Proxy ND (RFC4389 - or a sub-set thereof). This allows the 'emulation' of bridging. That is hosts in one sub-net reachable via differenet interfaces.

Introducate a new API command:
  ip6 nd proxy <host-address> <interface>

this indicates 2 things;
 1) that host <host-address> is reachable out of interface <interface>. VPP will thus install that route.
 2) NS requests sent to <host-address> will be responeded to (i.e. proxied).

Change-Id: I863f967fdb5097ab3b574769c70afdbfc8d5478a
Signed-off-by: Neale Ranns <nranns@cisco.com>

11 files changed, 721 insertions, 79 deletions

diff --git a/src/vat/api_format.c b/src/vat/api_format.c
index fb596fe69d0..08a2a774fce 100644
--- a/src/vat/api_format.c
+++ b/src/vat/api_format.c
@@ -3913,6 +3913,7 @@ _(dhcp_client_config_reply)                             \
 _(set_ip_flow_hash_reply)                               \
 _(sw_interface_ip6_enable_disable_reply)                \
 _(sw_interface_ip6_set_link_local_address_reply)        \
+_(ip6nd_proxy_add_del_reply)                            \
 _(sw_interface_ip6nd_ra_prefix_reply)                   \
 _(sw_interface_ip6nd_ra_config_reply)                   \
 _(set_arp_neighbor_limit_reply)                         \
@@ -4092,6 +4093,8 @@ _(SW_INTERFACE_IP6_ENABLE_DISABLE_REPLY,                                \
   sw_interface_ip6_enable_disable_reply)                                \
 _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS_REPLY,                        \
   sw_interface_ip6_set_link_local_address_reply)                        \
+_(IP6ND_PROXY_ADD_DEL_REPLY, ip6nd_proxy_add_del_reply)                 \
+_(IP6ND_PROXY_DETAILS, ip6nd_proxy_details)                             \
 _(SW_INTERFACE_IP6ND_RA_PREFIX_REPLY,                                   \
   sw_interface_ip6nd_ra_prefix_reply)                                   \
 _(SW_INTERFACE_IP6ND_RA_CONFIG_REPLY,                                   \
@@ -7968,6 +7971,109 @@ api_sw_interface_ip6_set_link_local_address (vat_main_t * vam)
   return ret;
 }
 
+static int
+api_ip6nd_proxy_add_del (vat_main_t * vam)
+{
+  unformat_input_t *i = vam->input;
+  vl_api_ip6nd_proxy_add_del_t *mp;
+  u32 sw_if_index = ~0;
+  u8 v6_address_set = 0;
+  ip6_address_t v6address;
+  u8 is_del = 0;
+  int ret;
+
+  /* Parse args required to build the message */
+  while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (i, "%U", api_unformat_sw_if_index, vam, &sw_if_index))
+	;
+      else if (unformat (i, "sw_if_index %d", &sw_if_index))
+	;
+      else if (unformat (i, "%U", unformat_ip6_address, &v6address))
+	v6_address_set = 1;
+      if (unformat (i, "del"))
+	is_del = 1;
+      else
+	{
+	  clib_warning ("parse error '%U'", format_unformat_error, i);
+	  return -99;
+	}
+    }
+
+  if (sw_if_index == ~0)
+    {
+      errmsg ("missing interface name or sw_if_index");
+      return -99;
+    }
+  if (!v6_address_set)
+    {
+      errmsg ("no address set");
+      return -99;
+    }
+
+  /* Construct the API message */
+  M (IP6ND_PROXY_ADD_DEL, mp);
+
+  mp->is_del = is_del;
+  mp->sw_if_index = ntohl (sw_if_index);
+  clib_memcpy (mp->address, &v6address, sizeof (v6address));
+
+  /* send it... */
+  S (mp);
+
+  /* Wait for a reply, return good/bad news  */
+  W (ret);
+  return ret;
+}
+
+static int
+api_ip6nd_proxy_dump (vat_main_t * vam)
+{
+  vl_api_ip6nd_proxy_dump_t *mp;
+  vl_api_control_ping_t *mp_ping;
+  int ret;
+
+  M (IP6ND_PROXY_DUMP, mp);
+
+  S (mp);
+
+  /* Use a control ping for synchronization */
+  M (CONTROL_PING, mp_ping);
+  S (mp_ping);
+
+  W (ret);
+  return ret;
+}
+
+static void vl_api_ip6nd_proxy_details_t_handler
+  (vl_api_ip6nd_proxy_details_t * mp)
+{
+  vat_main_t *vam = &vat_main;
+
+  print (vam->ofp, "host %U sw_if_index %d",
+	 format_ip6_address, mp->address, ntohl (mp->sw_if_index));
+}
+
+static void vl_api_ip6nd_proxy_details_t_handler_json
+  (vl_api_ip6nd_proxy_details_t * mp)
+{
+  vat_main_t *vam = &vat_main;
+  struct in6_addr ip6;
+  vat_json_node_t *node = NULL;
+
+  if (VAT_JSON_ARRAY != vam->json_tree.type)
+    {
+      ASSERT (VAT_JSON_NONE == vam->json_tree.type);
+      vat_json_init_array (&vam->json_tree);
+    }
+  node = vat_json_array_add (&vam->json_tree);
+
+  vat_json_init_object (node);
+  vat_json_object_add_uint (node, "sw_if_index", ntohl (mp->sw_if_index));
+
+  clib_memcpy (&ip6, mp->address, sizeof (ip6));
+  vat_json_object_add_ip6 (node, "host", ip6);
+}
 
 static int
 api_sw_interface_ip6nd_ra_prefix (vat_main_t * vam)
@@ -17974,6 +18080,9 @@ _(sw_interface_ip6_enable_disable,                                      \
   "<intfc> | sw_if_index <id> enable | disable")                        \
 _(sw_interface_ip6_set_link_local_address,                              \
   "<intfc> | sw_if_index <id> <ip6-address>/<mask-width>")              \
+_(ip6nd_proxy_add_del,                                                  \
+  "<intfc> | sw_if_index <id> <ip6-address>")                           \
+_(ip6nd_proxy_dump, "")                                                 \
 _(sw_interface_ip6nd_ra_prefix,                                         \
   "<intfc> | sw_if_index <id> <ip6-address>/<mask-width>\n"             \
   "val_life <n> pref_life <n> [def] [noadv] [offl] [noauto]\n"          \
diff --git a/src/vnet/fib/fib_entry.h b/src/vnet/fib/fib_entry.h
index 9dfb8127124..12fa9eb4e9b 100644
--- a/src/vnet/fib/fib_entry.h
+++ b/src/vnet/fib/fib_entry.h
@@ -81,6 +81,10 @@ typedef enum fib_source_t_ {
      */
     FIB_SOURCE_DHCP,
     /**
+     * IPv6 Proxy ND
+     */
+    FIB_SOURCE_IP6_ND_PROXY,
+    /**
      * Adjacency source.
      * routes created as a result of ARP/ND entries. This is lower priority
      * then the API/CLI. This is on purpose. trust me.
@@ -141,6 +145,7 @@ STATIC_ASSERT (sizeof(fib_source_t) == 1,
     [FIB_SOURCE_LISP] = "LISP", 			\
     [FIB_SOURCE_CLASSIFY] = "classify",			\
     [FIB_SOURCE_DHCP] = "DHCP",   			\
+    [FIB_SOURCE_IP6_ND_PROXY] = "IPv6-proxy-nd",        \
     [FIB_SOURCE_RR] = "recursive-resolution",	        \
     [FIB_SOURCE_AE] = "attached_export",	        \
     [FIB_SOURCE_MPLS] = "mpls",           	        \
diff --git a/src/vnet/fib/fib_entry_src_api.c b/src/vnet/fib/fib_entry_src_api.c
index edc8a47bc17..1277bd65af7 100644
--- a/src/vnet/fib/fib_entry_src_api.c
+++ b/src/vnet/fib/fib_entry_src_api.c
@@ -116,4 +116,5 @@ fib_entry_src_api_register (void)
     fib_entry_src_register(FIB_SOURCE_API, &api_src_vft);
     fib_entry_src_register(FIB_SOURCE_CLI, &api_src_vft);
     fib_entry_src_register(FIB_SOURCE_DHCP, &api_src_vft);
+    fib_entry_src_register(FIB_SOURCE_IP6_ND_PROXY, &api_src_vft);
 }
diff --git a/src/vnet/ip/ip.api b/src/vnet/ip/ip.api
index ff16e781c05..b5e730fcbea 100644
--- a/src/vnet/ip/ip.api
+++ b/src/vnet/ip/ip.api
@@ -294,6 +294,56 @@ define sw_interface_ip6nd_ra_prefix_reply
   i32 retval;
 };
 
+/** \brief IPv6 ND proxy config
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param sw_if_index - The interface the host is on
+    @param address - The address of the host for which to proxy for
+    @param is_add - Adding or deleting
+*/
+define ip6nd_proxy_add_del
+{
+  u32 client_index;
+  u32 context;
+  u32 sw_if_index;
+  u8 is_del;
+  u8 address[16];
+};
+
+/** \brief IPv6 ND proxy response
+    @param context - sender context, to match reply w/ request
+    @param retval - return code for the request
+*/
+define ip6nd_proxy_add_del_reply
+{
+  u32 context;
+  i32 retval;
+};
+
+/** \brief IPv6 ND proxy details returned after request
+    @param context - sender context, to match reply w/ request
+    @param retval - return code for the request
+*/
+define ip6nd_proxy_details
+{
+  u32 client_index;
+  u32 context;
+  u32 sw_if_index;
+  u8 address[16];
+};
+
+/** \brief IPv6 ND proxy dump request
+    @param context - sender context, to match reply w/ request
+    @param retval - return code for the request
+    @param sw_if_index - The interface the host is on
+    @param address - The address of the host for which to proxy for
+*/
+define ip6nd_proxy_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
 /** \brief IPv6 interface enable / disable request
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
diff --git a/src/vnet/ip/ip6.h b/src/vnet/ip/ip6.h
index 535f24c05d1..f402b0117c0 100644
--- a/src/vnet/ip/ip6.h
+++ b/src/vnet/ip/ip6.h
@@ -217,24 +217,6 @@ extern vlib_node_registration_t ip6_discover_neighbor_node;
 extern vlib_node_registration_t ip6_glean_node;
 extern vlib_node_registration_t ip6_midchain_node;
 
-extern vlib_node_registration_t ip6_icmp_neighbor_discovery_event_node;
-
-/* ipv6 neighbor discovery - timer/event types */
-typedef enum
-{
-  ICMP6_ND_EVENT_INIT,
-} ip6_icmp_neighbor_discovery_event_type_t;
-
-typedef union
-{
-  u32 add_del_swindex;
-  struct
-  {
-    u32 up_down_swindex;
-    u32 fib_index;
-  } up_down_event;
-} ip6_icmp_neighbor_discovery_event_data_t;
-
 always_inline uword
 ip6_destination_matches_route (const ip6_main_t * im,
 			       const ip6_address_t * key,
@@ -342,8 +324,6 @@ int ip6_address_compare (ip6_address_t * a1, ip6_address_t * a2);
 clib_error_t *ip6_probe_neighbor (vlib_main_t * vm, ip6_address_t * dst,
 				  u32 sw_if_index);
 
-clib_error_t *ip6_set_neighbor_limit (u32 neighbor_limit);
-
 uword
 ip6_udp_register_listener (vlib_main_t * vm,
 			   u16 dst_port, u32 next_node_index);
@@ -359,19 +339,6 @@ serialize_function_t serialize_vnet_ip6_main, unserialize_vnet_ip6_main;
 void ip6_ethernet_update_adjacency (vnet_main_t * vnm,
 				    u32 sw_if_index, u32 ai);
 
-int
-vnet_set_ip6_ethernet_neighbor (vlib_main_t * vm,
-				u32 sw_if_index,
-				ip6_address_t * a,
-				u8 * link_layer_address,
-				uword n_bytes_link_layer_address,
-				int is_static);
-int
-vnet_unset_ip6_ethernet_neighbor (vlib_main_t * vm,
-				  u32 sw_if_index,
-				  ip6_address_t * a,
-				  u8 * link_layer_address,
-				  uword n_bytes_link_layer_address);
 
 void
 ip6_link_local_address_from_ethernet_mac_address (ip6_address_t * ip,
@@ -384,22 +351,6 @@ ip6_ethernet_mac_address_from_link_local_address (u8 * mac,
 int vnet_set_ip6_flow_hash (u32 table_id,
 			    flow_hash_config_t flow_hash_config);
 
-int
-ip6_neighbor_ra_config (vlib_main_t * vm, u32 sw_if_index,
-			u8 suppress, u8 managed, u8 other,
-			u8 ll_option, u8 send_unicast, u8 cease,
-			u8 use_lifetime, u32 lifetime,
-			u32 initial_count, u32 initial_interval,
-			u32 max_interval, u32 min_interval, u8 is_no);
-
-int
-ip6_neighbor_ra_prefix (vlib_main_t * vm, u32 sw_if_index,
-			ip6_address_t * prefix_addr, u8 prefix_len,
-			u8 use_default, u32 val_lifetime, u32 pref_lifetime,
-			u8 no_advertise, u8 off_link, u8 no_autoconfig,
-			u8 no_onlink, u8 is_no);
-
-
 clib_error_t *enable_ip6_interface (vlib_main_t * vm, u32 sw_if_index);
 
 clib_error_t *disable_ip6_interface (vlib_main_t * vm, u32 sw_if_index);
@@ -410,12 +361,6 @@ clib_error_t *set_ip6_link_local_address (vlib_main_t * vm,
 					  u32 sw_if_index,
 					  ip6_address_t * address);
 
-void vnet_register_ip6_neighbor_resolution_event (vnet_main_t * vnm,
-						  void *address_arg,
-						  uword node_index,
-						  uword type_opaque,
-						  uword data);
-
 int vnet_add_del_ip6_nd_change_event (vnet_main_t * vnm,
 				      void *data_callback,
 				      u32 pid,
diff --git a/src/vnet/ip/ip6_neighbor.c b/src/vnet/ip/ip6_neighbor.c
index 43d68cd18bb..715891b8100 100644
--- a/src/vnet/ip/ip6_neighbor.c
+++ b/src/vnet/ip/ip6_neighbor.c
@@ -197,6 +197,22 @@ typedef struct
 
 } ip6_neighbor_main_t;
 
+/* ipv6 neighbor discovery - timer/event types */
+typedef enum
+{
+  ICMP6_ND_EVENT_INIT,
+} ip6_icmp_neighbor_discovery_event_type_t;
+
+typedef union
+{
+  u32 add_del_swindex;
+  struct
+  {
+    u32 up_down_swindex;
+    u32 fib_index;
+  } up_down_event;
+} ip6_icmp_neighbor_discovery_event_data_t;
+
 static ip6_neighbor_main_t ip6_neighbor_main;
 static ip6_address_t ip6a_zero;	/* ip6 address 0 */
 
@@ -312,7 +328,7 @@ static void ip6_neighbor_set_unset_rpc_callback
 static void set_unset_ip6_neighbor_rpc
   (vlib_main_t * vm,
    u32 sw_if_index,
-   ip6_address_t * a, u8 * link_layer_addreess, int is_add, int is_static)
+   ip6_address_t * a, u8 * link_layer_address, int is_add, int is_static)
 {
   ip6_neighbor_set_unset_rpc_args_t args;
   void vl_api_rpc_call_main_thread (void *fp, u8 * data, u32 data_length);
@@ -321,7 +337,8 @@ static void set_unset_ip6_neighbor_rpc
   args.is_add = is_add;
   args.is_static = is_static;
   clib_memcpy (&args.addr, a, sizeof (*a));
-  clib_memcpy (args.link_layer_address, link_layer_addreess, 6);
+  if (NULL != link_layer_address)
+    clib_memcpy (args.link_layer_address, link_layer_address, 6);
 
   vl_api_rpc_call_main_thread (ip6_neighbor_set_unset_rpc_callback,
 			       (u8 *) & args, sizeof (args));
@@ -1028,14 +1045,35 @@ icmp6_neighbor_solicitation_or_advertisement (vlib_main_t * vm,
 							  &h0->target_address,
 							  128);
 
-		  if (FIB_NODE_INDEX_INVALID == fei ||
-		      !(FIB_ENTRY_FLAG_LOCAL &
-			fib_entry_get_flags_for_source (fei,
-							FIB_SOURCE_INTERFACE)))
+		  if (FIB_NODE_INDEX_INVALID == fei)
 		    {
+		      /* The target address is not in the FIB */
 		      error0 =
 			ICMP6_ERROR_NEIGHBOR_SOLICITATION_SOURCE_UNKNOWN;
 		    }
+		  else
+		    {
+		      if (FIB_ENTRY_FLAG_LOCAL &
+			  fib_entry_get_flags_for_source (fei,
+							  FIB_SOURCE_INTERFACE))
+			{
+			  /* It's an address that belongs to one of our interfaces
+			   * that's good. */
+			}
+		      else
+			if (fib_entry_is_sourced
+			    (fei, FIB_SOURCE_IP6_ND_PROXY))
+			{
+			  /* The address was added by IPv6 Proxy ND config.
+			   * We should only respond to these if the NS arrived on
+			   * the link that has a matching covering prefix */
+			}
+		      else
+			{
+			  error0 =
+			    ICMP6_ERROR_NEIGHBOR_SOLICITATION_SOURCE_UNKNOWN;
+			}
+		    }
 		}
 	    }
 
@@ -4021,6 +4059,92 @@ vnet_ip6_nd_term (vlib_main_t * vm,
 
 }
 
+int
+ip6_neighbor_proxy_add_del (u32 sw_if_index, ip6_address_t * addr, u8 is_del)
+{
+  u32 fib_index;
+
+  fib_prefix_t pfx = {
+    .fp_len = 128,
+    .fp_proto = FIB_PROTOCOL_IP6,
+    .fp_addr = {
+		.ip6 = *addr,
+		},
+  };
+  ip46_address_t nh = {
+    .ip6 = *addr,
+  };
+
+  fib_index = ip6_fib_table_get_index_for_sw_if_index (sw_if_index);
+
+  if (~0 == fib_index)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  if (is_del)
+    {
+      fib_table_entry_path_remove (fib_index,
+				   &pfx,
+				   FIB_SOURCE_IP6_ND_PROXY,
+				   FIB_PROTOCOL_IP6,
+				   &nh,
+				   sw_if_index,
+				   ~0, 1, FIB_ROUTE_PATH_FLAG_NONE);
+      /* flush the ND cache of this address if it's there */
+      vnet_unset_ip6_ethernet_neighbor (vlib_get_main (),
+					sw_if_index, addr, NULL, 0);
+    }
+  else
+    {
+      fib_table_entry_path_add (fib_index,
+				&pfx,
+				FIB_SOURCE_IP6_ND_PROXY,
+				FIB_ENTRY_FLAG_NONE,
+				FIB_PROTOCOL_IP6,
+				&nh,
+				sw_if_index,
+				~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
+    }
+  return (0);
+}
+
+static clib_error_t *
+set_ip6_nd_proxy_cmd (vlib_main_t * vm,
+		      unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  clib_error_t *error = 0;
+  ip6_address_t addr;
+  u32 sw_if_index;
+  u8 is_del = 0;
+
+  if (unformat_user (input, unformat_vnet_sw_interface, vnm, &sw_if_index))
+    {
+      /* get the rest of the command */
+      while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+	{
+	  if (unformat (input, "%U", unformat_ip6_address, &addr))
+	    break;
+	  else if (unformat (input, "delete") || unformat (input, "del"))
+	    is_del = 1;
+	  else
+	    return (unformat_parse_error (input));
+	}
+    }
+
+  ip6_neighbor_proxy_add_del (sw_if_index, &addr, is_del);
+
+  return error;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (set_ip6_nd_proxy_command, static) =
+{
+  .path = "set ip6 nd proxy",
+  .short_help = "set ip6 nd proxy <HOST> <INTERFACE>",
+  .function = set_ip6_nd_proxy_cmd,
+};
+/* *INDENT-ON* */
+
 void
 ethernet_ndp_change_mac (u32 sw_if_index)
 {
diff --git a/src/vnet/ip/ip6_neighbor.h b/src/vnet/ip/ip6_neighbor.h
index b2c9f48ae8a..3d256316a47 100644
--- a/src/vnet/ip/ip6_neighbor.h
+++ b/src/vnet/ip/ip6_neighbor.h
@@ -39,7 +39,47 @@ typedef struct
   fib_node_index_t fib_entry_index;
 } ip6_neighbor_t;
 
-ip6_neighbor_t *ip6_neighbors_entries (u32 sw_if_index);
+extern ip6_neighbor_t *ip6_neighbors_entries (u32 sw_if_index);
+
+extern int ip6_neighbor_ra_config (vlib_main_t * vm, u32 sw_if_index,
+				   u8 suppress, u8 managed, u8 other,
+				   u8 ll_option, u8 send_unicast, u8 cease,
+				   u8 use_lifetime, u32 lifetime,
+				   u32 initial_count, u32 initial_interval,
+				   u32 max_interval, u32 min_interval,
+				   u8 is_no);
+
+extern int ip6_neighbor_ra_prefix (vlib_main_t * vm, u32 sw_if_index,
+				   ip6_address_t * prefix_addr, u8 prefix_len,
+				   u8 use_default, u32 val_lifetime,
+				   u32 pref_lifetime, u8 no_advertise,
+				   u8 off_link, u8 no_autoconfig,
+				   u8 no_onlink, u8 is_no);
+
+extern clib_error_t *ip6_set_neighbor_limit (u32 neighbor_limit);
+
+extern void vnet_register_ip6_neighbor_resolution_event (vnet_main_t * vnm,
+							 void *address_arg,
+							 uword node_index,
+							 uword type_opaque,
+							 uword data);
+
+extern int vnet_set_ip6_ethernet_neighbor (vlib_main_t * vm,
+					   u32 sw_if_index,
+					   ip6_address_t * a,
+					   u8 * link_layer_address,
+					   uword n_bytes_link_layer_address,
+					   int is_static);
+
+extern int vnet_unset_ip6_ethernet_neighbor (vlib_main_t * vm,
+					     u32 sw_if_index,
+					     ip6_address_t * a,
+					     u8 * link_layer_address,
+					     uword
+					     n_bytes_link_layer_address);
+
+extern int ip6_neighbor_proxy_add_del (u32 sw_if_index,
+				       ip6_address_t * addr, u8 is_add);
 
 #endif /* included_ip6_neighbor_h */
 
diff --git a/src/vnet/ip/ip_api.c b/src/vnet/ip/ip_api.c
index ab164a5f467..df9ca939c24 100644
--- a/src/vnet/ip/ip_api.c
+++ b/src/vnet/ip/ip_api.c
@@ -72,6 +72,9 @@ _(IP_ADD_DEL_ROUTE, ip_add_del_route)                                   \
 _(SET_IP_FLOW_HASH,set_ip_flow_hash)                                    \
 _(SW_INTERFACE_IP6ND_RA_CONFIG, sw_interface_ip6nd_ra_config)           \
 _(SW_INTERFACE_IP6ND_RA_PREFIX, sw_interface_ip6nd_ra_prefix)           \
+_(IP6ND_PROXY_ADD_DEL, ip6nd_proxy_add_del)                             \
+_(IP6ND_PROXY_DUMP, ip6nd_proxy_dump)                                   \
+_(IP6ND_PROXY_DETAILS, ip6nd_proxy_details)                             \
 _(SW_INTERFACE_IP6_ENABLE_DISABLE, sw_interface_ip6_enable_disable )    \
 _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS, 				\
   sw_interface_ip6_set_link_local_address)
@@ -1400,6 +1403,105 @@ static void
 }
 
 static void
+send_ip6nd_proxy_details (unix_shared_memory_queue_t * q,
+			  u32 context,
+			  const ip46_address_t * addr, u32 sw_if_index)
+{
+  vl_api_ip6nd_proxy_details_t *mp;
+
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_IP6ND_PROXY_DETAILS);
+  mp->context = context;
+  mp->sw_if_index = htonl (sw_if_index);
+  memcpy (mp->address, addr, 16);
+
+  vl_msg_api_send_shmem (q, (u8 *) & mp);
+}
+
+static void
+vl_api_ip6nd_proxy_details_t_handler (vl_api_ip_neighbor_details_t * mp)
+{
+  clib_warning ("BUG");
+}
+
+typedef struct api_ip6nd_proxy_fib_table_walk_ctx_t_
+{
+  u32 *indices;
+} api_ip6nd_proxy_fib_table_walk_ctx_t;
+
+static int
+api_ip6nd_proxy_fib_table_walk (fib_node_index_t fei, void *arg)
+{
+  api_ip6nd_proxy_fib_table_walk_ctx_t *ctx = arg;
+
+  if (fib_entry_is_sourced (fei, FIB_SOURCE_IP6_ND_PROXY))
+    {
+      vec_add1 (ctx->indices, fei);
+    }
+
+  return (1);
+}
+
+static void
+vl_api_ip6nd_proxy_dump_t_handler (vl_api_ip6nd_proxy_dump_t * mp)
+{
+  ip6_main_t *im6 = &ip6_main;
+  fib_table_t *fib_table;
+  api_ip6nd_proxy_fib_table_walk_ctx_t ctx = {
+    .indices = NULL,
+  };
+  fib_node_index_t *feip;
+  fib_prefix_t pfx;
+  unix_shared_memory_queue_t *q;
+
+  q = vl_api_client_index_to_input_queue (mp->client_index);
+  if (q == 0)
+    {
+      return;
+    }
+
+  /* *INDENT-OFF* */
+  pool_foreach (fib_table, im6->fibs,
+  ({
+    fib_table_walk(fib_table->ft_index,
+                   FIB_PROTOCOL_IP6,
+                   api_ip6nd_proxy_fib_table_walk,
+                   &ctx);
+  }));
+  /* *INDENT-ON* */
+
+  vec_sort_with_function (ctx.indices, fib_entry_cmp_for_sort);
+
+  vec_foreach (feip, ctx.indices)
+  {
+    fib_entry_get_prefix (*feip, &pfx);
+
+    send_ip6nd_proxy_details (q,
+			      mp->context,
+			      &pfx.fp_addr,
+			      fib_entry_get_resolving_interface (*feip));
+  }
+
+  vec_free (ctx.indices);
+}
+
+static void
+vl_api_ip6nd_proxy_add_del_t_handler (vl_api_ip6nd_proxy_add_del_t * mp)
+{
+  vl_api_ip6nd_proxy_add_del_reply_t *rmp;
+  int rv = 0;
+
+  VALIDATE_SW_IF_INDEX (mp);
+
+  rv = ip6_neighbor_proxy_add_del (ntohl (mp->sw_if_index),
+				   (ip6_address_t *) mp->address, mp->is_del);
+
+  BAD_SW_IF_INDEX_LABEL;
+  REPLY_MACRO (VL_API_IP6ND_PROXY_ADD_DEL_REPLY);
+}
+
+static void
   vl_api_sw_interface_ip6_enable_disable_t_handler
   (vl_api_sw_interface_ip6_enable_disable_t * mp)
 {
diff --git a/src/vnet/ip/lookup.c b/src/vnet/ip/lookup.c
index 807b87b6037..8607fa5f200 100644
--- a/src/vnet/ip/lookup.c
+++ b/src/vnet/ip/lookup.c
@@ -49,6 +49,7 @@
 #include <vnet/dpo/punt_dpo.h>
 #include <vnet/dpo/receive_dpo.h>
 #include <vnet/dpo/ip_null_dpo.h>
+#include <vnet/ip/ip6_neighbor.h>
 
 /**
  * @file
diff --git a/test/test_ip6.py b/test/test_ip6.py
index b8278329ba9..070e2d7df1a 100644
--- a/test/test_ip6.py
+++ b/test/test_ip6.py
@@ -1,17 +1,20 @@
 #!/usr/bin/env python
 
 import unittest
-import socket
+from socket import AF_INET6
 
 from framework import VppTestCase, VppTestRunner
 from vpp_sub_interface import VppSubInterface, VppDot1QSubint
 from vpp_pg_interface import is_ipv6_misc
+from vpp_neighbor import find_nbr
 
 from scapy.packet import Raw
 from scapy.layers.l2 import Ether, Dot1Q
 from scapy.layers.inet6 import IPv6, UDP, ICMPv6ND_NS, ICMPv6ND_RS, \
     ICMPv6ND_RA, ICMPv6NDOptSrcLLAddr, getmacbyip6, ICMPv6MRD_Solicitation, \
-    ICMPv6NDOptMTU, ICMPv6NDOptSrcLLAddr, ICMPv6NDOptPrefixInfo
+    ICMPv6NDOptMTU, ICMPv6NDOptSrcLLAddr, ICMPv6NDOptPrefixInfo, \
+    ICMPv6ND_NA, ICMPv6NDOptDstLLAddr
+
 from util import ppp
 from scapy.utils6 import in6_getnsma, in6_getnsmac, in6_ptop, in6_islladdr, \
     in6_mactoifaceid, in6_ismaddr
@@ -24,7 +27,71 @@ def mk_ll_addr(mac):
     return addr
 
 
-class TestIPv6(VppTestCase):
+class TestIPv6ND(VppTestCase):
+    def validate_ra(self, intf, rx, dst_ip=None):
+        if not dst_ip:
+            dst_ip = intf.remote_ip6
+
+        # unicasted packets must come to the unicast mac
+        self.assertEqual(rx[Ether].dst, intf.remote_mac)
+
+        # and from the router's MAC
+        self.assertEqual(rx[Ether].src, intf.local_mac)
+
+        # the rx'd RA should be addressed to the sender's source
+        self.assertTrue(rx.haslayer(ICMPv6ND_RA))
+        self.assertEqual(in6_ptop(rx[IPv6].dst),
+                         in6_ptop(dst_ip))
+
+        # and come from the router's link local
+        self.assertTrue(in6_islladdr(rx[IPv6].src))
+        self.assertEqual(in6_ptop(rx[IPv6].src),
+                         in6_ptop(mk_ll_addr(intf.local_mac)))
+
+    def validate_na(self, intf, rx, dst_ip=None, tgt_ip=None):
+        if not dst_ip:
+            dst_ip = intf.remote_ip6
+        if not tgt_ip:
+            dst_ip = intf.local_ip6
+
+        # unicasted packets must come to the unicast mac
+        self.assertEqual(rx[Ether].dst, intf.remote_mac)
+
+        # and from the router's MAC
+        self.assertEqual(rx[Ether].src, intf.local_mac)
+
+        # the rx'd NA should be addressed to the sender's source
+        self.assertTrue(rx.haslayer(ICMPv6ND_NA))
+        self.assertEqual(in6_ptop(rx[IPv6].dst),
+                         in6_ptop(dst_ip))
+
+        # and come from the target address
+        self.assertEqual(in6_ptop(rx[IPv6].src), in6_ptop(tgt_ip))
+
+        # Dest link-layer options should have the router's MAC
+        dll = rx[ICMPv6NDOptDstLLAddr]
+        self.assertEqual(dll.lladdr, intf.local_mac)
+
+    def send_and_expect_ra(self, intf, pkts, remark, dst_ip=None,
+                           filter_out_fn=is_ipv6_misc):
+        intf.add_stream(pkts)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        rx = intf.get_capture(1, filter_out_fn=filter_out_fn)
+
+        self.assertEqual(len(rx), 1)
+        rx = rx[0]
+        self.validate_ra(intf, rx, dst_ip)
+
+    def send_and_assert_no_replies(self, intf, pkts, remark):
+        intf.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        intf.assert_nothing_captured(remark=remark)
+
+
+class TestIPv6(TestIPv6ND):
     """ IPv6 Test Case """
 
     @classmethod
@@ -112,7 +179,7 @@ class TestIPv6(VppTestCase):
         n_int = len(self.interfaces)
         percent = 0
         counter = 0.0
-        dest_addr = socket.inet_pton(socket.AF_INET6, "fd02::1")
+        dest_addr = inet_pton(AF_INET6, "fd02::1")
         dest_addr_len = 128
         for i in self.interfaces:
             next_hop_address = i.local_ip6n
@@ -225,12 +292,6 @@ class TestIPv6(VppTestCase):
             pkts = i.parent.get_capture()
             self.verify_capture(i, pkts)
 
-    def send_and_assert_no_replies(self, intf, pkts, remark):
-        intf.add_stream(pkts)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        intf.assert_nothing_captured(remark=remark)
-
     def test_ns(self):
         """ IPv6 Neighbour Solicitation Exceptions
 
@@ -243,8 +304,8 @@ class TestIPv6(VppTestCase):
         #
         # An NS from a non link source address
         #
-        nsma = in6_getnsma(inet_pton(socket.AF_INET6, self.pg0.local_ip6))
-        d = inet_ntop(socket.AF_INET6, nsma)
+        nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6))
+        d = inet_ntop(AF_INET6, nsma)
 
         p = (Ether(dst=in6_getnsmac(nsma)) /
              IPv6(dst=d, src="2002::2") /
@@ -261,8 +322,8 @@ class TestIPv6(VppTestCase):
         # not a member of FAILS
         #
         if 0:
-            nsma = in6_getnsma(inet_pton(socket.AF_INET6, "fd::ffff"))
-            d = inet_ntop(socket.AF_INET6, nsma)
+            nsma = in6_getnsma(inet_pton(AF_INET6, "fd::ffff"))
+            d = inet_ntop(AF_INET6, nsma)
 
             p = (Ether(dst=in6_getnsmac(nsma)) /
                  IPv6(dst=d, src=self.pg0.remote_ip6) /
@@ -277,8 +338,8 @@ class TestIPv6(VppTestCase):
         #
         # An NS whose target address is one the router does not own
         #
-        nsma = in6_getnsma(inet_pton(socket.AF_INET6, self.pg0.local_ip6))
-        d = inet_ntop(socket.AF_INET6, nsma)
+        nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6))
+        d = inet_ntop(AF_INET6, nsma)
 
         p = (Ether(dst=in6_getnsmac(nsma)) /
              IPv6(dst=d, src=self.pg0.remote_ip6) /
@@ -418,7 +479,7 @@ class TestIPv6(VppTestCase):
         # Send the RS multicast
         #
         self.pg0.ip6_ra_config(send_unicast=1)
-        dmac = in6_getnsmac(inet_pton(socket.AF_INET6, "ff02::2"))
+        dmac = in6_getnsmac(inet_pton(AF_INET6, "ff02::2"))
         ll = mk_ll_addr(self.pg0.remote_mac)
         p = (Ether(dst=dmac, src=self.pg0.remote_mac) /
              IPv6(dst="ff02::2", src=ll) /
@@ -629,5 +690,203 @@ class TestIPv6(VppTestCase):
         #
         self.pg0.ip6_ra_config(no=1, suppress=1, send_unicast=0)
 
+
+class IPv6NDProxyTest(TestIPv6ND):
+    """ IPv6 ND ProxyTest Case """
+
+    def setUp(self):
+        super(IPv6NDProxyTest, self).setUp()
+
+        # create 3 pg interfaces
+        self.create_pg_interfaces(range(3))
+
+        # pg0 is the master interface, with the configured subnet
+        self.pg0.admin_up()
+        self.pg0.config_ip6()
+        self.pg0.resolve_ndp()
+
+        self.pg1.ip6_enable()
+        self.pg2.ip6_enable()
+
+    def tearDown(self):
+        super(IPv6NDProxyTest, self).tearDown()
+
+    def test_nd_proxy(self):
+        """ IPv6 Proxy ND """
+
+        #
+        # Generate some hosts in the subnet that we are proxying
+        #
+        self.pg0.generate_remote_hosts(8)
+
+        nsma = in6_getnsma(inet_pton(AF_INET6, self.pg0.local_ip6))
+        d = inet_ntop(AF_INET6, nsma)
+
+        #
+        # Send an NS for one of those remote hosts on one of the proxy links
+        # expect no response since it's from an address that is not
+        # on the link that has the prefix configured
+        #
+        ns_pg1 = (Ether(dst=in6_getnsmac(nsma), src=self.pg1.remote_mac) /
+                  IPv6(dst=d, src=self.pg0._remote_hosts[2].ip6) /
+                  ICMPv6ND_NS(tgt=self.pg0.local_ip6) /
+                  ICMPv6NDOptSrcLLAddr(lladdr=self.pg0._remote_hosts[2].mac))
+
+        self.send_and_assert_no_replies(self.pg1, ns_pg1, "Off link NS")
+
+        #
+        # Add proxy support for the host
+        #
+        self.vapi.ip6_nd_proxy(
+            inet_pton(AF_INET6, self.pg0._remote_hosts[2].ip6),
+            self.pg1.sw_if_index)
+
+        #
+        # try that NS again. this time we expect an NA back
+        #
+        self.pg1.add_stream(ns_pg1)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        rx = self.pg1.get_capture(1)
+
+        self.validate_na(self.pg1, rx[0],
+                         dst_ip=self.pg0._remote_hosts[2].ip6,
+                         tgt_ip=self.pg0.local_ip6)
+
+        #
+        # ... and that we have an entry in the ND cache
+        #
+        self.assertTrue(find_nbr(self,
+                                 self.pg1.sw_if_index,
+                                 self.pg0._remote_hosts[2].ip6,
+                                 inet=AF_INET6))
+
+        #
+        # ... and we can route traffic to it
+        #
+        t = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
+             IPv6(dst=self.pg0._remote_hosts[2].ip6,
+                  src=self.pg0.remote_ip6) /
+             UDP(sport=10000, dport=20000) /
+             Raw('\xa5' * 100))
+
+        self.pg0.add_stream(t)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        rx = self.pg1.get_capture(1)
+        rx = rx[0]
+
+        self.assertEqual(rx[Ether].dst, self.pg0._remote_hosts[2].mac)
+        self.assertEqual(rx[Ether].src, self.pg1.local_mac)
+
+        self.assertEqual(rx[IPv6].src, t[IPv6].src)
+        self.assertEqual(rx[IPv6].dst, t[IPv6].dst)
+
+        #
+        # Test we proxy for the host on the main interface
+        #
+        ns_pg0 = (Ether(dst=in6_getnsmac(nsma), src=self.pg0.remote_mac) /
+                  IPv6(dst=d, src=self.pg0.remote_ip6) /
+                  ICMPv6ND_NS(tgt=self.pg0._remote_hosts[2].ip6) /
+                  ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
+
+        self.pg0.add_stream(ns_pg0)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        rx = self.pg0.get_capture(1)
+
+        self.validate_na(self.pg0, rx[0],
+                         tgt_ip=self.pg0._remote_hosts[2].ip6,
+                         dst_ip=self.pg0.remote_ip6)
+
+        #
+        # Setup and resolve proxy for another host on another interface
+        #
+        ns_pg2 = (Ether(dst=in6_getnsmac(nsma), src=self.pg2.remote_mac) /
+                  IPv6(dst=d, src=self.pg0._remote_hosts[3].ip6) /
+                  ICMPv6ND_NS(tgt=self.pg0.local_ip6) /
+                  ICMPv6NDOptSrcLLAddr(lladdr=self.pg0._remote_hosts[2].mac))
+
+        self.vapi.ip6_nd_proxy(
+            inet_pton(AF_INET6, self.pg0._remote_hosts[3].ip6),
+            self.pg2.sw_if_index)
+
+        self.pg2.add_stream(ns_pg2)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        rx = self.pg2.get_capture(1)
+
+        self.validate_na(self.pg2, rx[0],
+                         dst_ip=self.pg0._remote_hosts[3].ip6,
+                         tgt_ip=self.pg0.local_ip6)
+
+        self.assertTrue(find_nbr(self,
+                                 self.pg2.sw_if_index,
+                                 self.pg0._remote_hosts[3].ip6,
+                                 inet=AF_INET6))
+
+        #
+        # hosts can communicate. pg2->pg1
+        #
+        t2 = (Ether(dst=self.pg2.local_mac,
+                    src=self.pg0.remote_hosts[3].mac) /
+              IPv6(dst=self.pg0._remote_hosts[2].ip6,
+                   src=self.pg0._remote_hosts[3].ip6) /
+              UDP(sport=10000, dport=20000) /
+              Raw('\xa5' * 100))
+
+        self.pg2.add_stream(t2)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        rx = self.pg1.get_capture(1)
+        rx = rx[0]
+
+        self.assertEqual(rx[Ether].dst, self.pg0._remote_hosts[2].mac)
+        self.assertEqual(rx[Ether].src, self.pg1.local_mac)
+
+        self.assertEqual(rx[IPv6].src, t2[IPv6].src)
+        self.assertEqual(rx[IPv6].dst, t2[IPv6].dst)
+
+        #
+        # remove the proxy configs
+        #
+        self.vapi.ip6_nd_proxy(
+            inet_pton(AF_INET6, self.pg0._remote_hosts[2].ip6),
+            self.pg1.sw_if_index,
+            is_del=1)
+        self.vapi.ip6_nd_proxy(
+            inet_pton(AF_INET6, self.pg0._remote_hosts[3].ip6),
+            self.pg2.sw_if_index,
+            is_del=1)
+
+        self.assertFalse(find_nbr(self,
+                                  self.pg2.sw_if_index,
+                                  self.pg0._remote_hosts[3].ip6,
+                                  inet=AF_INET6))
+        self.assertFalse(find_nbr(self,
+                                  self.pg1.sw_if_index,
+                                  self.pg0._remote_hosts[2].ip6,
+                                  inet=AF_INET6))
+
+        #
+        # no longer proxy-ing...
+        #
+        self.send_and_assert_no_replies(self.pg0, ns_pg0, "Proxy unconfigured")
+        self.send_and_assert_no_replies(self.pg1, ns_pg1, "Proxy unconfigured")
+        self.send_and_assert_no_replies(self.pg2, ns_pg2, "Proxy unconfigured")
+
+        #
+        # no longer forwarding. traffic generates NS out of the glean/main
+        # interface
+        #
+        self.pg2.add_stream(t2)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        rx = self.pg0.get_capture(1)
+
+        self.assertTrue(rx[0].haslayer(ICMPv6ND_NS))
+
+
 if __name__ == '__main__':
     unittest.main(testRunner=VppTestRunner)
diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py
index b9c4d0c1be6..f04537bff47 100644
--- a/test/vpp_papi_provider.py
+++ b/test/vpp_papi_provider.py
@@ -276,6 +276,12 @@ class VppPapiProvider(object):
                         {'sw_if_index': sw_if_index,
                          'suppress': suppress})
 
+    def ip6_nd_proxy(self, address, sw_if_index, is_del=0):
+        return self.api(self.papi.ip6nd_proxy_add_del,
+                        {'address': address,
+                         'sw_if_index': sw_if_index,
+                         'is_del': is_del})
+
     def ip6_sw_interface_ra_config(self, sw_if_index,
                                    no,
                                    suppress,