2 * sr.c: ipv6 segment routing
4 * Copyright (c) 2013 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
20 * @brief Segment Routing main functions
23 #include <vnet/vnet.h>
24 #include <vnet/sr/sr.h>
25 #include <vnet/fib/ip6_fib.h>
26 #include <vnet/dpo/dpo.h>
28 #include <openssl/hmac.h>
30 ip6_sr_main_t sr_main;
31 static vlib_node_registration_t sr_local_node;
34 * @brief Dynamically added SR DPO type
36 static dpo_type_t sr_dpo_type;
39 * @brief Use passed HMAC key in ip6_sr_header_t in OpenSSL HMAC routines
41 * @param sm ip6_sr_main_t *
42 * @param ip ip6_header_t *
43 * @param sr ip6_sr_header_t *
46 sr_fix_hmac (ip6_sr_main_t * sm, ip6_header_t * ip, ip6_sr_header_t * sr)
54 ip6_sr_hmac_key_t *hmac_key;
57 key_index = sr->hmac_key;
59 /* No signature? Pass... */
63 /* We don't know about this key? Fail... */
64 if (key_index >= vec_len (sm->hmac_keys))
67 hmac_key = sm->hmac_keys + key_index;
69 vec_reset_length (keybuf);
71 /* pkt ip6 src address */
72 vec_add2 (keybuf, copy_target, sizeof (ip6_address_t));
73 clib_memcpy (copy_target, ip->src_address.as_u8, sizeof (ip6_address_t));
76 vec_add2 (keybuf, copy_target, 1);
77 copy_target[0] = sr->first_segment;
79 /* octet w/ bit 0 = "clean" flag */
80 vec_add2 (keybuf, copy_target, 1);
82 = (sr->flags & clib_host_to_net_u16 (IP6_SR_HEADER_FLAG_CLEANUP))
86 vec_add2 (keybuf, copy_target, 1);
87 copy_target[0] = sr->hmac_key;
89 first_segment = sr->first_segment;
94 for (i = 0; i <= first_segment; i++)
96 vec_add2 (keybuf, copy_target, sizeof (ip6_address_t));
97 clib_memcpy (copy_target, addrp->as_u8, sizeof (ip6_address_t));
103 HMAC_CTX_init (sm->hmac_ctx);
104 if (!HMAC_Init (sm->hmac_ctx, hmac_key->shared_secret,
105 vec_len (hmac_key->shared_secret), sm->md))
106 clib_warning ("barf1");
107 if (!HMAC_Update (sm->hmac_ctx, keybuf, vec_len (keybuf)))
108 clib_warning ("barf2");
109 if (!HMAC_Final (sm->hmac_ctx, (unsigned char *) addrp, &sig_len))
110 clib_warning ("barf3");
111 HMAC_CTX_cleanup (sm->hmac_ctx);
115 * @brief Format function for decoding various SR flags
117 * @param s u8 * - formatted string
118 * @param args va_list * - u16 flags
120 * @return formatted output string u8 *
123 format_ip6_sr_header_flags (u8 * s, va_list * args)
125 u16 flags = (u16) va_arg (*args, int);
127 int bswap_needed = va_arg (*args, int);
131 flags = clib_host_to_net_u16 (flags);
133 if (flags & IP6_SR_HEADER_FLAG_CLEANUP)
134 s = format (s, "cleanup ");
136 if (flags & IP6_SR_HEADER_FLAG_PROTECTED)
137 s = format (s, "reroute ");
139 s = format (s, "pl: ");
140 for (i = 1; i <= 4; i++)
142 pl_flag = ip6_sr_policy_list_flags (flags, i);
143 s = format (s, "[%d] ", i);
147 case IP6_SR_HEADER_FLAG_PL_ELT_NOT_PRESENT:
148 s = format (s, "NotPr ");
150 case IP6_SR_HEADER_FLAG_PL_ELT_INGRESS_PE:
151 s = format (s, "InPE ");
153 case IP6_SR_HEADER_FLAG_PL_ELT_EGRESS_PE:
154 s = format (s, "EgPE ");
157 case IP6_SR_HEADER_FLAG_PL_ELT_ORIG_SRC_ADDR:
158 s = format (s, "OrgSrc ");
166 * @brief Format function for decoding ip6_sr_header_t
168 * @param s u8 * - formatted string
169 * @param args va_list * - ip6_sr_header_t
171 * @return formatted output string u8 *
174 format_ip6_sr_header (u8 * s, va_list * args)
176 ip6_sr_header_t *h = va_arg (*args, ip6_sr_header_t *);
177 ip6_address_t placeholder_addr =
178 { {254, 254, 254, 254, 254, 254, 254, 254, 254, 254, 254, 254, 254, 254,
181 int print_hmac = va_arg (*args, int);
182 int i, pl_index, max_segs;
183 int flags_host_byte_order = clib_net_to_host_u16 (h->flags);
185 s = format (s, "next proto %d, len %d, type %d",
186 h->protocol, (h->length << 3) + 8, h->type);
187 s = format (s, "\n segs left %d, first_segment %d, hmac key %d",
188 h->segments_left, h->first_segment, h->hmac_key);
189 s = format (s, "\n flags %U", format_ip6_sr_header_flags,
190 flags_host_byte_order, 0 /* bswap needed */ );
193 * Header length is in 8-byte units (minus one), so
194 * divide by 2 to ascertain the number of ip6 addresses in the
197 max_segs = (h->length >> 1);
199 if (!print_hmac && h->hmac_key)
202 s = format (s, "\n Segments (in processing order):");
204 for (i = h->first_segment; i >= 1; i--)
205 s = format (s, "\n %U", format_ip6_address, h->segments + i);
206 if (ip6_address_is_equal (&placeholder_addr, h->segments))
207 s = format (s, "\n (empty placeholder)");
209 s = format (s, "\n %U", format_ip6_address, h->segments);
211 s = format (s, "\n Policy List:");
213 pl_index = 1; /* to match the RFC text */
214 for (i = (h->first_segment + 1); i < max_segs; i++, pl_index++)
217 char *tags[] = { " ", "InPE: ", "EgPE: ", "OrgSrc: " };
220 if (pl_index >= 1 && pl_index <= 4)
222 int this_pl_flag = ip6_sr_policy_list_flags
223 (flags_host_byte_order, pl_index);
224 tag = tags[this_pl_flag];
227 s = format (s, "\n %s%U", tag, format_ip6_address, h->segments + i);
234 * @brief Format function for decoding ip6_sr_header_t with length
236 * @param s u8 * - formatted string
237 * @param args va_list * - ip6_header_t + ip6_sr_header_t
239 * @return formatted output string u8 *
242 format_ip6_sr_header_with_length (u8 * s, va_list * args)
244 ip6_header_t *h = va_arg (*args, ip6_header_t *);
245 u32 max_header_bytes = va_arg (*args, u32);
248 header_bytes = sizeof (h[0]) + sizeof (ip6_sr_header_t);
249 if (max_header_bytes != 0 && header_bytes > max_header_bytes)
250 return format (s, "ip6_sr header truncated");
252 s = format (s, "IP6: %U\n", format_ip6_header, h, max_header_bytes);
254 format (s, "SR: %U\n", format_ip6_sr_header, (ip6_sr_header_t *) (h + 1),
255 0 /* print_hmac */ , max_header_bytes);
260 * @brief Defined valid next nodes
261 * @note Cannot call replicate yet without DPDK
264 #define foreach_sr_rewrite_next \
265 _(ERROR, "error-drop") \
266 _(IP6_LOOKUP, "ip6-lookup") \
267 _(SR_LOCAL, "sr-local") \
268 _(SR_REPLICATE,"sr-replicate")
270 #define foreach_sr_rewrite_next \
271 _(ERROR, "error-drop") \
272 _(IP6_LOOKUP, "ip6-lookup") \
273 _(SR_LOCAL, "sr-local")
277 * @brief Struct for defined valid next nodes
281 #define _(s,n) SR_REWRITE_NEXT_##s,
282 foreach_sr_rewrite_next
288 * @brief Struct for data for SR rewrite packet trace
292 ip6_address_t src, dst;
297 } sr_rewrite_trace_t;
300 * @brief Error strings for SR rewrite
302 static char *sr_rewrite_error_strings[] = {
303 #define sr_error(n,s) s,
304 #include "sr_error.def"
309 * @brief Struct for SR rewrite error strings
313 #define sr_error(n,s) SR_REWRITE_ERROR_##n,
314 #include "sr_error.def"
317 } sr_rewrite_error_t;
321 * @brief Format function for SR rewrite trace.
324 format_sr_rewrite_trace (u8 * s, va_list * args)
326 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
327 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
328 sr_rewrite_trace_t *t = va_arg (*args, sr_rewrite_trace_t *);
329 ip6_sr_main_t *sm = &sr_main;
330 ip6_sr_tunnel_t *tun = pool_elt_at_index (sm->tunnels, t->tunnel_index);
331 ip6_fib_t *rx_fib, *tx_fib;
333 rx_fib = ip6_fib_get (tun->rx_fib_index);
334 tx_fib = ip6_fib_get (tun->tx_fib_index);
337 (s, "SR-REWRITE: next %s ip6 src %U dst %U len %u\n"
338 " rx-fib-id %d tx-fib-id %d\n%U",
339 (t->next_index == SR_REWRITE_NEXT_SR_LOCAL)
340 ? "sr-local" : "ip6-lookup",
341 format_ip6_address, &t->src,
342 format_ip6_address, &t->dst, t->length,
343 rx_fib->table_id, tx_fib->table_id,
344 format_ip6_sr_header, t->sr, 0 /* print_hmac */ );
349 * @brief Main processing dual-loop for Segment Routing Rewrite
352 * @param vm vlib_main_t *
353 * @param node vlib_node_runtime_t *
354 * @param from_frame vlib_frame_t *
356 * @return from_frame->n_vectors uword
359 sr_rewrite (vlib_main_t * vm,
360 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
362 u32 n_left_from, next_index, *from, *to_next;
363 ip6_main_t *im = &ip6_main;
364 ip_lookup_main_t *lm = &im->lookup_main;
365 ip6_sr_main_t *sm = &sr_main;
366 u32 (*sr_local_cb) (vlib_main_t *, vlib_node_runtime_t *,
367 vlib_buffer_t *, ip6_header_t *, ip6_sr_header_t *);
368 sr_local_cb = sm->sr_local_cb;
370 from = vlib_frame_vector_args (from_frame);
371 n_left_from = from_frame->n_vectors;
373 next_index = node->cached_next_index;
375 while (n_left_from > 0)
379 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
381 /* Note 2x loop disabled */
382 while (0 && n_left_from >= 4 && n_left_to_next >= 2)
385 vlib_buffer_t *b0, *b1;
386 ip6_header_t *ip0, *ip1;
387 ip_adjacency_t *adj0, *adj1;
388 ip6_sr_header_t *sr0, *sr1;
389 ip6_sr_tunnel_t *t0, *t1;
390 u32 next0 = SR_REWRITE_NEXT_IP6_LOOKUP;
391 u32 next1 = SR_REWRITE_NEXT_IP6_LOOKUP;
395 /* Prefetch next iteration. */
397 vlib_buffer_t *p2, *p3;
399 p2 = vlib_get_buffer (vm, from[2]);
400 p3 = vlib_get_buffer (vm, from[3]);
402 vlib_prefetch_buffer_header (p2, LOAD);
403 vlib_prefetch_buffer_header (p3, LOAD);
415 b0 = vlib_get_buffer (vm, bi0);
416 b1 = vlib_get_buffer (vm, bi1);
419 * $$$ parse through header(s) to pick the point
420 * where we punch in the SR extention header
424 ip_get_adjacency (lm, vnet_buffer (b0)->ip.adj_index[VLIB_TX]);
426 ip_get_adjacency (lm, vnet_buffer (b1)->ip.adj_index[VLIB_TX]);
428 pool_elt_at_index (sm->tunnels, adj0->rewrite_header.sw_if_index);
430 pool_elt_at_index (sm->tunnels, adj1->rewrite_header.sw_if_index);
432 ASSERT (VLIB_BUFFER_PRE_DATA_SIZE
433 >= ((word) vec_len (t0->rewrite)) + b0->current_data);
434 ASSERT (VLIB_BUFFER_PRE_DATA_SIZE
435 >= ((word) vec_len (t1->rewrite)) + b1->current_data);
437 vnet_buffer (b0)->sw_if_index[VLIB_TX] = t0->tx_fib_index;
438 vnet_buffer (b1)->sw_if_index[VLIB_TX] = t1->tx_fib_index;
440 ip0 = vlib_buffer_get_current (b0);
441 ip1 = vlib_buffer_get_current (b1);
444 * SR-unaware service chaining case: pkt coming back from
445 * service has the original dst address, and will already
446 * have an SR header. If so, send it to sr-local
448 if (PREDICT_FALSE (ip0->protocol == IPPROTO_IPV6_ROUTE))
450 vlib_buffer_advance (b0, sizeof (ip0));
451 sr0 = (ip6_sr_header_t *) (ip0 + 1);
452 new_l0 = clib_net_to_host_u16 (ip0->payload_length);
453 next0 = SR_REWRITE_NEXT_SR_LOCAL;
458 * Copy data before the punch-in point left by the
459 * required amount. Assume (for the moment) that only
460 * the main packet header needs to be copied.
462 clib_memcpy (((u8 *) ip0) - vec_len (t0->rewrite),
463 ip0, sizeof (ip6_header_t));
464 vlib_buffer_advance (b0, -(word) vec_len (t0->rewrite));
465 ip0 = vlib_buffer_get_current (b0);
466 sr0 = (ip6_sr_header_t *) (ip0 + 1);
468 clib_memcpy (sr0, t0->rewrite, vec_len (t0->rewrite));
470 /* Fix the next header chain */
471 sr0->protocol = ip0->protocol;
472 ip0->protocol = IPPROTO_IPV6_ROUTE; /* routing extension header */
473 new_l0 = clib_net_to_host_u16 (ip0->payload_length) +
474 vec_len (t0->rewrite);
475 ip0->payload_length = clib_host_to_net_u16 (new_l0);
477 /* Copy dst address into the DA slot in the segment list */
478 clib_memcpy (sr0->segments, ip0->dst_address.as_u64,
479 sizeof (ip6_address_t));
480 /* Rewrite the ip6 dst address with the first hop */
481 clib_memcpy (ip0->dst_address.as_u64, t0->first_hop.as_u64,
482 sizeof (ip6_address_t));
484 sr_fix_hmac (sm, ip0, sr0);
486 next0 = sr_local_cb ? sr_local_cb (vm, node, b0, ip0, sr0) :
490 * Ignore "do not rewrite" shtik in this path
492 if (PREDICT_FALSE (next0 & 0x80000000))
495 if (PREDICT_FALSE (next0 == SR_REWRITE_NEXT_ERROR))
496 b0->error = node->errors[SR_REWRITE_ERROR_APP_CALLBACK];
500 if (PREDICT_FALSE (ip1->protocol == IPPROTO_IPV6_ROUTE))
502 vlib_buffer_advance (b1, sizeof (ip1));
503 sr1 = (ip6_sr_header_t *) (ip1 + 1);
504 new_l1 = clib_net_to_host_u16 (ip1->payload_length);
505 next1 = SR_REWRITE_NEXT_SR_LOCAL;
509 clib_memcpy (((u8 *) ip0) - vec_len (t0->rewrite),
510 ip0, sizeof (ip6_header_t));
511 vlib_buffer_advance (b1, -(word) vec_len (t1->rewrite));
512 ip1 = vlib_buffer_get_current (b1);
513 sr1 = (ip6_sr_header_t *) (ip1 + 1);
514 clib_memcpy (sr1, t1->rewrite, vec_len (t1->rewrite));
516 sr1->protocol = ip1->protocol;
517 ip1->protocol = IPPROTO_IPV6_ROUTE;
518 new_l1 = clib_net_to_host_u16 (ip1->payload_length) +
519 vec_len (t1->rewrite);
520 ip1->payload_length = clib_host_to_net_u16 (new_l1);
522 /* Copy dst address into the DA slot in the segment list */
523 clib_memcpy (sr1->segments, ip1->dst_address.as_u64,
524 sizeof (ip6_address_t));
525 /* Rewrite the ip6 dst address with the first hop */
526 clib_memcpy (ip1->dst_address.as_u64, t1->first_hop.as_u64,
527 sizeof (ip6_address_t));
529 sr_fix_hmac (sm, ip1, sr1);
531 next1 = sr_local_cb ? sr_local_cb (vm, node, b1, ip1, sr1) :
535 * Ignore "do not rewrite" shtik in this path
537 if (PREDICT_FALSE (next1 & 0x80000000))
540 if (PREDICT_FALSE (next1 == SR_REWRITE_NEXT_ERROR))
541 b1->error = node->errors[SR_REWRITE_ERROR_APP_CALLBACK];
545 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
547 sr_rewrite_trace_t *tr = vlib_add_trace (vm, node,
549 tr->tunnel_index = t0 - sm->tunnels;
550 clib_memcpy (tr->src.as_u8, ip0->src_address.as_u8,
551 sizeof (tr->src.as_u8));
552 clib_memcpy (tr->dst.as_u8, ip0->dst_address.as_u8,
553 sizeof (tr->dst.as_u8));
555 tr->next_index = next0;
556 clib_memcpy (tr->sr, sr0, sizeof (tr->sr));
558 if (PREDICT_FALSE (b1->flags & VLIB_BUFFER_IS_TRACED))
560 sr_rewrite_trace_t *tr = vlib_add_trace (vm, node,
562 tr->tunnel_index = t1 - sm->tunnels;
563 clib_memcpy (tr->src.as_u8, ip1->src_address.as_u8,
564 sizeof (tr->src.as_u8));
565 clib_memcpy (tr->dst.as_u8, ip1->dst_address.as_u8,
566 sizeof (tr->dst.as_u8));
568 tr->next_index = next1;
569 clib_memcpy (tr->sr, sr1, sizeof (tr->sr));
572 vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
573 to_next, n_left_to_next,
574 bi0, bi1, next0, next1);
577 while (n_left_from > 0 && n_left_to_next > 0)
581 ip6_header_t *ip0 = 0;
582 ip_adjacency_t *adj0;
583 ip6_sr_header_t *sr0 = 0;
585 u32 next0 = SR_REWRITE_NEXT_IP6_LOOKUP;
595 b0 = vlib_get_buffer (vm, bi0);
598 * $$$ parse through header(s) to pick the point
599 * where we punch in the SR extention header
603 ip_get_adjacency (lm, vnet_buffer (b0)->ip.adj_index[VLIB_TX]);
605 pool_elt_at_index (sm->tunnels, adj0->rewrite_header.sw_if_index);
607 #if DPDK > 0 /* Cannot call replication node yet without DPDK */
608 /* add a replication node */
609 if (PREDICT_FALSE (t0->policy_index != ~0))
611 vnet_buffer (b0)->ip.save_protocol = t0->policy_index;
612 next0 = SR_REWRITE_NEXT_SR_REPLICATE;
617 ASSERT (VLIB_BUFFER_PRE_DATA_SIZE
618 >= ((word) vec_len (t0->rewrite)) + b0->current_data);
620 vnet_buffer (b0)->sw_if_index[VLIB_TX] = t0->tx_fib_index;
622 ip0 = vlib_buffer_get_current (b0);
625 * SR-unaware service chaining case: pkt coming back from
626 * service has the original dst address, and will already
627 * have an SR header. If so, send it to sr-local
629 if (PREDICT_FALSE (ip0->protocol == IPPROTO_IPV6_ROUTE))
631 vlib_buffer_advance (b0, sizeof (ip0));
632 sr0 = (ip6_sr_header_t *) (ip0 + 1);
633 new_l0 = clib_net_to_host_u16 (ip0->payload_length);
634 next0 = SR_REWRITE_NEXT_SR_LOCAL;
639 * Copy data before the punch-in point left by the
640 * required amount. Assume (for the moment) that only
641 * the main packet header needs to be copied.
643 clib_memcpy (((u8 *) ip0) - vec_len (t0->rewrite),
644 ip0, sizeof (ip6_header_t));
645 vlib_buffer_advance (b0, -(word) vec_len (t0->rewrite));
646 ip0 = vlib_buffer_get_current (b0);
647 sr0 = (ip6_sr_header_t *) (ip0 + 1);
649 clib_memcpy (sr0, t0->rewrite, vec_len (t0->rewrite));
651 /* Fix the next header chain */
652 sr0->protocol = ip0->protocol;
653 ip0->protocol = IPPROTO_IPV6_ROUTE; /* routing extension header */
654 new_l0 = clib_net_to_host_u16 (ip0->payload_length) +
655 vec_len (t0->rewrite);
656 ip0->payload_length = clib_host_to_net_u16 (new_l0);
658 /* Copy dst address into the DA slot in the segment list */
659 clib_memcpy (sr0->segments, ip0->dst_address.as_u64,
660 sizeof (ip6_address_t));
661 /* Rewrite the ip6 dst address with the first hop */
662 clib_memcpy (ip0->dst_address.as_u64, t0->first_hop.as_u64,
663 sizeof (ip6_address_t));
665 sr_fix_hmac (sm, ip0, sr0);
667 next0 = sr_local_cb ? sr_local_cb (vm, node, b0, ip0, sr0) :
671 * Ignore "do not rewrite" shtik in this path
673 if (PREDICT_FALSE (next0 & 0x80000000))
676 if (PREDICT_FALSE (next0 == SR_REWRITE_NEXT_ERROR))
677 b0->error = node->errors[SR_REWRITE_ERROR_APP_CALLBACK];
681 #if DPDK > 0 /* Cannot run replicate without DPDK and only replicate uses this label */
684 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
686 sr_rewrite_trace_t *tr = vlib_add_trace (vm, node,
688 tr->tunnel_index = t0 - sm->tunnels;
691 memcpy (tr->src.as_u8, ip0->src_address.as_u8,
692 sizeof (tr->src.as_u8));
693 memcpy (tr->dst.as_u8, ip0->dst_address.as_u8,
694 sizeof (tr->dst.as_u8));
697 tr->next_index = next0;
698 clib_memcpy (tr->sr, sr0, sizeof (tr->sr));
701 vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
702 to_next, n_left_to_next,
706 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
708 return from_frame->n_vectors;
712 VLIB_REGISTER_NODE (sr_rewrite_node) = {
713 .function = sr_rewrite,
714 .name = "sr-rewrite",
715 /* Takes a vector of packets. */
716 .vector_size = sizeof (u32),
717 .format_trace = format_sr_rewrite_trace,
718 .format_buffer = format_ip6_sr_header_with_length,
720 .n_errors = SR_REWRITE_N_ERROR,
721 .error_strings = sr_rewrite_error_strings,
723 .runtime_data_bytes = 0,
725 .n_next_nodes = SR_REWRITE_N_NEXT,
727 #define _(s,n) [SR_REWRITE_NEXT_##s] = n,
728 foreach_sr_rewrite_next
733 VLIB_NODE_FUNCTION_MULTIARCH (sr_rewrite_node, sr_rewrite)
737 ip6_delete_route_no_next_hop (ip6_address_t * dst_address_arg,
738 u32 dst_address_length, u32 rx_table_id)
741 .fp_len = dst_address_length,
742 .fp_proto = FIB_PROTOCOL_IP6,
744 .ip6 = *dst_address_arg,
748 fib_table_entry_delete (fib_table_id_find_fib_index (FIB_PROTOCOL_IP6,
750 &pfx, FIB_SOURCE_SR);
756 * @brief Find or add if not found - HMAC shared secret
758 * @param sm ip6_sr_main_t *
760 * @param indexp u32 *
762 * @return ip6_sr_hmac_key_t *
764 static ip6_sr_hmac_key_t *
765 find_or_add_shared_secret (ip6_sr_main_t * sm, u8 * secret, u32 * indexp)
768 ip6_sr_hmac_key_t *key = 0;
771 p = hash_get_mem (sm->hmac_key_by_shared_secret, secret);
775 key = vec_elt_at_index (sm->hmac_keys, p[0]);
781 /* Specific key ID? */
782 if (indexp && *indexp)
784 vec_validate (sm->hmac_keys, *indexp);
785 key = sm->hmac_keys + *indexp;
789 for (i = 0; i < vec_len (sm->hmac_keys); i++)
791 if (sm->hmac_keys[i].shared_secret == 0)
793 key = sm->hmac_keys + i;
797 vec_validate (sm->hmac_keys, i);
798 key = sm->hmac_keys + i;
803 key->shared_secret = vec_dup (secret);
805 hash_set_mem (sm->hmac_key_by_shared_secret, key->shared_secret,
806 key - sm->hmac_keys);
809 *indexp = key - sm->hmac_keys;
814 * @brief Add or Delete a Segment Routing tunnel.
816 * @param a ip6_sr_add_del_tunnel_args_t *
821 ip6_sr_add_del_tunnel (ip6_sr_add_del_tunnel_args_t * a)
823 ip6_main_t *im = &ip6_main;
824 ip6_sr_tunnel_key_t key;
827 ip6_sr_header_t *h = 0;
829 ip6_address_t *addrp, *this_address;
830 ip6_sr_main_t *sm = &sr_main;
832 u32 rx_fib_index, tx_fib_index;
833 u32 hmac_key_index_u32;
834 u8 hmac_key_index = 0;
837 dpo_id_t dpo = DPO_NULL;
839 /* Make sure that the rx FIB exists */
840 p = hash_get (im->fib_index_by_table_id, a->rx_table_id);
845 /* remember the FIB index */
848 /* Make sure that the supplied FIB exists */
849 p = hash_get (im->fib_index_by_table_id, a->tx_table_id);
854 /* remember the FIB index */
857 clib_memcpy (key.src.as_u8, a->src_address->as_u8, sizeof (key.src));
858 clib_memcpy (key.dst.as_u8, a->dst_address->as_u8, sizeof (key.dst));
860 /* When adding a tunnel:
861 * - If a "name" is given, it must not exist.
862 * - The "key" is always checked, and must not exist.
863 * When deleting a tunnel:
864 * - If the "name" is given, and it exists, then use it.
865 * - If the "name" is not given, use the "key".
866 * - If the "name" and the "key" are given, then both must point to the same
871 p = hash_get_mem (sm->tunnel_index_by_key, &key);
873 /* If the name is given, look it up */
875 n = hash_get_mem (sm->tunnel_index_by_name, a->name);
879 /* validate key/name parameters */
880 if (!a->is_del) /* adding a tunnel */
882 if (a->name && n) /* name given & exists already */
884 if (p) /* key exists already */
887 else /* deleting a tunnel */
889 if (!p) /* key doesn't exist */
891 if (a->name && !n) /* name given & it doesn't exist */
894 if (n) /* name given & found */
896 if (n[0] != p[0]) /* name and key do not point to the same thing */
902 if (a->is_del) /* delete the tunnel */
906 /* Delete existing tunnel */
907 t = pool_elt_at_index (sm->tunnels, p[0]);
909 ip6_delete_route_no_next_hop (&t->key.dst, t->dst_mask_width,
911 vec_free (t->rewrite);
912 /* Remove tunnel from any policy if associated */
913 if (t->policy_index != ~0)
915 pt = pool_elt_at_index (sm->policies, t->policy_index);
916 for (i = 0; i < vec_len (pt->tunnel_indices); i++)
918 if (pt->tunnel_indices[i] == t - sm->tunnels)
920 vec_delete (pt->tunnel_indices, 1, i);
924 clib_warning ("Tunnel index %d not found in policy_index %d",
925 t - sm->tunnels, pt - sm->policies);
927 /* If this is last tunnel in the policy, clean up the policy too */
928 if (vec_len (pt->tunnel_indices) == 0)
930 hash_unset_mem (sm->policy_index_by_policy_name, pt->name);
932 pool_put (sm->policies, pt);
936 /* Clean up the tunnel by name */
939 hash_unset_mem (sm->tunnel_index_by_name, t->name);
942 pool_put (sm->tunnels, t);
943 hp = hash_get_pair (sm->tunnel_index_by_key, &key);
944 key_copy = (void *) (hp->key);
945 hash_unset_mem (sm->tunnel_index_by_key, &key);
950 /* create a new tunnel */
951 pool_get (sm->tunnels, t);
952 memset (t, 0, sizeof (*t));
953 t->policy_index = ~0;
955 clib_memcpy (&t->key, &key, sizeof (t->key));
956 t->dst_mask_width = a->dst_mask_width;
957 t->rx_fib_index = rx_fib_index;
958 t->tx_fib_index = tx_fib_index;
960 if (!vec_len (a->segments))
961 /* there must be at least one segment... */
964 /* The first specified hop goes right into the dst address */
965 clib_memcpy (&t->first_hop, &a->segments[0], sizeof (ip6_address_t));
968 * Create the sr header rewrite string
969 * The list of segments needs an extra slot for the ultimate destination
970 * which is taken from the packet we add the SRH to.
972 header_length = sizeof (*h) +
973 sizeof (ip6_address_t) * (vec_len (a->segments) + 1 + vec_len (a->tags));
975 if (a->shared_secret)
977 /* Allocate a new key slot if we don't find the secret key */
978 hmac_key_index_u32 = 0;
979 (void) find_or_add_shared_secret (sm, a->shared_secret,
980 &hmac_key_index_u32);
982 /* Hey Vinz Clortho: Gozzer is pissed.. you're out of keys! */
983 if (hmac_key_index_u32 >= 256)
985 hmac_key_index = hmac_key_index_u32;
986 header_length += SHA256_DIGEST_LENGTH;
989 vec_validate (t->rewrite, header_length - 1);
991 h = (ip6_sr_header_t *) t->rewrite;
993 h->protocol = 0xFF; /* we don't know yet */
995 h->length = (header_length / 8) - 1;
996 h->type = ROUTING_HEADER_TYPE_SR;
998 /* first_segment and segments_left need to have the index of the last
999 * element in the list; a->segments has one element less than ends up
1000 * in the header (it does not have the DA in it), so vec_len(a->segments)
1001 * is the value we want.
1003 h->first_segment = h->segments_left = vec_len (a->segments);
1005 if (a->shared_secret)
1006 h->hmac_key = hmac_key_index & 0xFF;
1008 h->flags = a->flags_net_byte_order;
1010 /* Paint on the segment list, in reverse.
1011 * This is offset by one to leave room at the start for the ultimate
1014 addrp = h->segments + vec_len (a->segments);
1016 vec_foreach (this_address, a->segments)
1018 clib_memcpy (addrp->as_u8, this_address->as_u8, sizeof (ip6_address_t));
1023 * Since the ultimate destination address is not yet known, set that slot
1024 * to a value we will instantly recognize as bogus.
1026 memset (h->segments, 0xfe, sizeof (ip6_address_t));
1028 /* Paint on the tag list, not reversed */
1029 addrp = h->segments + vec_len (a->segments);
1031 vec_foreach (this_address, a->tags)
1033 clib_memcpy (addrp->as_u8, this_address->as_u8, sizeof (ip6_address_t));
1037 key_copy = vec_new (ip6_sr_tunnel_key_t, 1);
1038 clib_memcpy (key_copy, &key, sizeof (ip6_sr_tunnel_key_t));
1039 hash_set_mem (sm->tunnel_index_by_key, key_copy, t - sm->tunnels);
1042 * Stick the tunnel index into the rewrite header.
1044 * Unfortunately, inserting an SR header according to the various
1045 * RFC's requires parsing through the ip6 header, perhaps consing a
1046 * buffer onto the head of the vlib_buffer_t, etc. We don't use the
1047 * normal reverse bcopy rewrite code.
1049 * We don't handle ugly RFC-related cases yet, but I'm sure PL will complain
1052 dpo_set (&dpo, sr_dpo_type, DPO_PROTO_IP6, t - sm->tunnels);
1054 fib_prefix_t pfx = {
1055 .fp_proto = FIB_PROTOCOL_IP6,
1056 .fp_len = a->dst_mask_width,
1058 .ip6 = *a->dst_address,
1061 fib_table_entry_special_dpo_add (rx_fib_index,
1064 FIB_ENTRY_FLAG_EXCLUSIVE, &dpo);
1069 p = hash_get_mem (sm->policy_index_by_policy_name, a->policy_name);
1072 pt = pool_elt_at_index (sm->policies, p[0]);
1074 else /* no policy, lets create one */
1076 pool_get (sm->policies, pt);
1077 memset (pt, 0, sizeof (*pt));
1078 pt->name = format (0, "%s%c", a->policy_name, 0);
1079 hash_set_mem (sm->policy_index_by_policy_name, pt->name,
1081 p = hash_get_mem (sm->policy_index_by_policy_name, a->policy_name);
1083 vec_add1 (pt->tunnel_indices, t - sm->tunnels);
1085 clib_warning ("p is NULL!");
1086 t->policy_index = p ? p[0] : ~0; /* equiv. to (pt - sm->policies) */
1091 t->name = format (0, "%s%c", a->name, 0);
1092 hash_set_mem (sm->tunnel_index_by_name, t->name, t - sm->tunnels);
1099 * @brief no-op lock function.
1100 * The lifetime of the SR entry is managed by the control plane
1103 sr_dpo_lock (dpo_id_t * dpo)
1108 * @brief no-op unlock function.
1109 * The lifetime of the SR entry is managed by the control plane
1112 sr_dpo_unlock (dpo_id_t * dpo)
1117 format_sr_dpo (u8 * s, va_list * args)
1119 index_t index = va_arg (*args, index_t);
1120 CLIB_UNUSED (u32 indent) = va_arg (*args, u32);
1122 return (format (s, "SR: tunnel:[%d]", index));
1125 const static dpo_vft_t sr_vft = {
1126 .dv_lock = sr_dpo_lock,
1127 .dv_unlock = sr_dpo_unlock,
1128 .dv_format = format_sr_dpo,
1131 const static char *const sr_ip6_nodes[] = {
1136 const static char *const *const sr_nodes[DPO_PROTO_NUM] = {
1137 [DPO_PROTO_IP6] = sr_ip6_nodes,
1141 * @brief CLI parser for Add or Delete a Segment Routing tunnel.
1143 * @param vm vlib_main_t *
1144 * @param input unformat_input_t *
1145 * @param cmd vlib_cli_command_t *
1147 * @return error clib_error_t *
1149 static clib_error_t *
1150 sr_add_del_tunnel_command_fn (vlib_main_t * vm,
1151 unformat_input_t * input,
1152 vlib_cli_command_t * cmd)
1155 ip6_address_t src_address;
1156 int src_address_set = 0;
1157 ip6_address_t dst_address;
1159 int dst_address_set = 0;
1161 u8 *shared_secret = 0;
1163 u8 *policy_name = 0;
1164 u32 rx_table_id = 0;
1165 u32 tx_table_id = 0;
1166 ip6_address_t *segments = 0;
1167 ip6_address_t *this_seg;
1168 ip6_address_t *tags = 0;
1169 ip6_address_t *this_tag;
1170 ip6_sr_add_del_tunnel_args_t _a, *a = &_a;
1171 ip6_address_t next_address, tag;
1175 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1177 if (unformat (input, "del"))
1179 else if (unformat (input, "rx-fib-id %d", &rx_table_id))
1181 else if (unformat (input, "tx-fib-id %d", &tx_table_id))
1183 else if (unformat (input, "src %U", unformat_ip6_address, &src_address))
1184 src_address_set = 1;
1185 else if (unformat (input, "name %s", &name))
1187 else if (unformat (input, "policy %s", &policy_name))
1189 else if (unformat (input, "dst %U/%d",
1190 unformat_ip6_address, &dst_address, &dst_mask_width))
1191 dst_address_set = 1;
1192 else if (unformat (input, "next %U", unformat_ip6_address,
1195 vec_add2 (segments, this_seg, 1);
1196 clib_memcpy (this_seg->as_u8, next_address.as_u8,
1197 sizeof (*this_seg));
1199 else if (unformat (input, "tag %U", unformat_ip6_address, &tag))
1201 vec_add2 (tags, this_tag, 1);
1202 clib_memcpy (this_tag->as_u8, tag.as_u8, sizeof (*this_tag));
1204 else if (unformat (input, "clean"))
1205 flags |= IP6_SR_HEADER_FLAG_CLEANUP;
1206 else if (unformat (input, "protected"))
1207 flags |= IP6_SR_HEADER_FLAG_PROTECTED;
1208 else if (unformat (input, "key %s", &shared_secret))
1209 /* Do not include the trailing NULL byte. Guaranteed interop issue */
1210 _vec_len (shared_secret) -= 1;
1211 else if (unformat (input, "InPE %d", &pl_index))
1213 if (pl_index <= 0 || pl_index > 4)
1215 pl_index_range_error:
1216 return clib_error_return
1217 (0, "Policy List Element Index %d out of range (1-4)",
1221 flags |= IP6_SR_HEADER_FLAG_PL_ELT_INGRESS_PE
1222 << ip6_sr_policy_list_shift_from_index (pl_index);
1224 else if (unformat (input, "EgPE %d", &pl_index))
1226 if (pl_index <= 0 || pl_index > 4)
1227 goto pl_index_range_error;
1228 flags |= IP6_SR_HEADER_FLAG_PL_ELT_EGRESS_PE
1229 << ip6_sr_policy_list_shift_from_index (pl_index);
1231 else if (unformat (input, "OrgSrc %d", &pl_index))
1233 if (pl_index <= 0 || pl_index > 4)
1234 goto pl_index_range_error;
1235 flags |= IP6_SR_HEADER_FLAG_PL_ELT_ORIG_SRC_ADDR
1236 << ip6_sr_policy_list_shift_from_index (pl_index);
1242 if (!src_address_set)
1243 return clib_error_return (0, "src address required");
1245 if (!dst_address_set)
1246 return clib_error_return (0, "dst address required");
1249 return clib_error_return (0, "at least one sr segment required");
1251 memset (a, 0, sizeof (*a));
1252 a->src_address = &src_address;
1253 a->dst_address = &dst_address;
1254 a->dst_mask_width = dst_mask_width;
1255 a->segments = segments;
1257 a->flags_net_byte_order = clib_host_to_net_u16 (flags);
1259 a->rx_table_id = rx_table_id;
1260 a->tx_table_id = tx_table_id;
1261 a->shared_secret = shared_secret;
1268 if (vec_len (policy_name))
1269 a->policy_name = policy_name;
1273 rv = ip6_sr_add_del_tunnel (a);
1275 vec_free (segments);
1277 vec_free (shared_secret);
1285 return clib_error_return (0, "SR tunnel src %U dst %U already exists",
1286 format_ip6_address, &src_address,
1287 format_ip6_address, &dst_address);
1290 return clib_error_return (0, "SR tunnel src %U dst %U does not exist",
1291 format_ip6_address, &src_address,
1292 format_ip6_address, &dst_address);
1295 return clib_error_return (0, "FIB table %d does not exist",
1299 return clib_error_return (0, "At least one segment is required");
1302 return clib_error_return (0, "BUG: ip6_sr_add_del_tunnel returns %d",
1310 VLIB_CLI_COMMAND (sr_tunnel_command, static) = {
1311 .path = "sr tunnel",
1313 "sr tunnel [del] [name <name>] src <addr> dst <addr> [next <addr>] "
1314 "[clean] [reroute] [key <secret>] [policy <policy_name>]"
1315 "[rx-fib-id <fib_id>] [tx-fib-id <fib_id>]",
1316 .function = sr_add_del_tunnel_command_fn,
1321 * @brief Display Segment Routing tunnel
1323 * @param vm vlib_main_t *
1324 * @param t ip6_sr_tunnel_t *
1328 ip6_sr_tunnel_display (vlib_main_t * vm, ip6_sr_tunnel_t * t)
1330 ip6_sr_main_t *sm = &sr_main;
1331 ip6_fib_t *rx_fib, *tx_fib;
1332 ip6_sr_policy_t *pt;
1334 rx_fib = ip6_fib_get (t->rx_fib_index);
1335 tx_fib = ip6_fib_get (t->tx_fib_index);
1338 vlib_cli_output (vm, "sr tunnel name: %s", (char *) t->name);
1340 vlib_cli_output (vm, "src %U dst %U first hop %U",
1341 format_ip6_address, &t->key.src,
1342 format_ip6_address, &t->key.dst,
1343 format_ip6_address, &t->first_hop);
1344 vlib_cli_output (vm, " rx-fib-id %d tx-fib-id %d",
1345 rx_fib->table_id, tx_fib->table_id);
1346 vlib_cli_output (vm, " sr: %U", format_ip6_sr_header, t->rewrite,
1347 0 /* print_hmac */ );
1349 if (t->policy_index != ~0)
1351 pt = pool_elt_at_index (sm->policies, t->policy_index);
1352 vlib_cli_output (vm, "sr policy: %s", (char *) pt->name);
1354 vlib_cli_output (vm, "-------");
1360 * @brief CLI Parser for Display Segment Routing tunnel
1362 * @param vm vlib_main_t *
1363 * @param input unformat_input_t *
1364 * @param cmd vlib_cli_command_t *
1366 * @return error clib_error_t *
1368 static clib_error_t *
1369 show_sr_tunnel_fn (vlib_main_t * vm,
1370 unformat_input_t * input, vlib_cli_command_t * cmd)
1372 static ip6_sr_tunnel_t **tunnels;
1374 ip6_sr_main_t *sm = &sr_main;
1379 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1381 if (unformat (input, "name %s", &name))
1383 p = hash_get_mem (sm->tunnel_index_by_name, name);
1385 vlib_cli_output (vm, "No SR tunnel with name: %s. Showing all.",
1392 vec_reset_length (tunnels);
1394 if (!p) /* Either name parm not passed or no tunnel with that name found, show all */
1397 pool_foreach (t, sm->tunnels,
1399 vec_add1 (tunnels, t);
1403 else /* Just show the one tunnel by name */
1404 vec_add1 (tunnels, &sm->tunnels[p[0]]);
1406 if (vec_len (tunnels) == 0)
1407 vlib_cli_output (vm, "No SR tunnels configured");
1409 for (i = 0; i < vec_len (tunnels); i++)
1412 ip6_sr_tunnel_display (vm, t);
1419 VLIB_CLI_COMMAND (show_sr_tunnel_command, static) = {
1420 .path = "show sr tunnel",
1421 .short_help = "show sr tunnel [name <sr-tunnel-name>]",
1422 .function = show_sr_tunnel_fn,
1427 * @brief Add or Delete a Segment Routing policy
1429 * @param a ip6_sr_add_del_policy_args_t *
1431 * @return retval int
1434 ip6_sr_add_del_policy (ip6_sr_add_del_policy_args_t * a)
1436 ip6_sr_main_t *sm = &sr_main;
1438 ip6_sr_tunnel_t *t = 0;
1439 ip6_sr_policy_t *policy;
1440 u32 *tunnel_indices = 0;
1447 p = hash_get_mem (sm->policy_index_by_policy_name, a->name);
1449 return -6; /* policy name not found */
1451 policy = pool_elt_at_index (sm->policies, p[0]);
1453 vec_foreach_index (i, policy->tunnel_indices)
1455 t = pool_elt_at_index (sm->tunnels, policy->tunnel_indices[i]);
1456 t->policy_index = ~0;
1458 hash_unset_mem (sm->policy_index_by_policy_name, a->name);
1459 pool_put (sm->policies, policy);
1464 if (!vec_len (a->tunnel_names))
1465 return -3; /*tunnel name is required case */
1467 vec_reset_length (tunnel_indices);
1468 /* Check tunnel names, add tunnel_index to policy */
1469 for (i = 0; i < vec_len (a->tunnel_names); i++)
1471 p = hash_get_mem (sm->tunnel_index_by_name, a->tunnel_names[i]);
1473 return -4; /* tunnel name not found case */
1475 t = pool_elt_at_index (sm->tunnels, p[0]);
1477 No need to check t==0. -3 condition above ensures name
1479 if (t->policy_index != ~0)
1480 return -5; /* tunnel name already associated with a policy */
1482 /* Add to tunnel indicies */
1483 vec_add1 (tunnel_indices, p[0]);
1486 /* Add policy to ip6_sr_main_t */
1487 pool_get (sm->policies, policy);
1488 policy->name = a->name;
1489 policy->tunnel_indices = tunnel_indices;
1490 hash_set_mem (sm->policy_index_by_policy_name, policy->name,
1491 policy - sm->policies);
1493 /* Yes, this could be construed as overkill but the last thing you should do is set
1494 the policy_index on the tunnel after everything is set in ip6_sr_main_t.
1495 If this is deemed overly cautious, could set this in the vec_len(tunnel_names) loop.
1497 for (i = 0; i < vec_len (policy->tunnel_indices); i++)
1499 t = pool_elt_at_index (sm->tunnels, policy->tunnel_indices[i]);
1500 t->policy_index = policy - sm->policies;
1507 * @brief CLI Parser for Add or Delete a Segment Routing policy
1509 * @param vm vlib_main_t *
1510 * @param input unformat_input_t *
1511 * @param cmd vlib_cli_command_t *
1513 * @return error clib_error_t *
1515 static clib_error_t *
1516 sr_add_del_policy_command_fn (vlib_main_t * vm,
1517 unformat_input_t * input,
1518 vlib_cli_command_t * cmd)
1521 u8 **tunnel_names = 0;
1522 u8 *tunnel_name = 0;
1524 ip6_sr_add_del_policy_args_t _a, *a = &_a;
1527 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1529 if (unformat (input, "del"))
1531 else if (unformat (input, "name %s", &name))
1533 else if (unformat (input, "tunnel %s", &tunnel_name))
1537 vec_add1 (tunnel_names, tunnel_name);
1546 return clib_error_return (0, "name of SR policy required");
1549 memset (a, 0, sizeof (*a));
1553 a->tunnel_names = tunnel_names;
1555 rv = ip6_sr_add_del_policy (a);
1557 vec_free (tunnel_names);
1565 return clib_error_return (0,
1566 "tunnel name to associate to SR policy is required");
1569 return clib_error_return (0, "tunnel name not found");
1572 return clib_error_return (0, "tunnel already associated with policy");
1575 return clib_error_return (0, "policy name %s not found", name);
1578 return clib_error_return (0, "TODO: deleting policy name %s", name);
1581 return clib_error_return (0, "BUG: ip6_sr_add_del_policy returns %d",
1589 VLIB_CLI_COMMAND (sr_policy_command, static) = {
1590 .path = "sr policy",
1592 "sr policy [del] name <policy-name> tunnel <sr-tunnel-name> [tunnel <sr-tunnel-name>]*",
1593 .function = sr_add_del_policy_command_fn,
1598 * @brief CLI Parser for Displaying Segment Routing policy
1600 * @param vm vlib_main_t *
1601 * @param input unformat_input_t *
1602 * @param cmd vlib_cli_command_t *
1604 * @return error clib_error_t *
1606 static clib_error_t *
1607 show_sr_policy_fn (vlib_main_t * vm,
1608 unformat_input_t * input, vlib_cli_command_t * cmd)
1610 static ip6_sr_policy_t **policies;
1611 ip6_sr_policy_t *policy;
1613 ip6_sr_main_t *sm = &sr_main;
1618 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1620 if (unformat (input, "name %s", &name))
1622 p = hash_get_mem (sm->policy_index_by_policy_name, name);
1624 vlib_cli_output (vm,
1625 "policy with name %s not found. Showing all.",
1632 vec_reset_length (policies);
1634 if (!p) /* Either name parm not passed or no policy with that name found, show all */
1637 pool_foreach (policy, sm->policies,
1639 vec_add1 (policies, policy);
1643 else /* Just show the one policy by name and a summary of tunnel names */
1645 policy = pool_elt_at_index (sm->policies, p[0]);
1646 vec_add1 (policies, policy);
1649 if (vec_len (policies) == 0)
1650 vlib_cli_output (vm, "No SR policies configured");
1652 for (i = 0; i < vec_len (policies); i++)
1654 policy = policies[i];
1657 vlib_cli_output (vm, "SR policy name: %s", (char *) policy->name);
1658 for (j = 0; j < vec_len (policy->tunnel_indices); j++)
1660 t = pool_elt_at_index (sm->tunnels, policy->tunnel_indices[j]);
1661 ip6_sr_tunnel_display (vm, t);
1670 VLIB_CLI_COMMAND (show_sr_policy_command, static) = {
1671 .path = "show sr policy",
1672 .short_help = "show sr policy [name <sr-policy-name>]",
1673 .function = show_sr_policy_fn,
1678 * @brief Add or Delete a mapping of IP6 multicast address
1679 * to Segment Routing policy.
1681 * @param a ip6_sr_add_del_multicastmap_args_t *
1683 * @return retval int
1686 ip6_sr_add_del_multicastmap (ip6_sr_add_del_multicastmap_args_t * a)
1690 ip6_sr_main_t *sm = &sr_main;
1691 ip6_sr_policy_t *pt;
1695 /* clean up the adjacency */
1697 hash_get_mem (sm->policy_index_by_multicast_address,
1698 a->multicast_address);
1702 /* Get our policy by policy_name */
1703 p = hash_get_mem (sm->policy_index_by_policy_name, a->policy_name);
1709 pt = pool_elt_at_index (sm->policies, p[0]);
1712 Get the first tunnel associated with policy populate the fib adjacency.
1713 From there, since this tunnel will have it's policy_index != ~0 it will
1714 be the trigger in the dual_loop to pull up the policy and make a copy-rewrite
1715 for each tunnel in the policy
1718 t = pool_elt_at_index (sm->tunnels, pt->tunnel_indices[0]);
1721 * Stick the tunnel index into the rewrite header.
1723 * Unfortunately, inserting an SR header according to the various
1724 * RFC's requires parsing through the ip6 header, perhaps consing a
1725 * buffer onto the head of the vlib_buffer_t, etc. We don't use the
1726 * normal reverse bcopy rewrite code.
1728 * We don't handle ugly RFC-related cases yet, but I'm sure PL will complain
1731 dpo_id_t dpo = DPO_NULL;
1733 dpo_set (&dpo, sr_dpo_type, DPO_PROTO_IP6, t - sm->tunnels);
1735 /* Construct a FIB entry for multicast using the rx/tx fib from the first tunnel */
1736 fib_prefix_t pfx = {
1737 .fp_proto = FIB_PROTOCOL_IP6,
1740 .ip6 = *a->multicast_address,
1743 fib_table_entry_special_dpo_add (t->rx_fib_index,
1746 FIB_ENTRY_FLAG_EXCLUSIVE, &dpo);
1750 mcast_copy = vec_new (ip6_address_t, 1);
1751 memcpy (mcast_copy, a->multicast_address, sizeof (ip6_address_t));
1755 hash_unset_mem (sm->policy_index_by_multicast_address, mcast_copy);
1756 vec_free (mcast_copy);
1761 hash_set_mem (sm->policy_index_by_multicast_address, mcast_copy,
1769 * @brief CLI Parser for Adding or Delete a mapping of IP6 multicast address
1770 * to Segment Routing policy.
1772 * @param vm vlib_main_t *
1773 * @param input unformat_input_t *
1774 * @param cmd vlib_cli_command_t *
1776 * @return error clib_error_t *
1778 static clib_error_t *
1779 sr_add_del_multicast_map_command_fn (vlib_main_t * vm,
1780 unformat_input_t * input,
1781 vlib_cli_command_t * cmd)
1784 ip6_address_t multicast_address;
1785 u8 *policy_name = 0;
1786 int multicast_address_set = 0;
1787 ip6_sr_add_del_multicastmap_args_t _a, *a = &_a;
1790 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1792 if (unformat (input, "del"))
1796 (input, "address %U", unformat_ip6_address, &multicast_address))
1797 multicast_address_set = 1;
1798 else if (unformat (input, "sr-policy %s", &policy_name))
1804 if (!is_del && !policy_name)
1805 return clib_error_return (0, "name of sr policy required");
1807 if (!multicast_address_set)
1808 return clib_error_return (0, "multicast address required");
1810 memset (a, 0, sizeof (*a));
1813 a->multicast_address = &multicast_address;
1814 a->policy_name = policy_name;
1816 #if DPDK > 0 /*Cannot call replicate or configure multicast map yet without DPDK */
1817 rv = ip6_sr_add_del_multicastmap (a);
1819 return clib_error_return (0,
1820 "cannot use multicast replicate spray case without DPDK installed");
1828 return clib_error_return (0, "no policy with name: %s", policy_name);
1831 return clib_error_return (0, "multicast map someting ");
1834 return clib_error_return (0,
1835 "tunnel name to associate to SR policy is required");
1838 return clib_error_return (0, "TODO: deleting policy name %s",
1842 return clib_error_return (0, "BUG: ip6_sr_add_del_policy returns %d",
1852 VLIB_CLI_COMMAND (sr_multicast_map_command, static) = {
1853 .path = "sr multicast-map",
1855 "sr multicast-map address <multicast-ip6-address> sr-policy <sr-policy-name> [del]",
1856 .function = sr_add_del_multicast_map_command_fn,
1861 * @brief CLI Parser for Displaying a mapping of IP6 multicast address
1862 * to Segment Routing policy.
1864 * @param vm vlib_main_t *
1865 * @param input unformat_input_t *
1866 * @param cmd vlib_cli_command_t *
1868 * @return error clib_error_t *
1870 static clib_error_t *
1871 show_sr_multicast_map_fn (vlib_main_t * vm,
1872 unformat_input_t * input, vlib_cli_command_t * cmd)
1874 ip6_sr_main_t *sm = &sr_main;
1877 ip6_address_t multicast_address;
1878 ip6_sr_policy_t *pt;
1880 /* pull all entries from the hash table into vector for display */
1883 hash_foreach_mem (key, value, sm->policy_index_by_multicast_address,
1886 vlib_cli_output (vm, "no multicast maps configured");
1889 multicast_address = *((ip6_address_t *)key);
1890 pt = pool_elt_at_index (sm->policies, value);
1893 vlib_cli_output (vm, "address: %U policy: %s",
1894 format_ip6_address, &multicast_address,
1898 vlib_cli_output (vm, "BUG: policy not found for address: %U with policy index %d",
1899 format_ip6_address, &multicast_address,
1911 VLIB_CLI_COMMAND (show_sr_multicast_map_command, static) = {
1912 .path = "show sr multicast-map",
1913 .short_help = "show sr multicast-map",
1914 .function = show_sr_multicast_map_fn,
1919 #define foreach_sr_fix_dst_addr_next \
1920 _(DROP, "error-drop")
1923 * @brief Struct for valid next-nodes for SR fix destination address node
1927 #define _(s,n) SR_FIX_DST_ADDR_NEXT_##s,
1928 foreach_sr_fix_dst_addr_next
1930 SR_FIX_DST_ADDR_N_NEXT,
1931 } sr_fix_dst_addr_next_t;
1934 * @brief Error strings for SR Fix Destination rewrite
1936 static char *sr_fix_dst_error_strings[] = {
1937 #define sr_fix_dst_error(n,s) s,
1938 #include "sr_fix_dst_error.def"
1939 #undef sr_fix_dst_error
1943 * @brief Struct for errors for SR Fix Destination rewrite
1947 #define sr_fix_dst_error(n,s) SR_FIX_DST_ERROR_##n,
1948 #include "sr_fix_dst_error.def"
1949 #undef sr_fix_dst_error
1951 } sr_fix_dst_error_t;
1954 * @brief Information for fix address trace
1958 ip6_address_t src, dst;
1962 } sr_fix_addr_trace_t;
1965 * @brief Formatter for fix address trace
1968 format_sr_fix_addr_trace (u8 * s, va_list * args)
1970 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1971 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1972 sr_fix_addr_trace_t *t = va_arg (*args, sr_fix_addr_trace_t *);
1973 vnet_hw_interface_t *hi = 0;
1974 ip_adjacency_t *adj;
1975 ip6_main_t *im = &ip6_main;
1976 ip_lookup_main_t *lm = &im->lookup_main;
1977 vnet_main_t *vnm = vnet_get_main ();
1979 if (t->adj_index != ~0)
1981 adj = ip_get_adjacency (lm, t->adj_index);
1982 hi = vnet_get_sup_hw_interface (vnm, adj->rewrite_header.sw_if_index);
1985 s = format (s, "SR-FIX_ADDR: next %s ip6 src %U dst %U\n",
1986 (t->next_index == SR_FIX_DST_ADDR_NEXT_DROP)
1987 ? "drop" : "output",
1988 format_ip6_address, &t->src, format_ip6_address, &t->dst);
1989 if (t->next_index != SR_FIX_DST_ADDR_NEXT_DROP)
1992 format (s, "%U\n", format_ip6_sr_header, t->sr, 1 /* print_hmac */ );
1994 format (s, " output via %s",
1995 hi ? (char *) (hi->name) : "Invalid adj");
2001 * @brief Fix SR destination address - dual-loop
2003 * @node sr-fix-dst-addr
2004 * @param vm vlib_main_t *
2005 * @param node vlib_node_runtime_t *
2006 * @param from_frame vlib_frame_t *
2008 * @return from_frame->n_vectors uword
2011 sr_fix_dst_addr (vlib_main_t * vm,
2012 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
2014 u32 n_left_from, next_index, *from, *to_next;
2015 ip6_main_t *im = &ip6_main;
2016 ip_lookup_main_t *lm = &im->lookup_main;
2018 from = vlib_frame_vector_args (from_frame);
2019 n_left_from = from_frame->n_vectors;
2021 next_index = node->cached_next_index;
2023 while (n_left_from > 0)
2027 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
2030 while (0 && n_left_from >= 4 && n_left_to_next >= 2)
2033 __attribute__ ((unused)) vlib_buffer_t *b0, *b1;
2034 u32 next0 = SR_FIX_DST_ADDR_NEXT_DROP;
2035 u32 next1 = SR_FIX_DST_ADDR_NEXT_DROP;
2037 /* Prefetch next iteration. */
2039 vlib_buffer_t *p2, *p3;
2041 p2 = vlib_get_buffer (vm, from[2]);
2042 p3 = vlib_get_buffer (vm, from[3]);
2044 vlib_prefetch_buffer_header (p2, LOAD);
2045 vlib_prefetch_buffer_header (p3, LOAD);
2054 n_left_to_next -= 2;
2057 b0 = vlib_get_buffer (vm, bi0);
2058 b1 = vlib_get_buffer (vm, bi1);
2061 vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
2062 to_next, n_left_to_next,
2063 bi0, bi1, next0, next1);
2067 while (n_left_from > 0 && n_left_to_next > 0)
2072 ip_adjacency_t *adj0;
2073 ip6_sr_header_t *sr0;
2074 u32 next0 = SR_FIX_DST_ADDR_NEXT_DROP;
2075 ip6_address_t *new_dst0;
2076 ethernet_header_t *eh0;
2083 n_left_to_next -= 1;
2085 b0 = vlib_get_buffer (vm, bi0);
2088 ip_get_adjacency (lm, vnet_buffer (b0)->ip.adj_index[VLIB_TX]);
2089 next0 = adj0->mcast_group_index;
2091 /* We should be pointing at an Ethernet header... */
2092 eh0 = vlib_buffer_get_current (b0);
2093 ip0 = (ip6_header_t *) (eh0 + 1);
2094 sr0 = (ip6_sr_header_t *) (ip0 + 1);
2096 /* We'd better find an SR header... */
2097 if (PREDICT_FALSE (ip0->protocol != IPPROTO_IPV6_ROUTE))
2099 b0->error = node->errors[SR_FIX_DST_ERROR_NO_SR_HEADER];
2105 * We get here from sr_rewrite or sr_local, with
2106 * sr->segments_left pointing at the (copy of the original) dst
2107 * address. Use it, then increment sr0->segments_left.
2110 /* Out of segments? Turf the packet */
2111 if (PREDICT_FALSE (sr0->segments_left == 0))
2113 b0->error = node->errors[SR_FIX_DST_ERROR_NO_MORE_SEGMENTS];
2118 * Rewrite the packet with the original dst address
2119 * We assume that the last segment (in processing order) contains
2120 * the original dst address. The list is reversed, so sr0->segments
2121 * contains the original dst address.
2123 new_dst0 = sr0->segments;
2124 ip0->dst_address.as_u64[0] = new_dst0->as_u64[0];
2125 ip0->dst_address.as_u64[1] = new_dst0->as_u64[1];
2130 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
2132 sr_fix_addr_trace_t *t = vlib_add_trace (vm, node,
2134 t->next_index = next0;
2137 if (next0 != SR_FIX_DST_ADDR_NEXT_DROP)
2139 t->adj_index = vnet_buffer (b0)->ip.adj_index[VLIB_TX];
2140 clib_memcpy (t->src.as_u8, ip0->src_address.as_u8,
2141 sizeof (t->src.as_u8));
2142 clib_memcpy (t->dst.as_u8, ip0->dst_address.as_u8,
2143 sizeof (t->dst.as_u8));
2144 clib_memcpy (t->sr, sr0, sizeof (t->sr));
2148 vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
2149 to_next, n_left_to_next,
2153 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
2155 return from_frame->n_vectors;
2160 VLIB_REGISTER_NODE (sr_fix_dst_addr_node) = {
2161 .function = sr_fix_dst_addr,
2162 .name = "sr-fix-dst-addr",
2163 /* Takes a vector of packets. */
2164 .vector_size = sizeof (u32),
2165 .format_trace = format_sr_fix_addr_trace,
2166 .format_buffer = format_ip6_sr_header_with_length,
2168 .runtime_data_bytes = 0,
2170 .n_errors = SR_FIX_DST_N_ERROR,
2171 .error_strings = sr_fix_dst_error_strings,
2173 .n_next_nodes = SR_FIX_DST_ADDR_N_NEXT,
2175 #define _(s,n) [SR_FIX_DST_ADDR_NEXT_##s] = n,
2176 foreach_sr_fix_dst_addr_next
2181 VLIB_NODE_FUNCTION_MULTIARCH (sr_fix_dst_addr_node, sr_fix_dst_addr)
2184 static clib_error_t *
2185 sr_init (vlib_main_t * vm)
2187 ip6_sr_main_t *sm = &sr_main;
2188 clib_error_t *error = 0;
2189 vlib_node_t *ip6_lookup_node, *ip6_rewrite_node;
2191 if ((error = vlib_call_init_function (vm, ip_main_init)))
2194 if ((error = vlib_call_init_function (vm, ip6_lookup_init)))
2198 sm->vnet_main = vnet_get_main ();
2200 vec_validate (sm->hmac_keys, 0);
2201 sm->hmac_keys[0].shared_secret = (u8 *) 0xdeadbeef;
2203 sm->tunnel_index_by_key =
2204 hash_create_mem (0, sizeof (ip6_sr_tunnel_key_t), sizeof (uword));
2206 sm->tunnel_index_by_name = hash_create_string (0, sizeof (uword));
2208 sm->policy_index_by_policy_name = hash_create_string (0, sizeof (uword));
2210 sm->policy_index_by_multicast_address =
2211 hash_create_mem (0, sizeof (ip6_address_t), sizeof (uword));
2213 sm->hmac_key_by_shared_secret = hash_create_string (0, sizeof (uword));
2215 ip6_register_protocol (IPPROTO_IPV6_ROUTE, sr_local_node.index);
2217 ip6_lookup_node = vlib_get_node_by_name (vm, (u8 *) "ip6-lookup");
2218 ASSERT (ip6_lookup_node);
2220 ip6_rewrite_node = vlib_get_node_by_name (vm, (u8 *) "ip6-rewrite");
2221 ASSERT (ip6_rewrite_node);
2223 #if DPDK > 0 /* Cannot run replicate without DPDK */
2224 /* Add a disposition to sr_replicate for the sr multicast replicate node */
2225 sm->ip6_lookup_sr_replicate_index =
2226 vlib_node_add_next (vm, ip6_lookup_node->index, sr_replicate_node.index);
2229 /* Add a disposition to ip6_rewrite for the sr dst address hack node */
2230 sm->ip6_rewrite_sr_next_index =
2231 vlib_node_add_next (vm, ip6_rewrite_node->index,
2232 sr_fix_dst_addr_node.index);
2234 OpenSSL_add_all_digests ();
2236 sm->md = (void *) EVP_get_digestbyname ("sha1");
2237 sm->hmac_ctx = clib_mem_alloc (sizeof (HMAC_CTX));
2239 sr_dpo_type = dpo_register_new_type (&sr_vft, sr_nodes);
2244 VLIB_INIT_FUNCTION (sr_init);
2247 * @brief Definition of next-nodes for SR local
2249 #define foreach_sr_local_next \
2250 _ (ERROR, "error-drop") \
2251 _ (IP6_LOOKUP, "ip6-lookup")
2254 * @brief Struct for definition of next-nodes for SR local
2258 #define _(s,n) SR_LOCAL_NEXT_##s,
2259 foreach_sr_local_next
2265 * @brief Struct for packet trace of SR local
2271 ip6_address_t src, dst;
2277 * @brief Definition of SR local error-strings
2279 static char *sr_local_error_strings[] = {
2280 #define sr_error(n,s) s,
2281 #include "sr_error.def"
2286 * @brief Struct for definition of SR local error-strings
2290 #define sr_error(n,s) SR_LOCAL_ERROR_##n,
2291 #include "sr_error.def"
2297 * @brief Format SR local trace
2300 * @param args va_list *
2305 format_sr_local_trace (u8 * s, va_list * args)
2307 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
2308 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
2309 sr_local_trace_t *t = va_arg (*args, sr_local_trace_t *);
2311 s = format (s, "SR-LOCAL: src %U dst %U len %u next_index %d",
2312 format_ip6_address, &t->src,
2313 format_ip6_address, &t->dst, t->length, t->next_index);
2316 format (s, "\n %U", format_ip6_sr_header, t->sr, 1 /* print_hmac */ );
2318 s = format (s, "\n popped SR header");
2324 /* $$$$ fixme: smp, don't copy data, cache input, output (maybe) */
2326 * @brief Validate the SR HMAC
2328 * @param sm ip6_sr_main_t *
2329 * @param ip ip6_header_t *
2330 * @param sr ip6_sr_header_t *
2332 * @return retval int
2335 sr_validate_hmac (ip6_sr_main_t * sm, ip6_header_t * ip, ip6_sr_header_t * sr)
2341 ip6_address_t *addrp;
2343 ip6_sr_hmac_key_t *hmac_key;
2344 static u8 *signature;
2347 key_index = sr->hmac_key;
2349 /* No signature? Pass... */
2353 /* We don't know about this key? Fail... */
2354 if (key_index >= vec_len (sm->hmac_keys))
2357 vec_validate (signature, SHA256_DIGEST_LENGTH - 1);
2359 hmac_key = sm->hmac_keys + key_index;
2361 vec_reset_length (keybuf);
2363 /* pkt ip6 src address */
2364 vec_add2 (keybuf, copy_target, sizeof (ip6_address_t));
2365 clib_memcpy (copy_target, ip->src_address.as_u8, sizeof (ip6_address_t));
2368 vec_add2 (keybuf, copy_target, 1);
2369 copy_target[0] = sr->first_segment;
2371 /* octet w/ bit 0 = "clean" flag */
2372 vec_add2 (keybuf, copy_target, 1);
2374 = (sr->flags & clib_host_to_net_u16 (IP6_SR_HEADER_FLAG_CLEANUP))
2378 vec_add2 (keybuf, copy_target, 1);
2379 copy_target[0] = sr->hmac_key;
2381 first_segment = sr->first_segment;
2383 addrp = sr->segments;
2386 for (i = 0; i <= first_segment; i++)
2388 vec_add2 (keybuf, copy_target, sizeof (ip6_address_t));
2389 clib_memcpy (copy_target, addrp->as_u8, sizeof (ip6_address_t));
2394 clib_warning ("verify key index %d keybuf: %U", key_index,
2395 format_hex_bytes, keybuf, vec_len (keybuf));
2399 /* SHA1 is shorter than SHA-256 */
2400 memset (signature, 0, vec_len (signature));
2402 HMAC_CTX_init (sm->hmac_ctx);
2403 if (!HMAC_Init (sm->hmac_ctx, hmac_key->shared_secret,
2404 vec_len (hmac_key->shared_secret), sm->md))
2405 clib_warning ("barf1");
2406 if (!HMAC_Update (sm->hmac_ctx, keybuf, vec_len (keybuf)))
2407 clib_warning ("barf2");
2408 if (!HMAC_Final (sm->hmac_ctx, signature, &sig_len))
2409 clib_warning ("barf3");
2410 HMAC_CTX_cleanup (sm->hmac_ctx);
2413 clib_warning ("computed signature len %d, value %U", sig_len,
2414 format_hex_bytes, signature, vec_len (signature));
2416 /* Point at the SHA signature in the packet */
2419 clib_warning ("read signature %U", format_hex_bytes, addrp,
2420 SHA256_DIGEST_LENGTH);
2422 return memcmp (signature, addrp, SHA256_DIGEST_LENGTH);
2426 * @brief SR local node
2429 * @param vm vlib_main_t *
2430 * @param node vlib_node_runtime_t *
2431 * @param from_frame vlib_frame_t *
2433 * @return from_frame->n_vectors uword
2436 sr_local (vlib_main_t * vm,
2437 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
2439 u32 n_left_from, next_index, *from, *to_next;
2440 ip6_sr_main_t *sm = &sr_main;
2441 u32 (*sr_local_cb) (vlib_main_t *, vlib_node_runtime_t *,
2442 vlib_buffer_t *, ip6_header_t *, ip6_sr_header_t *);
2443 sr_local_cb = sm->sr_local_cb;
2445 from = vlib_frame_vector_args (from_frame);
2446 n_left_from = from_frame->n_vectors;
2448 next_index = node->cached_next_index;
2450 while (n_left_from > 0)
2454 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
2456 while (n_left_from >= 4 && n_left_to_next >= 2)
2459 vlib_buffer_t *b0, *b1;
2460 ip6_header_t *ip0, *ip1;
2461 ip6_sr_header_t *sr0, *sr1;
2462 ip6_address_t *new_dst0, *new_dst1;
2463 u32 next0 = SR_LOCAL_NEXT_IP6_LOOKUP;
2464 u32 next1 = SR_LOCAL_NEXT_IP6_LOOKUP;
2465 /* Prefetch next iteration. */
2467 vlib_buffer_t *p2, *p3;
2469 p2 = vlib_get_buffer (vm, from[2]);
2470 p3 = vlib_get_buffer (vm, from[3]);
2472 vlib_prefetch_buffer_header (p2, LOAD);
2473 vlib_prefetch_buffer_header (p3, LOAD);
2475 CLIB_PREFETCH (p2->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD);
2476 CLIB_PREFETCH (p3->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD);
2485 n_left_to_next -= 2;
2489 b0 = vlib_get_buffer (vm, bi0);
2490 ip0 = vlib_buffer_get_current (b0);
2491 sr0 = (ip6_sr_header_t *) (ip0 + 1);
2493 if (PREDICT_FALSE (sr0->type != ROUTING_HEADER_TYPE_SR))
2495 next0 = SR_LOCAL_NEXT_ERROR;
2497 node->errors[SR_LOCAL_ERROR_BAD_ROUTING_HEADER_TYPE];
2501 /* Out of segments? Turf the packet */
2502 if (PREDICT_FALSE (sr0->segments_left == 0))
2504 next0 = SR_LOCAL_NEXT_ERROR;
2505 b0->error = node->errors[SR_LOCAL_ERROR_NO_MORE_SEGMENTS];
2509 if (PREDICT_FALSE (sm->validate_hmac))
2511 if (sr_validate_hmac (sm, ip0, sr0))
2513 next0 = SR_LOCAL_NEXT_ERROR;
2514 b0->error = node->errors[SR_LOCAL_ERROR_HMAC_INVALID];
2519 next0 = sr_local_cb ? sr_local_cb (vm, node, b0, ip0, sr0) : next0;
2522 * To suppress rewrite, return ~SR_LOCAL_NEXT_xxx
2524 if (PREDICT_FALSE (next0 & 0x80000000))
2526 next0 ^= 0xFFFFFFFF;
2527 if (PREDICT_FALSE (next0 == SR_LOCAL_NEXT_ERROR))
2528 b0->error = node->errors[SR_LOCAL_ERROR_APP_CALLBACK];
2534 segment_index0 = sr0->segments_left - 1;
2536 /* Rewrite the packet */
2537 new_dst0 = (ip6_address_t *) (sr0->segments + segment_index0);
2538 ip0->dst_address.as_u64[0] = new_dst0->as_u64[0];
2539 ip0->dst_address.as_u64[1] = new_dst0->as_u64[1];
2541 if (PREDICT_TRUE (sr0->segments_left > 0))
2542 sr0->segments_left -= 1;
2545 /* End of the path. Clean up the SR header, or not */
2547 (sr0->segments_left == 0 &&
2549 clib_host_to_net_u16 (IP6_SR_HEADER_FLAG_CLEANUP))))
2551 u64 *copy_dst0, *copy_src0;
2554 * Copy the ip6 header right by the (real) length of the
2555 * sr header. Here's another place which assumes that
2556 * the sr header is the only extention header.
2559 ip0->protocol = sr0->protocol;
2560 vlib_buffer_advance (b0, (sr0->length + 1) * 8);
2562 new_l0 = clib_net_to_host_u16 (ip0->payload_length) -
2563 (sr0->length + 1) * 8;
2564 ip0->payload_length = clib_host_to_net_u16 (new_l0);
2566 copy_src0 = (u64 *) ip0;
2567 copy_dst0 = copy_src0 + (sr0->length + 1);
2569 copy_dst0[4] = copy_src0[4];
2570 copy_dst0[3] = copy_src0[3];
2571 copy_dst0[2] = copy_src0[2];
2572 copy_dst0[1] = copy_src0[1];
2573 copy_dst0[0] = copy_src0[0];
2579 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
2581 sr_local_trace_t *tr = vlib_add_trace (vm, node,
2583 clib_memcpy (tr->src.as_u8, ip0->src_address.as_u8,
2584 sizeof (tr->src.as_u8));
2585 clib_memcpy (tr->dst.as_u8, ip0->dst_address.as_u8,
2586 sizeof (tr->dst.as_u8));
2587 tr->length = vlib_buffer_length_in_chain (vm, b0);
2588 tr->next_index = next0;
2589 tr->sr_valid = sr0 != 0;
2591 clib_memcpy (tr->sr, sr0, sizeof (tr->sr));
2594 b1 = vlib_get_buffer (vm, bi1);
2595 ip1 = vlib_buffer_get_current (b1);
2596 sr1 = (ip6_sr_header_t *) (ip1 + 1);
2598 if (PREDICT_FALSE (sr1->type != ROUTING_HEADER_TYPE_SR))
2600 next1 = SR_LOCAL_NEXT_ERROR;
2602 node->errors[SR_LOCAL_ERROR_BAD_ROUTING_HEADER_TYPE];
2606 /* Out of segments? Turf the packet */
2607 if (PREDICT_FALSE (sr1->segments_left == 0))
2609 next1 = SR_LOCAL_NEXT_ERROR;
2610 b1->error = node->errors[SR_LOCAL_ERROR_NO_MORE_SEGMENTS];
2614 if (PREDICT_FALSE (sm->validate_hmac))
2616 if (sr_validate_hmac (sm, ip1, sr1))
2618 next1 = SR_LOCAL_NEXT_ERROR;
2619 b1->error = node->errors[SR_LOCAL_ERROR_HMAC_INVALID];
2624 next1 = sr_local_cb ? sr_local_cb (vm, node, b1, ip1, sr1) : next1;
2627 * To suppress rewrite, return ~SR_LOCAL_NEXT_xxx
2629 if (PREDICT_FALSE (next1 & 0x80000000))
2631 next1 ^= 0xFFFFFFFF;
2632 if (PREDICT_FALSE (next1 == SR_LOCAL_NEXT_ERROR))
2633 b1->error = node->errors[SR_LOCAL_ERROR_APP_CALLBACK];
2639 segment_index1 = sr1->segments_left - 1;
2641 /* Rewrite the packet */
2642 new_dst1 = (ip6_address_t *) (sr1->segments + segment_index1);
2643 ip1->dst_address.as_u64[0] = new_dst1->as_u64[0];
2644 ip1->dst_address.as_u64[1] = new_dst1->as_u64[1];
2646 if (PREDICT_TRUE (sr1->segments_left > 0))
2647 sr1->segments_left -= 1;
2650 /* End of the path. Clean up the SR header, or not */
2652 (sr1->segments_left == 0 &&
2654 clib_host_to_net_u16 (IP6_SR_HEADER_FLAG_CLEANUP))))
2656 u64 *copy_dst1, *copy_src1;
2659 * Copy the ip6 header right by the (real) length of the
2660 * sr header. Here's another place which assumes that
2661 * the sr header is the only extention header.
2664 ip1->protocol = sr1->protocol;
2665 vlib_buffer_advance (b1, (sr1->length + 1) * 8);
2667 new_l1 = clib_net_to_host_u16 (ip1->payload_length) -
2668 (sr1->length + 1) * 8;
2669 ip1->payload_length = clib_host_to_net_u16 (new_l1);
2671 copy_src1 = (u64 *) ip1;
2672 copy_dst1 = copy_src1 + (sr1->length + 1);
2674 copy_dst1[4] = copy_src1[4];
2675 copy_dst1[3] = copy_src1[3];
2676 copy_dst1[2] = copy_src1[2];
2677 copy_dst1[1] = copy_src1[1];
2678 copy_dst1[0] = copy_src1[0];
2684 if (PREDICT_FALSE (b1->flags & VLIB_BUFFER_IS_TRACED))
2686 sr_local_trace_t *tr = vlib_add_trace (vm, node,
2688 clib_memcpy (tr->src.as_u8, ip1->src_address.as_u8,
2689 sizeof (tr->src.as_u8));
2690 clib_memcpy (tr->dst.as_u8, ip1->dst_address.as_u8,
2691 sizeof (tr->dst.as_u8));
2692 tr->length = vlib_buffer_length_in_chain (vm, b1);
2693 tr->next_index = next1;
2694 tr->sr_valid = sr1 != 0;
2696 clib_memcpy (tr->sr, sr1, sizeof (tr->sr));
2699 vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
2700 to_next, n_left_to_next,
2701 bi0, bi1, next0, next1);
2704 while (n_left_from > 0 && n_left_to_next > 0)
2708 ip6_header_t *ip0 = 0;
2709 ip6_sr_header_t *sr0;
2710 ip6_address_t *new_dst0;
2711 u32 next0 = SR_LOCAL_NEXT_IP6_LOOKUP;
2718 n_left_to_next -= 1;
2720 b0 = vlib_get_buffer (vm, bi0);
2721 ip0 = vlib_buffer_get_current (b0);
2722 sr0 = (ip6_sr_header_t *) (ip0 + 1);
2724 if (PREDICT_FALSE (sr0->type != ROUTING_HEADER_TYPE_SR))
2726 next0 = SR_LOCAL_NEXT_ERROR;
2728 node->errors[SR_LOCAL_ERROR_BAD_ROUTING_HEADER_TYPE];
2732 /* Out of segments? Turf the packet */
2733 if (PREDICT_FALSE (sr0->segments_left == 0))
2735 next0 = SR_LOCAL_NEXT_ERROR;
2736 b0->error = node->errors[SR_LOCAL_ERROR_NO_MORE_SEGMENTS];
2740 if (PREDICT_FALSE (sm->validate_hmac))
2742 if (sr_validate_hmac (sm, ip0, sr0))
2744 next0 = SR_LOCAL_NEXT_ERROR;
2745 b0->error = node->errors[SR_LOCAL_ERROR_HMAC_INVALID];
2750 next0 = sr_local_cb ? sr_local_cb (vm, node, b0, ip0, sr0) : next0;
2753 * To suppress rewrite, return ~SR_LOCAL_NEXT_xxx
2755 if (PREDICT_FALSE (next0 & 0x80000000))
2757 next0 ^= 0xFFFFFFFF;
2758 if (PREDICT_FALSE (next0 == SR_LOCAL_NEXT_ERROR))
2759 b0->error = node->errors[SR_LOCAL_ERROR_APP_CALLBACK];
2765 segment_index0 = sr0->segments_left - 1;
2767 /* Rewrite the packet */
2768 new_dst0 = (ip6_address_t *) (sr0->segments + segment_index0);
2769 ip0->dst_address.as_u64[0] = new_dst0->as_u64[0];
2770 ip0->dst_address.as_u64[1] = new_dst0->as_u64[1];
2772 if (PREDICT_TRUE (sr0->segments_left > 0))
2773 sr0->segments_left -= 1;
2776 /* End of the path. Clean up the SR header, or not */
2778 (sr0->segments_left == 0 &&
2780 clib_host_to_net_u16 (IP6_SR_HEADER_FLAG_CLEANUP))))
2782 u64 *copy_dst0, *copy_src0;
2785 * Copy the ip6 header right by the (real) length of the
2786 * sr header. Here's another place which assumes that
2787 * the sr header is the only extention header.
2790 ip0->protocol = sr0->protocol;
2791 vlib_buffer_advance (b0, (sr0->length + 1) * 8);
2793 new_l0 = clib_net_to_host_u16 (ip0->payload_length) -
2794 (sr0->length + 1) * 8;
2795 ip0->payload_length = clib_host_to_net_u16 (new_l0);
2797 copy_src0 = (u64 *) ip0;
2798 copy_dst0 = copy_src0 + (sr0->length + 1);
2800 copy_dst0[4] = copy_src0[4];
2801 copy_dst0[3] = copy_src0[3];
2802 copy_dst0[2] = copy_src0[2];
2803 copy_dst0[1] = copy_src0[1];
2804 copy_dst0[0] = copy_src0[0];
2810 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
2812 sr_local_trace_t *tr = vlib_add_trace (vm, node,
2814 clib_memcpy (tr->src.as_u8, ip0->src_address.as_u8,
2815 sizeof (tr->src.as_u8));
2816 clib_memcpy (tr->dst.as_u8, ip0->dst_address.as_u8,
2817 sizeof (tr->dst.as_u8));
2818 tr->length = vlib_buffer_length_in_chain (vm, b0);
2819 tr->next_index = next0;
2820 tr->sr_valid = sr0 != 0;
2822 clib_memcpy (tr->sr, sr0, sizeof (tr->sr));
2825 vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
2826 to_next, n_left_to_next,
2830 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
2832 vlib_node_increment_counter (vm, sr_local_node.index,
2833 SR_LOCAL_ERROR_PKTS_PROCESSED,
2834 from_frame->n_vectors);
2835 return from_frame->n_vectors;
2839 VLIB_REGISTER_NODE (sr_local_node, static) = {
2840 .function = sr_local,
2842 /* Takes a vector of packets. */
2843 .vector_size = sizeof (u32),
2844 .format_trace = format_sr_local_trace,
2846 .runtime_data_bytes = 0,
2848 .n_errors = SR_LOCAL_N_ERROR,
2849 .error_strings = sr_local_error_strings,
2851 .n_next_nodes = SR_LOCAL_N_NEXT,
2853 #define _(s,n) [SR_LOCAL_NEXT_##s] = n,
2854 foreach_sr_local_next
2859 VLIB_NODE_FUNCTION_MULTIARCH (sr_local_node, sr_local)
2863 sr_get_main (vlib_main_t * vm)
2865 vlib_call_init_function (vm, sr_init);
2866 ASSERT (sr_local_node.index);
2871 * @brief CLI parser for SR fix destination rewrite node
2873 * @param vm vlib_main_t *
2874 * @param input unformat_input_t *
2875 * @param cmd vlib_cli_command_t *
2877 * @return error clib_error_t *
2879 static clib_error_t *
2880 set_ip6_sr_rewrite_fn (vlib_main_t * vm,
2881 unformat_input_t * input, vlib_cli_command_t * cmd)
2883 fib_prefix_t pfx = {
2884 .fp_proto = FIB_PROTOCOL_IP6,
2890 ip_adjacency_t *adj;
2891 vnet_hw_interface_t *hi;
2893 ip6_sr_main_t *sm = &sr_main;
2894 vnet_main_t *vnm = vnet_get_main ();
2895 fib_node_index_t fei;
2897 if (!unformat (input, "%U", unformat_ip6_address, &pfx.fp_addr.ip6))
2898 return clib_error_return (0, "ip6 address missing in '%U'",
2899 format_unformat_error, input);
2901 if (unformat (input, "rx-table-id %d", &fib_id))
2903 fib_index = fib_table_id_find_fib_index (FIB_PROTOCOL_IP6, fib_id);
2904 if (fib_index == ~0)
2905 return clib_error_return (0, "fib-id %d not found", fib_id);
2908 fei = fib_table_lookup_exact_match (fib_index, &pfx);
2910 if (FIB_NODE_INDEX_INVALID == fei)
2911 return clib_error_return (0, "no match for %U",
2912 format_ip6_address, &pfx.fp_addr.ip6);
2914 adj_index = fib_entry_get_adj_for_source (fei, FIB_SOURCE_SR);
2916 if (ADJ_INDEX_INVALID == adj_index)
2917 return clib_error_return (0, "%U not SR sourced",
2918 format_ip6_address, &pfx.fp_addr.ip6);
2920 adj = adj_get (adj_index);
2922 if (adj->lookup_next_index != IP_LOOKUP_NEXT_REWRITE)
2923 return clib_error_return (0, "%U unresolved (not a rewrite adj)",
2924 format_ip6_address, &pfx.fp_addr.ip6);
2926 adj->rewrite_header.next_index = sm->ip6_rewrite_sr_next_index;
2928 sw_if_index = adj->rewrite_header.sw_if_index;
2929 hi = vnet_get_sup_hw_interface (vnm, sw_if_index);
2930 adj->rewrite_header.node_index = sr_fix_dst_addr_node.index;
2932 /* $$$$$ hack... steal the mcast group index */
2933 adj->mcast_group_index =
2934 vlib_node_add_next (vm, sr_fix_dst_addr_node.index,
2935 hi->output_node_index);
2941 VLIB_CLI_COMMAND (set_ip6_sr_rewrite, static) = {
2942 .path = "set ip6 sr rewrite",
2943 .short_help = "set ip6 sr rewrite <ip6-address> [fib-id <id>]",
2944 .function = set_ip6_sr_rewrite_fn,
2949 * @brief Register a callback routine to set next0 in sr_local
2954 vnet_register_sr_app_callback (void *cb)
2956 ip6_sr_main_t *sm = &sr_main;
2958 sm->sr_local_cb = cb;
2962 * @brief Test routine for validation of HMAC
2964 static clib_error_t *
2965 test_sr_hmac_validate_fn (vlib_main_t * vm,
2966 unformat_input_t * input, vlib_cli_command_t * cmd)
2968 ip6_sr_main_t *sm = &sr_main;
2970 if (unformat (input, "validate on"))
2971 sm->validate_hmac = 1;
2972 else if (unformat (input, "chunk-offset off"))
2973 sm->validate_hmac = 0;
2975 return clib_error_return (0, "expected validate on|off in '%U'",
2976 format_unformat_error, input);
2978 vlib_cli_output (vm, "hmac signature validation %s",
2979 sm->validate_hmac ? "on" : "off");
2984 VLIB_CLI_COMMAND (test_sr_hmac_validate, static) = {
2985 .path = "test sr hmac",
2986 .short_help = "test sr hmac validate [on|off]",
2987 .function = test_sr_hmac_validate_fn,
2992 * @brief Add or Delete HMAC key
2994 * @param sm ip6_sr_main_t *
2996 * @param shared_secret u8 *
2999 * @return retval i32
3001 // $$$ fixme shouldn't return i32
3003 sr_hmac_add_del_key (ip6_sr_main_t * sm, u32 key_id, u8 * shared_secret,
3007 ip6_sr_hmac_key_t *key;
3011 /* Specific key in use? Fail. */
3012 if (key_id && vec_len (sm->hmac_keys) > key_id
3013 && sm->hmac_keys[key_id].shared_secret)
3017 key = find_or_add_shared_secret (sm, shared_secret, &index);
3018 ASSERT (index == key_id);
3024 if (key_id) /* delete by key ID */
3026 if (vec_len (sm->hmac_keys) <= key_id)
3029 key = sm->hmac_keys + key_id;
3031 hash_unset_mem (sm->hmac_key_by_shared_secret, key->shared_secret);
3032 vec_free (key->shared_secret);
3037 key = find_or_add_shared_secret (sm, shared_secret, &index);
3038 hash_unset_mem (sm->hmac_key_by_shared_secret, key->shared_secret);
3039 vec_free (key->shared_secret);
3044 static clib_error_t *
3045 sr_hmac_add_del_key_fn (vlib_main_t * vm,
3046 unformat_input_t * input, vlib_cli_command_t * cmd)
3048 ip6_sr_main_t *sm = &sr_main;
3052 u8 *shared_secret = 0;
3055 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
3057 if (unformat (input, "del"))
3059 else if (unformat (input, "id %d", &key_id))
3061 else if (unformat (input, "key %s", &shared_secret))
3063 /* Do not include the trailing NULL byte. Guaranteed interop issue */
3064 _vec_len (shared_secret) -= 1;
3070 if (is_del == 0 && shared_secret == 0)
3071 return clib_error_return (0, "shared secret must be set to add a key");
3073 if (shared_secret == 0 && key_id_set == 0)
3074 return clib_error_return (0, "shared secret and key id both unset");
3076 rv = sr_hmac_add_del_key (sm, key_id, shared_secret, is_del);
3078 vec_free (shared_secret);
3086 return clib_error_return (0, "sr_hmac_add_del_key returned %d", rv);
3093 VLIB_CLI_COMMAND (sr_hmac, static) = {
3095 .short_help = "sr hmac [del] id <nn> key <str>",
3096 .function = sr_hmac_add_del_key_fn,
3101 * @brief CLI parser for show HMAC key shared secrets
3103 * @param vm vlib_main_t *
3104 * @param input unformat_input_t *
3105 * @param cmd vlib_cli_command_t *
3107 * @return error clib_error_t *
3109 static clib_error_t *
3110 show_sr_hmac_fn (vlib_main_t * vm,
3111 unformat_input_t * input, vlib_cli_command_t * cmd)
3113 ip6_sr_main_t *sm = &sr_main;
3116 for (i = 1; i < vec_len (sm->hmac_keys); i++)
3118 if (sm->hmac_keys[i].shared_secret)
3119 vlib_cli_output (vm, "[%d]: %v", i, sm->hmac_keys[i].shared_secret);
3126 VLIB_CLI_COMMAND (show_sr_hmac, static) = {
3127 .path = "show sr hmac",
3128 .short_help = "show sr hmac",
3129 .function = show_sr_hmac_fn,
3134 * @brief Test for SR debug flag
3136 * @param vm vlib_main_t *
3137 * @param input unformat_input_t *
3138 * @param cmd vlib_cli_command_t *
3140 * @return error clib_error_t *
3142 static clib_error_t *
3143 test_sr_debug_fn (vlib_main_t * vm,
3144 unformat_input_t * input, vlib_cli_command_t * cmd)
3146 ip6_sr_main_t *sm = &sr_main;
3148 if (unformat (input, "on"))
3150 else if (unformat (input, "off"))
3153 return clib_error_return (0, "expected on|off in '%U'",
3154 format_unformat_error, input);
3156 vlib_cli_output (vm, "debug trace now %s", sm->is_debug ? "on" : "off");
3162 VLIB_CLI_COMMAND (test_sr_debug, static) = {
3163 .path = "test sr debug",
3164 .short_help = "test sr debug on|off",
3165 .function = test_sr_debug_fn,
3170 * fd.io coding-style-patch-verification: ON
3173 * eval: (c-set-style "gnu")