4 from socket import AF_INET6
6 from framework import VppTestCase, VppTestRunner
7 from vpp_sub_interface import VppSubInterface, VppDot1QSubint
8 from vpp_pg_interface import is_ipv6_misc
9 from vpp_ip_route import VppIpRoute, VppRoutePath, find_route
10 from vpp_neighbor import find_nbr, VppNeighbor
12 from scapy.packet import Raw
13 from scapy.layers.l2 import Ether, Dot1Q
14 from scapy.layers.inet6 import IPv6, UDP, ICMPv6ND_NS, ICMPv6ND_RS, \
15 ICMPv6ND_RA, ICMPv6NDOptSrcLLAddr, getmacbyip6, ICMPv6MRD_Solicitation, \
16 ICMPv6NDOptMTU, ICMPv6NDOptSrcLLAddr, ICMPv6NDOptPrefixInfo, \
17 ICMPv6ND_NA, ICMPv6NDOptDstLLAddr, ICMPv6DestUnreach, icmp6types
20 from scapy.utils6 import in6_getnsma, in6_getnsmac, in6_ptop, in6_islladdr, \
21 in6_mactoifaceid, in6_ismaddr
22 from scapy.utils import inet_pton, inet_ntop
26 euid = in6_mactoifaceid(mac)
27 addr = "fe80::" + euid
31 class TestIPv6ND(VppTestCase):
32 def validate_ra(self, intf, rx, dst_ip=None):
34 dst_ip = intf.remote_ip6
36 # unicasted packets must come to the unicast mac
37 self.assertEqual(rx[Ether].dst, intf.remote_mac)
39 # and from the router's MAC
40 self.assertEqual(rx[Ether].src, intf.local_mac)
42 # the rx'd RA should be addressed to the sender's source
43 self.assertTrue(rx.haslayer(ICMPv6ND_RA))
44 self.assertEqual(in6_ptop(rx[IPv6].dst),
47 # and come from the router's link local
48 self.assertTrue(in6_islladdr(rx[IPv6].src))
49 self.assertEqual(in6_ptop(rx[IPv6].src),
50 in6_ptop(mk_ll_addr(intf.local_mac)))
52 def validate_na(self, intf, rx, dst_ip=None, tgt_ip=None):
54 dst_ip = intf.remote_ip6
56 dst_ip = intf.local_ip6
58 # unicasted packets must come to the unicast mac
59 self.assertEqual(rx[Ether].dst, intf.remote_mac)
61 # and from the router's MAC
62 self.assertEqual(rx[Ether].src, intf.local_mac)
64 # the rx'd NA should be addressed to the sender's source
65 self.assertTrue(rx.haslayer(ICMPv6ND_NA))
66 self.assertEqual(in6_ptop(rx[IPv6].dst),
69 # and come from the target address
70 self.assertEqual(in6_ptop(rx[IPv6].src), in6_ptop(tgt_ip))
72 # Dest link-layer options should have the router's MAC
73 dll = rx[ICMPv6NDOptDstLLAddr]
74 self.assertEqual(dll.lladdr, intf.local_mac)
76 def send_and_expect_ra(self, intf, pkts, remark, dst_ip=None,
77 filter_out_fn=is_ipv6_misc):
79 self.pg0.add_stream(pkts)
80 self.pg_enable_capture(self.pg_interfaces)
82 rx = intf.get_capture(1, filter_out_fn=filter_out_fn)
84 self.assertEqual(len(rx), 1)
86 self.validate_ra(intf, rx, dst_ip)
88 def send_and_assert_no_replies(self, intf, pkts, remark):
90 self.pg_enable_capture(self.pg_interfaces)
92 intf.assert_nothing_captured(remark=remark)
95 class TestIPv6(TestIPv6ND):
96 """ IPv6 Test Case """
100 super(TestIPv6, cls).setUpClass()
104 Perform test setup before test case.
107 - create 3 pg interfaces
108 - untagged pg0 interface
109 - Dot1Q subinterface on pg1
110 - Dot1AD subinterface on pg2
112 - put it into UP state
114 - resolve neighbor address using NDP
115 - configure 200 fib entries
117 :ivar list interfaces: pg interfaces and subinterfaces.
118 :ivar dict flows: IPv4 packet flows in test.
119 :ivar list pg_if_packet_sizes: packet sizes in test.
121 *TODO:* Create AD sub interface
123 super(TestIPv6, self).setUp()
125 # create 3 pg interfaces
126 self.create_pg_interfaces(range(3))
128 # create 2 subinterfaces for p1 and pg2
129 self.sub_interfaces = [
130 VppDot1QSubint(self, self.pg1, 100),
131 VppDot1QSubint(self, self.pg2, 200)
132 # TODO: VppDot1ADSubint(self, self.pg2, 200, 300, 400)
135 # packet flows mapping pg0 -> pg1.sub, pg2.sub, etc.
137 self.flows[self.pg0] = [self.pg1.sub_if, self.pg2.sub_if]
138 self.flows[self.pg1.sub_if] = [self.pg0, self.pg2.sub_if]
139 self.flows[self.pg2.sub_if] = [self.pg0, self.pg1.sub_if]
142 self.pg_if_packet_sizes = [64, 512, 1518, 9018]
143 self.sub_if_packet_sizes = [64, 512, 1518 + 4, 9018 + 4]
145 self.interfaces = list(self.pg_interfaces)
146 self.interfaces.extend(self.sub_interfaces)
148 # setup all interfaces
149 for i in self.interfaces:
154 # config 2M FIB entries
155 self.config_fib_entries(200)
158 """Run standard test teardown and log ``show ip6 neighbors``."""
159 for i in self.sub_interfaces:
163 i.remove_vpp_config()
165 super(TestIPv6, self).tearDown()
166 if not self.vpp_dead:
167 self.logger.info(self.vapi.cli("show ip6 neighbors"))
168 # info(self.vapi.cli("show ip6 fib")) # many entries
170 def config_fib_entries(self, count):
171 """For each interface add to the FIB table *count* routes to
172 "fd02::1/128" destination with interface's local address as next-hop
175 :param int count: Number of FIB entries.
177 - *TODO:* check if the next-hop address shouldn't be remote address
178 instead of local address.
180 n_int = len(self.interfaces)
183 dest_addr = inet_pton(AF_INET6, "fd02::1")
185 for i in self.interfaces:
186 next_hop_address = i.local_ip6n
187 for j in range(count / n_int):
188 self.vapi.ip_add_del_route(
189 dest_addr, dest_addr_len, next_hop_address, is_ipv6=1)
191 if counter / count * 100 > percent:
192 self.logger.info("Configure %d FIB entries .. %d%% done" %
196 def create_stream(self, src_if, packet_sizes):
197 """Create input packet stream for defined interface.
199 :param VppInterface src_if: Interface to create packet stream for.
200 :param list packet_sizes: Required packet sizes.
203 for i in range(0, 257):
204 dst_if = self.flows[src_if][i % 2]
205 info = self.create_packet_info(src_if, dst_if)
206 payload = self.info_to_payload(info)
207 p = (Ether(dst=src_if.local_mac, src=src_if.remote_mac) /
208 IPv6(src=src_if.remote_ip6, dst=dst_if.remote_ip6) /
209 UDP(sport=1234, dport=1234) /
212 if isinstance(src_if, VppSubInterface):
213 p = src_if.add_dot1_layer(p)
214 size = packet_sizes[(i // 2) % len(packet_sizes)]
215 self.extend_packet(p, size)
219 def verify_capture(self, dst_if, capture):
220 """Verify captured input packet stream for defined interface.
222 :param VppInterface dst_if: Interface to verify captured packet stream
224 :param list capture: Captured packet stream.
226 self.logger.info("Verifying capture on interface %s" % dst_if.name)
228 for i in self.interfaces:
229 last_info[i.sw_if_index] = None
231 dst_sw_if_index = dst_if.sw_if_index
232 if hasattr(dst_if, 'parent'):
234 for packet in capture:
236 # Check VLAN tags and Ethernet header
237 packet = dst_if.remove_dot1_layer(packet)
238 self.assertTrue(Dot1Q not in packet)
242 payload_info = self.payload_to_info(str(packet[Raw]))
243 packet_index = payload_info.index
244 self.assertEqual(payload_info.dst, dst_sw_if_index)
246 "Got packet on port %s: src=%u (id=%u)" %
247 (dst_if.name, payload_info.src, packet_index))
248 next_info = self.get_next_packet_info_for_interface2(
249 payload_info.src, dst_sw_if_index,
250 last_info[payload_info.src])
251 last_info[payload_info.src] = next_info
252 self.assertTrue(next_info is not None)
253 self.assertEqual(packet_index, next_info.index)
254 saved_packet = next_info.data
255 # Check standard fields
256 self.assertEqual(ip.src, saved_packet[IPv6].src)
257 self.assertEqual(ip.dst, saved_packet[IPv6].dst)
258 self.assertEqual(udp.sport, saved_packet[UDP].sport)
259 self.assertEqual(udp.dport, saved_packet[UDP].dport)
261 self.logger.error(ppp("Unexpected or invalid packet:", packet))
263 for i in self.interfaces:
264 remaining_packet = self.get_next_packet_info_for_interface2(
265 i.sw_if_index, dst_sw_if_index, last_info[i.sw_if_index])
266 self.assertTrue(remaining_packet is None,
267 "Interface %s: Packet expected from interface %s "
268 "didn't arrive" % (dst_if.name, i.name))
274 - Create IPv6 stream for pg0 interface
275 - Create IPv6 tagged streams for pg1's and pg2's subinterface.
276 - Send and verify received packets on each interface.
279 pkts = self.create_stream(self.pg0, self.pg_if_packet_sizes)
280 self.pg0.add_stream(pkts)
282 for i in self.sub_interfaces:
283 pkts = self.create_stream(i, self.sub_if_packet_sizes)
284 i.parent.add_stream(pkts)
286 self.pg_enable_capture(self.pg_interfaces)
289 pkts = self.pg0.get_capture()
290 self.verify_capture(self.pg0, pkts)
292 for i in self.sub_interfaces:
293 pkts = i.parent.get_capture()
294 self.verify_capture(i, pkts)
297 """ IPv6 Neighbour Solicitation Exceptions
300 - Send an NS Sourced from an address not covered by the link sub-net
301 - Send an NS to an mcast address the router has not joined
302 - Send NS for a target address the router does not onn.
306 # An NS from a non link source address
308 nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6))
309 d = inet_ntop(AF_INET6, nsma)
311 p = (Ether(dst=in6_getnsmac(nsma)) /
312 IPv6(dst=d, src="2002::2") /
313 ICMPv6ND_NS(tgt=self.pg0.local_ip6) /
314 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
317 self.send_and_assert_no_replies(
319 "No response to NS source by address not on sub-net")
322 # An NS for sent to a solicited mcast group the router is
323 # not a member of FAILS
326 nsma = in6_getnsma(inet_pton(AF_INET6, "fd::ffff"))
327 d = inet_ntop(AF_INET6, nsma)
329 p = (Ether(dst=in6_getnsmac(nsma)) /
330 IPv6(dst=d, src=self.pg0.remote_ip6) /
331 ICMPv6ND_NS(tgt=self.pg0.local_ip6) /
332 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
335 self.send_and_assert_no_replies(
337 "No response to NS sent to unjoined mcast address")
340 # An NS whose target address is one the router does not own
342 nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6))
343 d = inet_ntop(AF_INET6, nsma)
345 p = (Ether(dst=in6_getnsmac(nsma)) /
346 IPv6(dst=d, src=self.pg0.remote_ip6) /
347 ICMPv6ND_NS(tgt="fd::ffff") /
348 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
351 self.send_and_assert_no_replies(self.pg0, pkts,
352 "No response to NS for unknown target")
355 # A neighbor entry that has no associated FIB-entry
357 self.pg0.generate_remote_hosts(4)
358 nd_entry = VppNeighbor(self,
359 self.pg0.sw_if_index,
360 self.pg0.remote_hosts[2].mac,
361 self.pg0.remote_hosts[2].ip6,
364 nd_entry.add_vpp_config()
367 # check we have the neighbor, but no route
369 self.assertTrue(find_nbr(self,
370 self.pg0.sw_if_index,
371 self.pg0._remote_hosts[2].ip6,
373 self.assertFalse(find_route(self,
374 self.pg0._remote_hosts[2].ip6,
378 def validate_ra(self, intf, rx, dst_ip=None, mtu=9000, pi_opt=None):
380 dst_ip = intf.remote_ip6
382 # unicasted packets must come to the unicast mac
383 self.assertEqual(rx[Ether].dst, intf.remote_mac)
385 # and from the router's MAC
386 self.assertEqual(rx[Ether].src, intf.local_mac)
388 # the rx'd RA should be addressed to the sender's source
389 self.assertTrue(rx.haslayer(ICMPv6ND_RA))
390 self.assertEqual(in6_ptop(rx[IPv6].dst),
393 # and come from the router's link local
394 self.assertTrue(in6_islladdr(rx[IPv6].src))
395 self.assertEqual(in6_ptop(rx[IPv6].src),
396 in6_ptop(mk_ll_addr(intf.local_mac)))
398 # it should contain the links MTU
400 self.assertEqual(ra[ICMPv6NDOptMTU].mtu, mtu)
402 # it should contain the source's link layer address option
403 sll = ra[ICMPv6NDOptSrcLLAddr]
404 self.assertEqual(sll.lladdr, intf.local_mac)
407 # the RA should not contain prefix information
408 self.assertFalse(ra.haslayer(ICMPv6NDOptPrefixInfo))
410 raos = rx.getlayer(ICMPv6NDOptPrefixInfo, 1)
412 # the options are nested in the scapy packet in way that i cannot
413 # decipher how to decode. this 1st layer of option always returns
414 # nested classes, so a direct obj1=obj2 comparison always fails.
415 # however, the getlayer(.., 2) does give one instnace.
416 # so we cheat here and construct a new opt instnace for comparison
417 rd = ICMPv6NDOptPrefixInfo(prefixlen=raos.prefixlen,
421 if type(pi_opt) is list:
422 for ii in range(len(pi_opt)):
423 self.assertEqual(pi_opt[ii], rd)
424 rd = rx.getlayer(ICMPv6NDOptPrefixInfo, ii+2)
426 self.assertEqual(pi_opt, raos)
428 def send_and_expect_ra(self, intf, pkts, remark, dst_ip=None,
429 filter_out_fn=is_ipv6_misc,
431 intf.add_stream(pkts)
432 self.pg_enable_capture(self.pg_interfaces)
434 rx = intf.get_capture(1, filter_out_fn=filter_out_fn)
436 self.assertEqual(len(rx), 1)
438 self.validate_ra(intf, rx, dst_ip, pi_opt=opt)
441 """ IPv6 Router Solicitation Exceptions
447 # Before we begin change the IPv6 RA responses to use the unicast
448 # address - that way we will not confuse them with the periodic
449 # RAs which go to the mcast address
450 # Sit and wait for the first periodic RA.
454 self.pg0.ip6_ra_config(send_unicast=1)
457 # An RS from a link source address
458 # - expect an RA in return
460 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
461 IPv6(dst=self.pg0.local_ip6, src=self.pg0.remote_ip6) /
464 self.send_and_expect_ra(self.pg0, pkts, "Genuine RS")
467 # For the next RS sent the RA should be rate limited
469 self.send_and_assert_no_replies(self.pg0, pkts, "RA rate limited")
472 # When we reconfiure the IPv6 RA config, we reset the RA rate limiting,
473 # so we need to do this before each test below so as not to drop
474 # packets for rate limiting reasons. Test this works here.
476 self.pg0.ip6_ra_config(send_unicast=1)
477 self.send_and_expect_ra(self.pg0, pkts, "Rate limit reset RS")
480 # An RS sent from a non-link local source
482 self.pg0.ip6_ra_config(send_unicast=1)
483 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
484 IPv6(dst=self.pg0.local_ip6, src="2002::ffff") /
487 self.send_and_assert_no_replies(self.pg0, pkts,
488 "RS from non-link source")
491 # Source an RS from a link local address
493 self.pg0.ip6_ra_config(send_unicast=1)
494 ll = mk_ll_addr(self.pg0.remote_mac)
495 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
496 IPv6(dst=self.pg0.local_ip6, src=ll) /
499 self.send_and_expect_ra(self.pg0, pkts,
500 "RS sourced from link-local",
504 # Send the RS multicast
506 self.pg0.ip6_ra_config(send_unicast=1)
507 dmac = in6_getnsmac(inet_pton(AF_INET6, "ff02::2"))
508 ll = mk_ll_addr(self.pg0.remote_mac)
509 p = (Ether(dst=dmac, src=self.pg0.remote_mac) /
510 IPv6(dst="ff02::2", src=ll) /
513 self.send_and_expect_ra(self.pg0, pkts,
514 "RS sourced from link-local",
518 # Source from the unspecified address ::. This happens when the RS
519 # is sent before the host has a configured address/sub-net,
520 # i.e. auto-config. Since the sender has no IP address, the reply
521 # comes back mcast - so the capture needs to not filter this.
522 # If we happen to pick up the periodic RA at this point then so be it,
525 self.pg0.ip6_ra_config(send_unicast=1, suppress=1)
526 p = (Ether(dst=dmac, src=self.pg0.remote_mac) /
527 IPv6(dst="ff02::2", src="::") /
530 self.send_and_expect_ra(self.pg0, pkts,
531 "RS sourced from unspecified",
536 # Configure The RA to announce the links prefix
538 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
539 self.pg0.local_ip6_prefix_len)
542 # RAs should now contain the prefix information option
544 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
545 prefix=self.pg0.local_ip6,
549 self.pg0.ip6_ra_config(send_unicast=1)
550 ll = mk_ll_addr(self.pg0.remote_mac)
551 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
552 IPv6(dst=self.pg0.local_ip6, src=ll) /
554 self.send_and_expect_ra(self.pg0, p,
555 "RA with prefix-info",
560 # Change the prefix info to not off-link
563 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
564 self.pg0.local_ip6_prefix_len,
567 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
568 prefix=self.pg0.local_ip6,
572 self.pg0.ip6_ra_config(send_unicast=1)
573 self.send_and_expect_ra(self.pg0, p,
574 "RA with Prefix info with L-flag=0",
579 # Change the prefix info to not off-link, no-autoconfig
580 # L and A flag are clear in the advert
582 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
583 self.pg0.local_ip6_prefix_len,
587 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
588 prefix=self.pg0.local_ip6,
592 self.pg0.ip6_ra_config(send_unicast=1)
593 self.send_and_expect_ra(self.pg0, p,
594 "RA with Prefix info with A & L-flag=0",
599 # Change the flag settings back to the defaults
600 # L and A flag are set in the advert
602 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
603 self.pg0.local_ip6_prefix_len)
605 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
606 prefix=self.pg0.local_ip6,
610 self.pg0.ip6_ra_config(send_unicast=1)
611 self.send_and_expect_ra(self.pg0, p,
612 "RA with Prefix info",
617 # Change the prefix info to not off-link, no-autoconfig
618 # L and A flag are clear in the advert
620 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
621 self.pg0.local_ip6_prefix_len,
625 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
626 prefix=self.pg0.local_ip6,
630 self.pg0.ip6_ra_config(send_unicast=1)
631 self.send_and_expect_ra(self.pg0, p,
632 "RA with Prefix info with A & L-flag=0",
637 # Use the reset to defults option to revert to defaults
638 # L and A flag are clear in the advert
640 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
641 self.pg0.local_ip6_prefix_len,
644 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
645 prefix=self.pg0.local_ip6,
649 self.pg0.ip6_ra_config(send_unicast=1)
650 self.send_and_expect_ra(self.pg0, p,
651 "RA with Prefix reverted to defaults",
656 # Advertise Another prefix. With no L-flag/A-flag
658 self.pg0.ip6_ra_prefix(self.pg1.local_ip6n,
659 self.pg1.local_ip6_prefix_len,
663 opt = [ICMPv6NDOptPrefixInfo(prefixlen=self.pg0.local_ip6_prefix_len,
664 prefix=self.pg0.local_ip6,
667 ICMPv6NDOptPrefixInfo(prefixlen=self.pg1.local_ip6_prefix_len,
668 prefix=self.pg1.local_ip6,
672 self.pg0.ip6_ra_config(send_unicast=1)
673 ll = mk_ll_addr(self.pg0.remote_mac)
674 p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
675 IPv6(dst=self.pg0.local_ip6, src=ll) /
677 self.send_and_expect_ra(self.pg0, p,
678 "RA with multiple Prefix infos",
683 # Remove the first refix-info - expect the second is still in the
686 self.pg0.ip6_ra_prefix(self.pg0.local_ip6n,
687 self.pg0.local_ip6_prefix_len,
690 opt = ICMPv6NDOptPrefixInfo(prefixlen=self.pg1.local_ip6_prefix_len,
691 prefix=self.pg1.local_ip6,
695 self.pg0.ip6_ra_config(send_unicast=1)
696 self.send_and_expect_ra(self.pg0, p,
697 "RA with Prefix reverted to defaults",
702 # Remove the second prefix-info - expect no prefix-info i nthe adverts
704 self.pg0.ip6_ra_prefix(self.pg1.local_ip6n,
705 self.pg1.local_ip6_prefix_len,
708 self.pg0.ip6_ra_config(send_unicast=1)
709 self.send_and_expect_ra(self.pg0, p,
710 "RA with Prefix reverted to defaults",
714 # Reset the periodic advertisements back to default values
716 self.pg0.ip6_ra_config(no=1, suppress=1, send_unicast=0)
719 class IPv6NDProxyTest(TestIPv6ND):
720 """ IPv6 ND ProxyTest Case """
723 super(IPv6NDProxyTest, self).setUp()
725 # create 3 pg interfaces
726 self.create_pg_interfaces(range(3))
728 # pg0 is the master interface, with the configured subnet
730 self.pg0.config_ip6()
731 self.pg0.resolve_ndp()
733 self.pg1.ip6_enable()
734 self.pg2.ip6_enable()
737 super(IPv6NDProxyTest, self).tearDown()
739 def test_nd_proxy(self):
740 """ IPv6 Proxy ND """
743 # Generate some hosts in the subnet that we are proxying
745 self.pg0.generate_remote_hosts(8)
747 nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6))
748 d = inet_ntop(AF_INET6, nsma)
751 # Send an NS for one of those remote hosts on one of the proxy links
752 # expect no response since it's from an address that is not
753 # on the link that has the prefix configured
755 ns_pg1 = (Ether(dst=in6_getnsmac(nsma), src=self.pg1.remote_mac) /
756 IPv6(dst=d, src=self.pg0._remote_hosts[2].ip6) /
757 ICMPv6ND_NS(tgt=self.pg0.local_ip6) /
758 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0._remote_hosts[2].mac))
760 self.send_and_assert_no_replies(self.pg1, ns_pg1, "Off link NS")
763 # Add proxy support for the host
765 self.vapi.ip6_nd_proxy(
766 inet_pton(AF_INET6, self.pg0._remote_hosts[2].ip6),
767 self.pg1.sw_if_index)
770 # try that NS again. this time we expect an NA back
772 self.pg1.add_stream(ns_pg1)
773 self.pg_enable_capture(self.pg_interfaces)
775 rx = self.pg1.get_capture(1)
777 self.validate_na(self.pg1, rx[0],
778 dst_ip=self.pg0._remote_hosts[2].ip6,
779 tgt_ip=self.pg0.local_ip6)
782 # ... and that we have an entry in the ND cache
784 self.assertTrue(find_nbr(self,
785 self.pg1.sw_if_index,
786 self.pg0._remote_hosts[2].ip6,
790 # ... and we can route traffic to it
792 t = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
793 IPv6(dst=self.pg0._remote_hosts[2].ip6,
794 src=self.pg0.remote_ip6) /
795 UDP(sport=10000, dport=20000) /
798 self.pg0.add_stream(t)
799 self.pg_enable_capture(self.pg_interfaces)
801 rx = self.pg1.get_capture(1)
804 self.assertEqual(rx[Ether].dst, self.pg0._remote_hosts[2].mac)
805 self.assertEqual(rx[Ether].src, self.pg1.local_mac)
807 self.assertEqual(rx[IPv6].src, t[IPv6].src)
808 self.assertEqual(rx[IPv6].dst, t[IPv6].dst)
811 # Test we proxy for the host on the main interface
813 ns_pg0 = (Ether(dst=in6_getnsmac(nsma), src=self.pg0.remote_mac) /
814 IPv6(dst=d, src=self.pg0.remote_ip6) /
815 ICMPv6ND_NS(tgt=self.pg0._remote_hosts[2].ip6) /
816 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
818 self.pg0.add_stream(ns_pg0)
819 self.pg_enable_capture(self.pg_interfaces)
821 rx = self.pg0.get_capture(1)
823 self.validate_na(self.pg0, rx[0],
824 tgt_ip=self.pg0._remote_hosts[2].ip6,
825 dst_ip=self.pg0.remote_ip6)
828 # Setup and resolve proxy for another host on another interface
830 ns_pg2 = (Ether(dst=in6_getnsmac(nsma), src=self.pg2.remote_mac) /
831 IPv6(dst=d, src=self.pg0._remote_hosts[3].ip6) /
832 ICMPv6ND_NS(tgt=self.pg0.local_ip6) /
833 ICMPv6NDOptSrcLLAddr(lladdr=self.pg0._remote_hosts[2].mac))
835 self.vapi.ip6_nd_proxy(
836 inet_pton(AF_INET6, self.pg0._remote_hosts[3].ip6),
837 self.pg2.sw_if_index)
839 self.pg2.add_stream(ns_pg2)
840 self.pg_enable_capture(self.pg_interfaces)
842 rx = self.pg2.get_capture(1)
844 self.validate_na(self.pg2, rx[0],
845 dst_ip=self.pg0._remote_hosts[3].ip6,
846 tgt_ip=self.pg0.local_ip6)
848 self.assertTrue(find_nbr(self,
849 self.pg2.sw_if_index,
850 self.pg0._remote_hosts[3].ip6,
854 # hosts can communicate. pg2->pg1
856 t2 = (Ether(dst=self.pg2.local_mac,
857 src=self.pg0.remote_hosts[3].mac) /
858 IPv6(dst=self.pg0._remote_hosts[2].ip6,
859 src=self.pg0._remote_hosts[3].ip6) /
860 UDP(sport=10000, dport=20000) /
863 self.pg2.add_stream(t2)
864 self.pg_enable_capture(self.pg_interfaces)
866 rx = self.pg1.get_capture(1)
869 self.assertEqual(rx[Ether].dst, self.pg0._remote_hosts[2].mac)
870 self.assertEqual(rx[Ether].src, self.pg1.local_mac)
872 self.assertEqual(rx[IPv6].src, t2[IPv6].src)
873 self.assertEqual(rx[IPv6].dst, t2[IPv6].dst)
876 # remove the proxy configs
878 self.vapi.ip6_nd_proxy(
879 inet_pton(AF_INET6, self.pg0._remote_hosts[2].ip6),
880 self.pg1.sw_if_index,
882 self.vapi.ip6_nd_proxy(
883 inet_pton(AF_INET6, self.pg0._remote_hosts[3].ip6),
884 self.pg2.sw_if_index,
887 self.assertFalse(find_nbr(self,
888 self.pg2.sw_if_index,
889 self.pg0._remote_hosts[3].ip6,
891 self.assertFalse(find_nbr(self,
892 self.pg1.sw_if_index,
893 self.pg0._remote_hosts[2].ip6,
897 # no longer proxy-ing...
899 self.send_and_assert_no_replies(self.pg0, ns_pg0, "Proxy unconfigured")
900 self.send_and_assert_no_replies(self.pg1, ns_pg1, "Proxy unconfigured")
901 self.send_and_assert_no_replies(self.pg2, ns_pg2, "Proxy unconfigured")
904 # no longer forwarding. traffic generates NS out of the glean/main
907 self.pg2.add_stream(t2)
908 self.pg_enable_capture(self.pg_interfaces)
911 rx = self.pg0.get_capture(1)
913 self.assertTrue(rx[0].haslayer(ICMPv6ND_NS))
916 class TestIPNull(VppTestCase):
917 """ IPv6 routes via NULL """
920 super(TestIPNull, self).setUp()
922 # create 2 pg interfaces
923 self.create_pg_interfaces(range(1))
925 for i in self.pg_interfaces:
931 super(TestIPNull, self).tearDown()
932 for i in self.pg_interfaces:
936 def test_ip_null(self):
937 """ IP NULL route """
939 p = (Ether(src=self.pg0.remote_mac,
940 dst=self.pg0.local_mac) /
941 IPv6(src=self.pg0.remote_ip6, dst="2001::1") /
942 UDP(sport=1234, dport=1234) /
946 # A route via IP NULL that will reply with ICMP unreachables
948 ip_unreach = VppIpRoute(self, "2001::", 64, [], is_unreach=1, is_ip6=1)
949 ip_unreach.add_vpp_config()
951 self.pg0.add_stream(p)
952 self.pg_enable_capture(self.pg_interfaces)
955 rx = self.pg0.get_capture(1)
957 icmp = rx[ICMPv6DestUnreach]
959 # 0 = "No route to destination"
960 self.assertEqual(icmp.code, 0)
962 # ICMP is rate limited. pause a bit
966 # A route via IP NULL that will reply with ICMP prohibited
968 ip_prohibit = VppIpRoute(self, "2001::1", 128, [],
969 is_prohibit=1, is_ip6=1)
970 ip_prohibit.add_vpp_config()
972 self.pg0.add_stream(p)
973 self.pg_enable_capture(self.pg_interfaces)
976 rx = self.pg0.get_capture(1)
978 icmp = rx[ICMPv6DestUnreach]
980 # 1 = "Communication with destination administratively prohibited"
981 self.assertEqual(icmp.code, 1)
984 if __name__ == '__main__':
985 unittest.main(testRunner=VppTestRunner)