M: Matthew Smith <mgsmith@netgate.com>
F: src/plugins/vrrp
+Plugin - Unicast Reverse Path forwarding
+I: urpf
+M: Neale Ranns <nranns@cisco.com>
+F: src/plugins/urpf
+
VPP Config Tooling
I: vpp_config
M: John DeNisco <jdenisco@cisco.com>
--- /dev/null
+# Copyright (c) 2020 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_vpp_plugin(urpf
+ SOURCES
+ urpf.c
+ urpf_api.c
+ ip4_urpf.c
+ ip6_urpf.c
+
+ MULTIARCH_SOURCES
+ ip4_urpf.c
+ ip6_urpf.c
+
+ API_FILES
+ urpf.api
+)
--- /dev/null
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip4_urpf_error_strings[] = {
+#define _(a,b) "ip4-" # b,
+ foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip4_rx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip4_rx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip4_tx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip4_tx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip4_rx_urpf_loose) = {
+ .name = "ip4-rx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_rx_urpf_strict) = {
+ .name = "ip4-rx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_tx_urpf_loose) = {
+ .name = "ip4-tx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_tx_urpf_strict) = {
+ .name = "ip4-tx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip4_rx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip4-unicast",
+ .node_name = "ip4-rx-urpf-loose",
+ .runs_before = VNET_FEATURES ("ip4-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip4_rx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip4-unicast",
+ .node_name = "ip4-rx-urpf-strict",
+ .runs_before = VNET_FEATURES ("ip4-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip4_tx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip4-output",
+ .node_name = "ip4-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip4_tx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip4-output",
+ .node_name = "ip4-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
--- /dev/null
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip6_urpf_error_strings[] = {
+#define _(a,b) "ip6-" # b,
+ foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip6_rx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_rx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip6_rx_urpf_loose) = {
+ .name = "ip6-rx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_rx_urpf_strict) = {
+ .name = "ip6-rx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_loose) = {
+ .name = "ip6-tx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_strict) = {
+ .name = "ip6-tx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip6-unicast",
+ .node_name = "ip6-rx-urpf-loose",
+ .runs_before = VNET_FEATURES ("ip6-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip6-unicast",
+ .node_name = "ip6-rx-urpf-strict",
+ .runs_before = VNET_FEATURES ("ip6-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "ip6-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "ip6-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
--- /dev/null
+#!/usr/bin/env python3
+
+import unittest
+
+from framework import VppTestCase, VppTestRunner
+
+from scapy.packet import Raw
+from scapy.layers.l2 import Ether
+from scapy.layers.inet import IP, UDP, ICMP
+from scapy.layers.inet6 import IPv6
+
+from vpp_papi import VppEnum
+
+N_PKTS = 63
+
+
+class TestURPF(VppTestCase):
+ """ Unicast Reverse Path Forwarding Test Case """
+
+ @classmethod
+ def setUpClass(cls):
+ super(TestURPF, cls).setUpClass()
+
+ @classmethod
+ def tearDownClass(cls):
+ super(TestURPF, cls).tearDownClass()
+
+ def setUp(self):
+ super(TestURPF, self).setUp()
+
+ # create 4 pg interfaces so there are a few addresses
+ # in the FIB
+ self.create_pg_interfaces(range(4))
+
+ for i in self.pg_interfaces:
+ i.admin_up()
+ i.config_ip4()
+ i.resolve_arp()
+ i.config_ip6()
+ i.resolve_ndp()
+
+ def tearDown(self):
+ for i in self.pg_interfaces:
+ i.unconfig_ip4()
+ i.unconfig_ip6()
+ i.admin_down()
+ super(TestURPF, self).tearDown()
+
+ def test_urpf4(self):
+ """ uRPF IP4 """
+
+ e = VppEnum
+ p_spoof_loose = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src="3.3.3.3", dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src=self.pg2.remote_ip4,
+ dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_good = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src=self.pg0.remote_ip4,
+ dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ #
+ # before adding the uRPF, ensure all packets are forwarded
+ #
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # apply loose uRPF check on pg0 rx
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets from address for which there is a route are forwarded
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ # packets from address to which there is no route are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-rx-urpf-loose", N_PKTS)
+
+ #
+ # crank it up to strict mode
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets that would not be routed back thru pg0 are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-rx-urpf-strict", 2 * N_PKTS)
+
+ #
+ # disable uRPF, all traffic should pass
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg0.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # Now apply in the TX direction
+ # for loose it is the same deal, they should not be forwarded
+ # if there's no route
+ # for strict they should not be forwarded if they would be
+ # forwarded thru that interface.
+ #
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-tx-urpf-loose", N_PKTS)
+
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # the strict packet, from a peer is allowed, since it does
+ # not forward via pg1
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-tx-urpf-strict", N_PKTS)
+
+ # change the strict packet so that it would forward through pg1
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src=self.pg1.remote_ip4,
+ dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.assert_error_counter_equal("ip4-tx-urpf-strict", 2 * N_PKTS)
+
+ # cleanup
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg1.sw_if_index)
+
+ def test_urpf6(self):
+ """ uRPF IP6 """
+
+ e = VppEnum
+ p_spoof_loose = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src="3::3", dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src=self.pg2.remote_ip6,
+ dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_good = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src=self.pg0.remote_ip6,
+ dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ #
+ # before adding the uRPF, ensure all packets are forwarded
+ #
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # apply loose uRPF check on pg0 rx
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets from address for which there is a route are forwarded
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ # packets from address to which there is no route are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-rx-urpf-loose", N_PKTS)
+
+ #
+ # crank it up to strict mode
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets that would not be routed back thru pg0 are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-rx-urpf-strict", 2 * N_PKTS)
+
+ #
+ # disable uRPF, all traffic should pass
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg0.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # Now apply in the TX direction
+ # for loose it is the same deal, they should not be forwarded
+ # if there's no route
+ # for strict they should not be forwarded if they would be
+ # forwarded thru that interface.
+ #
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-tx-urpf-loose", N_PKTS)
+
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # the strict packet, from a peer is allowed, since it does
+ # not forward via pg1
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-tx-urpf-strict", N_PKTS)
+
+ # change the strict packet so that it would forward through pg1
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src=self.pg1.remote_ip6,
+ dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.assert_error_counter_equal("ip6-tx-urpf-strict", 2 * N_PKTS)
+
+ # cleanup
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg1.sw_if_index)
+
+
+if __name__ == '__main__':
+ unittest.main(testRunner=VppTestRunner)
--- /dev/null
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** \file
+ This file defines the vpp control-plane API messages
+ used to control the URPF plugin
+*/
+
+option version = "1.0.0";
+import "vnet/ip/ip_types.api";
+import "vnet/fib/fib_types.api";
+import "vnet/interface_types.api";
+
+enum urpf_mode:u8
+{
+ URPF_API_MODE_OFF,
+ URPF_API_MODE_LOOSE,
+ URPF_API_MODE_STRICT,
+};
+
+/**
+ * @brief Enable uRPF on a given interface in a given direction
+ * @param client_index - opaque cookie to identify the sender
+ * @param context - sender context, to match reply w/ request
+ * @param mode - Mode
+ * @param af - Address Family
+ * @param sw_if_index - Interface
+ * @param is_input - Direction.
+ */
+autoreply define urpf_update
+{
+ u32 client_index;
+ u32 context;
+ bool is_input[default = true];
+ vl_api_urpf_mode_t mode;
+ vl_api_address_family_t af;
+ vl_api_interface_index_t sw_if_index;
+};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
--- /dev/null
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <urpf/urpf.h>
+
+#include <vnet/fib/fib_table.h>
+
+/* *INDENT-OFF* */
+static const char *urpf_feat_arcs[N_AF][VLIB_N_DIR] =
+{
+ [AF_IP4] = {
+ [VLIB_RX] = "ip4-unicast",
+ [VLIB_TX] = "ip4-output",
+ },
+ [AF_IP6] = {
+ [VLIB_RX] = "ip6-unicast",
+ [VLIB_TX] = "ip6-output",
+ },
+};
+
+static const char *urpf_feats[N_AF][VLIB_N_DIR][URPF_N_MODES] =
+{
+ [AF_IP4] = {
+ [VLIB_RX] = {
+ [URPF_MODE_STRICT] = "ip4-rx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip4-rx-urpf-loose",
+ },
+ [VLIB_TX] = {
+ [URPF_MODE_STRICT] = "ip4-tx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip4-tx-urpf-loose",
+ },
+ },
+ [AF_IP6] = {
+ [VLIB_RX] = {
+ [URPF_MODE_STRICT] = "ip6-rx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip6-rx-urpf-loose",
+ },
+ [VLIB_TX] = {
+ [URPF_MODE_STRICT] = "ip6-tx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip6-tx-urpf-loose",
+ },
+ },
+};
+/* *INDENT-ON* */
+
+/**
+ * Per-af, per-direction, per-interface uRPF configs
+ */
+static urpf_mode_t *urpf_cfgs[N_AF][VLIB_N_DIR];
+
+u8 *
+format_urpf_mode (u8 * s, va_list * a)
+{
+ urpf_mode_t mode = va_arg (*a, int);
+
+ switch (mode)
+ {
+#define _(a,b) \
+ case URPF_MODE_##a: \
+ return (format (s, "%s", b));
+ foreach_urpf_mode
+#undef _
+ }
+
+ return (format (s, "unknown"));
+}
+
+static uword
+unformat_urpf_mode (unformat_input_t * input, va_list * args)
+{
+ urpf_mode_t *mode = va_arg (*args, urpf_mode_t *);
+
+ if (0)
+ ;
+#define _(a,b) \
+ else if (unformat (input, b)) \
+ { \
+ *mode = URPF_MODE_##a; \
+ return (1); \
+ }
+ foreach_urpf_mode
+#undef _
+ return 0;
+}
+
+void
+urpf_update (urpf_mode_t mode,
+ u32 sw_if_index, ip_address_family_t af, vlib_dir_t dir)
+{
+ urpf_mode_t old;
+
+ vec_validate_init_empty (urpf_cfgs[af][dir], sw_if_index, URPF_MODE_OFF);
+ old = urpf_cfgs[af][dir][sw_if_index];
+
+ if (mode != old)
+ {
+ if (URPF_MODE_OFF != old)
+ /* disable what we have */
+ vnet_feature_enable_disable (urpf_feat_arcs[af][dir],
+ urpf_feats[af][dir][old],
+ sw_if_index, 0, 0, 0);
+
+ if (URPF_MODE_OFF != mode)
+ /* enable what's new */
+ vnet_feature_enable_disable (urpf_feat_arcs[af][dir],
+ urpf_feats[af][dir][mode],
+ sw_if_index, 1, 0, 0);
+ }
+ /* else - no change to existing config */
+
+ urpf_cfgs[af][dir][sw_if_index] = mode;
+}
+
+static clib_error_t *
+urpf_cli_update (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ vnet_main_t *vnm = vnet_get_main ();
+ clib_error_t *error = NULL;
+ ip_address_family_t af;
+ urpf_mode_t mode;
+ u32 sw_if_index;
+ vlib_dir_t dir;
+
+ sw_if_index = ~0;
+ af = AF_IP4;
+ dir = VLIB_RX;
+ mode = URPF_MODE_STRICT;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "%U",
+ unformat_vnet_sw_interface, vnm, &sw_if_index))
+ ;
+ else if (unformat (line_input, "%U", unformat_urpf_mode, &mode))
+ ;
+ else if (unformat (line_input, "%U", unformat_ip_address_family, &af))
+ ;
+ else if (unformat (line_input, "%U", unformat_vlib_rx_tx, &dir))
+ ;
+ else
+ {
+ error = unformat_parse_error (line_input);
+ goto done;
+ }
+ }
+
+ if (~0 == sw_if_index)
+ {
+ error = clib_error_return (0, "unknown interface `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+
+ urpf_update (mode, sw_if_index, af, dir);
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+/*?
+ * This command configures uRPF on an interface.
+ * Two flavours are supported (the default is strict):
+ * - loose: accept ingress packet if there is a route to reach the source
+ * - strict: accept ingress packet if it arrived on an interface which
+ * the route to the source uses. i.e. an interface that the source
+ * is reachable via.
+ *
+ * @cliexpar
+ * @parblock
+ * Example of graph node before range checking is enabled:
+ * @cliexstart{show vlib graph ip4-rx-urpf-strict}
+ * Name Next Previous
+ * ip4-rx-urpf-strict ip4-drop [0]
+ * @cliexend
+ *
+ * Example of how to enable unicast source checking on an interface:
+ * @cliexcmd{set urpf ip4 rx GigabitEthernet2/0/0 loose}
+ *
+ * Example of graph node after range checking is enabled:
+ * @cliexstart{show vlib graph ip4-rx-urpf-loose}
+ * Name Next Previous
+ * ip4-rx-urpf-loose ip4-drop [0] ip4-input-no-checksum
+ * ip4-source-and-port-range- ip4-input
+ * @cliexend
+ *
+ * Example of how to display the feature enabed on an interface:
+ * @cliexstart{show ip interface features GigabitEthernet2/0/0}
+ * IP feature paths configured on GigabitEthernet2/0/0...
+ *
+ * ipv4 unicast:
+ * ip4-rx-urpf-loose
+ * ip4-lookup
+ *
+ * ipv4 multicast:
+ * ip4-lookup-multicast
+ *
+ * ipv4 multicast:
+ * interface-output
+ *
+ * ipv6 unicast:
+ * ip6-lookup
+ *
+ * ipv6 multicast:
+ * ip6-lookup
+ *
+ * ipv6 multicast:
+ * interface-output
+ * @cliexend
+ *
+ * Example of how to disable unicast source checking on an interface:
+ * @cliexcmd{set urpf ip4 off GigabitEthernet2/0/0}
+ * @endparblock
+?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = {
+ .path = "set urpf",
+ .function = urpf_cli_update,
+ .short_help = "set urpf [ip4|ip6] [rx|tx] [off|strict|loose] <INTERFACE>",
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+urpf_cli_accept (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ clib_error_t *error = NULL;
+ fib_prefix_t fpfx;
+ ip_prefix_t pfx;
+ u32 table_id, is_add, fib_index;
+
+ is_add = 1;
+ table_id = 0;
+
+ /* Get a line of input. */
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "table %d", &table_id))
+ ;
+ else if (unformat (line_input, "del"))
+ is_add = 0;
+ else if (unformat (line_input, "add"))
+ is_add = 1;
+ else if (unformat (line_input, "%U", unformat_ip_prefix, &pfx))
+ ;
+ else
+ {
+ error = unformat_parse_error (line_input);
+ goto done;
+ }
+ }
+
+ ip_prefix_to_fib_prefix (&pfx, &fpfx);
+
+ fib_index = fib_table_find (fpfx.fp_proto, table_id);
+
+ if (~0 == fib_index)
+ {
+ error = clib_error_return (0, "Nonexistent table id %d", table_id);
+ goto done;
+ }
+
+ if (is_add)
+ fib_table_entry_special_add (fib_index,
+ &fpfx,
+ FIB_SOURCE_URPF_EXEMPT, FIB_ENTRY_FLAG_DROP);
+ else
+ fib_table_entry_special_remove (fib_index, &fpfx, FIB_SOURCE_URPF_EXEMPT);
+
+done:
+ unformat_free (line_input);
+
+ return (error);
+}
+
+/*?
+ * Add an exemption for a prefix to pass the Unicast Reverse Path
+ * Forwarding (uRPF) loose check. This is for testing purposes only.
+ * If the '<em>table</em>' is not enter it is defaulted to 0. Default
+ * is to '<em>add</em>'. VPP always performs a loose uRPF check for
+ * for-us traffic.
+ *
+ * @cliexpar
+ * Example of how to add a uRPF exception to a FIB table to pass the
+ * loose RPF tests:
+ * @cliexcmd{set urpf-accept table 7 10.0.0.0/8 add}
+?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (urpf_accept_command, static) = {
+ .path = "set urpf-accept",
+ .function = urpf_cli_accept,
+ .short_help = "urpf-accept [table <table-id>] [add|del] <PREFIX>",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
--- /dev/null
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __URPF_H__
+#define __URPF_H__
+
+#include <vnet/ip/ip_types.h>
+
+#define foreach_urpf_mode \
+ _(OFF, "off") \
+ _(LOOSE, "loose") \
+ _(STRICT, "strict") \
+
+typedef enum urpf_mode_t_
+{
+#define _(a,b) URPF_MODE_##a,
+ foreach_urpf_mode
+#undef _
+} __clib_packed urpf_mode_t;
+
+#define URPF_N_MODES (URPF_MODE_STRICT+1)
+
+extern u8 *format_urpf_mode (u8 * s, va_list * a);
+
+extern void urpf_update (urpf_mode_t mode,
+ u32 sw_if_index,
+ ip_address_family_t af, vlib_dir_t dir);
+
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
--- /dev/null
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <urpf/urpf.h>
+#include <vnet/plugin/plugin.h>
+#include <vnet/ip/ip_types_api.h>
+
+#include <vpp/app/version.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+
+/* define message IDs */
+#include <vnet/format_fns.h>
+#include <urpf/urpf.api_enum.h>
+#include <urpf/urpf.api_types.h>
+
+/**
+ * Base message ID fot the plugin
+ */
+static u32 urpf_base_msg_id;
+#define REPLY_MSG_ID_BASE urpf_base_msg_id
+
+#include <vlibapi/api_helper_macros.h>
+
+static int
+urpf_mode_decode (vl_api_urpf_mode_t in, urpf_mode_t * out)
+{
+ if (0)
+ ;
+#define _(a,b) \
+ else if (URPF_API_MODE_##a == in) \
+ { \
+ *out = URPF_MODE_##a; \
+ return (0); \
+ }
+ foreach_urpf_mode
+#undef _
+ return (VNET_API_ERROR_INVALID_VALUE);
+}
+
+static void
+vl_api_urpf_update_t_handler (vl_api_urpf_update_t * mp)
+{
+ vl_api_urpf_update_reply_t *rmp;
+ ip_address_family_t af;
+ urpf_mode_t mode;
+ int rv = 0;
+
+ VALIDATE_SW_IF_INDEX (mp);
+
+ rv = urpf_mode_decode (mp->mode, &mode);
+
+ if (rv)
+ goto done;
+
+ rv = ip_address_family_decode (mp->af, &af);
+
+ if (rv)
+ goto done;
+
+ urpf_update (mode, htonl (mp->sw_if_index), af,
+ (mp->is_input ? VLIB_RX : VLIB_TX));
+
+ BAD_SW_IF_INDEX_LABEL;
+done:
+ REPLY_MACRO (VL_API_URPF_UPDATE_REPLY);
+}
+
+#include <urpf/urpf.api.c>
+
+static clib_error_t *
+urpf_api_init (vlib_main_t * vm)
+{
+ /* Ask for a correctly-sized block of API message decode slots */
+ urpf_base_msg_id = setup_message_id_table ();
+
+ return 0;
+}
+
+VLIB_INIT_FUNCTION (urpf_api_init);
+
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () = {
+ .version = VPP_BUILD_VER,
+ .description = "Unicast Reverse Path Forwarding (uRPF)",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
--- /dev/null
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __URPF_DP_H__
+#define __URPF_DP_H__
+
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/fib/fib_urpf_list.h>
+#include <vnet/dpo/load_balance.h>
+
+#include <urpf/urpf.h>
+
+/**
+ * @file
+ * @brief Unicast Reverse Path forwarding.
+ *
+ * This file contains the interface unicast source check.
+ */
+typedef struct
+{
+ index_t urpf;
+} urpf_trace_t;
+
+static u8 *
+format_urpf_trace (u8 * s, va_list * va)
+{
+ CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
+ CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
+ urpf_trace_t *t = va_arg (*va, urpf_trace_t *);
+
+ s = format (s, "uRPF:%d", t->urpf);
+
+ return s;
+}
+
+#define foreach_urpf_error \
+ _(DROP, "uRPF Drop") \
+
+typedef enum urpf_error_t_
+{
+#define _(a,b) URPF_ERROR_##a,
+ foreach_urpf_error
+#undef _
+ URPF_N_ERROR,
+} urpf_error_t;
+
+typedef enum
+{
+ URPF_NEXT_DROP,
+ URPF_N_NEXT,
+} urpf_next_t;
+
+static_always_inline uword
+urpf_inline (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame,
+ ip_address_family_t af, vlib_dir_t dir, urpf_mode_t mode)
+{
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
+ u16 nexts[VLIB_FRAME_SIZE], *next;
+ u32 n_left, *from;
+
+ from = vlib_frame_vector_args (frame);
+ n_left = frame->n_vectors;
+ b = bufs;
+ next = nexts;
+
+ vlib_get_buffers (vm, from, bufs, n_left);
+
+ while (n_left >= 4)
+ {
+ u32 pass0, lb_index0, pass1, lb_index1;
+ const load_balance_t *lb0, *lb1;
+ u32 fib_index0, fib_index1;
+ const u8 *h0, *h1;
+
+ /* Prefetch next iteration. */
+ {
+ vlib_prefetch_buffer_header (b[2], LOAD);
+ vlib_prefetch_buffer_header (b[3], LOAD);
+ vlib_prefetch_buffer_data (b[2], LOAD);
+ vlib_prefetch_buffer_data (b[3], LOAD);
+ }
+
+ h0 = (u8 *) vlib_buffer_get_current (b[0]);
+ h1 = (u8 *) vlib_buffer_get_current (b[1]);
+
+ if (VLIB_TX == dir)
+ {
+ h0 += vnet_buffer (b[0])->ip.save_rewrite_length;
+ h1 += vnet_buffer (b[1])->ip.save_rewrite_length;
+ }
+
+ if (AF_IP4 == af)
+ {
+ const ip4_header_t *ip0, *ip1;
+
+ ip0 = (ip4_header_t *) h0;
+ ip1 = (ip4_header_t *) h1;
+
+ fib_index0 = ip4_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+ fib_index1 = ip4_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[1])->sw_if_index[dir]];
+
+ ip4_fib_forwarding_lookup_x2 (fib_index0,
+ fib_index1,
+ &ip0->src_address,
+ &ip1->src_address,
+ &lb_index0, &lb_index1);
+ /* Pass multicast. */
+ pass0 = (ip4_address_is_multicast (&ip0->src_address) ||
+ ip4_address_is_global_broadcast (&ip0->src_address));
+ pass1 = (ip4_address_is_multicast (&ip1->src_address) ||
+ ip4_address_is_global_broadcast (&ip1->src_address));
+ }
+ else
+ {
+ const ip6_header_t *ip0, *ip1;
+
+ fib_index0 = ip6_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+ fib_index1 = ip6_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[1])->sw_if_index[dir]];
+
+ ip0 = (ip6_header_t *) h0;
+ ip1 = (ip6_header_t *) h1;
+
+ lb_index0 = ip6_fib_table_fwding_lookup (fib_index0,
+ &ip0->src_address);
+ lb_index1 = ip6_fib_table_fwding_lookup (fib_index1,
+ &ip1->src_address);
+ pass0 = ip6_address_is_multicast (&ip0->src_address);
+ pass1 = ip6_address_is_multicast (&ip1->src_address);
+ }
+
+ lb0 = load_balance_get (lb_index0);
+ lb1 = load_balance_get (lb_index1);
+
+ if (URPF_MODE_STRICT == mode)
+ {
+ /* for RX the check is: would this source adddress be forwarded
+ * out of the interface on which it was recieved, if yes allow.
+ * For TX it's; would this source addres be forwarded out of the
+ * interface through which it is being sent, if yes drop.
+ */
+ int res0, res1;
+
+ res0 = fib_urpf_check (lb0->lb_urpf,
+ vnet_buffer (b[0])->sw_if_index[dir]);
+ res1 = fib_urpf_check (lb1->lb_urpf,
+ vnet_buffer (b[1])->sw_if_index[dir]);
+
+ if (VLIB_RX == dir)
+ {
+ pass0 |= res0;
+ pass1 |= res1;
+ }
+ else
+ {
+ pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf);
+ pass1 |= !res1 && fib_urpf_check_size (lb1->lb_urpf);
+ }
+ }
+ else
+ {
+ pass0 |= fib_urpf_check_size (lb0->lb_urpf);
+ pass1 |= fib_urpf_check_size (lb1->lb_urpf);
+ }
+
+ if (PREDICT_TRUE (pass0))
+ vnet_feature_next_u16 (&next[0], b[0]);
+ else
+ {
+ next[0] = URPF_NEXT_DROP;
+ b[0]->error = node->errors[URPF_ERROR_DROP];
+ }
+ if (PREDICT_TRUE (pass1))
+ vnet_feature_next_u16 (&next[1], b[1]);
+ else
+ {
+ next[1] = URPF_NEXT_DROP;
+ b[1]->error = node->errors[URPF_ERROR_DROP];
+ }
+
+ if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ urpf_trace_t *t;
+
+ t = vlib_add_trace (vm, node, b[0], sizeof (*t));
+ t->urpf = lb0->lb_urpf;
+ }
+ if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ urpf_trace_t *t;
+
+ t = vlib_add_trace (vm, node, b[1], sizeof (*t));
+ t->urpf = lb1->lb_urpf;
+ }
+
+ b += 2;
+ next += 2;
+ n_left -= 2;
+ }
+
+ while (n_left)
+ {
+ u32 pass0, lb_index0, fib_index0;
+ const load_balance_t *lb0;
+ const u8 *h0;
+
+ h0 = (u8 *) vlib_buffer_get_current (b[0]);
+
+ if (VLIB_TX == dir)
+ h0 += vnet_buffer (b[0])->ip.save_rewrite_length;
+
+ if (AF_IP4 == af)
+ {
+ const ip4_header_t *ip0;
+
+ fib_index0 = ip4_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+ ip0 = (ip4_header_t *) h0;
+
+ lb_index0 = ip4_fib_forwarding_lookup (fib_index0,
+ &ip0->src_address);
+
+ /* Pass multicast. */
+ pass0 = (ip4_address_is_multicast (&ip0->src_address) ||
+ ip4_address_is_global_broadcast (&ip0->src_address));
+ }
+ else
+ {
+ const ip6_header_t *ip0;
+
+ ip0 = (ip6_header_t *) h0;
+ fib_index0 = ip6_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+
+ lb_index0 = ip6_fib_table_fwding_lookup (fib_index0,
+ &ip0->src_address);
+ pass0 = ip6_address_is_multicast (&ip0->src_address);
+ }
+
+ lb0 = load_balance_get (lb_index0);
+
+ if (URPF_MODE_STRICT == mode)
+ {
+ int res0;
+
+ res0 = fib_urpf_check (lb0->lb_urpf,
+ vnet_buffer (b[0])->sw_if_index[dir]);
+ if (VLIB_RX == dir)
+ pass0 |= res0;
+ else
+ pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf);
+ }
+ else
+ pass0 |= fib_urpf_check_size (lb0->lb_urpf);
+
+ if (PREDICT_TRUE (pass0))
+ vnet_feature_next_u16 (&next[0], b[0]);
+ else
+ {
+ next[0] = URPF_NEXT_DROP;
+ b[0]->error = node->errors[URPF_ERROR_DROP];
+ }
+
+ if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ urpf_trace_t *t;
+
+ t = vlib_add_trace (vm, node, b[0], sizeof (*t));
+ t->urpf = lb0->lb_urpf;
+ }
+ b++;
+ next++;
+ n_left--;
+ }
+
+ vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
ip/ip4_mtrie.c
ip/ip4_pg.c
ip/ip4_source_and_port_range_check.c
- ip/ip4_source_check.c
ip/reass/ip4_full_reass.c
ip/reass/ip4_sv_reass.c
ip/ip6_format.c
)
list(APPEND VNET_MULTIARCH_SOURCES
- ip/ip4_source_check.c
ip/ip4_punt_drop.c
ip/reass/ip4_full_reass.c
ip/ip6_hop_by_hop.c
return (ip4_fib_mtrie_leaf_get_adj_index(leaf));
}
+static_always_inline void
+ip4_fib_forwarding_lookup_x2 (u32 fib_index0,
+ u32 fib_index1,
+ const ip4_address_t * addr0,
+ const ip4_address_t * addr1,
+ index_t *lb0,
+ index_t *lb1)
+{
+ ip4_fib_mtrie_leaf_t leaf[2];
+ ip4_fib_mtrie_t * mtrie[2];
+
+ mtrie[0] = &ip4_fib_get(fib_index0)->mtrie;
+ mtrie[1] = &ip4_fib_get(fib_index1)->mtrie;
+
+ leaf[0] = ip4_fib_mtrie_lookup_step_one (mtrie[0], addr0);
+ leaf[1] = ip4_fib_mtrie_lookup_step_one (mtrie[1], addr1);
+ leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 2);
+ leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 2);
+ leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 3);
+ leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 3);
+
+ *lb0 = ip4_fib_mtrie_leaf_get_adj_index(leaf[0]);
+ *lb1 = ip4_fib_mtrie_leaf_get_adj_index(leaf[1]);
+}
#endif
--- /dev/null
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+typedef u32 interface_index;
+
+enum if_status_flags
+{
+ IF_STATUS_API_FLAG_ADMIN_UP = 1,
+ IF_STATUS_API_FLAG_LINK_UP = 2,
+};
+
+/* Per protocol MTU */
+enum mtu_proto
+{
+ MTU_PROTO_API_L3, /* Default payload MTU (without L2 headers) */
+ MTU_PROTO_API_IP4, /* Per-protocol MTUs overriding default */
+ MTU_PROTO_API_IP6,
+ MTU_PROTO_API_MPLS,
+ MTU_PROTO_API_N,
+};
+
+enum link_duplex
+{
+ LINK_DUPLEX_API_UNKNOWN = 0,
+ LINK_DUPLEX_API_HALF = 1,
+ LINK_DUPLEX_API_FULL = 2,
+};
+
+enum sub_if_flags
+{
+ SUB_IF_API_FLAG_NO_TAGS = 1,
+ SUB_IF_API_FLAG_ONE_TAG = 2,
+ SUB_IF_API_FLAG_TWO_TAGS = 4,
+ SUB_IF_API_FLAG_DOT1AD = 8,
+ SUB_IF_API_FLAG_EXACT_MATCH = 16,
+ SUB_IF_API_FLAG_DEFAULT = 32,
+ SUB_IF_API_FLAG_OUTER_VLAN_ID_ANY = 64,
+ SUB_IF_API_FLAG_INNER_VLAN_ID_ANY = 128,
+ SUB_IF_API_FLAG_MASK_VNET = 254, /* use with vnet_sub_interface_t raw_flags */
+ SUB_IF_API_FLAG_DOT1AH = 256,
+};
+
+enum rx_mode
+{
+ RX_MODE_API_UNKNOWN = 0,
+ RX_MODE_API_POLLING,
+ RX_MODE_API_INTERRUPT,
+ RX_MODE_API_ADAPTIVE,
+ RX_MODE_API_DEFAULT,
+};
+
+enum if_type
+{
+ /* A hw interface. */
+ IF_API_TYPE_HARDWARE,
+
+ /* A sub-interface. */
+ IF_API_TYPE_SUB,
+ IF_API_TYPE_P2P,
+ IF_API_TYPE_PIPE,
+};
+
+enum direction:u8
+{
+ DIRECTION_RX,
+ DIRECTION_TX,
+};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
u32 udp_out_vrf_id;
};
-/** \brief Set interface source check request
- @param client_index - opaque cookie to identify the sender
- @param context - sender context, to match reply w/ request
- @param is_add - add or del
- @param loose - strict or loose
- @param sw_if_index - interface index
-*/
-autoreply define ip_source_check_interface_add_del
-{
- u32 client_index;
- u32 context;
- bool is_add [default=true];
- bool loose;
- vl_api_interface_index_t sw_if_index;
-};
-
/** \brief IPv6 set link local address on interface request
@param client_index - opaque cookie to identify the sender
@param context - sender context, to match reply w/ request
_ (UDP_CHECKSUM, "bad udp checksum") \
_ (UDP_LENGTH, "inconsistent udp/ip lengths") \
\
- /* Errors signalled by ip4-source-check. */ \
- _ (UNICAST_SOURCE_CHECK_FAILS, "ip4 unicast source check fails") \
- \
/* Spoofed packets in ip4-rewrite-local */ \
_ (SPOOFED_LOCAL_PACKETS, "ip4 spoofed local-address packet drops") \
\
{
.arc_name = "ip4-unicast",
.node_name = "ip4-inacl",
- .runs_before = VNET_FEATURES ("ip4-source-check-via-rx"),
-};
-
-VNET_FEATURE_INIT (ip4_source_check_1, static) =
-{
- .arc_name = "ip4-unicast",
- .node_name = "ip4-source-check-via-rx",
- .runs_before = VNET_FEATURES ("ip4-source-check-via-any"),
-};
-
-VNET_FEATURE_INIT (ip4_source_check_2, static) =
-{
- .arc_name = "ip4-unicast",
- .node_name = "ip4-source-check-via-any",
.runs_before = VNET_FEATURES ("ip4-policer-classify"),
};
if ((error = vlib_call_init_function (vm, ip4_cli_init)))
return error;
- if ((error = vlib_call_init_function (vm, ip4_source_check_init)))
- return error;
-
if ((error = vlib_call_init_function
(vm, ip4_source_and_port_range_check_init)))
return error;
return (a->data[0] & 0xf0) == 0xe0;
}
+always_inline uword
+ip4_address_is_global_broadcast (const ip4_address_t * a)
+{
+ return (a->as_u32) == 0xffffffff;
+}
+
always_inline void
ip4_multicast_address_set_for_group (ip4_address_t * a,
ip_multicast_group_t g)
+++ /dev/null
-/*
- * Copyright (c) 2015 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/*
- * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
- *
- * Copyright (c) 2008 Eliot Dresselhaus
- *
- * Permission is hereby granted, free of charge, to any person obtaining
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
- * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
- * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#include <vnet/ip/ip.h>
-#include <vnet/fib/ip4_fib.h>
-#include <vnet/fib/fib_urpf_list.h>
-#include <vnet/dpo/load_balance.h>
-
-/**
- * @file
- * @brief IPv4 Unicast Source Check.
- *
- * This file contains the IPv4 interface unicast source check.
- */
-
-
-typedef struct
-{
- u8 packet_data[64];
- index_t urpf;
-} ip4_source_check_trace_t;
-
-static u8 *
-format_ip4_source_check_trace (u8 * s, va_list * va)
-{
- CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
- CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
- ip4_source_check_trace_t *t = va_arg (*va, ip4_source_check_trace_t *);
-
- s = format (s, "%U",
- format_ip4_header, t->packet_data, sizeof (t->packet_data));
-
- return s;
-}
-
-typedef enum
-{
- IP4_SOURCE_CHECK_NEXT_DROP,
- IP4_SOURCE_CHECK_N_NEXT,
-} ip4_source_check_next_t;
-
-typedef enum
-{
- IP4_SOURCE_CHECK_REACHABLE_VIA_RX,
- IP4_SOURCE_CHECK_REACHABLE_VIA_ANY,
-} ip4_source_check_type_t;
-
-typedef union
-{
- u32 fib_index;
-} ip4_source_check_config_t;
-
-always_inline uword
-ip4_source_check_inline (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame,
- ip4_source_check_type_t source_check_type)
-{
- u32 n_left_from, *from, *to_next;
- u32 next_index;
- vlib_node_runtime_t *error_node =
- vlib_node_get_runtime (vm, ip4_input_node.index);
-
- from = vlib_frame_vector_args (frame);
- n_left_from = frame->n_vectors;
- next_index = node->cached_next_index;
-
- if (node->flags & VLIB_NODE_FLAG_TRACE)
- vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
- /* stride */ 1,
- sizeof (ip4_source_check_trace_t));
-
- while (n_left_from > 0)
- {
- u32 n_left_to_next;
-
- vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
-
- while (n_left_from >= 4 && n_left_to_next >= 2)
- {
- vlib_buffer_t *p0, *p1;
- ip4_header_t *ip0, *ip1;
- ip4_fib_mtrie_t *mtrie0, *mtrie1;
- ip4_fib_mtrie_leaf_t leaf0, leaf1;
- ip4_source_check_config_t *c0, *c1;
- const load_balance_t *lb0, *lb1;
- u32 pi0, next0, pass0, lb_index0;
- u32 pi1, next1, pass1, lb_index1;
-
- /* Prefetch next iteration. */
- {
- vlib_buffer_t *p2, *p3;
-
- p2 = vlib_get_buffer (vm, from[2]);
- p3 = vlib_get_buffer (vm, from[3]);
-
- vlib_prefetch_buffer_header (p2, LOAD);
- vlib_prefetch_buffer_header (p3, LOAD);
-
- CLIB_PREFETCH (p2->data, sizeof (ip0[0]), LOAD);
- CLIB_PREFETCH (p3->data, sizeof (ip1[0]), LOAD);
- }
-
- pi0 = to_next[0] = from[0];
- pi1 = to_next[1] = from[1];
- from += 2;
- to_next += 2;
- n_left_from -= 2;
- n_left_to_next -= 2;
-
- p0 = vlib_get_buffer (vm, pi0);
- p1 = vlib_get_buffer (vm, pi1);
-
- ip0 = vlib_buffer_get_current (p0);
- ip1 = vlib_buffer_get_current (p1);
-
- c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0]));
- c1 = vnet_feature_next_with_data (&next1, p1, sizeof (c1[0]));
-
- mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie;
- mtrie1 = &ip4_fib_get (c1->fib_index)->mtrie;
-
- leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
- leaf1 = ip4_fib_mtrie_lookup_step_one (mtrie1, &ip1->src_address);
-
- leaf0 =
- ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2);
- leaf1 =
- ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 2);
-
- leaf0 =
- ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3);
- leaf1 =
- ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 3);
-
- lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0);
- lb_index1 = ip4_fib_mtrie_leaf_get_adj_index (leaf1);
-
- lb0 = load_balance_get (lb_index0);
- lb1 = load_balance_get (lb_index1);
-
- /* Pass multicast. */
- pass0 = ip4_address_is_multicast (&ip0->src_address)
- || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF);
- pass1 = ip4_address_is_multicast (&ip1->src_address)
- || ip1->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF);
-
- if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type)
- {
- pass0 |= fib_urpf_check (lb0->lb_urpf,
- vnet_buffer (p0)->sw_if_index
- [VLIB_RX]);
- pass1 |=
- fib_urpf_check (lb1->lb_urpf,
- vnet_buffer (p1)->sw_if_index[VLIB_RX]);
- }
- else
- {
- pass0 |= fib_urpf_check_size (lb0->lb_urpf);
- pass1 |= fib_urpf_check_size (lb1->lb_urpf);
- }
- next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP);
- next1 = (pass1 ? next1 : IP4_SOURCE_CHECK_NEXT_DROP);
-
- p0->error =
- error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS];
- p1->error =
- error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS];
-
- vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
- to_next, n_left_to_next,
- pi0, pi1, next0, next1);
- }
-
- while (n_left_from > 0 && n_left_to_next > 0)
- {
- vlib_buffer_t *p0;
- ip4_header_t *ip0;
- ip4_fib_mtrie_t *mtrie0;
- ip4_fib_mtrie_leaf_t leaf0;
- ip4_source_check_config_t *c0;
- u32 pi0, next0, pass0, lb_index0;
- const load_balance_t *lb0;
-
- pi0 = from[0];
- to_next[0] = pi0;
- from += 1;
- to_next += 1;
- n_left_from -= 1;
- n_left_to_next -= 1;
-
- p0 = vlib_get_buffer (vm, pi0);
- ip0 = vlib_buffer_get_current (p0);
-
- c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0]));
-
- mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie;
-
- leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
-
- leaf0 =
- ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2);
-
- leaf0 =
- ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3);
-
- lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0);
-
- lb0 = load_balance_get (lb_index0);
-
- /* Pass multicast. */
- pass0 = ip4_address_is_multicast (&ip0->src_address)
- || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF);
-
- if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type)
- {
- pass0 |= fib_urpf_check (lb0->lb_urpf,
- vnet_buffer (p0)->sw_if_index
- [VLIB_RX]);
- }
- else
- {
- pass0 |= fib_urpf_check_size (lb0->lb_urpf);
- }
-
- next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP);
- p0->error =
- error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS];
-
- vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
- to_next, n_left_to_next,
- pi0, next0);
- }
-
- vlib_put_next_frame (vm, node, next_index, n_left_to_next);
- }
-
- return frame->n_vectors;
-}
-
-VLIB_NODE_FN (ip4_check_source_reachable_via_any) (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame)
-{
- return ip4_source_check_inline (vm, node, frame,
- IP4_SOURCE_CHECK_REACHABLE_VIA_ANY);
-}
-
-VLIB_NODE_FN (ip4_check_source_reachable_via_rx) (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame)
-{
- return ip4_source_check_inline (vm, node, frame,
- IP4_SOURCE_CHECK_REACHABLE_VIA_RX);
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip4_check_source_reachable_via_any) = {
- .name = "ip4-source-check-via-any",
- .vector_size = sizeof (u32),
-
- .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT,
- .next_nodes = {
- [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop",
- },
-
- .format_buffer = format_ip4_header,
- .format_trace = format_ip4_source_check_trace,
-};
-/* *INDENT-ON* */
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip4_check_source_reachable_via_rx) = {
- .name = "ip4-source-check-via-rx",
- .vector_size = sizeof (u32),
-
- .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT,
- .next_nodes = {
- [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop",
- },
-
- .format_buffer = format_ip4_header,
- .format_trace = format_ip4_source_check_trace,
-};
-/* *INDENT-ON* */
-
-static clib_error_t *
-set_ip_source_check (vlib_main_t * vm,
- unformat_input_t * input, vlib_cli_command_t * cmd)
-{
- unformat_input_t _line_input, *line_input = &_line_input;
- vnet_main_t *vnm = vnet_get_main ();
- ip4_main_t *im = &ip4_main;
- clib_error_t *error = 0;
- u32 sw_if_index, is_del;
- ip4_source_check_config_t config;
- char *feature_name = "ip4-source-check-via-rx";
-
- sw_if_index = ~0;
- is_del = 0;
-
- if (!unformat_user (input, unformat_line_input, line_input))
- return 0;
-
- while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
- {
- if (unformat_user
- (line_input, unformat_vnet_sw_interface, vnm, &sw_if_index))
- ;
- else if (unformat (line_input, "del"))
- is_del = 1;
- else if (unformat (line_input, "loose"))
- feature_name = "ip4-source-check-via-any";
- else
- {
- error = unformat_parse_error (line_input);
- goto done;
- }
- }
-
- if (~0 == sw_if_index)
- {
- error = clib_error_return (0, "unknown interface `%U'",
- format_unformat_error, line_input);
- goto done;
- }
-
- config.fib_index = im->fib_index_by_sw_if_index[sw_if_index];
- vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
- is_del == 0, &config, sizeof (config));
-done:
- unformat_free (line_input);
-
- return error;
-}
-
-/*?
- * This command adds the 'ip4-source-check-via-rx' graph node for
- * a given interface. By adding the IPv4 source check graph node to
- * an interface, the code verifies that the source address of incoming
- * unicast packets are reachable over the incoming interface. Two flavours
- * are supported (the default is strict):
- * - loose: accept ingress packet if there is a route to reach the source
- * - strict: accept ingress packet if it arrived on an interface which
- * the route to the source uses. i.e. an interface that the source
- * is reachable via.
- *
- * @cliexpar
- * @parblock
- * Example of graph node before range checking is enabled:
- * @cliexstart{show vlib graph ip4-source-check-via-rx}
- * Name Next Previous
- * ip4-source-check-via-rx ip4-drop [0]
- * @cliexend
- *
- * Example of how to enable unicast source checking on an interface:
- * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 loose}
- *
- * Example of graph node after range checking is enabled:
- * @cliexstart{show vlib graph ip4-source-check-via-rx}
- * Name Next Previous
- * ip4-source-check-via-rx ip4-drop [0] ip4-input-no-checksum
- * ip4-source-and-port-range- ip4-input
- * @cliexend
- *
- * Example of how to display the feature enabed on an interface:
- * @cliexstart{show ip interface features GigabitEthernet2/0/0}
- * IP feature paths configured on GigabitEthernet2/0/0...
- *
- * ipv4 unicast:
- * ip4-source-check-via-rx
- * ip4-lookup
- *
- * ipv4 multicast:
- * ip4-lookup-multicast
- *
- * ipv4 multicast:
- * interface-output
- *
- * ipv6 unicast:
- * ip6-lookup
- *
- * ipv6 multicast:
- * ip6-lookup
- *
- * ipv6 multicast:
- * interface-output
- * @cliexend
- *
- * Example of how to disable unicast source checking on an interface:
- * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 del}
- * @endparblock
-?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = {
- .path = "set interface ip source-check",
- .function = set_ip_source_check,
- .short_help = "set interface ip source-check <interface> [strict|loose] [del]",
-};
-/* *INDENT-ON* */
-
-static clib_error_t *
-ip_source_check_accept (vlib_main_t * vm,
- unformat_input_t * input, vlib_cli_command_t * cmd)
-{
- unformat_input_t _line_input, *line_input = &_line_input;
- fib_prefix_t pfx = {
- .fp_proto = FIB_PROTOCOL_IP4,
- };
- clib_error_t *error = NULL;
- u32 table_id, is_add, fib_index;
-
- is_add = 1;
- table_id = ~0;
-
- /* Get a line of input. */
- if (!unformat_user (input, unformat_line_input, line_input))
- return 0;
-
- while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
- {
- if (unformat (line_input, "table %d", &table_id))
- ;
- else if (unformat (line_input, "del"))
- is_add = 0;
- else if (unformat (line_input, "add"))
- is_add = 1;
- else if (unformat (line_input, "%U/%d",
- unformat_ip4_address, &pfx.fp_addr.ip4, &pfx.fp_len))
- pfx.fp_proto = FIB_PROTOCOL_IP4;
- else
- {
- error = unformat_parse_error (line_input);
- goto done;
- }
- }
-
- if (~0 != table_id)
- {
- fib_index = fib_table_find (pfx.fp_proto, table_id);
- if (~0 == fib_index)
- {
- error = clib_error_return (0, "Nonexistent table id %d", table_id);
- goto done;
- }
- }
- else
- {
- fib_index = 0;
- }
-
- if (is_add)
- {
- fib_table_entry_special_add (fib_index,
- &pfx,
- FIB_SOURCE_URPF_EXEMPT,
- FIB_ENTRY_FLAG_DROP);
- }
- else
- {
- fib_table_entry_special_remove (fib_index,
- &pfx, FIB_SOURCE_URPF_EXEMPT);
- }
-
-done:
- unformat_free (line_input);
-
- return error;
-}
-
-/*?
- * Add an exemption for a prefix to pass the Unicast Reverse Path
- * Forwarding (uRPF) loose check. This is for testing purposes only.
- * If the '<em>table</em>' is not enter it is defaulted to 0. Default
- * is to '<em>add</em>'. VPP always performs a loose uRPF check for
- * for-us traffic.
- *
- * @cliexpar
- * Example of how to add a uRPF exception to a FIB table to pass the
- * loose RPF tests:
- * @cliexcmd{ip urpf-accept table 7 add}
-?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (ip_source_check_accept_command, static) = {
- .path = "ip urpf-accept",
- .function = ip_source_check_accept,
- .short_help = "ip urpf-accept [table <table-id>] [add|del]",
-};
-/* *INDENT-ON* */
-
-
-#ifndef CLIB_MARCH_VARIANT
-/* Dummy init function to get us linked in. */
-clib_error_t *
-ip4_source_check_init (vlib_main_t * vm)
-{
- return 0;
-}
-
-VLIB_INIT_FUNCTION (ip4_source_check_init);
-#endif /* CLIB_MARCH_VARIANT */
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
ip_source_and_port_range_check_add_del) \
_(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL, \
ip_source_and_port_range_check_interface_add_del) \
-_(IP_SOURCE_CHECK_INTERFACE_ADD_DEL, \
- ip_source_check_interface_add_del) \
_(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS, \
sw_interface_ip6_set_link_local_address) \
_(IP_REASSEMBLY_SET, ip_reassembly_set) \
REPLY_MACRO (VL_API_SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS_REPLY);
}
-typedef union
-{
- u32 fib_index;
-} ip4_source_check_config_t;
-
-static void
- vl_api_ip_source_check_interface_add_del_t_handler
- (vl_api_ip_source_check_interface_add_del_t * mp)
-{
- vl_api_ip_source_check_interface_add_del_reply_t *rmp;
- int rv;
- u32 sw_if_index = ntohl (mp->sw_if_index);
- u8 is_add = mp->is_add;
- char *feature_name =
- mp->loose ? "ip4-source-check-via-any" : "ip4-source-check-via-rx";
-
- ip4_source_check_config_t config;
-
- VALIDATE_SW_IF_INDEX (mp);
-
- config.fib_index =
- fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index);
- rv =
- vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
- is_add, &config, sizeof (config));
- BAD_SW_IF_INDEX_LABEL;
-
- REPLY_MACRO (VL_API_IP_SOURCE_CHECK_INTERFACE_ADD_DEL_REPLY);
-}
-
-
static void
vl_api_ip_table_replace_begin_t_handler (vl_api_ip_table_replace_begin_t * mp)
{
Code Review / vpp.git / commitdiff