ip: Protocol Independent IP Neighbors - vpp

diff options

author	Neale Ranns <nranns@cisco.com>	2019-09-30 10:53:31 +0000
committer	Ole Trøan <otroan@employees.org>	2019-12-17 10:56:20 +0000
commit	cbe25aab3be72154f2c706c39eeba6a77f34450f (patch)
tree	131fb53b5ec973be045ffb9e2eb797af01d112a0 /src/plugins/flowprobe
parent	96453fd2417ebd1d69354a7fb692976129cea80e (diff)

ip: Protocol Independent IP Neighbors

Type: feature - ip-neighbour: generic neighbour handling; APIs, DBs, event handling, aging - arp: ARP protocol implementation - ip6-nd; IPv6 neighbor discovery implementation; separate ND, MLD, RA - ip6-link; manage link-local addresses - l2-arp-term; events separated from IP neighbours, since they are not the same. vnet retains just enough education to perform ND/ARP packet construction. arp and ip6-nd to be moved to plugins soon. Change-Id: I88dedd0006b299344f4c7024a0aa5baa6b9a8bbe Signed-off-by: Neale Ranns <nranns@cisco.com>

Diffstat (limited to 'src/plugins/flowprobe')

0 files changed, 0 insertions, 0 deletions

/* * Copyright (c) 2015 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /* * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check) * * Copyright (c) 2008 Eliot Dresselhaus * * Permission is hereby granted, free of charge, to any person obtaining * a copy of this software and associated documentation files (the * "Software"), to deal in the Software without restriction, including * without limitation the rights to use, copy, modify, merge, publish, * distribute, sublicense, and/or sell copies of the Software, and to * permit persons to whom the Software is furnished to do so, subject to * the following conditions: * * The above copyright notice and this permission notice shall be * included in all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ #ifndef __URPF_DP_H__ #define __URPF_DP_H__ #include <vnet/fib/ip4_fib.h> #include <vnet/fib/ip6_fib.h> #include <vnet/fib/fib_urpf_list.h> #include <vnet/dpo/load_balance.h> #include <urpf/urpf.h> /** * @file * @brief Unicast Reverse Path forwarding. * * This file contains the interface unicast source check. */ typedef struct { index_t urpf; } urpf_trace_t; static u8 * format_urpf_trace (u8 * s, va_list * va) { CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *); CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *); urpf_trace_t *t = va_arg (*va, urpf_trace_t *); s = format (s, "uRPF:%d", t->urpf); return s; } #define foreach_urpf_error \ _(DROP, "uRPF Drop") \ typedef enum urpf_error_t_ { #define _(a,b) URPF_ERROR_##a, foreach_urpf_error #undef _ URPF_N_ERROR, } urpf_error_t; typedef enum { URPF_NEXT_DROP, URPF_N_NEXT, } urpf_next_t; static_always_inline uword urpf_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame, ip_address_family_t af, vlib_dir_t dir, urpf_mode_t mode) { vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b; u16 nexts[VLIB_FRAME_SIZE], *next; u32 n_left, *from; from = vlib_frame_vector_args (frame); n_left = frame->n_vectors; b = bufs; next = nexts; vlib_get_buffers (vm, from, bufs, n_left); while (n_left >= 4) { u32 pass0, lb_index0, pass1, lb_index1; const load_balance_t *lb0, *lb1; u32 fib_index0, fib_index1; const u8 *h0, *h1; /* Prefetch next iteration. */ { vlib_prefetch_buffer_header (b[2], LOAD); vlib_prefetch_buffer_header (b[3], LOAD); vlib_prefetch_buffer_data (b[2], LOAD); vlib_prefetch_buffer_data (b[3], LOAD); } h0 = (u8 *) vlib_buffer_get_current (b[0]); h1 = (u8 *) vlib_buffer_get_current (b[1]); if (VLIB_TX == dir) { h0 += vnet_buffer (b[0])->ip.save_rewrite_length; h1 += vnet_buffer (b[1])->ip.save_rewrite_length; } if (AF_IP4 == af) { const ip4_header_t *ip0, *ip1; ip0 = (ip4_header_t *) h0; ip1 = (ip4_header_t *) h1; fib_index0 = ip4_main.fib_index_by_sw_if_index [vnet_buffer (b[0])->sw_if_index[dir]]; fib_index1 = ip4_main.fib_index_by_sw_if_index [vnet_buffer (b[1])->sw_if_index[dir]]; ip4_fib_forwarding_lookup_x2 (fib_index0, fib_index1, &ip0->src_address, &ip1->src_address, &lb_index0, &lb_index1); /* Pass multicast. */ pass0 = (ip4_address_is_multicast (&ip0->src_address) || ip4_address_is_global_broadcast (&ip0->src_address)); pass1 = (ip4_address_is_multicast (&ip1->src_address) || ip4_address_is_global_broadcast (&ip1->src_address)); } else { const ip6_header_t *ip0, *ip1; fib_index0 = ip6_main.fib_index_by_sw_if_index [vnet_buffer (b[0])->sw_if_index[dir]]; fib_index1 = ip6_main.fib_index_by_sw_if_index [vnet_buffer (b[1])->sw_if_index[dir]]; ip0 = (ip6_header_t *) h0; ip1 = (ip6_header_t *) h1; lb_index0 = ip6_fib_table_fwding_lookup (fib_index0, &ip0->src_address); lb_index1 = ip6_fib_table_fwding_lookup (fib_index1, &ip1->src_address); pass0 = ip6_address_is_multicast (&ip0->src_address); pass1 = ip6_address_is_multicast (&ip1->src_address); } lb0 = load_balance_get (lb_index0); lb1 = load_balance_get (lb_index1); if (URPF_MODE_STRICT == mode) { /* for RX the check is: would this source adddress be forwarded * out of the interface on which it was recieved, if yes allow. * For TX it's; would this source address be forwarded out of the * interface through which it is being sent, if yes drop. */ int res0, res1; res0 = fib_urpf_check (lb0->lb_urpf, vnet_buffer (b[0])->sw_if_index[dir]); res1 = fib_urpf_check (lb1->lb_urpf, vnet_buffer (b[1])->sw_if_index[dir]); if (VLIB_RX == dir) { pass0 |= res0; pass1 |= res1; } else { pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf); pass1 |= !res1 && fib_urpf_check_size (lb1->lb_urpf); /* allow locally generated */ pass0 |= b[0]->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED; pass1 |= b[1]->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED; } } else { pass0 |= fib_urpf_check_size (lb0->lb_urpf); pass1 |= fib_urpf_check_size (lb1->lb_urpf); } if (PREDICT_TRUE (pass0)) vnet_feature_next_u16 (&next[0], b[0]); else { next[0] = URPF_NEXT_DROP; b[0]->error = node->errors[URPF_ERROR_DROP]; } if (PREDICT_TRUE (pass1)) vnet_feature_next_u16 (&next[1], b[1]); else { next[1] = URPF_NEXT_DROP; b[1]->error = node->errors[URPF_ERROR_DROP]; } if (b[0]->flags & VLIB_BUFFER_IS_TRACED) { urpf_trace_t *t; t = vlib_add_trace (vm, node, b[0], sizeof (*t)); t->urpf = lb0->lb_urpf; } if (b[1]->flags & VLIB_BUFFER_IS_TRACED) { urpf_trace_t *t; t = vlib_add_trace (vm, node, b[1], sizeof (*t)); t->urpf = lb1->lb_urpf; } b += 2; next += 2; n_left -= 2; } while (n_left) { u32 pass0, lb_index0, fib_index0; const load_balance_t *lb0; const u8 *h0; h0 = (u8 *) vlib_buffer_get_current (b[0]); if (VLIB_TX == dir) h0 += vnet_buffer (b[0])->ip.save_rewrite_length; if (AF_IP4 == af) { const ip4_header_t *ip0; fib_index0 = ip4_main.fib_index_by_sw_if_index [vnet_buffer (b[0])->sw_if_index[dir]]; ip0 = (ip4_header_t *) h0; lb_index0 = ip4_fib_forwarding_lookup (fib_index0, &ip0->src_address); /* Pass multicast. */ pass0 = (ip4_address_is_multicast (&ip0->src_address) || ip4_address_is_global_broadcast (&ip0->src_address)); } else { const ip6_header_t *ip0; ip0 = (ip6_header_t *) h0; fib_index0 = ip6_main.fib_index_by_sw_if_index [vnet_buffer (b[0])->sw_if_index[dir]]; lb_index0 = ip6_fib_table_fwding_lookup (fib_index0, &ip0->src_address); pass0 = ip6_address_is_multicast (&ip0->src_address); } lb0 = load_balance_get (lb_index0); if (URPF_MODE_STRICT == mode) { int res0; res0 = fib_urpf_check (lb0->lb_urpf, vnet_buffer (b[0])->sw_if_index[dir]); if (VLIB_RX == dir) pass0 |= res0; else { pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf); pass0 |= b[0]->flags & VNET_BUFFER_F_LOCALLY_ORIGINATED; } } else pass0 |= fib_urpf_check_size (lb0->lb_urpf); if (PREDICT_TRUE (pass0)) vnet_feature_next_u16 (&next[0], b[0]); else { next[0] = URPF_NEXT_DROP; b[0]->error = node->errors[URPF_ERROR_DROP]; } if (b[0]->flags & VLIB_BUFFER_IS_TRACED) { urpf_trace_t *t; t = vlib_add_trace (vm, node, b[0], sizeof (*t)); t->urpf = lb0->lb_urpf; } b++; next++; n_left--; } vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors); return frame->n_vectors; } #endif /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: