5 from framework import VppTestCase, VppTestRunner
7 from scapy.packet import Raw
8 from scapy.layers.l2 import Ether
9 from scapy.layers.inet import IP, UDP, ICMP
10 from scapy.layers.inet6 import IPv6
12 from vpp_papi import VppEnum
17 class TestURPF(VppTestCase):
18 """Unicast Reverse Path Forwarding Test Case"""
22 super(TestURPF, cls).setUpClass()
25 def tearDownClass(cls):
26 super(TestURPF, cls).tearDownClass()
29 super(TestURPF, self).setUp()
31 # create 4 pg interfaces so there are a few addresses
33 self.create_pg_interfaces(range(4))
35 for i in self.pg_interfaces:
43 for i in self.pg_interfaces:
47 super(TestURPF, self).tearDown()
54 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
55 / IP(src="3.3.3.3", dst=self.pg1.remote_ip4)
56 / UDP(sport=1234, dport=1234)
60 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
61 / IP(src=self.pg2.remote_ip4, dst=self.pg1.remote_ip4)
62 / UDP(sport=1234, dport=1234)
66 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
67 / IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4)
68 / UDP(sport=1234, dport=1234)
73 # before adding the uRPF, ensure all packets are forwarded
75 self.send_and_expect(self.pg0, p_good, self.pg1)
76 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
77 self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
80 # apply loose uRPF check on pg0 rx
82 self.vapi.urpf_update(
84 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
85 af=e.vl_api_address_family_t.ADDRESS_IP4,
86 sw_if_index=self.pg0.sw_if_index,
89 # good packets still pass
90 self.send_and_expect(self.pg0, p_good, self.pg1)
91 # packets from address for which there is a route are forwarded
92 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
93 # packets from address to which there is no route are dropped
94 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
96 self.assert_error_counter_equal("/err/ip4-rx-urpf-loose/uRPF Drop", N_PKTS)
99 # crank it up to strict mode
101 self.vapi.urpf_update(
103 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
104 af=e.vl_api_address_family_t.ADDRESS_IP4,
105 sw_if_index=self.pg0.sw_if_index,
108 # good packets still pass
109 self.send_and_expect(self.pg0, p_good, self.pg1)
110 # packets that would not be routed back thru pg0 are dropped
111 self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
112 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
114 self.assert_error_counter_equal("/err/ip4-rx-urpf-strict/uRPF Drop", 2 * N_PKTS)
117 # disable uRPF, all traffic should pass
119 self.vapi.urpf_update(
121 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
122 af=e.vl_api_address_family_t.ADDRESS_IP4,
123 sw_if_index=self.pg0.sw_if_index,
126 self.send_and_expect(self.pg0, p_good, self.pg1)
127 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
128 self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
131 # Now apply in the TX direction
132 # for loose it is the same deal, they should not be forwarded
133 # if there's no route
134 # for strict they should not be forwarded if they would be
135 # forwarded thru that interface.
137 self.vapi.urpf_update(
139 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
140 af=e.vl_api_address_family_t.ADDRESS_IP4,
141 sw_if_index=self.pg1.sw_if_index,
144 self.send_and_expect(self.pg0, p_good, self.pg1)
145 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
146 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
148 self.assert_error_counter_equal("/err/ip4-tx-urpf-loose/uRPF Drop", N_PKTS)
150 self.vapi.urpf_update(
152 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
153 af=e.vl_api_address_family_t.ADDRESS_IP4,
154 sw_if_index=self.pg1.sw_if_index,
157 self.send_and_expect(self.pg0, p_good, self.pg1)
158 # the strict packet, from a peer is allowed, since it does
159 # not forward via pg1
160 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
161 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
163 self.assert_error_counter_equal("/err/ip4-tx-urpf-strict/uRPF Drop", N_PKTS)
165 # change the strict packet so that it would forward through pg1
167 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
168 / IP(src=self.pg1.remote_ip4, dst=self.pg1.remote_ip4)
169 / UDP(sport=1234, dport=1234)
173 self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
174 self.assert_error_counter_equal("/err/ip4-tx-urpf-strict/uRPF Drop", 2 * N_PKTS)
177 self.vapi.urpf_update(
179 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
180 af=e.vl_api_address_family_t.ADDRESS_IP4,
181 sw_if_index=self.pg1.sw_if_index,
184 def test_urpf6(self):
189 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
190 / IPv6(src="3::3", dst=self.pg1.remote_ip6)
191 / UDP(sport=1236, dport=1236)
195 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
196 / IPv6(src=self.pg2.remote_ip6, dst=self.pg1.remote_ip6)
197 / UDP(sport=1236, dport=1236)
201 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
202 / IPv6(src=self.pg0.remote_ip6, dst=self.pg1.remote_ip6)
203 / UDP(sport=1236, dport=1236)
208 # before adding the uRPF, ensure all packets are forwarded
210 self.send_and_expect(self.pg0, p_good, self.pg1)
211 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
212 self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
215 # apply loose uRPF check on pg0 rx
217 self.vapi.urpf_update(
219 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
220 af=e.vl_api_address_family_t.ADDRESS_IP6,
221 sw_if_index=self.pg0.sw_if_index,
224 # good packets still pass
225 self.send_and_expect(self.pg0, p_good, self.pg1)
226 # packets from address for which there is a route are forwarded
227 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
228 # packets from address to which there is no route are dropped
229 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
231 self.assert_error_counter_equal("/err/ip6-rx-urpf-loose/uRPF Drop", N_PKTS)
234 # crank it up to strict mode
236 self.vapi.urpf_update(
238 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
239 af=e.vl_api_address_family_t.ADDRESS_IP6,
240 sw_if_index=self.pg0.sw_if_index,
243 # good packets still pass
244 self.send_and_expect(self.pg0, p_good, self.pg1)
245 # packets that would not be routed back thru pg0 are dropped
246 self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
247 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
249 self.assert_error_counter_equal("/err/ip6-rx-urpf-strict/uRPF Drop", 2 * N_PKTS)
252 # disable uRPF, all traffic should pass
254 self.vapi.urpf_update(
256 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
257 af=e.vl_api_address_family_t.ADDRESS_IP6,
258 sw_if_index=self.pg0.sw_if_index,
261 self.send_and_expect(self.pg0, p_good, self.pg1)
262 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
263 self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
266 # Now apply in the TX direction
267 # for loose it is the same deal, they should not be forwarded
268 # if there's no route
269 # for strict they should not be forwarded if they would be
270 # forwarded thru that interface.
272 self.vapi.urpf_update(
274 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
275 af=e.vl_api_address_family_t.ADDRESS_IP6,
276 sw_if_index=self.pg1.sw_if_index,
279 self.send_and_expect(self.pg0, p_good, self.pg1)
280 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
281 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
283 self.assert_error_counter_equal("/err/ip6-tx-urpf-loose/uRPF Drop", N_PKTS)
285 self.vapi.urpf_update(
287 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
288 af=e.vl_api_address_family_t.ADDRESS_IP6,
289 sw_if_index=self.pg1.sw_if_index,
292 self.send_and_expect(self.pg0, p_good, self.pg1)
293 # the strict packet, from a peer is allowed, since it does
294 # not forward via pg1
295 self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
296 self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
298 self.assert_error_counter_equal("/err/ip6-tx-urpf-strict/uRPF Drop", N_PKTS)
300 # change the strict packet so that it would forward through pg1
302 Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac)
303 / IPv6(src=self.pg1.remote_ip6, dst=self.pg1.remote_ip6)
304 / UDP(sport=1236, dport=1236)
308 self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
309 self.assert_error_counter_equal("/err/ip6-tx-urpf-strict/uRPF Drop", 2 * N_PKTS)
312 self.vapi.urpf_update(
314 mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
315 af=e.vl_api_address_family_t.ADDRESS_IP6,
316 sw_if_index=self.pg1.sw_if_index,
320 if __name__ == "__main__":
321 unittest.main(testRunner=VppTestRunner)