3 from socket import AF_INET, AF_INET6
6 from scapy.packet import Raw
7 from scapy.layers.l2 import Ether, ARP, Dot1Q
8 from scapy.layers.inet import IP, UDP, ICMP
9 from scapy.layers.inet6 import IPv6, ICMPv6ND_NS, ICMPv6NDOptSrcLLAddr, \
11 from scapy.utils6 import in6_getnsma, in6_getnsmac
12 from scapy.layers.vxlan import VXLAN
13 from scapy.data import ETH_P_IP, ETH_P_IPV6
14 from scapy.utils import inet_pton, inet_ntop
16 from framework import VppTestCase, VppTestRunner
17 from vpp_object import VppObject
18 from vpp_interface import VppInterface
19 from vpp_ip_route import VppIpRoute, VppRoutePath, VppIpTable, \
20 VppIpInterfaceAddress, VppIpInterfaceBind, find_route
21 from vpp_l2 import VppBridgeDomain, VppBridgeDomainPort, \
22 VppBridgeDomainArpEntry, VppL2FibEntry, find_bridge_domain_port, VppL2Vtr
23 from vpp_sub_interface import VppDot1QSubint
24 from vpp_ip import VppIpAddress, VppIpPrefix
25 from vpp_papi import VppEnum, MACAddress
26 from vpp_papi_provider import L2_VTR_OP
27 from vpp_vxlan_gbp_tunnel import find_vxlan_gbp_tunnel, INDEX_INVALID, \
29 from vpp_neighbor import VppNeighbor
32 def find_gbp_endpoint(test, sw_if_index=None, ip=None, mac=None):
34 vip = VppIpAddress(ip)
36 vmac = MACAddress(mac)
38 eps = test.vapi.gbp_endpoint_dump()
42 if ep.endpoint.sw_if_index != sw_if_index:
45 for eip in ep.endpoint.ips:
49 if vmac.packed == ep.endpoint.mac:
54 def find_gbp_vxlan(test, vni):
55 ts = test.vapi.gbp_vxlan_tunnel_dump()
57 if t.tunnel.vni == vni:
62 class VppGbpEndpoint(VppObject):
89 return [self.ip4, self.ip6]
93 return [self.fip4, self.fip6]
95 def __init__(self, test, itf, epg, recirc, ip4, fip4, ip6, fip6,
105 self._ip4 = VppIpAddress(ip4)
106 self._fip4 = VppIpAddress(fip4)
107 self._ip6 = VppIpAddress(ip6)
108 self._fip6 = VppIpAddress(fip6)
111 self.vmac = MACAddress(self.itf.remote_mac)
113 self.vmac = MACAddress("00:00:00:00:00:00")
116 self.tun_src = VppIpAddress(tun_src)
117 self.tun_dst = VppIpAddress(tun_dst)
119 def add_vpp_config(self):
120 res = self._test.vapi.gbp_endpoint_add(
121 self.itf.sw_if_index,
122 [self.ip4.encode(), self.ip6.encode()],
126 self.tun_src.encode(),
127 self.tun_dst.encode())
128 self.handle = res.handle
129 self._test.registry.register(self, self._test.logger)
131 def remove_vpp_config(self):
132 self._test.vapi.gbp_endpoint_del(self.handle)
135 return self.object_id()
138 return "gbp-endpoint:[%d==%d:%s:%d]" % (self.handle,
139 self.itf.sw_if_index,
143 def query_vpp_config(self):
144 return find_gbp_endpoint(self._test,
145 self.itf.sw_if_index,
149 class VppGbpRecirc(VppObject):
151 GBP Recirculation Interface
154 def __init__(self, test, epg, recirc, is_ext=False):
160 def add_vpp_config(self):
161 self._test.vapi.gbp_recirc_add_del(
163 self.recirc.sw_if_index,
166 self._test.registry.register(self, self._test.logger)
168 def remove_vpp_config(self):
169 self._test.vapi.gbp_recirc_add_del(
171 self.recirc.sw_if_index,
176 return self.object_id()
179 return "gbp-recirc:[%d]" % (self.recirc.sw_if_index)
181 def query_vpp_config(self):
182 rs = self._test.vapi.gbp_recirc_dump()
184 if r.recirc.sw_if_index == self.recirc.sw_if_index:
189 class VppGbpExtItf(VppObject):
191 GBP ExtItfulation Interface
194 def __init__(self, test, itf, bd, rd):
200 def add_vpp_config(self):
201 self._test.vapi.gbp_ext_itf_add_del(
203 self.itf.sw_if_index,
206 self._test.registry.register(self, self._test.logger)
208 def remove_vpp_config(self):
209 self._test.vapi.gbp_ext_itf_add_del(
211 self.itf.sw_if_index,
216 return self.object_id()
219 return "gbp-ext-itf:[%d]" % (self.itf.sw_if_index)
221 def query_vpp_config(self):
222 rs = self._test.vapi.gbp_ext_itf_dump()
224 if r.ext_itf.sw_if_index == self.itf.sw_if_index:
229 class VppGbpSubnet(VppObject):
233 def __init__(self, test, rd, address, address_len,
234 type, sw_if_index=None, sclass=None):
236 self.rd_id = rd.rd_id
237 self.prefix = VppIpPrefix(address, address_len)
239 self.sw_if_index = sw_if_index
242 def add_vpp_config(self):
243 self._test.vapi.gbp_subnet_add_del(
246 self.prefix.encode(),
248 sw_if_index=self.sw_if_index if self.sw_if_index else 0xffffffff,
249 sclass=self.sclass if self.sclass else 0xffff)
250 self._test.registry.register(self, self._test.logger)
252 def remove_vpp_config(self):
253 self._test.vapi.gbp_subnet_add_del(
256 self.prefix.encode(),
260 return self.object_id()
263 return "gbp-subnet:[%d-%s]" % (self.rd_id, self.prefix)
265 def query_vpp_config(self):
266 ss = self._test.vapi.gbp_subnet_dump()
268 if s.subnet.rd_id == self.rd_id and \
269 s.subnet.type == self.type and \
270 s.subnet.prefix == self.prefix:
275 class VppGbpEndpointRetention(object):
276 def __init__(self, remote_ep_timeout=0xffffffff):
277 self.remote_ep_timeout = remote_ep_timeout
280 return {'remote_ep_timeout': self.remote_ep_timeout}
283 class VppGbpEndpointGroup(VppObject):
288 def __init__(self, test, vnid, sclass, rd, bd, uplink,
289 bvi, bvi_ip4, bvi_ip6=None,
290 retention=VppGbpEndpointRetention()):
294 self.bvi_ip4 = VppIpAddress(bvi_ip4)
295 self.bvi_ip6 = VppIpAddress(bvi_ip6)
302 self.retention = retention
304 def add_vpp_config(self):
305 self._test.vapi.gbp_endpoint_group_add(
310 self.uplink.sw_if_index if self.uplink else INDEX_INVALID,
311 self.retention.encode())
312 self._test.registry.register(self, self._test.logger)
314 def remove_vpp_config(self):
315 self._test.vapi.gbp_endpoint_group_del(self.sclass)
318 return self.object_id()
321 return "gbp-endpoint-group:[%d]" % (self.vnid)
323 def query_vpp_config(self):
324 epgs = self._test.vapi.gbp_endpoint_group_dump()
326 if epg.epg.vnid == self.vnid:
331 class VppGbpBridgeDomain(VppObject):
336 def __init__(self, test, bd, bvi, uu_fwd=None,
337 bm_flood=None, learn=True):
341 self.bm_flood = bm_flood
344 e = VppEnum.vl_api_gbp_bridge_domain_flags_t
346 self.learn = e.GBP_BD_API_FLAG_NONE
348 self.learn = e.GBP_BD_API_FLAG_DO_NOT_LEARN
350 def add_vpp_config(self):
351 self._test.vapi.gbp_bridge_domain_add(
354 self.bvi.sw_if_index,
355 self.uu_fwd.sw_if_index if self.uu_fwd else INDEX_INVALID,
356 self.bm_flood.sw_if_index if self.bm_flood else INDEX_INVALID)
357 self._test.registry.register(self, self._test.logger)
359 def remove_vpp_config(self):
360 self._test.vapi.gbp_bridge_domain_del(self.bd.bd_id)
363 return self.object_id()
366 return "gbp-bridge-domain:[%d]" % (self.bd.bd_id)
368 def query_vpp_config(self):
369 bds = self._test.vapi.gbp_bridge_domain_dump()
371 if bd.bd.bd_id == self.bd.bd_id:
376 class VppGbpRouteDomain(VppObject):
381 def __init__(self, test, rd_id, t4, t6, ip4_uu=None, ip6_uu=None):
389 def add_vpp_config(self):
390 self._test.vapi.gbp_route_domain_add(
394 self.ip4_uu.sw_if_index if self.ip4_uu else INDEX_INVALID,
395 self.ip6_uu.sw_if_index if self.ip6_uu else INDEX_INVALID)
396 self._test.registry.register(self, self._test.logger)
398 def remove_vpp_config(self):
399 self._test.vapi.gbp_route_domain_del(self.rd_id)
402 return self.object_id()
405 return "gbp-route-domain:[%d]" % (self.rd_id)
407 def query_vpp_config(self):
408 rds = self._test.vapi.gbp_route_domain_dump()
410 if rd.rd.rd_id == self.rd_id:
415 class VppGbpContractNextHop():
416 def __init__(self, mac, bd, ip, rd):
423 return {'ip': self.ip.encode(),
424 'mac': self.mac.packed,
425 'bd_id': self.bd.bd.bd_id,
426 'rd_id': self.rd.rd_id}
429 class VppGbpContractRule():
430 def __init__(self, action, hash_mode, nhs=[]):
432 self.hash_mode = hash_mode
438 nhs.append(nh.encode())
441 return {'action': self.action,
443 'hash_mode': self.hash_mode,
444 'n_nhs': len(self.nhs),
448 class VppGbpContract(VppObject):
453 def __init__(self, test, sclass, dclass, acl_index,
454 rules, allowed_ethertypes):
456 self.acl_index = acl_index
460 self.allowed_ethertypes = allowed_ethertypes
461 while (len(self.allowed_ethertypes) < 16):
462 self.allowed_ethertypes.append(0)
464 def add_vpp_config(self):
467 rules.append(r.encode())
468 self._test.vapi.gbp_contract_add_del(
474 self.allowed_ethertypes)
475 self._test.registry.register(self, self._test.logger)
477 def remove_vpp_config(self):
478 self._test.vapi.gbp_contract_add_del(
484 self.allowed_ethertypes)
487 return self.object_id()
490 return "gbp-contract:[%d:%s:%d]" % (self.sclass,
494 def query_vpp_config(self):
495 cs = self._test.vapi.gbp_contract_dump()
497 if c.contract.sclass == self.sclass \
498 and c.contract.dclass == self.dclass:
503 class VppGbpVxlanTunnel(VppInterface):
508 def __init__(self, test, vni, bd_rd_id, mode, src):
509 super(VppGbpVxlanTunnel, self).__init__(test)
512 self.bd_rd_id = bd_rd_id
516 def add_vpp_config(self):
517 r = self._test.vapi.gbp_vxlan_tunnel_add(
522 self.set_sw_if_index(r.sw_if_index)
523 self._test.registry.register(self, self._test.logger)
525 def remove_vpp_config(self):
526 self._test.vapi.gbp_vxlan_tunnel_del(self.vni)
529 return self.object_id()
532 return "gbp-vxlan:%d" % (self.sw_if_index)
534 def query_vpp_config(self):
535 return find_gbp_vxlan(self._test, self.vni)
538 class VppGbpAcl(VppObject):
543 def __init__(self, test):
545 self.acl_index = 4294967295
547 def create_rule(self, is_ipv6=0, permit_deny=0, proto=-1,
548 s_prefix=0, s_ip=b'\x00\x00\x00\x00', sport_from=0,
549 sport_to=65535, d_prefix=0, d_ip=b'\x00\x00\x00\x00',
550 dport_from=0, dport_to=65535):
551 if proto == -1 or proto == 0:
554 elif proto == 1 or proto == 58:
557 rule = ({'is_permit': permit_deny, 'is_ipv6': is_ipv6, 'proto': proto,
558 'srcport_or_icmptype_first': sport_from,
559 'srcport_or_icmptype_last': sport_to,
560 'src_ip_prefix_len': s_prefix,
562 'dstport_or_icmpcode_first': dport_from,
563 'dstport_or_icmpcode_last': dport_to,
564 'dst_ip_prefix_len': d_prefix,
565 'dst_ip_addr': d_ip})
568 def add_vpp_config(self, rules):
570 reply = self._test.vapi.acl_add_replace(self.acl_index,
573 self.acl_index = reply.acl_index
574 return self.acl_index
576 def remove_vpp_config(self):
577 self._test.vapi.acl_del(self.acl_index)
580 return self.object_id()
583 return "gbp-acl:[%d]" % (self.acl_index)
585 def query_vpp_config(self):
586 cs = self._test.vapi.acl_dump()
588 if c.acl_index == self.acl_index:
593 class TestGBP(VppTestCase):
594 """ GBP Test Case """
597 super(TestGBP, self).setUp()
599 self.create_pg_interfaces(range(9))
600 self.create_loopback_interfaces(8)
602 self.router_mac = MACAddress("00:11:22:33:44:55")
604 for i in self.pg_interfaces:
606 for i in self.lo_interfaces:
610 for i in self.pg_interfaces:
613 super(TestGBP, self).tearDown()
615 def send_and_expect_bridged(self, src, tx, dst):
616 rx = self.send_and_expect(src, tx, dst)
619 self.assertEqual(r[Ether].src, tx[0][Ether].src)
620 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
621 self.assertEqual(r[IP].src, tx[0][IP].src)
622 self.assertEqual(r[IP].dst, tx[0][IP].dst)
625 def send_and_expect_bridged6(self, src, tx, dst):
626 rx = self.send_and_expect(src, tx, dst)
629 self.assertEqual(r[Ether].src, tx[0][Ether].src)
630 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
631 self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
632 self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
635 def send_and_expect_routed(self, src, tx, dst, src_mac):
636 rx = self.send_and_expect(src, tx, dst)
639 self.assertEqual(r[Ether].src, src_mac)
640 self.assertEqual(r[Ether].dst, dst.remote_mac)
641 self.assertEqual(r[IP].src, tx[0][IP].src)
642 self.assertEqual(r[IP].dst, tx[0][IP].dst)
645 def send_and_expect_natted(self, src, tx, dst, src_ip):
646 rx = self.send_and_expect(src, tx, dst)
649 self.assertEqual(r[Ether].src, tx[0][Ether].src)
650 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
651 self.assertEqual(r[IP].src, src_ip)
652 self.assertEqual(r[IP].dst, tx[0][IP].dst)
655 def send_and_expect_natted6(self, src, tx, dst, src_ip):
656 rx = self.send_and_expect(src, tx, dst)
659 self.assertEqual(r[Ether].src, tx[0][Ether].src)
660 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
661 self.assertEqual(r[IPv6].src, src_ip)
662 self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
665 def send_and_expect_unnatted(self, src, tx, dst, dst_ip):
666 rx = self.send_and_expect(src, tx, dst)
669 self.assertEqual(r[Ether].src, tx[0][Ether].src)
670 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
671 self.assertEqual(r[IP].dst, dst_ip)
672 self.assertEqual(r[IP].src, tx[0][IP].src)
675 def send_and_expect_unnatted6(self, src, tx, dst, dst_ip):
676 rx = self.send_and_expect(src, tx, dst)
679 self.assertEqual(r[Ether].src, tx[0][Ether].src)
680 self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
681 self.assertEqual(r[IPv6].dst, dst_ip)
682 self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
685 def send_and_expect_double_natted(self, src, tx, dst, src_ip, dst_ip):
686 rx = self.send_and_expect(src, tx, dst)
689 self.assertEqual(r[Ether].src, str(self.router_mac))
690 self.assertEqual(r[Ether].dst, dst.remote_mac)
691 self.assertEqual(r[IP].dst, dst_ip)
692 self.assertEqual(r[IP].src, src_ip)
695 def send_and_expect_double_natted6(self, src, tx, dst, src_ip, dst_ip):
696 rx = self.send_and_expect(src, tx, dst)
699 self.assertEqual(r[Ether].src, str(self.router_mac))
700 self.assertEqual(r[Ether].dst, dst.remote_mac)
701 self.assertEqual(r[IPv6].dst, dst_ip)
702 self.assertEqual(r[IPv6].src, src_ip)
706 """ Group Based Policy """
708 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
713 bd1 = VppBridgeDomain(self, 1)
714 bd2 = VppBridgeDomain(self, 2)
715 bd20 = VppBridgeDomain(self, 20)
719 bd20.add_vpp_config()
721 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
722 gbd2 = VppGbpBridgeDomain(self, bd2, self.loop1)
723 gbd20 = VppGbpBridgeDomain(self, bd20, self.loop2)
725 gbd1.add_vpp_config()
726 gbd2.add_vpp_config()
727 gbd20.add_vpp_config()
732 gt4 = VppIpTable(self, 0)
734 gt6 = VppIpTable(self, 0, is_ip6=True)
736 nt4 = VppIpTable(self, 20)
738 nt6 = VppIpTable(self, 20, is_ip6=True)
741 rd0 = VppGbpRouteDomain(self, 0, gt4, gt6, None, None)
742 rd20 = VppGbpRouteDomain(self, 20, nt4, nt6, None, None)
745 rd20.add_vpp_config()
748 # 3 EPGs, 2 of which share a BD.
749 # 2 NAT EPGs, one for floating-IP subnets, the other for internet
751 epgs = [VppGbpEndpointGroup(self, 220, 1220, rd0, gbd1,
752 self.pg4, self.loop0,
753 "10.0.0.128", "2001:10::128"),
754 VppGbpEndpointGroup(self, 221, 1221, rd0, gbd1,
755 self.pg5, self.loop0,
756 "10.0.1.128", "2001:10:1::128"),
757 VppGbpEndpointGroup(self, 222, 1222, rd0, gbd2,
758 self.pg6, self.loop1,
759 "10.0.2.128", "2001:10:2::128"),
760 VppGbpEndpointGroup(self, 333, 1333, rd20, gbd20,
761 self.pg7, self.loop2,
762 "11.0.0.128", "3001::128"),
763 VppGbpEndpointGroup(self, 444, 1444, rd20, gbd20,
764 self.pg8, self.loop2,
765 "11.0.0.129", "3001::129")]
766 recircs = [VppGbpRecirc(self, epgs[0], self.loop3),
767 VppGbpRecirc(self, epgs[1], self.loop4),
768 VppGbpRecirc(self, epgs[2], self.loop5),
769 VppGbpRecirc(self, epgs[3], self.loop6, is_ext=True),
770 VppGbpRecirc(self, epgs[4], self.loop7, is_ext=True)]
773 recirc_nat = recircs[3]
776 # 4 end-points, 2 in the same subnet, 3 in the same BD
778 eps = [VppGbpEndpoint(self, self.pg0,
780 "10.0.0.1", "11.0.0.1",
781 "2001:10::1", "3001::1"),
782 VppGbpEndpoint(self, self.pg1,
784 "10.0.0.2", "11.0.0.2",
785 "2001:10::2", "3001::2"),
786 VppGbpEndpoint(self, self.pg2,
788 "10.0.1.1", "11.0.0.3",
789 "2001:10:1::1", "3001::3"),
790 VppGbpEndpoint(self, self.pg3,
792 "10.0.2.1", "11.0.0.4",
793 "2001:10:2::1", "3001::4")]
796 # Config related to each of the EPGs
799 # IP config on the BVI interfaces
800 if epg != epgs[1] and epg != epgs[4]:
801 VppIpInterfaceBind(self, epg.bvi, epg.rd.t4).add_vpp_config()
802 VppIpInterfaceBind(self, epg.bvi, epg.rd.t6).add_vpp_config()
803 self.vapi.sw_interface_set_mac_address(
805 self.router_mac.packed)
807 # The BVIs are NAT inside interfaces
808 self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
811 self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
815 if_ip4 = VppIpInterfaceAddress(self, epg.bvi, epg.bvi_ip4, 32)
816 if_ip6 = VppIpInterfaceAddress(self, epg.bvi, epg.bvi_ip6, 128)
817 if_ip4.add_vpp_config()
818 if_ip6.add_vpp_config()
820 # EPG uplink interfaces in the RD
821 VppIpInterfaceBind(self, epg.uplink, epg.rd.t4).add_vpp_config()
822 VppIpInterfaceBind(self, epg.uplink, epg.rd.t6).add_vpp_config()
824 # add the BD ARP termination entry for BVI IP
825 epg.bd_arp_ip4 = VppBridgeDomainArpEntry(self, epg.bd.bd,
826 str(self.router_mac),
828 epg.bd_arp_ip6 = VppBridgeDomainArpEntry(self, epg.bd.bd,
829 str(self.router_mac),
831 epg.bd_arp_ip4.add_vpp_config()
832 epg.bd_arp_ip6.add_vpp_config()
837 for recirc in recircs:
838 # EPG's ingress recirculation interface maps to its RD
839 VppIpInterfaceBind(self, recirc.recirc,
840 recirc.epg.rd.t4).add_vpp_config()
841 VppIpInterfaceBind(self, recirc.recirc,
842 recirc.epg.rd.t6).add_vpp_config()
844 self.vapi.nat44_interface_add_del_feature(
845 recirc.recirc.sw_if_index,
848 self.vapi.nat66_add_del_interface(
849 recirc.recirc.sw_if_index,
853 recirc.add_vpp_config()
855 for recirc in recircs:
856 self.assertTrue(find_bridge_domain_port(self,
857 recirc.epg.bd.bd.bd_id,
858 recirc.recirc.sw_if_index))
861 self.pg_enable_capture(self.pg_interfaces)
864 # routes to the endpoints. We need these since there are no
865 # adj-fibs due to the fact the the BVI address has /32 and
866 # the subnet is not attached.
868 for (ip, fip) in zip(ep.ips, ep.fips):
869 # Add static mappings for each EP from the 10/8 to 11/8 network
871 self.vapi.nat44_add_del_static_mapping(ip.bytes,
876 self.vapi.nat66_add_del_static_mapping(ip.bytes,
883 self.logger.info(self.vapi.cli("sh gbp endpoint"))
885 # ... results in a Gratuitous ARP/ND on the EPG's uplink
886 rx = ep.epg.uplink.get_capture(len(ep.ips), timeout=0.2)
888 for ii, ip in enumerate(ep.ips):
892 self.assertTrue(p.haslayer(ICMPv6ND_NA))
893 self.assertEqual(p[ICMPv6ND_NA].tgt, ip.address)
895 self.assertTrue(p.haslayer(ARP))
896 self.assertEqual(p[ARP].psrc, ip.address)
897 self.assertEqual(p[ARP].pdst, ip.address)
899 # add the BD ARP termination entry for floating IP
901 ba = VppBridgeDomainArpEntry(self, epg_nat.bd.bd, ep.mac, fip)
904 # floating IPs route via EPG recirc
905 r = VppIpRoute(self, fip.address, fip.length,
906 [VppRoutePath(fip.address,
907 ep.recirc.recirc.sw_if_index,
909 proto=fip.dpo_proto)],
914 # L2 FIB entries in the NAT EPG BD to bridge the packets from
915 # the outside direct to the internal EPG
916 lf = VppL2FibEntry(self, epg_nat.bd.bd, ep.mac,
917 ep.recirc.recirc, bvi_mac=0)
921 # ARP packets for unknown IP are sent to the EPG uplink
923 pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
924 src=self.pg0.remote_mac) /
926 hwdst="ff:ff:ff:ff:ff:ff",
927 hwsrc=self.pg0.remote_mac,
931 self.vapi.cli("clear trace")
932 self.pg0.add_stream(pkt_arp)
934 self.pg_enable_capture(self.pg_interfaces)
937 rxd = epgs[0].uplink.get_capture(1)
940 # ARP/ND packets get a response
942 pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
943 src=self.pg0.remote_mac) /
945 hwdst="ff:ff:ff:ff:ff:ff",
946 hwsrc=self.pg0.remote_mac,
947 pdst=epgs[0].bvi_ip4.address,
948 psrc=eps[0].ip4.address))
950 self.send_and_expect(self.pg0, [pkt_arp], self.pg0)
952 nsma = in6_getnsma(inet_pton(AF_INET6, eps[0].ip6.address))
953 d = inet_ntop(AF_INET6, nsma)
954 pkt_nd = (Ether(dst=in6_getnsmac(nsma),
955 src=self.pg0.remote_mac) /
956 IPv6(dst=d, src=eps[0].ip6.address) /
957 ICMPv6ND_NS(tgt=epgs[0].bvi_ip6.address) /
958 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
959 self.send_and_expect(self.pg0, [pkt_nd], self.pg0)
962 # broadcast packets are flooded
964 pkt_bcast = (Ether(dst="ff:ff:ff:ff:ff:ff",
965 src=self.pg0.remote_mac) /
966 IP(src=eps[0].ip4.address, dst="232.1.1.1") /
967 UDP(sport=1234, dport=1234) /
970 self.vapi.cli("clear trace")
971 self.pg0.add_stream(pkt_bcast)
973 self.pg_enable_capture(self.pg_interfaces)
976 rxd = eps[1].itf.get_capture(1)
977 self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
978 rxd = epgs[0].uplink.get_capture(1)
979 self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
982 # packets to non-local L3 destinations dropped
984 pkt_intra_epg_220_ip4 = (Ether(src=self.pg0.remote_mac,
985 dst=str(self.router_mac)) /
986 IP(src=eps[0].ip4.address,
988 UDP(sport=1234, dport=1234) /
990 pkt_inter_epg_222_ip4 = (Ether(src=self.pg0.remote_mac,
991 dst=str(self.router_mac)) /
992 IP(src=eps[0].ip4.address,
994 UDP(sport=1234, dport=1234) /
997 self.send_and_assert_no_replies(self.pg0, pkt_intra_epg_220_ip4 * 65)
999 pkt_inter_epg_222_ip6 = (Ether(src=self.pg0.remote_mac,
1000 dst=str(self.router_mac)) /
1001 IPv6(src=eps[0].ip6.address,
1002 dst="2001:10::99") /
1003 UDP(sport=1234, dport=1234) /
1005 self.send_and_assert_no_replies(self.pg0, pkt_inter_epg_222_ip6 * 65)
1008 # Add the subnet routes
1011 self, rd0, "10.0.0.0", 24,
1012 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1014 self, rd0, "10.0.1.0", 24,
1015 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1017 self, rd0, "10.0.2.0", 24,
1018 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1020 self, rd0, "2001:10::1", 64,
1021 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1023 self, rd0, "2001:10:1::1", 64,
1024 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1026 self, rd0, "2001:10:2::1", 64,
1027 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1028 s41.add_vpp_config()
1029 s42.add_vpp_config()
1030 s43.add_vpp_config()
1031 s61.add_vpp_config()
1032 s62.add_vpp_config()
1033 s63.add_vpp_config()
1035 self.send_and_expect_bridged(eps[0].itf,
1036 pkt_intra_epg_220_ip4 * 65,
1038 self.send_and_expect_bridged(eps[0].itf,
1039 pkt_inter_epg_222_ip4 * 65,
1041 self.send_and_expect_bridged6(eps[0].itf,
1042 pkt_inter_epg_222_ip6 * 65,
1045 self.logger.info(self.vapi.cli("sh ip fib 11.0.0.2"))
1046 self.logger.info(self.vapi.cli("sh gbp endpoint-group"))
1047 self.logger.info(self.vapi.cli("sh gbp endpoint"))
1048 self.logger.info(self.vapi.cli("sh gbp recirc"))
1049 self.logger.info(self.vapi.cli("sh int"))
1050 self.logger.info(self.vapi.cli("sh int addr"))
1051 self.logger.info(self.vapi.cli("sh int feat loop6"))
1052 self.logger.info(self.vapi.cli("sh vlib graph ip4-gbp-src-classify"))
1053 self.logger.info(self.vapi.cli("sh int feat loop3"))
1054 self.logger.info(self.vapi.cli("sh int feat pg0"))
1057 # Packet destined to unknown unicast is sent on the epg uplink ...
1059 pkt_intra_epg_220_to_uplink = (Ether(src=self.pg0.remote_mac,
1060 dst="00:00:00:33:44:55") /
1061 IP(src=eps[0].ip4.address,
1063 UDP(sport=1234, dport=1234) /
1066 self.send_and_expect_bridged(eps[0].itf,
1067 pkt_intra_epg_220_to_uplink * 65,
1069 # ... and nowhere else
1070 self.pg1.get_capture(0, timeout=0.1)
1071 self.pg1.assert_nothing_captured(remark="Flood onto other VMS")
1073 pkt_intra_epg_221_to_uplink = (Ether(src=self.pg2.remote_mac,
1074 dst="00:00:00:33:44:66") /
1075 IP(src=eps[0].ip4.address,
1077 UDP(sport=1234, dport=1234) /
1080 self.send_and_expect_bridged(eps[2].itf,
1081 pkt_intra_epg_221_to_uplink * 65,
1085 # Packets from the uplink are forwarded in the absence of a contract
1087 pkt_intra_epg_220_from_uplink = (Ether(src="00:00:00:33:44:55",
1088 dst=self.pg0.remote_mac) /
1089 IP(src=eps[0].ip4.address,
1091 UDP(sport=1234, dport=1234) /
1094 self.send_and_expect_bridged(self.pg4,
1095 pkt_intra_epg_220_from_uplink * 65,
1099 # in the absence of policy, endpoints in the same EPG
1102 pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
1103 dst=self.pg1.remote_mac) /
1104 IP(src=eps[0].ip4.address,
1105 dst=eps[1].ip4.address) /
1106 UDP(sport=1234, dport=1234) /
1109 self.send_and_expect_bridged(self.pg0, pkt_intra_epg * 65, self.pg1)
1112 # in the absence of policy, endpoints in the different EPG
1113 # cannot communicate
1115 pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
1116 dst=self.pg2.remote_mac) /
1117 IP(src=eps[0].ip4.address,
1118 dst=eps[2].ip4.address) /
1119 UDP(sport=1234, dport=1234) /
1121 pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
1122 dst=self.pg0.remote_mac) /
1123 IP(src=eps[2].ip4.address,
1124 dst=eps[0].ip4.address) /
1125 UDP(sport=1234, dport=1234) /
1127 pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
1128 dst=str(self.router_mac)) /
1129 IP(src=eps[0].ip4.address,
1130 dst=eps[3].ip4.address) /
1131 UDP(sport=1234, dport=1234) /
1134 self.send_and_assert_no_replies(eps[0].itf,
1135 pkt_inter_epg_220_to_221 * 65)
1136 self.send_and_assert_no_replies(eps[0].itf,
1137 pkt_inter_epg_220_to_222 * 65)
1140 # A uni-directional contract from EPG 220 -> 221
1142 acl = VppGbpAcl(self)
1143 rule = acl.create_rule(permit_deny=1, proto=17)
1144 rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
1145 acl_index = acl.add_vpp_config([rule, rule2])
1146 c1 = VppGbpContract(
1147 self, epgs[0].sclass, epgs[1].sclass, acl_index,
1148 [VppGbpContractRule(
1149 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1152 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1154 [ETH_P_IP, ETH_P_IPV6])
1157 self.send_and_expect_bridged(eps[0].itf,
1158 pkt_inter_epg_220_to_221 * 65,
1160 self.send_and_assert_no_replies(eps[0].itf,
1161 pkt_inter_epg_220_to_222 * 65)
1164 # contract for the return direction
1166 c2 = VppGbpContract(
1167 self, epgs[1].sclass, epgs[0].sclass, acl_index,
1168 [VppGbpContractRule(
1169 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1172 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1174 [ETH_P_IP, ETH_P_IPV6])
1177 self.send_and_expect_bridged(eps[0].itf,
1178 pkt_inter_epg_220_to_221 * 65,
1180 self.send_and_expect_bridged(eps[2].itf,
1181 pkt_inter_epg_221_to_220 * 65,
1185 # the contract does not allow non-IP
1187 pkt_non_ip_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
1188 dst=self.pg2.remote_mac) /
1190 self.send_and_assert_no_replies(eps[0].itf,
1191 pkt_non_ip_inter_epg_220_to_221 * 17)
1194 # check that inter group is still disabled for the groups
1195 # not in the contract.
1197 self.send_and_assert_no_replies(eps[0].itf,
1198 pkt_inter_epg_220_to_222 * 65)
1201 # A uni-directional contract from EPG 220 -> 222 'L3 routed'
1203 c3 = VppGbpContract(
1204 self, epgs[0].sclass, epgs[2].sclass, acl_index,
1205 [VppGbpContractRule(
1206 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1209 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1211 [ETH_P_IP, ETH_P_IPV6])
1214 self.logger.info(self.vapi.cli("sh gbp contract"))
1216 self.send_and_expect_routed(eps[0].itf,
1217 pkt_inter_epg_220_to_222 * 65,
1219 str(self.router_mac))
1222 # remove both contracts, traffic stops in both directions
1224 c2.remove_vpp_config()
1225 c1.remove_vpp_config()
1226 c3.remove_vpp_config()
1227 acl.remove_vpp_config()
1229 self.send_and_assert_no_replies(eps[2].itf,
1230 pkt_inter_epg_221_to_220 * 65)
1231 self.send_and_assert_no_replies(eps[0].itf,
1232 pkt_inter_epg_220_to_221 * 65)
1233 self.send_and_expect_bridged(eps[0].itf,
1238 # EPs to the outside world
1241 # in the EP's RD an external subnet via the NAT EPG's recirc
1243 self, rd0, "0.0.0.0", 0,
1244 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1245 sw_if_index=recirc_nat.recirc.sw_if_index,
1246 sclass=epg_nat.sclass)
1248 self, rd0, "11.0.0.0", 8,
1249 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1250 sw_if_index=recirc_nat.recirc.sw_if_index,
1251 sclass=epg_nat.sclass)
1252 se16 = VppGbpSubnet(
1254 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1255 sw_if_index=recirc_nat.recirc.sw_if_index,
1256 sclass=epg_nat.sclass)
1257 # in the NAT RD an external subnet via the NAT EPG's uplink
1259 self, rd20, "0.0.0.0", 0,
1260 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1261 sw_if_index=epg_nat.uplink.sw_if_index,
1262 sclass=epg_nat.sclass)
1263 se36 = VppGbpSubnet(
1264 self, rd20, "::", 0,
1265 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1266 sw_if_index=epg_nat.uplink.sw_if_index,
1267 sclass=epg_nat.sclass)
1269 self, rd20, "11.0.0.0", 8,
1270 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1271 sw_if_index=epg_nat.uplink.sw_if_index,
1272 sclass=epg_nat.sclass)
1273 se1.add_vpp_config()
1274 se2.add_vpp_config()
1275 se16.add_vpp_config()
1276 se3.add_vpp_config()
1277 se36.add_vpp_config()
1278 se4.add_vpp_config()
1280 self.logger.info(self.vapi.cli("sh ip fib 0.0.0.0/0"))
1281 self.logger.info(self.vapi.cli("sh ip fib 11.0.0.1"))
1282 self.logger.info(self.vapi.cli("sh ip6 fib ::/0"))
1283 self.logger.info(self.vapi.cli("sh ip6 fib %s" %
1287 # From an EP to an outside address: IN2OUT
1289 pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
1290 dst=str(self.router_mac)) /
1291 IP(src=eps[0].ip4.address,
1293 UDP(sport=1234, dport=1234) /
1297 self.send_and_assert_no_replies(eps[0].itf,
1298 pkt_inter_epg_220_to_global * 65)
1300 acl2 = VppGbpAcl(self)
1301 rule = acl2.create_rule(permit_deny=1, proto=17, sport_from=1234,
1302 sport_to=1234, dport_from=1234, dport_to=1234)
1303 rule2 = acl2.create_rule(is_ipv6=1, permit_deny=1, proto=17,
1304 sport_from=1234, sport_to=1234,
1305 dport_from=1234, dport_to=1234)
1307 acl_index2 = acl2.add_vpp_config([rule, rule2])
1308 c4 = VppGbpContract(
1309 self, epgs[0].sclass, epgs[3].sclass, acl_index2,
1310 [VppGbpContractRule(
1311 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1314 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1316 [ETH_P_IP, ETH_P_IPV6])
1319 self.send_and_expect_natted(eps[0].itf,
1320 pkt_inter_epg_220_to_global * 65,
1322 eps[0].fip4.address)
1324 pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
1325 dst=str(self.router_mac)) /
1326 IPv6(src=eps[0].ip6.address,
1328 UDP(sport=1234, dport=1234) /
1331 self.send_and_expect_natted6(self.pg0,
1332 pkt_inter_epg_220_to_global * 65,
1334 eps[0].fip6.address)
1337 # From a global address to an EP: OUT2IN
1339 pkt_inter_epg_220_from_global = (Ether(src=str(self.router_mac),
1340 dst=self.pg0.remote_mac) /
1341 IP(dst=eps[0].fip4.address,
1343 UDP(sport=1234, dport=1234) /
1346 self.send_and_assert_no_replies(self.pg7,
1347 pkt_inter_epg_220_from_global * 65)
1349 c5 = VppGbpContract(
1350 self, epgs[3].sclass, epgs[0].sclass, acl_index2,
1351 [VppGbpContractRule(
1352 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1355 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1357 [ETH_P_IP, ETH_P_IPV6])
1360 self.send_and_expect_unnatted(self.pg7,
1361 pkt_inter_epg_220_from_global * 65,
1365 pkt_inter_epg_220_from_global = (Ether(src=str(self.router_mac),
1366 dst=self.pg0.remote_mac) /
1367 IPv6(dst=eps[0].fip6.address,
1369 UDP(sport=1234, dport=1234) /
1372 self.send_and_expect_unnatted6(self.pg7,
1373 pkt_inter_epg_220_from_global * 65,
1378 # From a local VM to another local VM using resp. public addresses:
1381 pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
1382 dst=str(self.router_mac)) /
1383 IP(src=eps[0].ip4.address,
1384 dst=eps[1].fip4.address) /
1385 UDP(sport=1234, dport=1234) /
1388 self.send_and_expect_double_natted(eps[0].itf,
1389 pkt_intra_epg_220_global * 65,
1391 eps[0].fip4.address,
1394 pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
1395 dst=str(self.router_mac)) /
1396 IPv6(src=eps[0].ip6.address,
1397 dst=eps[1].fip6.address) /
1398 UDP(sport=1234, dport=1234) /
1401 self.send_and_expect_double_natted6(eps[0].itf,
1402 pkt_intra_epg_220_global * 65,
1404 eps[0].fip6.address,
1411 # del static mappings for each EP from the 10/8 to 11/8 network
1412 self.vapi.nat44_add_del_static_mapping(ep.ip4.bytes,
1417 self.vapi.nat66_add_del_static_mapping(ep.ip6.bytes,
1423 # IP config on the BVI interfaces
1424 if epg != epgs[0] and epg != epgs[3]:
1425 self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
1428 self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
1432 for recirc in recircs:
1433 self.vapi.nat44_interface_add_del_feature(
1434 recirc.recirc.sw_if_index,
1437 self.vapi.nat66_add_del_interface(
1438 recirc.recirc.sw_if_index,
1442 def wait_for_ep_timeout(self, sw_if_index=None, ip=None, mac=None,
1443 n_tries=100, s_time=1):
1445 if not find_gbp_endpoint(self, sw_if_index, ip, mac):
1447 n_tries = n_tries - 1
1449 self.assertFalse(find_gbp_endpoint(self, sw_if_index, ip, mac))
1452 def test_gbp_learn_l2(self):
1453 """ GBP L2 Endpoint Learning """
1455 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1456 learnt = [{'mac': '00:00:11:11:11:01',
1458 'ip6': '2001:10::2'},
1459 {'mac': '00:00:11:11:11:02',
1461 'ip6': '2001:10::3'}]
1466 gt4 = VppIpTable(self, 1)
1467 gt4.add_vpp_config()
1468 gt6 = VppIpTable(self, 1, is_ip6=True)
1469 gt6.add_vpp_config()
1471 rd1 = VppGbpRouteDomain(self, 1, gt4, gt6)
1472 rd1.add_vpp_config()
1475 # Pg2 hosts the vxlan tunnel, hosts on pg2 to act as TEPs
1476 # Pg3 hosts the IP4 UU-flood VXLAN tunnel
1477 # Pg4 hosts the IP6 UU-flood VXLAN tunnel
1479 self.pg2.config_ip4()
1480 self.pg2.resolve_arp()
1481 self.pg2.generate_remote_hosts(4)
1482 self.pg2.configure_ipv4_neighbors()
1483 self.pg3.config_ip4()
1484 self.pg3.resolve_arp()
1485 self.pg4.config_ip4()
1486 self.pg4.resolve_arp()
1489 # Add a mcast destination VXLAN-GBP tunnel for B&M traffic
1491 tun_bm = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
1494 tun_bm.add_vpp_config()
1497 # a GBP bridge domain with a BVI and a UU-flood interface
1499 bd1 = VppBridgeDomain(self, 1)
1500 bd1.add_vpp_config()
1501 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, self.pg3, tun_bm)
1502 gbd1.add_vpp_config()
1504 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1505 self.logger.info(self.vapi.cli("sh gbp bridge"))
1507 # ... and has a /32 applied
1508 ip_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
1509 ip_addr.add_vpp_config()
1512 # The Endpoint-group in which we are learning endpoints
1514 epg_220 = VppGbpEndpointGroup(self, 220, 112, rd1, gbd1,
1518 VppGbpEndpointRetention(2))
1519 epg_220.add_vpp_config()
1520 epg_330 = VppGbpEndpointGroup(self, 330, 113, rd1, gbd1,
1524 VppGbpEndpointRetention(2))
1525 epg_330.add_vpp_config()
1528 # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
1531 vx_tun_l2_1 = VppGbpVxlanTunnel(
1532 self, 99, bd1.bd_id,
1533 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L2,
1535 vx_tun_l2_1.add_vpp_config()
1538 # A static endpoint that the learnt endpoints are trying to
1541 ep = VppGbpEndpoint(self, self.pg0,
1543 "10.0.0.127", "11.0.0.127",
1544 "2001:10::1", "3001::1")
1547 self.assertTrue(find_route(self, ep.ip4.address, 32, table_id=1))
1549 # a packet with an sclass from an unknown EPG
1550 p = (Ether(src=self.pg2.remote_mac,
1551 dst=self.pg2.local_mac) /
1552 IP(src=self.pg2.remote_hosts[0].ip4,
1553 dst=self.pg2.local_ip4) /
1554 UDP(sport=1234, dport=48879) /
1555 VXLAN(vni=99, gpid=88, flags=0x88) /
1556 Ether(src=learnt[0]["mac"], dst=ep.mac) /
1557 IP(src=learnt[0]["ip"], dst=ep.ip4.address) /
1558 UDP(sport=1234, dport=1234) /
1561 self.send_and_assert_no_replies(self.pg2, p)
1564 # we should not have learnt a new tunnel endpoint, since
1565 # the EPG was not learnt.
1567 self.assertEqual(INDEX_INVALID,
1568 find_vxlan_gbp_tunnel(self,
1570 self.pg2.remote_hosts[0].ip4,
1573 # epg is not learnt, because the EPG is unknwon
1574 self.assertEqual(len(self.vapi.gbp_endpoint_dump()), 1)
1577 # Learn new EPs from IP packets
1579 for ii, l in enumerate(learnt):
1580 # a packet with an sclass from a known EPG
1581 # arriving on an unknown TEP
1582 p = (Ether(src=self.pg2.remote_mac,
1583 dst=self.pg2.local_mac) /
1584 IP(src=self.pg2.remote_hosts[1].ip4,
1585 dst=self.pg2.local_ip4) /
1586 UDP(sport=1234, dport=48879) /
1587 VXLAN(vni=99, gpid=112, flags=0x88) /
1588 Ether(src=l['mac'], dst=ep.mac) /
1589 IP(src=l['ip'], dst=ep.ip4.address) /
1590 UDP(sport=1234, dport=1234) /
1593 rx = self.send_and_expect(self.pg2, [p], self.pg0)
1596 tep1_sw_if_index = find_vxlan_gbp_tunnel(
1599 self.pg2.remote_hosts[1].ip4,
1601 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
1604 # the EP is learnt via the learnt TEP
1605 # both from its MAC and its IP
1607 self.assertTrue(find_gbp_endpoint(self,
1608 vx_tun_l2_1.sw_if_index,
1610 self.assertTrue(find_gbp_endpoint(self,
1611 vx_tun_l2_1.sw_if_index,
1614 self.logger.info(self.vapi.cli("show gbp endpoint"))
1615 self.logger.info(self.vapi.cli("show gbp vxlan"))
1616 self.logger.info(self.vapi.cli("show ip mfib"))
1619 # If we sleep for the threshold time, the learnt endpoints should
1623 self.wait_for_ep_timeout(vx_tun_l2_1.sw_if_index,
1627 # Learn new EPs from GARP packets received on the BD's mcast tunnel
1629 for ii, l in enumerate(learnt):
1630 # a packet with an sclass from a known EPG
1631 # arriving on an unknown TEP
1632 p = (Ether(src=self.pg2.remote_mac,
1633 dst=self.pg2.local_mac) /
1634 IP(src=self.pg2.remote_hosts[1].ip4,
1636 UDP(sport=1234, dport=48879) /
1637 VXLAN(vni=88, gpid=112, flags=0x88) /
1638 Ether(src=l['mac'], dst="ff:ff:ff:ff:ff:ff") /
1640 psrc=l['ip'], pdst=l['ip'],
1641 hwsrc=l['mac'], hwdst="ff:ff:ff:ff:ff:ff"))
1643 rx = self.send_and_expect(self.pg4, [p], self.pg0)
1646 tep1_sw_if_index = find_vxlan_gbp_tunnel(
1649 self.pg2.remote_hosts[1].ip4,
1651 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
1654 # the EP is learnt via the learnt TEP
1655 # both from its MAC and its IP
1657 self.assertTrue(find_gbp_endpoint(self,
1658 vx_tun_l2_1.sw_if_index,
1660 self.assertTrue(find_gbp_endpoint(self,
1661 vx_tun_l2_1.sw_if_index,
1665 # wait for the learnt endpoints to age out
1668 self.wait_for_ep_timeout(vx_tun_l2_1.sw_if_index,
1672 # Learn new EPs from L2 packets
1674 for ii, l in enumerate(learnt):
1675 # a packet with an sclass from a known EPG
1676 # arriving on an unknown TEP
1677 p = (Ether(src=self.pg2.remote_mac,
1678 dst=self.pg2.local_mac) /
1679 IP(src=self.pg2.remote_hosts[1].ip4,
1680 dst=self.pg2.local_ip4) /
1681 UDP(sport=1234, dport=48879) /
1682 VXLAN(vni=99, gpid=112, flags=0x88) /
1683 Ether(src=l['mac'], dst=ep.mac) /
1686 rx = self.send_and_expect(self.pg2, [p], self.pg0)
1689 tep1_sw_if_index = find_vxlan_gbp_tunnel(
1692 self.pg2.remote_hosts[1].ip4,
1694 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
1697 # the EP is learnt via the learnt TEP
1698 # both from its MAC and its IP
1700 self.assertTrue(find_gbp_endpoint(self,
1701 vx_tun_l2_1.sw_if_index,
1704 self.logger.info(self.vapi.cli("show gbp endpoint"))
1705 self.logger.info(self.vapi.cli("show gbp vxlan"))
1706 self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
1709 # wait for the learnt endpoints to age out
1712 self.wait_for_ep_timeout(vx_tun_l2_1.sw_if_index,
1716 # repeat. the do not learn bit is set so the EPs are not learnt
1719 # a packet with an sclass from a known EPG
1720 p = (Ether(src=self.pg2.remote_mac,
1721 dst=self.pg2.local_mac) /
1722 IP(src=self.pg2.remote_hosts[1].ip4,
1723 dst=self.pg2.local_ip4) /
1724 UDP(sport=1234, dport=48879) /
1725 VXLAN(vni=99, gpid=112, flags=0x88, gpflags="D") /
1726 Ether(src=l['mac'], dst=ep.mac) /
1727 IP(src=l['ip'], dst=ep.ip4.address) /
1728 UDP(sport=1234, dport=1234) /
1731 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1734 self.assertFalse(find_gbp_endpoint(self,
1735 vx_tun_l2_1.sw_if_index,
1742 # a packet with an sclass from a known EPG
1743 p = (Ether(src=self.pg2.remote_mac,
1744 dst=self.pg2.local_mac) /
1745 IP(src=self.pg2.remote_hosts[1].ip4,
1746 dst=self.pg2.local_ip4) /
1747 UDP(sport=1234, dport=48879) /
1748 VXLAN(vni=99, gpid=112, flags=0x88) /
1749 Ether(src=l['mac'], dst=ep.mac) /
1750 IP(src=l['ip'], dst=ep.ip4.address) /
1751 UDP(sport=1234, dport=1234) /
1754 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1756 self.assertTrue(find_gbp_endpoint(self,
1757 vx_tun_l2_1.sw_if_index,
1761 # Static EP replies to dynamics
1763 self.logger.info(self.vapi.cli("sh l2fib bd_id 1"))
1765 p = (Ether(src=ep.mac, dst=l['mac']) /
1766 IP(dst=l['ip'], src=ep.ip4.address) /
1767 UDP(sport=1234, dport=1234) /
1770 rxs = self.send_and_expect(self.pg0, p * 17, self.pg2)
1773 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
1774 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
1775 self.assertEqual(rx[UDP].dport, 48879)
1776 # the UDP source port is a random value for hashing
1777 self.assertEqual(rx[VXLAN].gpid, 112)
1778 self.assertEqual(rx[VXLAN].vni, 99)
1779 self.assertTrue(rx[VXLAN].flags.G)
1780 self.assertTrue(rx[VXLAN].flags.Instance)
1781 self.assertTrue(rx[VXLAN].gpflags.A)
1782 self.assertFalse(rx[VXLAN].gpflags.D)
1785 self.wait_for_ep_timeout(vx_tun_l2_1.sw_if_index,
1789 # repeat in the other EPG
1790 # there's no contract between 220 and 330, but the A-bit is set
1791 # so the packet is cleared for delivery
1794 # a packet with an sclass from a known EPG
1795 p = (Ether(src=self.pg2.remote_mac,
1796 dst=self.pg2.local_mac) /
1797 IP(src=self.pg2.remote_hosts[1].ip4,
1798 dst=self.pg2.local_ip4) /
1799 UDP(sport=1234, dport=48879) /
1800 VXLAN(vni=99, gpid=113, flags=0x88, gpflags='A') /
1801 Ether(src=l['mac'], dst=ep.mac) /
1802 IP(src=l['ip'], dst=ep.ip4.address) /
1803 UDP(sport=1234, dport=1234) /
1806 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1808 self.assertTrue(find_gbp_endpoint(self,
1809 vx_tun_l2_1.sw_if_index,
1813 # static EP cannot reach the learnt EPs since there is no contract
1814 # only test 1 EP as the others could timeout
1816 p = (Ether(src=ep.mac, dst=l['mac']) /
1817 IP(dst=learnt[0]['ip'], src=ep.ip4.address) /
1818 UDP(sport=1234, dport=1234) /
1821 self.send_and_assert_no_replies(self.pg0, [p])
1824 # refresh the entries after the check for no replies above
1827 # a packet with an sclass from a known EPG
1828 p = (Ether(src=self.pg2.remote_mac,
1829 dst=self.pg2.local_mac) /
1830 IP(src=self.pg2.remote_hosts[1].ip4,
1831 dst=self.pg2.local_ip4) /
1832 UDP(sport=1234, dport=48879) /
1833 VXLAN(vni=99, gpid=113, flags=0x88, gpflags='A') /
1834 Ether(src=l['mac'], dst=ep.mac) /
1835 IP(src=l['ip'], dst=ep.ip4.address) /
1836 UDP(sport=1234, dport=1234) /
1839 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1841 self.assertTrue(find_gbp_endpoint(self,
1842 vx_tun_l2_1.sw_if_index,
1846 # Add the contract so they can talk
1848 acl = VppGbpAcl(self)
1849 rule = acl.create_rule(permit_deny=1, proto=17)
1850 rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
1851 acl_index = acl.add_vpp_config([rule, rule2])
1852 c1 = VppGbpContract(
1853 self, epg_220.sclass, epg_330.sclass, acl_index,
1854 [VppGbpContractRule(
1855 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1858 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1860 [ETH_P_IP, ETH_P_IPV6])
1864 p = (Ether(src=ep.mac, dst=l['mac']) /
1865 IP(dst=l['ip'], src=ep.ip4.address) /
1866 UDP(sport=1234, dport=1234) /
1869 self.send_and_expect(self.pg0, [p], self.pg2)
1872 # send UU packets from the local EP
1874 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1875 self.logger.info(self.vapi.cli("sh gbp bridge"))
1876 p_uu = (Ether(src=ep.mac, dst="00:11:11:11:11:11") /
1877 IP(dst="10.0.0.133", src=ep.ip4.address) /
1878 UDP(sport=1234, dport=1234) /
1880 rxs = self.send_and_expect(ep.itf, [p_uu], gbd1.uu_fwd)
1882 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1884 p_bm = (Ether(src=ep.mac, dst="ff:ff:ff:ff:ff:ff") /
1885 IP(dst="10.0.0.133", src=ep.ip4.address) /
1886 UDP(sport=1234, dport=1234) /
1888 rxs = self.send_and_expect_only(ep.itf, [p_bm], tun_bm.mcast_itf)
1891 self.assertEqual(rx[IP].src, self.pg4.local_ip4)
1892 self.assertEqual(rx[IP].dst, "239.1.1.1")
1893 self.assertEqual(rx[UDP].dport, 48879)
1894 # the UDP source port is a random value for hashing
1895 self.assertEqual(rx[VXLAN].gpid, 112)
1896 self.assertEqual(rx[VXLAN].vni, 88)
1897 self.assertTrue(rx[VXLAN].flags.G)
1898 self.assertTrue(rx[VXLAN].flags.Instance)
1899 self.assertFalse(rx[VXLAN].gpflags.A)
1900 self.assertFalse(rx[VXLAN].gpflags.D)
1903 # Check v6 Endpoints
1906 # a packet with an sclass from a known EPG
1907 p = (Ether(src=self.pg2.remote_mac,
1908 dst=self.pg2.local_mac) /
1909 IP(src=self.pg2.remote_hosts[1].ip4,
1910 dst=self.pg2.local_ip4) /
1911 UDP(sport=1234, dport=48879) /
1912 VXLAN(vni=99, gpid=113, flags=0x88, gpflags='A') /
1913 Ether(src=l['mac'], dst=ep.mac) /
1914 IPv6(src=l['ip6'], dst=ep.ip6.address) /
1915 UDP(sport=1234, dport=1234) /
1918 rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1920 self.assertTrue(find_gbp_endpoint(self,
1921 vx_tun_l2_1.sw_if_index,
1925 # L3 Endpoint Learning
1926 # - configured on the bridge's BVI
1933 self.wait_for_ep_timeout(vx_tun_l2_1.sw_if_index,
1936 self.pg2.unconfig_ip4()
1937 self.pg3.unconfig_ip4()
1938 self.pg4.unconfig_ip4()
1940 self.logger.info(self.vapi.cli("sh int"))
1941 self.logger.info(self.vapi.cli("sh gbp vxlan"))
1943 def test_gbp_learn_vlan_l2(self):
1944 """ GBP L2 Endpoint w/ VLANs"""
1946 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1947 learnt = [{'mac': '00:00:11:11:11:01',
1949 'ip6': '2001:10::2'},
1950 {'mac': '00:00:11:11:11:02',
1952 'ip6': '2001:10::3'}]
1957 gt4 = VppIpTable(self, 1)
1958 gt4.add_vpp_config()
1959 gt6 = VppIpTable(self, 1, is_ip6=True)
1960 gt6.add_vpp_config()
1962 rd1 = VppGbpRouteDomain(self, 1, gt4, gt6)
1963 rd1.add_vpp_config()
1966 # Pg2 hosts the vxlan tunnel, hosts on pg2 to act as TEPs
1968 self.pg2.config_ip4()
1969 self.pg2.resolve_arp()
1970 self.pg2.generate_remote_hosts(4)
1971 self.pg2.configure_ipv4_neighbors()
1972 self.pg3.config_ip4()
1973 self.pg3.resolve_arp()
1976 # The EP will be on a vlan sub-interface
1978 vlan_11 = VppDot1QSubint(self, self.pg0, 11)
1980 self.vapi.l2_interface_vlan_tag_rewrite(
1981 sw_if_index=vlan_11.sw_if_index, vtr_op=L2_VTR_OP.L2_POP_1,
1984 bd_uu_fwd = VppVxlanGbpTunnel(self, self.pg3.local_ip4,
1985 self.pg3.remote_ip4, 116)
1986 bd_uu_fwd.add_vpp_config()
1989 # a GBP bridge domain with a BVI and a UU-flood interface
1990 # The BD is marked as do not learn, so no endpoints are ever
1991 # learnt in this BD.
1993 bd1 = VppBridgeDomain(self, 1)
1994 bd1.add_vpp_config()
1995 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, bd_uu_fwd,
1997 gbd1.add_vpp_config()
1999 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
2000 self.logger.info(self.vapi.cli("sh gbp bridge"))
2002 # ... and has a /32 applied
2003 ip_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2004 ip_addr.add_vpp_config()
2007 # The Endpoint-group in which we are learning endpoints
2009 epg_220 = VppGbpEndpointGroup(self, 220, 441, rd1, gbd1,
2013 VppGbpEndpointRetention(2))
2014 epg_220.add_vpp_config()
2017 # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
2020 vx_tun_l2_1 = VppGbpVxlanTunnel(
2021 self, 99, bd1.bd_id,
2022 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L2,
2024 vx_tun_l2_1.add_vpp_config()
2027 # A static endpoint that the learnt endpoints are trying to
2030 ep = VppGbpEndpoint(self, vlan_11,
2032 "10.0.0.127", "11.0.0.127",
2033 "2001:10::1", "3001::1")
2036 self.assertTrue(find_route(self, ep.ip4.address, 32, table_id=1))
2039 # Send to the static EP
2041 for ii, l in enumerate(learnt):
2042 # a packet with an sclass from a known EPG
2043 # arriving on an unknown TEP
2044 p = (Ether(src=self.pg2.remote_mac,
2045 dst=self.pg2.local_mac) /
2046 IP(src=self.pg2.remote_hosts[1].ip4,
2047 dst=self.pg2.local_ip4) /
2048 UDP(sport=1234, dport=48879) /
2049 VXLAN(vni=99, gpid=441, flags=0x88) /
2050 Ether(src=l['mac'], dst=ep.mac) /
2051 IP(src=l['ip'], dst=ep.ip4.address) /
2052 UDP(sport=1234, dport=1234) /
2055 rxs = self.send_and_expect(self.pg2, [p], self.pg0)
2058 # packet to EP has the EP's vlan tag
2061 self.assertEqual(rx[Dot1Q].vlan, 11)
2064 # the EP is not learnt since the BD setting prevents it
2067 self.assertFalse(find_gbp_endpoint(self,
2068 vx_tun_l2_1.sw_if_index,
2070 self.assertEqual(INDEX_INVALID,
2071 find_vxlan_gbp_tunnel(
2074 self.pg2.remote_hosts[1].ip4,
2077 self.assertEqual(len(self.vapi.gbp_endpoint_dump()), 1)
2081 # we didn't learn the remotes so they are sent to the UU-fwd
2084 p = (Ether(src=ep.mac, dst=l['mac']) /
2086 IP(dst=l['ip'], src=ep.ip4.address) /
2087 UDP(sport=1234, dport=1234) /
2090 rxs = self.send_and_expect(self.pg0, p * 17, self.pg3)
2093 self.assertEqual(rx[IP].src, self.pg3.local_ip4)
2094 self.assertEqual(rx[IP].dst, self.pg3.remote_ip4)
2095 self.assertEqual(rx[UDP].dport, 48879)
2096 # the UDP source port is a random value for hashing
2097 self.assertEqual(rx[VXLAN].gpid, 441)
2098 self.assertEqual(rx[VXLAN].vni, 116)
2099 self.assertTrue(rx[VXLAN].flags.G)
2100 self.assertTrue(rx[VXLAN].flags.Instance)
2101 self.assertFalse(rx[VXLAN].gpflags.A)
2102 self.assertFalse(rx[VXLAN].gpflags.D)
2104 self.pg2.unconfig_ip4()
2105 self.pg3.unconfig_ip4()
2107 def test_gbp_learn_l3(self):
2108 """ GBP L3 Endpoint Learning """
2110 self.vapi.cli("set logging class gbp debug")
2112 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
2113 routed_dst_mac = "00:0c:0c:0c:0c:0c"
2114 routed_src_mac = "00:22:bd:f8:19:ff"
2116 learnt = [{'mac': '00:00:11:11:11:02',
2118 'ip6': '2001:10::2'},
2119 {'mac': '00:00:11:11:11:03',
2121 'ip6': '2001:10::3'}]
2126 t4 = VppIpTable(self, 1)
2128 t6 = VppIpTable(self, 1, True)
2131 tun_ip4_uu = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
2132 self.pg4.remote_ip4, 114)
2133 tun_ip6_uu = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
2134 self.pg4.remote_ip4, 116)
2135 tun_ip4_uu.add_vpp_config()
2136 tun_ip6_uu.add_vpp_config()
2138 rd1 = VppGbpRouteDomain(self, 2, t4, t6, tun_ip4_uu, tun_ip6_uu)
2139 rd1.add_vpp_config()
2141 self.loop0.set_mac(self.router_mac)
2144 # Bind the BVI to the RD
2146 VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
2147 VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
2150 # Pg2 hosts the vxlan tunnel
2151 # hosts on pg2 to act as TEPs
2155 self.pg2.config_ip4()
2156 self.pg2.resolve_arp()
2157 self.pg2.generate_remote_hosts(4)
2158 self.pg2.configure_ipv4_neighbors()
2159 self.pg3.config_ip4()
2160 self.pg3.resolve_arp()
2161 self.pg4.config_ip4()
2162 self.pg4.resolve_arp()
2165 # a GBP bridge domain with a BVI and a UU-flood interface
2167 bd1 = VppBridgeDomain(self, 1)
2168 bd1.add_vpp_config()
2169 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, self.pg3)
2170 gbd1.add_vpp_config()
2172 self.logger.info(self.vapi.cli("sh bridge 1 detail"))
2173 self.logger.info(self.vapi.cli("sh gbp bridge"))
2174 self.logger.info(self.vapi.cli("sh gbp route"))
2176 # ... and has a /32 and /128 applied
2177 ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2178 ip4_addr.add_vpp_config()
2179 ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 128)
2180 ip6_addr.add_vpp_config()
2183 # The Endpoint-group in which we are learning endpoints
2185 epg_220 = VppGbpEndpointGroup(self, 220, 441, rd1, gbd1,
2189 VppGbpEndpointRetention(2))
2190 epg_220.add_vpp_config()
2193 # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
2196 vx_tun_l3 = VppGbpVxlanTunnel(
2197 self, 101, rd1.rd_id,
2198 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3,
2200 vx_tun_l3.add_vpp_config()
2203 # A static endpoint that the learnt endpoints are trying to
2206 ep = VppGbpEndpoint(self, self.pg0,
2208 "10.0.0.127", "11.0.0.127",
2209 "2001:10::1", "3001::1")
2213 # learn some remote IPv4 EPs
2215 for ii, l in enumerate(learnt):
2216 # a packet with an sclass from a known EPG
2217 # arriving on an unknown TEP
2218 p = (Ether(src=self.pg2.remote_mac,
2219 dst=self.pg2.local_mac) /
2220 IP(src=self.pg2.remote_hosts[1].ip4,
2221 dst=self.pg2.local_ip4) /
2222 UDP(sport=1234, dport=48879) /
2223 VXLAN(vni=101, gpid=441, flags=0x88) /
2224 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2225 IP(src=l['ip'], dst=ep.ip4.address) /
2226 UDP(sport=1234, dport=1234) /
2229 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2232 tep1_sw_if_index = find_vxlan_gbp_tunnel(
2235 self.pg2.remote_hosts[1].ip4,
2237 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2239 # endpoint learnt via the parent GBP-vxlan interface
2240 self.assertTrue(find_gbp_endpoint(self,
2241 vx_tun_l3._sw_if_index,
2245 # Static IPv4 EP replies to learnt
2248 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2249 IP(dst=l['ip'], src=ep.ip4.address) /
2250 UDP(sport=1234, dport=1234) /
2253 rxs = self.send_and_expect(self.pg0, p*1, self.pg2)
2256 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2257 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2258 self.assertEqual(rx[UDP].dport, 48879)
2259 # the UDP source port is a random value for hashing
2260 self.assertEqual(rx[VXLAN].gpid, 441)
2261 self.assertEqual(rx[VXLAN].vni, 101)
2262 self.assertTrue(rx[VXLAN].flags.G)
2263 self.assertTrue(rx[VXLAN].flags.Instance)
2264 self.assertTrue(rx[VXLAN].gpflags.A)
2265 self.assertFalse(rx[VXLAN].gpflags.D)
2267 inner = rx[VXLAN].payload
2269 self.assertEqual(inner[Ether].src, routed_src_mac)
2270 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2271 self.assertEqual(inner[IP].src, ep.ip4.address)
2272 self.assertEqual(inner[IP].dst, l['ip'])
2275 self.assertFalse(find_gbp_endpoint(self,
2280 # learn some remote IPv6 EPs
2282 for ii, l in enumerate(learnt):
2283 # a packet with an sclass from a known EPG
2284 # arriving on an unknown TEP
2285 p = (Ether(src=self.pg2.remote_mac,
2286 dst=self.pg2.local_mac) /
2287 IP(src=self.pg2.remote_hosts[1].ip4,
2288 dst=self.pg2.local_ip4) /
2289 UDP(sport=1234, dport=48879) /
2290 VXLAN(vni=101, gpid=441, flags=0x88) /
2291 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2292 IPv6(src=l['ip6'], dst=ep.ip6.address) /
2293 UDP(sport=1234, dport=1234) /
2296 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2299 tep1_sw_if_index = find_vxlan_gbp_tunnel(
2302 self.pg2.remote_hosts[1].ip4,
2304 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2306 self.logger.info(self.vapi.cli("show gbp bridge"))
2307 self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
2308 self.logger.info(self.vapi.cli("show gbp vxlan"))
2309 self.logger.info(self.vapi.cli("show int addr"))
2311 # endpoint learnt via the TEP
2312 self.assertTrue(find_gbp_endpoint(self, ip=l['ip6']))
2314 self.logger.info(self.vapi.cli("show gbp endpoint"))
2315 self.logger.info(self.vapi.cli("show ip fib index 1 %s" % l['ip']))
2318 # Static EP replies to learnt
2321 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2322 IPv6(dst=l['ip6'], src=ep.ip6.address) /
2323 UDP(sport=1234, dport=1234) /
2326 rxs = self.send_and_expect(self.pg0, p*65, self.pg2)
2329 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2330 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2331 self.assertEqual(rx[UDP].dport, 48879)
2332 # the UDP source port is a random value for hashing
2333 self.assertEqual(rx[VXLAN].gpid, 441)
2334 self.assertEqual(rx[VXLAN].vni, 101)
2335 self.assertTrue(rx[VXLAN].flags.G)
2336 self.assertTrue(rx[VXLAN].flags.Instance)
2337 self.assertTrue(rx[VXLAN].gpflags.A)
2338 self.assertFalse(rx[VXLAN].gpflags.D)
2340 inner = rx[VXLAN].payload
2342 self.assertEqual(inner[Ether].src, routed_src_mac)
2343 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2344 self.assertEqual(inner[IPv6].src, ep.ip6.address)
2345 self.assertEqual(inner[IPv6].dst, l['ip6'])
2347 self.logger.info(self.vapi.cli("sh gbp endpoint"))
2349 self.wait_for_ep_timeout(ip=l['ip'])
2352 # Static sends to unknown EP with no route
2354 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2355 IP(dst="10.0.0.99", src=ep.ip4.address) /
2356 UDP(sport=1234, dport=1234) /
2359 self.send_and_assert_no_replies(self.pg0, [p])
2362 # Add a route to static EP's v4 and v6 subnet
2363 # packets should be sent on the v4/v6 uu=fwd interface resp.
2365 se_10_24 = VppGbpSubnet(
2366 self, rd1, "10.0.0.0", 24,
2367 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_TRANSPORT)
2368 se_10_24.add_vpp_config()
2370 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2371 IP(dst="10.0.0.99", src=ep.ip4.address) /
2372 UDP(sport=1234, dport=1234) /
2375 rxs = self.send_and_expect(self.pg0, [p], self.pg4)
2377 self.assertEqual(rx[IP].src, self.pg4.local_ip4)
2378 self.assertEqual(rx[IP].dst, self.pg4.remote_ip4)
2379 self.assertEqual(rx[UDP].dport, 48879)
2380 # the UDP source port is a random value for hashing
2381 self.assertEqual(rx[VXLAN].gpid, 441)
2382 self.assertEqual(rx[VXLAN].vni, 114)
2383 self.assertTrue(rx[VXLAN].flags.G)
2384 self.assertTrue(rx[VXLAN].flags.Instance)
2385 # policy is not applied to packets sent to the uu-fwd interfaces
2386 self.assertFalse(rx[VXLAN].gpflags.A)
2387 self.assertFalse(rx[VXLAN].gpflags.D)
2390 # learn some remote IPv4 EPs
2392 for ii, l in enumerate(learnt):
2393 # a packet with an sclass from a known EPG
2394 # arriving on an unknown TEP
2395 p = (Ether(src=self.pg2.remote_mac,
2396 dst=self.pg2.local_mac) /
2397 IP(src=self.pg2.remote_hosts[2].ip4,
2398 dst=self.pg2.local_ip4) /
2399 UDP(sport=1234, dport=48879) /
2400 VXLAN(vni=101, gpid=441, flags=0x88) /
2401 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2402 IP(src=l['ip'], dst=ep.ip4.address) /
2403 UDP(sport=1234, dport=1234) /
2406 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2409 tep1_sw_if_index = find_vxlan_gbp_tunnel(
2412 self.pg2.remote_hosts[2].ip4,
2414 self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2416 # endpoint learnt via the parent GBP-vxlan interface
2417 self.assertTrue(find_gbp_endpoint(self,
2418 vx_tun_l3._sw_if_index,
2422 # Add a remote endpoint from the API
2424 rep_88 = VppGbpEndpoint(self, vx_tun_l3,
2426 "10.0.0.88", "11.0.0.88",
2427 "2001:10::88", "3001::88",
2428 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
2430 self.pg2.remote_hosts[1].ip4,
2432 rep_88.add_vpp_config()
2435 # Add a remote endpoint from the API that matches an existing one
2437 rep_2 = VppGbpEndpoint(self, vx_tun_l3,
2439 learnt[0]['ip'], "11.0.0.101",
2440 learnt[0]['ip6'], "3001::101",
2441 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
2443 self.pg2.remote_hosts[1].ip4,
2445 rep_2.add_vpp_config()
2448 # Add a route to the learned EP's v4 subnet
2449 # packets should be send on the v4/v6 uu=fwd interface resp.
2451 se_10_1_24 = VppGbpSubnet(
2452 self, rd1, "10.0.1.0", 24,
2453 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_TRANSPORT)
2454 se_10_1_24.add_vpp_config()
2456 self.logger.info(self.vapi.cli("show gbp endpoint"))
2458 ips = ["10.0.0.88", learnt[0]['ip']]
2460 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2461 IP(dst=ip, src=ep.ip4.address) /
2462 UDP(sport=1234, dport=1234) /
2465 rxs = self.send_and_expect(self.pg0, p*65, self.pg2)
2468 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2469 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2470 self.assertEqual(rx[UDP].dport, 48879)
2471 # the UDP source port is a random value for hashing
2472 self.assertEqual(rx[VXLAN].gpid, 441)
2473 self.assertEqual(rx[VXLAN].vni, 101)
2474 self.assertTrue(rx[VXLAN].flags.G)
2475 self.assertTrue(rx[VXLAN].flags.Instance)
2476 self.assertTrue(rx[VXLAN].gpflags.A)
2477 self.assertFalse(rx[VXLAN].gpflags.D)
2479 inner = rx[VXLAN].payload
2481 self.assertEqual(inner[Ether].src, routed_src_mac)
2482 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2483 self.assertEqual(inner[IP].src, ep.ip4.address)
2484 self.assertEqual(inner[IP].dst, ip)
2487 # remove the API remote EPs, only API sourced is gone, the DP
2488 # learnt one remains
2490 rep_88.remove_vpp_config()
2491 rep_2.remove_vpp_config()
2493 self.assertTrue(find_gbp_endpoint(self, ip=rep_2.ip4.address))
2495 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2496 IP(src=ep.ip4.address, dst=rep_2.ip4.address) /
2497 UDP(sport=1234, dport=1234) /
2499 rxs = self.send_and_expect(self.pg0, [p], self.pg2)
2501 self.assertFalse(find_gbp_endpoint(self, ip=rep_88.ip4.address))
2503 p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2504 IP(src=ep.ip4.address, dst=rep_88.ip4.address) /
2505 UDP(sport=1234, dport=1234) /
2507 rxs = self.send_and_expect(self.pg0, [p], self.pg4)
2510 # to appease the testcase we cannot have the registered EP still
2511 # present (because it's DP learnt) when the TC ends so wait until
2514 self.wait_for_ep_timeout(ip=rep_88.ip4.address)
2515 self.wait_for_ep_timeout(ip=rep_2.ip4.address)
2518 # shutdown with learnt endpoint present
2520 p = (Ether(src=self.pg2.remote_mac,
2521 dst=self.pg2.local_mac) /
2522 IP(src=self.pg2.remote_hosts[1].ip4,
2523 dst=self.pg2.local_ip4) /
2524 UDP(sport=1234, dport=48879) /
2525 VXLAN(vni=101, gpid=441, flags=0x88) /
2526 Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2527 IP(src=learnt[1]['ip'], dst=ep.ip4.address) /
2528 UDP(sport=1234, dport=1234) /
2531 rx = self.send_and_expect(self.pg2, [p], self.pg0)
2533 # endpoint learnt via the parent GBP-vxlan interface
2534 self.assertTrue(find_gbp_endpoint(self,
2535 vx_tun_l3._sw_if_index,
2540 # remote endpoint becomes local
2542 self.pg2.unconfig_ip4()
2543 self.pg3.unconfig_ip4()
2544 self.pg4.unconfig_ip4()
2546 def test_gbp_redirect(self):
2547 """ GBP Endpoint Redirect """
2549 self.vapi.cli("set logging class gbp debug")
2551 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
2552 routed_dst_mac = "00:0c:0c:0c:0c:0c"
2553 routed_src_mac = "00:22:bd:f8:19:ff"
2555 learnt = [{'mac': '00:00:11:11:11:02',
2557 'ip6': '2001:10::2'},
2558 {'mac': '00:00:11:11:11:03',
2560 'ip6': '2001:10::3'}]
2565 t4 = VppIpTable(self, 1)
2567 t6 = VppIpTable(self, 1, True)
2570 rd1 = VppGbpRouteDomain(self, 2, t4, t6)
2571 rd1.add_vpp_config()
2573 self.loop0.set_mac(self.router_mac)
2576 # Bind the BVI to the RD
2578 VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
2579 VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
2582 # Pg7 hosts a BD's UU-fwd
2584 self.pg7.config_ip4()
2585 self.pg7.resolve_arp()
2588 # a GBP bridge domains for the EPs
2590 bd1 = VppBridgeDomain(self, 1)
2591 bd1.add_vpp_config()
2592 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
2593 gbd1.add_vpp_config()
2595 bd2 = VppBridgeDomain(self, 2)
2596 bd2.add_vpp_config()
2597 gbd2 = VppGbpBridgeDomain(self, bd2, self.loop1)
2598 gbd2.add_vpp_config()
2600 # ... and has a /32 and /128 applied
2601 ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2602 ip4_addr.add_vpp_config()
2603 ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 128)
2604 ip6_addr.add_vpp_config()
2605 ip4_addr = VppIpInterfaceAddress(self, gbd2.bvi, "10.0.1.128", 32)
2606 ip4_addr.add_vpp_config()
2607 ip6_addr = VppIpInterfaceAddress(self, gbd2.bvi, "2001:11::128", 128)
2608 ip6_addr.add_vpp_config()
2611 # The Endpoint-groups in which we are learning endpoints
2613 epg_220 = VppGbpEndpointGroup(self, 220, 440, rd1, gbd1,
2617 VppGbpEndpointRetention(2))
2618 epg_220.add_vpp_config()
2619 epg_221 = VppGbpEndpointGroup(self, 221, 441, rd1, gbd2,
2623 VppGbpEndpointRetention(2))
2624 epg_221.add_vpp_config()
2625 epg_222 = VppGbpEndpointGroup(self, 222, 442, rd1, gbd1,
2629 VppGbpEndpointRetention(2))
2630 epg_222.add_vpp_config()
2633 # a GBP bridge domains for the SEPs
2635 bd_uu1 = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
2636 self.pg7.remote_ip4, 116)
2637 bd_uu1.add_vpp_config()
2638 bd_uu2 = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
2639 self.pg7.remote_ip4, 117)
2640 bd_uu2.add_vpp_config()
2642 bd3 = VppBridgeDomain(self, 3)
2643 bd3.add_vpp_config()
2644 gbd3 = VppGbpBridgeDomain(self, bd3, self.loop2, bd_uu1, learn=False)
2645 gbd3.add_vpp_config()
2646 bd4 = VppBridgeDomain(self, 4)
2647 bd4.add_vpp_config()
2648 gbd4 = VppGbpBridgeDomain(self, bd4, self.loop3, bd_uu2, learn=False)
2649 gbd4.add_vpp_config()
2652 # EPGs in which the service endpoints exist
2654 epg_320 = VppGbpEndpointGroup(self, 320, 550, rd1, gbd3,
2658 VppGbpEndpointRetention(2))
2659 epg_320.add_vpp_config()
2660 epg_321 = VppGbpEndpointGroup(self, 321, 551, rd1, gbd4,
2664 VppGbpEndpointRetention(2))
2665 epg_321.add_vpp_config()
2668 # three local endpoints
2670 ep1 = VppGbpEndpoint(self, self.pg0,
2672 "10.0.0.1", "11.0.0.1",
2673 "2001:10::1", "3001:10::1")
2674 ep1.add_vpp_config()
2675 ep2 = VppGbpEndpoint(self, self.pg1,
2677 "10.0.1.1", "11.0.1.1",
2678 "2001:11::1", "3001:11::1")
2679 ep2.add_vpp_config()
2680 ep3 = VppGbpEndpoint(self, self.pg2,
2682 "10.0.2.2", "11.0.2.2",
2683 "2001:12::1", "3001:12::1")
2684 ep3.add_vpp_config()
2689 sep1 = VppGbpEndpoint(self, self.pg3,
2691 "12.0.0.1", "13.0.0.1",
2692 "4001:10::1", "5001:10::1")
2693 sep1.add_vpp_config()
2694 sep2 = VppGbpEndpoint(self, self.pg4,
2696 "12.0.0.2", "13.0.0.2",
2697 "4001:10::2", "5001:10::2")
2698 sep2.add_vpp_config()
2699 sep3 = VppGbpEndpoint(self, self.pg5,
2701 "12.0.1.1", "13.0.1.1",
2702 "4001:11::1", "5001:11::1")
2703 sep3.add_vpp_config()
2704 # this EP is not installed immediately
2705 sep4 = VppGbpEndpoint(self, self.pg6,
2707 "12.0.1.2", "13.0.1.2",
2708 "4001:11::2", "5001:11::2")
2711 # an L2 switch packet between local EPs in different EPGs
2712 # different dest ports on each so the are LB hashed differently
2714 p4 = [(Ether(src=ep1.mac, dst=ep3.mac) /
2715 IP(src=ep1.ip4.address, dst=ep3.ip4.address) /
2716 UDP(sport=1234, dport=1234) /
2718 (Ether(src=ep3.mac, dst=ep1.mac) /
2719 IP(src=ep3.ip4.address, dst=ep1.ip4.address) /
2720 UDP(sport=1234, dport=1234) /
2722 p6 = [(Ether(src=ep1.mac, dst=ep3.mac) /
2723 IPv6(src=ep1.ip6.address, dst=ep3.ip6.address) /
2724 UDP(sport=1234, dport=1234) /
2726 (Ether(src=ep3.mac, dst=ep1.mac) /
2727 IPv6(src=ep3.ip6.address, dst=ep1.ip6.address) /
2728 UDP(sport=1234, dport=1230) /
2731 # should be dropped since no contract yet
2732 self.send_and_assert_no_replies(self.pg0, [p4[0]])
2733 self.send_and_assert_no_replies(self.pg0, [p6[0]])
2736 # Add a contract with a rule to load-balance redirect via SEP1 and SEP2
2737 # one of the next-hops is via an EP that is not known
2739 acl = VppGbpAcl(self)
2740 rule4 = acl.create_rule(permit_deny=1, proto=17)
2741 rule6 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
2742 acl_index = acl.add_vpp_config([rule4, rule6])
2745 # test the src-ip hash mode
2747 c1 = VppGbpContract(
2748 self, epg_220.sclass, epg_222.sclass, acl_index,
2749 [VppGbpContractRule(
2750 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2751 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2752 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2753 sep1.ip4, sep1.epg.rd),
2754 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2755 sep2.ip4, sep2.epg.rd)]),
2757 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2758 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2759 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2760 sep3.ip6, sep3.epg.rd),
2761 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2762 sep4.ip6, sep4.epg.rd)])],
2763 [ETH_P_IP, ETH_P_IPV6])
2766 c2 = VppGbpContract(
2767 self, epg_222.sclass, epg_220.sclass, acl_index,
2768 [VppGbpContractRule(
2769 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2770 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2771 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2772 sep1.ip4, sep1.epg.rd),
2773 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2774 sep2.ip4, sep2.epg.rd)]),
2776 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2777 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2778 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2779 sep3.ip6, sep3.epg.rd),
2780 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2781 sep4.ip6, sep4.epg.rd)])],
2782 [ETH_P_IP, ETH_P_IPV6])
2786 # send again with the contract preset, now packets arrive
2787 # at SEP1 or SEP2 depending on the hashing
2789 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2792 self.assertEqual(rx[Ether].src, routed_src_mac)
2793 self.assertEqual(rx[Ether].dst, sep1.mac)
2794 self.assertEqual(rx[IP].src, ep1.ip4.address)
2795 self.assertEqual(rx[IP].dst, ep3.ip4.address)
2797 rxs = self.send_and_expect(self.pg2, p4[1] * 17, sep2.itf)
2800 self.assertEqual(rx[Ether].src, routed_src_mac)
2801 self.assertEqual(rx[Ether].dst, sep2.mac)
2802 self.assertEqual(rx[IP].src, ep3.ip4.address)
2803 self.assertEqual(rx[IP].dst, ep1.ip4.address)
2805 rxs = self.send_and_expect(self.pg0, p6[0] * 17, self.pg7)
2808 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
2809 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
2810 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
2811 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
2812 self.assertEqual(rx[VXLAN].vni, 117)
2813 self.assertTrue(rx[VXLAN].flags.G)
2814 self.assertTrue(rx[VXLAN].flags.Instance)
2815 # redirect policy has been applied
2816 self.assertTrue(rx[VXLAN].gpflags.A)
2817 self.assertFalse(rx[VXLAN].gpflags.D)
2819 inner = rx[VXLAN].payload
2821 self.assertEqual(inner[Ether].src, routed_src_mac)
2822 self.assertEqual(inner[Ether].dst, sep4.mac)
2823 self.assertEqual(inner[IPv6].src, ep1.ip6.address)
2824 self.assertEqual(inner[IPv6].dst, ep3.ip6.address)
2826 rxs = self.send_and_expect(self.pg2, p6[1] * 17, sep3.itf)
2829 self.assertEqual(rx[Ether].src, routed_src_mac)
2830 self.assertEqual(rx[Ether].dst, sep3.mac)
2831 self.assertEqual(rx[IPv6].src, ep3.ip6.address)
2832 self.assertEqual(rx[IPv6].dst, ep1.ip6.address)
2835 # programme the unknown EP
2837 sep4.add_vpp_config()
2839 rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep4.itf)
2842 self.assertEqual(rx[Ether].src, routed_src_mac)
2843 self.assertEqual(rx[Ether].dst, sep4.mac)
2844 self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2845 self.assertEqual(rx[IPv6].dst, ep3.ip6.address)
2848 # and revert back to unprogrammed
2850 sep4.remove_vpp_config()
2852 rxs = self.send_and_expect(self.pg0, p6[0] * 17, self.pg7)
2855 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
2856 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
2857 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
2858 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
2859 self.assertEqual(rx[VXLAN].vni, 117)
2860 self.assertTrue(rx[VXLAN].flags.G)
2861 self.assertTrue(rx[VXLAN].flags.Instance)
2862 # redirect policy has been applied
2863 self.assertTrue(rx[VXLAN].gpflags.A)
2864 self.assertFalse(rx[VXLAN].gpflags.D)
2866 inner = rx[VXLAN].payload
2868 self.assertEqual(inner[Ether].src, routed_src_mac)
2869 self.assertEqual(inner[Ether].dst, sep4.mac)
2870 self.assertEqual(inner[IPv6].src, ep1.ip6.address)
2871 self.assertEqual(inner[IPv6].dst, ep3.ip6.address)
2873 c1.remove_vpp_config()
2874 c2.remove_vpp_config()
2877 # test the symmetric hash mode
2879 c1 = VppGbpContract(
2880 self, epg_220.sclass, epg_222.sclass, acl_index,
2881 [VppGbpContractRule(
2882 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2883 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2884 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2885 sep1.ip4, sep1.epg.rd),
2886 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2887 sep2.ip4, sep2.epg.rd)]),
2889 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2890 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2891 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2892 sep3.ip6, sep3.epg.rd),
2893 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2894 sep4.ip6, sep4.epg.rd)])],
2895 [ETH_P_IP, ETH_P_IPV6])
2898 c2 = VppGbpContract(
2899 self, epg_222.sclass, epg_220.sclass, acl_index,
2900 [VppGbpContractRule(
2901 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2902 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2903 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2904 sep1.ip4, sep1.epg.rd),
2905 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2906 sep2.ip4, sep2.epg.rd)]),
2908 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2909 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2910 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2911 sep3.ip6, sep3.epg.rd),
2912 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2913 sep4.ip6, sep4.epg.rd)])],
2914 [ETH_P_IP, ETH_P_IPV6])
2918 # send again with the contract preset, now packets arrive
2919 # at SEP1 for both directions
2921 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2924 self.assertEqual(rx[Ether].src, routed_src_mac)
2925 self.assertEqual(rx[Ether].dst, sep1.mac)
2926 self.assertEqual(rx[IP].src, ep1.ip4.address)
2927 self.assertEqual(rx[IP].dst, ep3.ip4.address)
2929 rxs = self.send_and_expect(self.pg2, p4[1] * 17, sep1.itf)
2932 self.assertEqual(rx[Ether].src, routed_src_mac)
2933 self.assertEqual(rx[Ether].dst, sep1.mac)
2934 self.assertEqual(rx[IP].src, ep3.ip4.address)
2935 self.assertEqual(rx[IP].dst, ep1.ip4.address)
2938 # programme the unknown EP for the L3 tests
2940 sep4.add_vpp_config()
2943 # an L3 switch packet between local EPs in different EPGs
2944 # different dest ports on each so the are LB hashed differently
2946 p4 = [(Ether(src=ep1.mac, dst=str(self.router_mac)) /
2947 IP(src=ep1.ip4.address, dst=ep2.ip4.address) /
2948 UDP(sport=1234, dport=1234) /
2950 (Ether(src=ep2.mac, dst=str(self.router_mac)) /
2951 IP(src=ep2.ip4.address, dst=ep1.ip4.address) /
2952 UDP(sport=1234, dport=1234) /
2954 p6 = [(Ether(src=ep1.mac, dst=str(self.router_mac)) /
2955 IPv6(src=ep1.ip6.address, dst=ep2.ip6.address) /
2956 UDP(sport=1234, dport=1234) /
2958 (Ether(src=ep2.mac, dst=str(self.router_mac)) /
2959 IPv6(src=ep2.ip6.address, dst=ep1.ip6.address) /
2960 UDP(sport=1234, dport=1234) /
2963 c3 = VppGbpContract(
2964 self, epg_220.sclass, epg_221.sclass, acl_index,
2965 [VppGbpContractRule(
2966 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2967 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2968 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2969 sep1.ip4, sep1.epg.rd),
2970 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2971 sep2.ip4, sep2.epg.rd)]),
2973 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2974 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2975 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2976 sep3.ip6, sep3.epg.rd),
2977 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2978 sep4.ip6, sep4.epg.rd)])],
2979 [ETH_P_IP, ETH_P_IPV6])
2982 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2985 self.assertEqual(rx[Ether].src, routed_src_mac)
2986 self.assertEqual(rx[Ether].dst, sep1.mac)
2987 self.assertEqual(rx[IP].src, ep1.ip4.address)
2988 self.assertEqual(rx[IP].dst, ep2.ip4.address)
2991 # learn a remote EP in EPG 221
2993 vx_tun_l3 = VppGbpVxlanTunnel(
2994 self, 444, rd1.rd_id,
2995 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3,
2997 vx_tun_l3.add_vpp_config()
2999 c4 = VppGbpContract(
3000 self, epg_221.sclass, epg_220.sclass, acl_index,
3001 [VppGbpContractRule(
3002 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3005 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3007 [ETH_P_IP, ETH_P_IPV6])
3010 p = (Ether(src=self.pg7.remote_mac,
3011 dst=self.pg7.local_mac) /
3012 IP(src=self.pg7.remote_ip4,
3013 dst=self.pg7.local_ip4) /
3014 UDP(sport=1234, dport=48879) /
3015 VXLAN(vni=444, gpid=441, flags=0x88) /
3016 Ether(src="00:22:22:22:22:33", dst=str(self.router_mac)) /
3017 IP(src="10.0.0.88", dst=ep1.ip4.address) /
3018 UDP(sport=1234, dport=1234) /
3021 rx = self.send_and_expect(self.pg7, [p], self.pg0)
3023 # endpoint learnt via the parent GBP-vxlan interface
3024 self.assertTrue(find_gbp_endpoint(self,
3025 vx_tun_l3._sw_if_index,
3028 p = (Ether(src=self.pg7.remote_mac,
3029 dst=self.pg7.local_mac) /
3030 IP(src=self.pg7.remote_ip4,
3031 dst=self.pg7.local_ip4) /
3032 UDP(sport=1234, dport=48879) /
3033 VXLAN(vni=444, gpid=441, flags=0x88) /
3034 Ether(src="00:22:22:22:22:33", dst=str(self.router_mac)) /
3035 IPv6(src="2001:10::88", dst=ep1.ip6.address) /
3036 UDP(sport=1234, dport=1234) /
3039 rx = self.send_and_expect(self.pg7, [p], self.pg0)
3041 # endpoint learnt via the parent GBP-vxlan interface
3042 self.assertTrue(find_gbp_endpoint(self,
3043 vx_tun_l3._sw_if_index,
3047 # L3 switch from local to remote EP
3049 p4 = [(Ether(src=ep1.mac, dst=str(self.router_mac)) /
3050 IP(src=ep1.ip4.address, dst="10.0.0.88") /
3051 UDP(sport=1234, dport=1234) /
3053 p6 = [(Ether(src=ep1.mac, dst=str(self.router_mac)) /
3054 IPv6(src=ep1.ip6.address, dst="2001:10::88") /
3055 UDP(sport=1234, dport=1234) /
3058 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
3061 self.assertEqual(rx[Ether].src, routed_src_mac)
3062 self.assertEqual(rx[Ether].dst, sep1.mac)
3063 self.assertEqual(rx[IP].src, ep1.ip4.address)
3064 self.assertEqual(rx[IP].dst, "10.0.0.88")
3066 rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep4.itf)
3069 self.assertEqual(rx[Ether].src, routed_src_mac)
3070 self.assertEqual(rx[Ether].dst, sep4.mac)
3071 self.assertEqual(rx[IPv6].src, ep1.ip6.address)
3072 self.assertEqual(rx[IPv6].dst, "2001:10::88")
3075 # test the dst-ip hash mode
3077 c5 = VppGbpContract(
3078 self, epg_220.sclass, epg_221.sclass, acl_index,
3079 [VppGbpContractRule(
3080 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
3081 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_DST_IP,
3082 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
3083 sep1.ip4, sep1.epg.rd),
3084 VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
3085 sep2.ip4, sep2.epg.rd)]),
3087 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
3088 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_DST_IP,
3089 [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
3090 sep3.ip6, sep3.epg.rd),
3091 VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
3092 sep4.ip6, sep4.epg.rd)])],
3093 [ETH_P_IP, ETH_P_IPV6])
3096 rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
3099 self.assertEqual(rx[Ether].src, routed_src_mac)
3100 self.assertEqual(rx[Ether].dst, sep1.mac)
3101 self.assertEqual(rx[IP].src, ep1.ip4.address)
3102 self.assertEqual(rx[IP].dst, "10.0.0.88")
3104 rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep3.itf)
3107 self.assertEqual(rx[Ether].src, routed_src_mac)
3108 self.assertEqual(rx[Ether].dst, sep3.mac)
3109 self.assertEqual(rx[IPv6].src, ep1.ip6.address)
3110 self.assertEqual(rx[IPv6].dst, "2001:10::88")
3115 self.pg7.unconfig_ip4()
3117 def test_gbp_l3_out(self):
3120 ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
3121 self.vapi.cli("set logging class gbp debug")
3123 routed_dst_mac = "00:0c:0c:0c:0c:0c"
3124 routed_src_mac = "00:22:bd:f8:19:ff"
3129 t4 = VppIpTable(self, 1)
3131 t6 = VppIpTable(self, 1, True)
3134 rd1 = VppGbpRouteDomain(self, 2, t4, t6)
3135 rd1.add_vpp_config()
3137 self.loop0.set_mac(self.router_mac)
3140 # Bind the BVI to the RD
3142 VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
3143 VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
3146 # Pg7 hosts a BD's BUM
3147 # Pg1 some other l3 interface
3149 self.pg7.config_ip4()
3150 self.pg7.resolve_arp()
3153 # a multicast vxlan-gbp tunnel for broadcast in the BD
3155 tun_bm = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
3158 tun_bm.add_vpp_config()
3161 # a GBP external bridge domains for the EPs
3163 bd1 = VppBridgeDomain(self, 1)
3164 bd1.add_vpp_config()
3165 gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, None, tun_bm)
3166 gbd1.add_vpp_config()
3169 # The Endpoint-groups in which the external endpoints exist
3171 epg_220 = VppGbpEndpointGroup(self, 220, 113, rd1, gbd1,
3175 VppGbpEndpointRetention(2))
3176 epg_220.add_vpp_config()
3178 # the BVIs have the subnets applied ...
3179 ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 24)
3180 ip4_addr.add_vpp_config()
3181 ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 64)
3182 ip6_addr.add_vpp_config()
3184 # ... which are L3-out subnets
3185 l3o_1 = VppGbpSubnet(
3186 self, rd1, "10.0.0.0", 24,
3187 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3189 l3o_1.add_vpp_config()
3192 # an external interface attached to the outside world and the
3195 vlan_100 = VppDot1QSubint(self, self.pg0, 100)
3197 VppL2Vtr(self, vlan_100, L2_VTR_OP.L2_POP_1).add_vpp_config()
3198 vlan_101 = VppDot1QSubint(self, self.pg0, 101)
3200 VppL2Vtr(self, vlan_101, L2_VTR_OP.L2_POP_1).add_vpp_config()
3202 ext_itf = VppGbpExtItf(self, self.loop0, bd1, rd1)
3203 ext_itf.add_vpp_config()
3206 # an unicast vxlan-gbp for inter-RD traffic
3208 vx_tun_l3 = VppGbpVxlanTunnel(
3209 self, 444, rd1.rd_id,
3210 VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3,
3212 vx_tun_l3.add_vpp_config()
3215 # External Endpoints
3217 eep1 = VppGbpEndpoint(self, vlan_100,
3219 "10.0.0.1", "11.0.0.1",
3220 "2001:10::1", "3001::1",
3221 ep_flags.GBP_API_ENDPOINT_FLAG_EXTERNAL)
3222 eep1.add_vpp_config()
3223 eep2 = VppGbpEndpoint(self, vlan_101,
3225 "10.0.0.2", "11.0.0.2",
3226 "2001:10::2", "3001::2",
3227 ep_flags.GBP_API_ENDPOINT_FLAG_EXTERNAL)
3228 eep2.add_vpp_config()
3231 # A remote external endpoint
3233 rep = VppGbpEndpoint(self, vx_tun_l3,
3235 "10.0.0.101", "11.0.0.101",
3236 "2001:10::101", "3001::101",
3237 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
3239 self.pg7.remote_ip4,
3241 rep.add_vpp_config()
3244 # ARP packet from External EPs are accepted and replied to
3246 p_arp = (Ether(src=eep1.mac, dst="ff:ff:ff:ff:ff:ff") /
3249 psrc=eep1.ip4.address, pdst="10.0.0.128",
3250 hwsrc=eep1.mac, hwdst="ff:ff:ff:ff:ff:ff"))
3251 rxs = self.send_and_expect(self.pg0, p_arp * 1, self.pg0)
3254 # packets destined to unknown addresses in the BVI's subnet
3257 p4 = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3259 IP(src="10.0.0.1", dst="10.0.0.88") /
3260 UDP(sport=1234, dport=1234) /
3262 p6 = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3264 IPv6(src="2001:10::1", dst="2001:10::88") /
3265 UDP(sport=1234, dport=1234) /
3268 rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3271 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3272 # self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3273 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3274 self.assertEqual(rx[IP].dst, "239.1.1.1")
3275 self.assertEqual(rx[VXLAN].vni, 88)
3276 self.assertTrue(rx[VXLAN].flags.G)
3277 self.assertTrue(rx[VXLAN].flags.Instance)
3278 # policy was applied to the original IP packet
3279 self.assertEqual(rx[VXLAN].gpid, 113)
3280 self.assertTrue(rx[VXLAN].gpflags.A)
3281 self.assertFalse(rx[VXLAN].gpflags.D)
3283 inner = rx[VXLAN].payload
3285 self.assertTrue(inner.haslayer(ARP))
3288 # remote to external
3290 p = (Ether(src=self.pg7.remote_mac,
3291 dst=self.pg7.local_mac) /
3292 IP(src=self.pg7.remote_ip4,
3293 dst=self.pg7.local_ip4) /
3294 UDP(sport=1234, dport=48879) /
3295 VXLAN(vni=444, gpid=113, flags=0x88) /
3296 Ether(src=self.pg0.remote_mac, dst=str(self.router_mac)) /
3297 IP(src="10.0.0.101", dst="10.0.0.1") /
3298 UDP(sport=1234, dport=1234) /
3301 rxs = self.send_and_expect(self.pg7, p * 1, self.pg0)
3304 # local EP pings router
3306 p = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3308 IP(src=eep1.ip4.address, dst="10.0.0.128") /
3309 ICMP(type='echo-request'))
3311 rxs = self.send_and_expect(self.pg0, p * 1, self.pg0)
3314 self.assertEqual(rx[Ether].src, str(self.router_mac))
3315 self.assertEqual(rx[Ether].dst, eep1.mac)
3316 self.assertEqual(rx[Dot1Q].vlan, 100)
3319 # local EP pings other local EP
3321 p = (Ether(src=eep1.mac, dst=eep2.mac) /
3323 IP(src=eep1.ip4.address, dst=eep2.ip4.address) /
3324 ICMP(type='echo-request'))
3326 rxs = self.send_and_expect(self.pg0, p * 1, self.pg0)
3329 self.assertEqual(rx[Ether].src, eep1.mac)
3330 self.assertEqual(rx[Ether].dst, eep2.mac)
3331 self.assertEqual(rx[Dot1Q].vlan, 101)
3334 # A subnet reachable through the external EP1
3336 ip_220 = VppIpRoute(self, "10.220.0.0", 24,
3337 [VppRoutePath(eep1.ip4.address,
3338 eep1.epg.bvi.sw_if_index)],
3339 table_id=t4.table_id)
3340 ip_220.add_vpp_config()
3342 l3o_220 = VppGbpSubnet(
3343 self, rd1, "10.220.0.0", 24,
3344 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3346 l3o_220.add_vpp_config()
3349 # A subnet reachable through the external EP2
3351 ip_221 = VppIpRoute(self, "10.221.0.0", 24,
3352 [VppRoutePath(eep2.ip4.address,
3353 eep2.epg.bvi.sw_if_index)],
3354 table_id=t4.table_id)
3355 ip_221.add_vpp_config()
3357 l3o_221 = VppGbpSubnet(
3358 self, rd1, "10.221.0.0", 24,
3359 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3361 l3o_221.add_vpp_config()
3364 # ping between hosts in remote subnets
3365 # dropped without a contract
3367 p = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3369 IP(src="10.220.0.1", dst="10.221.0.1") /
3370 ICMP(type='echo-request'))
3372 rxs = self.send_and_assert_no_replies(self.pg0, p * 1)
3375 # contract for the external nets to communicate
3377 acl = VppGbpAcl(self)
3378 rule4 = acl.create_rule(permit_deny=1, proto=17)
3379 rule6 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
3380 acl_index = acl.add_vpp_config([rule4, rule6])
3382 c1 = VppGbpContract(
3383 self, 4220, 4221, acl_index,
3384 [VppGbpContractRule(
3385 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3388 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3390 [ETH_P_IP, ETH_P_IPV6])
3394 # Contracts allowing ext-net 200 to talk with external EPs
3396 c2 = VppGbpContract(
3397 self, 4220, 113, acl_index,
3398 [VppGbpContractRule(
3399 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3402 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3404 [ETH_P_IP, ETH_P_IPV6])
3406 c3 = VppGbpContract(
3407 self, 113, 4220, acl_index,
3408 [VppGbpContractRule(
3409 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3412 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3414 [ETH_P_IP, ETH_P_IPV6])
3418 # ping between hosts in remote subnets
3420 p = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3422 IP(src="10.220.0.1", dst="10.221.0.1") /
3423 UDP(sport=1234, dport=1234) /
3426 rxs = self.send_and_expect(self.pg0, p * 1, self.pg0)
3429 self.assertEqual(rx[Ether].src, str(self.router_mac))
3430 self.assertEqual(rx[Ether].dst, eep2.mac)
3431 self.assertEqual(rx[Dot1Q].vlan, 101)
3433 # we did not learn these external hosts
3434 self.assertFalse(find_gbp_endpoint(self, ip="10.220.0.1"))
3435 self.assertFalse(find_gbp_endpoint(self, ip="10.221.0.1"))
3438 # from remote external EP to local external EP
3440 p = (Ether(src=self.pg7.remote_mac,
3441 dst=self.pg7.local_mac) /
3442 IP(src=self.pg7.remote_ip4,
3443 dst=self.pg7.local_ip4) /
3444 UDP(sport=1234, dport=48879) /
3445 VXLAN(vni=444, gpid=113, flags=0x88) /
3446 Ether(src=self.pg0.remote_mac, dst=str(self.router_mac)) /
3447 IP(src="10.0.0.101", dst="10.220.0.1") /
3448 UDP(sport=1234, dport=1234) /
3451 rxs = self.send_and_expect(self.pg7, p * 1, self.pg0)
3454 # ping from an external host to the remote external EP
3456 p = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3458 IP(src="10.220.0.1", dst=rep.ip4.address) /
3459 UDP(sport=1234, dport=1234) /
3462 rxs = self.send_and_expect(self.pg0, p * 1, self.pg7)
3465 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3466 # self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3467 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3468 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
3469 self.assertEqual(rx[VXLAN].vni, 444)
3470 self.assertTrue(rx[VXLAN].flags.G)
3471 self.assertTrue(rx[VXLAN].flags.Instance)
3472 # the sclass of the ext-net the packet came from
3473 self.assertEqual(rx[VXLAN].gpid, 4220)
3474 # policy was applied to the original IP packet
3475 self.assertTrue(rx[VXLAN].gpflags.A)
3476 # since it's an external host the reciever should not learn it
3477 self.assertTrue(rx[VXLAN].gpflags.D)
3478 inner = rx[VXLAN].payload
3479 self.assertEqual(inner[IP].src, "10.220.0.1")
3480 self.assertEqual(inner[IP].dst, rep.ip4.address)
3483 # An external subnet reachable via the remote external EP
3487 # first the VXLAN-GBP tunnel over which it is reached
3489 vx_tun_r = VppVxlanGbpTunnel(
3490 self, self.pg7.local_ip4,
3491 self.pg7.remote_ip4, 445,
3492 mode=(VppEnum.vl_api_vxlan_gbp_api_tunnel_mode_t.
3493 VXLAN_GBP_API_TUNNEL_MODE_L3))
3494 vx_tun_r.add_vpp_config()
3495 VppIpInterfaceBind(self, vx_tun_r, t4).add_vpp_config()
3497 self.logger.info(self.vapi.cli("sh vxlan-gbp tunnel"))
3500 # then the special adj to resolve through on that tunnel
3502 n1 = VppNeighbor(self,
3503 vx_tun_r.sw_if_index,
3504 "00:0c:0c:0c:0c:0c",
3505 self.pg7.remote_ip4)
3509 # the route via the adj above
3511 ip_222 = VppIpRoute(self, "10.222.0.0", 24,
3512 [VppRoutePath(self.pg7.remote_ip4,
3513 vx_tun_r.sw_if_index)],
3514 table_id=t4.table_id)
3515 ip_222.add_vpp_config()
3517 l3o_222 = VppGbpSubnet(
3518 self, rd1, "10.222.0.0", 24,
3519 VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3521 l3o_222.add_vpp_config()
3524 # ping between hosts in local and remote external subnets
3525 # dropped without a contract
3527 p = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3529 IP(src="10.220.0.1", dst="10.222.0.1") /
3530 UDP(sport=1234, dport=1234) /
3533 rxs = self.send_and_assert_no_replies(self.pg0, p * 1)
3536 # Add contracts ext-nets for 220 -> 222
3538 c4 = VppGbpContract(
3539 self, 4220, 4222, acl_index,
3540 [VppGbpContractRule(
3541 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3544 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3546 [ETH_P_IP, ETH_P_IPV6])
3550 # ping from host in local to remote external subnets
3552 p = (Ether(src=eep1.mac, dst=str(self.router_mac)) /
3554 IP(src="10.220.0.1", dst="10.222.0.1") /
3555 UDP(sport=1234, dport=1234) /
3558 rxs = self.send_and_expect(self.pg0, p * 3, self.pg7)
3561 self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3562 self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3563 self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3564 self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
3565 self.assertEqual(rx[VXLAN].vni, 445)
3566 self.assertTrue(rx[VXLAN].flags.G)
3567 self.assertTrue(rx[VXLAN].flags.Instance)
3568 # the sclass of the ext-net the packet came from
3569 self.assertEqual(rx[VXLAN].gpid, 4220)
3570 # policy was applied to the original IP packet
3571 self.assertTrue(rx[VXLAN].gpflags.A)
3572 # since it's an external host the reciever should not learn it
3573 self.assertTrue(rx[VXLAN].gpflags.D)
3574 inner = rx[VXLAN].payload
3575 self.assertEqual(inner[Ether].dst, "00:0c:0c:0c:0c:0c")
3576 self.assertEqual(inner[IP].src, "10.220.0.1")
3577 self.assertEqual(inner[IP].dst, "10.222.0.1")
3580 # ping from host in remote to local external subnets
3581 # there's no contract for this, but the A bit is set.
3583 p = (Ether(src=self.pg7.remote_mac, dst=self.pg7.local_mac) /
3584 IP(src=self.pg7.remote_ip4, dst=self.pg7.local_ip4) /
3585 UDP(sport=1234, dport=48879) /
3586 VXLAN(vni=445, gpid=4222, flags=0x88, gpflags='A') /
3587 Ether(src=self.pg0.remote_mac, dst=str(self.router_mac)) /
3588 IP(src="10.222.0.1", dst="10.220.0.1") /
3589 UDP(sport=1234, dport=1234) /
3592 rxs = self.send_and_expect(self.pg7, p * 3, self.pg0)
3593 self.assertFalse(find_gbp_endpoint(self, ip="10.222.0.1"))
3598 self.pg7.unconfig_ip4()
3599 vlan_100.set_vtr(L2_VTR_OP.L2_DISABLED)
3602 if __name__ == '__main__':
3603 unittest.main(testRunner=VppTestRunner)