src/vnet/l2/l2_arp_term.c

   1 /*
   2  * l2/l2_arp_term.c: IP v4 ARP L2 BD termination
   3  *
   4  * Copyright (c) 2010 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vlibmemory/api.h>
  19
  20 #include <vnet/l2/l2_arp_term.h>
  21 #include <vnet/l2/l2_input.h>
  22 #include <vnet/l2/feat_bitmap.h>
  23
  24 #include <vnet/ip/ip4_packet.h>
  25 #include <vnet/ethernet/arp_packet.h>
  26
  27 static const u8 vrrp_prefix[] = { 0x00, 0x00, 0x5E, 0x00, 0x01 };
  28
  29 l2_arp_term_main_t l2_arp_term_main;
  30
  31 /*
  32  * ARP/ND Termination in a L2 Bridge Domain based on IP4/IP6 to MAC
  33  * hash tables mac_by_ip4 and mac_by_ip6 for each BD.
  34  */
  35 typedef enum
  36 {
  37   ARP_TERM_NEXT_L2_OUTPUT,
  38   ARP_TERM_NEXT_DROP,
  39   ARP_TERM_N_NEXT,
  40 } arp_term_next_t;
  41
  42 u32 arp_term_next_node_index[32];
  43
  44 typedef struct
  45 {
  46   u8 packet_data[64];
  47 } ethernet_arp_input_trace_t;
  48
  49 #define foreach_ethernet_arp_error                                      \
  50   _ (replies_sent, "ARP replies sent")                                  \
  51   _ (l2_type_not_ethernet, "L2 type not ethernet")                      \
  52   _ (l3_type_not_ip4, "L3 type not IP4")                                \
  53   _ (l3_src_address_not_local, "IP4 source address not local to subnet") \
  54   _ (l3_dst_address_not_local, "IP4 destination address not local to subnet") \
  55   _ (l3_dst_address_unset, "IP4 destination address is unset")          \
  56   _ (l3_src_address_is_local, "IP4 source address matches local interface") \
  57   _ (l3_src_address_learned, "ARP request IP4 source address learned")  \
  58   _ (replies_received, "ARP replies received")                          \
  59   _ (opcode_not_request, "ARP opcode not request")                      \
  60   _ (proxy_arp_replies_sent, "Proxy ARP replies sent")                  \
  61   _ (l2_address_mismatch, "ARP hw addr does not match L2 frame src addr") \
  62   _ (gratuitous_arp, "ARP probe or announcement dropped") \
  63   _ (interface_no_table, "Interface is not mapped to an IP table") \
  64   _ (interface_not_ip_enabled, "Interface is not IP enabled") \
  65   _ (unnumbered_mismatch, "RX interface is unnumbered to different subnet") \
  66
  67 typedef enum
  68 {
  69 #define _(sym,string) ETHERNET_ARP_ERROR_##sym,
  70   foreach_ethernet_arp_error
  71 #undef _
  72     ETHERNET_ARP_N_ERROR,
  73 } ethernet_arp_reply_error_t;
  74
  75 static char *ethernet_arp_error_strings[] = {
  76 #define _(sym,string) string,
  77   foreach_ethernet_arp_error
  78 #undef _
  79 };
  80
  81 static u8 *
  82 format_arp_term_input_trace (u8 * s, va_list * va)
  83 {
  84   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
  85   CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
  86   ethernet_arp_input_trace_t *t = va_arg (*va, ethernet_arp_input_trace_t *);
  87
  88   /* arp-term trace data saved is either arp or ip6/icmp6 packet:
  89      - for arp, the 1st 16-bit field is hw type of value of 0x0001.
  90      - for ip6, the first nibble has value of 6. */
  91   s = format (s, "%U", t->packet_data[0] == 0 ?
  92               format_ethernet_arp_header : format_ip6_header,
  93               t->packet_data, sizeof (t->packet_data));
  94
  95   return s;
  96 }
  97
  98 void
  99 l2_arp_term_set_publisher_node (bool on)
 100 {
 101   l2_arp_term_main_t *l2am = &l2_arp_term_main;
 102
 103   l2am->publish = on;
 104 }
 105
 106 static int
 107 l2_arp_term_publish (l2_arp_term_publish_event_t * ctx)
 108 {
 109   l2_arp_term_main_t *l2am = &l2_arp_term_main;
 110
 111   vec_add1 (l2am->publish_events, *ctx);
 112
 113   vlib_process_signal_event (vlib_get_main (),
 114                              l2_arp_term_process_node.index,
 115                              L2_ARP_TERM_EVENT_PUBLISH, 0);
 116
 117   return 0;
 118 }
 119
 120 static inline void
 121 l2_arp_term_publish_v4_dp (u32 sw_if_index,
 122                            const ethernet_arp_ip4_over_ethernet_address_t * a)
 123 {
 124   l2_arp_term_main_t *l2am = &l2_arp_term_main;
 125
 126   if (!l2am->publish)
 127     return;
 128
 129   l2_arp_term_publish_event_t args = {
 130     .sw_if_index = sw_if_index,
 131     .type = IP46_TYPE_IP4,
 132     .ip.ip4 = a->ip4,
 133     .mac = a->mac,
 134   };
 135
 136   vl_api_rpc_call_main_thread (l2_arp_term_publish, (u8 *) & args,
 137                                sizeof (args));
 138 }
 139
 140 static inline void
 141 l2_arp_term_publish_v6_dp (u32 sw_if_index,
 142                            const ip6_address_t * addr,
 143                            const mac_address_t * mac)
 144 {
 145   l2_arp_term_main_t *l2am = &l2_arp_term_main;
 146
 147   if (!l2am->publish)
 148     return;
 149
 150   l2_arp_term_publish_event_t args = {
 151     .sw_if_index = sw_if_index,
 152     .type = IP46_TYPE_IP6,
 153     .ip.ip6 = *addr,
 154     .mac = *mac,
 155   };
 156
 157   vl_api_rpc_call_main_thread (l2_arp_term_publish, (u8 *) & args,
 158                                sizeof (args));
 159 }
 160
 161 static inline int
 162 vnet_ip6_nd_term (vlib_main_t * vm,
 163                   vlib_node_runtime_t * node,
 164                   vlib_buffer_t * p0,
 165                   ethernet_header_t * eth,
 166                   ip6_header_t * ip, u32 sw_if_index, u16 bd_index)
 167 {
 168   icmp6_neighbor_solicitation_or_advertisement_header_t *ndh;
 169   mac_address_t mac;
 170
 171   mac_address_from_bytes (&mac, eth->src_address);
 172   ndh = ip6_next_header (ip);
 173   if (ndh->icmp.type != ICMP6_neighbor_solicitation &&
 174       ndh->icmp.type != ICMP6_neighbor_advertisement)
 175     return 0;
 176
 177   if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) &&
 178                      (p0->flags & VLIB_BUFFER_IS_TRACED)))
 179     {
 180       u8 *t0 = vlib_add_trace (vm, node, p0,
 181                                sizeof (icmp6_input_trace_t));
 182       clib_memcpy (t0, ip, sizeof (icmp6_input_trace_t));
 183     }
 184
 185   /* Check if anyone want ND events for L2 BDs */
 186   if (PREDICT_FALSE (!ip6_address_is_link_local_unicast (&ip->src_address)))
 187     {
 188       l2_arp_term_publish_v6_dp (sw_if_index, &ip->src_address, &mac);
 189     }
 190
 191   /* Check if MAC entry exsist for solicited target IP */
 192   if (ndh->icmp.type == ICMP6_neighbor_solicitation)
 193     {
 194       icmp6_neighbor_discovery_ethernet_link_layer_address_option_t *opt;
 195       l2_bridge_domain_t *bd_config;
 196       u8 *macp;
 197
 198       opt = (void *) (ndh + 1);
 199       if ((opt->header.type !=
 200            ICMP6_NEIGHBOR_DISCOVERY_OPTION_source_link_layer_address) ||
 201           (opt->header.n_data_u64s != 1))
 202         return 0;               /* source link layer address option not present */
 203
 204       bd_config = vec_elt_at_index (l2input_main.bd_configs, bd_index);
 205       macp =
 206         (u8 *) hash_get_mem (bd_config->mac_by_ip6, &ndh->target_address);
 207       if (macp)
 208         {                       /* found ip-mac entry, generate eighbor advertisement response */
 209           int bogus_length;
 210           vlib_node_runtime_t *error_node =
 211             vlib_node_get_runtime (vm, ip6_icmp_input_node.index);
 212           ip->dst_address = ip->src_address;
 213           ip->src_address = ndh->target_address;
 214           ip->hop_limit = 255;
 215           opt->header.type =
 216             ICMP6_NEIGHBOR_DISCOVERY_OPTION_target_link_layer_address;
 217           clib_memcpy (opt->ethernet_address, macp, 6);
 218           ndh->icmp.type = ICMP6_neighbor_advertisement;
 219           ndh->advertisement_flags = clib_host_to_net_u32
 220             (ICMP6_NEIGHBOR_ADVERTISEMENT_FLAG_SOLICITED |
 221              ICMP6_NEIGHBOR_ADVERTISEMENT_FLAG_OVERRIDE);
 222           ndh->icmp.checksum = 0;
 223           ndh->icmp.checksum =
 224             ip6_tcp_udp_icmp_compute_checksum (vm, p0, ip, &bogus_length);
 225           clib_memcpy (eth->dst_address, eth->src_address, 6);
 226           clib_memcpy (eth->src_address, macp, 6);
 227           vlib_error_count (vm, error_node->node_index,
 228                             ICMP6_ERROR_NEIGHBOR_ADVERTISEMENTS_TX, 1);
 229           return 1;
 230         }
 231     }
 232
 233   return 0;
 234
 235 }
 236
 237 static uword
 238 arp_term_l2bd (vlib_main_t * vm,
 239                vlib_node_runtime_t * node, vlib_frame_t * frame)
 240 {
 241   l2input_main_t *l2im = &l2input_main;
 242   u32 n_left_from, next_index, *from, *to_next;
 243   u32 n_replies_sent = 0;
 244   u16 last_bd_index = ~0;
 245   l2_bridge_domain_t *last_bd_config = 0;
 246   l2_input_config_t *cfg0;
 247
 248   from = vlib_frame_vector_args (frame);
 249   n_left_from = frame->n_vectors;
 250   next_index = node->cached_next_index;
 251
 252   while (n_left_from > 0)
 253     {
 254       u32 n_left_to_next;
 255
 256       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 257
 258       while (n_left_from > 0 && n_left_to_next > 0)
 259         {
 260           vlib_buffer_t *p0;
 261           ethernet_header_t *eth0;
 262           ethernet_arp_header_t *arp0;
 263           ip6_header_t *iph0;
 264           u8 *l3h0;
 265           u32 pi0, error0, next0, sw_if_index0;
 266           u16 ethertype0;
 267           u16 bd_index0;
 268           u32 ip0;
 269           u8 *macp0;
 270
 271           pi0 = from[0];
 272           to_next[0] = pi0;
 273           from += 1;
 274           to_next += 1;
 275           n_left_from -= 1;
 276           n_left_to_next -= 1;
 277
 278           p0 = vlib_get_buffer (vm, pi0);
 279           // Terminate only local (SHG == 0) ARP
 280           if (vnet_buffer (p0)->l2.shg != 0)
 281             goto next_l2_feature;
 282
 283           eth0 = vlib_buffer_get_current (p0);
 284           l3h0 = (u8 *) eth0 + vnet_buffer (p0)->l2.l2_len;
 285           ethertype0 = clib_net_to_host_u16 (*(u16 *) (l3h0 - 2));
 286           arp0 = (ethernet_arp_header_t *) l3h0;
 287
 288           if (ethertype0 != ETHERNET_TYPE_ARP)
 289             goto check_ip6_nd;
 290
 291           if ((arp0->opcode !=
 292                clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_request)) &&
 293               (arp0->opcode !=
 294                clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply)))
 295             goto check_ip6_nd;
 296
 297           /* Must be ARP request/reply packet here */
 298           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) &&
 299                              (p0->flags & VLIB_BUFFER_IS_TRACED)))
 300             {
 301               u8 *t0 = vlib_add_trace (vm, node, p0,
 302                                        sizeof (ethernet_arp_input_trace_t));
 303               clib_memcpy_fast (t0, l3h0,
 304                                 sizeof (ethernet_arp_input_trace_t));
 305             }
 306
 307           error0 = 0;
 308           error0 =
 309             (arp0->l2_type !=
 310              clib_net_to_host_u16 (ETHERNET_ARP_HARDWARE_TYPE_ethernet)
 311              ? ETHERNET_ARP_ERROR_l2_type_not_ethernet : error0);
 312           error0 =
 313             (arp0->l3_type !=
 314              clib_net_to_host_u16 (ETHERNET_TYPE_IP4) ?
 315              ETHERNET_ARP_ERROR_l3_type_not_ip4 : error0);
 316
 317           sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
 318
 319           if (error0)
 320             goto drop;
 321
 322           /* Trash ARP packets whose ARP-level source addresses do not
 323              match, or if requester address is mcast */
 324           if (PREDICT_FALSE
 325               (!ethernet_mac_address_equal (eth0->src_address,
 326                                             arp0->ip4_over_ethernet[0].
 327                                             mac.bytes))
 328               || ethernet_address_cast (arp0->ip4_over_ethernet[0].mac.bytes))
 329             {
 330               /* VRRP virtual MAC may be different to SMAC in ARP reply */
 331               if (!ethernet_mac_address_equal
 332                   (arp0->ip4_over_ethernet[0].mac.bytes, vrrp_prefix))
 333                 {
 334                   error0 = ETHERNET_ARP_ERROR_l2_address_mismatch;
 335                   goto drop;
 336                 }
 337             }
 338           if (PREDICT_FALSE
 339               (ip4_address_is_multicast (&arp0->ip4_over_ethernet[0].ip4)))
 340             {
 341               error0 = ETHERNET_ARP_ERROR_l3_src_address_not_local;
 342               goto drop;
 343             }
 344
 345           /* Check if anyone want ARP request events for L2 BDs */
 346           l2_arp_term_publish_v4_dp (sw_if_index0,
 347                                      &arp0->ip4_over_ethernet[0]);
 348
 349           /* lookup BD mac_by_ip4 hash table for MAC entry */
 350           ip0 = arp0->ip4_over_ethernet[1].ip4.as_u32;
 351           bd_index0 = vnet_buffer (p0)->l2.bd_index;
 352           if (PREDICT_FALSE ((bd_index0 != last_bd_index)
 353                              || (last_bd_index == (u16) ~ 0)))
 354             {
 355               last_bd_index = bd_index0;
 356               last_bd_config = vec_elt_at_index (l2im->bd_configs, bd_index0);
 357             }
 358           macp0 = (u8 *) hash_get (last_bd_config->mac_by_ip4, ip0);
 359
 360           if (PREDICT_FALSE (!macp0))
 361             goto next_l2_feature;       /* MAC not found */
 362           if (PREDICT_FALSE (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
 363                              arp0->ip4_over_ethernet[1].ip4.as_u32))
 364             goto next_l2_feature;       /* GARP */
 365
 366           /* MAC found, send ARP reply -
 367              Convert ARP request packet to ARP reply */
 368           arp0->opcode = clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_reply);
 369           arp0->ip4_over_ethernet[1] = arp0->ip4_over_ethernet[0];
 370           arp0->ip4_over_ethernet[0].ip4.as_u32 = ip0;
 371           mac_address_from_bytes (&arp0->ip4_over_ethernet[0].mac, macp0);
 372           clib_memcpy_fast (eth0->dst_address, eth0->src_address, 6);
 373           clib_memcpy_fast (eth0->src_address, macp0, 6);
 374           n_replies_sent += 1;
 375
 376         output_response:
 377           /* For BVI, need to use l2-fwd node to send ARP reply as
 378              l2-output node cannot output packet to BVI properly */
 379           cfg0 = vec_elt_at_index (l2im->configs, sw_if_index0);
 380           if (PREDICT_FALSE (cfg0->bvi))
 381             {
 382               vnet_buffer (p0)->l2.feature_bitmap |= L2INPUT_FEAT_FWD;
 383               vnet_buffer (p0)->sw_if_index[VLIB_RX] = 0;
 384               goto next_l2_feature;
 385             }
 386
 387           /* Send ARP/ND reply back out input interface through l2-output */
 388           vnet_buffer (p0)->sw_if_index[VLIB_TX] = sw_if_index0;
 389           next0 = ARP_TERM_NEXT_L2_OUTPUT;
 390           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 391                                            to_next, n_left_to_next, pi0,
 392                                            next0);
 393           continue;
 394
 395         check_ip6_nd:
 396           /* IP6 ND event notification or solicitation handling to generate
 397              local response instead of flooding */
 398           iph0 = (ip6_header_t *) l3h0;
 399           if (PREDICT_FALSE (ethertype0 == ETHERNET_TYPE_IP6 &&
 400                              iph0->protocol == IP_PROTOCOL_ICMP6 &&
 401                              !ip6_address_is_unspecified
 402                              (&iph0->src_address)))
 403             {
 404               sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
 405               if (vnet_ip6_nd_term
 406                   (vm, node, p0, eth0, iph0, sw_if_index0,
 407                    vnet_buffer (p0)->l2.bd_index))
 408                 goto output_response;
 409             }
 410
 411         next_l2_feature:
 412           {
 413             next0 = vnet_l2_feature_next (p0, arp_term_next_node_index,
 414                                           L2INPUT_FEAT_ARP_TERM);
 415             vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 416                                              to_next, n_left_to_next,
 417                                              pi0, next0);
 418             continue;
 419           }
 420
 421         drop:
 422           if (0 == arp0->ip4_over_ethernet[0].ip4.as_u32 ||
 423               (arp0->ip4_over_ethernet[0].ip4.as_u32 ==
 424                arp0->ip4_over_ethernet[1].ip4.as_u32))
 425             {
 426               error0 = ETHERNET_ARP_ERROR_gratuitous_arp;
 427             }
 428           next0 = ARP_TERM_NEXT_DROP;
 429           p0->error = node->errors[error0];
 430
 431           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 432                                            to_next, n_left_to_next, pi0,
 433                                            next0);
 434         }
 435
 436       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 437     }
 438
 439   vlib_error_count (vm, node->node_index,
 440                     ETHERNET_ARP_ERROR_replies_sent, n_replies_sent);
 441   return frame->n_vectors;
 442 }
 443
 444 /* *INDENT-OFF* */
 445 VLIB_REGISTER_NODE (arp_term_l2bd_node, static) = {
 446   .function = arp_term_l2bd,
 447   .name = "arp-term-l2bd",
 448   .vector_size = sizeof (u32),
 449   .n_errors = ETHERNET_ARP_N_ERROR,
 450   .error_strings = ethernet_arp_error_strings,
 451   .n_next_nodes = ARP_TERM_N_NEXT,
 452   .next_nodes = {
 453     [ARP_TERM_NEXT_L2_OUTPUT] = "l2-output",
 454     [ARP_TERM_NEXT_DROP] = "error-drop",
 455   },
 456   .format_buffer = format_ethernet_arp_header,
 457   .format_trace = format_arp_term_input_trace,
 458 };
 459 /* *INDENT-ON* */
 460
 461 clib_error_t *
 462 arp_term_init (vlib_main_t * vm)
 463 {
 464   // Initialize the feature next-node indexes
 465   feat_bitmap_init_next_nodes (vm,
 466                                arp_term_l2bd_node.index,
 467                                L2INPUT_N_FEAT,
 468                                l2input_get_feat_names (),
 469                                arp_term_next_node_index);
 470   return 0;
 471 }
 472
 473 VLIB_INIT_FUNCTION (arp_term_init);
 474
 475 /*
 476  * fd.io coding-style-patch-verification: ON
 477  *
 478  * Local Variables:
 479  * eval: (c-set-style "gnu")
 480  * End:
 481  */