Source VRF Select

match against a packet's source address to determine
the VRF for the subsequent destination address lookup.

Change-Id: I48ee0ef54dcb891f0ec7f879e4d3b925a0ed0081
Signed-off-by: Neale Ranns <nranns@cisco.com>

10 files changed, 1204 insertions, 0 deletions

diff --git a/src/plugins/svs/CMakeLists.txt b/src/plugins/svs/CMakeLists.txt
new file mode 100644
index 00000000000..7d915b4878f
--- /dev/null
+++ b/src/plugins/svs/CMakeLists.txt
@@ -0,0 +1,25 @@
+# Copyright (c) 2018 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_vpp_plugin(svs
+  SOURCES
+  svs_api.c
+  svs.c
+
+  API_FILES
+  svs.api
+
+  INSTALL_HEADERS
+  svs_all_api_h.h
+  svs_msg_enum.h
+)
diff --git a/src/plugins/svs/svs.api b/src/plugins/svs/svs.api
new file mode 100644
index 00000000000..4bed037be90
--- /dev/null
+++ b/src/plugins/svs/svs.api
@@ -0,0 +1,131 @@
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ *   This file defines the vpp control-plane API messages
+ *   used to control the Source VRF select (SVS) plugin
+ */
+
+option version = "1.0.0";
+import "vnet/ip/ip_types.api";
+
+/**
+ * brief Get the plugin version
+ * @param client_index - opaque cookie to identify the sender
+ *@param context - sender context, to match reply w/ request
+ */
+define svs_plugin_get_version
+{
+  u32 client_index;
+  u32 context;
+};
+
+/**
+ * @brief Reply to get the plugin version
+ * @param context - returned sender context, to match reply w/ request
+ * @param major - Incremented every time a known breaking behavior change is introduced
+ * @param minor - Incremented with small changes, may be used to avoid buggy versions
+ */
+define svs_plugin_get_version_reply
+{
+  u32 context;
+  u32 major;
+  u32 minor;
+};
+
+/**
+ * @brief Add a table in which to add routes that will match against source
+ *        addresses
+ * @param client_index - opaque cookie to identify the sender
+ * @param context - sender context, to match reply w/ request
+ * @param af - Address Family
+ * @param table_id - User provided ID for the table
+ * @param is_add - add or delete
+ */
+autoreply define svs_table_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8 is_add;
+  vl_api_address_family_t af;
+  u32 table_id;
+};
+
+/**
+ * @brief Add a route into the source address matching table
+ * @param client_index - opaque cookie to identify the sender
+ * @param context - sender context, to match reply w/ request
+ * @param prefix - prefix
+ * @param table_id - The SVS table (from svs_table_add_del)
+ * @param source_table_id - This is the table ID that will be used for
+ *                          the subsequent lookup of the packet. The V in SVS.
+ *                          this table must exist (from e.g. ip_table_add_del)
+ */
+autoreply define svs_route_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8 is_add;
+  vl_api_prefix_t prefix;
+  u32 table_id;
+  u32 source_table_id;
+};
+
+/**
+ * @brief Enable SVS on a given interface by using the given table to match
+ *        RX'd packets' source addresses
+ * @param client_index - opaque cookie to identify the sender
+ * @param context - sender context, to match reply w/ request
+ * @param af - Address Family
+ * @param table_id - The SVS table (from svs_table_add_del)
+ * @param sw_if_index - Interface
+ */
+autoreply define svs_enable_disable
+{
+  u32 client_index;
+  u32 context;
+  u8 is_enable;
+  vl_api_address_family_t af;
+  u32 table_id;
+  u32 sw_if_index;
+};
+
+/**
+ * @brief Dump the SVS table mappings of table_id to interface
+ *        To see the routes added to a given table use ip_fib_dump()
+ */
+define svs_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
+/**
+ * @brief SVS table-id to interface mapping
+ * @param context - sender context, to match reply w/ request
+ * @param af - Address Family
+ * @param table_id - The SVS table (from svs_table_add_del)
+ * @param sw_if_index - Interface
+ */
+define svs_details
+{
+  u32 context;
+  u32 table_id;
+  u32 sw_if_index;
+  vl_api_address_family_t af;
+};
+
diff --git a/src/plugins/svs/svs.c b/src/plugins/svs/svs.c
new file mode 100644
index 00000000000..d9e46a50de8
--- /dev/null
+++ b/src/plugins/svs/svs.c
@@ -0,0 +1,611 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/svs/svs.h>
+
+#include <vlib/vlib.h>
+#include <vnet/plugin/plugin.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/dpo/lookup_dpo.h>
+#include <vnet/dpo/load_balance.h>
+#include <vnet/dpo/load_balance_map.h>
+
+u32 *svs_itf_db[FIB_PROTOCOL_IP_MAX];
+
+int
+svs_table_add (fib_protocol_t fproto, u32 table_id)
+{
+  fib_table_find_or_create_and_lock (fproto, table_id, FIB_SOURCE_PLUGIN_LOW);
+
+  return (0);
+}
+
+int
+svs_table_delete (fib_protocol_t fproto, u32 table_id)
+{
+  u32 fib_index;
+
+  fib_index = fib_table_find (fproto, table_id);
+
+  if (~0 == fib_index)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  fib_table_unlock (fib_index, fproto, FIB_SOURCE_PLUGIN_LOW);
+
+  return (0);
+}
+
+static int
+svs_route_add_i (u32 fib_index, const fib_prefix_t * pfx, u32 src_fib_index)
+{
+  dpo_id_t dpo = DPO_INVALID;
+
+
+  lookup_dpo_add_or_lock_w_fib_index (src_fib_index,
+				      fib_proto_to_dpo (pfx->fp_proto),
+				      LOOKUP_UNICAST,
+				      LOOKUP_INPUT_SRC_ADDR,
+				      LOOKUP_TABLE_FROM_CONFIG, &dpo);
+
+  fib_table_entry_special_dpo_add (fib_index, pfx,
+				   FIB_SOURCE_PLUGIN_LOW,
+				   FIB_ENTRY_FLAG_EXCLUSIVE, &dpo);
+
+  dpo_unlock (&dpo);
+
+  return (0);
+}
+
+int
+svs_route_add (u32 table_id, const fib_prefix_t * pfx, u32 source_table_id)
+{
+  u32 fib_index, src_fib_index;
+  int rv;
+
+  fib_index = fib_table_find (pfx->fp_proto, table_id);
+
+  if (~0 == fib_index)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  src_fib_index = fib_table_find (pfx->fp_proto, source_table_id);
+
+  if (~0 == src_fib_index)
+    return (VNET_API_ERROR_NO_SUCH_FIB);
+
+  rv = svs_route_add_i (fib_index, pfx, src_fib_index);
+
+  return (rv);
+}
+
+int
+svs_route_delete (u32 table_id, const fib_prefix_t * pfx)
+{
+  u32 fib_index;
+
+  fib_index = fib_table_find (pfx->fp_proto, table_id);
+
+  if (~0 == fib_index)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  fib_table_entry_special_remove (fib_index, pfx, FIB_SOURCE_PLUGIN_LOW);
+
+  return (0);
+}
+
+int
+svs_enable (fib_protocol_t fproto, u32 table_id, u32 sw_if_index)
+{
+  fib_prefix_t pfx = {
+    .fp_proto = fproto,
+  };
+  u32 fib_index;
+
+  fib_index = fib_table_find (fproto, table_id);
+
+  if (~0 == fib_index)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  /*
+   * now we know which interface the table will serve, we can add the default
+   * route to use the table that the interface is bound to.
+   */
+  svs_route_add_i (fib_index, &pfx,
+		   fib_table_get_index_for_sw_if_index (fproto, sw_if_index));
+
+  vec_validate_init_empty (svs_itf_db[fproto], sw_if_index, ~0);
+
+  svs_itf_db[fproto][sw_if_index] = fib_index;
+
+  vnet_feature_enable_disable ((FIB_PROTOCOL_IP4 == fproto ?
+				"ip4-unicast" :
+				"ip6-unicast"),
+			       (FIB_PROTOCOL_IP4 == fproto ?
+				"svs-ip4" :
+				"svs-ip6"), sw_if_index, 1, NULL, 0);
+
+  return (0);
+}
+
+static void
+svs_table_bind (fib_protocol_t fproto, u32 sw_if_index, u32 itf_fib_index)
+{
+  /*
+   * update the default route to use the interface's newly bound FIB
+   */
+  u32 svs_fib_index;
+
+  if (sw_if_index >= vec_len (svs_itf_db[FIB_PROTOCOL_IP6]))
+    return;
+
+  svs_fib_index = svs_itf_db[FIB_PROTOCOL_IP6][sw_if_index];
+
+  if (~0 != svs_fib_index)
+    {
+      fib_prefix_t pfx = {
+	.fp_proto = fproto,
+      };
+
+      svs_route_add (svs_fib_index, &pfx, itf_fib_index);
+    }
+  /*
+   * else
+   *  no SVS enable on this interface
+   */
+}
+
+static void
+svs_ip6_table_bind (ip6_main_t * im,
+		    uword opaque,
+		    u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
+{
+  svs_table_bind (FIB_PROTOCOL_IP6, sw_if_index, new_fib_index);
+}
+
+static void
+svs_ip4_table_bind (ip4_main_t * im,
+		    uword opaque,
+		    u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
+{
+  svs_table_bind (FIB_PROTOCOL_IP4, sw_if_index, new_fib_index);
+}
+
+int
+svs_disable (fib_protocol_t fproto, u32 table_id, u32 sw_if_index)
+{
+  u32 fib_index;
+
+  fib_index = fib_table_find (fproto, table_id);
+
+  if (~0 == fib_index)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  if (sw_if_index <= vec_len (svs_itf_db[fproto]))
+    return VNET_API_ERROR_INVALID_SW_IF_INDEX;
+
+  svs_itf_db[fproto][sw_if_index] = ~0;
+
+  vnet_feature_enable_disable ((FIB_PROTOCOL_IP4 == fproto ?
+				"ip4-unicast" :
+				"ip6-unicast"),
+			       (FIB_PROTOCOL_IP4 == fproto ?
+				"svs-ip4" :
+				"svs-ip6"), sw_if_index, 0, NULL, 0);
+
+  return (0);
+}
+
+void
+svs_walk (svs_walk_fn_t fn, void *ctx)
+{
+  fib_protocol_t fproto;
+  u32 ii, fib_index;
+
+  FOR_EACH_FIB_IP_PROTOCOL (fproto)
+  {
+    vec_foreach_index (ii, svs_itf_db[fproto])
+    {
+      fib_index = svs_itf_db[fproto][ii];
+
+      if (~0 != fib_index)
+	{
+	  if (WALK_CONTINUE != fn (fproto,
+				   fib_table_get_table_id (fib_index, fproto),
+				   ii, ctx))
+	    return;
+	}
+    }
+  }
+}
+
+typedef enum svs_next_t_
+{
+  SVS_NEXT_DROP,
+  SVS_N_NEXT,
+} svs_next_t;
+
+typedef struct svs_input_trace_t_
+{
+  u32 fib_index;
+} svs_input_trace_t;
+
+always_inline uword
+svs_input_inline (vlib_main_t * vm,
+		  vlib_node_runtime_t * node,
+		  vlib_frame_t * frame, fib_protocol_t fproto)
+{
+  u32 n_left_from, *from, *to_next, next_index;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  const load_balance_t *lb0;
+	  const lookup_dpo_t *lk0;
+	  u32 bi0, sw_if_index0;
+	  const dpo_id_t *dpo0;
+	  vlib_buffer_t *b0;
+	  svs_next_t next0;
+	  index_t lbi0;
+
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  if (FIB_PROTOCOL_IP4 == fproto)
+	    {
+	      ip4_header_t *ip0;
+
+	      ip0 = vlib_buffer_get_current (b0);
+	      lbi0 =
+		ip4_fib_forwarding_lookup (svs_itf_db[fproto][sw_if_index0],
+					   &ip0->src_address);
+	    }
+	  else
+	    {
+	      ip6_header_t *ip0;
+
+	      ip0 = vlib_buffer_get_current (b0);
+	      lbi0 = ip6_fib_table_fwding_lookup (&ip6_main,
+						  svs_itf_db[fproto]
+						  [sw_if_index0],
+						  &ip0->src_address);
+	    }
+	  lb0 = load_balance_get (lbi0);
+	  dpo0 = load_balance_get_fwd_bucket (lb0, 0);
+	  lk0 = lookup_dpo_get (dpo0->dpoi_index);
+
+	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = lk0->lkd_fib_index;
+
+	  vnet_feature_next (&next0, b0);
+
+	  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
+	    {
+	      svs_input_trace_t *tr;
+
+	      tr = vlib_add_trace (vm, node, b0, sizeof (*tr));
+	      tr->fib_index = vnet_buffer (b0)->sw_if_index[VLIB_TX];
+	    }
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next, bi0,
+					   next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+static uword
+svs_input_ip4 (vlib_main_t * vm,
+	       vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return svs_input_inline (vm, node, frame, FIB_PROTOCOL_IP4);
+}
+
+static uword
+svs_input_ip6 (vlib_main_t * vm,
+	       vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return svs_input_inline (vm, node, frame, FIB_PROTOCOL_IP6);
+}
+
+static u8 *
+format_svs_input_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  svs_input_trace_t *t = va_arg (*args, svs_input_trace_t *);
+
+  s = format (s, " fib_index %d", t->fib_index);
+  return s;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (svs_ip4_node) =
+{
+  .function = svs_input_ip4,
+  .name = "svs-ip4",
+  .vector_size = sizeof (u32),
+  .format_trace = format_svs_input_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_next_nodes = SVS_N_NEXT,
+  .next_nodes =
+  {
+    [SVS_NEXT_DROP] = "error-drop",
+  }
+};
+
+VLIB_REGISTER_NODE (svs_ip6_node) =
+{
+  .function = svs_input_ip6,
+  .name = "svs-ip6",
+  .vector_size = sizeof (u32),
+  .format_trace = format_svs_input_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .next_nodes =
+  {
+    [SVS_NEXT_DROP] = "error-drop",
+  }
+};
+
+VNET_FEATURE_INIT (svs_ip4_feat, static) =
+{
+  .arc_name = "ip4-unicast",
+  .node_name = "svs-ip4",
+};
+
+VNET_FEATURE_INIT (svs_ip6_feat, static) =
+{
+  .arc_name = "ip6-unicast",
+  .node_name = "svs-ip6",
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+svs_table_cli (vlib_main_t * vm,
+	       unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  fib_protocol_t fproto;
+  u32 table_id;
+  u8 add;
+
+  fproto = FIB_PROTOCOL_IP4;
+  table_id = ~0;
+  add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "ip4"))
+	fproto = FIB_PROTOCOL_IP4;
+      else if (unformat (input, "ip6"))
+	fproto = FIB_PROTOCOL_IP6;
+      else if (unformat (input, "table-id %d", &table_id))
+	;
+      else
+	break;
+    }
+
+  if (~0 == table_id)
+    return clib_error_return (0, "table-id must be specified");
+
+  if (add)
+    svs_table_add (fproto, table_id);
+  else
+    svs_table_delete (fproto, table_id);
+
+  return (NULL);
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (svs_table_cmd_cli, static) = {
+    .path = "svs table",
+    .short_help = "Source VRF select table [add|delete] [ip4|ip6] table-id X",
+    .function = svs_table_cli,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+svs_enable_cli (vlib_main_t * vm,
+		unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  u32 sw_if_index, table_id;
+  fib_protocol_t fproto;
+  vnet_main_t *vnm;
+  u8 enable;
+
+  vnm = vnet_get_main ();
+  sw_if_index = table_id = ~0;
+  fproto = FIB_PROTOCOL_IP4;
+  enable = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%U", unformat_vnet_sw_interface,
+		    vnm, &sw_if_index))
+	;
+      else if (unformat (input, "enable"))
+	enable = 1;
+      else if (unformat (input, "disable"))
+	enable = 0;
+      else if (unformat (input, "ip4"))
+	fproto = FIB_PROTOCOL_IP4;
+      else if (unformat (input, "ip6"))
+	fproto = FIB_PROTOCOL_IP6;
+      else if (unformat (input, "table-id %d", &table_id))
+	;
+      else
+	break;
+    }
+
+  if (~0 == sw_if_index)
+    return clib_error_return (0, "interface must be specified");
+  if (~0 == table_id)
+    return clib_error_return (0, "table-id must be specified");
+
+  if (enable)
+    svs_enable (fproto, table_id, sw_if_index);
+  else
+    svs_disable (fproto, table_id, sw_if_index);
+
+  return (NULL);
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (svs_enable_cli_cmd, static) = {
+    .path = "svs enable",
+    .short_help = "Source VRF select [enable|disable] [ip4|ip6] <table-id> X <interface>",
+    .function = svs_enable_cli,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+svs_route_cli (vlib_main_t * vm,
+	       unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  u32 table_id, src_table_id;
+  fib_prefix_t pfx;
+  int rv;
+  u8 add;
+
+  src_table_id = table_id = ~0;
+  add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "table-id %d", &table_id))
+	;
+      else if (unformat (input, "src-table-id %d", &src_table_id))
+	;
+      else if (unformat (input, "%U/%d",
+			 unformat_ip4_address, &pfx.fp_addr.ip4, &pfx.fp_len))
+	{
+	  pfx.fp_proto = FIB_PROTOCOL_IP4;
+	}
+      else if (unformat (input, "%U/%d",
+			 unformat_ip6_address, &pfx.fp_addr.ip6, &pfx.fp_len))
+	{
+	  pfx.fp_proto = FIB_PROTOCOL_IP6;
+	}
+      else
+	break;
+    }
+
+  if (~0 == table_id)
+    return clib_error_return (0, "table-id must be specified");
+  if (~0 == src_table_id)
+    return clib_error_return (0, "src-table-id must be specified");
+
+  if (add)
+    rv = svs_route_add (table_id, &pfx, src_table_id);
+  else
+    rv = svs_route_delete (table_id, &pfx);
+
+  if (rv != 0)
+    return clib_error_return (0,
+			      "failed, rv=%d:%U",
+			      (int) rv, format_vnet_api_errno, rv);
+
+  return (NULL);
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (svs_route_cmd_cli, static) = {
+    .path = "svs route",
+    .short_help = "Source VRF select route [add|delete] <table-id> <prefix> <src-table-id>",
+    .function = svs_route_cli,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+svs_show_cli (vlib_main_t * vm,
+	      unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  fib_protocol_t fproto;
+  u32 ii;
+
+  vlib_cli_output (vm, "Source VRF select interface to fib-index mappings:");
+  FOR_EACH_FIB_IP_PROTOCOL (fproto)
+  {
+    vlib_cli_output (vm, " %U", format_fib_protocol, fproto);
+    vec_foreach_index (ii, svs_itf_db[fproto])
+    {
+      if (~0 != svs_itf_db[fproto][ii])
+	vlib_cli_output (vm, "  %U -> %d", format_vnet_sw_if_index_name,
+			 vnet_get_main (), ii, svs_itf_db[fproto][ii]);
+    }
+  }
+  return (NULL);
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (svs_show_cli_cmd, static) = {
+  .path = "show svs",
+  .short_help = "Source VRF select show",
+  .function = svs_show_cli,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+svs_init (vlib_main_t * vm)
+{
+  ip6_table_bind_callback_t cbt6 = {
+    .function = svs_ip6_table_bind,
+  };
+  vec_add1 (ip6_main.table_bind_callbacks, cbt6);
+
+  ip4_table_bind_callback_t cbt4 = {
+    .function = svs_ip4_table_bind,
+  };
+  vec_add1 (ip4_main.table_bind_callbacks, cbt4);
+
+  return (NULL);
+}
+
+VLIB_INIT_FUNCTION (svs_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/svs/svs.h b/src/plugins/svs/svs.h
new file mode 100644
index 00000000000..80fefb740f3
--- /dev/null
+++ b/src/plugins/svs/svs.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Source VRF Selection matches against a packet's source address to set
+ * the VRF in which the subsequnet destination IP address lookup is done.
+ * If no match for the source address is found, then the RX interface's
+ * table/VRF is used.
+ */
+#ifndef __SVS_H__
+#define __SVS_H__
+
+#include <vnet/fib/fib_types.h>
+
+#define SVS_PLUGIN_VERSION_MAJOR 1
+#define SVS_PLUGIN_VERSION_MINOR 0
+
+extern int svs_table_add (fib_protocol_t fproto, u32 table_id);
+extern int svs_table_delete (fib_protocol_t fproto, u32 table_id);
+
+extern int svs_route_add (u32 table_id,
+			  const fib_prefix_t * pfx, u32 source_table_id);
+extern int svs_route_delete (u32 table_id, const fib_prefix_t * pfx);
+
+extern int svs_enable (fib_protocol_t fproto, u32 table_id, u32 sw_if_index);
+extern int svs_disable (fib_protocol_t fproto, u32 table_id, u32 sw_if_index);
+
+typedef walk_rc_t (*svs_walk_fn_t) (fib_protocol_t fproto, u32 table_id,
+				    u32 sw_if_index, void *ctx);
+
+extern void svs_walk (svs_walk_fn_t fn, void *ctx);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
+
+#endif
diff --git a/src/plugins/svs/svs_all_api_h.h b/src/plugins/svs/svs_all_api_h.h
new file mode 100644
index 00000000000..dff1657468f
--- /dev/null
+++ b/src/plugins/svs/svs_all_api_h.h
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/* Include the generated file, see BUILT_SOURCES in Makefile.am */
+
+#include <svs/svs.api.h>
diff --git a/src/plugins/svs/svs_api.c b/src/plugins/svs/svs_api.c
new file mode 100644
index 00000000000..8bdafc286ff
--- /dev/null
+++ b/src/plugins/svs/svs_api.c
@@ -0,0 +1,276 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+
+#include <vnet/vnet.h>
+#include <vnet/plugin/plugin.h>
+#include <svs/svs.h>
+#include <vnet/fib/fib_api.h>
+#include <vnet/ip/ip_types_api.h>
+
+#include <vpp/app/version.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+
+/* define message IDs */
+#include <svs/svs_msg_enum.h>
+
+/* define message structures */
+#define vl_typedefs
+#include <svs/svs_all_api_h.h>
+#undef vl_typedefs
+
+/* define generated endian-swappers */
+#define vl_endianfun
+#include <svs/svs_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
+#define vl_printfun
+#include <svs/svs_all_api_h.h>
+#undef vl_printfun
+
+/* Get the API version number */
+#define vl_api_version(n,v) static u32 api_version=(v);
+#include <svs/svs_all_api_h.h>
+#undef vl_api_version
+
+/**
+ * Base message ID fot the plugin
+ */
+static u32 svs_base_msg_id;
+
+#include <vlibapi/api_helper_macros.h>
+
+/* List of message types that this plugin understands */
+
+#define foreach_svs_plugin_api_msg                    \
+  _(SVS_PLUGIN_GET_VERSION, svs_plugin_get_version)   \
+  _(SVS_TABLE_ADD_DEL, svs_table_add_del)             \
+  _(SVS_ROUTE_ADD_DEL, svs_route_add_del)             \
+  _(SVS_ENABLE_DISABLE, svs_enable_disable)           \
+  _(SVS_DUMP, svs_dump)
+
+static void
+vl_api_svs_plugin_get_version_t_handler (vl_api_svs_plugin_get_version_t * mp)
+{
+  vl_api_svs_plugin_get_version_reply_t *rmp;
+  int msg_size = sizeof (*rmp);
+  unix_shared_memory_queue_t *q;
+
+  q = vl_api_client_index_to_input_queue (mp->client_index);
+  if (q == 0)
+    {
+      return;
+    }
+
+  rmp = vl_msg_api_alloc (msg_size);
+  memset (rmp, 0, msg_size);
+  rmp->_vl_msg_id =
+    ntohs (VL_API_SVS_PLUGIN_GET_VERSION_REPLY + svs_base_msg_id);
+  rmp->context = mp->context;
+  rmp->major = htonl (SVS_PLUGIN_VERSION_MAJOR);
+  rmp->minor = htonl (SVS_PLUGIN_VERSION_MINOR);
+
+  vl_msg_api_send_shmem (q, (u8 *) & rmp);
+}
+
+static void
+vl_api_svs_table_add_del_t_handler (vl_api_svs_table_add_del_t * mp)
+{
+  vl_api_svs_table_add_del_reply_t *rmp;
+  fib_protocol_t fproto;
+  int rv = 0;
+
+  fproto = fib_proto_from_api_address_family (mp->af);
+
+  if (mp->is_add)
+    {
+      svs_table_add (fproto, ntohl (mp->table_id));
+    }
+  else
+    {
+      svs_table_delete (fproto, ntohl (mp->table_id));
+    }
+
+  REPLY_MACRO (VL_API_SVS_TABLE_ADD_DEL_REPLY + svs_base_msg_id);
+}
+
+static void
+vl_api_svs_route_add_del_t_handler (vl_api_svs_route_add_del_t * mp)
+{
+  vl_api_svs_route_add_del_reply_t *rmp;
+  fib_prefix_t pfx;
+  int rv = 0;
+
+  ip_prefix_decode (&mp->prefix, &pfx);
+
+  if (mp->is_add)
+    {
+      rv =
+	svs_route_add (ntohl (mp->table_id), &pfx,
+		       ntohl (mp->source_table_id));
+    }
+  else
+    {
+      rv = svs_route_delete (ntohl (mp->table_id), &pfx);
+    }
+
+  REPLY_MACRO (VL_API_SVS_ROUTE_ADD_DEL_REPLY + svs_base_msg_id);
+}
+
+static void
+vl_api_svs_enable_disable_t_handler (vl_api_svs_enable_disable_t * mp)
+{
+  vl_api_svs_enable_disable_reply_t *rmp;
+  fib_protocol_t fproto;
+  int rv = 0;
+
+  VALIDATE_SW_IF_INDEX (mp);
+
+  fproto = fib_proto_from_api_address_family (mp->af);
+
+  if (mp->is_enable)
+    {
+      svs_enable (fproto, ntohl (mp->table_id), ntohl (mp->sw_if_index));
+    }
+  else
+    {
+      svs_disable (fproto, ntohl (mp->table_id), ntohl (mp->sw_if_index));
+    }
+
+  BAD_SW_IF_INDEX_LABEL;
+  REPLY_MACRO (VL_API_SVS_ENABLE_DISABLE_REPLY + svs_base_msg_id);
+}
+
+typedef struct svs_dump_walk_ctx_t_
+{
+  unix_shared_memory_queue_t *q;
+  u32 context;
+} svs_dump_walk_ctx_t;
+
+
+static walk_rc_t
+svs_send_details (fib_protocol_t fproto,
+		  u32 table_id, u32 sw_if_index, void *args)
+{
+  vl_api_svs_details_t *mp;
+  svs_dump_walk_ctx_t *ctx;
+
+  ctx = args;
+
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_SVS_DETAILS + svs_base_msg_id);
+
+  mp->context = ctx->context;
+  mp->sw_if_index = htonl (sw_if_index);
+  mp->table_id = htonl (table_id);
+  mp->af = fib_proto_to_api_address_family (fproto);
+
+  vl_msg_api_send_shmem (ctx->q, (u8 *) & mp);
+
+  return (WALK_CONTINUE);
+}
+
+static void
+vl_api_svs_dump_t_handler (vl_api_svs_dump_t * mp)
+{
+  unix_shared_memory_queue_t *q;
+
+  q = vl_api_client_index_to_input_queue (mp->client_index);
+  if (q == 0)
+    {
+      return;
+    }
+
+  svs_dump_walk_ctx_t ctx = {
+    .q = q,
+    .context = mp->context,
+  };
+
+  svs_walk (svs_send_details, &ctx);
+}
+
+#define vl_msg_name_crc_list
+#include <svs/svs_all_api_h.h>
+#undef vl_msg_name_crc_list
+
+/* Set up the API message handling tables */
+static clib_error_t *
+svs_plugin_api_hookup (vlib_main_t * vm)
+{
+#define _(N,n)                                                  \
+    vl_msg_api_set_handlers((VL_API_##N + svs_base_msg_id),     \
+                            #n,					\
+                            vl_api_##n##_t_handler,             \
+                            vl_noop_handler,                    \
+                            vl_api_##n##_t_endian,              \
+                            vl_api_##n##_t_print,               \
+                            sizeof(vl_api_##n##_t), 1);
+  foreach_svs_plugin_api_msg;
+#undef _
+
+  return 0;
+}
+
+static void
+setup_message_id_table (api_main_t * apim)
+{
+#define _(id,n,crc) \
+  vl_msg_api_add_msg_name_crc (apim, #n "_" #crc, id + svs_base_msg_id);
+  foreach_vl_msg_name_crc_svs;
+#undef _
+}
+
+static clib_error_t *
+svs_api_init (vlib_main_t * vm)
+{
+  clib_error_t *error = 0;
+
+  u8 *name = format (0, "svs_%08x%c", api_version, 0);
+
+  /* Ask for a correctly-sized block of API message decode slots */
+  svs_base_msg_id = vl_msg_api_get_msg_ids ((char *) name,
+					    VL_MSG_FIRST_AVAILABLE);
+
+  error = svs_plugin_api_hookup (vm);
+
+  /* Add our API messages to the global name_crc hash table */
+  setup_message_id_table (&api_main);
+
+  vec_free (name);
+
+  return error;
+}
+
+VLIB_INIT_FUNCTION (svs_api_init);
+
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () = {
+    .version = VPP_BUILD_VER,
+    .description = "Source VRF Select",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/svs/svs_msg_enum.h b/src/plugins/svs/svs_msg_enum.h
new file mode 100644
index 00000000000..550fdc8eced
--- /dev/null
+++ b/src/plugins/svs/svs_msg_enum.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef included_svs_msg_enum_h
+#define included_svs_msg_enum_h
+
+#include <vppinfra/byte_order.h>
+
+#define vl_msg_id(n,h) n,
+typedef enum {
+#include <svs/svs_all_api_h.h>
+    /* We'll want to know how many messages IDs we need... */
+    VL_MSG_FIRST_AVAILABLE,
+} vl_msg_id_t;
+#undef vl_msg_id
+
+#endif
diff --git a/src/vnet/fib/fib_api.c b/src/vnet/fib/fib_api.c
index eca5e614531..3c832eb01fb 100644
--- a/src/vnet/fib/fib_api.c
+++ b/src/vnet/fib/fib_api.c
@@ -266,3 +266,34 @@ fib_api_path_encode (const fib_route_path_encode_t * api_rpath,
     }
 }
 
+fib_protocol_t
+fib_proto_from_api_address_family (int af)
+{
+    switch (clib_net_to_host_u32 (af))
+    {
+    case ADDRESS_IP4:
+        return (FIB_PROTOCOL_IP4);
+    case ADDRESS_IP6:
+        return (FIB_PROTOCOL_IP6);
+    }
+
+    ASSERT(0);
+    return (FIB_PROTOCOL_IP4);
+}
+
+int
+fib_proto_to_api_address_family (fib_protocol_t fproto)
+{
+    switch (fproto)
+    {
+    case FIB_PROTOCOL_IP4:
+        return (clib_net_to_host_u32 (ADDRESS_IP4));
+    case FIB_PROTOCOL_IP6:
+        return (clib_net_to_host_u32 (ADDRESS_IP6));
+    default:
+        break;
+    }
+
+    ASSERT(0);
+    return (clib_net_to_host_u32 (ADDRESS_IP4));
+}
diff --git a/src/vnet/fib/fib_api.h b/src/vnet/fib/fib_api.h
index 66f0b51e891..041f962e3d7 100644
--- a/src/vnet/fib/fib_api.h
+++ b/src/vnet/fib/fib_api.h
@@ -73,4 +73,7 @@ struct _vl_api_fib_path;
 extern int fib_path_api_parse(const struct _vl_api_fib_path *in,
                               fib_route_path_t *out);
 
+extern fib_protocol_t fib_proto_from_api_address_family (int af);
+extern int fib_proto_to_api_address_family (fib_protocol_t fproto);
+
 #endif /* __FIB_API_H__ */
diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py
index f63ca6a4180..5ef1b309e06 100644
--- a/test/vpp_papi_provider.py
+++ b/test/vpp_papi_provider.py
@@ -3865,3 +3865,32 @@ class VppPapiProvider(object):
 
     def memif_socket_filename_dump(self):
         return self.api(self.papi.memif_socket_filename_dump, {})
+
+    def svs_table_add_del(self, af, table_id, is_add=1):
+        return self.api(self.papi.svs_table_add_del,
+                        {
+                            'table_id': table_id,
+                            'is_add': is_add,
+                            'af': af,
+                        })
+
+    def svs_route_add_del(self, table_id, prefix, src_table_id, is_add=1):
+        return self.api(self.papi.svs_route_add_del,
+                        {
+                            'table_id': table_id,
+                            'source_table_id': src_table_id,
+                            'prefix': prefix,
+                            'is_add': is_add,
+                        })
+
+    def svs_enable_disable(self, af, table_id, sw_if_index, is_enable=1):
+        return self.api(self.papi.svs_enable_disable,
+                        {
+                            'af': af,
+                            'table_id': table_id,
+                            'sw_if_index': sw_if_index,
+                            'is_enable': is_enable,
+                        })
+
+    def svs_dump(self):
+        return self.api(self.papi.svs_dump, {})