src/vnet/ethernet/arp.c

   1 /*
   2  * ethernet/arp.c: IP v4 ARP node
   3  *
   4  * Copyright (c) 2010 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ip/ip.h>
  19 #include <vnet/ip/ip_neighbor.h>
  20 #include <vnet/ip/ip6.h>
  21 #include <vnet/ethernet/ethernet.h>
  22 #include <vnet/ethernet/arp.h>
  23 #include <vnet/l2/l2_input.h>
  24 #include <vppinfra/mhash.h>
  25 #include <vnet/fib/ip4_fib.h>
  26 #include <vnet/fib/fib_entry_src.h>
  27 #include <vnet/adj/adj_nbr.h>
  28 #include <vnet/adj/adj_mcast.h>
  29 #include <vnet/mpls/mpls.h>
  30 #include <vnet/l2/feat_bitmap.h>
  31
  32 #include <vlibmemory/api.h>
  33
  34 /**
  35  * @file
  36  * @brief IPv4 ARP.
  37  *
  38  * This file contains code to manage the IPv4 ARP tables (IP Address
  39  * to MAC Address lookup).
  40  */
  41
  42
  43 /**
  44  * @brief Per-interface ARP configuration and state
  45  */
  46 typedef struct ethernet_arp_interface_t_
  47 {
  48   /**
  49    * Hash table of ARP entries.
  50    * Since this hash table is per-interface, the key is only the IPv4 address.
  51    */
  52   uword *arp_entries;
  53   /**
  54    * Is ARP enabled on this interface
  55    */
  56   u32 enabled;
  57   /**
  58    * Is Proxy ARP enabled on this interface
  59    */
  60   u32 proxy_enabled;
  61 } ethernet_arp_interface_t;
  62
  63 typedef struct
  64 {
  65   ip4_address_t lo_addr;
  66   ip4_address_t hi_addr;
  67   u32 fib_index;
  68 } ethernet_proxy_arp_t;
  69
  70 typedef struct
  71 {
  72   u32 next_index;
  73   uword node_index;
  74   uword type_opaque;
  75   uword data;
  76   /* Used for arp event notification only */
  77   arp_change_event_cb_t data_callback;
  78   u32 pid;
  79 } pending_resolution_t;
  80
  81 typedef struct
  82 {
  83   /* Hash tables mapping name to opcode. */
  84   uword *opcode_by_name;
  85
  86   /* lite beer "glean" adjacency handling */
  87   uword *pending_resolutions_by_address;
  88   pending_resolution_t *pending_resolutions;
  89
  90   /* Mac address change notification */
  91   uword *mac_changes_by_address;
  92   pending_resolution_t *mac_changes;
  93
  94   ethernet_arp_ip4_entry_t *ip4_entry_pool;
  95
  96   /* ARP attack mitigation */
  97   u32 arp_delete_rotor;
  98   u32 limit_arp_cache_size;
  99
 100   /** Per interface state */
 101   ethernet_arp_interface_t *ethernet_arp_by_sw_if_index;
 102
 103   /* Proxy arp vector */
 104   ethernet_proxy_arp_t *proxy_arps;
 105
 106   uword wc_ip4_arp_publisher_node;
 107   uword wc_ip4_arp_publisher_et;
 108
 109   /* ARP feature arc index */
 110   u8 feature_arc_index;
 111 } ethernet_arp_main_t;
 112
 113 static ethernet_arp_main_t ethernet_arp_main;
 114
 115 typedef struct
 116 {
 117   u32 sw_if_index;
 118   ip4_address_t ip4;
 119   mac_address_t mac;
 120   ip_neighbor_flags_t nbr_flags;
 121   u32 flags;
 122 #define ETHERNET_ARP_ARGS_REMOVE (1<<0)
 123 #define ETHERNET_ARP_ARGS_FLUSH  (1<<1)
 124 #define ETHERNET_ARP_ARGS_POPULATE  (1<<2)
 125 #define ETHERNET_ARP_ARGS_WC_PUB  (1<<3)
 126 } vnet_arp_set_ip4_over_ethernet_rpc_args_t;
 127
 128 static const u8 vrrp_prefix[] = { 0x00, 0x00, 0x5E, 0x00, 0x01 };
 129
 130 /* Node index for send_garp_na_process */
 131 u32 send_garp_na_process_node_index;
 132
 133 static void
 134 set_ip4_over_ethernet_rpc_callback (vnet_arp_set_ip4_over_ethernet_rpc_args_t
 135                                     * a);
 136
 137 static u8 *
 138 format_ethernet_arp_hardware_type (u8 * s, va_list * va)
 139 {
 140   ethernet_arp_hardware_type_t h = va_arg (*va, ethernet_arp_hardware_type_t);
 141   char *t = 0;
 142   switch (h)
 143     {
 144 #define _(n,f) case n: t = #f; break;
 145       foreach_ethernet_arp_hardware_type;
 146 #undef _
 147
 148     default:
 149       return format (s, "unknown 0x%x", h);
 150     }
 151
 152   return format (s, "%s", t);
 153 }
 154
 155 static u8 *
 156 format_ethernet_arp_opcode (u8 * s, va_list * va)
 157 {
 158   ethernet_arp_opcode_t o = va_arg (*va, ethernet_arp_opcode_t);
 159   char *t = 0;
 160   switch (o)
 161     {
 162 #define _(f) case ETHERNET_ARP_OPCODE_##f: t = #f; break;
 163       foreach_ethernet_arp_opcode;
 164 #undef _
 165
 166     default:
 167       return format (s, "unknown 0x%x", o);
 168     }
 169
 170   return format (s, "%s", t);
 171 }
 172
 173 static uword
 174 unformat_ethernet_arp_opcode_host_byte_order (unformat_input_t * input,
 175                                               va_list * args)
 176 {
 177   int *result = va_arg (*args, int *);
 178   ethernet_arp_main_t *am = &ethernet_arp_main;
 179   int x, i;
 180
 181   /* Numeric opcode. */
 182   if (unformat (input, "0x%x", &x) || unformat (input, "%d", &x))
 183     {
 184       if (x >= (1 << 16))
 185         return 0;
 186       *result = x;
 187       return 1;
 188     }
 189
 190   /* Named type. */
 191   if (unformat_user (input, unformat_vlib_number_by_name,
 192                      am->opcode_by_name, &i))
 193     {
 194       *result = i;
 195       return 1;
 196     }
 197
 198   return 0;
 199 }
 200
 201 static uword
 202 unformat_ethernet_arp_opcode_net_byte_order (unformat_input_t * input,
 203                                              va_list * args)
 204 {
 205   int *result = va_arg (*args, int *);
 206   if (!unformat_user
 207       (input, unformat_ethernet_arp_opcode_host_byte_order, result))
 208     return 0;
 209
 210   *result = clib_host_to_net_u16 ((u16) * result);
 211   return 1;
 212 }
 213
 214 static u8 *
 215 format_ethernet_arp_header (u8 * s, va_list * va)
 216 {
 217   ethernet_arp_header_t *a = va_arg (*va, ethernet_arp_header_t *);
 218   u32 max_header_bytes = va_arg (*va, u32);
 219   u32 indent;
 220   u16 l2_type, l3_type;
 221
 222   if (max_header_bytes != 0 && sizeof (a[0]) > max_header_bytes)
 223     return format (s, "ARP header truncated");
 224
 225   l2_type = clib_net_to_host_u16 (a->l2_type);
 226   l3_type = clib_net_to_host_u16 (a->l3_type);
 227
 228   indent = format_get_indent (s);
 229
 230   s = format (s, "%U, type %U/%U, address size %d/%d",
 231               format_ethernet_arp_opcode, clib_net_to_host_u16 (a->opcode),
 232               format_ethernet_arp_hardware_type, l2_type,
 233               format_ethernet_type, l3_type,
 234               a->n_l2_address_bytes, a->n_l3_address_bytes);
 235
 236   if (l2_type == ETHERNET_ARP_HARDWARE_TYPE_ethernet
 237       && l3_type == ETHERNET_TYPE_IP4)
 238     {
 239       s = format (s, "\n%U%U/%U -> %U/%U",
 240                   format_white_space, indent,
 241                   format_mac_address_t, &a->ip4_over_ethernet[0].mac,
 242                   format_ip4_address, &a->ip4_over_ethernet[0].ip4,
 243                   format_mac_address_t, &a->ip4_over_ethernet[1].mac,
 244                   format_ip4_address, &a->ip4_over_ethernet[1].ip4);
 245     }
 246   else
 247     {
 248       uword n2 = a->n_l2_address_bytes;
 249       uword n3 = a->n_l3_address_bytes;
 250       s = format (s, "\n%U%U/%U -> %U/%U",
 251                   format_white_space, indent,
 252                   format_hex_bytes, a->data + 0 * n2 + 0 * n3, n2,
 253                   format_hex_bytes, a->data + 1 * n2 + 0 * n3, n3,
 254                   format_hex_bytes, a->data + 1 * n2 + 1 * n3, n2,
 255                   format_hex_bytes, a->data + 2 * n2 + 1 * n3, n3);
 256     }
 257
 258   return s;
 259 }
 260
 261 u8 *
 262 format_ethernet_arp_ip4_entry (u8 * s, va_list * va)
 263 {
 264   vnet_main_t *vnm = va_arg (*va, vnet_main_t *);
 265   ethernet_arp_ip4_entry_t *e = va_arg (*va, ethernet_arp_ip4_entry_t *);
 266   vnet_sw_interface_t *si;
 267
 268   if (!e)
 269     return format (s, "%=12s%=16s%=6s%=20s%=24s", "Time", "IP4",
 270                    "Flags", "Ethernet", "Interface");
 271
 272   si = vnet_get_sw_interface (vnm, e->sw_if_index);
 273
 274   return format (s, "%=12U%=16U%=6U%=20U%U",
 275                  format_vlib_time, vnm->vlib_main, e->time_last_updated,
 276                  format_ip4_address, &e->ip4_address,
 277                  format_ip_neighbor_flags, e->flags,
 278                  format_mac_address_t, &e->mac,
 279                  format_vnet_sw_interface_name, vnm, si);
 280 }
 281
 282 typedef struct
 283 {
 284   u8 packet_data[64];
 285 } ethernet_arp_input_trace_t;
 286
 287 static u8 *
 288 format_ethernet_arp_input_trace (u8 * s, va_list * va)
 289 {
 290   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
 291   CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
 292   ethernet_arp_input_trace_t *t = va_arg (*va, ethernet_arp_input_trace_t *);
 293
 294   s = format (s, "%U",
 295               format_ethernet_arp_header,
 296               t->packet_data, sizeof (t->packet_data));
 297
 298   return s;
 299 }
 300
 301 static u8 *
 302 format_arp_term_input_trace (u8 * s, va_list * va)
 303 {
 304   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
 305   CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
 306   ethernet_arp_input_trace_t *t = va_arg (*va, ethernet_arp_input_trace_t *);
 307
 308   /* arp-term trace data saved is either arp or ip6/icmp6 packet:
 309      - for arp, the 1st 16-bit field is hw type of value of 0x0001.
 310      - for ip6, the first nibble has value of 6. */
 311   s = format (s, "%U", t->packet_data[0] == 0 ?
 312               format_ethernet_arp_header : format_ip6_header,
 313               t->packet_data, sizeof (t->packet_data));
 314
 315   return s;
 316 }
 317
 318 static void
 319 arp_nbr_probe (ip_adjacency_t * adj)
 320 {
 321   vnet_main_t *vnm = vnet_get_main ();
 322   ip4_main_t *im = &ip4_main;
 323   ip_interface_address_t *ia;
 324   ethernet_arp_header_t *h;
 325   vnet_hw_interface_t *hi;
 326   vnet_sw_interface_t *si;
 327   ip4_address_t *src;
 328   vlib_buffer_t *b;
 329   vlib_main_t *vm;
 330   u32 bi = 0;
 331
 332   vm = vlib_get_main ();
 333
 334   si = vnet_get_sw_interface (vnm, adj->rewrite_header.sw_if_index);
 335
 336   if (!(si->flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP))
 337     {
 338       return;
 339     }
 340
 341   src =
 342     ip4_interface_address_matching_destination (im,
 343                                                 &adj->sub_type.nbr.next_hop.
 344                                                 ip4,
 345                                                 adj->rewrite_header.
 346                                                 sw_if_index, &ia);
 347   if (!src)
 348     {
 349       return;
 350     }
 351
 352   h =
 353     vlib_packet_template_get_packet (vm, &im->ip4_arp_request_packet_template,
 354                                      &bi);
 355   if (!h)
 356     return;
 357
 358   hi = vnet_get_sup_hw_interface (vnm, adj->rewrite_header.sw_if_index);
 359
 360   mac_address_from_bytes (&h->ip4_over_ethernet[0].mac, hi->hw_address);
 361
 362   h->ip4_over_ethernet[0].ip4 = src[0];
 363   h->ip4_over_ethernet[1].ip4 = adj->sub_type.nbr.next_hop.ip4;
 364
 365   b = vlib_get_buffer (vm, bi);
 366   vnet_buffer (b)->sw_if_index[VLIB_RX] =
 367     vnet_buffer (b)->sw_if_index[VLIB_TX] = adj->rewrite_header.sw_if_index;
 368
 369   /* Add encapsulation string for software interface (e.g. ethernet header). */
 370   vnet_rewrite_one_header (adj[0], h, sizeof (ethernet_header_t));
 371   vlib_buffer_advance (b, -adj->rewrite_header.data_bytes);
 372
 373   {
 374     vlib_frame_t *f = vlib_get_frame_to_node (vm, hi->output_node_index);
 375     u32 *to_next = vlib_frame_vector_args (f);
 376     to_next[0] = bi;
 377     f->n_vectors = 1;
 378     vlib_put_frame_to_node (vm, hi->output_node_index, f);
 379   }
 380 }
 381
 382 static void
 383 arp_mk_complete (adj_index_t ai, ethernet_arp_ip4_entry_t * e)
 384 {
 385   adj_nbr_update_rewrite
 386     (ai, ADJ_NBR_REWRITE_FLAG_COMPLETE,
 387      ethernet_build_rewrite (vnet_get_main (),
 388                              e->sw_if_index,
 389                              adj_get_link_type (ai), &e->mac));
 390 }
 391
 392 static void
 393 arp_mk_incomplete (adj_index_t ai)
 394 {
 395   ip_adjacency_t *adj = adj_get (ai);
 396
 397   adj_nbr_update_rewrite
 398     (ai,
 399      ADJ_NBR_REWRITE_FLAG_INCOMPLETE,
 400      ethernet_build_rewrite (vnet_get_main (),
 401                              adj->rewrite_header.sw_if_index,
 402                              VNET_LINK_ARP,
 403                              VNET_REWRITE_FOR_SW_INTERFACE_ADDRESS_BROADCAST));
 404 }
 405
 406 static ethernet_arp_ip4_entry_t *
 407 arp_entry_find (ethernet_arp_interface_t * eai, const ip4_address_t * addr)
 408 {
 409   ethernet_arp_main_t *am = &ethernet_arp_main;
 410   ethernet_arp_ip4_entry_t *e = NULL;
 411   uword *p;
 412
 413   if (NULL != eai->arp_entries)
 414     {
 415       p = hash_get (eai->arp_entries, addr->as_u32);
 416       if (!p)
 417         return (NULL);
 418
 419       e = pool_elt_at_index (am->ip4_entry_pool, p[0]);
 420     }
 421
 422   return (e);
 423 }
 424
 425 static adj_walk_rc_t
 426 arp_mk_complete_walk (adj_index_t ai, void *ctx)
 427 {
 428   ethernet_arp_ip4_entry_t *e = ctx;
 429
 430   arp_mk_complete (ai, e);
 431
 432   return (ADJ_WALK_RC_CONTINUE);
 433 }
 434
 435 static adj_walk_rc_t
 436 arp_mk_incomplete_walk (adj_index_t ai, void *ctx)
 437 {
 438   arp_mk_incomplete (ai);
 439
 440   return (ADJ_WALK_RC_CONTINUE);
 441 }
 442
 443 static int
 444 arp_is_enabled (ethernet_arp_main_t * am, u32 sw_if_index)
 445 {
 446   if (vec_len (am->ethernet_arp_by_sw_if_index) <= sw_if_index)
 447     return 0;
 448
 449   return (am->ethernet_arp_by_sw_if_index[sw_if_index].enabled);
 450 }
 451
 452 static void
 453 arp_enable (ethernet_arp_main_t * am, u32 sw_if_index)
 454 {
 455   if (arp_is_enabled (am, sw_if_index))
 456     return;
 457
 458   vec_validate (am->ethernet_arp_by_sw_if_index, sw_if_index);
 459
 460   am->ethernet_arp_by_sw_if_index[sw_if_index].enabled = 1;
 461
 462   vnet_feature_enable_disable ("arp", "arp-reply", sw_if_index, 1, NULL, 0);
 463 }
 464
 465 static int
 466 vnet_arp_flush_ip4_over_ethernet_internal (vnet_main_t * vnm,
 467                                            vnet_arp_set_ip4_over_ethernet_rpc_args_t
 468                                            * args);
 469
 470 static void
 471 arp_disable (ethernet_arp_main_t * am, u32 sw_if_index)
 472 {
 473   ethernet_arp_interface_t *eai;
 474   ethernet_arp_ip4_entry_t *e;
 475   u32 i, *to_delete = 0;
 476   hash_pair_t *pair;
 477
 478   if (!arp_is_enabled (am, sw_if_index))
 479     return;
 480
 481   vnet_feature_enable_disable ("arp", "arp-reply", sw_if_index, 0, NULL, 0);
 482
 483   eai = &am->ethernet_arp_by_sw_if_index[sw_if_index];
 484
 485
 486   /* *INDENT-OFF* */
 487   hash_foreach_pair (pair, eai->arp_entries,
 488   ({
 489     e = pool_elt_at_index(am->ip4_entry_pool,
 490                           pair->value[0]);
 491     vec_add1 (to_delete, e - am->ip4_entry_pool);
 492   }));
 493   /* *INDENT-ON* */
 494
 495   for (i = 0; i < vec_len (to_delete); i++)
 496     {
 497       e = pool_elt_at_index (am->ip4_entry_pool, to_delete[i]);
 498
 499       vnet_arp_set_ip4_over_ethernet_rpc_args_t delme = {
 500         .ip4.as_u32 = e->ip4_address.as_u32,
 501         .sw_if_index = e->sw_if_index,
 502         .flags = ETHERNET_ARP_ARGS_FLUSH,
 503       };
 504       mac_address_copy (&delme.mac, &e->mac);
 505
 506       vnet_arp_flush_ip4_over_ethernet_internal (vnet_get_main (), &delme);
 507     }
 508
 509   vec_free (to_delete);
 510
 511   eai->enabled = 0;
 512 }
 513
 514 void
 515 arp_update_adjacency (vnet_main_t * vnm, u32 sw_if_index, u32 ai)
 516 {
 517   ethernet_arp_main_t *am = &ethernet_arp_main;
 518   ethernet_arp_interface_t *arp_int;
 519   ethernet_arp_ip4_entry_t *e;
 520   ip_adjacency_t *adj;
 521
 522   adj = adj_get (ai);
 523
 524   arp_enable (am, sw_if_index);
 525   arp_int = &am->ethernet_arp_by_sw_if_index[sw_if_index];
 526   e = arp_entry_find (arp_int, &adj->sub_type.nbr.next_hop.ip4);
 527
 528   switch (adj->lookup_next_index)
 529     {
 530     case IP_LOOKUP_NEXT_GLEAN:
 531       adj_glean_update_rewrite (ai);
 532       break;
 533     case IP_LOOKUP_NEXT_ARP:
 534       if (NULL != e)
 535         {
 536           adj_nbr_walk_nh4 (sw_if_index,
 537                             &e->ip4_address, arp_mk_complete_walk, e);
 538         }
 539       else
 540         {
 541           /*
 542            * no matching ARP entry.
 543            * construct the rewrite required to for an ARP packet, and stick
 544            * that in the adj's pipe to smoke.
 545            */
 546           adj_nbr_update_rewrite
 547             (ai,
 548              ADJ_NBR_REWRITE_FLAG_INCOMPLETE,
 549              ethernet_build_rewrite
 550              (vnm,
 551               sw_if_index,
 552               VNET_LINK_ARP,
 553               VNET_REWRITE_FOR_SW_INTERFACE_ADDRESS_BROADCAST));
 554
 555           /*
 556            * since the FIB has added this adj for a route, it makes sense it
 557            * may want to forward traffic sometime soon. Let's send a
 558            * speculative ARP. just one. If we were to do periodically that
 559            * wouldn't be bad either, but that's more code than i'm prepared to
 560            * write at this time for relatively little reward.
 561            */
 562           arp_nbr_probe (adj);
 563         }
 564       break;
 565     case IP_LOOKUP_NEXT_BCAST:
 566       adj_nbr_update_rewrite (ai,
 567                               ADJ_NBR_REWRITE_FLAG_COMPLETE,
 568                               ethernet_build_rewrite
 569                               (vnm,
 570                                sw_if_index,
 571                                VNET_LINK_IP4,
 572                                VNET_REWRITE_FOR_SW_INTERFACE_ADDRESS_BROADCAST));
 573       break;
 574     case IP_LOOKUP_NEXT_MCAST:
 575       {
 576         /*
 577          * Construct a partial rewrite from the known ethernet mcast dest MAC
 578          */
 579         u8 *rewrite;
 580         u8 offset;
 581
 582         rewrite = ethernet_build_rewrite (vnm,
 583                                           sw_if_index,
 584                                           adj->ia_link,
 585                                           ethernet_ip4_mcast_dst_addr ());
 586         offset = vec_len (rewrite) - 2;
 587
 588         /*
 589          * Complete the remaining fields of the adj's rewrite to direct the
 590          * complete of the rewrite at switch time by copying in the IP
 591          * dst address's bytes.
 592          * Offset is 2 bytes into the MAC destination address.
 593          */
 594         adj_mcast_update_rewrite (ai, rewrite, offset);
 595
 596         break;
 597       }
 598     case IP_LOOKUP_NEXT_DROP:
 599     case IP_LOOKUP_NEXT_PUNT:
 600     case IP_LOOKUP_NEXT_LOCAL:
 601     case IP_LOOKUP_NEXT_REWRITE:
 602     case IP_LOOKUP_NEXT_MCAST_MIDCHAIN:
 603     case IP_LOOKUP_NEXT_MIDCHAIN:
 604     case IP_LOOKUP_NEXT_ICMP_ERROR:
 605     case IP_LOOKUP_N_NEXT:
 606       ASSERT (0);
 607       break;
 608     }
 609 }
 610
 611 static void
 612 arp_adj_fib_add (ethernet_arp_ip4_entry_t * e, u32 fib_index)
 613 {
 614   fib_prefix_t pfx = {
 615     .fp_len = 32,
 616     .fp_proto = FIB_PROTOCOL_IP4,
 617     .fp_addr.ip4 = e->ip4_address,
 618   };
 619
 620   e->fib_entry_index =
 621     fib_table_entry_path_add (fib_index, &pfx, FIB_SOURCE_ADJ,
 622                               FIB_ENTRY_FLAG_ATTACHED,
 623                               DPO_PROTO_IP4, &pfx.fp_addr,
 624                               e->sw_if_index, ~0, 1, NULL,
 625                               FIB_ROUTE_PATH_FLAG_NONE);
 626   fib_table_lock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_ADJ);
 627 }
 628
 629 static void
 630 arp_adj_fib_remove (ethernet_arp_ip4_entry_t * e, u32 fib_index)
 631 {
 632   if (FIB_NODE_INDEX_INVALID != e->fib_entry_index)
 633     {
 634       fib_prefix_t pfx = {
 635         .fp_len = 32,
 636         .fp_proto = FIB_PROTOCOL_IP4,
 637         .fp_addr.ip4 = e->ip4_address,
 638       };
 639       u32 fib_index;
 640
 641       fib_index = ip4_fib_table_get_index_for_sw_if_index (e->sw_if_index);
 642
 643       fib_table_entry_path_remove (fib_index, &pfx,
 644                                    FIB_SOURCE_ADJ,
 645                                    DPO_PROTO_IP4,
 646                                    &pfx.fp_addr,
 647                                    e->sw_if_index, ~0, 1,
 648                                    FIB_ROUTE_PATH_FLAG_NONE);
 649       fib_table_unlock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_ADJ);
 650     }
 651 }
 652
 653 static ethernet_arp_ip4_entry_t *
 654 force_reuse_arp_entry (void)
 655 {
 656   ethernet_arp_ip4_entry_t *e;
 657   ethernet_arp_main_t *am = &ethernet_arp_main;
 658   u32 count = 0;
 659   u32 index = pool_next_index (am->ip4_entry_pool, am->arp_delete_rotor);
 660   if (index == ~0)              /* Try again from elt 0 */
 661     index = pool_next_index (am->ip4_entry_pool, index);
 662
 663   /* Find a non-static random entry to free up for reuse */
 664   do
 665     {
 666       if ((count++ == 100) || (index == ~0))
 667         return NULL;            /* give up after 100 entries */
 668       e = pool_elt_at_index (am->ip4_entry_pool, index);
 669       am->arp_delete_rotor = index;
 670       index = pool_next_index (am->ip4_entry_pool, index);
 671     }
 672   while (e->flags & IP_NEIGHBOR_FLAG_STATIC);
 673
 674   /* Remove ARP entry from its interface and update fib */
 675   hash_unset
 676     (am->ethernet_arp_by_sw_if_index[e->sw_if_index].arp_entries,
 677      e->ip4_address.as_u32);
 678   arp_adj_fib_remove
 679     (e, ip4_fib_table_get_index_for_sw_if_index (e->sw_if_index));
 680   adj_nbr_walk_nh4 (e->sw_if_index,
 681                     &e->ip4_address, arp_mk_incomplete_walk, e);
 682   return e;
 683 }
 684
 685 static int
 686 vnet_arp_set_ip4_over_ethernet_internal (vnet_main_t * vnm,
 687                                          vnet_arp_set_ip4_over_ethernet_rpc_args_t
 688                                          * args)
 689 {
 690   ethernet_arp_ip4_entry_t *e = 0;
 691   ethernet_arp_main_t *am = &ethernet_arp_main;
 692   vlib_main_t *vm = vlib_get_main ();
 693   int make_new_arp_cache_entry = 1;
 694   uword *p;
 695   pending_resolution_t *pr, *mc;
 696   ethernet_arp_interface_t *arp_int;
 697   u32 sw_if_index = args->sw_if_index;
 698
 699   arp_enable (am, sw_if_index);
 700
 701   arp_int = &am->ethernet_arp_by_sw_if_index[sw_if_index];
 702
 703   if (NULL != arp_int->arp_entries)
 704     {
 705       p = hash_get (arp_int->arp_entries, args->ip4.as_u32);
 706       if (p)
 707         {
 708           e = pool_elt_at_index (am->ip4_entry_pool, p[0]);
 709
 710           /* Refuse to over-write static arp. */
 711           if (!(args->nbr_flags & IP_NEIGHBOR_FLAG_STATIC) &&
 712               (e->flags & IP_NEIGHBOR_FLAG_STATIC))
 713             {
 714               /* if MAC address match, still check to send event */
 715               if (mac_address_equal (&e->mac, &args->mac))
 716                 goto check_customers;
 717               return -2;
 718             }
 719           make_new_arp_cache_entry = 0;
 720         }
 721     }
 722
 723   if (make_new_arp_cache_entry)
 724     {
 725       if (am->limit_arp_cache_size &&
 726           pool_elts (am->ip4_entry_pool) >= am->limit_arp_cache_size)
 727         {
 728           e = force_reuse_arp_entry ();
 729           if (NULL == e)
 730             return -2;
 731         }
 732       else
 733         pool_get (am->ip4_entry_pool, e);
 734
 735       if (NULL == arp_int->arp_entries)
 736         arp_int->arp_entries = hash_create (0, sizeof (u32));
 737
 738       hash_set (arp_int->arp_entries, args->ip4.as_u32,
 739                 e - am->ip4_entry_pool);
 740
 741       e->sw_if_index = sw_if_index;
 742       e->ip4_address = args->ip4;
 743       e->fib_entry_index = FIB_NODE_INDEX_INVALID;
 744       mac_address_copy (&e->mac, &args->mac);
 745
 746       if (!(args->nbr_flags & IP_NEIGHBOR_FLAG_NO_FIB_ENTRY))
 747         {
 748           arp_adj_fib_add (e,
 749                            ip4_fib_table_get_index_for_sw_if_index
 750                            (e->sw_if_index));
 751         }
 752       else
 753         {
 754           e->flags |= IP_NEIGHBOR_FLAG_NO_FIB_ENTRY;
 755         }
 756     }
 757   else
 758     {
 759       /*
 760        * prevent a DoS attack from the data-plane that
 761        * spams us with no-op updates to the MAC address
 762        */
 763       if (mac_address_equal (&e->mac, &args->mac))
 764         {
 765           e->time_last_updated = vlib_time_now (vm);
 766           goto check_customers;
 767         }
 768
 769       /* Update ethernet address. */
 770       mac_address_copy (&e->mac, &args->mac);
 771     }
 772
 773   /* Update time stamp and flags. */
 774   e->time_last_updated = vlib_time_now (vm);
 775   if (args->nbr_flags & IP_NEIGHBOR_FLAG_STATIC)
 776     {
 777       e->flags &= ~IP_NEIGHBOR_FLAG_DYNAMIC;
 778       e->flags |= IP_NEIGHBOR_FLAG_STATIC;
 779     }
 780   else
 781     {
 782       e->flags &= ~IP_NEIGHBOR_FLAG_STATIC;
 783       e->flags |= IP_NEIGHBOR_FLAG_DYNAMIC;
 784     }
 785
 786   adj_nbr_walk_nh4 (sw_if_index, &e->ip4_address, arp_mk_complete_walk, e);
 787
 788 check_customers:
 789   /* Customer(s) waiting for this address to be resolved? */
 790   p = hash_get (am->pending_resolutions_by_address, args->ip4.as_u32);
 791   if (p)
 792     {
 793       u32 next_index;
 794       next_index = p[0];
 795
 796       while (next_index != (u32) ~ 0)
 797         {
 798           pr = pool_elt_at_index (am->pending_resolutions, next_index);
 799           vlib_process_signal_event (vm, pr->node_index,
 800                                      pr->type_opaque, pr->data);
 801           next_index = pr->next_index;
 802           pool_put (am->pending_resolutions, pr);
 803         }
 804
 805       hash_unset (am->pending_resolutions_by_address, args->ip4.as_u32);
 806     }
 807
 808   /* Customer(s) requesting ARP event for this address? */
 809   p = hash_get (am->mac_changes_by_address, args->ip4.as_u32);
 810   if (p)
 811     {
 812       u32 next_index;
 813       next_index = p[0];
 814
 815       while (next_index != (u32) ~ 0)
 816         {
 817           int rv = 1;
 818           mc = pool_elt_at_index (am->mac_changes, next_index);
 819
 820           /* Call the user's data callback, return 1 to suppress dup events */
 821           if (mc->data_callback)
 822             rv = (mc->data_callback) (mc->data, &args->mac, sw_if_index, 0);
 823
 824           /*
 825            * Signal the resolver process, as long as the user
 826            * says they want to be notified
 827            */
 828           if (rv == 0)
 829             vlib_process_signal_event (vm, mc->node_index,
 830                                        mc->type_opaque, mc->data);
 831           next_index = mc->next_index;
 832         }
 833     }
 834
 835   return 0;
 836 }
 837
 838 void
 839 vnet_register_ip4_arp_resolution_event (vnet_main_t * vnm,
 840                                         void *address_arg,
 841                                         uword node_index,
 842                                         uword type_opaque, uword data)
 843 {
 844   ethernet_arp_main_t *am = &ethernet_arp_main;
 845   ip4_address_t *address = address_arg;
 846   uword *p;
 847   pending_resolution_t *pr;
 848
 849   pool_get (am->pending_resolutions, pr);
 850
 851   pr->next_index = ~0;
 852   pr->node_index = node_index;
 853   pr->type_opaque = type_opaque;
 854   pr->data = data;
 855   pr->data_callback = 0;
 856
 857   p = hash_get (am->pending_resolutions_by_address, address->as_u32);
 858   if (p)
 859     {
 860       /* Insert new resolution at the head of the list */
 861       pr->next_index = p[0];
 862       hash_unset (am->pending_resolutions_by_address, address->as_u32);
 863     }
 864
 865   hash_set (am->pending_resolutions_by_address, address->as_u32,
 866             pr - am->pending_resolutions);
 867 }
 868
 869 int
 870 vnet_add_del_ip4_arp_change_event (vnet_main_t * vnm,
 871                                    arp_change_event_cb_t data_callback,
 872                                    u32 pid,
 873                                    void *address_arg,
 874                                    uword node_index,
 875                                    uword type_opaque, uword data, int is_add)
 876 {
 877   ethernet_arp_main_t *am = &ethernet_arp_main;
 878   ip4_address_t *address = address_arg;
 879
 880   /* Try to find an existing entry */
 881   u32 *first = (u32 *) hash_get (am->mac_changes_by_address, address->as_u32);
 882   u32 *p = first;
 883   pending_resolution_t *mc;
 884   while (p && *p != ~0)
 885     {
 886       mc = pool_elt_at_index (am->mac_changes, *p);
 887       if (mc->node_index == node_index && mc->type_opaque == type_opaque
 888           && mc->pid == pid)
 889         break;
 890       p = &mc->next_index;
 891     }
 892
 893   int found = p && *p != ~0;
 894   if (is_add)
 895     {
 896       if (found)
 897         return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
 898
 899       pool_get (am->mac_changes, mc);
 900       /* *INDENT-OFF* */
 901       *mc = (pending_resolution_t)
 902       {
 903         .next_index = ~0,
 904         .node_index = node_index,
 905         .type_opaque = type_opaque,
 906         .data = data,
 907         .data_callback = data_callback,
 908         .pid = pid,
 909       };
 910       /* *INDENT-ON* */
 911
 912       /* Insert new resolution at the end of the list */
 913       u32 new_idx = mc - am->mac_changes;
 914       if (p)
 915         p[0] = new_idx;
 916       else
 917         hash_set (am->mac_changes_by_address, address->as_u32, new_idx);
 918     }
 919   else
 920     {
 921       if (!found)
 922         return VNET_API_ERROR_NO_SUCH_ENTRY;
 923
 924       /* Clients may need to clean up pool entries, too */
 925       if (data_callback)
 926         /* no new mac addrs */
 927         (data_callback) (mc->data, NULL, ~0, NULL);
 928
 929       /* Remove the entry from the list and delete the entry */
 930       *p = mc->next_index;
 931       pool_put (am->mac_changes, mc);
 932
 933       /* Remove from hash if we deleted the last entry */
 934       if (*p == ~0 && p == first)
 935         hash_unset (am->mac_changes_by_address, address->as_u32);
 936     }
 937   return 0;
 938 }
 939
 940 /* Either we drop the packet or we send a reply to the sender. */
 941 typedef enum
 942 {
 943   ARP_REPLY_NEXT_DROP,
 944   ARP_REPLY_NEXT_REPLY_TX,
 945   ARP_REPLY_N_NEXT,
 946 } arp_reply_next_t;
 947
 948 #define foreach_ethernet_arp_error                                      \
 949   _ (replies_sent, "ARP replies sent")                                  \
 950   _ (l2_type_not_ethernet, "L2 type not ethernet")                      \
 951   _ (l3_type_not_ip4, "L3 type not IP4")                                \
 952   _ (l3_src_address_not_local, "IP4 source address not local to subnet") \
 953   _ (l3_dst_address_not_local, "IP4 destination address not local to subnet") \
 954   _ (l3_dst_address_unset, "IP4 destination address is unset")          \
 955   _ (l3_src_address_is_local, "IP4 source address matches local interface") \
 956   _ (l3_src_address_learned, "ARP request IP4 source address learned")  \
 957   _ (replies_received, "ARP replies received")                          \
 958   _ (opcode_not_request, "ARP opcode not request")                      \
 959   _ (proxy_arp_replies_sent, "Proxy ARP replies sent")                  \
 960   _ (l2_address_mismatch, "ARP hw addr does not match L2 frame src addr") \
 961   _ (gratuitous_arp, "ARP probe or announcement dropped") \
 962   _ (interface_no_table, "Interface is not mapped to an IP table") \
 963   _ (interface_not_ip_enabled, "Interface is not IP enabled") \
 964   _ (unnumbered_mismatch, "RX interface is unnumbered to different subnet") \
 965
 966 typedef enum
 967 {
 968 #define _(sym,string) ETHERNET_ARP_ERROR_##sym,
 969   foreach_ethernet_arp_error
 970 #undef _
 971     ETHERNET_ARP_N_ERROR,
 972 } ethernet_arp_reply_error_t;
 973
 974 static int
 975 arp_unnumbered (vlib_buffer_t * p0,
 976                 u32 input_sw_if_index, u32 conn_sw_if_index)
 977 {
 978   vnet_main_t *vnm = vnet_get_main ();
 979   vnet_interface_main_t *vim = &vnm->interface_main;
 980   vnet_sw_interface_t *si;
 981
 982   /* verify that the input interface is unnumbered to the connected.
 983    * the connected interface is the interface on which the subnet is
 984    * configured */
 985   si = &vim->sw_interfaces[input_sw_if_index];
 986
 987   if (!(si->flags & VNET_SW_INTERFACE_FLAG_UNNUMBERED &&
 988         (si->unnumbered_sw_if_index == conn_sw_if_index)))
 989     {
 990       /* the input interface is not unnumbered to the interface on which
 991        * the sub-net is configured that covers the ARP request.
 992        * So this is not the case for unnumbered.. */
 993       return 0;
 994     }
 995
 996   return !0;
 997 }
 998
 999 static u32
1000 arp_learn (vnet_main_t * vnm,
1001            ethernet_arp_main_t * am, u32 sw_if_index,
1002            const ethernet_arp_ip4_over_ethernet_address_t * addr)
1003 {
1004   vnet_arp_set_ip4_over_ethernet (vnm, sw_if_index, addr, 0);
1005   return (ETHERNET_ARP_ERROR_l3_src_address_learned);
1006 }
1007
1008 typedef enum arp_input_next_t_
1009 {
1010   ARP_INPUT_NEXT_DROP,
1011   ARP_INPUT_NEXT_DISABLED,
1012   ARP_INPUT_N_NEXT,
1013 } arp_input_next_t;
1014
1015 static uword
1016 arp_input (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
1017 {
1018   u32 n_left_from, next_index, *from, *to_next, n_left_to_next;
1019   ethernet_arp_main_t *am = &ethernet_arp_main;
1020
1021   from = vlib_frame_vector_args (frame);
1022   n_left_from = frame->n_vectors;
1023   next_index = node->cached_next_index;
1024
1025   if (node->flags & VLIB_NODE_FLAG_TRACE)
1026     vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
1027                                    /* stride */ 1,
1028                                    sizeof (ethernet_arp_input_trace_t));
1029
1030   while (n_left_from > 0)
1031     {
1032       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
1033
1034       while (n_left_from > 0 && n_left_to_next > 0)
1035         {
1036           const ethernet_arp_header_t *arp0;
1037           arp_input_next_t next0;
1038           vlib_buffer_t *p0;
1039           u32 pi0, error0;
1040
1041           pi0 = to_next[0] = from[0];
1042           from += 1;
1043           to_next += 1;
1044           n_left_from -= 1;
1045           n_left_to_next -= 1;
1046
1047           p0 = vlib_get_buffer (vm, pi0);
1048           arp0 = vlib_buffer_get_current (p0);
1049
1050           error0 = ETHERNET_ARP_ERROR_replies_sent;
1051           next0 = ARP_INPUT_NEXT_DROP;
1052
1053           error0 =
1054             (arp0->l2_type !=
1055              clib_net_to_host_u16 (ETHERNET_ARP_HARDWARE_TYPE_ethernet) ?
1056              ETHERNET_ARP_ERROR_l2_type_not_ethernet : error0);
1057           error0 =
1058             (arp0->l3_type !=
1059              clib_net_to_host_u16 (ETHERNET_TYPE_IP4) ?
1060              ETHERNET_ARP_ERROR_l3_type_not_ip4 : error0);
1061           error0 =
1062             (0 == arp0->ip4_over_ethernet[0].ip4.as_u32 ?
1063              ETHERNET_ARP_ERROR_l3_dst_address_unset : error0);
1064
1065           if (ETHERNET_ARP_ERROR_replies_sent == error0)
1066             {
1067               next0 = ARP_INPUT_NEXT_DISABLED;
1068               vnet_feature_arc_start (am->feature_arc_index,
1069                                       vnet_buffer (p0)->sw_if_index[VLIB_RX],
1070                                       &next0, p0);
1071             }
1072           else
1073             p0->error = node->errors[error0];
1074
1075           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
1076                                            n_left_to_next, pi0, next0);
1077         }
1078
1079       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
1080     }
1081
1082   return frame->n_vectors;
1083 }
1084
1085 typedef enum arp_disabled_next_t_
1086 {
1087   ARP_DISABLED_NEXT_DROP,
1088   ARP_DISABLED_N_NEXT,
1089 } arp_disabled_next_t;
1090
1091 #define foreach_arp_disabled_error                                      \
1092   _ (DISABLED, "ARP Disabled on this interface")                    \
1093
1094 typedef enum
1095 {
1096 #define _(sym,string) ARP_DISABLED_ERROR_##sym,
1097   foreach_arp_disabled_error
1098 #undef _
1099     ARP_DISABLED_N_ERROR,
1100 } arp_disabled_error_t;
1101
1102 static char *arp_disabled_error_strings[] = {
1103 #define _(sym,string) string,
1104   foreach_arp_disabled_error
1105 #undef _
1106 };
1107
1108 static uword
1109 arp_disabled (vlib_main_t * vm,
1110               vlib_node_runtime_t * node, vlib_frame_t * frame)
1111 {
1112   u32 n_left_from, next_index, *from, *to_next, n_left_to_next;
1113
1114   from = vlib_frame_vector_args (frame);
1115   n_left_from = frame->n_vectors;
1116   next_index = node->cached_next_index;
1117
1118   if (node->flags & VLIB_NODE_FLAG_TRACE)
1119     vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
1120                                    /* stride */ 1,
1121                                    sizeof (ethernet_arp_input_trace_t));
1122
1123   while (n_left_from > 0)
1124     {
1125       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
1126
1127       while (n_left_from > 0 && n_left_to_next > 0)
1128         {
1129           arp_disabled_next_t next0 = ARP_DISABLED_NEXT_DROP;
1130           vlib_buffer_t *p0;
1131           u32 pi0, error0;
1132
1133           next0 = ARP_DISABLED_NEXT_DROP;
1134           error0 = ARP_DISABLED_ERROR_DISABLED;
1135
1136           pi0 = to_next[0] = from[0];
1137           from += 1;
1138           to_next += 1;
1139           n_left_from -= 1;
1140           n_left_to_next -= 1;
1141
1142           p0 = vlib_get_buffer (vm, pi0);
1143           p0->error = node->errors[error0];
1144
1145           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
1146                                            n_left_to_next, pi0, next0);
1147         }
1148
1149       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
1150     }
1151
1152   return frame->n_vectors;
1153 }
1154
1155 static_always_inline u32
1156 arp_mk_reply (vnet_main_t * vnm,
1157               vlib_buffer_t * p0,
1158               u32 sw_if_index0,
1159               const ip4_address_t * if_addr0,
1160               ethernet_arp_header_t * arp0, ethernet_header_t * eth_rx)
1161 {
1162   vnet_hw_interface_t *hw_if0;
1163   u8 *rewrite0, rewrite0_len;
1164   ethernet_header_t *eth_tx;
1165   u32 next0;
1166
1167   /* Send a reply.
1168      An adjacency to the sender is not always present,
1169      so we use the interface to build us a rewrite string
1170      which will contain all the necessary tags. */
1171   rewrite0 = ethernet_build_rewrite (vnm, sw_if_index0,
1172                                      VNET_LINK_ARP, eth_rx->src_address);
1173   rewrite0_len = vec_len (rewrite0);
1174
1175   /* Figure out how much to rewind current data from adjacency. */
1176   vlib_buffer_advance (p0, -rewrite0_len);
1177   eth_tx = vlib_buffer_get_current (p0);
1178
1179   vnet_buffer (p0)->sw_if_index[VLIB_TX] = sw_if_index0;
1180   hw_if0 = vnet_get_sup_hw_interface (vnm, sw_if_index0);
1181
1182   /* Send reply back through input interface */
1183   vnet_buffer (p0)->sw_if_index[VLIB_TX] = sw_if_index0;
1184   next0 = ARP_REPLY_NEXT_REPLY_TX;
1185
1186   arp0->opcode = clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply);
1187
1188   arp0->ip4_over_ethernet[1] = arp0->ip4_over_ethernet[0];
1189
1190   mac_address_from_bytes (&arp0->ip4_over_ethernet[0].mac,
1191                           hw_if0->hw_address);
1192   clib_mem_unaligned (&arp0->ip4_over_ethernet[0].ip4.data_u32, u32) =
1193     if_addr0->data_u32;
1194
1195   /* Hardware must be ethernet-like. */
1196   ASSERT (vec_len (hw_if0->hw_address) == 6);
1197
1198   /* the rx nd tx ethernet headers wil overlap in the case
1199    * when we received a tagged VLAN=0 packet, but we are sending
1200    * back untagged */
1201   clib_memcpy_fast (eth_tx, rewrite0, vec_len (rewrite0));
1202   vec_free (rewrite0);
1203
1204   return (next0);
1205 }
1206
1207 enum arp_dst_fib_type
1208 {
1209   ARP_DST_FIB_NONE,
1210   ARP_DST_FIB_ADJ,
1211   ARP_DST_FIB_CONN
1212 };
1213
1214 /*
1215  * we're looking for FIB sources that indicate the destination
1216  * is attached. There may be interposed DPO prior to the one
1217  * we are looking for
1218  */
1219 static enum arp_dst_fib_type
1220 arp_dst_fib_check (const fib_node_index_t fei, fib_entry_flag_t * flags)
1221 {
1222   const fib_entry_t *entry = fib_entry_get (fei);
1223   const fib_entry_src_t *entry_src;
1224   fib_source_t src;
1225   /* *INDENT-OFF* */
1226   FOR_EACH_SRC_ADDED(entry, entry_src, src,
1227   ({
1228     *flags = fib_entry_get_flags_for_source (fei, src);
1229     if (fib_entry_is_sourced (fei, FIB_SOURCE_ADJ))
1230         return ARP_DST_FIB_ADJ;
1231       else if (FIB_ENTRY_FLAG_CONNECTED & *flags)
1232         return ARP_DST_FIB_CONN;
1233   }))
1234   /* *INDENT-ON* */
1235
1236   return ARP_DST_FIB_NONE;
1237 }
1238
1239 static uword
1240 arp_reply (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
1241 {
1242   ethernet_arp_main_t *am = &ethernet_arp_main;
1243   vnet_main_t *vnm = vnet_get_main ();
1244   u32 n_left_from, next_index, *from, *to_next;
1245   u32 n_replies_sent = 0;
1246
1247   from = vlib_frame_vector_args (frame);
1248   n_left_from = frame->n_vectors;
1249   next_index = node->cached_next_index;
1250
1251   if (node->flags & VLIB_NODE_FLAG_TRACE)
1252     vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
1253                                    /* stride */ 1,
1254                                    sizeof (ethernet_arp_input_trace_t));
1255
1256   while (n_left_from > 0)
1257     {
1258       u32 n_left_to_next;
1259
1260       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
1261
1262       while (n_left_from > 0 && n_left_to_next > 0)
1263         {
1264           vlib_buffer_t *p0;
1265           ethernet_arp_header_t *arp0;
1266           ethernet_header_t *eth_rx;
1267           const ip4_address_t *if_addr0;
1268           u32 pi0, error0, next0, sw_if_index0, conn_sw_if_index0, fib_index0;
1269           u8 dst_is_local0, is_vrrp_reply0;
1270           fib_node_index_t dst_fei, src_fei;
1271           const fib_prefix_t *pfx0;
1272           fib_entry_flag_t src_flags, dst_flags;
1273
1274           pi0 = from[0];
1275           to_next[0] = pi0;
1276           from += 1;
1277           to_next += 1;
1278           n_left_from -= 1;
1279           n_left_to_next -= 1;
1280
1281           p0 = vlib_get_buffer (vm, pi0);
1282           arp0 = vlib_buffer_get_current (p0);
1283           /* Fill in ethernet header. */
1284           eth_rx = ethernet_buffer_get_header (p0);
1285
1286           next0 = ARP_REPLY_NEXT_DROP;
1287           error0 = ETHERNET_ARP_ERROR_replies_sent;
1288           sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
1289
1290           /* Check that IP address is local and matches incoming interface. */
1291           fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
1292           if (~0 == fib_index0)
1293             {
1294               error0 = ETHERNET_ARP_ERROR_interface_no_table;
1295               goto drop;
1296
1297             }
1298
1299           {
1300             /*
1301              * we're looking for FIB entries that indicate the source
1302              * is attached. There may be more specific non-attached
1303              * routes that match the source, but these do not influence
1304              * whether we respond to an ARP request, i.e. they do not
1305              * influence whether we are the correct way for the sender
1306              * to reach us, they only affect how we reach the sender.
1307              */
1308             fib_entry_t *src_fib_entry;
1309             const fib_prefix_t *pfx;
1310             fib_entry_src_t *src;
1311             fib_source_t source;
1312             int attached;
1313             int mask;
1314
1315             mask = 32;
1316             attached = 0;
1317
1318             do
1319               {
1320                 src_fei = ip4_fib_table_lookup (ip4_fib_get (fib_index0),
1321                                                 &arp0->
1322                                                 ip4_over_ethernet[0].ip4,
1323                                                 mask);
1324                 src_fib_entry = fib_entry_get (src_fei);
1325
1326                 /*
1327                  * It's possible that the source that provides the
1328                  * flags we need, or the flags we must not have,
1329                  * is not the best source, so check then all.
1330                  */
1331                 /* *INDENT-OFF* */
1332                 FOR_EACH_SRC_ADDED(src_fib_entry, src, source,
1333                 ({
1334                   src_flags = fib_entry_get_flags_for_source (src_fei, source);
1335
1336                   /* Reject requests/replies with our local interface
1337                      address. */
1338                   if (FIB_ENTRY_FLAG_LOCAL & src_flags)
1339                     {
1340                       error0 = ETHERNET_ARP_ERROR_l3_src_address_is_local;
1341                       /*
1342                        * When VPP has an interface whose address is also
1343                        * applied to a TAP interface on the host, then VPP's
1344                        * TAP interface will be unnumbered  to the 'real'
1345                        * interface and do proxy ARP from the host.
1346                        * The curious aspect of this setup is that ARP requests
1347                        * from the host will come from the VPP's own address.
1348                        * So don't drop immediately here, instead go see if this
1349                        * is a proxy ARP case.
1350                        */
1351                       goto next_feature;
1352                     }
1353                   /* A Source must also be local to subnet of matching
1354                    * interface address. */
1355                   if ((FIB_ENTRY_FLAG_ATTACHED & src_flags) ||
1356                       (FIB_ENTRY_FLAG_CONNECTED & src_flags))
1357                     {
1358                       attached = 1;
1359                       break;
1360                     }
1361                   /*
1362                    * else
1363                    *  The packet was sent from an address that is not
1364                    *  connected nor attached i.e. it is not from an
1365                    *  address that is covered by a link's sub-net,
1366                    *  nor is it a already learned host resp.
1367                    */
1368                 }));
1369                 /* *INDENT-ON* */
1370
1371                 /*
1372                  * shorter mask lookup for the next iteration.
1373                  */
1374                 pfx = fib_entry_get_prefix (src_fei);
1375                 mask = pfx->fp_len - 1;
1376
1377                 /*
1378                  * continue until we hit the default route or we find
1379                  * the attached we are looking for. The most likely
1380                  * outcome is we find the attached with the first source
1381                  * on the first lookup.
1382                  */
1383               }
1384             while (!attached &&
1385                    !fib_entry_is_sourced (src_fei, FIB_SOURCE_DEFAULT_ROUTE));
1386
1387             if (!attached)
1388               {
1389                 /*
1390                  * the matching route is a not attached, i.e. it was
1391                  * added as a result of routing, rather than interface/ARP
1392                  * configuration. If the matching route is not a host route
1393                  * (i.e. a /32)
1394                  */
1395                 error0 = ETHERNET_ARP_ERROR_l3_src_address_not_local;
1396                 goto drop;
1397               }
1398           }
1399
1400           dst_fei = ip4_fib_table_lookup (ip4_fib_get (fib_index0),
1401                                           &arp0->ip4_over_ethernet[1].ip4,
1402                                           32);
1403           switch (arp_dst_fib_check (dst_fei, &dst_flags))
1404             {
1405             case ARP_DST_FIB_ADJ:
1406               /*
1407                * We matched an adj-fib on ths source subnet (a /32 previously
1408                * added as a result of ARP). If this request is a gratuitous
1409                * ARP, then learn from it.
1410                * The check for matching an adj-fib, is to prevent hosts
1411                * from spamming us with gratuitous ARPS that might otherwise
1412                * blow our ARP cache
1413                */
1414               if (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
1415                   arp0->ip4_over_ethernet[1].ip4.as_u32)
1416                 error0 = arp_learn (vnm, am, sw_if_index0,
1417                                     &arp0->ip4_over_ethernet[0]);
1418               goto drop;
1419             case ARP_DST_FIB_CONN:
1420               /* destination is connected, continue to process */
1421               break;
1422             case ARP_DST_FIB_NONE:
1423               /* destination is not connected, stop here */
1424               error0 = ETHERNET_ARP_ERROR_l3_dst_address_not_local;
1425               goto next_feature;
1426             }
1427
1428           dst_is_local0 = (FIB_ENTRY_FLAG_LOCAL & dst_flags);
1429           pfx0 = fib_entry_get_prefix (dst_fei);
1430           if_addr0 = &pfx0->fp_addr.ip4;
1431
1432           is_vrrp_reply0 =
1433             ((arp0->opcode ==
1434               clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply))
1435              &&
1436              (!memcmp
1437               (arp0->ip4_over_ethernet[0].mac.bytes, vrrp_prefix,
1438                sizeof (vrrp_prefix))));
1439
1440           /* Trash ARP packets whose ARP-level source addresses do not
1441              match their L2-frame-level source addresses, unless it's
1442              a reply from a VRRP virtual router */
1443           if (!ethernet_mac_address_equal
1444               (eth_rx->src_address,
1445                arp0->ip4_over_ethernet[0].mac.bytes) && !is_vrrp_reply0)
1446             {
1447               error0 = ETHERNET_ARP_ERROR_l2_address_mismatch;
1448               goto drop;
1449             }
1450
1451           /* Learn or update sender's mapping only for replies to addresses
1452            * that are local to the subnet */
1453           if (arp0->opcode ==
1454               clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply))
1455             {
1456               if (dst_is_local0)
1457                 error0 = arp_learn (vnm, am, sw_if_index0,
1458                                     &arp0->ip4_over_ethernet[0]);
1459               else
1460                 /* a reply for a non-local destination could be a GARP.
1461                  * GARPs for hosts we know were handled above, so this one
1462                  * we drop */
1463                 error0 = ETHERNET_ARP_ERROR_l3_dst_address_not_local;
1464
1465               goto next_feature;
1466             }
1467           else if (arp0->opcode ==
1468                    clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_request) &&
1469                    (dst_is_local0 == 0))
1470             {
1471               goto next_feature;
1472             }
1473
1474           /* Honor unnumbered interface, if any */
1475           conn_sw_if_index0 = fib_entry_get_resolving_interface (dst_fei);
1476           if (sw_if_index0 != conn_sw_if_index0 ||
1477               sw_if_index0 != fib_entry_get_resolving_interface (src_fei))
1478             {
1479               /*
1480                * The interface the ARP is sent to or was received on is not the
1481                * interface on which the covering prefix is configured.
1482                * Maybe this is a case for unnumbered.
1483                */
1484               if (!arp_unnumbered (p0, sw_if_index0, conn_sw_if_index0))
1485                 {
1486                   error0 = ETHERNET_ARP_ERROR_unnumbered_mismatch;
1487                   goto drop;
1488                 }
1489             }
1490           if (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
1491               arp0->ip4_over_ethernet[1].ip4.as_u32)
1492             {
1493               error0 = ETHERNET_ARP_ERROR_gratuitous_arp;
1494               goto drop;
1495             }
1496
1497           next0 = arp_mk_reply (vnm, p0, sw_if_index0,
1498                                 if_addr0, arp0, eth_rx);
1499
1500           /* We are going to reply to this request, so, in the absence of
1501              errors, learn the sender */
1502           if (!error0)
1503             error0 = arp_learn (vnm, am, sw_if_index0,
1504                                 &arp0->ip4_over_ethernet[1]);
1505
1506           n_replies_sent += 1;
1507           goto enqueue;
1508
1509         next_feature:
1510           vnet_feature_next (&next0, p0);
1511           goto enqueue;
1512
1513         drop:
1514           p0->error = node->errors[error0];
1515
1516         enqueue:
1517           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
1518                                            n_left_to_next, pi0, next0);
1519         }
1520
1521       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
1522     }
1523
1524   vlib_error_count (vm, node->node_index,
1525                     ETHERNET_ARP_ERROR_replies_sent, n_replies_sent);
1526
1527   return frame->n_vectors;
1528 }
1529
1530 static uword
1531 arp_proxy (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
1532 {
1533   ethernet_arp_main_t *am = &ethernet_arp_main;
1534   vnet_main_t *vnm = vnet_get_main ();
1535   u32 n_left_from, next_index, *from, *to_next;
1536   u32 n_arp_replies_sent = 0;
1537
1538   from = vlib_frame_vector_args (frame);
1539   n_left_from = frame->n_vectors;
1540   next_index = node->cached_next_index;
1541
1542   if (node->flags & VLIB_NODE_FLAG_TRACE)
1543     vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
1544                                    /* stride */ 1,
1545                                    sizeof (ethernet_arp_input_trace_t));
1546
1547   while (n_left_from > 0)
1548     {
1549       u32 n_left_to_next;
1550
1551       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
1552
1553       while (n_left_from > 0 && n_left_to_next > 0)
1554         {
1555           vlib_buffer_t *p0;
1556           ethernet_arp_header_t *arp0;
1557           ethernet_header_t *eth_rx;
1558           ip4_address_t proxy_src;
1559           u32 pi0, error0, next0, sw_if_index0, fib_index0;
1560           u8 is_request0;
1561           ethernet_proxy_arp_t *pa;
1562
1563           pi0 = from[0];
1564           to_next[0] = pi0;
1565           from += 1;
1566           to_next += 1;
1567           n_left_from -= 1;
1568           n_left_to_next -= 1;
1569
1570           p0 = vlib_get_buffer (vm, pi0);
1571           arp0 = vlib_buffer_get_current (p0);
1572           /* Fill in ethernet header. */
1573           eth_rx = ethernet_buffer_get_header (p0);
1574
1575           is_request0 = arp0->opcode
1576             == clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_request);
1577
1578           error0 = ETHERNET_ARP_ERROR_replies_sent;
1579           sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
1580           next0 = ARP_REPLY_NEXT_DROP;
1581
1582           fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
1583           if (~0 == fib_index0)
1584             {
1585               error0 = ETHERNET_ARP_ERROR_interface_no_table;
1586             }
1587
1588           if (0 == error0 && is_request0)
1589             {
1590               u32 this_addr = clib_net_to_host_u32
1591                 (arp0->ip4_over_ethernet[1].ip4.as_u32);
1592
1593               vec_foreach (pa, am->proxy_arps)
1594               {
1595                 u32 lo_addr = clib_net_to_host_u32 (pa->lo_addr.as_u32);
1596                 u32 hi_addr = clib_net_to_host_u32 (pa->hi_addr.as_u32);
1597
1598                 /* an ARP request hit in the proxy-arp table? */
1599                 if ((this_addr >= lo_addr && this_addr <= hi_addr) &&
1600                     (fib_index0 == pa->fib_index))
1601                   {
1602                     proxy_src.as_u32 =
1603                       arp0->ip4_over_ethernet[1].ip4.data_u32;
1604
1605                     /*
1606                      * change the interface address to the proxied
1607                      */
1608                     n_arp_replies_sent++;
1609
1610                     next0 =
1611                       arp_mk_reply (vnm, p0, sw_if_index0, &proxy_src, arp0,
1612                                     eth_rx);
1613                   }
1614               }
1615             }
1616           else
1617             {
1618               p0->error = node->errors[error0];
1619             }
1620
1621           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
1622                                            n_left_to_next, pi0, next0);
1623         }
1624
1625       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
1626     }
1627
1628   vlib_error_count (vm, node->node_index,
1629                     ETHERNET_ARP_ERROR_replies_sent, n_arp_replies_sent);
1630
1631   return frame->n_vectors;
1632 }
1633
1634 static char *ethernet_arp_error_strings[] = {
1635 #define _(sym,string) string,
1636   foreach_ethernet_arp_error
1637 #undef _
1638 };
1639
1640 /* *INDENT-OFF* */
1641
1642 VLIB_REGISTER_NODE (arp_input_node, static) =
1643 {
1644   .function = arp_input,
1645   .name = "arp-input",
1646   .vector_size = sizeof (u32),
1647   .n_errors = ETHERNET_ARP_N_ERROR,
1648   .error_strings = ethernet_arp_error_strings,
1649   .n_next_nodes = ARP_INPUT_N_NEXT,
1650   .next_nodes = {
1651     [ARP_INPUT_NEXT_DROP] = "error-drop",
1652     [ARP_INPUT_NEXT_DISABLED] = "arp-disabled",
1653   },
1654   .format_buffer = format_ethernet_arp_header,
1655   .format_trace = format_ethernet_arp_input_trace,
1656 };
1657
1658 VLIB_REGISTER_NODE (arp_disabled_node, static) =
1659 {
1660   .function = arp_disabled,
1661   .name = "arp-disabled",
1662   .vector_size = sizeof (u32),
1663   .n_errors = ARP_DISABLED_N_ERROR,
1664   .error_strings = arp_disabled_error_strings,
1665   .n_next_nodes = ARP_DISABLED_N_NEXT,
1666   .next_nodes = {
1667     [ARP_INPUT_NEXT_DROP] = "error-drop",
1668   },
1669   .format_buffer = format_ethernet_arp_header,
1670   .format_trace = format_ethernet_arp_input_trace,
1671 };
1672
1673 VLIB_REGISTER_NODE (arp_reply_node, static) =
1674 {
1675   .function = arp_reply,
1676   .name = "arp-reply",
1677   .vector_size = sizeof (u32),
1678   .n_errors = ETHERNET_ARP_N_ERROR,
1679   .error_strings = ethernet_arp_error_strings,
1680   .n_next_nodes = ARP_REPLY_N_NEXT,
1681   .next_nodes = {
1682     [ARP_REPLY_NEXT_DROP] = "error-drop",
1683     [ARP_REPLY_NEXT_REPLY_TX] = "interface-output",
1684   },
1685   .format_buffer = format_ethernet_arp_header,
1686   .format_trace = format_ethernet_arp_input_trace,
1687 };
1688
1689 VLIB_REGISTER_NODE (arp_proxy_node, static) =
1690 {
1691   .function = arp_proxy,
1692   .name = "arp-proxy",
1693   .vector_size = sizeof (u32),
1694   .n_errors = ETHERNET_ARP_N_ERROR,
1695   .error_strings = ethernet_arp_error_strings,
1696   .n_next_nodes = ARP_REPLY_N_NEXT,
1697   .next_nodes = {
1698     [ARP_REPLY_NEXT_DROP] = "error-drop",
1699     [ARP_REPLY_NEXT_REPLY_TX] = "interface-output",
1700   },
1701   .format_buffer = format_ethernet_arp_header,
1702   .format_trace = format_ethernet_arp_input_trace,
1703 };
1704
1705 /* Built-in ARP rx feature path definition */
1706 VNET_FEATURE_ARC_INIT (arp_feat, static) =
1707 {
1708   .arc_name = "arp",
1709   .start_nodes = VNET_FEATURES ("arp-input"),
1710   .last_in_arc = "arp-disabled",
1711   .arc_index_ptr = &ethernet_arp_main.feature_arc_index,
1712 };
1713
1714 VNET_FEATURE_INIT (arp_reply_feat_node, static) =
1715 {
1716   .arc_name = "arp",
1717   .node_name = "arp-reply",
1718   .runs_before = VNET_FEATURES ("arp-disabled"),
1719 };
1720
1721 VNET_FEATURE_INIT (arp_proxy_feat_node, static) =
1722 {
1723   .arc_name = "arp",
1724   .node_name = "arp-proxy",
1725   .runs_after = VNET_FEATURES ("arp-reply"),
1726   .runs_before = VNET_FEATURES ("arp-disabled"),
1727 };
1728
1729 VNET_FEATURE_INIT (arp_drop_feat_node, static) =
1730 {
1731   .arc_name = "arp",
1732   .node_name = "arp-disabled",
1733   .runs_before = 0,     /* last feature */
1734 };
1735
1736 /* *INDENT-ON* */
1737
1738 static int
1739 ip4_arp_entry_sort (void *a1, void *a2)
1740 {
1741   ethernet_arp_ip4_entry_t *e1 = a1;
1742   ethernet_arp_ip4_entry_t *e2 = a2;
1743
1744   int cmp;
1745   vnet_main_t *vnm = vnet_get_main ();
1746
1747   cmp = vnet_sw_interface_compare (vnm, e1->sw_if_index, e2->sw_if_index);
1748   if (!cmp)
1749     cmp = ip4_address_compare (&e1->ip4_address, &e2->ip4_address);
1750   return cmp;
1751 }
1752
1753 ethernet_arp_ip4_entry_t *
1754 ip4_neighbors_pool (void)
1755 {
1756   ethernet_arp_main_t *am = &ethernet_arp_main;
1757   return am->ip4_entry_pool;
1758 }
1759
1760 ethernet_arp_ip4_entry_t *
1761 ip4_neighbor_entries (u32 sw_if_index)
1762 {
1763   ethernet_arp_main_t *am = &ethernet_arp_main;
1764   ethernet_arp_ip4_entry_t *n, *ns = 0;
1765
1766   /* *INDENT-OFF* */
1767   pool_foreach (n, am->ip4_entry_pool, ({
1768     if (sw_if_index != ~0 && n->sw_if_index != sw_if_index)
1769       continue;
1770     vec_add1 (ns, n[0]);
1771   }));
1772   /* *INDENT-ON* */
1773
1774   if (ns)
1775     vec_sort_with_function (ns, ip4_arp_entry_sort);
1776   return ns;
1777 }
1778
1779 static clib_error_t *
1780 show_ip4_arp (vlib_main_t * vm,
1781               unformat_input_t * input, vlib_cli_command_t * cmd)
1782 {
1783   vnet_main_t *vnm = vnet_get_main ();
1784   ethernet_arp_main_t *am = &ethernet_arp_main;
1785   ethernet_arp_ip4_entry_t *e, *es;
1786   ethernet_proxy_arp_t *pa;
1787   clib_error_t *error = 0;
1788   u32 sw_if_index;
1789
1790   /* Filter entries by interface if given. */
1791   sw_if_index = ~0;
1792   (void) unformat_user (input, unformat_vnet_sw_interface, vnm, &sw_if_index);
1793
1794   es = ip4_neighbor_entries (sw_if_index);
1795   if (es)
1796     {
1797       vlib_cli_output (vm, "%U", format_ethernet_arp_ip4_entry, vnm, 0);
1798       vec_foreach (e, es)
1799       {
1800         vlib_cli_output (vm, "%U", format_ethernet_arp_ip4_entry, vnm, e);
1801       }
1802       vec_free (es);
1803     }
1804
1805   if (vec_len (am->proxy_arps))
1806     {
1807       vlib_cli_output (vm, "Proxy arps enabled for:");
1808       vec_foreach (pa, am->proxy_arps)
1809       {
1810         vlib_cli_output (vm, "Fib_index %d   %U - %U ",
1811                          pa->fib_index,
1812                          format_ip4_address, &pa->lo_addr,
1813                          format_ip4_address, &pa->hi_addr);
1814       }
1815     }
1816
1817   return error;
1818 }
1819
1820 /*?
1821  * Display all the IPv4 ARP entries.
1822  *
1823  * @cliexpar
1824  * Example of how to display the IPv4 ARP table:
1825  * @cliexstart{show ip arp}
1826  *    Time      FIB        IP4       Flags      Ethernet              Interface
1827  *    346.3028   0       6.1.1.3            de:ad:be:ef:ba:be   GigabitEthernet2/0/0
1828  *   3077.4271   0       6.1.1.4       S    de:ad:be:ef:ff:ff   GigabitEthernet2/0/0
1829  *   2998.6409   1       6.2.2.3            de:ad:be:ef:00:01   GigabitEthernet2/0/0
1830  * Proxy arps enabled for:
1831  * Fib_index 0   6.0.0.1 - 6.0.0.11
1832  * @cliexend
1833  ?*/
1834 /* *INDENT-OFF* */
1835 VLIB_CLI_COMMAND (show_ip4_arp_command, static) = {
1836   .path = "show ip arp",
1837   .function = show_ip4_arp,
1838   .short_help = "show ip arp",
1839 };
1840 /* *INDENT-ON* */
1841
1842 typedef struct
1843 {
1844   pg_edit_t l2_type, l3_type;
1845   pg_edit_t n_l2_address_bytes, n_l3_address_bytes;
1846   pg_edit_t opcode;
1847   struct
1848   {
1849     pg_edit_t mac;
1850     pg_edit_t ip4;
1851   } ip4_over_ethernet[2];
1852 } pg_ethernet_arp_header_t;
1853
1854 static inline void
1855 pg_ethernet_arp_header_init (pg_ethernet_arp_header_t * p)
1856 {
1857   /* Initialize fields that are not bit fields in the IP header. */
1858 #define _(f) pg_edit_init (&p->f, ethernet_arp_header_t, f);
1859   _(l2_type);
1860   _(l3_type);
1861   _(n_l2_address_bytes);
1862   _(n_l3_address_bytes);
1863   _(opcode);
1864   _(ip4_over_ethernet[0].mac);
1865   _(ip4_over_ethernet[0].ip4);
1866   _(ip4_over_ethernet[1].mac);
1867   _(ip4_over_ethernet[1].ip4);
1868 #undef _
1869 }
1870
1871 uword
1872 unformat_pg_arp_header (unformat_input_t * input, va_list * args)
1873 {
1874   pg_stream_t *s = va_arg (*args, pg_stream_t *);
1875   pg_ethernet_arp_header_t *p;
1876   u32 group_index;
1877
1878   p = pg_create_edit_group (s, sizeof (p[0]), sizeof (ethernet_arp_header_t),
1879                             &group_index);
1880   pg_ethernet_arp_header_init (p);
1881
1882   /* Defaults. */
1883   pg_edit_set_fixed (&p->l2_type, ETHERNET_ARP_HARDWARE_TYPE_ethernet);
1884   pg_edit_set_fixed (&p->l3_type, ETHERNET_TYPE_IP4);
1885   pg_edit_set_fixed (&p->n_l2_address_bytes, 6);
1886   pg_edit_set_fixed (&p->n_l3_address_bytes, 4);
1887
1888   if (!unformat (input, "%U: %U/%U -> %U/%U",
1889                  unformat_pg_edit,
1890                  unformat_ethernet_arp_opcode_net_byte_order, &p->opcode,
1891                  unformat_pg_edit,
1892                  unformat_mac_address_t, &p->ip4_over_ethernet[0].mac,
1893                  unformat_pg_edit,
1894                  unformat_ip4_address, &p->ip4_over_ethernet[0].ip4,
1895                  unformat_pg_edit,
1896                  unformat_mac_address_t, &p->ip4_over_ethernet[1].mac,
1897                  unformat_pg_edit,
1898                  unformat_ip4_address, &p->ip4_over_ethernet[1].ip4))
1899     {
1900       /* Free up any edits we may have added. */
1901       pg_free_edit_group (s);
1902       return 0;
1903     }
1904   return 1;
1905 }
1906
1907 clib_error_t *
1908 ip4_set_arp_limit (u32 arp_limit)
1909 {
1910   ethernet_arp_main_t *am = &ethernet_arp_main;
1911
1912   am->limit_arp_cache_size = arp_limit;
1913   return 0;
1914 }
1915
1916 /**
1917  * @brief Control Plane hook to remove an ARP entry
1918  */
1919 int
1920 vnet_arp_unset_ip4_over_ethernet (vnet_main_t * vnm,
1921                                   u32 sw_if_index,
1922                                   const
1923                                   ethernet_arp_ip4_over_ethernet_address_t *
1924                                   a)
1925 {
1926   vnet_arp_set_ip4_over_ethernet_rpc_args_t args = {
1927     .sw_if_index = sw_if_index,
1928     .flags = ETHERNET_ARP_ARGS_REMOVE,
1929     .ip4 = a->ip4,
1930     .mac = a->mac,
1931   };
1932
1933   vl_api_rpc_call_main_thread (set_ip4_over_ethernet_rpc_callback,
1934                                (u8 *) & args, sizeof (args));
1935   return 0;
1936 }
1937
1938 /**
1939  * @brief publish wildcard arp event
1940  * @param sw_if_index The interface on which the ARP entries are acted
1941  */
1942 static int
1943 vnet_arp_wc_publish (u32 sw_if_index,
1944                      const ethernet_arp_ip4_over_ethernet_address_t * a)
1945 {
1946   vnet_arp_set_ip4_over_ethernet_rpc_args_t args = {
1947     .flags = ETHERNET_ARP_ARGS_WC_PUB,
1948     .sw_if_index = sw_if_index,
1949     .ip4 = a->ip4,
1950     .mac = a->mac,
1951   };
1952
1953   vl_api_rpc_call_main_thread (set_ip4_over_ethernet_rpc_callback,
1954                                (u8 *) & args, sizeof (args));
1955   return 0;
1956 }
1957
1958 static void
1959 vnet_arp_wc_publish_internal (vnet_main_t * vnm,
1960                               vnet_arp_set_ip4_over_ethernet_rpc_args_t *
1961                               args)
1962 {
1963   vlib_main_t *vm = vlib_get_main ();
1964   ethernet_arp_main_t *am = &ethernet_arp_main;
1965   uword ni = am->wc_ip4_arp_publisher_node;
1966   uword et = am->wc_ip4_arp_publisher_et;
1967
1968   if (ni == (uword) ~ 0)
1969     return;
1970   wc_arp_report_t *r =
1971     vlib_process_signal_event_data (vm, ni, et, 1, sizeof *r);
1972   r->ip.as_u32 = args->ip4.as_u32;
1973   r->sw_if_index = args->sw_if_index;
1974   mac_address_copy (&r->mac, &args->mac);
1975 }
1976
1977 void
1978 wc_arp_set_publisher_node (uword node_index, uword event_type)
1979 {
1980   ethernet_arp_main_t *am = &ethernet_arp_main;
1981   am->wc_ip4_arp_publisher_node = node_index;
1982   am->wc_ip4_arp_publisher_et = event_type;
1983 }
1984
1985 static void
1986 arp_entry_free (ethernet_arp_interface_t * eai, ethernet_arp_ip4_entry_t * e);
1987
1988 static int
1989 vnet_arp_flush_ip4_over_ethernet_internal (vnet_main_t * vnm,
1990                                            vnet_arp_set_ip4_over_ethernet_rpc_args_t
1991                                            * args)
1992 {
1993   ethernet_arp_main_t *am = &ethernet_arp_main;
1994   ethernet_arp_ip4_entry_t *e;
1995   ethernet_arp_interface_t *eai;
1996
1997   if (vec_len (am->ethernet_arp_by_sw_if_index) <= args->sw_if_index)
1998     return 0;
1999
2000   eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index];
2001
2002   e = arp_entry_find (eai, &args->ip4);
2003
2004   if (NULL != e)
2005     {
2006       adj_nbr_walk_nh4 (e->sw_if_index,
2007                         &e->ip4_address, arp_mk_incomplete_walk, e);
2008
2009       /*
2010        * The difference between flush and unset, is that an unset
2011        * means delete for static and dynamic entries. A flush
2012        * means delete only for dynamic. Flushing is what the DP
2013        * does in response to interface events. unset is only done
2014        * by the control plane.
2015        */
2016       if (e->flags & IP_NEIGHBOR_FLAG_STATIC)
2017         {
2018           e->flags &= ~IP_NEIGHBOR_FLAG_DYNAMIC;
2019         }
2020       else if (e->flags & IP_NEIGHBOR_FLAG_DYNAMIC)
2021         {
2022           arp_entry_free (eai, e);
2023         }
2024     }
2025   return (0);
2026 }
2027
2028 /*
2029  * arp_add_del_interface_address
2030  *
2031  * callback when an interface address is added or deleted
2032  */
2033 static void
2034 arp_enable_disable_interface (ip4_main_t * im,
2035                               uword opaque, u32 sw_if_index, u32 is_enable)
2036 {
2037   ethernet_arp_main_t *am = &ethernet_arp_main;
2038
2039   if (is_enable)
2040     arp_enable (am, sw_if_index);
2041   else
2042     arp_disable (am, sw_if_index);
2043 }
2044
2045 /*
2046  * arp_add_del_interface_address
2047  *
2048  * callback when an interface address is added or deleted
2049  */
2050 static void
2051 arp_add_del_interface_address (ip4_main_t * im,
2052                                uword opaque,
2053                                u32 sw_if_index,
2054                                ip4_address_t * address,
2055                                u32 address_length,
2056                                u32 if_address_index, u32 is_del)
2057 {
2058   /*
2059    * Flush the ARP cache of all entries covered by the address
2060    * that is being removed.
2061    */
2062   ethernet_arp_main_t *am = &ethernet_arp_main;
2063   ethernet_arp_ip4_entry_t *e;
2064
2065   if (vec_len (am->ethernet_arp_by_sw_if_index) <= sw_if_index)
2066     return;
2067
2068   if (is_del)
2069     {
2070       ethernet_arp_interface_t *eai;
2071       u32 i, *to_delete = 0;
2072       hash_pair_t *pair;
2073
2074       eai = &am->ethernet_arp_by_sw_if_index[sw_if_index];
2075
2076       /* *INDENT-OFF* */
2077       hash_foreach_pair (pair, eai->arp_entries,
2078       ({
2079         e = pool_elt_at_index(am->ip4_entry_pool,
2080                               pair->value[0]);
2081         if (ip4_destination_matches_route (im, &e->ip4_address,
2082                                            address, address_length))
2083           {
2084             vec_add1 (to_delete, e - am->ip4_entry_pool);
2085           }
2086       }));
2087       /* *INDENT-ON* */
2088
2089       for (i = 0; i < vec_len (to_delete); i++)
2090         {
2091           e = pool_elt_at_index (am->ip4_entry_pool, to_delete[i]);
2092
2093           vnet_arp_set_ip4_over_ethernet_rpc_args_t delme = {
2094             .ip4.as_u32 = e->ip4_address.as_u32,
2095             .sw_if_index = e->sw_if_index,
2096             .flags = ETHERNET_ARP_ARGS_FLUSH,
2097           };
2098           mac_address_copy (&delme.mac, &e->mac);
2099
2100           vnet_arp_flush_ip4_over_ethernet_internal (vnet_get_main (),
2101                                                      &delme);
2102         }
2103
2104       vec_free (to_delete);
2105     }
2106 }
2107
2108 static void
2109 arp_table_bind (ip4_main_t * im,
2110                 uword opaque,
2111                 u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
2112 {
2113   ethernet_arp_main_t *am = &ethernet_arp_main;
2114   ethernet_arp_interface_t *eai;
2115   ethernet_arp_ip4_entry_t *e;
2116   hash_pair_t *pair;
2117
2118   /*
2119    * the IP table that the interface is bound to has changed.
2120    * reinstall all the adj fibs.
2121    */
2122
2123   if (vec_len (am->ethernet_arp_by_sw_if_index) <= sw_if_index)
2124     return;
2125
2126   eai = &am->ethernet_arp_by_sw_if_index[sw_if_index];
2127
2128   /* *INDENT-OFF* */
2129   hash_foreach_pair (pair, eai->arp_entries,
2130   ({
2131     e = pool_elt_at_index(am->ip4_entry_pool,
2132                           pair->value[0]);
2133     /*
2134      * remove the adj-fib from the old table and add to the new
2135      */
2136     arp_adj_fib_remove(e, old_fib_index);
2137     arp_adj_fib_add(e, new_fib_index);
2138   }));
2139   /* *INDENT-ON* */
2140
2141 }
2142
2143 static clib_error_t *
2144 ethernet_arp_init (vlib_main_t * vm)
2145 {
2146   ethernet_arp_main_t *am = &ethernet_arp_main;
2147   ip4_main_t *im = &ip4_main;
2148   pg_node_t *pn;
2149
2150   ethernet_register_input_type (vm, ETHERNET_TYPE_ARP, arp_input_node.index);
2151
2152   pn = pg_get_node (arp_input_node.index);
2153   pn->unformat_edit = unformat_pg_arp_header;
2154
2155   am->opcode_by_name = hash_create_string (0, sizeof (uword));
2156 #define _(o) hash_set_mem (am->opcode_by_name, #o, ETHERNET_ARP_OPCODE_##o);
2157   foreach_ethernet_arp_opcode;
2158 #undef _
2159
2160   /* $$$ configurable */
2161   am->limit_arp_cache_size = 50000;
2162
2163   am->pending_resolutions_by_address = hash_create (0, sizeof (uword));
2164   am->mac_changes_by_address = hash_create (0, sizeof (uword));
2165   am->wc_ip4_arp_publisher_node = (uword) ~ 0;
2166
2167   /* don't trace ARP error packets */
2168   {
2169     vlib_node_runtime_t *rt =
2170       vlib_node_get_runtime (vm, arp_input_node.index);
2171
2172 #define _(a,b)                                  \
2173     vnet_pcap_drop_trace_filter_add_del         \
2174         (rt->errors[ETHERNET_ARP_ERROR_##a],    \
2175          1 /* is_add */);
2176     foreach_ethernet_arp_error
2177 #undef _
2178   }
2179
2180   ip4_add_del_interface_address_callback_t cb;
2181   cb.function = arp_add_del_interface_address;
2182   cb.function_opaque = 0;
2183   vec_add1 (im->add_del_interface_address_callbacks, cb);
2184
2185   ip4_enable_disable_interface_callback_t cbe;
2186   cbe.function = arp_enable_disable_interface;
2187   cbe.function_opaque = 0;
2188   vec_add1 (im->enable_disable_interface_callbacks, cbe);
2189
2190   ip4_table_bind_callback_t cbt;
2191   cbt.function = arp_table_bind;
2192   cbt.function_opaque = 0;
2193   vec_add1 (im->table_bind_callbacks, cbt);
2194
2195   return 0;
2196 }
2197 /* *INDENT-OFF* */
2198 VLIB_INIT_FUNCTION (ethernet_arp_init) =
2199 {
2200   .runs_after = VLIB_INITS("ethernet_init"),
2201 };
2202 /* *INDENT-ON* */
2203
2204 static void
2205 arp_entry_free (ethernet_arp_interface_t * eai, ethernet_arp_ip4_entry_t * e)
2206 {
2207   ethernet_arp_main_t *am = &ethernet_arp_main;
2208
2209   arp_adj_fib_remove
2210     (e, ip4_fib_table_get_index_for_sw_if_index (e->sw_if_index));
2211   hash_unset (eai->arp_entries, e->ip4_address.as_u32);
2212   pool_put (am->ip4_entry_pool, e);
2213 }
2214
2215 static inline int
2216 vnet_arp_unset_ip4_over_ethernet_internal (vnet_main_t * vnm,
2217                                            vnet_arp_set_ip4_over_ethernet_rpc_args_t
2218                                            * args)
2219 {
2220   ethernet_arp_main_t *am = &ethernet_arp_main;
2221   ethernet_arp_ip4_entry_t *e;
2222   ethernet_arp_interface_t *eai;
2223
2224   if (vec_len (am->ethernet_arp_by_sw_if_index) <= args->sw_if_index)
2225     return 0;
2226
2227   eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index];
2228
2229   e = arp_entry_find (eai, &args->ip4);
2230
2231   if (NULL != e)
2232     {
2233       adj_nbr_walk_nh4 (e->sw_if_index,
2234                         &e->ip4_address, arp_mk_incomplete_walk, e);
2235       arp_entry_free (eai, e);
2236     }
2237
2238   return 0;
2239 }
2240
2241
2242 static int
2243 vnet_arp_populate_ip4_over_ethernet_internal (vnet_main_t * vnm,
2244                                               vnet_arp_set_ip4_over_ethernet_rpc_args_t
2245                                               * args)
2246 {
2247   ethernet_arp_main_t *am = &ethernet_arp_main;
2248   ethernet_arp_ip4_entry_t *e;
2249   ethernet_arp_interface_t *eai;
2250
2251   arp_enable (am, args->sw_if_index);
2252   eai = &am->ethernet_arp_by_sw_if_index[args->sw_if_index];
2253
2254   e = arp_entry_find (eai, &args->ip4);
2255
2256   if (NULL != e)
2257     {
2258       adj_nbr_walk_nh4 (e->sw_if_index,
2259                         &e->ip4_address, arp_mk_complete_walk, e);
2260     }
2261   return (0);
2262 }
2263
2264 static void
2265 set_ip4_over_ethernet_rpc_callback (vnet_arp_set_ip4_over_ethernet_rpc_args_t
2266                                     * a)
2267 {
2268   vnet_main_t *vm = vnet_get_main ();
2269   ASSERT (vlib_get_thread_index () == 0);
2270
2271   if (a->flags & ETHERNET_ARP_ARGS_REMOVE)
2272     vnet_arp_unset_ip4_over_ethernet_internal (vm, a);
2273   else if (a->flags & ETHERNET_ARP_ARGS_FLUSH)
2274     vnet_arp_flush_ip4_over_ethernet_internal (vm, a);
2275   else if (a->flags & ETHERNET_ARP_ARGS_POPULATE)
2276     vnet_arp_populate_ip4_over_ethernet_internal (vm, a);
2277   else if (a->flags & ETHERNET_ARP_ARGS_WC_PUB)
2278     vnet_arp_wc_publish_internal (vm, a);
2279   else
2280     vnet_arp_set_ip4_over_ethernet_internal (vm, a);
2281 }
2282
2283 /**
2284  * @brief Invoked when the interface's admin state changes
2285  */
2286 static clib_error_t *
2287 ethernet_arp_sw_interface_up_down (vnet_main_t * vnm,
2288                                    u32 sw_if_index, u32 flags)
2289 {
2290   ethernet_arp_main_t *am = &ethernet_arp_main;
2291   ethernet_arp_ip4_entry_t *e;
2292   u32 i, *to_update = 0;
2293
2294   /* *INDENT-OFF* */
2295   pool_foreach (e, am->ip4_entry_pool,
2296   ({
2297     if (e->sw_if_index == sw_if_index)
2298       vec_add1 (to_update,
2299                 e - am->ip4_entry_pool);
2300   }));
2301   /* *INDENT-ON* */
2302
2303   for (i = 0; i < vec_len (to_update); i++)
2304     {
2305       e = pool_elt_at_index (am->ip4_entry_pool, to_update[i]);
2306
2307       vnet_arp_set_ip4_over_ethernet_rpc_args_t update_me = {
2308         .ip4.as_u32 = e->ip4_address.as_u32,
2309         .sw_if_index = e->sw_if_index,
2310       };
2311       mac_address_copy (&update_me.mac, &e->mac);
2312
2313       if (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP)
2314         {
2315           update_me.flags = ETHERNET_ARP_ARGS_POPULATE;
2316           vnet_arp_populate_ip4_over_ethernet_internal (vnm, &update_me);
2317         }
2318       else
2319         {
2320           update_me.flags = ETHERNET_ARP_ARGS_FLUSH;
2321           vnet_arp_flush_ip4_over_ethernet_internal (vnm, &update_me);
2322         }
2323     }
2324   vec_free (to_update);
2325
2326   return 0;
2327 }
2328
2329 VNET_SW_INTERFACE_ADMIN_UP_DOWN_FUNCTION (ethernet_arp_sw_interface_up_down);
2330
2331 static void
2332 increment_ip4_and_mac_address (ethernet_arp_ip4_over_ethernet_address_t * a)
2333 {
2334   u8 old;
2335   int i;
2336
2337   for (i = 3; i >= 0; i--)
2338     {
2339       old = a->ip4.as_u8[i];
2340       a->ip4.as_u8[i] += 1;
2341       if (old < a->ip4.as_u8[i])
2342         break;
2343     }
2344
2345   for (i = 5; i >= 0; i--)
2346     {
2347       old = a->mac.bytes[i];
2348       a->mac.bytes[i] += 1;
2349       if (old < a->mac.bytes[i])
2350         break;
2351     }
2352 }
2353
2354 int
2355 vnet_arp_set_ip4_over_ethernet (vnet_main_t * vnm,
2356                                 u32 sw_if_index,
2357                                 const ethernet_arp_ip4_over_ethernet_address_t
2358                                 * a, ip_neighbor_flags_t flags)
2359 {
2360   vnet_arp_set_ip4_over_ethernet_rpc_args_t args = {
2361     .sw_if_index = sw_if_index,
2362     .nbr_flags = flags,
2363     .flags = 0,
2364     .ip4.as_u32 = a->ip4.as_u32,
2365     .mac = a->mac,
2366   };
2367
2368   vl_api_rpc_call_main_thread (set_ip4_over_ethernet_rpc_callback,
2369                                (u8 *) & args, sizeof (args));
2370   return 0;
2371 }
2372
2373 void
2374 proxy_arp_walk (proxy_arp_walk_t cb, void *data)
2375 {
2376   ethernet_arp_main_t *am = &ethernet_arp_main;
2377   ethernet_proxy_arp_t *pa;
2378
2379   vec_foreach (pa, am->proxy_arps)
2380   {
2381     if (!cb (&pa->lo_addr, &pa->hi_addr, pa->fib_index, data))
2382       break;
2383   }
2384 }
2385
2386 int
2387 vnet_proxy_arp_enable_disable (vnet_main_t * vnm, u32 sw_if_index, u8 enable)
2388 {
2389   ethernet_arp_main_t *am = &ethernet_arp_main;
2390   ethernet_arp_interface_t *eai;
2391
2392   vec_validate (am->ethernet_arp_by_sw_if_index, sw_if_index);
2393
2394   eai = &am->ethernet_arp_by_sw_if_index[sw_if_index];
2395
2396   if (enable)
2397     {
2398       if (!eai->proxy_enabled)
2399         {
2400           vnet_feature_enable_disable ("arp", "arp-proxy",
2401                                        sw_if_index, 1, NULL, 0);
2402         }
2403       eai->proxy_enabled = 1;
2404     }
2405   else
2406     {
2407       if (eai->proxy_enabled)
2408         {
2409           vnet_feature_enable_disable ("arp", "arp-proxy",
2410                                        sw_if_index, 0, NULL, 0);
2411         }
2412       eai->proxy_enabled = 0;
2413     }
2414
2415   return (0);
2416 }
2417
2418 int
2419 vnet_proxy_arp_add_del (ip4_address_t * lo_addr,
2420                         ip4_address_t * hi_addr, u32 fib_index, int is_del)
2421 {
2422   ethernet_arp_main_t *am = &ethernet_arp_main;
2423   ethernet_proxy_arp_t *pa;
2424   u32 found_at_index = ~0;
2425
2426   vec_foreach (pa, am->proxy_arps)
2427   {
2428     if (pa->lo_addr.as_u32 == lo_addr->as_u32 &&
2429         pa->hi_addr.as_u32 == hi_addr->as_u32 && pa->fib_index == fib_index)
2430       {
2431         found_at_index = pa - am->proxy_arps;
2432         break;
2433       }
2434   }
2435
2436   if (found_at_index != ~0)
2437     {
2438       /* Delete, otherwise it's already in the table */
2439       if (is_del)
2440         vec_delete (am->proxy_arps, 1, found_at_index);
2441       return 0;
2442     }
2443   /* delete, no such entry */
2444   if (is_del)
2445     return VNET_API_ERROR_NO_SUCH_ENTRY;
2446
2447   /* add, not in table */
2448   vec_add2 (am->proxy_arps, pa, 1);
2449   pa->lo_addr.as_u32 = lo_addr->as_u32;
2450   pa->hi_addr.as_u32 = hi_addr->as_u32;
2451   pa->fib_index = fib_index;
2452   return 0;
2453 }
2454
2455 void
2456 proxy_arp_intfc_walk (proxy_arp_intf_walk_t cb, void *data)
2457 {
2458   ethernet_arp_main_t *am = &ethernet_arp_main;
2459   ethernet_arp_interface_t *eai;
2460
2461   vec_foreach (eai, am->ethernet_arp_by_sw_if_index)
2462   {
2463     if (eai->proxy_enabled)
2464       cb (eai - am->ethernet_arp_by_sw_if_index, data);
2465   }
2466 }
2467
2468 /*
2469  * Remove any proxy arp entries associated with the
2470  * specified fib.
2471  */
2472 int
2473 vnet_proxy_arp_fib_reset (u32 fib_id)
2474 {
2475   ethernet_arp_main_t *am = &ethernet_arp_main;
2476   ethernet_proxy_arp_t *pa;
2477   u32 *entries_to_delete = 0;
2478   u32 fib_index;
2479   int i;
2480
2481   fib_index = fib_table_find (FIB_PROTOCOL_IP4, fib_id);
2482   if (~0 == fib_index)
2483     return VNET_API_ERROR_NO_SUCH_ENTRY;
2484
2485   vec_foreach (pa, am->proxy_arps)
2486   {
2487     if (pa->fib_index == fib_index)
2488       {
2489         vec_add1 (entries_to_delete, pa - am->proxy_arps);
2490       }
2491   }
2492
2493   for (i = 0; i < vec_len (entries_to_delete); i++)
2494     {
2495       vec_delete (am->proxy_arps, 1, entries_to_delete[i]);
2496     }
2497
2498   vec_free (entries_to_delete);
2499
2500   return 0;
2501 }
2502
2503 static clib_error_t *
2504 ip_arp_add_del_command_fn (vlib_main_t * vm,
2505                            unformat_input_t * input, vlib_cli_command_t * cmd)
2506 {
2507   vnet_main_t *vnm = vnet_get_main ();
2508   u32 sw_if_index;
2509   ethernet_arp_ip4_over_ethernet_address_t lo_addr, hi_addr, addr;
2510   int addr_valid = 0;
2511   int is_del = 0;
2512   int count = 1;
2513   u32 fib_index = 0;
2514   u32 fib_id;
2515   int is_proxy = 0;
2516   ip_neighbor_flags_t flags;
2517
2518   flags = IP_NEIGHBOR_FLAG_NONE;
2519
2520   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2521     {
2522       /* set ip arp TenGigE1/1/0/1 1.2.3.4 aa:bb:... or aabb.ccdd... */
2523       if (unformat (input, "%U %U %U",
2524                     unformat_vnet_sw_interface, vnm, &sw_if_index,
2525                     unformat_ip4_address, &addr.ip4,
2526                     unformat_mac_address_t, &addr.mac))
2527         addr_valid = 1;
2528
2529       else if (unformat (input, "delete") || unformat (input, "del"))
2530         is_del = 1;
2531
2532       else if (unformat (input, "static"))
2533         flags |= IP_NEIGHBOR_FLAG_STATIC;
2534
2535       else if (unformat (input, "no-fib-entry"))
2536         flags |= IP_NEIGHBOR_FLAG_NO_FIB_ENTRY;
2537
2538       else if (unformat (input, "count %d", &count))
2539         ;
2540
2541       else if (unformat (input, "fib-id %d", &fib_id))
2542         {
2543           fib_index = fib_table_find (FIB_PROTOCOL_IP4, fib_id);
2544
2545           if (~0 == fib_index)
2546             return clib_error_return (0, "fib ID %d doesn't exist\n", fib_id);
2547         }
2548
2549       else if (unformat (input, "proxy %U - %U",
2550                          unformat_ip4_address, &lo_addr.ip4,
2551                          unformat_ip4_address, &hi_addr.ip4))
2552         is_proxy = 1;
2553       else
2554         break;
2555     }
2556
2557   if (is_proxy)
2558     {
2559       (void) vnet_proxy_arp_add_del (&lo_addr.ip4, &hi_addr.ip4,
2560                                      fib_index, is_del);
2561       return 0;
2562     }
2563
2564   if (addr_valid)
2565     {
2566       int i;
2567
2568       for (i = 0; i < count; i++)
2569         {
2570           if (is_del == 0)
2571             {
2572               uword event_type, *event_data = 0;
2573
2574               /* Park the debug CLI until the arp entry is installed */
2575               vnet_register_ip4_arp_resolution_event
2576                 (vnm, &addr.ip4, vlib_current_process (vm),
2577                  1 /* type */ , 0 /* data */ );
2578
2579               vnet_arp_set_ip4_over_ethernet (vnm, sw_if_index, &addr, flags);
2580
2581               vlib_process_wait_for_event (vm);
2582               event_type = vlib_process_get_events (vm, &event_data);
2583               vec_reset_length (event_data);
2584               if (event_type != 1)
2585                 clib_warning ("event type %d unexpected", event_type);
2586             }
2587           else
2588             vnet_arp_unset_ip4_over_ethernet (vnm, sw_if_index, &addr);
2589
2590           increment_ip4_and_mac_address (&addr);
2591         }
2592     }
2593   else
2594     {
2595       return clib_error_return (0, "unknown input `%U'",
2596                                 format_unformat_error, input);
2597     }
2598
2599   return 0;
2600 }
2601
2602 /* *INDENT-OFF* */
2603 /*?
2604  * Add or delete IPv4 ARP cache entries.
2605  *
2606  * @note 'set ip arp' options (e.g. delete, static, 'fib-id <id>',
2607  * 'count <number>', 'interface ip4_addr mac_addr') can be added in
2608  * any order and combination.
2609  *
2610  * @cliexpar
2611  * @parblock
2612  * Add or delete IPv4 ARP cache entries as follows. MAC Address can be in
2613  * either aa:bb:cc:dd:ee:ff format or aabb.ccdd.eeff format.
2614  * @cliexcmd{set ip arp GigabitEthernet2/0/0 6.0.0.3 dead.beef.babe}
2615  * @cliexcmd{set ip arp delete GigabitEthernet2/0/0 6.0.0.3 de:ad:be:ef:ba:be}
2616  *
2617  * To add or delete an IPv4 ARP cache entry to or from a specific fib
2618  * table:
2619  * @cliexcmd{set ip arp fib-id 1 GigabitEthernet2/0/0 6.0.0.3 dead.beef.babe}
2620  * @cliexcmd{set ip arp fib-id 1 delete GigabitEthernet2/0/0 6.0.0.3 dead.beef.babe}
2621  *
2622  * Add or delete IPv4 static ARP cache entries as follows:
2623  * @cliexcmd{set ip arp static GigabitEthernet2/0/0 6.0.0.3 dead.beef.babe}
2624  * @cliexcmd{set ip arp static delete GigabitEthernet2/0/0 6.0.0.3 dead.beef.babe}
2625  *
2626  * For testing / debugging purposes, the 'set ip arp' command can add or
2627  * delete multiple entries. Supply the 'count N' parameter:
2628  * @cliexcmd{set ip arp count 10 GigabitEthernet2/0/0 6.0.0.3 dead.beef.babe}
2629  * @endparblock
2630  ?*/
2631 VLIB_CLI_COMMAND (ip_arp_add_del_command, static) = {
2632   .path = "set ip arp",
2633   .short_help =
2634   "set ip arp [del] <intfc> <ip-address> <mac-address> [static] [no-fib-entry] [count <count>] [fib-id <fib-id>] [proxy <lo-addr> - <hi-addr>]",
2635   .function = ip_arp_add_del_command_fn,
2636 };
2637 /* *INDENT-ON* */
2638
2639 static clib_error_t *
2640 set_int_proxy_arp_command_fn (vlib_main_t * vm,
2641                               unformat_input_t *
2642                               input, vlib_cli_command_t * cmd)
2643 {
2644   vnet_main_t *vnm = vnet_get_main ();
2645   u32 sw_if_index;
2646   int enable = 0;
2647
2648   sw_if_index = ~0;
2649
2650   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2651     {
2652       if (unformat (input, "%U", unformat_vnet_sw_interface,
2653                     vnm, &sw_if_index))
2654         ;
2655       else if (unformat (input, "enable") || unformat (input, "on"))
2656         enable = 1;
2657       else if (unformat (input, "disable") || unformat (input, "off"))
2658         enable = 0;
2659       else
2660         break;
2661     }
2662
2663   if (~0 == sw_if_index)
2664     return clib_error_return (0, "unknown input '%U'",
2665                               format_unformat_error, input);
2666
2667   vnet_proxy_arp_enable_disable (vnm, sw_if_index, enable);
2668
2669   return 0;
2670 }
2671
2672 /* *INDENT-OFF* */
2673 /*?
2674  * Enable proxy-arp on an interface. The vpp stack will answer ARP
2675  * requests for the indicated address range. Multiple proxy-arp
2676  * ranges may be provisioned.
2677  *
2678  * @note Proxy ARP as a technology is infamous for blackholing traffic.
2679  * Also, the underlying implementation has not been performance-tuned.
2680  * Avoid creating an unnecessarily large set of ranges.
2681  *
2682  * @cliexpar
2683  * To enable proxy arp on a range of addresses, use:
2684  * @cliexcmd{set ip arp proxy 6.0.0.1 - 6.0.0.11}
2685  * Append 'del' to delete a range of proxy ARP addresses:
2686  * @cliexcmd{set ip arp proxy 6.0.0.1 - 6.0.0.11 del}
2687  * You must then specifically enable proxy arp on individual interfaces:
2688  * @cliexcmd{set interface proxy-arp GigabitEthernet0/8/0 enable}
2689  * To disable proxy arp on an individual interface:
2690  * @cliexcmd{set interface proxy-arp GigabitEthernet0/8/0 disable}
2691  ?*/
2692 VLIB_CLI_COMMAND (set_int_proxy_enable_command, static) = {
2693   .path = "set interface proxy-arp",
2694   .short_help =
2695   "set interface proxy-arp <intfc> [enable|disable]",
2696   .function = set_int_proxy_arp_command_fn,
2697 };
2698 /* *INDENT-ON* */
2699
2700
2701 /*
2702  * ARP/ND Termination in a L2 Bridge Domain based on IP4/IP6 to MAC
2703  * hash tables mac_by_ip4 and mac_by_ip6 for each BD.
2704  */
2705 typedef enum
2706 {
2707   ARP_TERM_NEXT_L2_OUTPUT,
2708   ARP_TERM_NEXT_DROP,
2709   ARP_TERM_N_NEXT,
2710 } arp_term_next_t;
2711
2712 u32 arp_term_next_node_index[32];
2713
2714 static uword
2715 arp_term_l2bd (vlib_main_t * vm,
2716                vlib_node_runtime_t * node, vlib_frame_t * frame)
2717 {
2718   l2input_main_t *l2im = &l2input_main;
2719   u32 n_left_from, next_index, *from, *to_next;
2720   u32 n_replies_sent = 0;
2721   u16 last_bd_index = ~0;
2722   l2_bridge_domain_t *last_bd_config = 0;
2723   l2_input_config_t *cfg0;
2724
2725   from = vlib_frame_vector_args (frame);
2726   n_left_from = frame->n_vectors;
2727   next_index = node->cached_next_index;
2728
2729   while (n_left_from > 0)
2730     {
2731       u32 n_left_to_next;
2732
2733       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
2734
2735       while (n_left_from > 0 && n_left_to_next > 0)
2736         {
2737           vlib_buffer_t *p0;
2738           ethernet_header_t *eth0;
2739           ethernet_arp_header_t *arp0;
2740           ip6_header_t *iph0;
2741           u8 *l3h0;
2742           u32 pi0, error0, next0, sw_if_index0;
2743           u16 ethertype0;
2744           u16 bd_index0;
2745           u32 ip0;
2746           u8 *macp0;
2747
2748           pi0 = from[0];
2749           to_next[0] = pi0;
2750           from += 1;
2751           to_next += 1;
2752           n_left_from -= 1;
2753           n_left_to_next -= 1;
2754
2755           p0 = vlib_get_buffer (vm, pi0);
2756           // Terminate only local (SHG == 0) ARP
2757           if (vnet_buffer (p0)->l2.shg != 0)
2758             goto next_l2_feature;
2759
2760           eth0 = vlib_buffer_get_current (p0);
2761           l3h0 = (u8 *) eth0 + vnet_buffer (p0)->l2.l2_len;
2762           ethertype0 = clib_net_to_host_u16 (*(u16 *) (l3h0 - 2));
2763           arp0 = (ethernet_arp_header_t *) l3h0;
2764
2765           if (ethertype0 != ETHERNET_TYPE_ARP)
2766             goto check_ip6_nd;
2767
2768           if ((arp0->opcode !=
2769                clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_request)) &&
2770               (arp0->opcode !=
2771                clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply)))
2772             goto check_ip6_nd;
2773
2774           /* Must be ARP request/reply packet here */
2775           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) &&
2776                              (p0->flags & VLIB_BUFFER_IS_TRACED)))
2777             {
2778               u8 *t0 = vlib_add_trace (vm, node, p0,
2779                                        sizeof (ethernet_arp_input_trace_t));
2780               clib_memcpy_fast (t0, l3h0,
2781                                 sizeof (ethernet_arp_input_trace_t));
2782             }
2783
2784           error0 = 0;
2785           error0 =
2786             (arp0->l2_type !=
2787              clib_net_to_host_u16 (ETHERNET_ARP_HARDWARE_TYPE_ethernet)
2788              ? ETHERNET_ARP_ERROR_l2_type_not_ethernet : error0);
2789           error0 =
2790             (arp0->l3_type !=
2791              clib_net_to_host_u16 (ETHERNET_TYPE_IP4) ?
2792              ETHERNET_ARP_ERROR_l3_type_not_ip4 : error0);
2793
2794           sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
2795
2796           if (error0)
2797             goto drop;
2798
2799           /* Trash ARP packets whose ARP-level source addresses do not
2800              match, or if requester address is mcast */
2801           if (PREDICT_FALSE
2802               (!ethernet_mac_address_equal (eth0->src_address,
2803                                             arp0->ip4_over_ethernet[0].
2804                                             mac.bytes))
2805               || ethernet_address_cast (arp0->ip4_over_ethernet[0].mac.bytes))
2806             {
2807               /* VRRP virtual MAC may be different to SMAC in ARP reply */
2808               if (!ethernet_mac_address_equal
2809                   (arp0->ip4_over_ethernet[0].mac.bytes, vrrp_prefix))
2810                 {
2811                   error0 = ETHERNET_ARP_ERROR_l2_address_mismatch;
2812                   goto drop;
2813                 }
2814             }
2815           if (PREDICT_FALSE
2816               (ip4_address_is_multicast (&arp0->ip4_over_ethernet[0].ip4)))
2817             {
2818               error0 = ETHERNET_ARP_ERROR_l3_src_address_not_local;
2819               goto drop;
2820             }
2821
2822           /* Check if anyone want ARP request events for L2 BDs */
2823           {
2824             ethernet_arp_main_t *am = &ethernet_arp_main;
2825             if (am->wc_ip4_arp_publisher_node != (uword) ~ 0)
2826               vnet_arp_wc_publish (sw_if_index0, &arp0->ip4_over_ethernet[0]);
2827           }
2828
2829           /* lookup BD mac_by_ip4 hash table for MAC entry */
2830           ip0 = arp0->ip4_over_ethernet[1].ip4.as_u32;
2831           bd_index0 = vnet_buffer (p0)->l2.bd_index;
2832           if (PREDICT_FALSE ((bd_index0 != last_bd_index)
2833                              || (last_bd_index == (u16) ~ 0)))
2834             {
2835               last_bd_index = bd_index0;
2836               last_bd_config = vec_elt_at_index (l2im->bd_configs, bd_index0);
2837             }
2838           macp0 = (u8 *) hash_get (last_bd_config->mac_by_ip4, ip0);
2839
2840           if (PREDICT_FALSE (!macp0))
2841             goto next_l2_feature;       /* MAC not found */
2842           if (PREDICT_FALSE (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
2843                              arp0->ip4_over_ethernet[1].ip4.as_u32))
2844             goto next_l2_feature;       /* GARP */
2845
2846           /* MAC found, send ARP reply -
2847              Convert ARP request packet to ARP reply */
2848           arp0->opcode = clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply);
2849           arp0->ip4_over_ethernet[1] = arp0->ip4_over_ethernet[0];
2850           arp0->ip4_over_ethernet[0].ip4.as_u32 = ip0;
2851           mac_address_from_bytes (&arp0->ip4_over_ethernet[0].mac, macp0);
2852           clib_memcpy_fast (eth0->dst_address, eth0->src_address, 6);
2853           clib_memcpy_fast (eth0->src_address, macp0, 6);
2854           n_replies_sent += 1;
2855
2856         output_response:
2857           /* For BVI, need to use l2-fwd node to send ARP reply as
2858              l2-output node cannot output packet to BVI properly */
2859           cfg0 = vec_elt_at_index (l2im->configs, sw_if_index0);
2860           if (PREDICT_FALSE (cfg0->bvi))
2861             {
2862               vnet_buffer (p0)->l2.feature_bitmap |= L2INPUT_FEAT_FWD;
2863               vnet_buffer (p0)->sw_if_index[VLIB_RX] = 0;
2864               goto next_l2_feature;
2865             }
2866
2867           /* Send ARP/ND reply back out input interface through l2-output */
2868           vnet_buffer (p0)->sw_if_index[VLIB_TX] = sw_if_index0;
2869           next0 = ARP_TERM_NEXT_L2_OUTPUT;
2870           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
2871                                            to_next, n_left_to_next, pi0,
2872                                            next0);
2873           continue;
2874
2875         check_ip6_nd:
2876           /* IP6 ND event notification or solicitation handling to generate
2877              local response instead of flooding */
2878           iph0 = (ip6_header_t *) l3h0;
2879           if (PREDICT_FALSE (ethertype0 == ETHERNET_TYPE_IP6 &&
2880                              iph0->protocol == IP_PROTOCOL_ICMP6 &&
2881                              !ip6_address_is_unspecified
2882                              (&iph0->src_address)))
2883             {
2884               sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
2885               if (vnet_ip6_nd_term
2886                   (vm, node, p0, eth0, iph0, sw_if_index0,
2887                    vnet_buffer (p0)->l2.bd_index))
2888                 goto output_response;
2889             }
2890
2891         next_l2_feature:
2892           {
2893             next0 = vnet_l2_feature_next (p0, arp_term_next_node_index,
2894                                           L2INPUT_FEAT_ARP_TERM);
2895             vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
2896                                              to_next, n_left_to_next,
2897                                              pi0, next0);
2898             continue;
2899           }
2900
2901         drop:
2902           if (0 == arp0->ip4_over_ethernet[0].ip4.as_u32 ||
2903               (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
2904                arp0->ip4_over_ethernet[1].ip4.as_u32))
2905             {
2906               error0 = ETHERNET_ARP_ERROR_gratuitous_arp;
2907             }
2908           next0 = ARP_TERM_NEXT_DROP;
2909           p0->error = node->errors[error0];
2910
2911           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
2912                                            to_next, n_left_to_next, pi0,
2913                                            next0);
2914         }
2915
2916       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
2917     }
2918
2919   vlib_error_count (vm, node->node_index,
2920                     ETHERNET_ARP_ERROR_replies_sent, n_replies_sent);
2921   return frame->n_vectors;
2922 }
2923
2924 /* *INDENT-OFF* */
2925 VLIB_REGISTER_NODE (arp_term_l2bd_node, static) = {
2926   .function = arp_term_l2bd,
2927   .name = "arp-term-l2bd",
2928   .vector_size = sizeof (u32),
2929   .n_errors = ETHERNET_ARP_N_ERROR,
2930   .error_strings = ethernet_arp_error_strings,
2931   .n_next_nodes = ARP_TERM_N_NEXT,
2932   .next_nodes = {
2933     [ARP_TERM_NEXT_L2_OUTPUT] = "l2-output",
2934     [ARP_TERM_NEXT_DROP] = "error-drop",
2935   },
2936   .format_buffer = format_ethernet_arp_header,
2937   .format_trace = format_arp_term_input_trace,
2938 };
2939 /* *INDENT-ON* */
2940
2941 clib_error_t *
2942 arp_term_init (vlib_main_t * vm)
2943 {
2944   // Initialize the feature next-node indexes
2945   feat_bitmap_init_next_nodes (vm,
2946                                arp_term_l2bd_node.index,
2947                                L2INPUT_N_FEAT,
2948                                l2input_get_feat_names (),
2949                                arp_term_next_node_index);
2950   return 0;
2951 }
2952
2953 VLIB_INIT_FUNCTION (arp_term_init);
2954
2955 void
2956 change_arp_mac (u32 sw_if_index, ethernet_arp_ip4_entry_t * e)
2957 {
2958   if (e->sw_if_index == sw_if_index)
2959     {
2960       adj_nbr_walk_nh4 (e->sw_if_index,
2961                         &e->ip4_address, arp_mk_complete_walk, e);
2962     }
2963 }
2964
2965 void
2966 ethernet_arp_change_mac (u32 sw_if_index)
2967 {
2968   ethernet_arp_main_t *am = &ethernet_arp_main;
2969   ethernet_arp_ip4_entry_t *e;
2970   adj_index_t ai;
2971
2972   /* *INDENT-OFF* */
2973   pool_foreach (e, am->ip4_entry_pool,
2974   ({
2975     change_arp_mac (sw_if_index, e);
2976   }));
2977   /* *INDENT-ON* */
2978
2979   ai = adj_glean_get (FIB_PROTOCOL_IP4, sw_if_index);
2980
2981   if (ADJ_INDEX_INVALID != ai)
2982     adj_glean_update_rewrite (ai);
2983 }
2984
2985 void
2986 send_ip4_garp (vlib_main_t * vm, u32 sw_if_index)
2987 {
2988   ip4_main_t *i4m = &ip4_main;
2989   ip4_address_t *ip4_addr = ip4_interface_first_address (i4m, sw_if_index, 0);
2990
2991   send_ip4_garp_w_addr (vm, ip4_addr, sw_if_index);
2992 }
2993
2994 void
2995 send_ip4_garp_w_addr (vlib_main_t * vm,
2996                       const ip4_address_t * ip4_addr, u32 sw_if_index)
2997 {
2998   ip4_main_t *i4m = &ip4_main;
2999   vnet_main_t *vnm = vnet_get_main ();
3000   u8 *rewrite, rewrite_len;
3001   vnet_hw_interface_t *hi = vnet_get_sup_hw_interface (vnm, sw_if_index);
3002
3003   if (ip4_addr)
3004     {
3005       clib_warning ("Sending GARP for IP4 address %U on sw_if_idex %d",
3006                     format_ip4_address, ip4_addr, sw_if_index);
3007
3008       /* Form GARP packet for output - Gratuitous ARP is an ARP request packet
3009          where the interface IP/MAC pair is used for both source and request
3010          MAC/IP pairs in the request */
3011       u32 bi = 0;
3012       ethernet_arp_header_t *h = vlib_packet_template_get_packet
3013         (vm, &i4m->ip4_arp_request_packet_template, &bi);
3014
3015       if (!h)
3016         return;
3017
3018       mac_address_from_bytes (&h->ip4_over_ethernet[0].mac, hi->hw_address);
3019       mac_address_from_bytes (&h->ip4_over_ethernet[1].mac, hi->hw_address);
3020       h->ip4_over_ethernet[0].ip4 = ip4_addr[0];
3021       h->ip4_over_ethernet[1].ip4 = ip4_addr[0];
3022
3023       /* Setup MAC header with ARP Etype and broadcast DMAC */
3024       vlib_buffer_t *b = vlib_get_buffer (vm, bi);
3025       rewrite =
3026         ethernet_build_rewrite (vnm, sw_if_index, VNET_LINK_ARP,
3027                                 VNET_REWRITE_FOR_SW_INTERFACE_ADDRESS_BROADCAST);
3028       rewrite_len = vec_len (rewrite);
3029       vlib_buffer_advance (b, -rewrite_len);
3030       ethernet_header_t *e = vlib_buffer_get_current (b);
3031       clib_memcpy_fast (e->dst_address, rewrite, rewrite_len);
3032       vec_free (rewrite);
3033
3034       /* Send GARP packet out the specified interface */
3035       vnet_buffer (b)->sw_if_index[VLIB_RX] =
3036         vnet_buffer (b)->sw_if_index[VLIB_TX] = sw_if_index;
3037       vlib_frame_t *f = vlib_get_frame_to_node (vm, hi->output_node_index);
3038       u32 *to_next = vlib_frame_vector_args (f);
3039       to_next[0] = bi;
3040       f->n_vectors = 1;
3041       vlib_put_frame_to_node (vm, hi->output_node_index, f);
3042     }
3043 }
3044
3045 /*
3046  * Remove any arp entries associated with the specified interface
3047  */
3048 static clib_error_t *
3049 vnet_arp_delete_sw_interface (vnet_main_t * vnm, u32 sw_if_index, u32 is_add)
3050 {
3051   if (!is_add && sw_if_index != ~0)
3052     {
3053       ethernet_arp_main_t *am = &ethernet_arp_main;
3054       ethernet_arp_ip4_entry_t *e;
3055       /* *INDENT-OFF* */
3056       pool_foreach (e, am->ip4_entry_pool, ({
3057         if (e->sw_if_index != sw_if_index)
3058           continue;
3059         vnet_arp_set_ip4_over_ethernet_rpc_args_t args = {
3060           .sw_if_index = sw_if_index,
3061           .ip4 = e->ip4_address,
3062         };
3063         vnet_arp_unset_ip4_over_ethernet_internal (vnm, &args);
3064       }));
3065       /* *INDENT-ON* */
3066     }
3067
3068   return (NULL);
3069 }
3070
3071 VNET_SW_INTERFACE_ADD_DEL_FUNCTION (vnet_arp_delete_sw_interface);
3072
3073 /*
3074  * fd.io coding-style-patch-verification: ON
3075  *
3076  * Local Variables:
3077  * eval: (c-set-style "gnu")
3078  * End:
3079  */