diff options
| -rw-r--r-- | src/vat/api_format.c | 109 | ||||
| -rw-r--r-- | src/vnet/fib/fib_entry.h | 5 | ||||
| -rw-r--r-- | src/vnet/fib/fib_entry_src_api.c | 1 | ||||
| -rw-r--r-- | src/vnet/ip/ip.api | 50 | ||||
| -rw-r--r-- | src/vnet/ip/ip6.h | 55 | ||||
| -rw-r--r-- | src/vnet/ip/ip6_neighbor.c | 136 | ||||
| -rw-r--r-- | src/vnet/ip/ip6_neighbor.h | 42 | ||||
| -rw-r--r-- | src/vnet/ip/ip_api.c | 102 | ||||
| -rw-r--r-- | src/vnet/ip/lookup.c | 1 | ||||
| -rw-r--r-- | test/test_ip6.py | 293 | ||||
| -rw-r--r-- | test/vpp_papi_provider.py | 6 |
11 files changed, 721 insertions, 79 deletions
diff --git a/src/vat/api_format.c b/src/vat/api_format.c index fb596fe6..08a2a774 100644 --- a/src/vat/api_format.c +++ b/src/vat/api_format.c @@ -3913,6 +3913,7 @@ _(dhcp_client_config_reply) \ _(set_ip_flow_hash_reply) \ _(sw_interface_ip6_enable_disable_reply) \ _(sw_interface_ip6_set_link_local_address_reply) \ +_(ip6nd_proxy_add_del_reply) \ _(sw_interface_ip6nd_ra_prefix_reply) \ _(sw_interface_ip6nd_ra_config_reply) \ _(set_arp_neighbor_limit_reply) \ @@ -4092,6 +4093,8 @@ _(SW_INTERFACE_IP6_ENABLE_DISABLE_REPLY, \ sw_interface_ip6_enable_disable_reply) \ _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS_REPLY, \ sw_interface_ip6_set_link_local_address_reply) \ +_(IP6ND_PROXY_ADD_DEL_REPLY, ip6nd_proxy_add_del_reply) \ +_(IP6ND_PROXY_DETAILS, ip6nd_proxy_details) \ _(SW_INTERFACE_IP6ND_RA_PREFIX_REPLY, \ sw_interface_ip6nd_ra_prefix_reply) \ _(SW_INTERFACE_IP6ND_RA_CONFIG_REPLY, \ @@ -7968,6 +7971,109 @@ api_sw_interface_ip6_set_link_local_address (vat_main_t * vam) return ret; } +static int +api_ip6nd_proxy_add_del (vat_main_t * vam) +{ + unformat_input_t *i = vam->input; + vl_api_ip6nd_proxy_add_del_t *mp; + u32 sw_if_index = ~0; + u8 v6_address_set = 0; + ip6_address_t v6address; + u8 is_del = 0; + int ret; + + /* Parse args required to build the message */ + while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT) + { + if (unformat (i, "%U", api_unformat_sw_if_index, vam, &sw_if_index)) + ; + else if (unformat (i, "sw_if_index %d", &sw_if_index)) + ; + else if (unformat (i, "%U", unformat_ip6_address, &v6address)) + v6_address_set = 1; + if (unformat (i, "del")) + is_del = 1; + else + { + clib_warning ("parse error '%U'", format_unformat_error, i); + return -99; + } + } + + if (sw_if_index == ~0) + { + errmsg ("missing interface name or sw_if_index"); + return -99; + } + if (!v6_address_set) + { + errmsg ("no address set"); + return -99; + } + + /* Construct the API message */ + M (IP6ND_PROXY_ADD_DEL, mp); + + mp->is_del = is_del; + mp->sw_if_index = ntohl (sw_if_index); + clib_memcpy (mp->address, &v6address, sizeof (v6address)); + + /* send it... */ + S (mp); + + /* Wait for a reply, return good/bad news */ + W (ret); + return ret; +} + +static int +api_ip6nd_proxy_dump (vat_main_t * vam) +{ + vl_api_ip6nd_proxy_dump_t *mp; + vl_api_control_ping_t *mp_ping; + int ret; + + M (IP6ND_PROXY_DUMP, mp); + + S (mp); + + /* Use a control ping for synchronization */ + M (CONTROL_PING, mp_ping); + S (mp_ping); + + W (ret); + return ret; +} + +static void vl_api_ip6nd_proxy_details_t_handler + (vl_api_ip6nd_proxy_details_t * mp) +{ + vat_main_t *vam = &vat_main; + + print (vam->ofp, "host %U sw_if_index %d", + format_ip6_address, mp->address, ntohl (mp->sw_if_index)); +} + +static void vl_api_ip6nd_proxy_details_t_handler_json + (vl_api_ip6nd_proxy_details_t * mp) +{ + vat_main_t *vam = &vat_main; + struct in6_addr ip6; + vat_json_node_t *node = NULL; + + if (VAT_JSON_ARRAY != vam->json_tree.type) + { + ASSERT (VAT_JSON_NONE == vam->json_tree.type); + vat_json_init_array (&vam->json_tree); + } + node = vat_json_array_add (&vam->json_tree); + + vat_json_init_object (node); + vat_json_object_add_uint (node, "sw_if_index", ntohl (mp->sw_if_index)); + + clib_memcpy (&ip6, mp->address, sizeof (ip6)); + vat_json_object_add_ip6 (node, "host", ip6); +} static int api_sw_interface_ip6nd_ra_prefix (vat_main_t * vam) @@ -17974,6 +18080,9 @@ _(sw_interface_ip6_enable_disable, \ "<intfc> | sw_if_index <id> enable | disable") \ _(sw_interface_ip6_set_link_local_address, \ "<intfc> | sw_if_index <id> <ip6-address>/<mask-width>") \ +_(ip6nd_proxy_add_del, \ + "<intfc> | sw_if_index <id> <ip6-address>") \ +_(ip6nd_proxy_dump, "") \ _(sw_interface_ip6nd_ra_prefix, \ "<intfc> | sw_if_index <id> <ip6-address>/<mask-width>\n" \ "val_life <n> pref_life <n> [def] [noadv] [offl] [noauto]\n" \ diff --git a/src/vnet/fib/fib_entry.h b/src/vnet/fib/fib_entry.h index 9dfb8127..12fa9eb4 100644 --- a/src/vnet/fib/fib_entry.h +++ b/src/vnet/fib/fib_entry.h @@ -81,6 +81,10 @@ typedef enum fib_source_t_ { */ FIB_SOURCE_DHCP, /** + * IPv6 Proxy ND + */ + FIB_SOURCE_IP6_ND_PROXY, + /** * Adjacency source. * routes created as a result of ARP/ND entries. This is lower priority * then the API/CLI. This is on purpose. trust me. @@ -141,6 +145,7 @@ STATIC_ASSERT (sizeof(fib_source_t) == 1, [FIB_SOURCE_LISP] = "LISP", \ [FIB_SOURCE_CLASSIFY] = "classify", \ [FIB_SOURCE_DHCP] = "DHCP", \ + [FIB_SOURCE_IP6_ND_PROXY] = "IPv6-proxy-nd", \ [FIB_SOURCE_RR] = "recursive-resolution", \ [FIB_SOURCE_AE] = "attached_export", \ [FIB_SOURCE_MPLS] = "mpls", \ diff --git a/src/vnet/fib/fib_entry_src_api.c b/src/vnet/fib/fib_entry_src_api.c index edc8a47b..1277bd65 100644 --- a/src/vnet/fib/fib_entry_src_api.c +++ b/src/vnet/fib/fib_entry_src_api.c @@ -116,4 +116,5 @@ fib_entry_src_api_register (void) fib_entry_src_register(FIB_SOURCE_API, &api_src_vft); fib_entry_src_register(FIB_SOURCE_CLI, &api_src_vft); fib_entry_src_register(FIB_SOURCE_DHCP, &api_src_vft); + fib_entry_src_register(FIB_SOURCE_IP6_ND_PROXY, &api_src_vft); } diff --git a/src/vnet/ip/ip.api b/src/vnet/ip/ip.api index ff16e781..b5e730fc 100644 --- a/src/vnet/ip/ip.api +++ b/src/vnet/ip/ip.api @@ -294,6 +294,56 @@ define sw_interface_ip6nd_ra_prefix_reply i32 retval; }; +/** \brief IPv6 ND proxy config + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param sw_if_index - The interface the host is on + @param address - The address of the host for which to proxy for + @param is_add - Adding or deleting +*/ +define ip6nd_proxy_add_del +{ + u32 client_index; + u32 context; + u32 sw_if_index; + u8 is_del; + u8 address[16]; +}; + +/** \brief IPv6 ND proxy response + @param context - sender context, to match reply w/ request + @param retval - return code for the request +*/ +define ip6nd_proxy_add_del_reply +{ + u32 context; + i32 retval; +}; + +/** \brief IPv6 ND proxy details returned after request + @param context - sender context, to match reply w/ request + @param retval - return code for the request +*/ +define ip6nd_proxy_details +{ + u32 client_index; + u32 context; + u32 sw_if_index; + u8 address[16]; +}; + +/** \brief IPv6 ND proxy dump request + @param context - sender context, to match reply w/ request + @param retval - return code for the request + @param sw_if_index - The interface the host is on + @param address - The address of the host for which to proxy for +*/ +define ip6nd_proxy_dump +{ + u32 client_index; + u32 context; +}; + /** \brief IPv6 interface enable / disable request @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request diff --git a/src/vnet/ip/ip6.h b/src/vnet/ip/ip6.h index 535f24c0..f402b011 100644 --- a/src/vnet/ip/ip6.h +++ b/src/vnet/ip/ip6.h @@ -217,24 +217,6 @@ extern vlib_node_registration_t ip6_discover_neighbor_node; extern vlib_node_registration_t ip6_glean_node; extern vlib_node_registration_t ip6_midchain_node; -extern vlib_node_registration_t ip6_icmp_neighbor_discovery_event_node; - -/* ipv6 neighbor discovery - timer/event types */ -typedef enum -{ - ICMP6_ND_EVENT_INIT, -} ip6_icmp_neighbor_discovery_event_type_t; - -typedef union -{ - u32 add_del_swindex; - struct - { - u32 up_down_swindex; - u32 fib_index; - } up_down_event; -} ip6_icmp_neighbor_discovery_event_data_t; - always_inline uword ip6_destination_matches_route (const ip6_main_t * im, const ip6_address_t * key, @@ -342,8 +324,6 @@ int ip6_address_compare (ip6_address_t * a1, ip6_address_t * a2); clib_error_t *ip6_probe_neighbor (vlib_main_t * vm, ip6_address_t * dst, u32 sw_if_index); -clib_error_t *ip6_set_neighbor_limit (u32 neighbor_limit); - uword ip6_udp_register_listener (vlib_main_t * vm, u16 dst_port, u32 next_node_index); @@ -359,19 +339,6 @@ serialize_function_t serialize_vnet_ip6_main, unserialize_vnet_ip6_main; void ip6_ethernet_update_adjacency (vnet_main_t * vnm, u32 sw_if_index, u32 ai); -int -vnet_set_ip6_ethernet_neighbor (vlib_main_t * vm, - u32 sw_if_index, - ip6_address_t * a, - u8 * link_layer_address, - uword n_bytes_link_layer_address, - int is_static); -int -vnet_unset_ip6_ethernet_neighbor (vlib_main_t * vm, - u32 sw_if_index, - ip6_address_t * a, - u8 * link_layer_address, - uword n_bytes_link_layer_address); void ip6_link_local_address_from_ethernet_mac_address (ip6_address_t * ip, @@ -384,22 +351,6 @@ ip6_ethernet_mac_address_from_link_local_address (u8 * mac, int vnet_set_ip6_flow_hash (u32 table_id, flow_hash_config_t flow_hash_config); -int -ip6_neighbor_ra_config (vlib_main_t * vm, u32 sw_if_index, - u8 suppress, u8 managed, u8 other, - u8 ll_option, u8 send_unicast, u8 cease, - u8 use_lifetime, u32 lifetime, - u32 initial_count, u32 initial_interval, - u32 max_interval, u32 min_interval, u8 is_no); - -int -ip6_neighbor_ra_prefix (vlib_main_t * vm, u32 sw_if_index, - ip6_address_t * prefix_addr, u8 prefix_len, - u8 use_default, u32 val_lifetime, u32 pref_lifetime, - u8 no_advertise, u8 off_link, u8 no_autoconfig, - u8 no_onlink, u8 is_no); - - clib_error_t *enable_ip6_interface (vlib_main_t * vm, u32 sw_if_index); clib_error_t *disable_ip6_interface (vlib_main_t * vm, u32 sw_if_index); @@ -410,12 +361,6 @@ clib_error_t *set_ip6_link_local_address (vlib_main_t * vm, u32 sw_if_index, ip6_address_t * address); -void vnet_register_ip6_neighbor_resolution_event (vnet_main_t * vnm, - void *address_arg, - uword node_index, - uword type_opaque, - uword data); - int vnet_add_del_ip6_nd_change_event (vnet_main_t * vnm, void *data_callback, u32 pid, diff --git a/src/vnet/ip/ip6_neighbor.c b/src/vnet/ip/ip6_neighbor.c index 43d68cd1..715891b8 100644 --- a/src/vnet/ip/ip6_neighbor.c +++ b/src/vnet/ip/ip6_neighbor.c @@ -197,6 +197,22 @@ typedef struct } ip6_neighbor_main_t; +/* ipv6 neighbor discovery - timer/event types */ +typedef enum +{ + ICMP6_ND_EVENT_INIT, +} ip6_icmp_neighbor_discovery_event_type_t; + +typedef union +{ + u32 add_del_swindex; + struct + { + u32 up_down_swindex; + u32 fib_index; + } up_down_event; +} ip6_icmp_neighbor_discovery_event_data_t; + static ip6_neighbor_main_t ip6_neighbor_main; static ip6_address_t ip6a_zero; /* ip6 address 0 */ @@ -312,7 +328,7 @@ static void ip6_neighbor_set_unset_rpc_callback static void set_unset_ip6_neighbor_rpc (vlib_main_t * vm, u32 sw_if_index, - ip6_address_t * a, u8 * link_layer_addreess, int is_add, int is_static) + ip6_address_t * a, u8 * link_layer_address, int is_add, int is_static) { ip6_neighbor_set_unset_rpc_args_t args; void vl_api_rpc_call_main_thread (void *fp, u8 * data, u32 data_length); @@ -321,7 +337,8 @@ static void set_unset_ip6_neighbor_rpc args.is_add = is_add; args.is_static = is_static; clib_memcpy (&args.addr, a, sizeof (*a)); - clib_memcpy (args.link_layer_address, link_layer_addreess, 6); + if (NULL != link_layer_address) + clib_memcpy (args.link_layer_address, link_layer_address, 6); vl_api_rpc_call_main_thread (ip6_neighbor_set_unset_rpc_callback, (u8 *) & args, sizeof (args)); @@ -1028,14 +1045,35 @@ icmp6_neighbor_solicitation_or_advertisement (vlib_main_t * vm, &h0->target_address, 128); - if (FIB_NODE_INDEX_INVALID == fei || - !(FIB_ENTRY_FLAG_LOCAL & - fib_entry_get_flags_for_source (fei, - FIB_SOURCE_INTERFACE))) + if (FIB_NODE_INDEX_INVALID == fei) { + /* The target address is not in the FIB */ error0 = ICMP6_ERROR_NEIGHBOR_SOLICITATION_SOURCE_UNKNOWN; } + else + { + if (FIB_ENTRY_FLAG_LOCAL & + fib_entry_get_flags_for_source (fei, + FIB_SOURCE_INTERFACE)) + { + /* It's an address that belongs to one of our interfaces + * that's good. */ + } + else + if (fib_entry_is_sourced + (fei, FIB_SOURCE_IP6_ND_PROXY)) + { + /* The address was added by IPv6 Proxy ND config. + * We should only respond to these if the NS arrived on + * the link that has a matching covering prefix */ + } + else + { + error0 = + ICMP6_ERROR_NEIGHBOR_SOLICITATION_SOURCE_UNKNOWN; + } + } } } @@ -4021,6 +4059,92 @@ vnet_ip6_nd_term (vlib_main_t * vm, } +int +ip6_neighbor_proxy_add_del (u32 sw_if_index, ip6_address_t * addr, u8 is_del) +{ + u32 fib_index; + + fib_prefix_t pfx = { + .fp_len = 128, + .fp_proto = FIB_PROTOCOL_IP6, + .fp_addr = { + .ip6 = *addr, + }, + }; + ip46_address_t nh = { + .ip6 = *addr, + }; + + fib_index = ip6_fib_table_get_index_for_sw_if_index (sw_if_index); + + if (~0 == fib_index) + return VNET_API_ERROR_NO_SUCH_FIB; + + if (is_del) + { + fib_table_entry_path_remove (fib_index, + &pfx, + FIB_SOURCE_IP6_ND_PROXY, + FIB_PROTOCOL_IP6, + &nh, + sw_if_index, + ~0, 1, FIB_ROUTE_PATH_FLAG_NONE); + /* flush the ND cache of this address if it's there */ + vnet_unset_ip6_ethernet_neighbor (vlib_get_main (), + sw_if_index, addr, NULL, 0); + } + else + { + fib_table_entry_path_add (fib_index, + &pfx, + FIB_SOURCE_IP6_ND_PROXY, + FIB_ENTRY_FLAG_NONE, + FIB_PROTOCOL_IP6, + &nh, + sw_if_index, + ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE); + } + return (0); +} + +static clib_error_t * +set_ip6_nd_proxy_cmd (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + vnet_main_t *vnm = vnet_get_main (); + clib_error_t *error = 0; + ip6_address_t addr; + u32 sw_if_index; + u8 is_del = 0; + + if (unformat_user (input, unformat_vnet_sw_interface, vnm, &sw_if_index)) + { + /* get the rest of the command */ + while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (input, "%U", unformat_ip6_address, &addr)) + break; + else if (unformat (input, "delete") || unformat (input, "del")) + is_del = 1; + else + return (unformat_parse_error (input)); + } + } + + ip6_neighbor_proxy_add_del (sw_if_index, &addr, is_del); + + return error; +} + +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (set_ip6_nd_proxy_command, static) = +{ + .path = "set ip6 nd proxy", + .short_help = "set ip6 nd proxy <HOST> <INTERFACE>", + .function = set_ip6_nd_proxy_cmd, +}; +/* *INDENT-ON* */ + void ethernet_ndp_change_mac (u32 sw_if_index) { diff --git a/src/vnet/ip/ip6_neighbor.h b/src/vnet/ip/ip6_neighbor.h index b2c9f48a..3d256316 100644 --- a/src/vnet/ip/ip6_neighbor.h +++ b/src/vnet/ip/ip6_neighbor.h @@ -39,7 +39,47 @@ typedef struct fib_node_index_t fib_entry_index; } ip6_neighbor_t; -ip6_neighbor_t *ip6_neighbors_entries (u32 sw_if_index); +extern ip6_neighbor_t *ip6_neighbors_entries (u32 sw_if_index); + +extern int ip6_neighbor_ra_config (vlib_main_t * vm, u32 sw_if_index, + u8 suppress, u8 managed, u8 other, + u8 ll_option, u8 send_unicast, u8 cease, + u8 use_lifetime, u32 lifetime, + u32 initial_count, u32 initial_interval, + u32 max_interval, u32 min_interval, + u8 is_no); + +extern int ip6_neighbor_ra_prefix (vlib_main_t * vm, u32 sw_if_index, + ip6_address_t * prefix_addr, u8 prefix_len, + u8 use_default, u32 val_lifetime, + u32 pref_lifetime, u8 no_advertise, + u8 off_link, u8 no_autoconfig, + u8 no_onlink, u8 is_no); + +extern clib_error_t *ip6_set_neighbor_limit (u32 neighbor_limit); + +extern void vnet_register_ip6_neighbor_resolution_event (vnet_main_t * vnm, + void *address_arg, + uword node_index, + uword type_opaque, + uword data); + +extern int vnet_set_ip6_ethernet_neighbor (vlib_main_t * vm, + u32 sw_if_index, + ip6_address_t * a, + u8 * link_layer_address, + uword n_bytes_link_layer_address, + int is_static); + +extern int vnet_unset_ip6_ethernet_neighbor (vlib_main_t * vm, + u32 sw_if_index, + ip6_address_t * a, + u8 * link_layer_address, + uword + n_bytes_link_layer_address); + +extern int ip6_neighbor_proxy_add_del (u32 sw_if_index, + ip6_address_t * addr, u8 is_add); #endif /* included_ip6_neighbor_h */ diff --git a/src/vnet/ip/ip_api.c b/src/vnet/ip/ip_api.c index ab164a5f..df9ca939 100644 --- a/src/vnet/ip/ip_api.c +++ b/src/vnet/ip/ip_api.c @@ -72,6 +72,9 @@ _(IP_ADD_DEL_ROUTE, ip_add_del_route) \ _(SET_IP_FLOW_HASH,set_ip_flow_hash) \ _(SW_INTERFACE_IP6ND_RA_CONFIG, sw_interface_ip6nd_ra_config) \ _(SW_INTERFACE_IP6ND_RA_PREFIX, sw_interface_ip6nd_ra_prefix) \ +_(IP6ND_PROXY_ADD_DEL, ip6nd_proxy_add_del) \ +_(IP6ND_PROXY_DUMP, ip6nd_proxy_dump) \ +_(IP6ND_PROXY_DETAILS, ip6nd_proxy_details) \ _(SW_INTERFACE_IP6_ENABLE_DISABLE, sw_interface_ip6_enable_disable ) \ _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS, \ sw_interface_ip6_set_link_local_address) @@ -1400,6 +1403,105 @@ static void } static void +send_ip6nd_proxy_details (unix_shared_memory_queue_t * q, + u32 context, + const ip46_address_t * addr, u32 sw_if_index) +{ + vl_api_ip6nd_proxy_details_t *mp; + + mp = vl_msg_api_alloc (sizeof (*mp)); + memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IP6ND_PROXY_DETAILS); + mp->context = context; + mp->sw_if_index = htonl (sw_if_index); + memcpy (mp->address, addr, 16); + + vl_msg_api_send_shmem (q, (u8 *) & mp); +} + +static void +vl_api_ip6nd_proxy_details_t_handler (vl_api_ip_neighbor_details_t * mp) +{ + clib_warning ("BUG"); +} + +typedef struct api_ip6nd_proxy_fib_table_walk_ctx_t_ +{ + u32 *indices; +} api_ip6nd_proxy_fib_table_walk_ctx_t; + +static int +api_ip6nd_proxy_fib_table_walk (fib_node_index_t fei, void *arg) +{ + api_ip6nd_proxy_fib_table_walk_ctx_t *ctx = arg; + + if (fib_entry_is_sourced (fei, FIB_SOURCE_IP6_ND_PROXY)) + { + vec_add1 (ctx->indices, fei); + } + + return (1); +} + +static void +vl_api_ip6nd_proxy_dump_t_handler (vl_api_ip6nd_proxy_dump_t * mp) +{ + ip6_main_t *im6 = &ip6_main; + fib_table_t *fib_table; + api_ip6nd_proxy_fib_table_walk_ctx_t ctx = { + .indices = NULL, + }; + fib_node_index_t *feip; + fib_prefix_t pfx; + unix_shared_memory_queue_t *q; + + q = vl_api_client_index_to_input_queue (mp->client_index); + if (q == 0) + { + return; + } + + /* *INDENT-OFF* */ + pool_foreach (fib_table, im6->fibs, + ({ + fib_table_walk(fib_table->ft_index, + FIB_PROTOCOL_IP6, + api_ip6nd_proxy_fib_table_walk, + &ctx); + })); + /* *INDENT-ON* */ + + vec_sort_with_function (ctx.indices, fib_entry_cmp_for_sort); + + vec_foreach (feip, ctx.indices) + { + fib_entry_get_prefix (*feip, &pfx); + + send_ip6nd_proxy_details (q, + mp->context, + &pfx.fp_addr, + fib_entry_get_resolving_interface (*feip)); + } + + vec_free (ctx.indices); +} + +static void +vl_api_ip6nd_proxy_add_del_t_handler (vl_api_ip6nd_proxy_add_del_t * mp) +{ + vl_api_ip6nd_proxy_add_del_reply_t *rmp; + int rv = 0; + + VALIDATE_SW_IF_INDEX (mp); + + rv = ip6_neighbor_proxy_add_del (ntohl (mp->sw_if_index), + (ip6_address_t *) mp->address, mp->is_del); + + BAD_SW_IF_INDEX_LABEL; + REPLY_MACRO (VL_API_IP6ND_PROXY_ADD_DEL_REPLY); +} + +static void vl_api_sw_interface_ip6_enable_disable_t_handler (vl_api_sw_interface_ip6_enable_disable_t * mp) { diff --git a/src/vnet/ip/lookup.c b/src/vnet/ip/lookup.c index 807b87b6..8607fa5f 100644 --- a/src/vnet/ip/lookup.c +++ b/src/vnet/ip/lookup.c @@ -49,6 +49,7 @@ #include <vnet/dpo/punt_dpo.h> #include <vnet/dpo/receive_dpo.h> #include <vnet/dpo/ip_null_dpo.h> +#include <vnet/ip/ip6_neighbor.h> /** * @file diff --git a/test/test_ip6.py b/test/test_ip6.py index b8278329..070e2d7d 100644 --- a/test/test_ip6.py +++ b/test/test_ip6.py @@ -1,17 +1,20 @@ #!/usr/bin/env python import unittest -import socket +from socket import AF_INET6 from framework import VppTestCase, VppTestRunner from vpp_sub_interface import VppSubInterface, VppDot1QSubint from vpp_pg_interface import is_ipv6_misc +from vpp_neighbor import find_nbr from scapy.packet import Raw from scapy.layers.l2 import Ether, Dot1Q from scapy.layers.inet6 import IPv6, UDP, ICMPv6ND_NS, ICMPv6ND_RS, \ ICMPv6ND_RA, ICMPv6NDOptSrcLLAddr, getmacbyip6, ICMPv6MRD_Solicitation, \ - ICMPv6NDOptMTU, ICMPv6NDOptSrcLLAddr, ICMPv6NDOptPrefixInfo + ICMPv6NDOptMTU, ICMPv6NDOptSrcLLAddr, ICMPv6NDOptPrefixInfo, \ + ICMPv6ND_NA, ICMPv6NDOptDstLLAddr + from util import ppp from scapy.utils6 import in6_getnsma, in6_getnsmac, in6_ptop, in6_islladdr, \ in6_mactoifaceid, in6_ismaddr @@ -24,7 +27,71 @@ def mk_ll_addr(mac): return addr -class TestIPv6(VppTestCase): +class TestIPv6ND(VppTestCase): + def validate_ra(self, intf, rx, dst_ip=None): + if not dst_ip: + dst_ip = intf.remote_ip6 + + # unicasted packets must come to the unicast mac + self.assertEqual(rx[Ether].dst, intf.remote_mac) + + # and from the router's MAC + self.assertEqual(rx[Ether].src, intf.local_mac) + + # the rx'd RA should be addressed to the sender's source + self.assertTrue(rx.haslayer(ICMPv6ND_RA)) + self.assertEqual(in6_ptop(rx[IPv6].dst), + in6_ptop(dst_ip)) + + # and come from the router's link local + self.assertTrue(in6_islladdr(rx[IPv6].src)) + self.assertEqual(in6_ptop(rx[IPv6].src), + in6_ptop(mk_ll_addr(intf.local_mac))) + + def validate_na(self, intf, rx, dst_ip=None, tgt_ip=None): + if not dst_ip: + dst_ip = intf.remote_ip6 + if not tgt_ip: + dst_ip = intf.local_ip6 + + # unicasted packets must come to the unicast mac + self.assertEqual(rx[Ether].dst, intf.remote_mac) + + # and from the router's MAC + self.assertEqual(rx[Ether].src, intf.local_mac) + + # the rx'd NA should be addressed to the sender's source + self.assertTrue(rx.haslayer(ICMPv6ND_NA)) + self.assertEqual(in6_ptop(rx[IPv6].dst), + in6_ptop(dst_ip)) + + # and come from the target address + self.assertEqual(in6_ptop(rx[IPv6].src), in6_ptop(tgt_ip)) + + # Dest link-layer options should have the router's MAC + dll = rx[ICMPv6NDOptDstLLAddr] + self.assertEqual(dll.lladdr, intf.local_mac) + + def send_and_expect_ra(self, intf, pkts, remark, dst_ip=None, + filter_out_fn=is_ipv6_misc): + intf.add_stream(pkts) + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + rx = intf.get_capture(1, filter_out_fn=filter_out_fn) + + self.assertEqual(len(rx), 1) + rx = rx[0] + self.validate_ra(intf, rx, dst_ip) + + def send_and_assert_no_replies(self, intf, pkts, remark): + intf.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + intf.assert_nothing_captured(remark=remark) + + +class TestIPv6(TestIPv6ND): """ IPv6 Test Case """ @classmethod @@ -112,7 +179,7 @@ class TestIPv6(VppTestCase): n_int = len(self.interfaces) percent = 0 counter = 0.0 - dest_addr = socket.inet_pton(socket.AF_INET6, "fd02::1") + dest_addr = inet_pton(AF_INET6, "fd02::1") dest_addr_len = 128 for i in self.interfaces: next_hop_address = i.local_ip6n @@ -225,12 +292,6 @@ class TestIPv6(VppTestCase): pkts = i.parent.get_capture() self.verify_capture(i, pkts) - def send_and_assert_no_replies(self, intf, pkts, remark): - intf.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - intf.assert_nothing_captured(remark=remark) - def test_ns(self): """ IPv6 Neighbour Solicitation Exceptions @@ -243,8 +304,8 @@ class TestIPv6(VppTestCase): # # An NS from a non link source address # - nsma = in6_getnsma(inet_pton(socket.AF_INET6, self.pg0.local_ip6)) - d = inet_ntop(socket.AF_INET6, nsma) + nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6)) + d = inet_ntop(AF_INET6, nsma) p = (Ether(dst=in6_getnsmac(nsma)) / IPv6(dst=d, src="2002::2") / @@ -261,8 +322,8 @@ class TestIPv6(VppTestCase): # not a member of FAILS # if 0: - nsma = in6_getnsma(inet_pton(socket.AF_INET6, "fd::ffff")) - d = inet_ntop(socket.AF_INET6, nsma) + nsma = in6_getnsma(inet_pton(AF_INET6, "fd::ffff")) + d = inet_ntop(AF_INET6, nsma) p = (Ether(dst=in6_getnsmac(nsma)) / IPv6(dst=d, src=self.pg0.remote_ip6) / @@ -277,8 +338,8 @@ class TestIPv6(VppTestCase): # # An NS whose target address is one the router does not own # - nsma = in6_getnsma(inet_pton(socket.AF_INET6, self.pg0.local_ip6)) - d = inet_ntop(socket.AF_INET6, nsma) + nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6)) + d = inet_ntop(AF_INET6, nsma) p = (Ether(dst=in6_getnsmac(nsma)) / IPv6(dst=d, src=self.pg0.remote_ip6) / @@ -418,7 +479,7 @@ class TestIPv6(VppTestCase): # Send the RS multicast # self.pg0.ip6_ra_config(send_unicast=1) - dmac = in6_getnsmac(inet_pton(socket.AF_INET6, "ff02::2")) + dmac = in6_getnsmac(inet_pton(AF_INET6, "ff02::2")) ll = mk_ll_addr(self.pg0.remote_mac) p = (Ether(dst=dmac, src=self.pg0.remote_mac) / IPv6(dst="ff02::2", src=ll) / @@ -629,5 +690,203 @@ class TestIPv6(VppTestCase): # self.pg0.ip6_ra_config(no=1, suppress=1, send_unicast=0) + +class IPv6NDProxyTest(TestIPv6ND): + """ IPv6 ND ProxyTest Case """ + + def setUp(self): + super(IPv6NDProxyTest, self).setUp() + + # create 3 pg interfaces + self.create_pg_interfaces(range(3)) + + # pg0 is the master interface, with the configured subnet + self.pg0.admin_up() + self.pg0.config_ip6() + self.pg0.resolve_ndp() + + self.pg1.ip6_enable() + self.pg2.ip6_enable() + + def tearDown(self): + super(IPv6NDProxyTest, self).tearDown() + + def test_nd_proxy(self): + """ IPv6 Proxy ND """ + + # + # Generate some hosts in the subnet that we are proxying + # + self.pg0.generate_remote_hosts(8) + + nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6)) + d = inet_ntop(AF_INET6, nsma) + + # + # Send an NS for one of those remote hosts on one of the proxy links + # expect no response since it's from an address that is not + # on the link that has the prefix configured + # + ns_pg1 = (Ether(dst=in6_getnsmac(nsma), src=self.pg1.remote_mac) / + IPv6(dst=d, src=self.pg0._remote_hosts[2].ip6) / + ICMPv6ND_NS(tgt=self.pg0.local_ip6) / + ICMPv6NDOptSrcLLAddr(lladdr=self.pg0._remote_hosts[2].mac)) + + self.send_and_assert_no_replies(self.pg1, ns_pg1, "Off link NS") + + # + # Add proxy support for the host + # + self.vapi.ip6_nd_proxy( + inet_pton(AF_INET6, self.pg0._remote_hosts[2].ip6), + self.pg1.sw_if_index) + + # + # try that NS again. this time we expect an NA back + # + self.pg1.add_stream(ns_pg1) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + rx = self.pg1.get_capture(1) + + self.validate_na(self.pg1, rx[0], + dst_ip=self.pg0._remote_hosts[2].ip6, + tgt_ip=self.pg0.local_ip6) + + # + # ... and that we have an entry in the ND cache + # + self.assertTrue(find_nbr(self, + self.pg1.sw_if_index, + self.pg0._remote_hosts[2].ip6, + inet=AF_INET6)) + + # + # ... and we can route traffic to it + # + t = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) / + IPv6(dst=self.pg0._remote_hosts[2].ip6, + src=self.pg0.remote_ip6) / + UDP(sport=10000, dport=20000) / + Raw('\xa5' * 100)) + + self.pg0.add_stream(t) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + rx = self.pg1.get_capture(1) + rx = rx[0] + + self.assertEqual(rx[Ether].dst, self.pg0._remote_hosts[2].mac) + self.assertEqual(rx[Ether].src, self.pg1.local_mac) + + self.assertEqual(rx[IPv6].src, t[IPv6].src) + self.assertEqual(rx[IPv6].dst, t[IPv6].dst) + + # + # Test we proxy for the host on the main interface + # + ns_pg0 = (Ether(dst=in6_getnsmac(nsma), src=self.pg0.remote_mac) / + IPv6(dst=d, src=self.pg0.remote_ip6) / + ICMPv6ND_NS(tgt=self.pg0._remote_hosts[2].ip6) / + ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac)) + + self.pg0.add_stream(ns_pg0) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + rx = self.pg0.get_capture(1) + + self.validate_na(self.pg0, rx[0], + tgt_ip=self.pg0._remote_hosts[2].ip6, + dst_ip=self.pg0.remote_ip6) + + # + # Setup and resolve proxy for another host on another interface + # + ns_pg2 = (Ether(dst=in6_getnsmac(nsma), src=self.pg2.remote_mac) / + IPv6(dst=d, src=self.pg0._remote_hosts[3].ip6) / + ICMPv6ND_NS(tgt=self.pg0.local_ip6) / + ICMPv6NDOptSrcLLAddr(lladdr=self.pg0._remote_hosts[2].mac)) + + self.vapi.ip6_nd_proxy( + inet_pton(AF_INET6, self.pg0._remote_hosts[3].ip6), + self.pg2.sw_if_index) + + self.pg2.add_stream(ns_pg2) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + rx = self.pg2.get_capture(1) + + self.validate_na(self.pg2, rx[0], + dst_ip=self.pg0._remote_hosts[3].ip6, + tgt_ip=self.pg0.local_ip6) + + self.assertTrue(find_nbr(self, + self.pg2.sw_if_index, + self.pg0._remote_hosts[3].ip6, + inet=AF_INET6)) + + # + # hosts can communicate. pg2->pg1 + # + t2 = (Ether(dst=self.pg2.local_mac, + src=self.pg0.remote_hosts[3].mac) / + IPv6(dst=self.pg0._remote_hosts[2].ip6, + src=self.pg0._remote_hosts[3].ip6) / + UDP(sport=10000, dport=20000) / + Raw('\xa5' * 100)) + + self.pg2.add_stream(t2) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + rx = self.pg1.get_capture(1) + rx = rx[0] + + self.assertEqual(rx[Ether].dst, self.pg0._remote_hosts[2].mac) + self.assertEqual(rx[Ether].src, self.pg1.local_mac) + + self.assertEqual(rx[IPv6].src, t2[IPv6].src) + self.assertEqual(rx[IPv6].dst, t2[IPv6].dst) + + # + # remove the proxy configs + # + self.vapi.ip6_nd_proxy( + inet_pton(AF_INET6, self.pg0._remote_hosts[2].ip6), + self.pg1.sw_if_index, + is_del=1) + self.vapi.ip6_nd_proxy( + inet_pton(AF_INET6, self.pg0._remote_hosts[3].ip6), + self.pg2.sw_if_index, + is_del=1) + + self.assertFalse(find_nbr(self, + self.pg2.sw_if_index, + self.pg0._remote_hosts[3].ip6, + inet=AF_INET6)) + self.assertFalse(find_nbr(self, + self.pg1.sw_if_index, + self.pg0._remote_hosts[2].ip6, + inet=AF_INET6)) + + # + # no longer proxy-ing... + # + self.send_and_assert_no_replies(self.pg0, ns_pg0, "Proxy unconfigured") + self.send_and_assert_no_replies(self.pg1, ns_pg1, "Proxy unconfigured") + self.send_and_assert_no_replies(self.pg2, ns_pg2, "Proxy unconfigured") + + # + # no longer forwarding. traffic generates NS out of the glean/main + # interface + # + self.pg2.add_stream(t2) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + + rx = self.pg0.get_capture(1) + + self.assertTrue(rx[0].haslayer(ICMPv6ND_NS)) + + if __name__ == '__main__': unittest.main(testRunner=VppTestRunner) diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py index b9c4d0c1..f04537bf 100644 --- a/test/vpp_papi_provider.py +++ b/test/vpp_papi_provider.py @@ -276,6 +276,12 @@ class VppPapiProvider(object): {'sw_if_index': sw_if_index, 'suppress': suppress}) + def ip6_nd_proxy(self, address, sw_if_index, is_del=0): + return self.api(self.papi.ip6nd_proxy_add_del, + {'address': address, + 'sw_if_index': sw_if_index, + 'is_del': is_del}) + def ip6_sw_interface_ra_config(self, sw_if_index, no, suppress, |