test/test_gbp.py

   1 #!/usr/bin/env python
   2
   3 import unittest
   4
   5 from framework import VppTestCase, VppTestRunner
   6 from vpp_object import VppObject
   7 from vpp_neighbor import VppNeighbor
   8 from vpp_ip_route import VppIpRoute, VppRoutePath, VppIpTable, \
   9     VppIpInterfaceAddress, VppIpInterfaceBind, find_route
  10 from vpp_l2 import VppBridgeDomain, VppBridgeDomainPort, \
  11     VppBridgeDomainArpEntry, VppL2FibEntry, find_bridge_domain_port
  12 from vpp_vxlan_gbp_tunnel import *
  13 from vpp_sub_interface import VppDot1QSubint
  14
  15 from vpp_ip import *
  16 from vpp_mac import *
  17 from vpp_papi_provider import L2_PORT_TYPE
  18 from vpp_papi import VppEnum
  19
  20 from scapy.packet import Raw
  21 from scapy.layers.l2 import Ether, ARP, Dot1Q
  22 from scapy.layers.inet import IP, UDP
  23 from scapy.layers.inet6 import IPv6, ICMPv6ND_NS,  ICMPv6NDOptSrcLLAddr, \
  24     ICMPv6ND_NA
  25 from scapy.utils6 import in6_getnsma, in6_getnsmac
  26 from scapy.layers.vxlan import VXLAN
  27
  28 from socket import AF_INET, AF_INET6
  29 from scapy.utils import inet_pton, inet_ntop
  30 from util import mactobinary
  31 from vpp_papi_provider import L2_VTR_OP
  32
  33
  34 def find_gbp_endpoint(test, sw_if_index=None, ip=None, mac=None):
  35     if ip:
  36         vip = VppIpAddress(ip)
  37     if mac:
  38         vmac = VppMacAddress(mac)
  39
  40     eps = test.vapi.gbp_endpoint_dump()
  41
  42     for ep in eps:
  43         if sw_if_index:
  44             if ep.endpoint.sw_if_index != sw_if_index:
  45                 continue
  46         if ip:
  47             for eip in ep.endpoint.ips:
  48                 if vip == eip:
  49                     return True
  50         if mac:
  51             if vmac == ep.endpoint.mac:
  52                 return True
  53     return False
  54
  55
  56 def find_gbp_vxlan(test, vni):
  57     ts = test.vapi.gbp_vxlan_tunnel_dump()
  58     for t in ts:
  59         if t.tunnel.vni == vni:
  60             return True
  61     return False
  62
  63
  64 class VppGbpEndpoint(VppObject):
  65     """
  66     GBP Endpoint
  67     """
  68
  69     @property
  70     def bin_mac(self):
  71         return self.vmac.bytes
  72
  73     @property
  74     def mac(self):
  75         return self.vmac.address
  76
  77     @property
  78     def mac(self):
  79         return self.itf.remote_mac
  80
  81     @property
  82     def ip4(self):
  83         return self._ip4
  84
  85     @property
  86     def fip4(self):
  87         return self._fip4
  88
  89     @property
  90     def ip6(self):
  91         return self._ip6
  92
  93     @property
  94     def fip6(self):
  95         return self._fip6
  96
  97     @property
  98     def ips(self):
  99         return [self.ip4, self.ip6]
 100
 101     @property
 102     def fips(self):
 103         return [self.fip4, self.fip6]
 104
 105     def __init__(self, test, itf, epg, recirc, ip4, fip4, ip6, fip6,
 106                  flags=0,
 107                  tun_src="0.0.0.0",
 108                  tun_dst="0.0.0.0",
 109                  mac=True):
 110         self._test = test
 111         self.itf = itf
 112         self.epg = epg
 113         self.recirc = recirc
 114
 115         self._ip4 = VppIpAddress(ip4)
 116         self._fip4 = VppIpAddress(fip4)
 117         self._ip6 = VppIpAddress(ip6)
 118         self._fip6 = VppIpAddress(fip6)
 119
 120         if mac:
 121             self.vmac = VppMacAddress(self.itf.remote_mac)
 122         else:
 123             self.vmac = VppMacAddress("00:00:00:00:00:00")
 124
 125         self.flags = flags
 126         self.tun_src = VppIpAddress(tun_src)
 127         self.tun_dst = VppIpAddress(tun_dst)
 128
 129     def add_vpp_config(self):
 130         res = self._test.vapi.gbp_endpoint_add(
 131             self.itf.sw_if_index,
 132             [self.ip4.encode(), self.ip6.encode()],
 133             self.vmac.encode(),
 134             self.epg.epg,
 135             self.flags,
 136             self.tun_src.encode(),
 137             self.tun_dst.encode())
 138         self.handle = res.handle
 139         self._test.registry.register(self, self._test.logger)
 140
 141     def remove_vpp_config(self):
 142         self._test.vapi.gbp_endpoint_del(self.handle)
 143
 144     def __str__(self):
 145         return self.object_id()
 146
 147     def object_id(self):
 148         return "gbp-endpoint:[%d==%d:%s:%d]" % (self.handle,
 149                                                 self.itf.sw_if_index,
 150                                                 self.ip4.address,
 151                                                 self.epg.epg)
 152
 153     def query_vpp_config(self):
 154         return find_gbp_endpoint(self._test,
 155                                  self.itf.sw_if_index,
 156                                  self.ip4.address)
 157
 158
 159 class VppGbpRecirc(VppObject):
 160     """
 161     GBP Recirculation Interface
 162     """
 163
 164     def __init__(self, test, epg, recirc, is_ext=False):
 165         self._test = test
 166         self.recirc = recirc
 167         self.epg = epg
 168         self.is_ext = is_ext
 169
 170     def add_vpp_config(self):
 171         self._test.vapi.gbp_recirc_add_del(
 172             1,
 173             self.recirc.sw_if_index,
 174             self.epg.epg,
 175             self.is_ext)
 176         self._test.registry.register(self, self._test.logger)
 177
 178     def remove_vpp_config(self):
 179         self._test.vapi.gbp_recirc_add_del(
 180             0,
 181             self.recirc.sw_if_index,
 182             self.epg.epg,
 183             self.is_ext)
 184
 185     def __str__(self):
 186         return self.object_id()
 187
 188     def object_id(self):
 189         return "gbp-recirc:[%d]" % (self.recirc.sw_if_index)
 190
 191     def query_vpp_config(self):
 192         rs = self._test.vapi.gbp_recirc_dump()
 193         for r in rs:
 194             if r.recirc.sw_if_index == self.recirc.sw_if_index:
 195                 return True
 196         return False
 197
 198
 199 class VppGbpExtItf(VppObject):
 200     """
 201     GBP ExtItfulation Interface
 202     """
 203
 204     def __init__(self, test, itf, bd, rd):
 205         self._test = test
 206         self.itf = itf
 207         self.bd = bd
 208         self.rd = rd
 209
 210     def add_vpp_config(self):
 211         self._test.vapi.gbp_ext_itf_add_del(
 212             1,
 213             self.itf.sw_if_index,
 214             self.bd.bd_id,
 215             self.rd.rd_id)
 216         self._test.registry.register(self, self._test.logger)
 217
 218     def remove_vpp_config(self):
 219         self._test.vapi.gbp_ext_itf_add_del(
 220             0,
 221             self.itf.sw_if_index,
 222             self.bd.bd_id,
 223             self.rd.rd_id)
 224
 225     def __str__(self):
 226         return self.object_id()
 227
 228     def object_id(self):
 229         return "gbp-ext-itf:[%d]" % (self.itf.sw_if_index)
 230
 231     def query_vpp_config(self):
 232         rs = self._test.vapi.gbp_ext_itf_dump()
 233         for r in rs:
 234             if r.ext_itf.sw_if_index == self.itf.sw_if_index:
 235                 return True
 236         return False
 237
 238
 239 class VppGbpSubnet(VppObject):
 240     """
 241     GBP Subnet
 242     """
 243     def __init__(self, test, rd, address, address_len,
 244                  type, sw_if_index=None, epg=None):
 245         self._test = test
 246         self.rd_id = rd.rd_id
 247         self.prefix = VppIpPrefix(address, address_len)
 248         self.type = type
 249         self.sw_if_index = sw_if_index
 250         self.epg = epg
 251
 252     def add_vpp_config(self):
 253         self._test.vapi.gbp_subnet_add_del(
 254             1,
 255             self.rd_id,
 256             self.prefix.encode(),
 257             self.type,
 258             sw_if_index=self.sw_if_index if self.sw_if_index else 0xffffffff,
 259             epg_id=self.epg if self.epg else 0xffff)
 260         self._test.registry.register(self, self._test.logger)
 261
 262     def remove_vpp_config(self):
 263         self._test.vapi.gbp_subnet_add_del(
 264             0,
 265             self.rd_id,
 266             self.prefix.encode(),
 267             self.type)
 268
 269     def __str__(self):
 270         return self.object_id()
 271
 272     def object_id(self):
 273         return "gbp-subnet:[%d-%s]" % (self.rd_id, self.prefix)
 274
 275     def query_vpp_config(self):
 276         ss = self._test.vapi.gbp_subnet_dump()
 277         for s in ss:
 278             if s.subnet.rd_id == self.rd_id and \
 279                s.subnet.type == self.type and \
 280                s.subnet.prefix == self.prefix:
 281                 return True
 282         return False
 283
 284
 285 class VppGbpEndpointGroup(VppObject):
 286     """
 287     GBP Endpoint Group
 288     """
 289
 290     def __init__(self, test, epg, rd, bd, uplink,
 291                  bvi, bvi_ip4, bvi_ip6=None):
 292         self._test = test
 293         self.uplink = uplink
 294         self.bvi = bvi
 295         self.bvi_ip4 = VppIpAddress(bvi_ip4)
 296         self.bvi_ip6 = VppIpAddress(bvi_ip6)
 297         self.epg = epg
 298         self.bd = bd
 299         self.rd = rd
 300
 301     def add_vpp_config(self):
 302         self._test.vapi.gbp_endpoint_group_add(
 303             self.epg,
 304             self.bd.bd.bd_id,
 305             self.rd.rd_id,
 306             self.uplink.sw_if_index if self.uplink else INDEX_INVALID)
 307         self._test.registry.register(self, self._test.logger)
 308
 309     def remove_vpp_config(self):
 310         self._test.vapi.gbp_endpoint_group_del(
 311             self.epg)
 312
 313     def __str__(self):
 314         return self.object_id()
 315
 316     def object_id(self):
 317         return "gbp-endpoint-group:[%d]" % (self.epg)
 318
 319     def query_vpp_config(self):
 320         epgs = self._test.vapi.gbp_endpoint_group_dump()
 321         for epg in epgs:
 322             if epg.epg.epg_id == self.epg:
 323                 return True
 324         return False
 325
 326
 327 class VppGbpBridgeDomain(VppObject):
 328     """
 329     GBP Bridge Domain
 330     """
 331
 332     def __init__(self, test, bd, bvi, uu_flood=None, learn=True):
 333         self._test = test
 334         self.bvi = bvi
 335         self.uu_flood = uu_flood
 336         self.bd = bd
 337
 338         e = VppEnum.vl_api_gbp_bridge_domain_flags_t
 339         if (learn):
 340             self.learn = e.GBP_BD_API_FLAG_NONE
 341         else:
 342             self.learn = e.GBP_BD_API_FLAG_DO_NOT_LEARN
 343
 344     def add_vpp_config(self):
 345         self._test.vapi.gbp_bridge_domain_add(
 346             self.bd.bd_id,
 347             self.learn,
 348             self.bvi.sw_if_index,
 349             self.uu_flood.sw_if_index if self.uu_flood else INDEX_INVALID)
 350         self._test.registry.register(self, self._test.logger)
 351
 352     def remove_vpp_config(self):
 353         self._test.vapi.gbp_bridge_domain_del(self.bd.bd_id)
 354
 355     def __str__(self):
 356         return self.object_id()
 357
 358     def object_id(self):
 359         return "gbp-bridge-domain:[%d]" % (self.bd.bd_id)
 360
 361     def query_vpp_config(self):
 362         bds = self._test.vapi.gbp_bridge_domain_dump()
 363         for bd in bds:
 364             if bd.bd.bd_id == self.bd.bd_id:
 365                 return True
 366         return False
 367
 368
 369 class VppGbpRouteDomain(VppObject):
 370     """
 371     GBP Route Domain
 372     """
 373
 374     def __init__(self, test, rd_id, t4, t6, ip4_uu=None, ip6_uu=None):
 375         self._test = test
 376         self.rd_id = rd_id
 377         self.t4 = t4
 378         self.t6 = t6
 379         self.ip4_uu = ip4_uu
 380         self.ip6_uu = ip6_uu
 381
 382     def add_vpp_config(self):
 383         self._test.vapi.gbp_route_domain_add(
 384             self.rd_id,
 385             self.t4.table_id,
 386             self.t6.table_id,
 387             self.ip4_uu.sw_if_index if self.ip4_uu else INDEX_INVALID,
 388             self.ip6_uu.sw_if_index if self.ip6_uu else INDEX_INVALID)
 389         self._test.registry.register(self, self._test.logger)
 390
 391     def remove_vpp_config(self):
 392         self._test.vapi.gbp_route_domain_del(self.rd_id)
 393
 394     def __str__(self):
 395         return self.object_id()
 396
 397     def object_id(self):
 398         return "gbp-route-domain:[%d]" % (self.rd_id)
 399
 400     def query_vpp_config(self):
 401         rds = self._test.vapi.gbp_route_domain_dump()
 402         for rd in rds:
 403             if rd.rd.rd_id == self.rd_id:
 404                 return True
 405         return False
 406
 407
 408 class VppGbpContractNextHop():
 409     def __init__(self, mac, bd, ip, rd):
 410         self.mac = mac
 411         self.ip = ip
 412         self.bd = bd
 413         self.rd = rd
 414
 415     def encode(self):
 416         return {'ip': self.ip.encode(),
 417                 'mac': self.mac.encode(),
 418                 'bd_id': self.bd.bd.bd_id,
 419                 'rd_id': self.rd.rd_id}
 420
 421
 422 class VppGbpContractRule():
 423     def __init__(self, action, hash_mode, nhs=[]):
 424         self.action = action
 425         self.hash_mode = hash_mode
 426         self.nhs = nhs
 427
 428     def encode(self):
 429         nhs = []
 430         for nh in self.nhs:
 431             nhs.append(nh.encode())
 432         while len(nhs) < 8:
 433             nhs.append({})
 434         return {'action': self.action,
 435                 'nh_set': {
 436                     'hash_mode': self.hash_mode,
 437                     'n_nhs': len(self.nhs),
 438                     'nhs': nhs}}
 439
 440
 441 class VppGbpContract(VppObject):
 442     """
 443     GBP Contract
 444     """
 445
 446     def __init__(self, test, src_epg, dst_epg, acl_index, rules=[]):
 447         self._test = test
 448         self.acl_index = acl_index
 449         self.src_epg = src_epg
 450         self.dst_epg = dst_epg
 451         self.rules = rules
 452
 453     def add_vpp_config(self):
 454         rules = []
 455         for r in self.rules:
 456             rules.append(r.encode())
 457         self._test.vapi.gbp_contract_add_del(
 458             1,
 459             self.src_epg,
 460             self.dst_epg,
 461             self.acl_index,
 462             rules)
 463         self._test.registry.register(self, self._test.logger)
 464
 465     def remove_vpp_config(self):
 466         self._test.vapi.gbp_contract_add_del(
 467             0,
 468             self.src_epg,
 469             self.dst_epg,
 470             self.acl_index,
 471             [])
 472
 473     def __str__(self):
 474         return self.object_id()
 475
 476     def object_id(self):
 477         return "gbp-contract:[%d:%s:%d]" % (self.src_epg,
 478                                             self.dst_epg,
 479                                             self.acl_index)
 480
 481     def query_vpp_config(self):
 482         cs = self._test.vapi.gbp_contract_dump()
 483         for c in cs:
 484             if c.contract.src_epg == self.src_epg \
 485                and c.contract.dst_epg == self.dst_epg:
 486                 return True
 487         return False
 488
 489
 490 class VppGbpVxlanTunnel(VppInterface):
 491     """
 492     GBP VXLAN tunnel
 493     """
 494
 495     def __init__(self, test, vni, bd_rd_id, mode):
 496         super(VppGbpVxlanTunnel, self).__init__(test)
 497         self._test = test
 498         self.vni = vni
 499         self.bd_rd_id = bd_rd_id
 500         self.mode = mode
 501
 502     def add_vpp_config(self):
 503         r = self._test.vapi.gbp_vxlan_tunnel_add(
 504             self.vni,
 505             self.bd_rd_id,
 506             self.mode)
 507         self.set_sw_if_index(r.sw_if_index)
 508         self._test.registry.register(self, self._test.logger)
 509
 510     def remove_vpp_config(self):
 511         self._test.vapi.gbp_vxlan_tunnel_del(self.vni)
 512
 513     def __str__(self):
 514         return self.object_id()
 515
 516     def object_id(self):
 517         return "gbp-vxlan:%d" % (self.vni)
 518
 519     def query_vpp_config(self):
 520         return find_gbp_vxlan(self._test, self.vni)
 521
 522
 523 class VppGbpAcl(VppObject):
 524     """
 525     GBP Acl
 526     """
 527
 528     def __init__(self, test):
 529         self._test = test
 530         self.acl_index = 4294967295
 531
 532     def create_rule(self, is_ipv6=0, permit_deny=0, proto=-1,
 533                     s_prefix=0, s_ip='\x00\x00\x00\x00', sport_from=0,
 534                     sport_to=65535, d_prefix=0, d_ip='\x00\x00\x00\x00',
 535                     dport_from=0, dport_to=65535):
 536         if proto == -1 or proto == 0:
 537             sport_to = 0
 538             dport_to = sport_to
 539         elif proto == 1 or proto == 58:
 540             sport_to = 255
 541             dport_to = sport_to
 542         rule = ({'is_permit': permit_deny, 'is_ipv6': is_ipv6, 'proto': proto,
 543                  'srcport_or_icmptype_first': sport_from,
 544                  'srcport_or_icmptype_last': sport_to,
 545                  'src_ip_prefix_len': s_prefix,
 546                  'src_ip_addr': s_ip,
 547                  'dstport_or_icmpcode_first': dport_from,
 548                  'dstport_or_icmpcode_last': dport_to,
 549                  'dst_ip_prefix_len': d_prefix,
 550                  'dst_ip_addr': d_ip})
 551         return rule
 552
 553     def add_vpp_config(self, rules):
 554
 555         reply = self._test.vapi.acl_add_replace(self.acl_index,
 556                                                 r=rules,
 557                                                 tag='GBPTest')
 558         self.acl_index = reply.acl_index
 559         return self.acl_index
 560
 561     def remove_vpp_config(self):
 562         self._test.vapi.acl_del(self.acl_index)
 563
 564     def __str__(self):
 565         return self.object_id()
 566
 567     def object_id(self):
 568         return "gbp-acl:[%d]" % (self.acl_index)
 569
 570     def query_vpp_config(self):
 571         cs = self._test.vapi.acl_dump()
 572         for c in cs:
 573             if c.acl_index == self.acl_index:
 574                 return True
 575         return False
 576
 577
 578 class TestGBP(VppTestCase):
 579     """ GBP Test Case """
 580
 581     def setUp(self):
 582         super(TestGBP, self).setUp()
 583
 584         self.create_pg_interfaces(range(9))
 585         self.create_loopback_interfaces(8)
 586
 587         self.router_mac = VppMacAddress("00:11:22:33:44:55")
 588
 589         for i in self.pg_interfaces:
 590             i.admin_up()
 591         for i in self.lo_interfaces:
 592             i.admin_up()
 593
 594     def tearDown(self):
 595         for i in self.pg_interfaces:
 596             i.admin_down()
 597
 598         super(TestGBP, self).tearDown()
 599
 600     def send_and_expect_bridged(self, src, tx, dst):
 601         rx = self.send_and_expect(src, tx, dst)
 602
 603         for r in rx:
 604             self.assertEqual(r[Ether].src, tx[0][Ether].src)
 605             self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
 606             self.assertEqual(r[IP].src, tx[0][IP].src)
 607             self.assertEqual(r[IP].dst, tx[0][IP].dst)
 608         return rx
 609
 610     def send_and_expect_bridged6(self, src, tx, dst):
 611         rx = self.send_and_expect(src, tx, dst)
 612
 613         for r in rx:
 614             self.assertEqual(r[Ether].src, tx[0][Ether].src)
 615             self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
 616             self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
 617             self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
 618         return rx
 619
 620     def send_and_expect_routed(self, src, tx, dst, src_mac):
 621         rx = self.send_and_expect(src, tx, dst)
 622
 623         for r in rx:
 624             self.assertEqual(r[Ether].src, src_mac)
 625             self.assertEqual(r[Ether].dst, dst.remote_mac)
 626             self.assertEqual(r[IP].src, tx[0][IP].src)
 627             self.assertEqual(r[IP].dst, tx[0][IP].dst)
 628         return rx
 629
 630     def send_and_expect_natted(self, src, tx, dst, src_ip):
 631         rx = self.send_and_expect(src, tx, dst)
 632
 633         for r in rx:
 634             self.assertEqual(r[Ether].src, tx[0][Ether].src)
 635             self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
 636             self.assertEqual(r[IP].src, src_ip)
 637             self.assertEqual(r[IP].dst, tx[0][IP].dst)
 638         return rx
 639
 640     def send_and_expect_natted6(self, src, tx, dst, src_ip):
 641         rx = self.send_and_expect(src, tx, dst)
 642
 643         for r in rx:
 644             self.assertEqual(r[Ether].src, tx[0][Ether].src)
 645             self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
 646             self.assertEqual(r[IPv6].src, src_ip)
 647             self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
 648         return rx
 649
 650     def send_and_expect_unnatted(self, src, tx, dst, dst_ip):
 651         rx = self.send_and_expect(src, tx, dst)
 652
 653         for r in rx:
 654             self.assertEqual(r[Ether].src, tx[0][Ether].src)
 655             self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
 656             self.assertEqual(r[IP].dst, dst_ip)
 657             self.assertEqual(r[IP].src, tx[0][IP].src)
 658         return rx
 659
 660     def send_and_expect_unnatted6(self, src, tx, dst, dst_ip):
 661         rx = self.send_and_expect(src, tx, dst)
 662
 663         for r in rx:
 664             self.assertEqual(r[Ether].src, tx[0][Ether].src)
 665             self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
 666             self.assertEqual(r[IPv6].dst, dst_ip)
 667             self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
 668         return rx
 669
 670     def send_and_expect_double_natted(self, src, tx, dst, src_ip, dst_ip):
 671         rx = self.send_and_expect(src, tx, dst)
 672
 673         for r in rx:
 674             self.assertEqual(r[Ether].src, self.router_mac.address)
 675             self.assertEqual(r[Ether].dst, dst.remote_mac)
 676             self.assertEqual(r[IP].dst, dst_ip)
 677             self.assertEqual(r[IP].src, src_ip)
 678         return rx
 679
 680     def send_and_expect_double_natted6(self, src, tx, dst, src_ip, dst_ip):
 681         rx = self.send_and_expect(src, tx, dst)
 682
 683         for r in rx:
 684             self.assertEqual(r[Ether].src, self.router_mac.address)
 685             self.assertEqual(r[Ether].dst, dst.remote_mac)
 686             self.assertEqual(r[IPv6].dst, dst_ip)
 687             self.assertEqual(r[IPv6].src, src_ip)
 688         return rx
 689
 690     def test_gbp(self):
 691         """ Group Based Policy """
 692
 693         ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
 694
 695         #
 696         # Bridge Domains
 697         #
 698         bd1 = VppBridgeDomain(self, 1)
 699         bd2 = VppBridgeDomain(self, 2)
 700         bd20 = VppBridgeDomain(self, 20)
 701
 702         bd1.add_vpp_config()
 703         bd2.add_vpp_config()
 704         bd20.add_vpp_config()
 705
 706         gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
 707         gbd2 = VppGbpBridgeDomain(self, bd2, self.loop1)
 708         gbd20 = VppGbpBridgeDomain(self, bd20, self.loop2)
 709
 710         gbd1.add_vpp_config()
 711         gbd2.add_vpp_config()
 712         gbd20.add_vpp_config()
 713
 714         #
 715         # Route Domains
 716         #
 717         gt4 = VppIpTable(self, 0)
 718         gt4.add_vpp_config()
 719         gt6 = VppIpTable(self, 0, is_ip6=True)
 720         gt6.add_vpp_config()
 721         nt4 = VppIpTable(self, 20)
 722         nt4.add_vpp_config()
 723         nt6 = VppIpTable(self, 20, is_ip6=True)
 724         nt6.add_vpp_config()
 725
 726         rd0 = VppGbpRouteDomain(self, 0, gt4, gt6, None, None)
 727         rd20 = VppGbpRouteDomain(self, 20, nt4, nt6, None, None)
 728
 729         rd0.add_vpp_config()
 730         rd20.add_vpp_config()
 731
 732         #
 733         # 3 EPGs, 2 of which share a BD.
 734         # 2 NAT EPGs, one for floating-IP subnets, the other for internet
 735         #
 736         epgs = [VppGbpEndpointGroup(self, 220, rd0, gbd1, self.pg4,
 737                                     self.loop0,
 738                                     "10.0.0.128",
 739                                     "2001:10::128"),
 740                 VppGbpEndpointGroup(self, 221, rd0, gbd1, self.pg5,
 741                                     self.loop0,
 742                                     "10.0.1.128",
 743                                     "2001:10:1::128"),
 744                 VppGbpEndpointGroup(self, 222, rd0, gbd2, self.pg6,
 745                                     self.loop1,
 746                                     "10.0.2.128",
 747                                     "2001:10:2::128"),
 748                 VppGbpEndpointGroup(self, 333, rd20, gbd20, self.pg7,
 749                                     self.loop2,
 750                                     "11.0.0.128",
 751                                     "3001::128"),
 752                 VppGbpEndpointGroup(self, 444, rd20, gbd20, self.pg8,
 753                                     self.loop2,
 754                                     "11.0.0.129",
 755                                     "3001::129")]
 756         recircs = [VppGbpRecirc(self, epgs[0],
 757                                 self.loop3),
 758                    VppGbpRecirc(self, epgs[1],
 759                                 self.loop4),
 760                    VppGbpRecirc(self, epgs[2],
 761                                 self.loop5),
 762                    VppGbpRecirc(self, epgs[3],
 763                                 self.loop6, is_ext=True),
 764                    VppGbpRecirc(self, epgs[4],
 765                                 self.loop7, is_ext=True)]
 766
 767         epg_nat = epgs[3]
 768         recirc_nat = recircs[3]
 769
 770         #
 771         # 4 end-points, 2 in the same subnet, 3 in the same BD
 772         #
 773         eps = [VppGbpEndpoint(self, self.pg0,
 774                               epgs[0], recircs[0],
 775                               "10.0.0.1", "11.0.0.1",
 776                               "2001:10::1", "3001::1"),
 777                VppGbpEndpoint(self, self.pg1,
 778                               epgs[0], recircs[0],
 779                               "10.0.0.2", "11.0.0.2",
 780                               "2001:10::2", "3001::2"),
 781                VppGbpEndpoint(self, self.pg2,
 782                               epgs[1], recircs[1],
 783                               "10.0.1.1", "11.0.0.3",
 784                               "2001:10:1::1", "3001::3"),
 785                VppGbpEndpoint(self, self.pg3,
 786                               epgs[2], recircs[2],
 787                               "10.0.2.1", "11.0.0.4",
 788                               "2001:10:2::1", "3001::4")]
 789
 790         #
 791         # Config related to each of the EPGs
 792         #
 793         for epg in epgs:
 794             # IP config on the BVI interfaces
 795             if epg != epgs[1] and epg != epgs[4]:
 796                 VppIpInterfaceBind(self, epg.bvi, epg.rd.t4).add_vpp_config()
 797                 VppIpInterfaceBind(self, epg.bvi, epg.rd.t6).add_vpp_config()
 798                 self.vapi.sw_interface_set_mac_address(
 799                     epg.bvi.sw_if_index,
 800                     self.router_mac.bytes)
 801
 802                 # The BVIs are NAT inside interfaces
 803                 self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
 804                                                           is_inside=1,
 805                                                           is_add=1)
 806                 self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
 807                                                   is_inside=1,
 808                                                   is_add=1)
 809
 810             if_ip4 = VppIpInterfaceAddress(self, epg.bvi, epg.bvi_ip4, 32)
 811             if_ip6 = VppIpInterfaceAddress(self, epg.bvi, epg.bvi_ip6, 128)
 812             if_ip4.add_vpp_config()
 813             if_ip6.add_vpp_config()
 814
 815             # EPG uplink interfaces in the RD
 816             VppIpInterfaceBind(self, epg.uplink, epg.rd.t4).add_vpp_config()
 817             VppIpInterfaceBind(self, epg.uplink, epg.rd.t6).add_vpp_config()
 818
 819             # add the BD ARP termination entry for BVI IP
 820             epg.bd_arp_ip4 = VppBridgeDomainArpEntry(self, epg.bd.bd,
 821                                                      self.router_mac.address,
 822                                                      epg.bvi_ip4)
 823             epg.bd_arp_ip6 = VppBridgeDomainArpEntry(self, epg.bd.bd,
 824                                                      self.router_mac.address,
 825                                                      epg.bvi_ip6)
 826             epg.bd_arp_ip4.add_vpp_config()
 827             epg.bd_arp_ip6.add_vpp_config()
 828
 829             # EPG in VPP
 830             epg.add_vpp_config()
 831
 832         for recirc in recircs:
 833             # EPG's ingress recirculation interface maps to its RD
 834             VppIpInterfaceBind(self, recirc.recirc,
 835                                recirc.epg.rd.t4).add_vpp_config()
 836             VppIpInterfaceBind(self, recirc.recirc,
 837                                recirc.epg.rd.t6).add_vpp_config()
 838
 839             self.vapi.nat44_interface_add_del_feature(
 840                 recirc.recirc.sw_if_index,
 841                 is_inside=0,
 842                 is_add=1)
 843             self.vapi.nat66_add_del_interface(
 844                 recirc.recirc.sw_if_index,
 845                 is_inside=0,
 846                 is_add=1)
 847
 848             recirc.add_vpp_config()
 849
 850         for recirc in recircs:
 851             self.assertTrue(find_bridge_domain_port(self,
 852                                                     recirc.epg.bd.bd.bd_id,
 853                                                     recirc.recirc.sw_if_index))
 854
 855         for ep in eps:
 856             self.pg_enable_capture(self.pg_interfaces)
 857             self.pg_start()
 858             #
 859             # routes to the endpoints. We need these since there are no
 860             # adj-fibs due to the fact the the BVI address has /32 and
 861             # the subnet is not attached.
 862             #
 863             for (ip, fip) in zip(ep.ips, ep.fips):
 864                 # Add static mappings for each EP from the 10/8 to 11/8 network
 865                 if ip.af == AF_INET:
 866                     self.vapi.nat44_add_del_static_mapping(ip.bytes,
 867                                                            fip.bytes,
 868                                                            vrf_id=0,
 869                                                            addr_only=1)
 870                 else:
 871                     self.vapi.nat66_add_del_static_mapping(ip.bytes,
 872                                                            fip.bytes,
 873                                                            vrf_id=0)
 874
 875             # VPP EP create ...
 876             ep.add_vpp_config()
 877
 878             self.logger.info(self.vapi.cli("sh gbp endpoint"))
 879
 880             # ... results in a Gratuitous ARP/ND on the EPG's uplink
 881             rx = ep.epg.uplink.get_capture(len(ep.ips), timeout=0.2)
 882
 883             for ii, ip in enumerate(ep.ips):
 884                 p = rx[ii]
 885
 886                 if ip.is_ip6:
 887                     self.assertTrue(p.haslayer(ICMPv6ND_NA))
 888                     self.assertEqual(p[ICMPv6ND_NA].tgt, ip.address)
 889                 else:
 890                     self.assertTrue(p.haslayer(ARP))
 891                     self.assertEqual(p[ARP].psrc, ip.address)
 892                     self.assertEqual(p[ARP].pdst, ip.address)
 893
 894             # add the BD ARP termination entry for floating IP
 895             for fip in ep.fips:
 896                 ba = VppBridgeDomainArpEntry(self, epg_nat.bd.bd, ep.mac, fip)
 897                 ba.add_vpp_config()
 898
 899                 # floating IPs route via EPG recirc
 900                 r = VppIpRoute(self, fip.address, fip.length,
 901                                [VppRoutePath(fip.address,
 902                                              ep.recirc.recirc.sw_if_index,
 903                                              is_dvr=1,
 904                                              proto=fip.dpo_proto)],
 905                                table_id=20,
 906                                is_ip6=fip.is_ip6)
 907                 r.add_vpp_config()
 908
 909             # L2 FIB entries in the NAT EPG BD to bridge the packets from
 910             # the outside direct to the internal EPG
 911             lf = VppL2FibEntry(self, epg_nat.bd.bd, ep.mac,
 912                                ep.recirc.recirc, bvi_mac=0)
 913             lf.add_vpp_config()
 914
 915         #
 916         # ARP packets for unknown IP are sent to the EPG uplink
 917         #
 918         pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
 919                          src=self.pg0.remote_mac) /
 920                    ARP(op="who-has",
 921                        hwdst="ff:ff:ff:ff:ff:ff",
 922                        hwsrc=self.pg0.remote_mac,
 923                        pdst="10.0.0.88",
 924                        psrc="10.0.0.99"))
 925
 926         self.vapi.cli("clear trace")
 927         self.pg0.add_stream(pkt_arp)
 928
 929         self.pg_enable_capture(self.pg_interfaces)
 930         self.pg_start()
 931
 932         rxd = epgs[0].uplink.get_capture(1)
 933
 934         #
 935         # ARP/ND packets get a response
 936         #
 937         pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
 938                          src=self.pg0.remote_mac) /
 939                    ARP(op="who-has",
 940                        hwdst="ff:ff:ff:ff:ff:ff",
 941                        hwsrc=self.pg0.remote_mac,
 942                        pdst=epgs[0].bvi_ip4.address,
 943                        psrc=eps[0].ip4.address))
 944
 945         self.send_and_expect(self.pg0, [pkt_arp], self.pg0)
 946
 947         nsma = in6_getnsma(inet_pton(AF_INET6, eps[0].ip6.address))
 948         d = inet_ntop(AF_INET6, nsma)
 949         pkt_nd = (Ether(dst=in6_getnsmac(nsma),
 950                         src=self.pg0.remote_mac) /
 951                   IPv6(dst=d, src=eps[0].ip6.address) /
 952                   ICMPv6ND_NS(tgt=epgs[0].bvi_ip6.address) /
 953                   ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
 954         self.send_and_expect(self.pg0, [pkt_nd], self.pg0)
 955
 956         #
 957         # broadcast packets are flooded
 958         #
 959         pkt_bcast = (Ether(dst="ff:ff:ff:ff:ff:ff",
 960                            src=self.pg0.remote_mac) /
 961                      IP(src=eps[0].ip4.address, dst="232.1.1.1") /
 962                      UDP(sport=1234, dport=1234) /
 963                      Raw('\xa5' * 100))
 964
 965         self.vapi.cli("clear trace")
 966         self.pg0.add_stream(pkt_bcast)
 967
 968         self.pg_enable_capture(self.pg_interfaces)
 969         self.pg_start()
 970
 971         rxd = eps[1].itf.get_capture(1)
 972         self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
 973         rxd = epgs[0].uplink.get_capture(1)
 974         self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
 975
 976         #
 977         # packets to non-local L3 destinations dropped
 978         #
 979         pkt_intra_epg_220_ip4 = (Ether(src=self.pg0.remote_mac,
 980                                        dst=self.router_mac.address) /
 981                                  IP(src=eps[0].ip4.address,
 982                                     dst="10.0.0.99") /
 983                                  UDP(sport=1234, dport=1234) /
 984                                  Raw('\xa5' * 100))
 985         pkt_inter_epg_222_ip4 = (Ether(src=self.pg0.remote_mac,
 986                                        dst=self.router_mac.address) /
 987                                  IP(src=eps[0].ip4.address,
 988                                     dst="10.0.1.99") /
 989                                  UDP(sport=1234, dport=1234) /
 990                                  Raw('\xa5' * 100))
 991
 992         self.send_and_assert_no_replies(self.pg0, pkt_intra_epg_220_ip4 * 65)
 993
 994         pkt_inter_epg_222_ip6 = (Ether(src=self.pg0.remote_mac,
 995                                        dst=self.router_mac.address) /
 996                                  IPv6(src=eps[0].ip6.address,
 997                                       dst="2001:10::99") /
 998                                  UDP(sport=1234, dport=1234) /
 999                                  Raw('\xa5' * 100))
1000         self.send_and_assert_no_replies(self.pg0, pkt_inter_epg_222_ip6 * 65)
1001
1002         #
1003         # Add the subnet routes
1004         #
1005         s41 = VppGbpSubnet(
1006             self, rd0, "10.0.0.0", 24,
1007             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1008         s42 = VppGbpSubnet(
1009             self, rd0, "10.0.1.0", 24,
1010             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1011         s43 = VppGbpSubnet(
1012             self, rd0, "10.0.2.0", 24,
1013             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1014         s61 = VppGbpSubnet(
1015             self, rd0, "2001:10::1", 64,
1016             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1017         s62 = VppGbpSubnet(
1018             self, rd0, "2001:10:1::1", 64,
1019             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1020         s63 = VppGbpSubnet(
1021             self, rd0, "2001:10:2::1", 64,
1022             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_INTERNAL)
1023         s41.add_vpp_config()
1024         s42.add_vpp_config()
1025         s43.add_vpp_config()
1026         s61.add_vpp_config()
1027         s62.add_vpp_config()
1028         s63.add_vpp_config()
1029
1030         self.send_and_expect_bridged(eps[0].itf,
1031                                      pkt_intra_epg_220_ip4 * 65,
1032                                      eps[0].epg.uplink)
1033         self.send_and_expect_bridged(eps[0].itf,
1034                                      pkt_inter_epg_222_ip4 * 65,
1035                                      eps[0].epg.uplink)
1036         self.send_and_expect_bridged6(eps[0].itf,
1037                                       pkt_inter_epg_222_ip6 * 65,
1038                                       eps[0].epg.uplink)
1039
1040         self.logger.info(self.vapi.cli("sh ip fib 11.0.0.2"))
1041         self.logger.info(self.vapi.cli("sh gbp endpoint-group"))
1042         self.logger.info(self.vapi.cli("sh gbp endpoint"))
1043         self.logger.info(self.vapi.cli("sh gbp recirc"))
1044         self.logger.info(self.vapi.cli("sh int"))
1045         self.logger.info(self.vapi.cli("sh int addr"))
1046         self.logger.info(self.vapi.cli("sh int feat loop6"))
1047         self.logger.info(self.vapi.cli("sh vlib graph ip4-gbp-src-classify"))
1048         self.logger.info(self.vapi.cli("sh int feat loop3"))
1049         self.logger.info(self.vapi.cli("sh int feat pg0"))
1050
1051         #
1052         # Packet destined to unknown unicast is sent on the epg uplink ...
1053         #
1054         pkt_intra_epg_220_to_uplink = (Ether(src=self.pg0.remote_mac,
1055                                              dst="00:00:00:33:44:55") /
1056                                        IP(src=eps[0].ip4.address,
1057                                           dst="10.0.0.99") /
1058                                        UDP(sport=1234, dport=1234) /
1059                                        Raw('\xa5' * 100))
1060
1061         self.send_and_expect_bridged(eps[0].itf,
1062                                      pkt_intra_epg_220_to_uplink * 65,
1063                                      eps[0].epg.uplink)
1064         # ... and nowhere else
1065         self.pg1.get_capture(0, timeout=0.1)
1066         self.pg1.assert_nothing_captured(remark="Flood onto other VMS")
1067
1068         pkt_intra_epg_221_to_uplink = (Ether(src=self.pg2.remote_mac,
1069                                              dst="00:00:00:33:44:66") /
1070                                        IP(src=eps[0].ip4.address,
1071                                           dst="10.0.0.99") /
1072                                        UDP(sport=1234, dport=1234) /
1073                                        Raw('\xa5' * 100))
1074
1075         self.send_and_expect_bridged(eps[2].itf,
1076                                      pkt_intra_epg_221_to_uplink * 65,
1077                                      eps[2].epg.uplink)
1078
1079         #
1080         # Packets from the uplink are forwarded in the absence of a contract
1081         #
1082         pkt_intra_epg_220_from_uplink = (Ether(src="00:00:00:33:44:55",
1083                                                dst=self.pg0.remote_mac) /
1084                                          IP(src=eps[0].ip4.address,
1085                                             dst="10.0.0.99") /
1086                                          UDP(sport=1234, dport=1234) /
1087                                          Raw('\xa5' * 100))
1088
1089         self.send_and_expect_bridged(self.pg4,
1090                                      pkt_intra_epg_220_from_uplink * 65,
1091                                      self.pg0)
1092
1093         #
1094         # in the absence of policy, endpoints in the same EPG
1095         # can communicate
1096         #
1097         pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
1098                                dst=self.pg1.remote_mac) /
1099                          IP(src=eps[0].ip4.address,
1100                             dst=eps[1].ip4.address) /
1101                          UDP(sport=1234, dport=1234) /
1102                          Raw('\xa5' * 100))
1103
1104         self.send_and_expect_bridged(self.pg0, pkt_intra_epg * 65, self.pg1)
1105
1106         #
1107         # in the abscense of policy, endpoints in the different EPG
1108         # cannot communicate
1109         #
1110         pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
1111                                           dst=self.pg2.remote_mac) /
1112                                     IP(src=eps[0].ip4.address,
1113                                        dst=eps[2].ip4.address) /
1114                                     UDP(sport=1234, dport=1234) /
1115                                     Raw('\xa5' * 100))
1116         pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
1117                                           dst=self.pg0.remote_mac) /
1118                                     IP(src=eps[2].ip4.address,
1119                                        dst=eps[0].ip4.address) /
1120                                     UDP(sport=1234, dport=1234) /
1121                                     Raw('\xa5' * 100))
1122         pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
1123                                           dst=self.router_mac.address) /
1124                                     IP(src=eps[0].ip4.address,
1125                                        dst=eps[3].ip4.address) /
1126                                     UDP(sport=1234, dport=1234) /
1127                                     Raw('\xa5' * 100))
1128
1129         self.send_and_assert_no_replies(eps[0].itf,
1130                                         pkt_inter_epg_220_to_221 * 65)
1131         self.send_and_assert_no_replies(eps[0].itf,
1132                                         pkt_inter_epg_220_to_222 * 65)
1133
1134         #
1135         # A uni-directional contract from EPG 220 -> 221
1136         #
1137         acl = VppGbpAcl(self)
1138         rule = acl.create_rule(permit_deny=1, proto=17)
1139         rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
1140         acl_index = acl.add_vpp_config([rule, rule2])
1141         c1 = VppGbpContract(
1142             self, 220, 221, acl_index,
1143             [VppGbpContractRule(
1144                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1145                 []),
1146              VppGbpContractRule(
1147                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1148                  [])])
1149         c1.add_vpp_config()
1150
1151         self.send_and_expect_bridged(eps[0].itf,
1152                                      pkt_inter_epg_220_to_221 * 65,
1153                                      eps[2].itf)
1154         self.send_and_assert_no_replies(eps[0].itf,
1155                                         pkt_inter_epg_220_to_222 * 65)
1156
1157         #
1158         # contract for the return direction
1159         #
1160         c2 = VppGbpContract(
1161             self, 221, 220, acl_index,
1162             [VppGbpContractRule(
1163                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1164                 []),
1165              VppGbpContractRule(
1166                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1167                  [])])
1168
1169         c2.add_vpp_config()
1170
1171         self.send_and_expect_bridged(eps[0].itf,
1172                                      pkt_inter_epg_220_to_221 * 65,
1173                                      eps[2].itf)
1174         self.send_and_expect_bridged(eps[2].itf,
1175                                      pkt_inter_epg_221_to_220 * 65,
1176                                      eps[0].itf)
1177
1178         #
1179         # check that inter group is still disabled for the groups
1180         # not in the contract.
1181         #
1182         self.send_and_assert_no_replies(eps[0].itf,
1183                                         pkt_inter_epg_220_to_222 * 65)
1184
1185         #
1186         # A uni-directional contract from EPG 220 -> 222 'L3 routed'
1187         #
1188         c3 = VppGbpContract(
1189             self, 220, 222, acl_index,
1190             [VppGbpContractRule(
1191                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1192                 []),
1193              VppGbpContractRule(
1194                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1195                  [])])
1196
1197         c3.add_vpp_config()
1198
1199         self.logger.info(self.vapi.cli("sh gbp contract"))
1200
1201         self.send_and_expect_routed(eps[0].itf,
1202                                     pkt_inter_epg_220_to_222 * 65,
1203                                     eps[3].itf,
1204                                     self.router_mac.address)
1205
1206         #
1207         # remove both contracts, traffic stops in both directions
1208         #
1209         c2.remove_vpp_config()
1210         c1.remove_vpp_config()
1211         c3.remove_vpp_config()
1212         acl.remove_vpp_config()
1213
1214         self.send_and_assert_no_replies(eps[2].itf,
1215                                         pkt_inter_epg_221_to_220 * 65)
1216         self.send_and_assert_no_replies(eps[0].itf,
1217                                         pkt_inter_epg_220_to_221 * 65)
1218         self.send_and_expect_bridged(eps[0].itf,
1219                                      pkt_intra_epg * 65,
1220                                      eps[1].itf)
1221
1222         #
1223         # EPs to the outside world
1224         #
1225
1226         # in the EP's RD an external subnet via the NAT EPG's recirc
1227         se1 = VppGbpSubnet(
1228             self, rd0, "0.0.0.0", 0,
1229             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1230             sw_if_index=recirc_nat.recirc.sw_if_index,
1231             epg=epg_nat.epg)
1232         se2 = VppGbpSubnet(
1233             self, rd0, "11.0.0.0", 8,
1234             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1235             sw_if_index=recirc_nat.recirc.sw_if_index,
1236             epg=epg_nat.epg)
1237         se16 = VppGbpSubnet(
1238             self, rd0, "::", 0,
1239             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1240             sw_if_index=recirc_nat.recirc.sw_if_index,
1241             epg=epg_nat.epg)
1242         # in the NAT RD an external subnet via the NAT EPG's uplink
1243         se3 = VppGbpSubnet(
1244             self, rd20, "0.0.0.0", 0,
1245             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1246             sw_if_index=epg_nat.uplink.sw_if_index,
1247             epg=epg_nat.epg)
1248         se36 = VppGbpSubnet(
1249             self, rd20, "::", 0,
1250             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1251             sw_if_index=epg_nat.uplink.sw_if_index,
1252             epg=epg_nat.epg)
1253         se4 = VppGbpSubnet(
1254             self, rd20, "11.0.0.0", 8,
1255             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_STITCHED_EXTERNAL,
1256             sw_if_index=epg_nat.uplink.sw_if_index,
1257             epg=epg_nat.epg)
1258         se1.add_vpp_config()
1259         se2.add_vpp_config()
1260         se16.add_vpp_config()
1261         se3.add_vpp_config()
1262         se36.add_vpp_config()
1263         se4.add_vpp_config()
1264
1265         self.logger.info(self.vapi.cli("sh ip fib 0.0.0.0/0"))
1266         self.logger.info(self.vapi.cli("sh ip fib 11.0.0.1"))
1267         self.logger.info(self.vapi.cli("sh ip6 fib ::/0"))
1268         self.logger.info(self.vapi.cli("sh ip6 fib %s" %
1269                                        eps[0].fip6))
1270
1271         #
1272         # From an EP to an outside addess: IN2OUT
1273         #
1274         pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
1275                                              dst=self.router_mac.address) /
1276                                        IP(src=eps[0].ip4.address,
1277                                           dst="1.1.1.1") /
1278                                        UDP(sport=1234, dport=1234) /
1279                                        Raw('\xa5' * 100))
1280
1281         # no policy yet
1282         self.send_and_assert_no_replies(eps[0].itf,
1283                                         pkt_inter_epg_220_to_global * 65)
1284
1285         acl2 = VppGbpAcl(self)
1286         rule = acl2.create_rule(permit_deny=1, proto=17, sport_from=1234,
1287                                 sport_to=1234, dport_from=1234, dport_to=1234)
1288         rule2 = acl2.create_rule(is_ipv6=1, permit_deny=1, proto=17,
1289                                  sport_from=1234, sport_to=1234,
1290                                  dport_from=1234, dport_to=1234)
1291
1292         acl_index2 = acl2.add_vpp_config([rule, rule2])
1293         c4 = VppGbpContract(
1294             self, 220, 333, acl_index2,
1295             [VppGbpContractRule(
1296                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1297                 []),
1298              VppGbpContractRule(
1299                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1300                  [])])
1301
1302         c4.add_vpp_config()
1303
1304         self.send_and_expect_natted(eps[0].itf,
1305                                     pkt_inter_epg_220_to_global * 65,
1306                                     self.pg7,
1307                                     eps[0].fip4.address)
1308
1309         pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
1310                                              dst=self.router_mac.address) /
1311                                        IPv6(src=eps[0].ip6.address,
1312                                             dst="6001::1") /
1313                                        UDP(sport=1234, dport=1234) /
1314                                        Raw('\xa5' * 100))
1315
1316         self.send_and_expect_natted6(self.pg0,
1317                                      pkt_inter_epg_220_to_global * 65,
1318                                      self.pg7,
1319                                      eps[0].fip6.address)
1320
1321         #
1322         # From a global address to an EP: OUT2IN
1323         #
1324         pkt_inter_epg_220_from_global = (Ether(src=self.router_mac.address,
1325                                                dst=self.pg0.remote_mac) /
1326                                          IP(dst=eps[0].fip4.address,
1327                                             src="1.1.1.1") /
1328                                          UDP(sport=1234, dport=1234) /
1329                                          Raw('\xa5' * 100))
1330
1331         self.send_and_assert_no_replies(self.pg7,
1332                                         pkt_inter_epg_220_from_global * 65)
1333
1334         c5 = VppGbpContract(
1335             self, 333, 220, acl_index2,
1336             [VppGbpContractRule(
1337                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1338                 []),
1339              VppGbpContractRule(
1340                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1341                  [])])
1342
1343         c5.add_vpp_config()
1344
1345         self.send_and_expect_unnatted(self.pg7,
1346                                       pkt_inter_epg_220_from_global * 65,
1347                                       eps[0].itf,
1348                                       eps[0].ip4.address)
1349
1350         pkt_inter_epg_220_from_global = (Ether(src=self.router_mac.address,
1351                                                dst=self.pg0.remote_mac) /
1352                                          IPv6(dst=eps[0].fip6.address,
1353                                               src="6001::1") /
1354                                          UDP(sport=1234, dport=1234) /
1355                                          Raw('\xa5' * 100))
1356
1357         self.send_and_expect_unnatted6(self.pg7,
1358                                        pkt_inter_epg_220_from_global * 65,
1359                                        eps[0].itf,
1360                                        eps[0].ip6.address)
1361
1362         #
1363         # From a local VM to another local VM using resp. public addresses:
1364         #  IN2OUT2IN
1365         #
1366         pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
1367                                           dst=self.router_mac.address) /
1368                                     IP(src=eps[0].ip4.address,
1369                                        dst=eps[1].fip4.address) /
1370                                     UDP(sport=1234, dport=1234) /
1371                                     Raw('\xa5' * 100))
1372
1373         self.send_and_expect_double_natted(eps[0].itf,
1374                                            pkt_intra_epg_220_global * 65,
1375                                            eps[1].itf,
1376                                            eps[0].fip4.address,
1377                                            eps[1].ip4.address)
1378
1379         pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
1380                                           dst=self.router_mac.address) /
1381                                     IPv6(src=eps[0].ip6.address,
1382                                          dst=eps[1].fip6.address) /
1383                                     UDP(sport=1234, dport=1234) /
1384                                     Raw('\xa5' * 100))
1385
1386         self.send_and_expect_double_natted6(eps[0].itf,
1387                                             pkt_intra_epg_220_global * 65,
1388                                             eps[1].itf,
1389                                             eps[0].fip6.address,
1390                                             eps[1].ip6.address)
1391
1392         #
1393         # cleanup
1394         #
1395         for ep in eps:
1396             # del static mappings for each EP from the 10/8 to 11/8 network
1397             self.vapi.nat44_add_del_static_mapping(ep.ip4.bytes,
1398                                                    ep.fip4.bytes,
1399                                                    vrf_id=0,
1400                                                    addr_only=1,
1401                                                    is_add=0)
1402             self.vapi.nat66_add_del_static_mapping(ep.ip6.bytes,
1403                                                    ep.fip6.bytes,
1404                                                    vrf_id=0,
1405                                                    is_add=0)
1406
1407         for epg in epgs:
1408             # IP config on the BVI interfaces
1409             if epg != epgs[0] and epg != epgs[3]:
1410                 self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
1411                                                           is_inside=1,
1412                                                           is_add=0)
1413                 self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
1414                                                   is_inside=1,
1415                                                   is_add=0)
1416
1417         for recirc in recircs:
1418             self.vapi.nat44_interface_add_del_feature(
1419                 recirc.recirc.sw_if_index,
1420                 is_inside=0,
1421                 is_add=0)
1422             self.vapi.nat66_add_del_interface(
1423                 recirc.recirc.sw_if_index,
1424                 is_inside=0,
1425                 is_add=0)
1426
1427     def test_gbp_learn_l2(self):
1428         """ GBP L2 Endpoint Learning """
1429
1430         ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1431         learnt = [{'mac': '00:00:11:11:11:01',
1432                    'ip': '10.0.0.1',
1433                    'ip6': '2001:10::2'},
1434                   {'mac': '00:00:11:11:11:02',
1435                    'ip': '10.0.0.2',
1436                    'ip6': '2001:10::3'}]
1437
1438         #
1439         # lower the inactive threshold so these tests pass in a
1440         # reasonable amount of time
1441         #
1442         self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
1443
1444         #
1445         # IP tables
1446         #
1447         gt4 = VppIpTable(self, 1)
1448         gt4.add_vpp_config()
1449         gt6 = VppIpTable(self, 1, is_ip6=True)
1450         gt6.add_vpp_config()
1451
1452         rd1 = VppGbpRouteDomain(self, 1, gt4, gt6)
1453         rd1.add_vpp_config()
1454
1455         #
1456         # Pg2 hosts the vxlan tunnel, hosts on pg2 to act as TEPs
1457         # Pg3 hosts the IP4 UU-flood VXLAN tunnel
1458         # Pg4 hosts the IP6 UU-flood VXLAN tunnel
1459         #
1460         self.pg2.config_ip4()
1461         self.pg2.resolve_arp()
1462         self.pg2.generate_remote_hosts(4)
1463         self.pg2.configure_ipv4_neighbors()
1464         self.pg3.config_ip4()
1465         self.pg3.resolve_arp()
1466         self.pg4.config_ip4()
1467         self.pg4.resolve_arp()
1468
1469         #
1470         # a GBP bridge domain with a BVI and a UU-flood interface
1471         #
1472         bd1 = VppBridgeDomain(self, 1)
1473         bd1.add_vpp_config()
1474         gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, self.pg3)
1475         gbd1.add_vpp_config()
1476
1477         self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1478         self.logger.info(self.vapi.cli("sh gbp bridge"))
1479
1480         # ... and has a /32 applied
1481         ip_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
1482         ip_addr.add_vpp_config()
1483
1484         #
1485         # The Endpoint-group in which we are learning endpoints
1486         #
1487         epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
1488                                       None, self.loop0,
1489                                       "10.0.0.128",
1490                                       "2001:10::128")
1491         epg_220.add_vpp_config()
1492         epg_330 = VppGbpEndpointGroup(self, 330, rd1, gbd1,
1493                                       None, self.loop1,
1494                                       "10.0.1.128",
1495                                       "2001:11::128")
1496         epg_330.add_vpp_config()
1497
1498         #
1499         # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
1500         # leanring enabled
1501         #
1502         vx_tun_l2_1 = VppGbpVxlanTunnel(
1503             self, 99, bd1.bd_id,
1504             VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L2)
1505         vx_tun_l2_1.add_vpp_config()
1506
1507         #
1508         # A static endpoint that the learnt endpoints are trying to
1509         # talk to
1510         #
1511         ep = VppGbpEndpoint(self, self.pg0,
1512                             epg_220, None,
1513                             "10.0.0.127", "11.0.0.127",
1514                             "2001:10::1", "3001::1")
1515         ep.add_vpp_config()
1516
1517         self.assertTrue(find_route(self, ep.ip4.address, 32, table_id=1))
1518
1519         # a packet with an sclass from an unknwon EPG
1520         p = (Ether(src=self.pg2.remote_mac,
1521                    dst=self.pg2.local_mac) /
1522              IP(src=self.pg2.remote_hosts[0].ip4,
1523                 dst=self.pg2.local_ip4) /
1524              UDP(sport=1234, dport=48879) /
1525              VXLAN(vni=99, gpid=88, flags=0x88) /
1526              Ether(src=learnt[0]["mac"], dst=ep.mac) /
1527              IP(src=learnt[0]["ip"], dst=ep.ip4.address) /
1528              UDP(sport=1234, dport=1234) /
1529              Raw('\xa5' * 100))
1530
1531         self.send_and_assert_no_replies(self.pg2, p)
1532
1533         #
1534         # we should not have learnt a new tunnel endpoint, since
1535         # the EPG was not learnt.
1536         #
1537         self.assertEqual(INDEX_INVALID,
1538                          find_vxlan_gbp_tunnel(self,
1539                                                self.pg2.local_ip4,
1540                                                self.pg2.remote_hosts[0].ip4,
1541                                                99))
1542
1543         # epg is not learnt, becasue the EPG is unknwon
1544         self.assertEqual(len(self.vapi.gbp_endpoint_dump()), 1)
1545
1546         for ii, l in enumerate(learnt):
1547             # a packet with an sclass from a knwon EPG
1548             # arriving on an unknown TEP
1549             p = (Ether(src=self.pg2.remote_mac,
1550                        dst=self.pg2.local_mac) /
1551                  IP(src=self.pg2.remote_hosts[1].ip4,
1552                     dst=self.pg2.local_ip4) /
1553                  UDP(sport=1234, dport=48879) /
1554                  VXLAN(vni=99, gpid=220, flags=0x88) /
1555                  Ether(src=l['mac'], dst=ep.mac) /
1556                  IP(src=l['ip'], dst=ep.ip4.address) /
1557                  UDP(sport=1234, dport=1234) /
1558                  Raw('\xa5' * 100))
1559
1560             rx = self.send_and_expect(self.pg2, [p], self.pg0)
1561
1562             # the new TEP
1563             tep1_sw_if_index = find_vxlan_gbp_tunnel(
1564                 self,
1565                 self.pg2.local_ip4,
1566                 self.pg2.remote_hosts[1].ip4,
1567                 99)
1568             self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
1569
1570             #
1571             # the EP is learnt via the learnt TEP
1572             # both from its MAC and its IP
1573             #
1574             self.assertTrue(find_gbp_endpoint(self,
1575                                               vx_tun_l2_1.sw_if_index,
1576                                               mac=l['mac']))
1577             self.assertTrue(find_gbp_endpoint(self,
1578                                               vx_tun_l2_1.sw_if_index,
1579                                               ip=l['ip']))
1580
1581         self.logger.info(self.vapi.cli("show gbp endpoint"))
1582         self.logger.info(self.vapi.cli("show gbp vxlan"))
1583         self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
1584
1585         #
1586         # If we sleep for the threshold time, the learnt endpoints should
1587         # age out
1588         #
1589         self.sleep(2)
1590         for l in learnt:
1591             self.assertFalse(find_gbp_endpoint(self,
1592                                                mac=l['mac']))
1593
1594         #
1595         # repeat. the do not learn bit is set so the EPs are not learnt
1596         #
1597         for l in learnt:
1598             # a packet with an sclass from a knwon EPG
1599             p = (Ether(src=self.pg2.remote_mac,
1600                        dst=self.pg2.local_mac) /
1601                  IP(src=self.pg2.remote_hosts[1].ip4,
1602                     dst=self.pg2.local_ip4) /
1603                  UDP(sport=1234, dport=48879) /
1604                  VXLAN(vni=99, gpid=220, flags=0x88, gpflags="D") /
1605                  Ether(src=l['mac'], dst=ep.mac) /
1606                  IP(src=l['ip'], dst=ep.ip4.address) /
1607                  UDP(sport=1234, dport=1234) /
1608                  Raw('\xa5' * 100))
1609
1610             rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1611
1612         for l in learnt:
1613             self.assertFalse(find_gbp_endpoint(self,
1614                                                vx_tun_l2_1.sw_if_index,
1615                                                mac=l['mac']))
1616
1617         #
1618         # repeat
1619         #
1620         for l in learnt:
1621             # a packet with an sclass from a knwon EPG
1622             p = (Ether(src=self.pg2.remote_mac,
1623                        dst=self.pg2.local_mac) /
1624                  IP(src=self.pg2.remote_hosts[1].ip4,
1625                     dst=self.pg2.local_ip4) /
1626                  UDP(sport=1234, dport=48879) /
1627                  VXLAN(vni=99, gpid=220, flags=0x88) /
1628                  Ether(src=l['mac'], dst=ep.mac) /
1629                  IP(src=l['ip'], dst=ep.ip4.address) /
1630                  UDP(sport=1234, dport=1234) /
1631                  Raw('\xa5' * 100))
1632
1633             rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1634
1635             self.assertTrue(find_gbp_endpoint(self,
1636                                               vx_tun_l2_1.sw_if_index,
1637                                               mac=l['mac']))
1638
1639         #
1640         # Static EP replies to dynamics
1641         #
1642         self.logger.info(self.vapi.cli("sh l2fib bd_id 1"))
1643         for l in learnt:
1644             p = (Ether(src=ep.mac, dst=l['mac']) /
1645                  IP(dst=l['ip'], src=ep.ip4.address) /
1646                  UDP(sport=1234, dport=1234) /
1647                  Raw('\xa5' * 100))
1648
1649             rxs = self.send_and_expect(self.pg0, p * 17, self.pg2)
1650
1651             for rx in rxs:
1652                 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
1653                 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
1654                 self.assertEqual(rx[UDP].dport, 48879)
1655                 # the UDP source port is a random value for hashing
1656                 self.assertEqual(rx[VXLAN].gpid, 220)
1657                 self.assertEqual(rx[VXLAN].vni, 99)
1658                 self.assertTrue(rx[VXLAN].flags.G)
1659                 self.assertTrue(rx[VXLAN].flags.Instance)
1660                 self.assertTrue(rx[VXLAN].gpflags.A)
1661                 self.assertFalse(rx[VXLAN].gpflags.D)
1662
1663         self.sleep(2)
1664         for l in learnt:
1665             self.assertFalse(find_gbp_endpoint(self,
1666                                                vx_tun_l2_1.sw_if_index,
1667                                                mac=l['mac']))
1668
1669         #
1670         # repeat in the other EPG
1671         # there's no contract between 220 and 330, but the A-bit is set
1672         # so the packet is cleared for delivery
1673         #
1674         for l in learnt:
1675             # a packet with an sclass from a knwon EPG
1676             p = (Ether(src=self.pg2.remote_mac,
1677                        dst=self.pg2.local_mac) /
1678                  IP(src=self.pg2.remote_hosts[1].ip4,
1679                     dst=self.pg2.local_ip4) /
1680                  UDP(sport=1234, dport=48879) /
1681                  VXLAN(vni=99, gpid=330, flags=0x88, gpflags='A') /
1682                  Ether(src=l['mac'], dst=ep.mac) /
1683                  IP(src=l['ip'], dst=ep.ip4.address) /
1684                  UDP(sport=1234, dport=1234) /
1685                  Raw('\xa5' * 100))
1686
1687             rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1688
1689             self.assertTrue(find_gbp_endpoint(self,
1690                                               vx_tun_l2_1.sw_if_index,
1691                                               mac=l['mac']))
1692
1693         #
1694         # static EP cannot reach the learnt EPs since there is no contract
1695         # only test 1 EP as the others could timeout
1696         #
1697         p = (Ether(src=ep.mac, dst=l['mac']) /
1698              IP(dst=learnt[0]['ip'], src=ep.ip4.address) /
1699              UDP(sport=1234, dport=1234) /
1700              Raw('\xa5' * 100))
1701
1702         self.send_and_assert_no_replies(self.pg0, [p])
1703
1704         #
1705         # refresh the entries after the check for no replies above
1706         #
1707         for l in learnt:
1708             # a packet with an sclass from a knwon EPG
1709             p = (Ether(src=self.pg2.remote_mac,
1710                        dst=self.pg2.local_mac) /
1711                  IP(src=self.pg2.remote_hosts[1].ip4,
1712                     dst=self.pg2.local_ip4) /
1713                  UDP(sport=1234, dport=48879) /
1714                  VXLAN(vni=99, gpid=330, flags=0x88, gpflags='A') /
1715                  Ether(src=l['mac'], dst=ep.mac) /
1716                  IP(src=l['ip'], dst=ep.ip4.address) /
1717                  UDP(sport=1234, dport=1234) /
1718                  Raw('\xa5' * 100))
1719
1720             rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1721
1722             self.assertTrue(find_gbp_endpoint(self,
1723                                               vx_tun_l2_1.sw_if_index,
1724                                               mac=l['mac']))
1725
1726         #
1727         # Add the contract so they can talk
1728         #
1729         acl = VppGbpAcl(self)
1730         rule = acl.create_rule(permit_deny=1, proto=17)
1731         rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
1732         acl_index = acl.add_vpp_config([rule, rule2])
1733         c1 = VppGbpContract(
1734             self, 220, 330, acl_index,
1735             [VppGbpContractRule(
1736                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1737                 []),
1738              VppGbpContractRule(
1739                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
1740                  [])])
1741
1742         c1.add_vpp_config()
1743
1744         for l in learnt:
1745             p = (Ether(src=ep.mac, dst=l['mac']) /
1746                  IP(dst=l['ip'], src=ep.ip4.address) /
1747                  UDP(sport=1234, dport=1234) /
1748                  Raw('\xa5' * 100))
1749
1750             self.send_and_expect(self.pg0, [p], self.pg2)
1751
1752         #
1753         # send UU packets from the local EP
1754         #
1755         self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1756         self.logger.info(self.vapi.cli("sh gbp bridge"))
1757         p_uu = (Ether(src=ep.mac, dst="00:11:11:11:11:11") /
1758                 IP(dst="10.0.0.133", src=ep.ip4.address) /
1759                 UDP(sport=1234, dport=1234) /
1760                 Raw('\xa5' * 100))
1761         rxs = self.send_and_expect(ep.itf, [p_uu], gbd1.uu_flood)
1762
1763         #
1764         # Add a mcast destination VXLAN-GBP tunnel for B&M traffic
1765         #
1766         tun_bm = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
1767                                    "239.1.1.1", 88,
1768                                    mcast_itf=self.pg4)
1769         tun_bm.add_vpp_config()
1770         bp_bm = VppBridgeDomainPort(self, bd1, tun_bm,
1771                                     port_type=L2_PORT_TYPE.NORMAL)
1772         bp_bm.add_vpp_config()
1773
1774         self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1775
1776         p_bm = (Ether(src=ep.mac, dst="ff:ff:ff:ff:ff:ff") /
1777                 IP(dst="10.0.0.133", src=ep.ip4.address) /
1778                 UDP(sport=1234, dport=1234) /
1779                 Raw('\xa5' * 100))
1780         rxs = self.send_and_expect_only(ep.itf, [p_bm], tun_bm.mcast_itf)
1781
1782         #
1783         # Check v6 Endpoints
1784         #
1785         for l in learnt:
1786             # a packet with an sclass from a knwon EPG
1787             p = (Ether(src=self.pg2.remote_mac,
1788                        dst=self.pg2.local_mac) /
1789                  IP(src=self.pg2.remote_hosts[1].ip4,
1790                     dst=self.pg2.local_ip4) /
1791                  UDP(sport=1234, dport=48879) /
1792                  VXLAN(vni=99, gpid=330, flags=0x88, gpflags='A') /
1793                  Ether(src=l['mac'], dst=ep.mac) /
1794                  IPv6(src=l['ip6'], dst=ep.ip6.address) /
1795                  UDP(sport=1234, dport=1234) /
1796                  Raw('\xa5' * 100))
1797
1798             rx = self.send_and_expect(self.pg2, p*65, self.pg0)
1799
1800             self.assertTrue(find_gbp_endpoint(self,
1801                                               vx_tun_l2_1.sw_if_index,
1802                                               mac=l['mac']))
1803
1804         #
1805         # L3 Endpoint Learning
1806         #  - configured on the bridge's BVI
1807         #
1808
1809         #
1810         # clean up
1811         #
1812         self.sleep(2)
1813         for l in learnt:
1814             self.assertFalse(find_gbp_endpoint(self,
1815                                                vx_tun_l2_1.sw_if_index,
1816                                                mac=l['mac']))
1817
1818         self.pg2.unconfig_ip4()
1819         self.pg3.unconfig_ip4()
1820         self.pg4.unconfig_ip4()
1821
1822         self.logger.info(self.vapi.cli("sh int"))
1823         self.logger.info(self.vapi.cli("sh gbp vxlan"))
1824
1825     def test_gbp_learn_vlan_l2(self):
1826         """ GBP L2 Endpoint w/ VLANs"""
1827
1828         ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1829         learnt = [{'mac': '00:00:11:11:11:01',
1830                    'ip': '10.0.0.1',
1831                    'ip6': '2001:10::2'},
1832                   {'mac': '00:00:11:11:11:02',
1833                    'ip': '10.0.0.2',
1834                    'ip6': '2001:10::3'}]
1835
1836         #
1837         # lower the inactive threshold so these tests pass in a
1838         # reasonable amount of time
1839         #
1840         self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
1841
1842         #
1843         # IP tables
1844         #
1845         gt4 = VppIpTable(self, 1)
1846         gt4.add_vpp_config()
1847         gt6 = VppIpTable(self, 1, is_ip6=True)
1848         gt6.add_vpp_config()
1849
1850         rd1 = VppGbpRouteDomain(self, 1, gt4, gt6)
1851         rd1.add_vpp_config()
1852
1853         #
1854         # Pg2 hosts the vxlan tunnel, hosts on pg2 to act as TEPs
1855         #
1856         self.pg2.config_ip4()
1857         self.pg2.resolve_arp()
1858         self.pg2.generate_remote_hosts(4)
1859         self.pg2.configure_ipv4_neighbors()
1860         self.pg3.config_ip4()
1861         self.pg3.resolve_arp()
1862
1863         #
1864         # The EP will be on a vlan sub-interface
1865         #
1866         vlan_11 = VppDot1QSubint(self, self.pg0, 11)
1867         vlan_11.admin_up()
1868         self.vapi.sw_interface_set_l2_tag_rewrite(vlan_11.sw_if_index,
1869                                                   L2_VTR_OP.L2_POP_1,
1870                                                   11)
1871
1872         bd_uu_fwd = VppVxlanGbpTunnel(self, self.pg3.local_ip4,
1873                                       self.pg3.remote_ip4, 116)
1874         bd_uu_fwd.add_vpp_config()
1875
1876         #
1877         # a GBP bridge domain with a BVI and a UU-flood interface
1878         # The BD is marked as do not learn, so no endpoints are ever
1879         # learnt in this BD.
1880         #
1881         bd1 = VppBridgeDomain(self, 1)
1882         bd1.add_vpp_config()
1883         gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, bd_uu_fwd,
1884                                   learn=False)
1885         gbd1.add_vpp_config()
1886
1887         self.logger.info(self.vapi.cli("sh bridge 1 detail"))
1888         self.logger.info(self.vapi.cli("sh gbp bridge"))
1889
1890         # ... and has a /32 applied
1891         ip_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
1892         ip_addr.add_vpp_config()
1893
1894         #
1895         # The Endpoint-group in which we are learning endpoints
1896         #
1897         epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
1898                                       None, self.loop0,
1899                                       "10.0.0.128",
1900                                       "2001:10::128")
1901         epg_220.add_vpp_config()
1902
1903         #
1904         # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
1905         # leanring enabled
1906         #
1907         vx_tun_l2_1 = VppGbpVxlanTunnel(
1908             self, 99, bd1.bd_id,
1909             VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L2)
1910         vx_tun_l2_1.add_vpp_config()
1911
1912         #
1913         # A static endpoint that the learnt endpoints are trying to
1914         # talk to
1915         #
1916         ep = VppGbpEndpoint(self, vlan_11,
1917                             epg_220, None,
1918                             "10.0.0.127", "11.0.0.127",
1919                             "2001:10::1", "3001::1")
1920         ep.add_vpp_config()
1921
1922         self.assertTrue(find_route(self, ep.ip4.address, 32, table_id=1))
1923
1924         #
1925         # Send to the static EP
1926         #
1927         for ii, l in enumerate(learnt):
1928             # a packet with an sclass from a knwon EPG
1929             # arriving on an unknown TEP
1930             p = (Ether(src=self.pg2.remote_mac,
1931                        dst=self.pg2.local_mac) /
1932                  IP(src=self.pg2.remote_hosts[1].ip4,
1933                     dst=self.pg2.local_ip4) /
1934                  UDP(sport=1234, dport=48879) /
1935                  VXLAN(vni=99, gpid=220, flags=0x88) /
1936                  Ether(src=l['mac'], dst=ep.mac) /
1937                  IP(src=l['ip'], dst=ep.ip4.address) /
1938                  UDP(sport=1234, dport=1234) /
1939                  Raw('\xa5' * 100))
1940
1941             rxs = self.send_and_expect(self.pg2, [p], self.pg0)
1942
1943             #
1944             # packet to EP has the EP's vlan tag
1945             #
1946             for rx in rxs:
1947                 self.assertEqual(rx[Dot1Q].vlan, 11)
1948
1949             #
1950             # the EP is not learnt since the BD setting prevents it
1951             # also no TEP too
1952             #
1953             self.assertFalse(find_gbp_endpoint(self,
1954                                                vx_tun_l2_1.sw_if_index,
1955                                                mac=l['mac']))
1956             self.assertEqual(INDEX_INVALID,
1957                              find_vxlan_gbp_tunnel(
1958                                  self,
1959                                  self.pg2.local_ip4,
1960                                  self.pg2.remote_hosts[1].ip4,
1961                                  99))
1962
1963         self.assertEqual(len(self.vapi.gbp_endpoint_dump()), 1)
1964
1965         #
1966         # static to remotes
1967         # we didn't learn the remotes so they are sent to the UU-fwd
1968         #
1969         for l in learnt:
1970             p = (Ether(src=ep.mac, dst=l['mac']) /
1971                  Dot1Q(vlan=11) /
1972                  IP(dst=l['ip'], src=ep.ip4.address) /
1973                  UDP(sport=1234, dport=1234) /
1974                  Raw('\xa5' * 100))
1975
1976             rxs = self.send_and_expect(self.pg0, p * 17, self.pg3)
1977
1978             for rx in rxs:
1979                 self.assertEqual(rx[IP].src, self.pg3.local_ip4)
1980                 self.assertEqual(rx[IP].dst, self.pg3.remote_ip4)
1981                 self.assertEqual(rx[UDP].dport, 48879)
1982                 # the UDP source port is a random value for hashing
1983                 self.assertEqual(rx[VXLAN].gpid, 220)
1984                 self.assertEqual(rx[VXLAN].vni, 116)
1985                 self.assertTrue(rx[VXLAN].flags.G)
1986                 self.assertTrue(rx[VXLAN].flags.Instance)
1987                 self.assertFalse(rx[VXLAN].gpflags.A)
1988                 self.assertFalse(rx[VXLAN].gpflags.D)
1989
1990         self.pg2.unconfig_ip4()
1991         self.pg3.unconfig_ip4()
1992
1993     def test_gbp_learn_l3(self):
1994         """ GBP L3 Endpoint Learning """
1995
1996         self.vapi.cli("set logging class gbp debug")
1997
1998         ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
1999         routed_dst_mac = "00:0c:0c:0c:0c:0c"
2000         routed_src_mac = "00:22:bd:f8:19:ff"
2001
2002         learnt = [{'mac': '00:00:11:11:11:02',
2003                    'ip': '10.0.1.2',
2004                    'ip6': '2001:10::2'},
2005                   {'mac': '00:00:11:11:11:03',
2006                    'ip': '10.0.1.3',
2007                    'ip6': '2001:10::3'}]
2008
2009         #
2010         # lower the inactive threshold so these tests pass in a
2011         # reasonable amount of time
2012         #
2013         self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
2014
2015         #
2016         # IP tables
2017         #
2018         t4 = VppIpTable(self, 1)
2019         t4.add_vpp_config()
2020         t6 = VppIpTable(self, 1, True)
2021         t6.add_vpp_config()
2022
2023         tun_ip4_uu = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
2024                                        self.pg4.remote_ip4, 114)
2025         tun_ip6_uu = VppVxlanGbpTunnel(self, self.pg4.local_ip4,
2026                                        self.pg4.remote_ip4, 116)
2027         tun_ip4_uu.add_vpp_config()
2028         tun_ip6_uu.add_vpp_config()
2029
2030         rd1 = VppGbpRouteDomain(self, 2, t4, t6, tun_ip4_uu, tun_ip6_uu)
2031         rd1.add_vpp_config()
2032
2033         self.loop0.set_mac(self.router_mac.address)
2034
2035         #
2036         # Bind the BVI to the RD
2037         #
2038         VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
2039         VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
2040
2041         #
2042         # Pg2 hosts the vxlan tunnel
2043         # hosts on pg2 to act as TEPs
2044         # pg3 is BD uu-fwd
2045         # pg4 is RD uu-fwd
2046         #
2047         self.pg2.config_ip4()
2048         self.pg2.resolve_arp()
2049         self.pg2.generate_remote_hosts(4)
2050         self.pg2.configure_ipv4_neighbors()
2051         self.pg3.config_ip4()
2052         self.pg3.resolve_arp()
2053         self.pg4.config_ip4()
2054         self.pg4.resolve_arp()
2055
2056         #
2057         # a GBP bridge domain with a BVI and a UU-flood interface
2058         #
2059         bd1 = VppBridgeDomain(self, 1)
2060         bd1.add_vpp_config()
2061         gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0, self.pg3)
2062         gbd1.add_vpp_config()
2063
2064         self.logger.info(self.vapi.cli("sh bridge 1 detail"))
2065         self.logger.info(self.vapi.cli("sh gbp bridge"))
2066         self.logger.info(self.vapi.cli("sh gbp route"))
2067
2068         # ... and has a /32 and /128 applied
2069         ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2070         ip4_addr.add_vpp_config()
2071         ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 128)
2072         ip6_addr.add_vpp_config()
2073
2074         #
2075         # The Endpoint-group in which we are learning endpoints
2076         #
2077         epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
2078                                       None, self.loop0,
2079                                       "10.0.0.128",
2080                                       "2001:10::128")
2081         epg_220.add_vpp_config()
2082
2083         #
2084         # The VXLAN GBP tunnel is a bridge-port and has L2 endpoint
2085         # leanring enabled
2086         #
2087         vx_tun_l3 = VppGbpVxlanTunnel(
2088             self, 101, rd1.rd_id,
2089             VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3)
2090         vx_tun_l3.add_vpp_config()
2091
2092         #
2093         # A static endpoint that the learnt endpoints are trying to
2094         # talk to
2095         #
2096         ep = VppGbpEndpoint(self, self.pg0,
2097                             epg_220, None,
2098                             "10.0.0.127", "11.0.0.127",
2099                             "2001:10::1", "3001::1")
2100         ep.add_vpp_config()
2101
2102         #
2103         # learn some remote IPv4 EPs
2104         #
2105         for ii, l in enumerate(learnt):
2106             # a packet with an sclass from a knwon EPG
2107             # arriving on an unknown TEP
2108             p = (Ether(src=self.pg2.remote_mac,
2109                        dst=self.pg2.local_mac) /
2110                  IP(src=self.pg2.remote_hosts[1].ip4,
2111                     dst=self.pg2.local_ip4) /
2112                  UDP(sport=1234, dport=48879) /
2113                  VXLAN(vni=101, gpid=220, flags=0x88) /
2114                  Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2115                  IP(src=l['ip'], dst=ep.ip4.address) /
2116                  UDP(sport=1234, dport=1234) /
2117                  Raw('\xa5' * 100))
2118
2119             rx = self.send_and_expect(self.pg2, [p], self.pg0)
2120
2121             # the new TEP
2122             tep1_sw_if_index = find_vxlan_gbp_tunnel(
2123                 self,
2124                 self.pg2.local_ip4,
2125                 self.pg2.remote_hosts[1].ip4,
2126                 vx_tun_l3.vni)
2127             self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2128
2129             # endpoint learnt via the parent GBP-vxlan interface
2130             self.assertTrue(find_gbp_endpoint(self,
2131                                               vx_tun_l3._sw_if_index,
2132                                               ip=l['ip']))
2133
2134         #
2135         # Static IPv4 EP replies to learnt
2136         #
2137         for l in learnt:
2138             p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2139                  IP(dst=l['ip'], src=ep.ip4.address) /
2140                  UDP(sport=1234, dport=1234) /
2141                  Raw('\xa5' * 100))
2142
2143             rxs = self.send_and_expect(self.pg0, p*1, self.pg2)
2144
2145             for rx in rxs:
2146                 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2147                 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2148                 self.assertEqual(rx[UDP].dport, 48879)
2149                 # the UDP source port is a random value for hashing
2150                 self.assertEqual(rx[VXLAN].gpid, 220)
2151                 self.assertEqual(rx[VXLAN].vni, 101)
2152                 self.assertTrue(rx[VXLAN].flags.G)
2153                 self.assertTrue(rx[VXLAN].flags.Instance)
2154                 self.assertTrue(rx[VXLAN].gpflags.A)
2155                 self.assertFalse(rx[VXLAN].gpflags.D)
2156
2157                 inner = rx[VXLAN].payload
2158
2159                 self.assertEqual(inner[Ether].src, routed_src_mac)
2160                 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2161                 self.assertEqual(inner[IP].src, ep.ip4.address)
2162                 self.assertEqual(inner[IP].dst, l['ip'])
2163
2164         self.sleep(2)
2165         for l in learnt:
2166             self.assertFalse(find_gbp_endpoint(self,
2167                                                tep1_sw_if_index,
2168                                                ip=l['ip']))
2169
2170         #
2171         # learn some remote IPv6 EPs
2172         #
2173         for ii, l in enumerate(learnt):
2174             # a packet with an sclass from a knwon EPG
2175             # arriving on an unknown TEP
2176             p = (Ether(src=self.pg2.remote_mac,
2177                        dst=self.pg2.local_mac) /
2178                  IP(src=self.pg2.remote_hosts[1].ip4,
2179                     dst=self.pg2.local_ip4) /
2180                  UDP(sport=1234, dport=48879) /
2181                  VXLAN(vni=101, gpid=220, flags=0x88) /
2182                  Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2183                  IPv6(src=l['ip6'], dst=ep.ip6.address) /
2184                  UDP(sport=1234, dport=1234) /
2185                  Raw('\xa5' * 100))
2186
2187             rx = self.send_and_expect(self.pg2, [p], self.pg0)
2188
2189             # the new TEP
2190             tep1_sw_if_index = find_vxlan_gbp_tunnel(
2191                 self,
2192                 self.pg2.local_ip4,
2193                 self.pg2.remote_hosts[1].ip4,
2194                 vx_tun_l3.vni)
2195             self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2196
2197             self.logger.info(self.vapi.cli("show gbp bridge"))
2198             self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
2199             self.logger.info(self.vapi.cli("show gbp vxlan"))
2200             self.logger.info(self.vapi.cli("show int addr"))
2201
2202             # endpoint learnt via the TEP
2203             self.assertTrue(find_gbp_endpoint(self, ip=l['ip6']))
2204
2205         self.logger.info(self.vapi.cli("show gbp endpoint"))
2206         self.logger.info(self.vapi.cli("show ip fib index 1 %s" % l['ip']))
2207
2208         #
2209         # Static EP replies to learnt
2210         #
2211         for l in learnt:
2212             p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2213                  IPv6(dst=l['ip6'], src=ep.ip6.address) /
2214                  UDP(sport=1234, dport=1234) /
2215                  Raw('\xa5' * 100))
2216
2217             rxs = self.send_and_expect(self.pg0, p*65, self.pg2)
2218
2219             for rx in rxs:
2220                 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2221                 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2222                 self.assertEqual(rx[UDP].dport, 48879)
2223                 # the UDP source port is a random value for hashing
2224                 self.assertEqual(rx[VXLAN].gpid, 220)
2225                 self.assertEqual(rx[VXLAN].vni, 101)
2226                 self.assertTrue(rx[VXLAN].flags.G)
2227                 self.assertTrue(rx[VXLAN].flags.Instance)
2228                 self.assertTrue(rx[VXLAN].gpflags.A)
2229                 self.assertFalse(rx[VXLAN].gpflags.D)
2230
2231                 inner = rx[VXLAN].payload
2232
2233                 self.assertEqual(inner[Ether].src, routed_src_mac)
2234                 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2235                 self.assertEqual(inner[IPv6].src, ep.ip6.address)
2236                 self.assertEqual(inner[IPv6].dst, l['ip6'])
2237
2238         self.logger.info(self.vapi.cli("sh gbp endpoint"))
2239         self.sleep(2)
2240         for l in learnt:
2241             self.assertFalse(find_gbp_endpoint(self,
2242                                                tep1_sw_if_index,
2243                                                ip=l['ip']))
2244
2245         #
2246         # Static sends to unknown EP with no route
2247         #
2248         p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2249              IP(dst="10.0.0.99", src=ep.ip4.address) /
2250              UDP(sport=1234, dport=1234) /
2251              Raw('\xa5' * 100))
2252
2253         self.send_and_assert_no_replies(self.pg0, [p])
2254
2255         #
2256         # Add a route to static EP's v4 and v6 subnet
2257         #  packets should be sent on the v4/v6 uu=fwd interface resp.
2258         #
2259         se_10_24 = VppGbpSubnet(
2260             self, rd1, "10.0.0.0", 24,
2261             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_TRANSPORT)
2262         se_10_24.add_vpp_config()
2263
2264         p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2265              IP(dst="10.0.0.99", src=ep.ip4.address) /
2266              UDP(sport=1234, dport=1234) /
2267              Raw('\xa5' * 100))
2268
2269         rxs = self.send_and_expect(self.pg0, [p], self.pg4)
2270         for rx in rxs:
2271             self.assertEqual(rx[IP].src, self.pg4.local_ip4)
2272             self.assertEqual(rx[IP].dst, self.pg4.remote_ip4)
2273             self.assertEqual(rx[UDP].dport, 48879)
2274             # the UDP source port is a random value for hashing
2275             self.assertEqual(rx[VXLAN].gpid, 220)
2276             self.assertEqual(rx[VXLAN].vni, 114)
2277             self.assertTrue(rx[VXLAN].flags.G)
2278             self.assertTrue(rx[VXLAN].flags.Instance)
2279             # policy is not applied to packets sent to the uu-fwd interfaces
2280             self.assertFalse(rx[VXLAN].gpflags.A)
2281             self.assertFalse(rx[VXLAN].gpflags.D)
2282
2283         #
2284         # learn some remote IPv4 EPs
2285         #
2286         for ii, l in enumerate(learnt):
2287             # a packet with an sclass from a knwon EPG
2288             # arriving on an unknown TEP
2289             p = (Ether(src=self.pg2.remote_mac,
2290                        dst=self.pg2.local_mac) /
2291                  IP(src=self.pg2.remote_hosts[1].ip4,
2292                     dst=self.pg2.local_ip4) /
2293                  UDP(sport=1234, dport=48879) /
2294                  VXLAN(vni=101, gpid=220, flags=0x88) /
2295                  Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2296                  IP(src=l['ip'], dst=ep.ip4.address) /
2297                  UDP(sport=1234, dport=1234) /
2298                  Raw('\xa5' * 100))
2299
2300             rx = self.send_and_expect(self.pg2, [p], self.pg0)
2301
2302             # the new TEP
2303             tep1_sw_if_index = find_vxlan_gbp_tunnel(
2304                 self,
2305                 self.pg2.local_ip4,
2306                 self.pg2.remote_hosts[1].ip4,
2307                 vx_tun_l3.vni)
2308             self.assertNotEqual(INDEX_INVALID, tep1_sw_if_index)
2309
2310             # endpoint learnt via the parent GBP-vxlan interface
2311             self.assertTrue(find_gbp_endpoint(self,
2312                                               vx_tun_l3._sw_if_index,
2313                                               ip=l['ip']))
2314
2315         #
2316         # Add a remote endpoint from the API
2317         #
2318         rep_88 = VppGbpEndpoint(self, vx_tun_l3,
2319                                 epg_220, None,
2320                                 "10.0.0.88", "11.0.0.88",
2321                                 "2001:10::88", "3001::88",
2322                                 ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
2323                                 self.pg2.local_ip4,
2324                                 self.pg2.remote_hosts[1].ip4,
2325                                 mac=None)
2326         rep_88.add_vpp_config()
2327
2328         #
2329         # Add a remote endpoint from the API that matches an existing one
2330         #
2331         rep_2 = VppGbpEndpoint(self, vx_tun_l3,
2332                                epg_220, None,
2333                                learnt[0]['ip'], "11.0.0.101",
2334                                learnt[0]['ip6'], "3001::101",
2335                                ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
2336                                self.pg2.local_ip4,
2337                                self.pg2.remote_hosts[1].ip4,
2338                                mac=None)
2339         rep_2.add_vpp_config()
2340
2341         #
2342         # Add a route to the leanred EP's v4 subnet
2343         #  packets should be send on the v4/v6 uu=fwd interface resp.
2344         #
2345         se_10_1_24 = VppGbpSubnet(
2346             self, rd1, "10.0.1.0", 24,
2347             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_TRANSPORT)
2348         se_10_1_24.add_vpp_config()
2349
2350         self.logger.info(self.vapi.cli("show gbp endpoint"))
2351
2352         ips = ["10.0.0.88", learnt[0]['ip']]
2353         for ip in ips:
2354             p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2355                  IP(dst=ip, src=ep.ip4.address) /
2356                  UDP(sport=1234, dport=1234) /
2357                  Raw('\xa5' * 100))
2358
2359             rxs = self.send_and_expect(self.pg0, p*65, self.pg2)
2360
2361             for rx in rxs:
2362                 self.assertEqual(rx[IP].src, self.pg2.local_ip4)
2363                 self.assertEqual(rx[IP].dst, self.pg2.remote_hosts[1].ip4)
2364                 self.assertEqual(rx[UDP].dport, 48879)
2365                 # the UDP source port is a random value for hashing
2366                 self.assertEqual(rx[VXLAN].gpid, 220)
2367                 self.assertEqual(rx[VXLAN].vni, 101)
2368                 self.assertTrue(rx[VXLAN].flags.G)
2369                 self.assertTrue(rx[VXLAN].flags.Instance)
2370                 self.assertTrue(rx[VXLAN].gpflags.A)
2371                 self.assertFalse(rx[VXLAN].gpflags.D)
2372
2373                 inner = rx[VXLAN].payload
2374
2375                 self.assertEqual(inner[Ether].src, routed_src_mac)
2376                 self.assertEqual(inner[Ether].dst, routed_dst_mac)
2377                 self.assertEqual(inner[IP].src, ep.ip4.address)
2378                 self.assertEqual(inner[IP].dst, ip)
2379
2380         #
2381         # remove the API remote EPs, only API sourced is gone, the DP
2382         # learnt one remains
2383         #
2384         rep_88.remove_vpp_config()
2385         rep_2.remove_vpp_config()
2386
2387         self.logger.info(self.vapi.cli("show gbp endpoint"))
2388
2389         self.assertFalse(find_gbp_endpoint(self, ip=rep_88.ip4.address))
2390
2391         p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2392              IP(src=ep.ip4.address, dst=rep_88.ip4.address) /
2393              UDP(sport=1234, dport=1234) /
2394              Raw('\xa5' * 100))
2395         rxs = self.send_and_expect(self.pg0, [p], self.pg4)
2396
2397         self.assertTrue(find_gbp_endpoint(self, ip=rep_2.ip4.address))
2398
2399         p = (Ether(src=ep.mac, dst=self.loop0.local_mac) /
2400              IP(src=ep.ip4.address, dst=rep_2.ip4.address) /
2401              UDP(sport=1234, dport=1234) /
2402              Raw('\xa5' * 100))
2403         rxs = self.send_and_expect(self.pg0, [p], self.pg2)
2404
2405         #
2406         # to appease the testcase we cannot have the registered EP stll
2407         # present (because it's DP learnt) when the TC ends so wait until
2408         # it is removed
2409         #
2410         self.sleep(2)
2411
2412         #
2413         # shutdown with learnt endpoint present
2414         #
2415         p = (Ether(src=self.pg2.remote_mac,
2416                    dst=self.pg2.local_mac) /
2417              IP(src=self.pg2.remote_hosts[1].ip4,
2418                 dst=self.pg2.local_ip4) /
2419              UDP(sport=1234, dport=48879) /
2420              VXLAN(vni=101, gpid=220, flags=0x88) /
2421              Ether(src=l['mac'], dst="00:00:00:11:11:11") /
2422              IP(src=learnt[1]['ip'], dst=ep.ip4.address) /
2423              UDP(sport=1234, dport=1234) /
2424              Raw('\xa5' * 100))
2425
2426         rx = self.send_and_expect(self.pg2, [p], self.pg0)
2427
2428         # endpoint learnt via the parent GBP-vxlan interface
2429         self.assertTrue(find_gbp_endpoint(self,
2430                                           vx_tun_l3._sw_if_index,
2431                                           ip=l['ip']))
2432
2433         #
2434         # TODO
2435         # remote endpoint becomes local
2436         #
2437         self.pg2.unconfig_ip4()
2438         self.pg3.unconfig_ip4()
2439         self.pg4.unconfig_ip4()
2440
2441     def test_gbp_redirect(self):
2442         """ GBP Endpoint Redirect """
2443
2444         self.vapi.cli("set logging class gbp debug")
2445
2446         ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
2447         routed_dst_mac = "00:0c:0c:0c:0c:0c"
2448         routed_src_mac = "00:22:bd:f8:19:ff"
2449
2450         learnt = [{'mac': '00:00:11:11:11:02',
2451                    'ip': '10.0.1.2',
2452                    'ip6': '2001:10::2'},
2453                   {'mac': '00:00:11:11:11:03',
2454                    'ip': '10.0.1.3',
2455                    'ip6': '2001:10::3'}]
2456
2457         #
2458         # lower the inactive threshold so these tests pass in a
2459         # reasonable amount of time
2460         #
2461         self.vapi.gbp_endpoint_learn_set_inactive_threshold(1)
2462
2463         #
2464         # IP tables
2465         #
2466         t4 = VppIpTable(self, 1)
2467         t4.add_vpp_config()
2468         t6 = VppIpTable(self, 1, True)
2469         t6.add_vpp_config()
2470
2471         rd1 = VppGbpRouteDomain(self, 2, t4, t6)
2472         rd1.add_vpp_config()
2473
2474         self.loop0.set_mac(self.router_mac.address)
2475
2476         #
2477         # Bind the BVI to the RD
2478         #
2479         VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
2480         VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
2481
2482         #
2483         # Pg7 hosts a BD's UU-fwd
2484         #
2485         self.pg7.config_ip4()
2486         self.pg7.resolve_arp()
2487
2488         #
2489         # a GBP bridge domains for the EPs
2490         #
2491         bd1 = VppBridgeDomain(self, 1)
2492         bd1.add_vpp_config()
2493         gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
2494         gbd1.add_vpp_config()
2495
2496         bd2 = VppBridgeDomain(self, 2)
2497         bd2.add_vpp_config()
2498         gbd2 = VppGbpBridgeDomain(self, bd2, self.loop1)
2499         gbd2.add_vpp_config()
2500
2501         # ... and has a /32 and /128 applied
2502         ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 32)
2503         ip4_addr.add_vpp_config()
2504         ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 128)
2505         ip6_addr.add_vpp_config()
2506         ip4_addr = VppIpInterfaceAddress(self, gbd2.bvi, "10.0.1.128", 32)
2507         ip4_addr.add_vpp_config()
2508         ip6_addr = VppIpInterfaceAddress(self, gbd2.bvi, "2001:11::128", 128)
2509         ip6_addr.add_vpp_config()
2510
2511         #
2512         # The Endpoint-groups in which we are learning endpoints
2513         #
2514         epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
2515                                       None, gbd1.bvi,
2516                                       "10.0.0.128",
2517                                       "2001:10::128")
2518         epg_220.add_vpp_config()
2519         epg_221 = VppGbpEndpointGroup(self, 221, rd1, gbd2,
2520                                       None, gbd2.bvi,
2521                                       "10.0.1.128",
2522                                       "2001:11::128")
2523         epg_221.add_vpp_config()
2524         epg_222 = VppGbpEndpointGroup(self, 222, rd1, gbd1,
2525                                       None, gbd1.bvi,
2526                                       "10.0.2.128",
2527                                       "2001:12::128")
2528         epg_222.add_vpp_config()
2529
2530         #
2531         # a GBP bridge domains for the SEPs
2532         #
2533         bd_uu1 = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
2534                                    self.pg7.remote_ip4, 116)
2535         bd_uu1.add_vpp_config()
2536         bd_uu2 = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
2537                                    self.pg7.remote_ip4, 117)
2538         bd_uu2.add_vpp_config()
2539
2540         bd3 = VppBridgeDomain(self, 3)
2541         bd3.add_vpp_config()
2542         gbd3 = VppGbpBridgeDomain(self, bd3, self.loop2, bd_uu1, learn=False)
2543         gbd3.add_vpp_config()
2544         bd4 = VppBridgeDomain(self, 4)
2545         bd4.add_vpp_config()
2546         gbd4 = VppGbpBridgeDomain(self, bd4, self.loop3, bd_uu2, learn=False)
2547         gbd4.add_vpp_config()
2548
2549         #
2550         # EPGs in which the service endpoints exist
2551         #
2552         epg_320 = VppGbpEndpointGroup(self, 320, rd1, gbd3,
2553                                       None, gbd1.bvi,
2554                                       "12.0.0.128",
2555                                       "4001:10::128")
2556         epg_320.add_vpp_config()
2557         epg_321 = VppGbpEndpointGroup(self, 321, rd1, gbd4,
2558                                       None, gbd2.bvi,
2559                                       "12.0.1.128",
2560                                       "4001:11::128")
2561         epg_321.add_vpp_config()
2562
2563         #
2564         # three local endpoints
2565         #
2566         ep1 = VppGbpEndpoint(self, self.pg0,
2567                              epg_220, None,
2568                              "10.0.0.1", "11.0.0.1",
2569                              "2001:10::1", "3001:10::1")
2570         ep1.add_vpp_config()
2571         ep2 = VppGbpEndpoint(self, self.pg1,
2572                              epg_221, None,
2573                              "10.0.1.1", "11.0.1.1",
2574                              "2001:11::1", "3001:11::1")
2575         ep2.add_vpp_config()
2576         ep3 = VppGbpEndpoint(self, self.pg2,
2577                              epg_222, None,
2578                              "10.0.2.2", "11.0.2.2",
2579                              "2001:12::1", "3001:12::1")
2580         ep3.add_vpp_config()
2581
2582         #
2583         # service endpoints
2584         #
2585         sep1 = VppGbpEndpoint(self, self.pg3,
2586                               epg_320, None,
2587                               "12.0.0.1", "13.0.0.1",
2588                               "4001:10::1", "5001:10::1")
2589         sep1.add_vpp_config()
2590         sep2 = VppGbpEndpoint(self, self.pg4,
2591                               epg_320, None,
2592                               "12.0.0.2", "13.0.0.2",
2593                               "4001:10::2", "5001:10::2")
2594         sep2.add_vpp_config()
2595         sep3 = VppGbpEndpoint(self, self.pg5,
2596                               epg_321, None,
2597                               "12.0.1.1", "13.0.1.1",
2598                               "4001:11::1", "5001:11::1")
2599         sep3.add_vpp_config()
2600         # this EP is not installed immediately
2601         sep4 = VppGbpEndpoint(self, self.pg6,
2602                               epg_321, None,
2603                               "12.0.1.2", "13.0.1.2",
2604                               "4001:11::2", "5001:11::2")
2605
2606         #
2607         # an L2 switch packet between local EPs in different EPGs
2608         #  different dest ports on each so the are LB hashed differently
2609         #
2610         p4 = [(Ether(src=ep1.mac, dst=ep3.mac) /
2611                IP(src=ep1.ip4.address, dst=ep3.ip4.address) /
2612                UDP(sport=1234, dport=1234) /
2613                Raw('\xa5' * 100)),
2614               (Ether(src=ep3.mac, dst=ep1.mac) /
2615                IP(src=ep3.ip4.address, dst=ep1.ip4.address) /
2616                UDP(sport=1234, dport=1234) /
2617                Raw('\xa5' * 100))]
2618         p6 = [(Ether(src=ep1.mac, dst=ep3.mac) /
2619                IPv6(src=ep1.ip6.address, dst=ep3.ip6.address) /
2620                UDP(sport=1234, dport=1234) /
2621                Raw('\xa5' * 100)),
2622               (Ether(src=ep3.mac, dst=ep1.mac) /
2623                IPv6(src=ep3.ip6.address, dst=ep1.ip6.address) /
2624                UDP(sport=1234, dport=1230) /
2625                Raw('\xa5' * 100))]
2626
2627         # should be dropped since no contract yet
2628         self.send_and_assert_no_replies(self.pg0, [p4[0]])
2629         self.send_and_assert_no_replies(self.pg0, [p6[0]])
2630
2631         #
2632         # Add a contract with a rule to load-balance redirect via SEP1 and SEP2
2633         # one of the next-hops is via an EP that is not known
2634         #
2635         acl = VppGbpAcl(self)
2636         rule4 = acl.create_rule(permit_deny=1, proto=17)
2637         rule6 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
2638         acl_index = acl.add_vpp_config([rule4, rule6])
2639
2640         #
2641         # test the src-ip hash mode
2642         #
2643         c1 = VppGbpContract(
2644             self, 220, 222, acl_index,
2645             [VppGbpContractRule(
2646                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2647                 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2648                 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2649                                        sep1.ip4, sep1.epg.rd),
2650                  VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2651                                        sep2.ip4, sep2.epg.rd)]),
2652              VppGbpContractRule(
2653                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2654                  VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2655                  [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2656                                         sep3.ip6, sep3.epg.rd),
2657                   VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2658                                         sep4.ip6, sep4.epg.rd)])])
2659         c1.add_vpp_config()
2660
2661         c2 = VppGbpContract(
2662             self, 222, 220, acl_index,
2663             [VppGbpContractRule(
2664                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2665                 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2666                 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2667                                        sep1.ip4, sep1.epg.rd),
2668                  VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2669                                        sep2.ip4, sep2.epg.rd)]),
2670              VppGbpContractRule(
2671                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2672                  VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SRC_IP,
2673                  [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2674                                         sep3.ip6, sep3.epg.rd),
2675                   VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2676                                         sep4.ip6, sep4.epg.rd)])])
2677         c2.add_vpp_config()
2678
2679         #
2680         # send again with the contract preset, now packets arrive
2681         # at SEP1 or SEP2 depending on the hashing
2682         #
2683         rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2684
2685         for rx in rxs:
2686             self.assertEqual(rx[Ether].src, routed_src_mac)
2687             self.assertEqual(rx[Ether].dst, sep1.mac)
2688             self.assertEqual(rx[IP].src, ep1.ip4.address)
2689             self.assertEqual(rx[IP].dst, ep3.ip4.address)
2690
2691         rxs = self.send_and_expect(self.pg2, p4[1] * 17, sep2.itf)
2692
2693         for rx in rxs:
2694             self.assertEqual(rx[Ether].src, routed_src_mac)
2695             self.assertEqual(rx[Ether].dst, sep2.mac)
2696             self.assertEqual(rx[IP].src, ep3.ip4.address)
2697             self.assertEqual(rx[IP].dst, ep1.ip4.address)
2698
2699         rxs = self.send_and_expect(self.pg0, p6[0] * 17, self.pg7)
2700
2701         for rx in rxs:
2702             self.assertEqual(rx[Ether].src, self.pg7.local_mac)
2703             self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
2704             self.assertEqual(rx[IP].src, self.pg7.local_ip4)
2705             self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
2706             self.assertEqual(rx[VXLAN].vni, 117)
2707             self.assertTrue(rx[VXLAN].flags.G)
2708             self.assertTrue(rx[VXLAN].flags.Instance)
2709             # redirect policy has been applied
2710             self.assertTrue(rx[VXLAN].gpflags.A)
2711             self.assertFalse(rx[VXLAN].gpflags.D)
2712
2713             inner = rx[VXLAN].payload
2714
2715             self.assertEqual(inner[Ether].src, routed_src_mac)
2716             self.assertEqual(inner[Ether].dst, sep4.mac)
2717             self.assertEqual(inner[IPv6].src, ep1.ip6.address)
2718             self.assertEqual(inner[IPv6].dst, ep3.ip6.address)
2719
2720         rxs = self.send_and_expect(self.pg2, p6[1] * 17, sep3.itf)
2721
2722         for rx in rxs:
2723             self.assertEqual(rx[Ether].src, routed_src_mac)
2724             self.assertEqual(rx[Ether].dst, sep3.mac)
2725             self.assertEqual(rx[IPv6].src, ep3.ip6.address)
2726             self.assertEqual(rx[IPv6].dst, ep1.ip6.address)
2727
2728         #
2729         # programme the unknown EP
2730         #
2731         sep4.add_vpp_config()
2732
2733         rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep4.itf)
2734
2735         for rx in rxs:
2736             self.assertEqual(rx[Ether].src, routed_src_mac)
2737             self.assertEqual(rx[Ether].dst, sep4.mac)
2738             self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2739             self.assertEqual(rx[IPv6].dst, ep3.ip6.address)
2740
2741         #
2742         # and revert back to unprogrammed
2743         #
2744         sep4.remove_vpp_config()
2745
2746         rxs = self.send_and_expect(self.pg0, p6[0] * 17, self.pg7)
2747
2748         for rx in rxs:
2749             self.assertEqual(rx[Ether].src, self.pg7.local_mac)
2750             self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
2751             self.assertEqual(rx[IP].src, self.pg7.local_ip4)
2752             self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
2753             self.assertEqual(rx[VXLAN].vni, 117)
2754             self.assertTrue(rx[VXLAN].flags.G)
2755             self.assertTrue(rx[VXLAN].flags.Instance)
2756             # redirect policy has been applied
2757             self.assertTrue(rx[VXLAN].gpflags.A)
2758             self.assertFalse(rx[VXLAN].gpflags.D)
2759
2760             inner = rx[VXLAN].payload
2761
2762             self.assertEqual(inner[Ether].src, routed_src_mac)
2763             self.assertEqual(inner[Ether].dst, sep4.mac)
2764             self.assertEqual(inner[IPv6].src, ep1.ip6.address)
2765             self.assertEqual(inner[IPv6].dst, ep3.ip6.address)
2766
2767         c1.remove_vpp_config()
2768         c2.remove_vpp_config()
2769
2770         #
2771         # test the symmetric hash mode
2772         #
2773         c1 = VppGbpContract(
2774             self, 220, 222, acl_index,
2775             [VppGbpContractRule(
2776                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2777                 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2778                 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2779                                        sep1.ip4, sep1.epg.rd),
2780                  VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2781                                        sep2.ip4, sep2.epg.rd)]),
2782              VppGbpContractRule(
2783                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2784                  VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2785                  [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2786                                         sep3.ip6, sep3.epg.rd),
2787                   VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2788                                         sep4.ip6, sep4.epg.rd)])])
2789         c1.add_vpp_config()
2790
2791         c2 = VppGbpContract(
2792             self, 222, 220, acl_index,
2793             [VppGbpContractRule(
2794                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2795                 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2796                 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2797                                        sep1.ip4, sep1.epg.rd),
2798                  VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2799                                        sep2.ip4, sep2.epg.rd)]),
2800              VppGbpContractRule(
2801                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2802                  VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2803                  [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2804                                         sep3.ip6, sep3.epg.rd),
2805                   VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2806                                         sep4.ip6, sep4.epg.rd)])])
2807         c2.add_vpp_config()
2808
2809         #
2810         # send again with the contract preset, now packets arrive
2811         # at SEP1 for both directions
2812         #
2813         rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2814
2815         for rx in rxs:
2816             self.assertEqual(rx[Ether].src, routed_src_mac)
2817             self.assertEqual(rx[Ether].dst, sep1.mac)
2818             self.assertEqual(rx[IP].src, ep1.ip4.address)
2819             self.assertEqual(rx[IP].dst, ep3.ip4.address)
2820
2821         rxs = self.send_and_expect(self.pg2, p4[1] * 17, sep1.itf)
2822
2823         for rx in rxs:
2824             self.assertEqual(rx[Ether].src, routed_src_mac)
2825             self.assertEqual(rx[Ether].dst, sep1.mac)
2826             self.assertEqual(rx[IP].src, ep3.ip4.address)
2827             self.assertEqual(rx[IP].dst, ep1.ip4.address)
2828
2829         #
2830         # programme the unknown EP for the L3 tests
2831         #
2832         sep4.add_vpp_config()
2833
2834         #
2835         # an L3 switch packet between local EPs in different EPGs
2836         #  different dest ports on each so the are LB hashed differently
2837         #
2838         p4 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2839                IP(src=ep1.ip4.address, dst=ep2.ip4.address) /
2840                UDP(sport=1234, dport=1234) /
2841                Raw('\xa5' * 100)),
2842               (Ether(src=ep2.mac, dst=self.router_mac.address) /
2843                IP(src=ep2.ip4.address, dst=ep1.ip4.address) /
2844                UDP(sport=1234, dport=1234) /
2845                Raw('\xa5' * 100))]
2846         p6 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2847                IPv6(src=ep1.ip6.address, dst=ep2.ip6.address) /
2848                UDP(sport=1234, dport=1234) /
2849                Raw('\xa5' * 100)),
2850               (Ether(src=ep2.mac, dst=self.router_mac.address) /
2851                IPv6(src=ep2.ip6.address, dst=ep1.ip6.address) /
2852                UDP(sport=1234, dport=1234) /
2853                Raw('\xa5' * 100))]
2854
2855         c3 = VppGbpContract(
2856              self, 220, 221, acl_index,
2857              [VppGbpContractRule(
2858                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2859                  VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2860                  [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2861                                         sep1.ip4, sep1.epg.rd),
2862                   VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2863                                         sep2.ip4, sep2.epg.rd)]),
2864               VppGbpContractRule(
2865                   VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2866                   VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_SYMMETRIC,
2867                   [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2868                                          sep3.ip6, sep3.epg.rd),
2869                    VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2870                                          sep4.ip6, sep4.epg.rd)])])
2871         c3.add_vpp_config()
2872
2873         rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2874
2875         for rx in rxs:
2876             self.assertEqual(rx[Ether].src, routed_src_mac)
2877             self.assertEqual(rx[Ether].dst, sep1.mac)
2878             self.assertEqual(rx[IP].src, ep1.ip4.address)
2879             self.assertEqual(rx[IP].dst, ep2.ip4.address)
2880
2881         #
2882         # learn a remote EP in EPG 221
2883         #
2884         vx_tun_l3 = VppGbpVxlanTunnel(
2885             self, 444, rd1.rd_id,
2886             VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3)
2887         vx_tun_l3.add_vpp_config()
2888
2889         c4 = VppGbpContract(
2890             self, 221, 220, acl_index,
2891             [VppGbpContractRule(
2892                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
2893                 []),
2894              VppGbpContractRule(
2895                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
2896                  [])])
2897         c4.add_vpp_config()
2898
2899         p = (Ether(src=self.pg7.remote_mac,
2900                    dst=self.pg7.local_mac) /
2901              IP(src=self.pg7.remote_ip4,
2902                 dst=self.pg7.local_ip4) /
2903              UDP(sport=1234, dport=48879) /
2904              VXLAN(vni=444, gpid=221, flags=0x88) /
2905              Ether(src="00:22:22:22:22:33", dst=self.router_mac.address) /
2906              IP(src="10.0.0.88", dst=ep1.ip4.address) /
2907              UDP(sport=1234, dport=1234) /
2908              Raw('\xa5' * 100))
2909
2910         rx = self.send_and_expect(self.pg7, [p], self.pg0)
2911
2912         # endpoint learnt via the parent GBP-vxlan interface
2913         self.assertTrue(find_gbp_endpoint(self,
2914                                           vx_tun_l3._sw_if_index,
2915                                           ip="10.0.0.88"))
2916
2917         p = (Ether(src=self.pg7.remote_mac,
2918                    dst=self.pg7.local_mac) /
2919              IP(src=self.pg7.remote_ip4,
2920                 dst=self.pg7.local_ip4) /
2921              UDP(sport=1234, dport=48879) /
2922              VXLAN(vni=444, gpid=221, flags=0x88) /
2923              Ether(src="00:22:22:22:22:33", dst=self.router_mac.address) /
2924              IPv6(src="2001:10::88", dst=ep1.ip6.address) /
2925              UDP(sport=1234, dport=1234) /
2926              Raw('\xa5' * 100))
2927
2928         rx = self.send_and_expect(self.pg7, [p], self.pg0)
2929
2930         # endpoint learnt via the parent GBP-vxlan interface
2931         self.assertTrue(find_gbp_endpoint(self,
2932                                           vx_tun_l3._sw_if_index,
2933                                           ip="2001:10::88"))
2934
2935         #
2936         # L3 switch from local to remote EP
2937         #
2938         p4 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2939                IP(src=ep1.ip4.address, dst="10.0.0.88") /
2940                UDP(sport=1234, dport=1234) /
2941                Raw('\xa5' * 100))]
2942         p6 = [(Ether(src=ep1.mac, dst=self.router_mac.address) /
2943                IPv6(src=ep1.ip6.address, dst="2001:10::88") /
2944                UDP(sport=1234, dport=1234) /
2945                Raw('\xa5' * 100))]
2946
2947         rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2948
2949         for rx in rxs:
2950             self.assertEqual(rx[Ether].src, routed_src_mac)
2951             self.assertEqual(rx[Ether].dst, sep1.mac)
2952             self.assertEqual(rx[IP].src, ep1.ip4.address)
2953             self.assertEqual(rx[IP].dst, "10.0.0.88")
2954
2955         rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep4.itf)
2956
2957         for rx in rxs:
2958             self.assertEqual(rx[Ether].src, routed_src_mac)
2959             self.assertEqual(rx[Ether].dst, sep4.mac)
2960             self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2961             self.assertEqual(rx[IPv6].dst, "2001:10::88")
2962
2963         #
2964         # test the dst-ip hash mode
2965         #
2966         c5 = VppGbpContract(
2967             self, 220, 221, acl_index,
2968             [VppGbpContractRule(
2969                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2970                 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_DST_IP,
2971                 [VppGbpContractNextHop(sep1.vmac, sep1.epg.bd,
2972                                        sep1.ip4, sep1.epg.rd),
2973                  VppGbpContractNextHop(sep2.vmac, sep2.epg.bd,
2974                                        sep2.ip4, sep2.epg.rd)]),
2975              VppGbpContractRule(
2976                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_REDIRECT,
2977                 VppEnum.vl_api_gbp_hash_mode_t.GBP_API_HASH_MODE_DST_IP,
2978                  [VppGbpContractNextHop(sep3.vmac, sep3.epg.bd,
2979                                         sep3.ip6, sep3.epg.rd),
2980                   VppGbpContractNextHop(sep4.vmac, sep4.epg.bd,
2981                                         sep4.ip6, sep4.epg.rd)])])
2982         c5.add_vpp_config()
2983
2984         rxs = self.send_and_expect(self.pg0, p4[0] * 17, sep1.itf)
2985
2986         for rx in rxs:
2987             self.assertEqual(rx[Ether].src, routed_src_mac)
2988             self.assertEqual(rx[Ether].dst, sep1.mac)
2989             self.assertEqual(rx[IP].src, ep1.ip4.address)
2990             self.assertEqual(rx[IP].dst, "10.0.0.88")
2991
2992         rxs = self.send_and_expect(self.pg0, p6[0] * 17, sep3.itf)
2993
2994         for rx in rxs:
2995             self.assertEqual(rx[Ether].src, routed_src_mac)
2996             self.assertEqual(rx[Ether].dst, sep3.mac)
2997             self.assertEqual(rx[IPv6].src, ep1.ip6.address)
2998             self.assertEqual(rx[IPv6].dst, "2001:10::88")
2999
3000         #
3001         # cleanup
3002         #
3003         self.pg7.unconfig_ip4()
3004
3005     def test_gbp_l3_out(self):
3006         """ GBP L3 Out """
3007
3008         ep_flags = VppEnum.vl_api_gbp_endpoint_flags_t
3009         self.vapi.cli("set logging class gbp debug")
3010
3011         routed_dst_mac = "00:0c:0c:0c:0c:0c"
3012         routed_src_mac = "00:22:bd:f8:19:ff"
3013
3014         #
3015         # IP tables
3016         #
3017         t4 = VppIpTable(self, 1)
3018         t4.add_vpp_config()
3019         t6 = VppIpTable(self, 1, True)
3020         t6.add_vpp_config()
3021
3022         rd1 = VppGbpRouteDomain(self, 2, t4, t6)
3023         rd1.add_vpp_config()
3024
3025         self.loop0.set_mac(self.router_mac.address)
3026
3027         #
3028         # Bind the BVI to the RD
3029         #
3030         VppIpInterfaceBind(self, self.loop0, t4).add_vpp_config()
3031         VppIpInterfaceBind(self, self.loop0, t6).add_vpp_config()
3032
3033         #
3034         # Pg7 hosts a BD's BUM
3035         # Pg1 some other l3 interface
3036         #
3037         self.pg7.config_ip4()
3038         self.pg7.resolve_arp()
3039
3040         #
3041         # a GBP external bridge domains for the EPs
3042         #
3043         bd1 = VppBridgeDomain(self, 1)
3044         bd1.add_vpp_config()
3045         gbd1 = VppGbpBridgeDomain(self, bd1, self.loop0)
3046         gbd1.add_vpp_config()
3047
3048         #
3049         # The Endpoint-groups in which the external endpoints exist
3050         #
3051         epg_220 = VppGbpEndpointGroup(self, 220, rd1, gbd1,
3052                                       None, gbd1.bvi,
3053                                       "10.0.0.128",
3054                                       "2001:10::128")
3055         epg_220.add_vpp_config()
3056
3057         # the BVIs have the subnets applied ...
3058         ip4_addr = VppIpInterfaceAddress(self, gbd1.bvi, "10.0.0.128", 24)
3059         ip4_addr.add_vpp_config()
3060         ip6_addr = VppIpInterfaceAddress(self, gbd1.bvi, "2001:10::128", 64)
3061         ip6_addr.add_vpp_config()
3062
3063         # ... which are L3-out subnets
3064         l3o_1 = VppGbpSubnet(
3065             self, rd1, "10.0.0.0", 24,
3066             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3067             epg=200)
3068         l3o_1.add_vpp_config()
3069
3070         #
3071         # an external interface attached to the outside world and the
3072         # external BD
3073         #
3074         vlan_100 = VppDot1QSubint(self, self.pg0, 100)
3075         vlan_100.admin_up()
3076         ext_itf = VppGbpExtItf(self, vlan_100, bd1, rd1)
3077         ext_itf.add_vpp_config()
3078
3079         #
3080         # a multicast vxlan-gbp tunnel for broadcast in the BD
3081         #
3082         tun_bm = VppVxlanGbpTunnel(self, self.pg7.local_ip4,
3083                                    "239.1.1.1", 88,
3084                                    mcast_itf=self.pg7)
3085         tun_bm.add_vpp_config()
3086         bp_bm = VppBridgeDomainPort(self, bd1, tun_bm,
3087                                     port_type=L2_PORT_TYPE.NORMAL)
3088         bp_bm.add_vpp_config()
3089
3090         #
3091         # an unicast vxlan-gbp for inter-BD traffic
3092         #
3093         vx_tun_l3 = VppGbpVxlanTunnel(
3094             self, 444, rd1.rd_id,
3095             VppEnum.vl_api_gbp_vxlan_tunnel_mode_t.GBP_VXLAN_TUNNEL_MODE_L3)
3096         vx_tun_l3.add_vpp_config()
3097
3098         #
3099         # packets destined to unkown addresses in the BVI's subnet
3100         # are ARP'd for
3101         #
3102         p4 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3103               Dot1Q(vlan=100) /
3104               IP(src="10.0.0.1", dst="10.0.0.88") /
3105               UDP(sport=1234, dport=1234) /
3106               Raw('\xa5' * 100))
3107         p6 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3108               Dot1Q(vlan=100) /
3109               IPv6(src="2001:10::1", dst="2001:10::88") /
3110               UDP(sport=1234, dport=1234) /
3111               Raw('\xa5' * 100))
3112
3113         rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3114
3115         for rx in rxs:
3116             self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3117             # self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3118             self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3119             self.assertEqual(rx[IP].dst, "239.1.1.1")
3120             self.assertEqual(rx[VXLAN].vni, 88)
3121             self.assertTrue(rx[VXLAN].flags.G)
3122             self.assertTrue(rx[VXLAN].flags.Instance)
3123             # policy is not applied since we don't know where it's going
3124             self.assertFalse(rx[VXLAN].gpflags.A)
3125             self.assertFalse(rx[VXLAN].gpflags.D)
3126
3127             inner = rx[VXLAN].payload
3128
3129             self.assertTrue(inner.haslayer(ARP))
3130
3131         #
3132         # An external Endpoint
3133         #
3134         eep = VppGbpEndpoint(self, vlan_100,
3135                              epg_220, None,
3136                              "10.0.0.1", "11.0.0.1",
3137                              "2001:10::1", "3001::1",
3138                              ep_flags.GBP_API_ENDPOINT_FLAG_EXTERNAL)
3139         eep.add_vpp_config()
3140
3141         #
3142         # A remote endpoint
3143         #
3144         rep = VppGbpEndpoint(self, vx_tun_l3,
3145                              epg_220, None,
3146                              "10.0.0.101", "11.0.0.101",
3147                              "2001:10::101", "3001::101",
3148                              ep_flags.GBP_API_ENDPOINT_FLAG_REMOTE,
3149                              self.pg7.local_ip4,
3150                              self.pg7.remote_ip4,
3151                              mac=None)
3152         rep.add_vpp_config()
3153
3154         #
3155         # remote to external
3156         #
3157         p = (Ether(src=self.pg7.remote_mac,
3158                    dst=self.pg7.local_mac) /
3159              IP(src=self.pg7.remote_ip4,
3160                 dst=self.pg7.local_ip4) /
3161              UDP(sport=1234, dport=48879) /
3162              VXLAN(vni=444, gpid=220, flags=0x88) /
3163              Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3164              IP(src="10.0.0.101", dst="10.0.0.1") /
3165              UDP(sport=1234, dport=1234) /
3166              Raw('\xa5' * 100))
3167
3168         rxs = self.send_and_expect(self.pg7, p * 1, self.pg0)
3169
3170         #
3171         # A subnet reachable through the external EP
3172         #
3173         ip_220 = VppIpRoute(self, "10.220.0.0", 24,
3174                             [VppRoutePath(eep.ip4.address,
3175                                           eep.epg.bvi.sw_if_index)],
3176                             table_id=t4.table_id)
3177         ip_220.add_vpp_config()
3178
3179         l3o_220 = VppGbpSubnet(
3180             self, rd1, "10.220.0.0", 24,
3181             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3182             epg=220)
3183         l3o_220.add_vpp_config()
3184
3185         p = (Ether(src=self.pg7.remote_mac,
3186                    dst=self.pg7.local_mac) /
3187              IP(src=self.pg7.remote_ip4,
3188                 dst=self.pg7.local_ip4) /
3189              UDP(sport=1234, dport=48879) /
3190              VXLAN(vni=444, gpid=220, flags=0x88) /
3191              Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3192              IP(src="10.0.0.101", dst="10.220.0.1") /
3193              UDP(sport=1234, dport=1234) /
3194              Raw('\xa5' * 100))
3195
3196         rxs = self.send_and_expect(self.pg7, p * 1, self.pg0)
3197
3198         #
3199         # another external subnet, this time in a different EPG
3200         #
3201         ip_200 = VppIpRoute(self, "10.200.0.0", 24,
3202                             [VppRoutePath(eep.ip4.address,
3203                                           eep.epg.bvi.sw_if_index)],
3204                             table_id=t4.table_id)
3205         ip_200.add_vpp_config()
3206
3207         l3o_200 = VppGbpSubnet(
3208             self, rd1, "10.200.0.0", 24,
3209             VppEnum.vl_api_gbp_subnet_type_t.GBP_API_SUBNET_L3_OUT,
3210             epg=200)
3211         l3o_200.add_vpp_config()
3212
3213         p = (Ether(src=self.pg7.remote_mac,
3214                    dst=self.pg7.local_mac) /
3215              IP(src=self.pg7.remote_ip4,
3216                 dst=self.pg7.local_ip4) /
3217              UDP(sport=1234, dport=48879) /
3218              VXLAN(vni=444, gpid=220, flags=0x88) /
3219              Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3220              IP(src="10.0.0.101", dst="10.200.0.1") /
3221              UDP(sport=1234, dport=1234) /
3222              Raw('\xa5' * 100))
3223
3224         #
3225         # packets dropped due to lack of contract.
3226         #
3227         rxs = self.send_and_assert_no_replies(self.pg7, p * 1)
3228
3229         #
3230         # from the the subnet in EPG 220 beyond the external to remote
3231         #
3232         p4 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3233               Dot1Q(vlan=100) /
3234               IP(src="10.220.0.1", dst=rep.ip4.address) /
3235               UDP(sport=1234, dport=1234) /
3236               Raw('\xa5' * 100))
3237
3238         rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3239
3240         for rx in rxs:
3241             self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3242             self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3243             self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3244             self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
3245             self.assertEqual(rx[VXLAN].vni, 444)
3246             self.assertTrue(rx[VXLAN].flags.G)
3247             self.assertTrue(rx[VXLAN].flags.Instance)
3248             self.assertTrue(rx[VXLAN].gpflags.A)
3249             self.assertFalse(rx[VXLAN].gpflags.D)
3250
3251         #
3252         # from the the subnet in EPG 200 beyond the external to remote
3253         # dropped due to no contract
3254         #
3255         p4 = (Ether(src=self.pg0.remote_mac, dst=self.router_mac.address) /
3256               Dot1Q(vlan=100) /
3257               IP(src="10.200.0.1", dst=rep.ip4.address) /
3258               UDP(sport=1234, dport=1234) /
3259               Raw('\xa5' * 100))
3260
3261         rxs = self.send_and_assert_no_replies(self.pg0, p4 * 1)
3262
3263         #
3264         # add a contract
3265         #
3266         acl = VppGbpAcl(self)
3267         rule = acl.create_rule(permit_deny=1, proto=17)
3268         rule2 = acl.create_rule(is_ipv6=1, permit_deny=1, proto=17)
3269         acl_index = acl.add_vpp_config([rule, rule2])
3270         c1 = VppGbpContract(
3271             self, 200, 220, acl_index,
3272             [VppGbpContractRule(
3273                 VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3274                 []),
3275              VppGbpContractRule(
3276                  VppEnum.vl_api_gbp_rule_action_t.GBP_API_RULE_PERMIT,
3277                  [])])
3278         c1.add_vpp_config()
3279
3280         rxs = self.send_and_expect(self.pg0, p4 * 1, self.pg7)
3281
3282         for rx in rxs:
3283             self.assertEqual(rx[Ether].src, self.pg7.local_mac)
3284             self.assertEqual(rx[Ether].dst, self.pg7.remote_mac)
3285             self.assertEqual(rx[IP].src, self.pg7.local_ip4)
3286             self.assertEqual(rx[IP].dst, self.pg7.remote_ip4)
3287             self.assertEqual(rx[VXLAN].vni, 444)
3288             self.assertTrue(rx[VXLAN].flags.G)
3289             self.assertTrue(rx[VXLAN].flags.Instance)
3290             self.assertTrue(rx[VXLAN].gpflags.A)
3291             self.assertFalse(rx[VXLAN].gpflags.D)
3292
3293         #
3294         # cleanup
3295         #
3296         self.pg7.unconfig_ip4()
3297
3298
3299 if __name__ == '__main__':
3300     unittest.main(testRunner=VppTestRunner)