aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/urpf/ip6_urpf.c
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2020-04-02 15:02:16 +0000
committerOle Trøan <otroan@employees.org>2020-04-14 09:40:48 +0000
commitd724e4f43b1d143a3f35492bce72fdc3e8af553e (patch)
treeb458929e250006e18a7e0615a573e68b6e1a8178 /src/plugins/urpf/ip6_urpf.c
parentdc3e9664858df680accca7324299b633bf60397d (diff)
urpf: Unicast reverse Path Forwarding (plugin)
Type: feature - move the IP4 code to plugin - add ip6 support - add suport for uRPF on TX - add tests Change-Id: I074c2debc486d3e79c12fad4b8dbd72c41e841a0 Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/plugins/urpf/ip6_urpf.c')
-rw-r--r--src/plugins/urpf/ip6_urpf.c171
1 files changed, 171 insertions, 0 deletions
diff --git a/src/plugins/urpf/ip6_urpf.c b/src/plugins/urpf/ip6_urpf.c
new file mode 100644
index 00000000000..3a94a456cb7
--- /dev/null
+++ b/src/plugins/urpf/ip6_urpf.c
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip6_urpf_error_strings[] = {
+#define _(a,b) "ip6-" # b,
+ foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip6_rx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_rx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip6_rx_urpf_loose) = {
+ .name = "ip6-rx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_rx_urpf_strict) = {
+ .name = "ip6-rx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_loose) = {
+ .name = "ip6-tx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_strict) = {
+ .name = "ip6-tx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip6-unicast",
+ .node_name = "ip6-rx-urpf-loose",
+ .runs_before = VNET_FEATURES ("ip6-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip6-unicast",
+ .node_name = "ip6-rx-urpf-strict",
+ .runs_before = VNET_FEATURES ("ip6-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "ip6-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "ip6-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */