 300 /* coverity[overrun-local] */ 301 DPORT_BCM_PBMP_ITER(unit, pcfg.e, dport, port) { 302 r = bcm_auth_mode_get(unit, port, &mode); 303 304 if (r < 0) { 305 cli_out("ERROR: %s %s port %s failed: %s\n", 306 ARG_CMD(a), subcmd, BCM_PORT_NAME(unit, port), 307 bcm_errmsg(r)); 308 return CMD_FAIL; 309 } 310 if (mode & BCM_AUTH_MODE_UNCONTROLLED) { 311 cli_out("port %s in uncontrolled state.\n", 312 BCM_PORT_NAME(unit, port)); 313 } else if (mode & BCM_AUTH_MODE_UNAUTH) { 314 cli_out("port %s is unauthorized for %s direction(s).\n", 315 BCM_PORT_NAME(unit, port), 316 (mode & BCM_AUTH_BLOCK_IN) ? "ingress" : "all"); 317 } else { 318 if (!(mode & (BCM_AUTH_LEARN|BCM_AUTH_IGNORE_LINK 319 |BCM_AUTH_IGNORE_VIOLATION))) { 320 cli_out("port %s is authorized.\n", 321 BCM_PORT_NAME(unit, port)); 322 } else { 323 cli_out("port %s is authorized with condition(s) %s%s%s\n", 324 BCM_PORT_NAME(unit, port), 325 (mode & BCM_AUTH_LEARN) ? 326 "L2LEARN " : "", 327 (mode & BCM_AUTH_IGNORE_LINK) ? 328 "IGNORE_LINK " : "", 329 (mode & BCM_AUTH_IGNORE_VIOLATION) ? 330 "IGNORE_VIOLATION " : ""); 331 } 332 } 333 } 334 return CMD_OK; 335 } 336 337 return CMD_USAGE; 338 }