GBP plugin

Group Base Policy (GBP) defines:
 - endpoints: typically a VM or container that is connected to the
              virtual switch/router (i.e. to VPP)
 - endpoint-group: (EPG) a collection of endpoints
 - policy: rules determining which traffic can pass between EPGs a.k.a
            a 'contract'

Here, policy is implemented via an ACL.
EPG classification for transit packets is determined by:
 - source EPG: from the packet's input interface
 - destination EPG: from the packet's destination IP address.

Change-Id: I7b983844826b5fc3d49e21353ebda9df9b224e25
Signed-off-by: Neale Ranns <neale.ranns@cisco.com>

23 files changed, 3102 insertions, 3 deletions

diff --git a/src/configure.ac b/src/configure.ac
index 2b0d22607ce..4bdfa8c6bde 100644
--- a/src/configure.ac
+++ b/src/configure.ac
@@ -227,6 +227,7 @@ PLUGIN_ENABLED(srv6as)
 PLUGIN_ENABLED(nat)
 PLUGIN_ENABLED(stn)
 PLUGIN_ENABLED(l2e)
+PLUGIN_ENABLED(gbp)
 
 ###############################################################################
 # Dependency checks
diff --git a/src/plugins/Makefile.am b/src/plugins/Makefile.am
index c2621e4aa78..64faeda9963 100644
--- a/src/plugins/Makefile.am
+++ b/src/plugins/Makefile.am
@@ -107,6 +107,10 @@ if ENABLE_L2E_PLUGIN
 include l2e.am
 endif
 
+if ENABLE_GBP_PLUGIN
+include gbp.am
+endif
+
 include ../suffix-rules.mk
 
 # Remove *.la files
diff --git a/src/plugins/gbp.am b/src/plugins/gbp.am
new file mode 100644
index 00000000000..644d08ccb49
--- /dev/null
+++ b/src/plugins/gbp.am
@@ -0,0 +1,28 @@
+# Copyright (c) 2016 Cisco Systems, Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+vppplugins_LTLIBRARIES += gbp_plugin.la
+
+gbp_plugin_la_SOURCES = 	\
+	gbp/gbp.c		\
+	gbp/gbp_api.c
+
+API_FILES += gbp/gbp.api
+
+noinst_HEADERS += 		\
+	gbp/gbp.h		\
+	gbp/gbp_all_api_h.h	\
+	gbp/gbp_msg_enum.h	\
+	gbp/gbp.api.h
+
+# vi:syntax=automake
diff --git a/src/plugins/gbp/gbp.api b/src/plugins/gbp/gbp.api
new file mode 100644
index 00000000000..491ad363c75
--- /dev/null
+++ b/src/plugins/gbp/gbp.api
@@ -0,0 +1,83 @@
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+option version = "1.0.0";
+
+/** \brief Endpoint
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+*/
+
+typeonly define gbp_endpoint
+{
+  u32 sw_if_index;
+  u32 epg_id;
+  u8  is_ip6;
+  u8  address[16];
+};
+
+autoreply define gbp_endpoint_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8  is_add;
+  vl_api_gbp_endpoint_t endpoint;
+};
+
+define gbp_endpoint_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
+define gbp_endpoint_details
+{
+  u32 context;
+  vl_api_gbp_endpoint_t endpoint;
+};
+
+typeonly define gbp_contract
+{
+  u32 src_epg;
+  u32 dst_epg;
+  u32 acl_index;
+};
+
+autoreply define gbp_contract_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8  is_add;
+  vl_api_gbp_contract_t contract;
+};
+
+define gbp_contract_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
+define gbp_contract_details
+{
+  u32 context;
+  vl_api_gbp_contract_t contract;
+};
+
+/*
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp.c b/src/plugins/gbp/gbp.c
new file mode 100644
index 00000000000..5a21d4fdc79
--- /dev/null
+++ b/src/plugins/gbp/gbp.c
@@ -0,0 +1,777 @@
+/*
+ * gbp.h : Group Based Policy
+ *
+ * Copyright (c) 2013 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+
+/**
+ * IP4 destintion address to destination EPG mapping table
+ */
+typedef struct gbp_ip4_to_epg_db_t_
+{
+  /**
+   * use a simple hash table
+   */
+  uword *g4ie_hash;
+} gbp_ip4_to_epg_db_t;
+
+static gbp_ip4_to_epg_db_t gbp_ip4_to_epg_db;
+
+/**
+ * IP6 destintion address to destination EPG mapping table
+ */
+typedef struct gbp_ip6_to_epg_db_t_
+{
+  /**
+   * use a memroy hash table
+   */
+  uword *g6ie_hash;
+} gbp_ip6_to_epg_db_t;
+
+static gbp_ip6_to_epg_db_t gbp_ip6_to_epg_db;
+
+/**
+ * Result of a interface to EPG mapping.
+ * multiple Endpoints can occur on the same interface, so this
+ * mapping needs to be reference counted.
+ */
+typedef struct gbp_itf_t_
+{
+  epg_id_t gi_epg;
+  u32 gi_ref_count;
+} gbp_itf_t;
+
+const static gbp_itf_t ITF_INVALID = {
+  .gi_epg = EPG_INVALID,
+  .gi_ref_count = 0,
+};
+
+/**
+ * Interface to source EPG DB - a per-interface vector
+ */
+typedef struct gbp_itf_to_epg_db_t_
+{
+  gbp_itf_t *gte_vec;
+} gbp_itf_to_epg_db_t;
+
+static gbp_itf_to_epg_db_t gbp_itf_to_epg_db;
+
+/**
+ * Pool of GBP endpoints
+ */
+static gbp_endpoint_t *gbp_endpoint_pool;
+
+/**
+ * DB of endpoints
+ */
+static uword *gbp_endpoint_db;
+
+/**
+ * EPG src,dst pair to ACL mapping table, aka contract DB
+ */
+typedef struct gbp_contract_db_t_
+{
+  /**
+   * We can form a u64 key from the pair, so use a simple hash table
+   */
+  uword *gc_hash;
+} gbp_contract_db_t;
+
+/**
+ * Since contract DB instance
+ */
+static gbp_contract_db_t gbp_contract_db;
+
+static void
+gbp_ip_epg_update (const ip46_address_t * ip, epg_id_t epg_id)
+{
+  /*
+   * we are dealing only with addresses here so this limited
+   * is_ip4 check is ok
+   */
+  if (ip46_address_is_ip4 (ip))
+    {
+      hash_set (gbp_ip4_to_epg_db.g4ie_hash, ip->ip4.as_u32, epg_id);
+    }
+  else
+    {
+      hash_set_mem (gbp_ip6_to_epg_db.g6ie_hash, &ip->ip6, epg_id);
+    }
+}
+
+static void
+gbp_ip_epg_delete (const ip46_address_t * ip)
+{
+  if (ip46_address_is_ip4 (ip))
+    {
+      hash_unset (gbp_ip4_to_epg_db.g4ie_hash, ip->ip4.as_u32);
+    }
+  else
+    {
+      hash_unset_mem (gbp_ip6_to_epg_db.g6ie_hash, &ip->ip6);
+    }
+}
+
+static void
+gbp_itf_epg_update (u32 sw_if_index, epg_id_t src_epg)
+{
+  vec_validate_init_empty (gbp_itf_to_epg_db.gte_vec,
+			   sw_if_index, ITF_INVALID);
+
+  if (0 == gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count)
+    {
+      vnet_feature_enable_disable ("ip4-unicast", "gbp4",
+				   sw_if_index, 1, NULL, 0);
+      vnet_feature_enable_disable ("ip6-unicast", "gbp6",
+				   sw_if_index, 1, NULL, 0);
+    }
+  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg = src_epg;
+  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count++;
+}
+
+static void
+gbp_itf_epg_delete (u32 sw_if_index)
+{
+  if (vec_len (gbp_itf_to_epg_db.gte_vec) <= sw_if_index)
+    return;
+
+  if (1 == gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count)
+    {
+      gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg = EPG_INVALID;
+
+      vnet_feature_enable_disable ("ip4-unicast", "gbp4",
+				   sw_if_index, 0, NULL, 0);
+      vnet_feature_enable_disable ("ip6-unicast", "gbp6",
+				   sw_if_index, 0, NULL, 0);
+    }
+  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count--;
+}
+
+void
+gbp_endpoint_update (u32 sw_if_index,
+		     const ip46_address_t * ip, epg_id_t epg_id)
+{
+  gbp_endpoint_key_t key = {
+    .gek_ip = *ip,
+    .gek_sw_if_index = sw_if_index,
+  };
+  gbp_endpoint_t *gbpe;
+  uword *p;
+
+  p = hash_get_mem (gbp_endpoint_db, &key);
+
+  if (p)
+    {
+      gbpe = pool_elt_at_index (gbp_endpoint_pool, p[0]);
+    }
+  else
+    {
+      pool_get (gbp_endpoint_pool, gbpe);
+
+      gbpe->ge_key = clib_mem_alloc (sizeof (gbp_endpoint_key_t));
+      clib_memcpy (gbpe->ge_key, &key, sizeof (gbp_endpoint_key_t));
+
+      hash_set_mem (gbp_endpoint_db, gbpe->ge_key, gbpe - gbp_endpoint_pool);
+    }
+
+  gbpe->ge_epg_id = epg_id;
+
+  gbp_itf_epg_update (gbpe->ge_key->gek_sw_if_index, gbpe->ge_epg_id);
+  gbp_ip_epg_update (&gbpe->ge_key->gek_ip, gbpe->ge_epg_id);
+}
+
+void
+gbp_endpoint_delete (u32 sw_if_index, const ip46_address_t * ip)
+{
+  gbp_endpoint_key_t key = {
+    .gek_ip = *ip,
+    .gek_sw_if_index = sw_if_index,
+  };
+  gbp_endpoint_t *gbpe;
+  uword *p;
+
+  p = hash_get_mem (gbp_endpoint_db, &key);
+
+  if (p)
+    {
+      gbpe = pool_elt_at_index (gbp_endpoint_pool, p[0]);
+
+      hash_unset_mem (gbp_endpoint_db, gbpe->ge_key);
+
+      gbp_itf_epg_delete (gbpe->ge_key->gek_sw_if_index);
+      gbp_ip_epg_delete (&gbpe->ge_key->gek_ip);
+
+      clib_mem_free (gbpe->ge_key);
+
+      pool_put (gbp_endpoint_pool, gbpe);
+    }
+}
+
+void
+gbp_endpoint_walk (gbp_endpoint_cb_t cb, void *ctx)
+{
+  gbp_endpoint_t *gbpe;
+
+  /* *INDENT-OFF* */
+  pool_foreach(gbpe, gbp_endpoint_pool,
+  {
+    if (!cb(gbpe, ctx))
+      break;
+  });
+  /* *INDENT-ON* */
+}
+
+void
+gbp_contract_update (epg_id_t src_epg, epg_id_t dst_epg, u32 acl_index)
+{
+  gbp_contract_key_t key = {
+    .gck_src = src_epg,
+    .gck_dst = dst_epg,
+  };
+
+  hash_set (gbp_contract_db.gc_hash, key.as_u64, acl_index);
+}
+
+void
+gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg)
+{
+  gbp_contract_key_t key = {
+    .gck_src = src_epg,
+    .gck_dst = dst_epg,
+  };
+
+  hash_unset (gbp_contract_db.gc_hash, key.as_u64);
+}
+
+void
+gbp_contract_walk (gbp_contract_cb_t cb, void *ctx)
+{
+  gbp_contract_key_t key;
+  u32 acl_index;
+
+  /* *INDENT-OFF* */
+  hash_foreach(key.as_u64, acl_index, gbp_contract_db.gc_hash,
+  ({
+    gbp_contract_t gbpc = {
+      .gc_key = key,
+      .gc_acl_index = acl_index,
+    };
+
+    if (!cb(&gbpc, ctx))
+      break;
+  }));
+  /* *INDENT-ON* */
+}
+
+static clib_error_t *
+gbp_endpoint_cli (vlib_main_t * vm,
+		  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  epg_id_t epg_id = EPG_INVALID;
+  ip46_address_t ip = { };
+  u32 sw_if_index = ~0;
+  u8 add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%U", unformat_vnet_sw_interface,
+		    vnm, &sw_if_index))
+	;
+      else if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "epg %d", &epg_id))
+	;
+      else if (unformat (input, "ip %U", unformat_ip4_address, &ip.ip4))
+	;
+      else if (unformat (input, "ip %U", unformat_ip6_address, &ip.ip6))
+	;
+      else
+	break;
+    }
+
+  if (~0 == sw_if_index)
+    return clib_error_return (0, "interface must be specified");
+  if (EPG_INVALID == epg_id)
+    return clib_error_return (0, "EPG-ID must be specified");
+  if (ip46_address_is_zero (&ip))
+    return clib_error_return (0, "IP address must be specified");
+
+  if (add)
+    gbp_endpoint_update (sw_if_index, &ip, epg_id);
+  else
+    gbp_endpoint_delete (sw_if_index, &ip);
+
+  return (NULL);
+}
+
+static clib_error_t *
+gbp_contract_cli (vlib_main_t * vm,
+		  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  epg_id_t src_epg_id = EPG_INVALID, dst_epg_id = EPG_INVALID;
+  u32 acl_index = ~0;
+  u8 add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "src-epg %d", &src_epg_id))
+	;
+      else if (unformat (input, "dst-epg %d", &dst_epg_id))
+	;
+      else if (unformat (input, "acl-index %d", &acl_index))
+	;
+      else
+	break;
+    }
+
+  if (EPG_INVALID == src_epg_id)
+    return clib_error_return (0, "Source EPG-ID must be specified");
+  if (EPG_INVALID == dst_epg_id)
+    return clib_error_return (0, "Destination EPG-ID must be specified");
+
+  if (add)
+    {
+      gbp_contract_update (src_epg_id, dst_epg_id, acl_index);
+    }
+  else
+    {
+      gbp_contract_delete (src_epg_id, dst_epg_id);
+    }
+
+  return (NULL);
+}
+
+/*?
+ * Configure a GBP Endpoint
+ *
+ * @cliexpar
+ * @cliexstart{set gbp endpoint [del] <interface> epg <ID> ip <IP>}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_endpoint_cli_node, static) = {
+  .path = "gbp endpoint",
+  .short_help = "gbp endpoint [del] <interface> epg <ID> ip <IP>",
+  .function = gbp_endpoint_cli,
+};
+
+/*?
+ * Configure a GBP Contract
+ *
+ * @cliexpar
+ * @cliexstart{set gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>}
+ * @cliexend
+ ?*/
+VLIB_CLI_COMMAND (gbp_contract_cli_node, static) = {
+  .path = "gbp contract",
+  .short_help = "gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>",
+  .function = gbp_contract_cli,
+};
+/* *INDENT-ON* */
+
+static int
+gbp_endpoint_show_one (gbp_endpoint_t * gbpe, void *ctx)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  vlib_main_t *vm;
+
+  vm = ctx;
+  vlib_cli_output (vm, "  {%U, %U} -> %d",
+		   format_vnet_sw_if_index_name, vnm,
+		   gbpe->ge_key->gek_sw_if_index,
+		   format_ip46_address, &gbpe->ge_key->gek_ip, IP46_TYPE_ANY,
+		   gbpe->ge_epg_id);
+
+  return (1);
+}
+
+static clib_error_t *
+gbp_endpoint_show (vlib_main_t * vm,
+		   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  ip46_address_t ip, *ipp;
+  epg_id_t epg_id;
+  u32 sw_if_index;
+
+  vlib_cli_output (vm, "Endpoints:");
+  gbp_endpoint_walk (gbp_endpoint_show_one, vm);
+
+  vlib_cli_output (vm, "\nSource interface to EPG:");
+
+  vec_foreach_index (sw_if_index, gbp_itf_to_epg_db.gte_vec)
+  {
+    if (EPG_INVALID != gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg)
+      {
+	vlib_cli_output (vm, "  %U -> %d",
+			 format_vnet_sw_if_index_name, vnm, sw_if_index,
+			 gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg);
+      }
+  }
+
+  vlib_cli_output (vm, "\nDestination IP4 to EPG:");
+
+  /* *INDENT-OFF* */
+  hash_foreach (ip.ip4.as_u32, epg_id, gbp_ip4_to_epg_db.g4ie_hash,
+  {
+    vlib_cli_output (vm, "  %U -> %d", format_ip46_address, &ip,
+                     IP46_TYPE_IP4, epg_id);
+  });
+  /* *INDENT-ON* */
+
+  vlib_cli_output (vm, "\nDestination IP6 to EPG:");
+
+  /* *INDENT-OFF* */
+  hash_foreach_mem (ipp, epg_id, gbp_ip6_to_epg_db.g6ie_hash,
+  {
+    vlib_cli_output (vm, "  %U -> %d", format_ip46_address, ipp,
+                     IP46_TYPE_IP6, epg_id);
+  });
+  /* *INDENT-ON* */
+
+  return (NULL);
+}
+
+static clib_error_t *
+gbp_contract_show (vlib_main_t * vm,
+		   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  gbp_contract_key_t key;
+  epg_id_t epg_id;
+
+  vlib_cli_output (vm, "Contracts:");
+
+  /* *INDENT-OFF* */
+  hash_foreach (key.as_u64, epg_id, gbp_contract_db.gc_hash,
+  {
+    vlib_cli_output (vm, "  {%d,%d} -> %d", key.gck_src,
+                     key.gck_dst, epg_id);
+  });
+  /* *INDENT-ON* */
+
+  return (NULL);
+}
+
+/*?
+ * Show Group Based Policy Endpoints and derived information
+ *
+ * @cliexpar
+ * @cliexstart{show gbp endpoint}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_endpoint_show_node, static) = {
+  .path = "show gbp endpoint",
+  .short_help = "show gbp endpoint\n",
+  .function = gbp_endpoint_show,
+};
+/* *INDENT-ON* */
+
+/*?
+ * Show Group Based Policy Contracts
+ *
+ * @cliexpar
+ * @cliexstart{show gbp contract}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_contract_show_node, static) = {
+  .path = "show gbp contract",
+  .short_help = "show gbp contract\n",
+  .function = gbp_contract_show,
+};
+/* *INDENT-ON* */
+
+#define foreach_gbp                    \
+  _(DENY,    "deny")
+
+typedef enum
+{
+#define _(sym,str) GBP_ERROR_##sym,
+  foreach_gbp
+#undef _
+    GBP_N_ERROR,
+} gbp_error_t;
+
+static char *gbp_error_strings[] = {
+#define _(sym,string) string,
+  foreach_gbp
+#undef _
+};
+
+typedef enum
+{
+#define _(sym,str) GBP_NEXT_##sym,
+  foreach_gbp
+#undef _
+    GBP_N_NEXT,
+} gbp_next_t;
+
+/**
+ * per-packet trace data
+ */
+typedef struct gbp_trace_t_
+{
+  /* per-pkt trace data */
+  epg_id_t src_epg;
+  epg_id_t dst_epg;
+  u32 acl_index;
+} gbp_trace_t;
+
+static inline uword
+gbp_inline (vlib_main_t * vm,
+	    vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6)
+{
+  u32 n_left_from, *from, *to_next;
+  gbp_next_t next_index;
+
+  next_index = 0;
+  n_left_from = frame->n_vectors;
+  from = vlib_frame_vector_args (frame);
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  vlib_buffer_t *b0;
+	  u32 sw_if_index0;
+	  gbp_next_t next0;
+	  u32 bi0;
+	  ip4_header_t *ip4_0;
+	  ip6_header_t *ip6_0;
+	  gbp_contract_key_t key0;
+	  u32 acl_index0;
+	  uword *p;
+
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  /* deny by default */
+	  next0 = GBP_NEXT_DENY;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  if (is_ip6)
+	    ip6_0 = vlib_buffer_get_current (b0);
+	  else
+	    ip4_0 = vlib_buffer_get_current (b0);
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  /*
+	   * determine the src and dst EPG
+	   */
+	  key0.gck_src = gbp_itf_to_epg_db.gte_vec[sw_if_index0].gi_epg;
+
+	  if (is_ip6)
+	    p = hash_get_mem (gbp_ip6_to_epg_db.g6ie_hash,
+			      &ip6_0->dst_address);
+	  else
+	    p = hash_get (gbp_ip4_to_epg_db.g4ie_hash,
+			  ip4_0->dst_address.as_u32);
+
+	  if (NULL != p)
+	    {
+	      key0.gck_dst = p[0];
+
+	      /*
+	       * If the src and dst are the same, then let it through
+	       */
+	      if (key0.gck_dst == key0.gck_src)
+		{
+		  vnet_feature_next (sw_if_index0, &next0, b0);
+		  acl_index0 = ~0;
+		}
+	      else
+		{
+		  /*
+		   * find this src,dst pair in the egp->acl DB
+		   */
+		  p = hash_get (gbp_contract_db.gc_hash, key0.as_u64);
+
+		  if (NULL != p)
+		    {
+		      acl_index0 = p[0];
+
+		      /*
+		       * the ACL index stored is NULL, this means any-any so let it pass
+		       */
+		      if (~0 == acl_index0)
+			{
+			  vnet_feature_next (sw_if_index0, &next0, b0);
+			}
+		      else
+			{
+			  /*
+			   * TODO tests against the ACL
+			   */
+			}
+		    }
+		  else
+		    {
+		      /*
+		       * no ACL to apply for packets between these two EPGs.
+		       * GBP is a whitelist model, so no ACL implies deny, which
+		       * is the default result
+		       */
+		      acl_index0 = ~0;
+		    }
+		}
+	    }
+	  else
+	    {
+	      /*
+	       * cannot determine the destinaiotn EPG, so we cannot enforce policy
+	       * on this node. permit.
+	       */
+	      vnet_feature_next (sw_if_index0, &next0, b0);
+
+	      key0.gck_dst = ~0;
+	      acl_index0 = ~0;
+	    }
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) &&
+			     (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      gbp_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->src_epg = key0.gck_src;
+	      t->dst_epg = key0.gck_dst;
+	      t->acl_index = acl_index0;
+	    }
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+/* packet trace format function */
+static u8 *
+format_gbp_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_trace_t *t = va_arg (*args, gbp_trace_t *);
+
+  s = format (s, "gbp: src:%d dst:%d acl:%d",
+	      t->src_epg, t->dst_epg, t->acl_index);
+
+  return s;
+}
+
+static inline uword
+gbp_4 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_inline (vm, node, frame, 0));
+}
+
+static inline uword
+gbp_6 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_inline (vm, node, frame, 1));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (gbp_4_node) = {
+  .function = gbp_4,
+  .name = "gbp4",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(gbp_error_strings),
+  .error_strings = gbp_error_strings,
+
+  .n_next_nodes = GBP_N_NEXT,
+
+  .next_nodes = {
+    [GBP_NEXT_DENY] = "ip4-drop",
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_4_node, gbp_4);
+
+VNET_FEATURE_INIT (gbp_4_node, static) = {
+    .arc_name = "ip4-unicast",
+    .node_name = "gbp4",
+    .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
+};
+
+VLIB_REGISTER_NODE (gbp_6_node) = {
+  .function = gbp_6,
+  .name = "gbp6",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(gbp_error_strings),
+  .error_strings = gbp_error_strings,
+
+  .n_next_nodes = GBP_N_NEXT,
+
+  .next_nodes = {
+    [GBP_NEXT_DENY] = "ip6-drop",
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_6_node, gbp_6);
+
+VNET_FEATURE_INIT (gbp_6_node, static) = {
+    .arc_name = "ip6-unicast",
+    .node_name = "gbp6",
+    .runs_after = VNET_FEATURES ("acl-plugin-out-ip6-fa"),
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+gbp_init (vlib_main_t * vm)
+{
+  gbp_endpoint_db = hash_create_mem (0,
+				     sizeof (gbp_endpoint_key_t),
+				     sizeof (u32));
+  gbp_ip6_to_epg_db.g6ie_hash =
+    hash_create_mem (0, sizeof (ip6_address_t), sizeof (u32));
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (gbp_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp.h b/src/plugins/gbp/gbp.h
new file mode 100644
index 00000000000..334a7438f53
--- /dev/null
+++ b/src/plugins/gbp/gbp.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (c) 2013 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Group Base Policy (GBP) defines:
+ *  - endpoints: typically a VM or container that is connected to the
+ *               virtual switch/router (i.e. to VPP)
+ *  - endpoint-group: (EPG) a collection of endpoints
+ *  - policy: rules determining which traffic can pass between EPGs a.k.a
+ *            a 'contract'
+ *
+ * Here, policy is implemented via an ACL.
+ * EPG classification for transit packets is determined by:
+ *  - source EPG: from the packet's input interface
+ *  - destination EPG: from the packet's destination IP address.
+ *
+ */
+
+#ifndef included_vnet_gbp_h
+#define included_vnet_gbp_h
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+
+typedef u32 epg_id_t;
+#define EPG_INVALID (~0)
+
+/**
+ * The key for an Endpoint
+ */
+typedef struct gbp_endpoint_key_t_
+{
+  /**
+   * The interface on which the EP is connected
+   */
+  u32 gek_sw_if_index;
+
+  /**
+   * The IP[46] address of the endpoint
+   */
+  ip46_address_t gek_ip;
+} gbp_endpoint_key_t;
+
+/**
+ * A Group Based Policy Endpoint.
+ * This is typcially a VM on the local compute node for which policy must be
+ * locally applied
+ */
+typedef struct gbp_endpoint_t_
+{
+  /**
+   * The endpoint's interface and IP address
+   */
+  gbp_endpoint_key_t *ge_key;
+
+  /**
+   * The endpoint's designated EPG
+   */
+  epg_id_t ge_epg_id;
+} gbp_endpoint_t;
+
+extern void gbp_endpoint_update (u32 sw_if_index,
+				 const ip46_address_t * ip, epg_id_t epg_id);
+extern void gbp_endpoint_delete (u32 sw_if_index, const ip46_address_t * ip);
+
+typedef int (*gbp_endpoint_cb_t) (gbp_endpoint_t * gbpe, void *ctx);
+extern void gbp_endpoint_walk (gbp_endpoint_cb_t bgpe, void *ctx);
+
+
+/**
+ * The key for an Contract
+ */
+typedef struct gbp_contract_key_t_
+{
+  union
+  {
+    struct
+    {
+      /**
+       * source and destination EPGs for which the ACL applies
+       */
+      epg_id_t gck_src;
+      epg_id_t gck_dst;
+    };
+    u64 as_u64;
+  };
+} gbp_contract_key_t;
+
+/**
+ * A Group Based Policy Contract.
+ *  Determines the ACL that applies to traffic pass between two endpoint groups
+ */
+typedef struct gbp_contract_t_
+{
+  /**
+   * source and destination EPGs
+   */
+  gbp_contract_key_t gc_key;
+
+  /**
+   * The ACL to apply for packets from the source to the destination EPG
+   */
+  u32 gc_acl_index;;
+} gbp_contract_t;
+
+
+extern void gbp_contract_update (epg_id_t src_epg,
+				 epg_id_t dst_epg, u32 acl_index);
+extern void gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg);
+
+typedef int (*gbp_contract_cb_t) (gbp_contract_t * gbpe, void *ctx);
+extern void gbp_contract_walk (gbp_contract_cb_t bgpe, void *ctx);
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_all_api_h.h b/src/plugins/gbp/gbp_all_api_h.h
new file mode 100644
index 00000000000..a65d9fcd164
--- /dev/null
+++ b/src/plugins/gbp/gbp_all_api_h.h
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/* Include the generated file, see BUILT_SOURCES in Makefile.am */
+#include <gbp/gbp.api.h>
+
diff --git a/src/plugins/gbp/gbp_api.c b/src/plugins/gbp/gbp_api.c
new file mode 100644
index 00000000000..998d5d9bdbb
--- /dev/null
+++ b/src/plugins/gbp/gbp_api.c
@@ -0,0 +1,294 @@
+/*
+ *------------------------------------------------------------------
+ * gbp_api.c - layer 2 emulation api
+ *
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *------------------------------------------------------------------
+ */
+
+#include <vnet/vnet.h>
+#include <vnet/plugin/plugin.h>
+
+#include <vnet/interface.h>
+#include <vnet/api_errno.h>
+#include <vpp/app/version.h>
+
+#include <gbp/gbp.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+
+/* define message IDs */
+#include <gbp/gbp_msg_enum.h>
+
+#define vl_typedefs		/* define message structures */
+#include <gbp/gbp_all_api_h.h>
+#undef vl_typedefs
+
+#define vl_endianfun		/* define message structures */
+#include <gbp/gbp_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
+#define vl_printfun
+#include <gbp/gbp_all_api_h.h>
+#undef vl_printfun
+
+/* Get the API version number */
+#define vl_api_version(n,v) static u32 api_version=(v);
+#include <acl/acl_all_api_h.h>
+#undef vl_api_version
+
+#include <vlibapi/api_helper_macros.h>
+
+#define foreach_gbp_api_msg                                 \
+  _(GBP_ENDPOINT_ADD_DEL, gbp_endpoint_add_del)             \
+  _(GBP_ENDPOINT_DUMP, gbp_endpoint_dump)                   \
+  _(GBP_CONTRACT_ADD_DEL, gbp_contract_add_del)             \
+  _(GBP_CONTRACT_DUMP, gbp_contract_dump)
+
+/**
+ * L2 Emulation Main
+ */
+typedef struct gbp_main_t_
+{
+  u16 msg_id_base;
+} gbp_main_t;
+
+static gbp_main_t gbp_main;
+
+#define GBP_MSG_BASE gbp_main.msg_id_base
+
+static void
+vl_api_gbp_endpoint_add_del_t_handler (vl_api_gbp_endpoint_add_del_t * mp)
+{
+  vl_api_gbp_endpoint_add_del_reply_t *rmp;
+  ip46_address_t ip = { };
+  u32 sw_if_index;
+  int rv = 0;
+
+  sw_if_index = ntohl (mp->endpoint.sw_if_index);
+  if (!vnet_sw_if_index_is_api_valid (sw_if_index))
+    goto bad_sw_if_index;
+
+  if (mp->endpoint.is_ip6)
+    {
+      clib_memcpy (&ip.ip6, mp->endpoint.address, sizeof (ip.ip6));
+    }
+  else
+    {
+      clib_memcpy (&ip.ip4, mp->endpoint.address, sizeof (ip.ip4));
+    }
+
+  if (mp->is_add)
+    {
+      gbp_endpoint_update (sw_if_index, &ip, ntohl (mp->endpoint.epg_id));
+    }
+  else
+    {
+      gbp_endpoint_delete (sw_if_index, &ip);
+    }
+
+  BAD_SW_IF_INDEX_LABEL;
+
+  REPLY_MACRO (VL_API_GBP_ENDPOINT_ADD_DEL_REPLY + GBP_MSG_BASE);
+}
+
+typedef struct gbp_walk_ctx_t_
+{
+  vl_api_registration_t *reg;
+  u32 context;
+} gbp_walk_ctx_t;
+
+static int
+gbp_endpoint_send_details (gbp_endpoint_t * gbpe, void *args)
+{
+  vl_api_gbp_endpoint_details_t *mp;
+  gbp_walk_ctx_t *ctx;
+
+  ctx = args;
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  if (!mp)
+    return 1;
+
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_GBP_ENDPOINT_DETAILS + GBP_MSG_BASE);
+  mp->context = ctx->context;
+
+  mp->endpoint.sw_if_index = ntohl (gbpe->ge_key->gek_sw_if_index);
+  mp->endpoint.is_ip6 = !ip46_address_is_ip4 (&gbpe->ge_key->gek_ip);
+  if (mp->endpoint.is_ip6)
+    clib_memcpy (&mp->endpoint.address,
+		 &gbpe->ge_key->gek_ip.ip6,
+		 sizeof (gbpe->ge_key->gek_ip.ip6));
+  else
+    clib_memcpy (&mp->endpoint.address,
+		 &gbpe->ge_key->gek_ip.ip4,
+		 sizeof (gbpe->ge_key->gek_ip.ip4));
+
+  mp->endpoint.epg_id = ntohl (gbpe->ge_epg_id);
+
+  vl_api_send_msg (ctx->reg, (u8 *) mp);
+
+  return (1);
+}
+
+static void
+vl_api_gbp_endpoint_dump_t_handler (vl_api_gbp_endpoint_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  gbp_walk_ctx_t ctx = {
+    .reg = reg,
+    .context = mp->context,
+  };
+
+  gbp_endpoint_walk (gbp_endpoint_send_details, &ctx);
+}
+
+static void
+vl_api_gbp_contract_add_del_t_handler (vl_api_gbp_contract_add_del_t * mp)
+{
+  vl_api_gbp_contract_add_del_reply_t *rmp;
+  int rv = 0;
+
+  if (mp->is_add)
+    gbp_contract_update (ntohl (mp->contract.src_epg),
+			 ntohl (mp->contract.dst_epg),
+			 ntohl (mp->contract.acl_index));
+  else
+    gbp_contract_delete (ntohl (mp->contract.src_epg),
+			 ntohl (mp->contract.dst_epg));
+
+  REPLY_MACRO (VL_API_GBP_CONTRACT_ADD_DEL_REPLY + GBP_MSG_BASE);
+}
+
+static int
+gbp_contract_send_details (gbp_contract_t * gbpc, void *args)
+{
+  vl_api_gbp_contract_details_t *mp;
+  gbp_walk_ctx_t *ctx;
+
+  ctx = args;
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  if (!mp)
+    return 1;
+
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_GBP_CONTRACT_DETAILS + GBP_MSG_BASE);
+  mp->context = ctx->context;
+
+  mp->contract.src_epg = ntohl (gbpc->gc_key.gck_src);
+  mp->contract.dst_epg = ntohl (gbpc->gc_key.gck_dst);
+  mp->contract.acl_index = ntohl (gbpc->gc_acl_index);
+
+  vl_api_send_msg (ctx->reg, (u8 *) mp);
+
+  return (1);
+}
+
+static void
+vl_api_gbp_contract_dump_t_handler (vl_api_gbp_contract_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  gbp_walk_ctx_t ctx = {
+    .reg = reg,
+    .context = mp->context,
+  };
+
+  gbp_contract_walk (gbp_contract_send_details, &ctx);
+}
+
+/*
+ * gbp_api_hookup
+ * Add vpe's API message handlers to the table.
+ * vlib has alread mapped shared memory and
+ * added the client registration handlers.
+ * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
+ */
+#define vl_msg_name_crc_list
+#include <gbp/gbp_all_api_h.h>
+#undef vl_msg_name_crc_list
+
+static void
+setup_message_id_table (api_main_t * am)
+{
+#define _(id,n,crc)                                     \
+  vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id + GBP_MSG_BASE);
+  foreach_vl_msg_name_crc_gbp;
+#undef _
+}
+
+static void
+gbp_api_hookup (vlib_main_t * vm)
+{
+#define _(N,n)                                                  \
+    vl_msg_api_set_handlers(VL_API_##N + GBP_MSG_BASE,          \
+                            #n,                                 \
+                            vl_api_##n##_t_handler,             \
+                            vl_noop_handler,                    \
+                            vl_api_##n##_t_endian,              \
+                            vl_api_##n##_t_print,               \
+                            sizeof(vl_api_##n##_t), 1);
+  foreach_gbp_api_msg;
+#undef _
+}
+
+static clib_error_t *
+gbp_init (vlib_main_t * vm)
+{
+  api_main_t *am = &api_main;
+  gbp_main_t *gbpm = &gbp_main;
+  u8 *name = format (0, "gbp_%08x%c", api_version, 0);
+
+  /* Ask for a correctly-sized block of API message decode slots */
+  gbpm->msg_id_base = vl_msg_api_get_msg_ids ((char *) name,
+					      VL_MSG_FIRST_AVAILABLE);
+
+  gbp_api_hookup (vm);
+
+  /* Add our API messages to the global name_crc hash table */
+  setup_message_id_table (am);
+
+  vec_free (name);
+  return (NULL);
+}
+
+VLIB_API_INIT_FUNCTION (gbp_init);
+
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () = {
+    .version = VPP_BUILD_VER,
+    .description = "Group Based Policy",
+};
+/* *INDENT-ON* */
+
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_msg_enum.h b/src/plugins/gbp/gbp_msg_enum.h
new file mode 100644
index 00000000000..6f134a84027
--- /dev/null
+++ b/src/plugins/gbp/gbp_msg_enum.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef included_gbp_msg_enum_h
+#define included_gbp_msg_enum_h
+
+#include <vppinfra/byte_order.h>
+
+#define vl_msg_id(n,h) n,
+typedef enum {
+#include <gbp/gbp_all_api_h.h>
+    /* We'll want to know how many messages IDs we need... */
+    VL_MSG_FIRST_AVAILABLE,
+} vl_msg_id_t;
+#undef vl_msg_id
+
+#endif
diff --git a/src/vpp-api/vom/Makefile.am b/src/vpp-api/vom/Makefile.am
index e7e003968b0..2cb7f837571 100644
--- a/src/vpp-api/vom/Makefile.am
+++ b/src/vpp-api/vom/Makefile.am
@@ -57,6 +57,10 @@ libvom_la_SOURCES = 			\
 	connection.cpp			\
 	dhcp_config_cmds.cpp		\
 	dhcp_config.cpp			\
+	gbp_endpoint_cmds.cpp		\
+	gbp_endpoint.cpp		\
+	gbp_contract_cmds.cpp		\
+	gbp_contract.cpp		\
 	hw_cmds.cpp			\
 	hw.cpp				\
 	inspect.cpp			\
@@ -123,6 +127,8 @@ vominclude_HEADERS =			\
 	dump_cmd.hpp			\
 	enum_base.hpp			\
 	event_cmd.hpp			\
+	gbp_endpoint.hpp		\
+	gbp_contract.hpp		\
 	hw.hpp				\
 	inspect.hpp			\
 	interface.hpp			\
diff --git a/src/vpp-api/vom/gbp_contract.cpp b/src/vpp-api/vom/gbp_contract.cpp
new file mode 100644
index 00000000000..d648fb3aeaa
--- /dev/null
+++ b/src/vpp-api/vom/gbp_contract.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_contract.hpp"
+#include "vom/gbp_contract_cmds.hpp"
+
+namespace VOM {
+
+singular_db<gbp_contract::key_t, gbp_contract> gbp_contract::m_db;
+
+gbp_contract::event_handler gbp_contract::m_evh;
+
+gbp_contract::gbp_contract(epg_id_t src_epg_id,
+                           epg_id_t dst_epg_id,
+                           const ACL::l3_list& acl)
+  : m_hw(false)
+  , m_src_epg_id(src_epg_id)
+  , m_dst_epg_id(dst_epg_id)
+  , m_acl(acl.singular())
+{
+}
+
+gbp_contract::gbp_contract(const gbp_contract& gbpc)
+  : m_hw(gbpc.m_hw)
+  , m_src_epg_id(gbpc.m_src_epg_id)
+  , m_dst_epg_id(gbpc.m_dst_epg_id)
+  , m_acl(gbpc.m_acl)
+{
+}
+
+gbp_contract::~gbp_contract()
+{
+  sweep();
+
+  // not in the DB anymore.
+  m_db.release(key(), this);
+}
+
+const gbp_contract::key_t
+gbp_contract::key() const
+{
+  return (std::make_pair(m_src_epg_id, m_dst_epg_id));
+}
+
+bool
+gbp_contract::operator==(const gbp_contract& gbpc) const
+{
+  return ((key() == gbpc.key()) && (m_acl->handle() == gbpc.m_acl->handle()));
+}
+
+void
+gbp_contract::sweep()
+{
+  if (m_hw) {
+    HW::enqueue(
+      new gbp_contract_cmds::delete_cmd(m_hw, m_src_epg_id, m_dst_epg_id));
+  }
+  HW::write();
+}
+
+void
+gbp_contract::replay()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_contract_cmds::create_cmd(
+      m_hw, m_src_epg_id, m_dst_epg_id, m_acl->handle()));
+  }
+}
+
+std::string
+gbp_contract::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-contract:[{" << m_src_epg_id << ", " << m_dst_epg_id << "}, "
+    << m_acl->to_string() << "]";
+
+  return (s.str());
+}
+
+void
+gbp_contract::update(const gbp_contract& r)
+{
+  /*
+ * create the table if it is not yet created
+ */
+  if (rc_t::OK != m_hw.rc()) {
+    HW::enqueue(new gbp_contract_cmds::create_cmd(
+      m_hw, m_src_epg_id, m_dst_epg_id, m_acl->handle()));
+  }
+}
+
+std::shared_ptr<gbp_contract>
+gbp_contract::find_or_add(const gbp_contract& temp)
+{
+  return (m_db.find_or_add(temp.key(), temp));
+}
+
+std::shared_ptr<gbp_contract>
+gbp_contract::find(const key_t& k)
+{
+  return (m_db.find(k));
+}
+
+std::shared_ptr<gbp_contract>
+gbp_contract::singular() const
+{
+  return find_or_add(*this);
+}
+
+void
+gbp_contract::dump(std::ostream& os)
+{
+  m_db.dump(os);
+}
+
+gbp_contract::event_handler::event_handler()
+{
+  OM::register_listener(this);
+  inspect::register_handler({ "gbp-contract" }, "GBP Contract", this);
+}
+
+void
+gbp_contract::event_handler::handle_replay()
+{
+  m_db.replay();
+}
+
+void
+gbp_contract::event_handler::handle_populate(const client_db::key_t& key)
+{
+  std::shared_ptr<gbp_contract_cmds::dump_cmd> cmd =
+    std::make_shared<gbp_contract_cmds::dump_cmd>();
+
+  HW::enqueue(cmd);
+  HW::write();
+
+  for (auto& record : *cmd) {
+    auto& payload = record.get_payload();
+
+    std::shared_ptr<ACL::l3_list> acl =
+      ACL::l3_list::find(payload.contract.acl_index);
+
+    if (acl) {
+      gbp_contract gbpc(payload.contract.src_epg, payload.contract.dst_epg,
+                        *acl);
+      OM::commit(key, gbpc);
+
+      VOM_LOG(log_level_t::DEBUG) << "read: " << gbpc.to_string();
+    }
+  }
+}
+
+dependency_t
+gbp_contract::event_handler::order() const
+{
+  return (dependency_t::ENTRY);
+}
+
+void
+gbp_contract::event_handler::show(std::ostream& os)
+{
+  m_db.dump(os);
+}
+
+std::ostream&
+operator<<(std::ostream& os, const gbp_contract::key_t& key)
+{
+  os << "{ " << key.first << "," << key.second << "}";
+
+  return (os);
+}
+
+} // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_contract.hpp b/src/vpp-api/vom/gbp_contract.hpp
new file mode 100644
index 00000000000..7a0696de7b3
--- /dev/null
+++ b/src/vpp-api/vom/gbp_contract.hpp
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_CONTRACT_H__
+#define __VOM_GBP_CONTRACT_H__
+
+#include "vom/acl_list.hpp"
+#include "vom/gbp_endpoint.hpp"
+#include "vom/interface.hpp"
+#include "vom/singular_db.hpp"
+#include "vom/types.hpp"
+
+namespace VOM {
+
+/**
+ * A entry in the ARP termination table of a Bridge Domain
+ */
+class gbp_contract : public object_base
+{
+public:
+  /**
+   * The key for a contract is the pari of EPG-IDs
+   */
+  typedef std::pair<epg_id_t, epg_id_t> key_t;
+
+  /**
+   * Construct a GBP contract
+   */
+  gbp_contract(epg_id_t src_epg_id,
+               epg_id_t dst_epg_id,
+               const ACL::l3_list& acl);
+
+  /**
+   * Copy Construct
+   */
+  gbp_contract(const gbp_contract& r);
+
+  /**
+   * Destructor
+   */
+  ~gbp_contract();
+
+  /**
+   * Return the object's key
+   */
+  const key_t key() const;
+
+  /**
+   * comparison operator
+   */
+  bool operator==(const gbp_contract& bdae) const;
+
+  /**
+   * Return the matching 'singular instance'
+   */
+  std::shared_ptr<gbp_contract> singular() const;
+
+  /**
+   * Find the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_contract> find(const key_t& k);
+
+  /**
+   * Dump all bridge_domain-doamin into the stream provided
+   */
+  static void dump(std::ostream& os);
+
+  /**
+   * replay the object to create it in hardware
+   */
+  void replay(void);
+
+  /**
+   * Convert to string for debugging
+   */
+  std::string to_string() const;
+
+private:
+  /**
+   * Class definition for listeners to OM events
+   */
+  class event_handler : public OM::listener, public inspect::command_handler
+  {
+  public:
+    event_handler();
+    virtual ~event_handler() = default;
+
+    /**
+     * Handle a populate event
+     */
+    void handle_populate(const client_db::key_t& key);
+
+    /**
+     * Handle a replay event
+     */
+    void handle_replay();
+
+    /**
+     * Show the object in the Singular DB
+     */
+    void show(std::ostream& os);
+
+    /**
+     * Get the sortable Id of the listener
+     */
+    dependency_t order() const;
+  };
+
+  /**
+   * event_handler to register with OM
+   */
+  static event_handler m_evh;
+
+  /**
+   * Commit the acculmulated changes into VPP. i.e. to a 'HW" write.
+   */
+  void update(const gbp_contract& obj);
+
+  /**
+   * Find or add the instance of the contract domain in the OM
+   */
+  static std::shared_ptr<gbp_contract> find_or_add(const gbp_contract& temp);
+
+  /*
+   * It's the VPPHW class that updates the objects in HW
+   */
+  friend class OM;
+
+  /**
+   * It's the singular_db class that calls replay()
+   */
+  friend class singular_db<key_t, gbp_contract>;
+
+  /**
+   * Sweep/reap the object if still stale
+   */
+  void sweep(void);
+
+  /**
+   * HW configuration for the result of creating the endpoint
+   */
+  HW::item<bool> m_hw;
+
+  /**
+   * The source EPG ID
+   */
+  epg_id_t m_src_epg_id;
+
+  /**
+   * The destination EPG ID
+   */
+  epg_id_t m_dst_epg_id;
+
+  /**
+   * The ACL applied to traffic between the gourps
+   */
+  std::shared_ptr<ACL::l3_list> m_acl;
+
+  /**
+   * A map of all bridge_domains
+   */
+  static singular_db<key_t, gbp_contract> m_db;
+};
+
+std::ostream& operator<<(std::ostream& os, const gbp_contract::key_t& key);
+}; // namespace
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_contract_cmds.cpp b/src/vpp-api/vom/gbp_contract_cmds.cpp
new file mode 100644
index 00000000000..a98dc62bc59
--- /dev/null
+++ b/src/vpp-api/vom/gbp_contract_cmds.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_contract_cmds.hpp"
+
+namespace VOM {
+namespace gbp_contract_cmds {
+
+create_cmd::create_cmd(HW::item<bool>& item,
+                       epg_id_t src_epg_id,
+                       epg_id_t dst_epg_id,
+                       const handle_t& acl)
+  : rpc_cmd(item)
+  , m_src_epg_id(src_epg_id)
+  , m_dst_epg_id(dst_epg_id)
+  , m_acl(acl)
+{
+}
+
+bool
+create_cmd::operator==(const create_cmd& other) const
+{
+  return ((m_acl == other.m_acl) && (m_src_epg_id == other.m_src_epg_id) &&
+          (m_dst_epg_id == other.m_dst_epg_id));
+}
+
+rc_t
+create_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 1;
+  payload.contract.acl_index = m_acl.value();
+  payload.contract.src_epg = m_src_epg_id;
+  payload.contract.dst_epg = m_dst_epg_id;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+create_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-contract-create: " << m_hw_item.to_string()
+    << " src-epg-id:" << m_src_epg_id << " dst-epg-id:" << m_dst_epg_id
+    << " acl:" << m_acl;
+
+  return (s.str());
+}
+
+delete_cmd::delete_cmd(HW::item<bool>& item,
+                       epg_id_t src_epg_id,
+                       epg_id_t dst_epg_id)
+  : rpc_cmd(item)
+  , m_src_epg_id(src_epg_id)
+  , m_dst_epg_id(dst_epg_id)
+{
+}
+
+bool
+delete_cmd::operator==(const delete_cmd& other) const
+{
+  return ((m_src_epg_id == other.m_src_epg_id) &&
+          (m_dst_epg_id == other.m_dst_epg_id));
+}
+
+rc_t
+delete_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 0;
+  payload.contract.acl_index = ~0;
+  payload.contract.src_epg = m_src_epg_id;
+  payload.contract.dst_epg = m_dst_epg_id;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+delete_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-contract-delete: " << m_hw_item.to_string()
+    << " src-epg-id:" << m_src_epg_id << " dst-epg-id:" << m_dst_epg_id;
+
+  return (s.str());
+}
+
+bool
+dump_cmd::operator==(const dump_cmd& other) const
+{
+  return (true);
+}
+
+rc_t
+dump_cmd::issue(connection& con)
+{
+  m_dump.reset(new msg_t(con.ctx(), std::ref(*this)));
+
+  VAPI_CALL(m_dump->execute());
+
+  wait();
+
+  return rc_t::OK;
+}
+
+std::string
+dump_cmd::to_string() const
+{
+  return ("gbp-contract-dump");
+}
+
+}; // namespace gbp_contract_cmds
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_contract_cmds.hpp b/src/vpp-api/vom/gbp_contract_cmds.hpp
new file mode 100644
index 00000000000..705c1a0a3db
--- /dev/null
+++ b/src/vpp-api/vom/gbp_contract_cmds.hpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_CONTRACT_CMDS_H__
+#define __VOM_GBP_CONTRACT_CMDS_H__
+
+#include "vom/dump_cmd.hpp"
+#include "vom/gbp_contract.hpp"
+
+#include <vapi/gbp.api.vapi.hpp>
+
+namespace VOM {
+namespace gbp_contract_cmds {
+
+/**
+* A command class that creates or updates the GBP contract
+*/
+class create_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_contract_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  create_cmd(HW::item<bool>& item,
+             epg_id_t src_epg_id,
+             epg_id_t dst_epg_id,
+             const handle_t& acl);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const create_cmd& i) const;
+
+private:
+  const epg_id_t m_src_epg_id;
+  const epg_id_t m_dst_epg_id;
+  const handle_t m_acl;
+};
+
+/**
+ * A cmd class that deletes a GBP contract
+ */
+class delete_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_contract_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  delete_cmd(HW::item<bool>& item, epg_id_t src_epg_id, epg_id_t dst_epg_id);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const delete_cmd& i) const;
+
+private:
+  const epg_id_t m_src_epg_id;
+  const epg_id_t m_dst_epg_id;
+};
+
+/**
+ * A cmd class that Dumps all the GBP endpoints
+ */
+class dump_cmd : public VOM::dump_cmd<vapi::Gbp_contract_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_cmd() = default;
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+}; // namespace gbp_contract_cmds
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_endpoint.cpp b/src/vpp-api/vom/gbp_endpoint.cpp
new file mode 100644
index 00000000000..429183bd210
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint.cpp
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_endpoint.hpp"
+#include "vom/gbp_endpoint_cmds.hpp"
+
+namespace VOM {
+
+singular_db<gbp_endpoint::key_t, gbp_endpoint> gbp_endpoint::m_db;
+
+gbp_endpoint::event_handler gbp_endpoint::m_evh;
+
+gbp_endpoint::gbp_endpoint(const interface& itf,
+                           const boost::asio::ip::address& ip_addr,
+                           epg_id_t epg_id)
+  : m_hw(false)
+  , m_itf(itf.singular())
+  , m_ip_addr(ip_addr)
+  , m_epg_id(epg_id)
+{
+}
+
+gbp_endpoint::gbp_endpoint(const gbp_endpoint& gbpe)
+  : m_hw(gbpe.m_hw)
+  , m_itf(gbpe.m_itf)
+  , m_ip_addr(gbpe.m_ip_addr)
+  , m_epg_id(gbpe.m_epg_id)
+{
+}
+
+gbp_endpoint::~gbp_endpoint()
+{
+  sweep();
+
+  // not in the DB anymore.
+  m_db.release(key(), this);
+}
+
+const gbp_endpoint::key_t
+gbp_endpoint::key() const
+{
+  return (std::make_pair(m_itf->key(), m_ip_addr));
+}
+
+bool
+gbp_endpoint::operator==(const gbp_endpoint& gbpe) const
+{
+  return ((key() == gbpe.key()) && (m_epg_id == gbpe.m_epg_id));
+}
+
+void
+gbp_endpoint::sweep()
+{
+  if (m_hw) {
+    HW::enqueue(
+      new gbp_endpoint_cmds::delete_cmd(m_hw, m_itf->handle(), m_ip_addr));
+  }
+  HW::write();
+}
+
+void
+gbp_endpoint::replay()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_endpoint_cmds::create_cmd(m_hw, m_itf->handle(),
+                                                  m_ip_addr, m_epg_id));
+  }
+}
+
+std::string
+gbp_endpoint::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-endpoint:[" << m_itf->to_string() << ", " << m_ip_addr.to_string()
+    << ", epg-id:" << m_epg_id << "]";
+
+  return (s.str());
+}
+
+void
+gbp_endpoint::update(const gbp_endpoint& r)
+{
+  /*
+ * create the table if it is not yet created
+ */
+  if (rc_t::OK != m_hw.rc()) {
+    HW::enqueue(new gbp_endpoint_cmds::create_cmd(m_hw, m_itf->handle(),
+                                                  m_ip_addr, m_epg_id));
+  }
+}
+
+std::shared_ptr<gbp_endpoint>
+gbp_endpoint::find_or_add(const gbp_endpoint& temp)
+{
+  return (m_db.find_or_add(temp.key(), temp));
+}
+
+std::shared_ptr<gbp_endpoint>
+gbp_endpoint::find(const key_t& k)
+{
+  return (m_db.find(k));
+}
+
+std::shared_ptr<gbp_endpoint>
+gbp_endpoint::singular() const
+{
+  return find_or_add(*this);
+}
+
+void
+gbp_endpoint::dump(std::ostream& os)
+{
+  m_db.dump(os);
+}
+
+gbp_endpoint::event_handler::event_handler()
+{
+  OM::register_listener(this);
+  inspect::register_handler({ "gbp-endpoint" }, "GBP Endpoints", this);
+}
+
+void
+gbp_endpoint::event_handler::handle_replay()
+{
+  m_db.replay();
+}
+
+void
+gbp_endpoint::event_handler::handle_populate(const client_db::key_t& key)
+{
+  std::shared_ptr<gbp_endpoint_cmds::dump_cmd> cmd =
+    std::make_shared<gbp_endpoint_cmds::dump_cmd>();
+
+  HW::enqueue(cmd);
+  HW::write();
+
+  for (auto& record : *cmd) {
+    auto& payload = record.get_payload();
+
+    boost::asio::ip::address address =
+      from_bytes(payload.endpoint.is_ip6, payload.endpoint.address);
+    std::shared_ptr<interface> itf =
+      interface::find(payload.endpoint.sw_if_index);
+
+    VOM_LOG(log_level_t::DEBUG) << "data: " << payload.endpoint.sw_if_index;
+
+    if (itf) {
+      gbp_endpoint gbpe(*itf, address, payload.endpoint.epg_id);
+      OM::commit(key, gbpe);
+
+      VOM_LOG(log_level_t::DEBUG) << "read: " << gbpe.to_string();
+    }
+  }
+}
+
+dependency_t
+gbp_endpoint::event_handler::order() const
+{
+  return (dependency_t::ENTRY);
+}
+
+void
+gbp_endpoint::event_handler::show(std::ostream& os)
+{
+  m_db.dump(os);
+}
+} // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_endpoint.hpp b/src/vpp-api/vom/gbp_endpoint.hpp
new file mode 100644
index 00000000000..9118cb80eb1
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint.hpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_ENDPOINT_H__
+#define __VOM_GBP_ENDPOINT_H__
+
+#include "vom/interface.hpp"
+#include "vom/singular_db.hpp"
+#include "vom/types.hpp"
+
+namespace VOM {
+
+/**
+ * EPG IDs are 32 bit integers
+ */
+typedef uint32_t epg_id_t;
+
+/**
+ * A entry in the ARP termination table of a Bridge Domain
+ */
+class gbp_endpoint : public object_base
+{
+public:
+  /**
+   * The key for a GBP endpoint; interface and IP
+   */
+  typedef std::pair<interface::key_t, boost::asio::ip::address> key_t;
+
+  /**
+   * Construct a GBP endpoint
+   */
+  gbp_endpoint(const interface& itf,
+               const boost::asio::ip::address& ip_addr,
+               epg_id_t epg_id);
+
+  /**
+   * Copy Construct
+   */
+  gbp_endpoint(const gbp_endpoint& r);
+
+  /**
+   * Destructor
+   */
+  ~gbp_endpoint();
+
+  /**
+   * Return the object's key
+   */
+  const key_t key() const;
+
+  /**
+   * comparison operator
+   */
+  bool operator==(const gbp_endpoint& bdae) const;
+
+  /**
+   * Return the matching 'singular instance'
+   */
+  std::shared_ptr<gbp_endpoint> singular() const;
+
+  /**
+   * Find the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_endpoint> find(const key_t& k);
+
+  /**
+   * Dump all bridge_domain-doamin into the stream provided
+   */
+  static void dump(std::ostream& os);
+
+  /**
+   * replay the object to create it in hardware
+   */
+  void replay(void);
+
+  /**
+   * Convert to string for debugging
+   */
+  std::string to_string() const;
+
+private:
+  /**
+   * Class definition for listeners to OM events
+   */
+  class event_handler : public OM::listener, public inspect::command_handler
+  {
+  public:
+    event_handler();
+    virtual ~event_handler() = default;
+
+    /**
+     * Handle a populate event
+     */
+    void handle_populate(const client_db::key_t& key);
+
+    /**
+     * Handle a replay event
+     */
+    void handle_replay();
+
+    /**
+     * Show the object in the Singular DB
+     */
+    void show(std::ostream& os);
+
+    /**
+     * Get the sortable Id of the listener
+     */
+    dependency_t order() const;
+  };
+
+  /**
+   * event_handler to register with OM
+   */
+  static event_handler m_evh;
+
+  /**
+   * Commit the acculmulated changes into VPP. i.e. to a 'HW" write.
+   */
+  void update(const gbp_endpoint& obj);
+
+  /**
+   * Find or add the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_endpoint> find_or_add(const gbp_endpoint& temp);
+
+  /*
+   * It's the VPPHW class that updates the objects in HW
+   */
+  friend class OM;
+
+  /**
+   * It's the singular_db class that calls replay()
+   */
+  friend class singular_db<key_t, gbp_endpoint>;
+
+  /**
+   * Sweep/reap the object if still stale
+   */
+  void sweep(void);
+
+  /**
+   * HW configuration for the result of creating the endpoint
+   */
+  HW::item<bool> m_hw;
+
+  /**
+   * The interface the endpoint is attached to.
+   */
+  std::shared_ptr<interface> m_itf;
+
+  /**
+   * The IP address of the endpoint
+   */
+  boost::asio::ip::address m_ip_addr;
+
+  /**
+   * The EPG ID
+   */
+  epg_id_t m_epg_id;
+
+  /**
+   * A map of all bridge_domains
+   */
+  static singular_db<key_t, gbp_endpoint> m_db;
+};
+
+std::ostream& operator<<(std::ostream& os, const gbp_endpoint::key_t& key);
+}; // namespace
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_endpoint_cmds.cpp b/src/vpp-api/vom/gbp_endpoint_cmds.cpp
new file mode 100644
index 00000000000..5a8247a4250
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint_cmds.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_endpoint_cmds.hpp"
+
+DEFINE_VAPI_MSG_IDS_GBP_API_JSON;
+
+namespace VOM {
+namespace gbp_endpoint_cmds {
+
+create_cmd::create_cmd(HW::item<bool>& item,
+                       const handle_t& itf,
+                       const boost::asio::ip::address& ip_addr,
+                       epg_id_t epg_id)
+  : rpc_cmd(item)
+  , m_itf(itf)
+  , m_ip_addr(ip_addr)
+  , m_epg_id(epg_id)
+{
+}
+
+bool
+create_cmd::operator==(const create_cmd& other) const
+{
+  return ((m_itf == other.m_itf) && (m_ip_addr == other.m_ip_addr) &&
+          (m_epg_id == other.m_epg_id));
+}
+
+rc_t
+create_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 1;
+  payload.endpoint.sw_if_index = m_itf.value();
+  payload.endpoint.epg_id = m_epg_id;
+  to_bytes(m_ip_addr, &payload.endpoint.is_ip6, payload.endpoint.address);
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+create_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-endpoint-create: " << m_hw_item.to_string() << " itf:" << m_itf
+    << " ip:" << m_ip_addr.to_string() << " epg-id:" << m_epg_id;
+
+  return (s.str());
+}
+
+delete_cmd::delete_cmd(HW::item<bool>& item,
+                       const handle_t& itf,
+                       const boost::asio::ip::address& ip_addr)
+  : rpc_cmd(item)
+  , m_itf(itf)
+  , m_ip_addr(ip_addr)
+{
+}
+
+bool
+delete_cmd::operator==(const delete_cmd& other) const
+{
+  return ((m_itf == other.m_itf) && (m_ip_addr == other.m_ip_addr));
+}
+
+rc_t
+delete_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 0;
+  payload.endpoint.sw_if_index = m_itf.value();
+  payload.endpoint.epg_id = ~0;
+  to_bytes(m_ip_addr, &payload.endpoint.is_ip6, payload.endpoint.address);
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+delete_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-endpoint-create: " << m_hw_item.to_string() << " itf:" << m_itf
+    << " ip:" << m_ip_addr.to_string();
+
+  return (s.str());
+}
+
+dump_cmd::dump_cmd()
+{
+}
+
+bool
+dump_cmd::operator==(const dump_cmd& other) const
+{
+  return (true);
+}
+
+rc_t
+dump_cmd::issue(connection& con)
+{
+  m_dump.reset(new msg_t(con.ctx(), std::ref(*this)));
+
+  VAPI_CALL(m_dump->execute());
+
+  wait();
+
+  return rc_t::OK;
+}
+
+std::string
+dump_cmd::to_string() const
+{
+  return ("gbp-endpoint-dump");
+}
+
+}; // namespace gbp_endpoint_cmds
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_endpoint_cmds.hpp b/src/vpp-api/vom/gbp_endpoint_cmds.hpp
new file mode 100644
index 00000000000..cc7884979e8
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint_cmds.hpp
@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_ENDPOINT_CMDS_H__
+#define __VOM_GBP_ENDPOINT_CMDS_H__
+
+#include "vom/dump_cmd.hpp"
+#include "vom/gbp_endpoint.hpp"
+
+#include <vapi/gbp.api.vapi.hpp>
+
+namespace VOM {
+namespace gbp_endpoint_cmds {
+
+/**
+* A command class that creates or updates the GBP endpoint
+*/
+class create_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_endpoint_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  create_cmd(HW::item<bool>& item,
+             const handle_t& itf,
+             const boost::asio::ip::address& ip_addr,
+             epg_id_t epg_id);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const create_cmd& i) const;
+
+private:
+  const handle_t m_itf;
+  const boost::asio::ip::address m_ip_addr;
+  const epg_id_t m_epg_id;
+};
+
+/**
+ * A cmd class that deletes a GBP endpoint
+ */
+class delete_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_endpoint_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  delete_cmd(HW::item<bool>& item,
+             const handle_t& itf,
+             const boost::asio::ip::address& ip_addr);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const delete_cmd& i) const;
+
+private:
+  const handle_t m_itf;
+  const boost::asio::ip::address m_ip_addr;
+};
+
+/**
+ * A cmd class that Dumps all the GBP endpoints
+ */
+class dump_cmd : public VOM::dump_cmd<vapi::Gbp_endpoint_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_cmd();
+  dump_cmd(const dump_cmd& d);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+}; // namespace gbp_enpoint_cms
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/l2_emulation.cpp b/src/vpp-api/vom/l2_emulation.cpp
index 2a2757616be..75e3bffb2ec 100644
--- a/src/vpp-api/vom/l2_emulation.cpp
+++ b/src/vpp-api/vom/l2_emulation.cpp
@@ -74,7 +74,7 @@ l2_emulation::replay()
 {
   if (m_emulation && handle_t::INVALID != m_itf->handle()) {
     HW::enqueue(
-      new l2_emulation_cmds::disable_cmd(m_emulation, m_itf->handle()));
+      new l2_emulation_cmds::enable_cmd(m_emulation, m_itf->handle()));
   }
 }
 
diff --git a/src/vpp-api/vom/l2_emulation_cmds.cpp b/src/vpp-api/vom/l2_emulation_cmds.cpp
index 07107d6ff58..27f84830191 100644
--- a/src/vpp-api/vom/l2_emulation_cmds.cpp
+++ b/src/vpp-api/vom/l2_emulation_cmds.cpp
@@ -51,7 +51,7 @@ std::string
 enable_cmd::to_string() const
 {
   std::ostringstream s;
-  s << "L2-emulation: " << m_hw_item.to_string()
+  s << "L2-emulation-enable: " << m_hw_item.to_string()
     << " itf:" << m_itf.to_string();
 
   return (s.str());
@@ -89,7 +89,7 @@ std::string
 disable_cmd::to_string() const
 {
   std::ostringstream s;
-  s << "L2-emulation: " << m_hw_item.to_string()
+  s << "L2-emulation-disable: " << m_hw_item.to_string()
     << " itf:" << m_itf.to_string();
 
   return (s.str());
diff --git a/src/vppinfra/cache_entry_by_name b/src/vppinfra/cache_entry_by_name
new file mode 100644
index 00000000000..e69de29bb2d
--- /dev/null
+++ b/src/vppinfra/cache_entry_by_name
diff --git a/test/test_gbp.py b/test/test_gbp.py
new file mode 100644
index 00000000000..427b14de506
--- /dev/null
+++ b/test/test_gbp.py
@@ -0,0 +1,369 @@
+#!/usr/bin/env python
+
+import unittest
+import socket
+import struct
+
+from framework import VppTestCase, VppTestRunner
+from vpp_object import VppObject
+
+from scapy.packet import Raw
+from scapy.layers.l2 import Ether
+from scapy.layers.inet import IP, UDP
+from scapy.layers.inet6 import IPv6
+
+from socket import AF_INET, AF_INET6
+from scapy.utils import inet_pton
+
+
+class VppGbpEndpoint(VppObject):
+    """
+    GDB Endpoint
+    """
+
+    def __init__(self, test, sw_if_index, addr, epg, is_ip6=0):
+        self._test = test
+        self.sw_if_index = sw_if_index
+        self.epg = epg
+        self.addr_p = addr
+        self.is_ip6 = is_ip6
+        if is_ip6:
+            self.addr = inet_pton(AF_INET6, addr)
+        else:
+            self.addr = inet_pton(AF_INET, addr)
+
+    def add_vpp_config(self):
+        self._test.vapi.gbp_endpoint_add_del(
+            1,
+            self.sw_if_index,
+            self.addr,
+            self.is_ip6,
+            self.epg)
+        self._test.registry.register(self, self._test.logger)
+
+    def remove_vpp_config(self):
+        self._test.vapi.gbp_endpoint_add_del(
+            0,
+            self.sw_if_index,
+            self.addr,
+            self.is_ip6,
+            self.epg)
+
+    def __str__(self):
+        return self.object_id()
+
+    def object_id(self):
+        return "gbp-endpoint;[%d:%s:%d]" % (self.sw_if_index,
+                                            self.addr_p,
+                                            self.epg)
+
+    def query_vpp_config(self):
+        eps = self._test.vapi.gbp_endpoint_dump()
+        for ep in eps:
+            if ep.endpoint.address == self.addr \
+               and ep.endpoint.sw_if_index == self.sw_if_index:
+                return True
+        return False
+
+
+class VppGbpContract(VppObject):
+    """
+    GDB Contract
+    """
+
+    def __init__(self, test, src_epg, dst_epg, acl_index):
+        self._test = test
+        self.acl_index = acl_index
+        self.src_epg = src_epg
+        self.dst_epg = dst_epg
+
+    def add_vpp_config(self):
+        self._test.vapi.gbp_contract_add_del(
+            1,
+            self.src_epg,
+            self.dst_epg,
+            self.acl_index)
+        self._test.registry.register(self, self._test.logger)
+
+    def remove_vpp_config(self):
+        self._test.vapi.gbp_contract_add_del(
+            0,
+            self.src_epg,
+            self.dst_epg,
+            self.acl_index)
+
+    def __str__(self):
+        return self.object_id()
+
+    def object_id(self):
+        return "gbp-contract;[%d:%s:%d]" % (self.src_epg,
+                                            self.dst_epg,
+                                            self.acl_index)
+
+    def query_vpp_config(self):
+        eps = self._test.vapi.gbp_contract_dump()
+        for ep in eps:
+            if ep.contract.src_epg == self.src_epg \
+               and ep.contract.dst_epg == self.dst_epg:
+                return True
+        return False
+
+
+class TestGBP(VppTestCase):
+    """ GBP Test Case """
+
+    def setUp(self):
+        super(TestGBP, self).setUp()
+
+        # create 6 pg interfaces for pg0 to pg5
+        self.create_pg_interfaces(range(6))
+
+        for i in self.pg_interfaces:
+            i.admin_up()
+            i.config_ip4()
+            i.resolve_arp()
+            i.config_ip6()
+            i.resolve_ndp()
+
+    def tearDown(self):
+        for i in self.pg_interfaces:
+            i.unconfig_ip4()
+            i.unconfig_ip6()
+
+        super(TestGBP, self).tearDown()
+
+    def test_gbp4(self):
+        """ Group Based Policy v4 """
+
+        ep1 = VppGbpEndpoint(self,
+                             self.pg0.sw_if_index,
+                             self.pg0.remote_ip4,
+                             220)
+        ep1.add_vpp_config()
+        ep2 = VppGbpEndpoint(self,
+                             self.pg1.sw_if_index,
+                             self.pg1.remote_ip4,
+                             220)
+        ep2.add_vpp_config()
+
+        ep3 = VppGbpEndpoint(self,
+                             self.pg2.sw_if_index,
+                             self.pg2.remote_ip4,
+                             221)
+        ep3.add_vpp_config()
+        ep4 = VppGbpEndpoint(self,
+                             self.pg3.sw_if_index,
+                             self.pg3.remote_ip4,
+                             222)
+        ep4.add_vpp_config()
+
+        self.logger.info(self.vapi.cli("sh gbp endpoint"))
+
+        #
+        # in the abscense of policy, endpoints in the same EPG
+        # can communicate
+        #
+        pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
+                               dst=self.pg0.local_mac) /
+                         IP(src=self.pg0.remote_ip4,
+                            dst=self.pg1.remote_ip4) /
+                         UDP(sport=1234, dport=1234) /
+                         Raw('\xa5' * 100))
+
+        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+
+        #
+        # in the abscense of policy, endpoints in the different EPG
+        # cannot communicate
+        #
+        pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
+                                          dst=self.pg0.local_mac) /
+                                    IP(src=self.pg0.remote_ip4,
+                                       dst=self.pg2.remote_ip4) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+        pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
+                                          dst=self.pg0.local_mac) /
+                                    IP(src=self.pg0.remote_ip4,
+                                       dst=self.pg3.remote_ip4) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+        pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
+                                          dst=self.pg2.local_mac) /
+                                    IP(src=self.pg2.remote_ip4,
+                                       dst=self.pg0.remote_ip4) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_221 * 65)
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_221_to_220 * 65)
+
+        #
+        # A uni-directional contract from EPG 220 -> 221
+        #
+        c1 = VppGbpContract(self, 220, 221, 0xffffffff)
+        c1.add_vpp_config()
+
+        self.send_and_expect(self.pg0,
+                             pkt_inter_epg_220_to_221 * 65,
+                             self.pg2)
+        self.send_and_assert_no_replies(self.pg2,
+                                        pkt_inter_epg_221_to_220 * 65)
+
+        #
+        # contract for the return direction
+        #
+        c2 = VppGbpContract(self, 221, 220, 0xffffffff)
+        c2.add_vpp_config()
+
+        self.send_and_expect(self.pg0,
+                             pkt_inter_epg_220_to_221 * 65,
+                             self.pg2)
+        self.send_and_expect(self.pg2,
+                             pkt_inter_epg_221_to_220 * 65,
+                             self.pg0)
+
+        #
+        # check that inter group is still disabled for the groups
+        # not in the contract.
+        #
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_222 * 65)
+
+        self.logger.info(self.vapi.cli("sh gbp contract"))
+
+        #
+        # remove both contracts, traffic stops in both directions
+        #
+        c2.remove_vpp_config()
+        c1.remove_vpp_config()
+
+        self.send_and_assert_no_replies(self.pg2,
+                                        pkt_inter_epg_221_to_220 * 65)
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_221 * 65)
+        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+
+    def test_gbp6(self):
+        """ Group Based Policy v6 """
+
+        ep1 = VppGbpEndpoint(self,
+                             self.pg0.sw_if_index,
+                             self.pg0.remote_ip6,
+                             220,
+                             is_ip6=1)
+        ep1.add_vpp_config()
+        ep2 = VppGbpEndpoint(self,
+                             self.pg1.sw_if_index,
+                             self.pg1.remote_ip6,
+                             220,
+                             is_ip6=1)
+        ep2.add_vpp_config()
+
+        ep3 = VppGbpEndpoint(self,
+                             self.pg2.sw_if_index,
+                             self.pg2.remote_ip6,
+                             221,
+                             is_ip6=1)
+        ep3.add_vpp_config()
+        ep4 = VppGbpEndpoint(self,
+                             self.pg3.sw_if_index,
+                             self.pg3.remote_ip6,
+                             222,
+                             is_ip6=1)
+        ep4.add_vpp_config()
+
+        self.logger.info(self.vapi.cli("sh gbp endpoint"))
+
+        #
+        # in the abscense of policy, endpoints in the same EPG
+        # can communicate
+        #
+        pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
+                               dst=self.pg0.local_mac) /
+                         IPv6(src=self.pg0.remote_ip6,
+                              dst=self.pg1.remote_ip6) /
+                         UDP(sport=1234, dport=1234) /
+                         Raw('\xa5' * 100))
+
+        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+
+        #
+        # in the abscense of policy, endpoints in the different EPG
+        # cannot communicate
+        #
+        pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
+                                          dst=self.pg0.local_mac) /
+                                    IPv6(src=self.pg0.remote_ip6,
+                                         dst=self.pg2.remote_ip6) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+        pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
+                                          dst=self.pg0.local_mac) /
+                                    IPv6(src=self.pg0.remote_ip6,
+                                         dst=self.pg3.remote_ip6) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+        pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
+                                          dst=self.pg2.local_mac) /
+                                    IPv6(src=self.pg2.remote_ip6,
+                                         dst=self.pg0.remote_ip6) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_221 * 65)
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_221_to_220 * 65)
+
+        #
+        # A uni-directional contract from EPG 220 -> 221
+        #
+        c1 = VppGbpContract(self, 220, 221, 0xffffffff)
+        c1.add_vpp_config()
+
+        self.send_and_expect(self.pg0,
+                             pkt_inter_epg_220_to_221 * 65,
+                             self.pg2)
+        self.send_and_assert_no_replies(self.pg2,
+                                        pkt_inter_epg_221_to_220 * 65)
+
+        #
+        # contract for the return direction
+        #
+        c2 = VppGbpContract(self, 221, 220, 0xffffffff)
+        c2.add_vpp_config()
+
+        self.send_and_expect(self.pg0,
+                             pkt_inter_epg_220_to_221 * 65,
+                             self.pg2)
+        self.send_and_expect(self.pg2,
+                             pkt_inter_epg_221_to_220 * 65,
+                             self.pg0)
+
+        #
+        # check that inter group is still disabled for the groups
+        # not in the contract.
+        #
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_222 * 65)
+
+        self.logger.info(self.vapi.cli("sh gbp contract"))
+
+        #
+        # remove both contracts, traffic stops in both directions
+        #
+        c2.remove_vpp_config()
+        c1.remove_vpp_config()
+
+        self.send_and_assert_no_replies(self.pg2,
+                                        pkt_inter_epg_221_to_220 * 65)
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_221 * 65)
+        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+
+
+if __name__ == '__main__':
+    unittest.main(testRunner=VppTestRunner)
diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py
index a10b777a13a..15a566c5bc7 100644
--- a/test/vpp_papi_provider.py
+++ b/test/vpp_papi_provider.py
@@ -3162,3 +3162,30 @@ class VppPapiProvider(object):
     def ip_reassembly_get(self, is_ip6=0):
         """ Get IP reassembly parameters """
         return self.api(self.papi.ip_reassembly_get, {'is_ip6': is_ip6})
+
+    def gbp_endpoint_add_del(self, is_add, sw_if_index, addr, is_ip6, epg):
+        """ GBP endpoint Add/Del """
+        return self.api(self.papi.gbp_endpoint_add_del,
+                        {'is_add': is_add,
+                         'endpoint': {
+                             'is_ip6': is_ip6,
+                             'sw_if_index': sw_if_index,
+                             'address': addr,
+                             'epg_id': epg}})
+
+    def gbp_endpoint_dump(self):
+        """ GBP endpoint Dump """
+        return self.api(self.papi.gbp_endpoint_dump, {})
+
+    def gbp_contract_add_del(self, is_add, src_epg, dst_epg, acl_index):
+        """ GBP contract Add/Del """
+        return self.api(self.papi.gbp_contract_add_del,
+                        {'is_add': is_add,
+                         'contract': {
+                             'acl_index': acl_index,
+                             'src_epg': src_epg,
+                             'dst_epg': dst_epg}})
+
+    def gbp_contract_dump(self):
+        """ GBP contract Dump """
+        return self.api(self.papi.gbp_contract_dump, {})