5 from framework import VppTestCase, VppTestRunner
6 from vpp_object import VppObject
7 from vpp_neighbor import VppNeighbor
8 from vpp_ip_route import VppIpRoute, VppRoutePath, VppIpTable, \
9 VppIpInterfaceAddress, VppIpInterfaceBind, find_route
10 from vpp_l2 import VppBridgeDomain, VppBridgeDomainPort, \
11 VppBridgeDomainArpEntry, VppL2FibEntry, find_bridge_domain_port
12 from vpp_vxlan_gbp_tunnel import *
13 from vpp_sub_interface import VppDot1QSubint
17 from vpp_papi_provider import L2_PORT_TYPE
18 from vpp_papi import VppEnum
20 from scapy.packet import Raw
21 from scapy.layers.l2 import Ether, ARP, Dot1Q
22 from scapy.layers.inet import IP, UDP
23 from scapy.layers.inet6 import IPv6, ICMPv6ND_NS, ICMPv6NDOptSrcLLAddr, \
25 from scapy.utils6 import in6_getnsma, in6_getnsmac
26 from scapy.layers.vxlan import VXLAN
28 from socket import AF_INET, AF_INET6
29 from scapy.utils import inet_pton, inet_ntop
30 from util import mactobinary
31 from vpp_papi_provider import L2_VTR_OP
34 def find_gbp_endpoint(test, sw_if_index=None, ip=None, mac=None):
36 vip = VppIpAddress(ip)
38 vmac = VppMacAddress(mac)
40 eps = test.vapi.gbp_endpoint_dump()
44 if ep.endpoint.sw_if_index != sw_if_index:
47 for eip in ep.endpoint.ips:
51 if vmac == ep.endpoint.mac:
56 def find_gbp_vxlan(test, vni):
57 ts = test.vapi.gbp_vxlan_tunnel_dump()
59 if t.tunnel.vni == vni:
64 class VppGbpEndpoint(VppObject):
71 return self.vmac.bytes
75 return self.vmac.address
79 return self.itf.remote_mac
99 return [self.ip4, self.ip6]
103 return [self.fip4, self.fip6]
105 def __init__(self, test, itf, epg, recirc, ip4, fip4, ip6, fip6,
115 self._ip4 = VppIpAddress(ip4)
116 self._fip4 = VppIpAddress(fip4)
117 self._ip6 = VppIpAddress(ip6)
118 self._fip6 = VppIpAddress(fip6)
121 self.vmac = VppMacAddress(self.itf.remote_mac)
123 self.vmac = VppMacAddress("00:00:00:00:00:00")
126 self.tun_src = VppIpAddress(tun_src)
127 self.tun_dst = VppIpAddress(tun_dst)
129 def add_vpp_config(self):
130 res = self._test.vapi.gbp_endpoint_add(
131 self.itf.sw_if_index,
132 [self.ip4.encode(), self.ip6.encode()],
136 self.tun_src.encode(),
137 self.tun_dst.encode())
138 self.handle = res.handle
139 self._test.registry.register(self, self._test.logger)
141 def remove_vpp_config(self):
142 self._test.vapi.gbp_endpoint_del(self.handle)
145 return self.object_id()
148 return "gbp-endpoint:[%d==%d:%s:%d]" % (self.handle,
149 self.itf.sw_if_index,
153 def query_vpp_config(self):
154 return find_gbp_endpoint(self._test,
155 self.itf.sw_if_index,
159 class VppGbpRecirc(VppObject):
161 GBP Recirculation Interface
164 def __init__(self, test, epg, recirc, is_ext=False):
170 def add_vpp_config(self):
171 self._test.vapi.gbp_recirc_add_del(
173 self.recirc.sw_if_index,
176 self._test.registry.register(self, self._test.logger)
178 def remove_vpp_config(self):
179 self._test.vapi.gbp_recirc_add_del(
181 self.recirc.sw_if_index,
186 return self.object_id()
189 return "gbp-recirc:[%d]" % (self.recirc.sw_if_index)
191 def query_vpp_config(self):
192 rs = self._test.vapi.gbp_recirc_dump()
194 if r.recirc.sw_if_index == self.recirc.sw_if_index:
199 class VppGbpExtItf(VppObject):
201 GBP ExtItfulation Interface
204 def __init__(self, test, itf, bd, rd):
210 def add_vpp_config(self):
211 self._test.vapi.gbp_ext_itf_add_del(
213 self.itf.sw_if_index,
216 self._test.registry.register(self, self._test.logger)
218 def remove_vpp_config(self):
219 self._test.vapi.gbp_ext_itf_add_del(
221 self.itf.sw_if_index,
226 return self.object_id()
229 return "gbp-ext-itf:[%d]" % (self.itf.sw_if_index)
231 def query_vpp_config(self):
232 rs = self._test.vapi.gbp_ext_itf_dump()
234 if r.ext_itf.sw_if_index == self.itf.sw_if_index:
239 class VppGbpSubnet(VppObject):
243 def __init__(self, test, rd, address, address_len,
244 type, sw_if_index=None, epg=None):
246 self.rd_id = rd.rd_id
247 self.prefix = VppIpPrefix(address, address_len)
249 self.sw_if_index = sw_if_index
252 def add_vpp_config(self):
253 self._test.vapi.gbp_subnet_add_del(
256 self.prefix.encode(),
258 sw_if_index=self.sw_if_index if self.sw_if_index else 0xffffffff,
259 epg_id=self.epg if self.epg else 0xffff)
260 self._test.registry.register(self, self._test.logger)
262 def remove_vpp_config(self):
263 self._test.vapi.gbp_subnet_add_del(
266 self.prefix.encode(),
270 return self.object_id()
273 return "gbp-subnet:[%d-%s]" % (self.rd_id, self.prefix)
275 def query_vpp_config(self):
276 ss = self._test.vapi.gbp_subnet_dump()
278 if s.subnet.rd_id == self.rd_id and \
279 s.subnet.type == self.type and \
280 s.subnet.prefix == self.prefix:
285 class VppGbpEndpointGroup(VppObject):
290 def __init__(self, test, epg, rd, bd, uplink,
291 bvi, bvi_ip4, bvi_ip6=None):
295 self.bvi_ip4 = VppIpAddress(bvi_ip4)
296 self.bvi_ip6 = VppIpAddress(bvi_ip6)
301 def add_vpp_config(self):
302 self._test.vapi.gbp_endpoint_group_add(
306 self.uplink.sw_if_index if self.uplink else INDEX_INVALID)
307 self._test.registry.register(self, self._test.logger)
309 def remove_vpp_config(self):
310 self._test.vapi.gbp_endpoint_group_del(
314 return self.object_id()
317 return "gbp-endpoint-group:[%d]" % (self.epg)
319 def query_vpp_config(self):
320 epgs = self._test.vapi.gbp_endpoint_group_dump()
322 if epg.epg.epg_id == self.epg:
327 class VppGbpBridgeDomain(VppObject):
332 def __init__(self, test, bd, bvi, uu_flood=None, learn=True):
335 self.uu_flood = uu_flood
338 e = VppEnum.vl_api_gbp_bridge_domain_flags_t
340 self.learn = e.GBP_BD_API_FLAG_NONE
342 self.learn = e.GBP_BD_API_FLAG_DO_NOT_LEARN
344 def add_vpp_config(self):
345 self._test.vapi.gbp_bridge_domain_add(
348 self.bvi.sw_if_index,
349 self.uu_flood.sw_if_index if self.uu_flood else INDEX_INVALID)
350 self._test.registry.register(self, self._test.logger)
352 def remove_vpp_config(self):
353 self._test.vapi.gbp_bridge_domain_del(self.bd.bd_id)
356 return self.object_id()
359 return "gbp-bridge-domain:[%d]" % (self.bd.bd_id)
361 def query_vpp_config(self):
362 bds = self._test.vapi.gbp_bridge_domain_dump()
364 if bd.bd.bd_id == self.bd.bd_id:
369 class VppGbpRouteDomain(VppObject):
374 def __init__(self, test, rd_id, t4, t6, ip4_uu=None, ip6_uu=None):
382 def add_vpp_config(self):
383 self._test.vapi.gbp_route_domain_add(
387 self.ip4_uu.sw_if_index if self.ip4_uu else INDEX_INVALID,
388 self.ip6_uu.sw_if_index if self.ip6_uu else INDEX_INVALID)
389 self._test.registry.register(self, self._test.logger)
391 def remove_vpp_config(self):
392 self._test.vapi.gbp_route_domain_del(self.rd_id)
395 return self.object_id()
398 return "gbp-route-domain:[%d]" % (self.rd_id)
400 def query_vpp_config(self):
401 rds = self._test.vapi.gbp_route_domain_dump()
403 if rd.rd.rd_id == self.rd_id:
408 class VppGbpContractNextHop():
409 def __init__(self, mac, bd, ip, rd):
416 return {'ip': self.ip.encode(),
417 'mac': self.mac.encode(),
418 'bd_id': self.bd.bd.bd_id,
419 'rd_id': self.rd.rd_id}
422 class VppGbpContractRule():
423 def __init__(self, action, hash_mode, nhs=[]):
425 self.hash_mode = hash_mode
431 nhs.append(nh.encode())
434 return {'action': self.action,
436 'hash_mode': self.hash_mode,
437 'n_nhs': len(self.nhs),
441 class VppGbpContract(VppObject):
446 def __init__(self, test, src_epg, dst_epg, acl_index, rules=[]):
448 self.acl_index = acl_index
449 self.src_epg = src_epg
450 self.dst_epg = dst_epg
453 def add_vpp_config(self):
456 rules.append(r.encode())
457 self._test.vapi.gbp_contract_add_del(
463 self._test.registry.register(self, self._test.logger)
465 def remove_vpp_config(self):
466 self._test.vapi.gbp_contract_add_del(
474 return self.object_id()
477 return "gbp-contract:[%d:%s:%d]" % (self.src_epg,
481 def query_vpp_config(self):
482 cs = self._test.vapi.gbp_contract_dump()
484 if c.contract.src_epg == self.src_epg \
485 and c.contract.dst_epg == self.dst_epg:
490 class VppGbpVxlanTunnel(VppInterface):
495 def __init__(self, test, vni, bd_rd_id, mode):
496 super(VppGbpVxlanTunnel, self).__init__(test)
499 self.bd_rd_id = bd_rd_id
502 def add_vpp_config(self):
503 r = self._test.vapi.gbp_vxlan_tunnel_add(
507 self.set_sw_if_index(r.sw_if_index)
508 self._test.registry.register(self, self._test.logger)
510 def remove_vpp_config(self):
511 self._test.vapi.gbp_vxlan_tunnel_del(self.vni)
514 return self.object_id()
517 return "gbp-vxlan:%d" % (self.vni)
519 def query_vpp_config(self):
520 return find_gbp_vxlan(self._test, self.vni)
523 class VppGbpAcl(VppObject):
528 def __init__(self, test):
530 self.acl_index = 4294967295
532 def create_rule(self, is_ipv6=0, permit_deny=0, proto=-1,
533 s_prefix=0, s_ip='\x00\x00\x00\x00', sport_from=0,
534 sport_to=65535, d_prefix=0, d_ip='\x00\x00\x00\x00',
535 dport_from=0, dport_to=65535):
536 if proto == -1 or proto == 0:
539 elif proto == 1 or proto == 58:
542 rule = ({'is_permit': permit_deny, 'is_ipv6': is_ipv6, 'proto': proto,
543 'srcport_or_icmptype_first': sport_from,
544 'srcport_or_icmptype_last': sport_to,
545 'src_ip_prefix_len': s_prefix,
547 'dstport_or_icmpcode_first': dport_from,
548 'dstport_or_icmpcode_last': dport_to,
549 'dst_ip_prefix_len': d_prefix,
550 'dst_ip_addr': d_ip})
553 def add_vpp_config(self, rules):
555 reply = self._test.vapi.acl_add_replace(self.acl_index,
558 self.acl_index = reply.acl_index
559 return self.acl_index
561 def remove_vpp_config(self):
562 self._test.vapi.acl_del(self.acl_index)
565 return self.object_id()
568 return "gbp-acl:[%d]" % (self.acl_index)
570 def query_vpp_config(self):
571 cs = self._test.vapi.acl_dump()
573 if c.acl_index == self.acl_index:
578 class TestGBP(VppTestCase):
579 """ GBP Test Case """
582 super(TestGBP, self).setUp()
584 self.create_pg_interfaces(range(9))
585 self.create_loopback_interfaces(8)
587 self.router_mac = VppMacAddress("00:11:22:33:44:55")
589 for i in self.pg_interfaces:
591 for i in self.lo_interfaces:
595 for i in self.pg_interfaces:
598 super(TestGBP, self).tearDown()
600 def send_and_expect_bridged(self, src, tx, dst):
601 rx = self.send_and_expect(src, tx, dst)
604 self.assertEqual(r[Ether].src, tx[0][Ether].src)
605 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
606 self.assertEqual(r[IP].src, tx[0][IP].src)
607 self.assertEqual(r[IP].dst, tx[0][IP].dst)
610 def send_and_expect_bridged6(self, src, tx, dst):
611 rx = self.send_and_expect(src, tx, dst)
614 self.assertEqual(r[Ether].src, tx[0][Ether].src)
615 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
616 self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
617 self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
620 def send_and_expect_routed(self, src, tx, dst, src_mac):
621 rx = self.send_and_expect(src, tx, dst)
624 self.assertEqual(r[Ether].src, src_mac)
625 self.assertEqual(r[Ether].dst, dst.remote_mac)
626 self.assertEqual(r[IP].src, tx[0][IP].src)
627 self.assertEqual(r[IP].dst, tx[0][IP].dst)
630 def send_and_expect_natted(self, src, tx, dst, src_ip):
631 rx = self.send_and_expect(src, tx, dst)
634 self.assertEqual(r[Ether].src, tx[0][Ether].src)
635 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
636 self.assertEqual(r[IP].src, src_ip)
637 self.assertEqual(r[IP].dst, tx[0][IP].dst)
640 def send_and_expect_natted6(self, src, tx, dst, src_ip):
641 rx = self.send_and_expect(src, tx, dst)
644 self.assertEqual(r[Ether].src, tx[0][Ether].src)
645 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
646 self.assertEqual(r[IPv6].src, src_ip)
647 self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
650 def send_and_expect_unnatted(self, src, tx, dst, dst_ip):
651 rx = self.send_and_expect(src, tx, dst)
654 self.assertEqual(r[Ether].src, tx[0][Ether].src)
655 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
656 self.assertEqual(r[IP].dst, dst_ip)
657 self.assertEqual(r[IP].src, tx[0][IP].src)
660 def send_and_expect_unnatted6(self, src, tx, dst, dst_ip):
661 rx = self.send_and_expect(src, tx, dst)
664 self.assertEqual(r[Ether].src, tx[0][Ether].src)
665 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
666 self.assertEqual(r[IPv6].dst, dst_ip)
667 self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
670 def send_and_expect_double_natted(self, src, tx, dst, src_ip, dst_ip):
671 rx = self.send_and_expect(src, tx, dst)
674 self.assertEqual(r[Ether].src, self.router_mac.address)
675 self.assertEqual(r[Ether].dst, dst.remote_mac)
676 self.assertEqual(r[IP].dst, dst_ip)
677 self.assertEqual(r[IP].src, src_ip)
680 def send_and_expect_double_natted6(self, src, tx, dst, src_ip, dst_ip):
681 rx = self.send_and_expect(src, tx, dst)
684 self.assertEqual(r[Ether].src, self.router_mac.address)
685 self.assertEqual(r[Ether].dst, dst.remote_mac)
686 self.assertEqual(r[IPv6].dst, dst_ip)
687 self.assertEqual(r[IPv6].src, src_ip)
691 """ Group Based Policy """
693 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
698 bd1 = VppBridgeDomain(self, 1)
699 bd2 = VppBridgeDomain(self, 2)
700 bd20 = VppBridgeDomain(self, 20)
704 bd20.add_vpp_config()
706 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
707 gbd2 = VppGbpBridgeDomain(self, bd2, self.loop1)
708 gbd20 = VppGbpBridgeDomain(self, bd20, self.loop2)
710 gbd1.add_vpp_config()
711 gbd2.add_vpp_config()
712 gbd20.add_vpp_config()
717 gt4 = VppIpTable(self, 0)
719 gt6 = VppIpTable(self, 0, is_ip6=True)
721 nt4 = VppIpTable(self, 20)
723 nt6 = VppIpTable(self, 20, is_ip6=True)
726 rd0 = VppGbpRouteDomain(self, 0, gt4, gt6, None, None)
727 rd20 = VppGbpRouteDomain(self, 20, nt4, nt6, None, None)
730 rd20.add_vpp_config()
733 # 3 EPGs, 2 of which share a BD.
734 # 2 NAT EPGs, one for floating-IP subnets, the other for internet
736 epgs = [VppGbpEndpointGroup(self, 220, rd0, gbd1, self.pg4,
740 VppGbpEndpointGroup(self, 221, rd0, gbd1, self.pg5,
744 VppGbpEndpointGroup(self, 222, rd0, gbd2, self.pg6,
748 VppGbpEndpointGroup(self, 333, rd20, gbd20, self.pg7,
752 VppGbpEndpointGroup(self, 444, rd20, gbd20, self.pg8,
756 recircs = [VppGbpRecirc(self, epgs[0],
758 VppGbpRecirc(self, epgs[1],
760 VppGbpRecirc(self, epgs[2],
762 VppGbpRecirc(self, epgs[3],
763 self.loop6, is_ext=True),
764 VppGbpRecirc(self, epgs[4],
765 self.loop7, is_ext=True)]
768 recirc_nat = recircs[3]
771 # 4 end-points, 2 in the same subnet, 3 in the same BD
773 eps = [VppGbpEndpoint(self, self.pg0,
775 "10.0.0.1", "11.0.0.1",
776 "2001:10::1", "3001::1"),
777 VppGbpEndpoint(self, self.pg1,
779 "10.0.0.2", "11.0.0.2",
780 "2001:10::2", "3001::2"),
781 VppGbpEndpoint(self, self.pg2,
783 "10.0.1.1", "11.0.0.3",
784 "2001:10:1::1", "3001::3"),
785 VppGbpEndpoint(self, self.pg3,
787 "10.0.2.1", "11.0.0.4",
788 "2001:10:2::1", "3001::4")]
791 # Config related to each of the EPGs
794 # IP config on the BVI interfaces
795 if epg != epgs[1] and epg != epgs[4]:
796 VppIpInterfaceBind(self, epg.bvi, epg.rd.t4).add_vpp_config()
797 VppIpInterfaceBind(self, epg.bvi, epg.rd.t6).add_vpp_config()
798 self.vapi.sw_interface_set_mac_address(
800 self.router_mac.bytes)
802 # The BVIs are NAT inside interfaces
803 self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
806 self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
810 if_ip4 = VppIpInterfaceAddress(self, epg.bvi, epg.bvi_ip4, 32)
811 if_ip6 = VppIpInterfaceAddress(self, epg.bvi, epg.bvi_ip6, 128)
812 if_ip4.add_vpp_config()
813 if_ip6.add_vpp_config()
815 # EPG uplink interfaces in the RD
816 VppIpInterfaceBind(self, epg.uplink, epg.rd.t4).add_vpp_config()
817 VppIpInterfaceBind(self, epg.uplink, epg.rd.t6).add_vpp_config()
819 # add the BD ARP termination entry for BVI IP
820 epg.bd_arp_ip4 = VppBridgeDomainArpEntry(self, epg.bd.bd,
821 self.router_mac.address,
823 epg.bd_arp_ip6 = VppBridgeDomainArpEntry(self, epg.bd.bd,
824 self.router_mac.address,
826 epg.bd_arp_ip4.add_vpp_config()
827 epg.bd_arp_ip6.add_vpp_config()
832 for recirc in recircs:
833 # EPG's ingress recirculation interface maps to its RD
834 VppIpInterfaceBind(self, recirc.recirc,
835 recirc.epg.rd.t4).add_vpp_config()
836 VppIpInterfaceBind(self, recirc.recirc,
837 recirc.epg.rd.t6).add_vpp_config()
839 self.vapi.nat44_interface_add_del_feature(
840 recirc.recirc.sw_if_index,
843 self.vapi.nat66_add_del_interface(
844 recirc.recirc.sw_if_index,
848 recirc.add_vpp_config()
850 for recirc in recircs:
851 self.assertTrue(find_bridge_domain_port(self,
852 recirc.epg.bd.bd.bd_id,
853 recirc.recirc.sw_if_index))
856 self.pg_enable_capture(self.pg_interfaces)
859 # routes to the endpoints. We need these since there are no
860 # adj-fibs due to the fact the the BVI address has /32 and
861 # the subnet is not attached.
863 for (ip, fip) in zip(ep.ips, ep.fips):
864 # Add static mappings for each EP from the 10/8 to 11/8 network
866 self.vapi.nat44_add_del_static_mapping(ip.bytes,
871 self.vapi.nat66_add_del_static_mapping(ip.bytes,
878 self.logger.info(self.vapi.cli("sh gbp endpoint"))
880 # ... results in a Gratuitous ARP/ND on the EPG's uplink
881 rx = ep.epg.uplink.get_capture(len(ep.ips), timeout=0.2)
883 for ii, ip in enumerate(ep.ips):
887 self.assertTrue(p.haslayer(ICMPv6ND_NA))
888 self.assertEqual(p[ICMPv6ND_NA].tgt, ip.address)
890 self.assertTrue(p.haslayer(ARP))
891 self.assertEqual(p[ARP].psrc, ip.address)
892 self.assertEqual(p[ARP].pdst, ip.address)
894 # add the BD ARP termination entry for floating IP
896 ba = VppBridgeDomainArpEntry(self, epg_nat.bd.bd, ep.mac, fip)
899 # floating IPs route via EPG recirc
900 r = VppIpRoute(self, fip.address, fip.length,
901 [VppRoutePath(fip.address,
902 ep.recirc.recirc.sw_if_index,
904 proto=fip.dpo_proto)],
909 # L2 FIB entries in the NAT EPG BD to bridge the packets from
910 # the outside direct to the internal EPG
911 lf = VppL2FibEntry(self, epg_nat.bd.bd, ep.mac,
912 ep.recirc.recirc, bvi_mac=0)
916 # ARP packets for unknown IP are sent to the EPG uplink
918 pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
919 src=self.pg0.remote_mac) /
921 hwdst="ff:ff:ff:ff:ff:ff",
922 hwsrc=self.pg0.remote_mac,
926 self.vapi.cli("clear trace")
927 self.pg0.add_stream(pkt_arp)
929 self.pg_enable_capture(self.pg_interfaces)
932 rxd = epgs[0].uplink.get_capture(1)
935 # ARP/ND packets get a response
937 pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
938 src=self.pg0.remote_mac) /
940 hwdst="ff:ff:ff:ff:ff:ff",
941 hwsrc=self.pg0.remote_mac,
942 pdst=epgs[0].bvi_ip4.address,
943 psrc=eps[0].ip4.address))
945 self.send_and_expect(self.pg0, [pkt_arp], self.pg0)
947 nsma = in6_getnsma(inet_pton(AF_INET6, eps[0].ip6.address))
948 d = inet_ntop(AF_INET6, nsma)
949 pkt_nd = (Ether(dst=in6_getnsmac(nsma),
950 src=self.pg0.remote_mac) /
951 IPv6(dst=d, src=eps[0].ip6.address) /
952 ICMPv6ND_NS(tgt=epgs[0].bvi_ip6.address) /
953 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
954 self.send_and_expect(self.pg0, [pkt_nd], self.pg0)
957 # broadcast packets are flooded
959 pkt_bcast = (Ether(dst="ff:ff:ff:ff:ff:ff",
960 src=self.pg0.remote_mac) /
961 IP(src=eps[0].ip4.address, dst="232.1.1.1") /
962 UDP(sport=1234, dport=1234) /
965 self.vapi.cli("clear trace")
966 self.pg0.add_stream(pkt_bcast)
968 self.pg_enable_capture(self.pg_interfaces)
971 rxd = eps[1].itf.get_capture(1)
972 self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
973 rxd = epgs[0].uplink.get_capture(1)
974 self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
977 # packets to non-local L3 destinations dropped
979 pkt_intra_epg_220_ip4 = (Ether(src=self.pg0.remote_mac,
980 dst=self.router_mac.address) /
981 IP(src=eps[0].ip4.address,
983 UDP(sport=1234, dport=1234) /
985 pkt_inter_epg_222_ip4 = (Ether(src=self.pg0.remote_mac,
986 dst=self.router_mac.address) /
987 IP(src=eps[0].ip4.address,
989 UDP(sport=1234, dport=1234) /
992 self.send_and_assert_no_replies(self.pg0, pkt_intra_epg_220_ip4 * 65)
994 pkt_inter_epg_222_ip6 = (Ether(src=self.pg0.remote_mac,
995 dst=self.router_mac.address) /
996 IPv6(src=eps[0].ip6.address,
998 UDP(sport=1234, dport=1234) /
1000 self.send_and_assert_no_replies(self.pg0, pkt_inter_epg_222_ip6 * 65)
1003 # Add the subnet routes
1006 self, rd0, "10.0.0.0", 24,
1007 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1009 self, rd0, "10.0.1.0", 24,
1010 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1012 self, rd0, "10.0.2.0", 24,
1013 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1015 self, rd0, "2001:10::1", 64,
1016 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1018 self, rd0, "2001:10:1::1", 64,
1019 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1021 self, rd0, "2001:10:2::1", 64,
1022 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1023 s41.add_vpp_config()
1024 s42.add_vpp_config()
1025 s43.add_vpp_config()
1026 s61.add_vpp_config()
1027 s62.add_vpp_config()
1028 s63.add_vpp_config()
1030 self.send_and_expect_bridged(eps[0].itf,
1031 pkt_intra_epg_220_ip4 * 65,
1033 self.send_and_expect_bridged(eps[0].itf,
1034 pkt_inter_epg_222_ip4 * 65,
1036 self.send_and_expect_bridged6(eps[0].itf,
1037 pkt_inter_epg_222_ip6 * 65,
1040 self.logger.info(self.vapi.cli("sh ip fib 11.0.0.2"))
1041 self.logger.info(self.vapi.cli("sh gbp endpoint-group"))
1042 self.logger.info(self.vapi.cli("sh gbp endpoint"))
1043 self.logger.info(self.vapi.cli("sh gbp recirc"))
1044 self.logger.info(self.vapi.cli("sh int"))
1045 self.logger.info(self.vapi.cli("sh int addr"))
1046 self.logger.info(self.vapi.cli("sh int feat loop6"))
1047 self.logger.info(self.vapi.cli("sh vlib graph ip4-gbp-src-classify"))
1048 self.logger.info(self.vapi.cli("sh int feat loop3"))
1049 self.logger.info(self.vapi.cli("sh int feat pg0"))
1052 # Packet destined to unknown unicast is sent on the epg uplink ...
1054 pkt_intra_epg_220_to_uplink = (Ether(src=self.pg0.remote_mac,
1055 dst="00:00:00:33:44:55") /
1056 IP(src=eps[0].ip4.address,
1058 UDP(sport=1234, dport=1234) /
1061 self.send_and_expect_bridged(eps[0].itf,
1062 pkt_intra_epg_220_to_uplink * 65,
1064 # ... and nowhere else
1065 self.pg1.get_capture(0, timeout=0.1)
1066 self.pg1.assert_nothing_captured(remark="Flood onto other VMS")
1068 pkt_intra_epg_221_to_uplink = (Ether(src=self.pg2.remote_mac,
1069 dst="00:00:00:33:44:66") /
1070 IP(src=eps[0].ip4.address,
1072 UDP(sport=1234, dport=1234) /
1075 self.send_and_expect_bridged(eps[2].itf,
1076 pkt_intra_epg_221_to_uplink * 65,
1080 # Packets from the uplink are forwarded in the absence of a contract
1082 pkt_intra_epg_220_from_uplink = (Ether(src="00:00:00:33:44:55",
1083 dst=self.pg0.remote_mac) /
1084 IP(src=eps[0].ip4.address,
1086 UDP(sport=1234, dport=1234) /
1089 self.send_and_expect_bridged(self.pg4,
1090 pkt_intra_epg_220_from_uplink * 65,
1094 # in the absence of policy, endpoints in the same EPG
1097 pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
1098 dst=self.pg1.remote_mac) /
1099 IP(src=eps[0].ip4.address,
1100 dst=eps[1].ip4.address) /
1101 UDP(sport=1234, dport=1234) /
1104 self.send_and_expect_bridged(self.pg0, pkt_intra_epg * 65, self.pg1)
1107 # in the abscense of policy, endpoints in the different EPG
1108 # cannot communicate
1110 pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
1111 dst=self.pg2.remote_mac) /
1112 IP(src=eps[0].ip4.address,
1113 dst=eps[2].ip4.address) /
1114 UDP(sport=1234, dport=1234) /
1116 pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
1117 dst=self.pg0.remote_mac) /
1118 IP(src=eps[2].ip4.address,
1119 dst=eps[0].ip4.address) /
1120 UDP(sport=1234, dport=1234) /
1122 pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
1123 dst=self.router_mac.address) /
1124 IP(src=eps[0].ip4.address,
1125 dst=eps[3].ip4.address) /
1126 UDP(sport=1234, dport=1234) /
1129 self.send_and_assert_no_replies(eps[0].itf,
1130 pkt_inter_epg_220_to_221 * 65)
1131 self.send_and_assert_no_replies(eps[0].itf,
1132 pkt_inter_epg_220_to_222 * 65)
1135 # A uni-directional contract from EPG 220 -> 221
1137 acl = VppGbpAcl(self)
1138 rule = acl.create_rule(permit_deny=1, proto=17)
1139 rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
1140 acl_index = acl.add_vpp_config([rule, rule2])
1141 c1 = VppGbpContract(
1142 self, 220, 221, acl_index,
1143 [VppGbpContractRule(
1144 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1147 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1151 self.send_and_expect_bridged(eps[0].itf,
1152 pkt_inter_epg_220_to_221 * 65,
1154 self.send_and_assert_no_replies(eps[0].itf,
1155 pkt_inter_epg_220_to_222 * 65)
1158 # contract for the return direction
1160 c2 = VppGbpContract(
1161 self, 221, 220, acl_index,
1162 [VppGbpContractRule(
1163 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1166 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1171 self.send_and_expect_bridged(eps[0].itf,
1172 pkt_inter_epg_220_to_221 * 65,
1174 self.send_and_expect_bridged(eps[2].itf,
1175 pkt_inter_epg_221_to_220 * 65,
1179 # check that inter group is still disabled for the groups
1180 # not in the contract.
1182 self.send_and_assert_no_replies(eps[0].itf,
1183 pkt_inter_epg_220_to_222 * 65)
1186 # A uni-directional contract from EPG 220 -> 222 'L3 routed'
1188 c3 = VppGbpContract(
1189 self, 220, 222, acl_index,
1190 [VppGbpContractRule(
1191 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1194 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1199 self.logger.info(self.vapi.cli("sh gbp contract"))
1201 self.send_and_expect_routed(eps[0].itf,
1202 pkt_inter_epg_220_to_222 * 65,
1204 self.router_mac.address)
1207 # remove both contracts, traffic stops in both directions
1209 c2.remove_vpp_config()
1210 c1.remove_vpp_config()
1211 c3.remove_vpp_config()
1212 acl.remove_vpp_config()
1214 self.send_and_assert_no_replies(eps[2].itf,
1215 pkt_inter_epg_221_to_220 * 65)
1216 self.send_and_assert_no_replies(eps[0].itf,
1217 pkt_inter_epg_220_to_221 * 65)
1218 self.send_and_expect_bridged(eps[0].itf,
1223 # EPs to the outside world
1226 # in the EP's RD an external subnet via the NAT EPG's recirc
1228 self, rd0, "0.0.0.0", 0,
1229 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1230 sw_if_index=recirc_nat.recirc.sw_if_index,
1233 self, rd0, "11.0.0.0", 8,
1234 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1235 sw_if_index=recirc_nat.recirc.sw_if_index,
1237 se16 = VppGbpSubnet(
1239 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1240 sw_if_index=recirc_nat.recirc.sw_if_index,
1242 # in the NAT RD an external subnet via the NAT EPG's uplink
1244 self, rd20, "0.0.0.0", 0,
1245 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1246 sw_if_index=epg_nat.uplink.sw_if_index,
1248 se36 = VppGbpSubnet(
1249 self, rd20, "::", 0,
1250 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1251 sw_if_index=epg_nat.uplink.sw_if_index,
1254 self, rd20, "11.0.0.0", 8,
1255 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1256 sw_if_index=epg_nat.uplink.sw_if_index,
1258 se1.add_vpp_config()
1259 se2.add_vpp_config()
1260 se16.add_vpp_config()
1261 se3.add_vpp_config()
1262 se36.add_vpp_config()
1263 se4.add_vpp_config()
1265 self.logger.info(self.vapi.cli("sh ip fib 0.0.0.0/0"))
1266 self.logger.info(self.vapi.cli("sh ip fib 11.0.0.1"))
1267 self.logger.info(self.vapi.cli("sh ip6 fib ::/0"))
1268 self.logger.info(self.vapi.cli("sh ip6 fib %s" %
1272 # From an EP to an outside addess: IN2OUT
1274 pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
1275 dst=self.router_mac.address) /
1276 IP(src=eps[0].ip4.address,
1278 UDP(sport=1234, dport=1234) /
1282 self.send_and_assert_no_replies(eps[0].itf,
1283 pkt_inter_epg_220_to_global * 65)
1285 acl2 = VppGbpAcl(self)
1286 rule = acl2.create_rule(permit_deny=1, proto=17, sport_from=1234,
1287 sport_to=1234, dport_from=1234, dport_to=1234)
1288 rule2 = acl2.create_rule(is_ipv6=1, permit_deny=1, proto=17,
1289 sport_from=1234, sport_to=1234,
1290 dport_from=1234, dport_to=1234)
1292 acl_index2 = acl2.add_vpp_config([rule, rule2])
1293 c4 = VppGbpContract(
1294 self, 220, 333, acl_index2,
1295 [VppGbpContractRule(
1296 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1299 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1304 self.send_and_expect_natted(eps[0].itf,
1305 pkt_inter_epg_220_to_global * 65,
1307 eps[0].fip4.address)
1309 pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
1310 dst=self.router_mac.address) /
1311 IPv6(src=eps[0].ip6.address,
1313 UDP(sport=1234, dport=1234) /
1316 self.send_and_expect_natted6(self.pg0,
1317 pkt_inter_epg_220_to_global * 65,
1319 eps[0].fip6.address)
1322 # From a global address to an EP: OUT2IN
1324 pkt_inter_epg_220_from_global = (Ether(src=self.router_mac.address,
1325 dst=self.pg0.remote_mac) /
1326 IP(dst=eps[0].fip4.address,
1328 UDP(sport=1234, dport=1234) /
1331 self.send_and_assert_no_replies(self.pg7,
1332 pkt_inter_epg_220_from_global * 65)
1334 c5 = VppGbpContract(
1335 self, 333, 220, acl_index2,
1336 [VppGbpContractRule(
1337 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1340 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1345 self.send_and_expect_unnatted(self.pg7,
1346 pkt_inter_epg_220_from_global * 65,
1350 pkt_inter_epg_220_from_global = (Ether(src=self.router_mac.address,
1351 dst=self.pg0.remote_mac) /
1352 IPv6(dst=eps[0].fip6.address,
1354 UDP(sport=1234, dport=1234) /
1357 self.send_and_expect_unnatted6(self.pg7,
1358 pkt_inter_epg_220_from_global * 65,
1363 # From a local VM to another local VM using resp. public addresses:
1366 pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
1367 dst=self.router_mac.address) /
1368 IP(src=eps[0].ip4.address,
1369 dst=eps[1].fip4.address) /
1370 UDP(sport=1234, dport=1234) /
1373 self.send_and_expect_double_natted(eps[0].itf,
1374 pkt_intra_epg_220_global * 65,
1376 eps[0].fip4.address,
1379 pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
1380 dst=self.router_mac.address) /
1381 IPv6(src=eps[0].ip6.address,
1382 dst=eps[1].fip6.address) /
1383 UDP(sport=1234, dport=1234) /
1386 self.send_and_expect_double_natted6(eps[0].itf,
1387 pkt_intra_epg_220_global * 65,
1389 eps[0].fip6.address,
1396 # del static mappings for each EP from the 10/8 to 11/8 network
1397 self.vapi.nat44_add_del_static_mapping(ep.ip4.bytes,
1402 self.vapi.nat66_add_del_static_mapping(ep.ip6.bytes,
1408 # IP config on the BVI interfaces
1409 if epg != epgs[0] and epg != epgs[3]:
1410 self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
1413 self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
1417 for recirc in recircs:
1418 self.vapi.nat44_interface_add_del_feature(
1419 recirc.recirc.sw_if_index,
1422 self.vapi.nat66_add_del_interface(
1423 recirc.recirc.sw_if_index,
1427 def test_gbp_learn_l2(self):
1428 """ GBP L2 Endpoint Learning """
1430 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1431 learnt = [{'mac': '00:00:11:11:11:01',
1433 'ip6': '2001:10::2'},
1434 {'mac': '00:00:11:11:11:02',
1436 'ip6': '2001:10::3'}]
1439 # lower the inactive threshold so these tests pass in a
1440 # reasonable amount of time
1442 self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
1447 gt4 = VppIpTable(self, 1)
1448 gt4.add_vpp_config()
1449 gt6 = VppIpTable(self, 1, is_ip6=True)
1450 gt6.add_vpp_config()
1452 rd1 = VppGbpRouteDomain(self, 1, gt4, gt6)
1453 rd1.add_vpp_config()
1456 # Pg2 hosts the vxlan tunnel, hosts on pg2 to act as TEPs
1457 # Pg3 hosts the IP4 UU-flood VXLAN tunnel
1458 # Pg4 hosts the IP6 UU-flood VXLAN tunnel
1460 self.pg2.config_ip4()
1461 self.pg2.resolve_arp()
1462 self.pg2.generate_remote_hosts(4)
1463 self.pg2.configure_ipv4_neighbors()
1464 self.pg3.config_ip4()
1465 self.pg3.resolve_arp()
1466 self.pg4.config_ip4()
1467 self.pg4.resolve_arp()
1470 # a GBP bridge domain with a BVI and a UU-flood interface
1472 bd1 = VppBridgeDomain(self, 1)
1473 bd1.add_vpp_config()
1474 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, self.pg3)
1475 gbd1.add_vpp_config()
1477 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1478 self.logger.info(self.vapi.cli("sh gbp bridge"))
1480 # ... and has a /32 applied
1481 ip_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
1482 ip_addr.add_vpp_config()
1485 # The Endpoint-group in which we are learning endpoints
1487 epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
1491 epg_220.add_vpp_config()
1492 epg_330 = VppGbpEndpointGroup(self, 330, rd1, gbd1,
1496 epg_330.add_vpp_config()
1499 # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
1502 vx_tun_l2_1 = VppGbpVxlanTunnel(
1503 self, 99, bd1.bd_id,
1504 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L2)
1505 vx_tun_l2_1.add_vpp_config()
1508 # A static endpoint that the learnt endpoints are trying to
1511 ep = VppGbpEndpoint(self, self.pg0,
1513 "10.0.0.127", "11.0.0.127",
1514 "2001:10::1", "3001::1")
1517 self.assertTrue(find_route(self, ep.ip4.address, 32, table_id=1))
1519 # a packet with an sclass from an unknwon EPG
1520 p = (Ether(src=self.pg2.remote_mac,
1521 dst=self.pg2.local_mac) /
1522 IP(src=self.pg2.remote_hosts[0].ip4,
1523 dst=self.pg2.local_ip4) /
1524 UDP(sport=1234, dport=48879) /
1525 VXLAN(vni=99, gpid=88, flags=0x88) /
1526 Ether(src=learnt[0]["mac"], dst=ep.mac) /
1527 IP(src=learnt[0]["ip"], dst=ep.ip4.address) /
1528 UDP(sport=1234, dport=1234) /
1531 self.send_and_assert_no_replies(self.pg2, p)
1534 # we should not have learnt a new tunnel endpoint, since
1535 # the EPG was not learnt.
1537 self.assertEqual(INDEX_INVALID,
1538 find_vxlan_gbp_tunnel(self,
1540 self.pg2.remote_hosts[0].ip4,
1543 # epg is not learnt, becasue the EPG is unknwon
1544 self.assertEqual(len(self.vapi.gbp_endpoint_dump()), 1)
1546 for ii, l in enumerate(learnt):
1547 # a packet with an sclass from a knwon EPG
1548 # arriving on an unknown TEP
1549 p = (Ether(src=self.pg2.remote_mac,
1550 dst=self.pg2.local_mac) /
1551 IP(src=self.pg2.remote_hosts[1].ip4,
1552 dst=self.pg2.local_ip4) /
1553 UDP(sport=1234, dport=48879) /
1554 VXLAN(vni=99, gpid=220, flags=0x88) /
1555 Ether(src=l['mac'], dst=ep.mac) /
1556 IP(src=l['ip'], dst=ep.ip4.address) /
1557 UDP(sport=1234, dport=1234) /
1560 rx = self.send_and_expect(self.pg2, [p], self.pg0)
1563 tep1_sw_if_index = find_vxlan_gbp_tunnel(
1566 self.pg2.remote_hosts[1].ip4,
1568 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
1571 # the EP is learnt via the learnt TEP
1572 # both from its MAC and its IP
1574 self.assertTrue(find_gbp_endpoint(self,
1575 vx_tun_l2_1.sw_if_index,
1577 self.assertTrue(find_gbp_endpoint(self,
1578 vx_tun_l2_1.sw_if_index,
1581 self.logger.info(self.vapi.cli("show gbp endpoint"))
1582 self.logger.info(self.vapi.cli("show gbp vxlan"))
1583 self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
1586 # If we sleep for the threshold time, the learnt endpoints should
1591 self.assertFalse(find_gbp_endpoint(self,
1595 # repeat. the do not learn bit is set so the EPs are not learnt
1598 # a packet with an sclass from a knwon EPG
1599 p = (Ether(src=self.pg2.remote_mac,
1600 dst=self.pg2.local_mac) /
1601 IP(src=self.pg2.remote_hosts[1].ip4,
1602 dst=self.pg2.local_ip4) /
1603 UDP(sport=1234, dport=48879) /
1604 VXLAN(vni=99, gpid=220, flags=0x88, gpflags="D") /
1605 Ether(src=l['mac'], dst=ep.mac) /
1606 IP(src=l['ip'], dst=ep.ip4.address) /
1607 UDP(sport=1234, dport=1234) /
1610 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1613 self.assertFalse(find_gbp_endpoint(self,
1614 vx_tun_l2_1.sw_if_index,
1621 # a packet with an sclass from a knwon EPG
1622 p = (Ether(src=self.pg2.remote_mac,
1623 dst=self.pg2.local_mac) /
1624 IP(src=self.pg2.remote_hosts[1].ip4,
1625 dst=self.pg2.local_ip4) /
1626 UDP(sport=1234, dport=48879) /
1627 VXLAN(vni=99, gpid=220, flags=0x88) /
1628 Ether(src=l['mac'], dst=ep.mac) /
1629 IP(src=l['ip'], dst=ep.ip4.address) /
1630 UDP(sport=1234, dport=1234) /
1633 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1635 self.assertTrue(find_gbp_endpoint(self,
1636 vx_tun_l2_1.sw_if_index,
1640 # Static EP replies to dynamics
1642 self.logger.info(self.vapi.cli("sh l2fib bd_id 1"))
1644 p = (Ether(src=ep.mac, dst=l['mac']) /
1645 IP(dst=l['ip'], src=ep.ip4.address) /
1646 UDP(sport=1234, dport=1234) /
1649 rxs = self.send_and_expect(self.pg0, p * 17, self.pg2)
1652 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
1653 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
1654 self.assertEqual(rx[UDP].dport, 48879)
1655 # the UDP source port is a random value for hashing
1656 self.assertEqual(rx[VXLAN].gpid, 220)
1657 self.assertEqual(rx[VXLAN].vni, 99)
1658 self.assertTrue(rx[VXLAN].flags.G)
1659 self.assertTrue(rx[VXLAN].flags.Instance)
1660 self.assertTrue(rx[VXLAN].gpflags.A)
1661 self.assertFalse(rx[VXLAN].gpflags.D)
1665 self.assertFalse(find_gbp_endpoint(self,
1666 vx_tun_l2_1.sw_if_index,
1670 # repeat in the other EPG
1671 # there's no contract between 220 and 330, but the A-bit is set
1672 # so the packet is cleared for delivery
1675 # a packet with an sclass from a knwon EPG
1676 p = (Ether(src=self.pg2.remote_mac,
1677 dst=self.pg2.local_mac) /
1678 IP(src=self.pg2.remote_hosts[1].ip4,
1679 dst=self.pg2.local_ip4) /
1680 UDP(sport=1234, dport=48879) /
1681 VXLAN(vni=99, gpid=330, flags=0x88, gpflags='A') /
1682 Ether(src=l['mac'], dst=ep.mac) /
1683 IP(src=l['ip'], dst=ep.ip4.address) /
1684 UDP(sport=1234, dport=1234) /
1687 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1689 self.assertTrue(find_gbp_endpoint(self,
1690 vx_tun_l2_1.sw_if_index,
1694 # static EP cannot reach the learnt EPs since there is no contract
1695 # only test 1 EP as the others could timeout
1697 p = (Ether(src=ep.mac, dst=l['mac']) /
1698 IP(dst=learnt[0]['ip'], src=ep.ip4.address) /
1699 UDP(sport=1234, dport=1234) /
1702 self.send_and_assert_no_replies(self.pg0, [p])
1705 # refresh the entries after the check for no replies above
1708 # a packet with an sclass from a knwon EPG
1709 p = (Ether(src=self.pg2.remote_mac,
1710 dst=self.pg2.local_mac) /
1711 IP(src=self.pg2.remote_hosts[1].ip4,
1712 dst=self.pg2.local_ip4) /
1713 UDP(sport=1234, dport=48879) /
1714 VXLAN(vni=99, gpid=330, flags=0x88, gpflags='A') /
1715 Ether(src=l['mac'], dst=ep.mac) /
1716 IP(src=l['ip'], dst=ep.ip4.address) /
1717 UDP(sport=1234, dport=1234) /
1720 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1722 self.assertTrue(find_gbp_endpoint(self,
1723 vx_tun_l2_1.sw_if_index,
1727 # Add the contract so they can talk
1729 acl = VppGbpAcl(self)
1730 rule = acl.create_rule(permit_deny=1, proto=17)
1731 rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
1732 acl_index = acl.add_vpp_config([rule, rule2])
1733 c1 = VppGbpContract(
1734 self, 220, 330, acl_index,
1735 [VppGbpContractRule(
1736 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1739 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1745 p = (Ether(src=ep.mac, dst=l['mac']) /
1746 IP(dst=l['ip'], src=ep.ip4.address) /
1747 UDP(sport=1234, dport=1234) /
1750 self.send_and_expect(self.pg0, [p], self.pg2)
1753 # send UU packets from the local EP
1755 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1756 self.logger.info(self.vapi.cli("sh gbp bridge"))
1757 p_uu = (Ether(src=ep.mac, dst="00:11:11:11:11:11") /
1758 IP(dst="10.0.0.133", src=ep.ip4.address) /
1759 UDP(sport=1234, dport=1234) /
1761 rxs = self.send_and_expect(ep.itf, [p_uu], gbd1.uu_flood)
1764 # Add a mcast destination VXLAN-GBP tunnel for B&M traffic
1766 tun_bm = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
1769 tun_bm.add_vpp_config()
1770 bp_bm = VppBridgeDomainPort(self, bd1, tun_bm,
1771 port_type=L2_PORT_TYPE.NORMAL)
1772 bp_bm.add_vpp_config()
1774 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1776 p_bm = (Ether(src=ep.mac, dst="ff:ff:ff:ff:ff:ff") /
1777 IP(dst="10.0.0.133", src=ep.ip4.address) /
1778 UDP(sport=1234, dport=1234) /
1780 rxs = self.send_and_expect_only(ep.itf, [p_bm], tun_bm.mcast_itf)
1783 # Check v6 Endpoints
1786 # a packet with an sclass from a knwon EPG
1787 p = (Ether(src=self.pg2.remote_mac,
1788 dst=self.pg2.local_mac) /
1789 IP(src=self.pg2.remote_hosts[1].ip4,
1790 dst=self.pg2.local_ip4) /
1791 UDP(sport=1234, dport=48879) /
1792 VXLAN(vni=99, gpid=330, flags=0x88, gpflags='A') /
1793 Ether(src=l['mac'], dst=ep.mac) /
1794 IPv6(src=l['ip6'], dst=ep.ip6.address) /
1795 UDP(sport=1234, dport=1234) /
1798 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1800 self.assertTrue(find_gbp_endpoint(self,
1801 vx_tun_l2_1.sw_if_index,
1805 # L3 Endpoint Learning
1806 # - configured on the bridge's BVI
1814 self.assertFalse(find_gbp_endpoint(self,
1815 vx_tun_l2_1.sw_if_index,
1818 self.pg2.unconfig_ip4()
1819 self.pg3.unconfig_ip4()
1820 self.pg4.unconfig_ip4()
1822 self.logger.info(self.vapi.cli("sh int"))
1823 self.logger.info(self.vapi.cli("sh gbp vxlan"))
1825 def test_gbp_learn_vlan_l2(self):
1826 """ GBP L2 Endpoint w/ VLANs"""
1828 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1829 learnt = [{'mac': '00:00:11:11:11:01',
1831 'ip6': '2001:10::2'},
1832 {'mac': '00:00:11:11:11:02',
1834 'ip6': '2001:10::3'}]
1837 # lower the inactive threshold so these tests pass in a
1838 # reasonable amount of time
1840 self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
1845 gt4 = VppIpTable(self, 1)
1846 gt4.add_vpp_config()
1847 gt6 = VppIpTable(self, 1, is_ip6=True)
1848 gt6.add_vpp_config()
1850 rd1 = VppGbpRouteDomain(self, 1, gt4, gt6)
1851 rd1.add_vpp_config()
1854 # Pg2 hosts the vxlan tunnel, hosts on pg2 to act as TEPs
1856 self.pg2.config_ip4()
1857 self.pg2.resolve_arp()
1858 self.pg2.generate_remote_hosts(4)
1859 self.pg2.configure_ipv4_neighbors()
1860 self.pg3.config_ip4()
1861 self.pg3.resolve_arp()
1864 # The EP will be on a vlan sub-interface
1866 vlan_11 = VppDot1QSubint(self, self.pg0, 11)
1868 self.vapi.sw_interface_set_l2_tag_rewrite(vlan_11.sw_if_index,
1872 bd_uu_fwd = VppVxlanGbpTunnel(self, self.pg3.local_ip4,
1873 self.pg3.remote_ip4, 116)
1874 bd_uu_fwd.add_vpp_config()
1877 # a GBP bridge domain with a BVI and a UU-flood interface
1878 # The BD is marked as do not learn, so no endpoints are ever
1879 # learnt in this BD.
1881 bd1 = VppBridgeDomain(self, 1)
1882 bd1.add_vpp_config()
1883 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, bd_uu_fwd,
1885 gbd1.add_vpp_config()
1887 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1888 self.logger.info(self.vapi.cli("sh gbp bridge"))
1890 # ... and has a /32 applied
1891 ip_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
1892 ip_addr.add_vpp_config()
1895 # The Endpoint-group in which we are learning endpoints
1897 epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
1901 epg_220.add_vpp_config()
1904 # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
1907 vx_tun_l2_1 = VppGbpVxlanTunnel(
1908 self, 99, bd1.bd_id,
1909 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L2)
1910 vx_tun_l2_1.add_vpp_config()
1913 # A static endpoint that the learnt endpoints are trying to
1916 ep = VppGbpEndpoint(self, vlan_11,
1918 "10.0.0.127", "11.0.0.127",
1919 "2001:10::1", "3001::1")
1922 self.assertTrue(find_route(self, ep.ip4.address, 32, table_id=1))
1925 # Send to the static EP
1927 for ii, l in enumerate(learnt):
1928 # a packet with an sclass from a knwon EPG
1929 # arriving on an unknown TEP
1930 p = (Ether(src=self.pg2.remote_mac,
1931 dst=self.pg2.local_mac) /
1932 IP(src=self.pg2.remote_hosts[1].ip4,
1933 dst=self.pg2.local_ip4) /
1934 UDP(sport=1234, dport=48879) /
1935 VXLAN(vni=99, gpid=220, flags=0x88) /
1936 Ether(src=l['mac'], dst=ep.mac) /
1937 IP(src=l['ip'], dst=ep.ip4.address) /
1938 UDP(sport=1234, dport=1234) /
1941 rxs = self.send_and_expect(self.pg2, [p], self.pg0)
1944 # packet to EP has the EP's vlan tag
1947 self.assertEqual(rx[Dot1Q].vlan, 11)
1950 # the EP is not learnt since the BD setting prevents it
1953 self.assertFalse(find_gbp_endpoint(self,
1954 vx_tun_l2_1.sw_if_index,
1956 self.assertEqual(INDEX_INVALID,
1957 find_vxlan_gbp_tunnel(
1960 self.pg2.remote_hosts[1].ip4,
1963 self.assertEqual(len(self.vapi.gbp_endpoint_dump()), 1)
1967 # we didn't learn the remotes so they are sent to the UU-fwd
1970 p = (Ether(src=ep.mac, dst=l['mac']) /
1972 IP(dst=l['ip'], src=ep.ip4.address) /
1973 UDP(sport=1234, dport=1234) /
1976 rxs = self.send_and_expect(self.pg0, p * 17, self.pg3)
1979 self.assertEqual(rx[IP].src, self.pg3.local_ip4)
1980 self.assertEqual(rx[IP].dst, self.pg3.remote_ip4)
1981 self.assertEqual(rx[UDP].dport, 48879)
1982 # the UDP source port is a random value for hashing
1983 self.assertEqual(rx[VXLAN].gpid, 220)
1984 self.assertEqual(rx[VXLAN].vni, 116)
1985 self.assertTrue(rx[VXLAN].flags.G)
1986 self.assertTrue(rx[VXLAN].flags.Instance)
1987 self.assertFalse(rx[VXLAN].gpflags.A)
1988 self.assertFalse(rx[VXLAN].gpflags.D)
1990 self.pg2.unconfig_ip4()
1991 self.pg3.unconfig_ip4()
1993 def test_gbp_learn_l3(self):
1994 """ GBP L3 Endpoint Learning """
1996 self.vapi.cli("set logging class gbp debug")
1998 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1999 routed_dst_mac = "00:0c:0c:0c:0c:0c"
2000 routed_src_mac = "00:22:bd:f8:19:ff"
2002 learnt = [{'mac': '00:00:11:11:11:02',
2004 'ip6': '2001:10::2'},
2005 {'mac': '00:00:11:11:11:03',
2007 'ip6': '2001:10::3'}]
2010 # lower the inactive threshold so these tests pass in a
2011 # reasonable amount of time
2013 self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
2018 t4 = VppIpTable(self, 1)
2020 t6 = VppIpTable(self, 1, True)
2023 tun_ip4_uu = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
2024 self.pg4.remote_ip4, 114)
2025 tun_ip6_uu = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
2026 self.pg4.remote_ip4, 116)
2027 tun_ip4_uu.add_vpp_config()
2028 tun_ip6_uu.add_vpp_config()
2030 rd1 = VppGbpRouteDomain(self, 2, t4, t6, tun_ip4_uu, tun_ip6_uu)
2031 rd1.add_vpp_config()
2033 self.loop0.set_mac(self.router_mac.address)
2036 # Bind the BVI to the RD
2038 VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
2039 VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
2042 # Pg2 hosts the vxlan tunnel
2043 # hosts on pg2 to act as TEPs
2047 self.pg2.config_ip4()
2048 self.pg2.resolve_arp()
2049 self.pg2.generate_remote_hosts(4)
2050 self.pg2.configure_ipv4_neighbors()
2051 self.pg3.config_ip4()
2052 self.pg3.resolve_arp()
2053 self.pg4.config_ip4()
2054 self.pg4.resolve_arp()
2057 # a GBP bridge domain with a BVI and a UU-flood interface
2059 bd1 = VppBridgeDomain(self, 1)
2060 bd1.add_vpp_config()
2061 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, self.pg3)
2062 gbd1.add_vpp_config()
2064 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
2065 self.logger.info(self.vapi.cli("sh gbp bridge"))
2066 self.logger.info(self.vapi.cli("sh gbp route"))
2068 # ... and has a /32 and /128 applied
2069 ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2070 ip4_addr.add_vpp_config()
2071 ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 128)
2072 ip6_addr.add_vpp_config()
2075 # The Endpoint-group in which we are learning endpoints
2077 epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
2081 epg_220.add_vpp_config()
2084 # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
2087 vx_tun_l3 = VppGbpVxlanTunnel(
2088 self, 101, rd1.rd_id,
2089 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3)
2090 vx_tun_l3.add_vpp_config()
2093 # A static endpoint that the learnt endpoints are trying to
2096 ep = VppGbpEndpoint(self, self.pg0,
2098 "10.0.0.127", "11.0.0.127",
2099 "2001:10::1", "3001::1")
2103 # learn some remote IPv4 EPs
2105 for ii, l in enumerate(learnt):
2106 # a packet with an sclass from a knwon EPG
2107 # arriving on an unknown TEP
2108 p = (Ether(src=self.pg2.remote_mac,
2109 dst=self.pg2.local_mac) /
2110 IP(src=self.pg2.remote_hosts[1].ip4,
2111 dst=self.pg2.local_ip4) /
2112 UDP(sport=1234, dport=48879) /
2113 VXLAN(vni=101, gpid=220, flags=0x88) /
2114 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2115 IP(src=l['ip'], dst=ep.ip4.address) /
2116 UDP(sport=1234, dport=1234) /
2119 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2122 tep1_sw_if_index = find_vxlan_gbp_tunnel(
2125 self.pg2.remote_hosts[1].ip4,
2127 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2129 # endpoint learnt via the parent GBP-vxlan interface
2130 self.assertTrue(find_gbp_endpoint(self,
2131 vx_tun_l3._sw_if_index,
2135 # Static IPv4 EP replies to learnt
2138 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2139 IP(dst=l['ip'], src=ep.ip4.address) /
2140 UDP(sport=1234, dport=1234) /
2143 rxs = self.send_and_expect(self.pg0, p*1, self.pg2)
2146 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2147 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2148 self.assertEqual(rx[UDP].dport, 48879)
2149 # the UDP source port is a random value for hashing
2150 self.assertEqual(rx[VXLAN].gpid, 220)
2151 self.assertEqual(rx[VXLAN].vni, 101)
2152 self.assertTrue(rx[VXLAN].flags.G)
2153 self.assertTrue(rx[VXLAN].flags.Instance)
2154 self.assertTrue(rx[VXLAN].gpflags.A)
2155 self.assertFalse(rx[VXLAN].gpflags.D)
2157 inner = rx[VXLAN].payload
2159 self.assertEqual(inner[Ether].src, routed_src_mac)
2160 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2161 self.assertEqual(inner[IP].src, ep.ip4.address)
2162 self.assertEqual(inner[IP].dst, l['ip'])
2166 self.assertFalse(find_gbp_endpoint(self,
2171 # learn some remote IPv6 EPs
2173 for ii, l in enumerate(learnt):
2174 # a packet with an sclass from a knwon EPG
2175 # arriving on an unknown TEP
2176 p = (Ether(src=self.pg2.remote_mac,
2177 dst=self.pg2.local_mac) /
2178 IP(src=self.pg2.remote_hosts[1].ip4,
2179 dst=self.pg2.local_ip4) /
2180 UDP(sport=1234, dport=48879) /
2181 VXLAN(vni=101, gpid=220, flags=0x88) /
2182 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2183 IPv6(src=l['ip6'], dst=ep.ip6.address) /
2184 UDP(sport=1234, dport=1234) /
2187 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2190 tep1_sw_if_index = find_vxlan_gbp_tunnel(
2193 self.pg2.remote_hosts[1].ip4,
2195 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2197 self.logger.info(self.vapi.cli("show gbp bridge"))
2198 self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
2199 self.logger.info(self.vapi.cli("show gbp vxlan"))
2200 self.logger.info(self.vapi.cli("show int addr"))
2202 # endpoint learnt via the TEP
2203 self.assertTrue(find_gbp_endpoint(self, ip=l['ip6']))
2205 self.logger.info(self.vapi.cli("show gbp endpoint"))
2206 self.logger.info(self.vapi.cli("show ip fib index 1 %s" % l['ip']))
2209 # Static EP replies to learnt
2212 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2213 IPv6(dst=l['ip6'], src=ep.ip6.address) /
2214 UDP(sport=1234, dport=1234) /
2217 rxs = self.send_and_expect(self.pg0, p*65, self.pg2)
2220 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2221 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2222 self.assertEqual(rx[UDP].dport, 48879)
2223 # the UDP source port is a random value for hashing
2224 self.assertEqual(rx[VXLAN].gpid, 220)
2225 self.assertEqual(rx[VXLAN].vni, 101)
2226 self.assertTrue(rx[VXLAN].flags.G)
2227 self.assertTrue(rx[VXLAN].flags.Instance)
2228 self.assertTrue(rx[VXLAN].gpflags.A)
2229 self.assertFalse(rx[VXLAN].gpflags.D)
2231 inner = rx[VXLAN].payload
2233 self.assertEqual(inner[Ether].src, routed_src_mac)
2234 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2235 self.assertEqual(inner[IPv6].src, ep.ip6.address)
2236 self.assertEqual(inner[IPv6].dst, l['ip6'])
2238 self.logger.info(self.vapi.cli("sh gbp endpoint"))
2241 self.assertFalse(find_gbp_endpoint(self,
2246 # Static sends to unknown EP with no route
2248 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2249 IP(dst="10.0.0.99", src=ep.ip4.address) /
2250 UDP(sport=1234, dport=1234) /
2253 self.send_and_assert_no_replies(self.pg0, [p])
2256 # Add a route to static EP's v4 and v6 subnet
2257 # packets should be sent on the v4/v6 uu=fwd interface resp.
2259 se_10_24 = VppGbpSubnet(
2260 self, rd1, "10.0.0.0", 24,
2261 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_TRANSPORT)
2262 se_10_24.add_vpp_config()
2264 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2265 IP(dst="10.0.0.99", src=ep.ip4.address) /
2266 UDP(sport=1234, dport=1234) /
2269 rxs = self.send_and_expect(self.pg0, [p], self.pg4)
2271 self.assertEqual(rx[IP].src, self.pg4.local_ip4)
2272 self.assertEqual(rx[IP].dst, self.pg4.remote_ip4)
2273 self.assertEqual(rx[UDP].dport, 48879)
2274 # the UDP source port is a random value for hashing
2275 self.assertEqual(rx[VXLAN].gpid, 220)
2276 self.assertEqual(rx[VXLAN].vni, 114)
2277 self.assertTrue(rx[VXLAN].flags.G)
2278 self.assertTrue(rx[VXLAN].flags.Instance)
2279 # policy is not applied to packets sent to the uu-fwd interfaces
2280 self.assertFalse(rx[VXLAN].gpflags.A)
2281 self.assertFalse(rx[VXLAN].gpflags.D)
2284 # learn some remote IPv4 EPs
2286 for ii, l in enumerate(learnt):
2287 # a packet with an sclass from a knwon EPG
2288 # arriving on an unknown TEP
2289 p = (Ether(src=self.pg2.remote_mac,
2290 dst=self.pg2.local_mac) /
2291 IP(src=self.pg2.remote_hosts[1].ip4,
2292 dst=self.pg2.local_ip4) /
2293 UDP(sport=1234, dport=48879) /
2294 VXLAN(vni=101, gpid=220, flags=0x88) /
2295 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2296 IP(src=l['ip'], dst=ep.ip4.address) /
2297 UDP(sport=1234, dport=1234) /
2300 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2303 tep1_sw_if_index = find_vxlan_gbp_tunnel(
2306 self.pg2.remote_hosts[1].ip4,
2308 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2310 # endpoint learnt via the parent GBP-vxlan interface
2311 self.assertTrue(find_gbp_endpoint(self,
2312 vx_tun_l3._sw_if_index,
2316 # Add a remote endpoint from the API
2318 rep_88 = VppGbpEndpoint(self, vx_tun_l3,
2320 "10.0.0.88", "11.0.0.88",
2321 "2001:10::88", "3001::88",
2322 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
2324 self.pg2.remote_hosts[1].ip4,
2326 rep_88.add_vpp_config()
2329 # Add a remote endpoint from the API that matches an existing one
2331 rep_2 = VppGbpEndpoint(self, vx_tun_l3,
2333 learnt[0]['ip'], "11.0.0.101",
2334 learnt[0]['ip6'], "3001::101",
2335 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
2337 self.pg2.remote_hosts[1].ip4,
2339 rep_2.add_vpp_config()
2342 # Add a route to the leanred EP's v4 subnet
2343 # packets should be send on the v4/v6 uu=fwd interface resp.
2345 se_10_1_24 = VppGbpSubnet(
2346 self, rd1, "10.0.1.0", 24,
2347 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_TRANSPORT)
2348 se_10_1_24.add_vpp_config()
2350 self.logger.info(self.vapi.cli("show gbp endpoint"))
2352 ips = ["10.0.0.88", learnt[0]['ip']]
2354 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2355 IP(dst=ip, src=ep.ip4.address) /
2356 UDP(sport=1234, dport=1234) /
2359 rxs = self.send_and_expect(self.pg0, p*65, self.pg2)
2362 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2363 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2364 self.assertEqual(rx[UDP].dport, 48879)
2365 # the UDP source port is a random value for hashing
2366 self.assertEqual(rx[VXLAN].gpid, 220)
2367 self.assertEqual(rx[VXLAN].vni, 101)
2368 self.assertTrue(rx[VXLAN].flags.G)
2369 self.assertTrue(rx[VXLAN].flags.Instance)
2370 self.assertTrue(rx[VXLAN].gpflags.A)
2371 self.assertFalse(rx[VXLAN].gpflags.D)
2373 inner = rx[VXLAN].payload
2375 self.assertEqual(inner[Ether].src, routed_src_mac)
2376 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2377 self.assertEqual(inner[IP].src, ep.ip4.address)
2378 self.assertEqual(inner[IP].dst, ip)
2381 # remove the API remote EPs, only API sourced is gone, the DP
2382 # learnt one remains
2384 rep_88.remove_vpp_config()
2385 rep_2.remove_vpp_config()
2387 self.logger.info(self.vapi.cli("show gbp endpoint"))
2389 self.assertFalse(find_gbp_endpoint(self, ip=rep_88.ip4.address))
2391 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2392 IP(src=ep.ip4.address, dst=rep_88.ip4.address) /
2393 UDP(sport=1234, dport=1234) /
2395 rxs = self.send_and_expect(self.pg0, [p], self.pg4)
2397 self.assertTrue(find_gbp_endpoint(self, ip=rep_2.ip4.address))
2399 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2400 IP(src=ep.ip4.address, dst=rep_2.ip4.address) /
2401 UDP(sport=1234, dport=1234) /
2403 rxs = self.send_and_expect(self.pg0, [p], self.pg2)
2406 # to appease the testcase we cannot have the registered EP stll
2407 # present (because it's DP learnt) when the TC ends so wait until
2413 # shutdown with learnt endpoint present
2415 p = (Ether(src=self.pg2.remote_mac,
2416 dst=self.pg2.local_mac) /
2417 IP(src=self.pg2.remote_hosts[1].ip4,
2418 dst=self.pg2.local_ip4) /
2419 UDP(sport=1234, dport=48879) /
2420 VXLAN(vni=101, gpid=220, flags=0x88) /
2421 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2422 IP(src=learnt[1]['ip'], dst=ep.ip4.address) /
2423 UDP(sport=1234, dport=1234) /
2426 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2428 # endpoint learnt via the parent GBP-vxlan interface
2429 self.assertTrue(find_gbp_endpoint(self,
2430 vx_tun_l3._sw_if_index,
2435 # remote endpoint becomes local
2437 self.pg2.unconfig_ip4()
2438 self.pg3.unconfig_ip4()
2439 self.pg4.unconfig_ip4()
2441 def test_gbp_redirect(self):
2442 """ GBP Endpoint Redirect """
2444 self.vapi.cli("set logging class gbp debug")
2446 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
2447 routed_dst_mac = "00:0c:0c:0c:0c:0c"
2448 routed_src_mac = "00:22:bd:f8:19:ff"
2450 learnt = [{'mac': '00:00:11:11:11:02',
2452 'ip6': '2001:10::2'},
2453 {'mac': '00:00:11:11:11:03',
2455 'ip6': '2001:10::3'}]
2458 # lower the inactive threshold so these tests pass in a
2459 # reasonable amount of time
2461 self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
2466 t4 = VppIpTable(self, 1)
2468 t6 = VppIpTable(self, 1, True)
2471 rd1 = VppGbpRouteDomain(self, 2, t4, t6)
2472 rd1.add_vpp_config()
2474 self.loop0.set_mac(self.router_mac.address)
2477 # Bind the BVI to the RD
2479 VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
2480 VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
2483 # Pg7 hosts a BD's UU-fwd
2485 self.pg7.config_ip4()
2486 self.pg7.resolve_arp()
2489 # a GBP bridge domains for the EPs
2491 bd1 = VppBridgeDomain(self, 1)
2492 bd1.add_vpp_config()
2493 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
2494 gbd1.add_vpp_config()
2496 bd2 = VppBridgeDomain(self, 2)
2497 bd2.add_vpp_config()
2498 gbd2 = VppGbpBridgeDomain(self, bd2, self.loop1)
2499 gbd2.add_vpp_config()
2501 # ... and has a /32 and /128 applied
2502 ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2503 ip4_addr.add_vpp_config()
2504 ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 128)
2505 ip6_addr.add_vpp_config()
2506 ip4_addr = VppIpInterfaceAddress(self, gbd2.bvi, "10.0.1.128", 32)
2507 ip4_addr.add_vpp_config()
2508 ip6_addr = VppIpInterfaceAddress(self, gbd2.bvi, "2001:11::128", 128)
2509 ip6_addr.add_vpp_config()
2512 # The Endpoint-groups in which we are learning endpoints
2514 epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
2518 epg_220.add_vpp_config()
2519 epg_221 = VppGbpEndpointGroup(self, 221, rd1, gbd2,
2523 epg_221.add_vpp_config()
2524 epg_222 = VppGbpEndpointGroup(self, 222, rd1, gbd1,
2528 epg_222.add_vpp_config()
2531 # a GBP bridge domains for the SEPs
2533 bd_uu1 = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
2534 self.pg7.remote_ip4, 116)
2535 bd_uu1.add_vpp_config()
2536 bd_uu2 = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
2537 self.pg7.remote_ip4, 117)
2538 bd_uu2.add_vpp_config()
2540 bd3 = VppBridgeDomain(self, 3)
2541 bd3.add_vpp_config()
2542 gbd3 = VppGbpBridgeDomain(self, bd3, self.loop2, bd_uu1, learn=False)
2543 gbd3.add_vpp_config()
2544 bd4 = VppBridgeDomain(self, 4)
2545 bd4.add_vpp_config()
2546 gbd4 = VppGbpBridgeDomain(self, bd4, self.loop3, bd_uu2, learn=False)
2547 gbd4.add_vpp_config()
2550 # EPGs in which the service endpoints exist
2552 epg_320 = VppGbpEndpointGroup(self, 320, rd1, gbd3,
2556 epg_320.add_vpp_config()
2557 epg_321 = VppGbpEndpointGroup(self, 321, rd1, gbd4,
2561 epg_321.add_vpp_config()
2564 # three local endpoints
2566 ep1 = VppGbpEndpoint(self, self.pg0,
2568 "10.0.0.1", "11.0.0.1",
2569 "2001:10::1", "3001:10::1")
2570 ep1.add_vpp_config()
2571 ep2 = VppGbpEndpoint(self, self.pg1,
2573 "10.0.1.1", "11.0.1.1",
2574 "2001:11::1", "3001:11::1")
2575 ep2.add_vpp_config()
2576 ep3 = VppGbpEndpoint(self, self.pg2,
2578 "10.0.2.2", "11.0.2.2",
2579 "2001:12::1", "3001:12::1")
2580 ep3.add_vpp_config()
2585 sep1 = VppGbpEndpoint(self, self.pg3,
2587 "12.0.0.1", "13.0.0.1",
2588 "4001:10::1", "5001:10::1")
2589 sep1.add_vpp_config()
2590 sep2 = VppGbpEndpoint(self, self.pg4,
2592 "12.0.0.2", "13.0.0.2",
2593 "4001:10::2", "5001:10::2")
2594 sep2.add_vpp_config()
2595 sep3 = VppGbpEndpoint(self, self.pg5,
2597 "12.0.1.1", "13.0.1.1",
2598 "4001:11::1", "5001:11::1")
2599 sep3.add_vpp_config()
2600 # this EP is not installed immediately
2601 sep4 = VppGbpEndpoint(self, self.pg6,
2603 "12.0.1.2", "13.0.1.2",
2604 "4001:11::2", "5001:11::2")
2607 # an L2 switch packet between local EPs in different EPGs
2608 # different dest ports on each so the are LB hashed differently
2610 p4 = [(Ether(src=ep1.mac, dst=ep3.mac) /
2611 IP(src=ep1.ip4.address, dst=ep3.ip4.address) /
2612 UDP(sport=1234, dport=1234) /
2614 (Ether(src=ep3.mac, dst=ep1.mac) /
2615 IP(src=ep3.ip4.address, dst=ep1.ip4.address) /
2616 UDP(sport=1234, dport=1234) /
2618 p6 = [(Ether(src=ep1.mac, dst=ep3.mac) /
2619 IPv6(src=ep1.ip6.address, dst=ep3.ip6.address) /
2620 UDP(sport=1234, dport=1234) /
2622 (Ether(src=ep3.mac, dst=ep1.mac) /
2623 IPv6(src=ep3.ip6.address, dst=ep1.ip6.address) /
2624 UDP(sport=1234, dport=1230) /
2627 # should be dropped since no contract yet
2628 self.send_and_assert_no_replies(self.pg0, [p4[0]])
2629 self.send_and_assert_no_replies(self.pg0, [p6[0]])
2632 # Add a contract with a rule to load-balance redirect via SEP1 and SEP2
2633 # one of the next-hops is via an EP that is not known
2635 acl = VppGbpAcl(self)
2636 rule4 = acl.create_rule(permit_deny=1, proto=17)
2637 rule6 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
2638 acl_index = acl.add_vpp_config([rule4, rule6])
2641 # test the src-ip hash mode
2643 c1 = VppGbpContract(
2644 self, 220, 222, acl_index,
2645 [VppGbpContractRule(
2646 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2647 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2648 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2649 sep1.ip4, sep1.epg.rd),
2650 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2651 sep2.ip4, sep2.epg.rd)]),
2653 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2654 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2655 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2656 sep3.ip6, sep3.epg.rd),
2657 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2658 sep4.ip6, sep4.epg.rd)])])
2661 c2 = VppGbpContract(
2662 self, 222, 220, acl_index,
2663 [VppGbpContractRule(
2664 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2665 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2666 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2667 sep1.ip4, sep1.epg.rd),
2668 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2669 sep2.ip4, sep2.epg.rd)]),
2671 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2672 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2673 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2674 sep3.ip6, sep3.epg.rd),
2675 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2676 sep4.ip6, sep4.epg.rd)])])
2680 # send again with the contract preset, now packets arrive
2681 # at SEP1 or SEP2 depending on the hashing
2683 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2686 self.assertEqual(rx[Ether].src, routed_src_mac)
2687 self.assertEqual(rx[Ether].dst, sep1.mac)
2688 self.assertEqual(rx[IP].src, ep1.ip4.address)
2689 self.assertEqual(rx[IP].dst, ep3.ip4.address)
2691 rxs = self.send_and_expect(self.pg2, p4[1] * 17, sep2.itf)
2694 self.assertEqual(rx[Ether].src, routed_src_mac)
2695 self.assertEqual(rx[Ether].dst, sep2.mac)
2696 self.assertEqual(rx[IP].src, ep3.ip4.address)
2697 self.assertEqual(rx[IP].dst, ep1.ip4.address)
2699 rxs = self.send_and_expect(self.pg0, p6[0] * 17, self.pg7)
2702 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
2703 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
2704 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
2705 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
2706 self.assertEqual(rx[VXLAN].vni, 117)
2707 self.assertTrue(rx[VXLAN].flags.G)
2708 self.assertTrue(rx[VXLAN].flags.Instance)
2709 # redirect policy has been applied
2710 self.assertTrue(rx[VXLAN].gpflags.A)
2711 self.assertFalse(rx[VXLAN].gpflags.D)
2713 inner = rx[VXLAN].payload
2715 self.assertEqual(inner[Ether].src, routed_src_mac)
2716 self.assertEqual(inner[Ether].dst, sep4.mac)
2717 self.assertEqual(inner[IPv6].src, ep1.ip6.address)
2718 self.assertEqual(inner[IPv6].dst, ep3.ip6.address)
2720 rxs = self.send_and_expect(self.pg2, p6[1] * 17, sep3.itf)
2723 self.assertEqual(rx[Ether].src, routed_src_mac)
2724 self.assertEqual(rx[Ether].dst, sep3.mac)
2725 self.assertEqual(rx[IPv6].src, ep3.ip6.address)
2726 self.assertEqual(rx[IPv6].dst, ep1.ip6.address)
2729 # programme the unknown EP
2731 sep4.add_vpp_config()
2733 rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep4.itf)
2736 self.assertEqual(rx[Ether].src, routed_src_mac)
2737 self.assertEqual(rx[Ether].dst, sep4.mac)
2738 self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2739 self.assertEqual(rx[IPv6].dst, ep3.ip6.address)
2742 # and revert back to unprogrammed
2744 sep4.remove_vpp_config()
2746 rxs = self.send_and_expect(self.pg0, p6[0] * 17, self.pg7)
2749 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
2750 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
2751 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
2752 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
2753 self.assertEqual(rx[VXLAN].vni, 117)
2754 self.assertTrue(rx[VXLAN].flags.G)
2755 self.assertTrue(rx[VXLAN].flags.Instance)
2756 # redirect policy has been applied
2757 self.assertTrue(rx[VXLAN].gpflags.A)
2758 self.assertFalse(rx[VXLAN].gpflags.D)
2760 inner = rx[VXLAN].payload
2762 self.assertEqual(inner[Ether].src, routed_src_mac)
2763 self.assertEqual(inner[Ether].dst, sep4.mac)
2764 self.assertEqual(inner[IPv6].src, ep1.ip6.address)
2765 self.assertEqual(inner[IPv6].dst, ep3.ip6.address)
2767 c1.remove_vpp_config()
2768 c2.remove_vpp_config()
2771 # test the symmetric hash mode
2773 c1 = VppGbpContract(
2774 self, 220, 222, acl_index,
2775 [VppGbpContractRule(
2776 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2777 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2778 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2779 sep1.ip4, sep1.epg.rd),
2780 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2781 sep2.ip4, sep2.epg.rd)]),
2783 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2784 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2785 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2786 sep3.ip6, sep3.epg.rd),
2787 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2788 sep4.ip6, sep4.epg.rd)])])
2791 c2 = VppGbpContract(
2792 self, 222, 220, acl_index,
2793 [VppGbpContractRule(
2794 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2795 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2796 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2797 sep1.ip4, sep1.epg.rd),
2798 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2799 sep2.ip4, sep2.epg.rd)]),
2801 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2802 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2803 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2804 sep3.ip6, sep3.epg.rd),
2805 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2806 sep4.ip6, sep4.epg.rd)])])
2810 # send again with the contract preset, now packets arrive
2811 # at SEP1 for both directions
2813 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2816 self.assertEqual(rx[Ether].src, routed_src_mac)
2817 self.assertEqual(rx[Ether].dst, sep1.mac)
2818 self.assertEqual(rx[IP].src, ep1.ip4.address)
2819 self.assertEqual(rx[IP].dst, ep3.ip4.address)
2821 rxs = self.send_and_expect(self.pg2, p4[1] * 17, sep1.itf)
2824 self.assertEqual(rx[Ether].src, routed_src_mac)
2825 self.assertEqual(rx[Ether].dst, sep1.mac)
2826 self.assertEqual(rx[IP].src, ep3.ip4.address)
2827 self.assertEqual(rx[IP].dst, ep1.ip4.address)
2830 # programme the unknown EP for the L3 tests
2832 sep4.add_vpp_config()
2835 # an L3 switch packet between local EPs in different EPGs
2836 # different dest ports on each so the are LB hashed differently
2838 p4 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2839 IP(src=ep1.ip4.address, dst=ep2.ip4.address) /
2840 UDP(sport=1234, dport=1234) /
2842 (Ether(src=ep2.mac, dst=self.router_mac.address) /
2843 IP(src=ep2.ip4.address, dst=ep1.ip4.address) /
2844 UDP(sport=1234, dport=1234) /
2846 p6 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2847 IPv6(src=ep1.ip6.address, dst=ep2.ip6.address) /
2848 UDP(sport=1234, dport=1234) /
2850 (Ether(src=ep2.mac, dst=self.router_mac.address) /
2851 IPv6(src=ep2.ip6.address, dst=ep1.ip6.address) /
2852 UDP(sport=1234, dport=1234) /
2855 c3 = VppGbpContract(
2856 self, 220, 221, acl_index,
2857 [VppGbpContractRule(
2858 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2859 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2860 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2861 sep1.ip4, sep1.epg.rd),
2862 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2863 sep2.ip4, sep2.epg.rd)]),
2865 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2866 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2867 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2868 sep3.ip6, sep3.epg.rd),
2869 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2870 sep4.ip6, sep4.epg.rd)])])
2873 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2876 self.assertEqual(rx[Ether].src, routed_src_mac)
2877 self.assertEqual(rx[Ether].dst, sep1.mac)
2878 self.assertEqual(rx[IP].src, ep1.ip4.address)
2879 self.assertEqual(rx[IP].dst, ep2.ip4.address)
2882 # learn a remote EP in EPG 221
2884 vx_tun_l3 = VppGbpVxlanTunnel(
2885 self, 444, rd1.rd_id,
2886 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3)
2887 vx_tun_l3.add_vpp_config()
2889 c4 = VppGbpContract(
2890 self, 221, 220, acl_index,
2891 [VppGbpContractRule(
2892 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
2895 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
2899 p = (Ether(src=self.pg7.remote_mac,
2900 dst=self.pg7.local_mac) /
2901 IP(src=self.pg7.remote_ip4,
2902 dst=self.pg7.local_ip4) /
2903 UDP(sport=1234, dport=48879) /
2904 VXLAN(vni=444, gpid=221, flags=0x88) /
2905 Ether(src="00:22:22:22:22:33", dst=self.router_mac.address) /
2906 IP(src="10.0.0.88", dst=ep1.ip4.address) /
2907 UDP(sport=1234, dport=1234) /
2910 rx = self.send_and_expect(self.pg7, [p], self.pg0)
2912 # endpoint learnt via the parent GBP-vxlan interface
2913 self.assertTrue(find_gbp_endpoint(self,
2914 vx_tun_l3._sw_if_index,
2917 p = (Ether(src=self.pg7.remote_mac,
2918 dst=self.pg7.local_mac) /
2919 IP(src=self.pg7.remote_ip4,
2920 dst=self.pg7.local_ip4) /
2921 UDP(sport=1234, dport=48879) /
2922 VXLAN(vni=444, gpid=221, flags=0x88) /
2923 Ether(src="00:22:22:22:22:33", dst=self.router_mac.address) /
2924 IPv6(src="2001:10::88", dst=ep1.ip6.address) /
2925 UDP(sport=1234, dport=1234) /
2928 rx = self.send_and_expect(self.pg7, [p], self.pg0)
2930 # endpoint learnt via the parent GBP-vxlan interface
2931 self.assertTrue(find_gbp_endpoint(self,
2932 vx_tun_l3._sw_if_index,
2936 # L3 switch from local to remote EP
2938 p4 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2939 IP(src=ep1.ip4.address, dst="10.0.0.88") /
2940 UDP(sport=1234, dport=1234) /
2942 p6 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2943 IPv6(src=ep1.ip6.address, dst="2001:10::88") /
2944 UDP(sport=1234, dport=1234) /
2947 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2950 self.assertEqual(rx[Ether].src, routed_src_mac)
2951 self.assertEqual(rx[Ether].dst, sep1.mac)
2952 self.assertEqual(rx[IP].src, ep1.ip4.address)
2953 self.assertEqual(rx[IP].dst, "10.0.0.88")
2955 rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep4.itf)
2958 self.assertEqual(rx[Ether].src, routed_src_mac)
2959 self.assertEqual(rx[Ether].dst, sep4.mac)
2960 self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2961 self.assertEqual(rx[IPv6].dst, "2001:10::88")
2964 # test the dst-ip hash mode
2966 c5 = VppGbpContract(
2967 self, 220, 221, acl_index,
2968 [VppGbpContractRule(
2969 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2970 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_DST_IP,
2971 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2972 sep1.ip4, sep1.epg.rd),
2973 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2974 sep2.ip4, sep2.epg.rd)]),
2976 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2977 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_DST_IP,
2978 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2979 sep3.ip6, sep3.epg.rd),
2980 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2981 sep4.ip6, sep4.epg.rd)])])
2984 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2987 self.assertEqual(rx[Ether].src, routed_src_mac)
2988 self.assertEqual(rx[Ether].dst, sep1.mac)
2989 self.assertEqual(rx[IP].src, ep1.ip4.address)
2990 self.assertEqual(rx[IP].dst, "10.0.0.88")
2992 rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep3.itf)
2995 self.assertEqual(rx[Ether].src, routed_src_mac)
2996 self.assertEqual(rx[Ether].dst, sep3.mac)
2997 self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2998 self.assertEqual(rx[IPv6].dst, "2001:10::88")
3003 self.pg7.unconfig_ip4()
3005 def test_gbp_l3_out(self):
3008 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
3009 self.vapi.cli("set logging class gbp debug")
3011 routed_dst_mac = "00:0c:0c:0c:0c:0c"
3012 routed_src_mac = "00:22:bd:f8:19:ff"
3017 t4 = VppIpTable(self, 1)
3019 t6 = VppIpTable(self, 1, True)
3022 rd1 = VppGbpRouteDomain(self, 2, t4, t6)
3023 rd1.add_vpp_config()
3025 self.loop0.set_mac(self.router_mac.address)
3028 # Bind the BVI to the RD
3030 VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
3031 VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
3034 # Pg7 hosts a BD's BUM
3035 # Pg1 some other l3 interface
3037 self.pg7.config_ip4()
3038 self.pg7.resolve_arp()
3041 # a GBP external bridge domains for the EPs
3043 bd1 = VppBridgeDomain(self, 1)
3044 bd1.add_vpp_config()
3045 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
3046 gbd1.add_vpp_config()
3049 # The Endpoint-groups in which the external endpoints exist
3051 epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
3055 epg_220.add_vpp_config()
3057 # the BVIs have the subnets applied ...
3058 ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 24)
3059 ip4_addr.add_vpp_config()
3060 ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 64)
3061 ip6_addr.add_vpp_config()
3063 # ... which are L3-out subnets
3064 l3o_1 = VppGbpSubnet(
3065 self, rd1, "10.0.0.0", 24,
3066 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3068 l3o_1.add_vpp_config()
3071 # an external interface attached to the outside world and the
3074 vlan_100 = VppDot1QSubint(self, self.pg0, 100)
3076 ext_itf = VppGbpExtItf(self, vlan_100, bd1, rd1)
3077 ext_itf.add_vpp_config()
3080 # a multicast vxlan-gbp tunnel for broadcast in the BD
3082 tun_bm = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
3085 tun_bm.add_vpp_config()
3086 bp_bm = VppBridgeDomainPort(self, bd1, tun_bm,
3087 port_type=L2_PORT_TYPE.NORMAL)
3088 bp_bm.add_vpp_config()
3091 # an unicast vxlan-gbp for inter-BD traffic
3093 vx_tun_l3 = VppGbpVxlanTunnel(
3094 self, 444, rd1.rd_id,
3095 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3)
3096 vx_tun_l3.add_vpp_config()
3099 # packets destined to unkown addresses in the BVI's subnet
3102 p4 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3104 IP(src="10.0.0.1", dst="10.0.0.88") /
3105 UDP(sport=1234, dport=1234) /
3107 p6 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3109 IPv6(src="2001:10::1", dst="2001:10::88") /
3110 UDP(sport=1234, dport=1234) /
3113 rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3116 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3117 # self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3118 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3119 self.assertEqual(rx[IP].dst, "239.1.1.1")
3120 self.assertEqual(rx[VXLAN].vni, 88)
3121 self.assertTrue(rx[VXLAN].flags.G)
3122 self.assertTrue(rx[VXLAN].flags.Instance)
3123 # policy is not applied since we don't know where it's going
3124 self.assertFalse(rx[VXLAN].gpflags.A)
3125 self.assertFalse(rx[VXLAN].gpflags.D)
3127 inner = rx[VXLAN].payload
3129 self.assertTrue(inner.haslayer(ARP))
3132 # An external Endpoint
3134 eep = VppGbpEndpoint(self, vlan_100,
3136 "10.0.0.1", "11.0.0.1",
3137 "2001:10::1", "3001::1",
3138 ep_flags.GBP_API_ENDPOINT_FLAG_EXTERNAL)
3139 eep.add_vpp_config()
3144 rep = VppGbpEndpoint(self, vx_tun_l3,
3146 "10.0.0.101", "11.0.0.101",
3147 "2001:10::101", "3001::101",
3148 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
3150 self.pg7.remote_ip4,
3152 rep.add_vpp_config()
3155 # remote to external
3157 p = (Ether(src=self.pg7.remote_mac,
3158 dst=self.pg7.local_mac) /
3159 IP(src=self.pg7.remote_ip4,
3160 dst=self.pg7.local_ip4) /
3161 UDP(sport=1234, dport=48879) /
3162 VXLAN(vni=444, gpid=220, flags=0x88) /
3163 Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3164 IP(src="10.0.0.101", dst="10.0.0.1") /
3165 UDP(sport=1234, dport=1234) /
3168 rxs = self.send_and_expect(self.pg7, p * 1, self.pg0)
3171 # A subnet reachable through the external EP
3173 ip_220 = VppIpRoute(self, "10.220.0.0", 24,
3174 [VppRoutePath(eep.ip4.address,
3175 eep.epg.bvi.sw_if_index)],
3176 table_id=t4.table_id)
3177 ip_220.add_vpp_config()
3179 l3o_220 = VppGbpSubnet(
3180 self, rd1, "10.220.0.0", 24,
3181 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3183 l3o_220.add_vpp_config()
3185 p = (Ether(src=self.pg7.remote_mac,
3186 dst=self.pg7.local_mac) /
3187 IP(src=self.pg7.remote_ip4,
3188 dst=self.pg7.local_ip4) /
3189 UDP(sport=1234, dport=48879) /
3190 VXLAN(vni=444, gpid=220, flags=0x88) /
3191 Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3192 IP(src="10.0.0.101", dst="10.220.0.1") /
3193 UDP(sport=1234, dport=1234) /
3196 rxs = self.send_and_expect(self.pg7, p * 1, self.pg0)
3199 # another external subnet, this time in a different EPG
3201 ip_200 = VppIpRoute(self, "10.200.0.0", 24,
3202 [VppRoutePath(eep.ip4.address,
3203 eep.epg.bvi.sw_if_index)],
3204 table_id=t4.table_id)
3205 ip_200.add_vpp_config()
3207 l3o_200 = VppGbpSubnet(
3208 self, rd1, "10.200.0.0", 24,
3209 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3211 l3o_200.add_vpp_config()
3213 p = (Ether(src=self.pg7.remote_mac,
3214 dst=self.pg7.local_mac) /
3215 IP(src=self.pg7.remote_ip4,
3216 dst=self.pg7.local_ip4) /
3217 UDP(sport=1234, dport=48879) /
3218 VXLAN(vni=444, gpid=220, flags=0x88) /
3219 Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3220 IP(src="10.0.0.101", dst="10.200.0.1") /
3221 UDP(sport=1234, dport=1234) /
3225 # packets dropped due to lack of contract.
3227 rxs = self.send_and_assert_no_replies(self.pg7, p * 1)
3230 # from the the subnet in EPG 220 beyond the external to remote
3232 p4 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3234 IP(src="10.220.0.1", dst=rep.ip4.address) /
3235 UDP(sport=1234, dport=1234) /
3238 rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3241 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3242 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3243 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3244 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
3245 self.assertEqual(rx[VXLAN].vni, 444)
3246 self.assertTrue(rx[VXLAN].flags.G)
3247 self.assertTrue(rx[VXLAN].flags.Instance)
3248 self.assertTrue(rx[VXLAN].gpflags.A)
3249 self.assertFalse(rx[VXLAN].gpflags.D)
3252 # from the the subnet in EPG 200 beyond the external to remote
3253 # dropped due to no contract
3255 p4 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3257 IP(src="10.200.0.1", dst=rep.ip4.address) /
3258 UDP(sport=1234, dport=1234) /
3261 rxs = self.send_and_assert_no_replies(self.pg0, p4 * 1)
3266 acl = VppGbpAcl(self)
3267 rule = acl.create_rule(permit_deny=1, proto=17)
3268 rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
3269 acl_index = acl.add_vpp_config([rule, rule2])
3270 c1 = VppGbpContract(
3271 self, 200, 220, acl_index,
3272 [VppGbpContractRule(
3273 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3276 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3280 rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3283 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3284 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3285 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3286 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
3287 self.assertEqual(rx[VXLAN].vni, 444)
3288 self.assertTrue(rx[VXLAN].flags.G)
3289 self.assertTrue(rx[VXLAN].flags.Instance)
3290 self.assertTrue(rx[VXLAN].gpflags.A)
3291 self.assertFalse(rx[VXLAN].gpflags.D)
3296 self.pg7.unconfig_ip4()
3299 if __name__ == '__main__':
3300 unittest.main(testRunner=VppTestRunner)