ip: Protocol Independent IP Neighbors

Type: feature

 - ip-neighbour: generic neighbour handling; APIs, DBs, event handling,
aging
 - arp: ARP protocol implementation
 - ip6-nd; IPv6 neighbor discovery implementation; separate ND,
MLD, RA
 - ip6-link; manage link-local addresses
 - l2-arp-term; events separated from IP neighbours, since they are not
the same.

vnet retains just enough education to perform ND/ARP packet
construction.
arp and ip6-nd to be moved to plugins soon.

Change-Id: I88dedd0006b299344f4c7024a0aa5baa6b9a8bbe
Signed-off-by: Neale Ranns <nranns@cisco.com>

1 files changed, 407 insertions, 0 deletions

diff --git a/src/vnet/arp/arp_proxy.c b/src/vnet/arp/arp_proxy.c
new file mode 100644
index 00000000000..346a21775f8
--- /dev/null
+++ b/src/vnet/arp/arp_proxy.c
@@ -0,0 +1,407 @@
+/*
+ * ethernet/arp.c: IP v4 ARP node
+ *
+ * Copyright (c) 2010 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <vnet/arp/arp.h>
+#include <vnet/arp/arp_packet.h>
+
+#include <vnet/fib/ip4_fib.h>
+
+typedef struct
+{
+  ip4_address_t lo_addr;
+  ip4_address_t hi_addr;
+  u32 fib_index;
+} ethernet_proxy_arp_t;
+
+typedef struct arp_proxy_main_t_
+{
+  /** Per interface state */
+  bool *enabled_by_sw_if_index;
+
+  /* Proxy arp vector */
+  ethernet_proxy_arp_t *proxy_arps;
+} arp_proxy_main_t;
+
+arp_proxy_main_t arp_proxy_main;
+
+void
+proxy_arp_walk (proxy_arp_walk_t cb, void *data)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+  ethernet_proxy_arp_t *pa;
+
+  vec_foreach (pa, am->proxy_arps)
+  {
+    if (!cb (&pa->lo_addr, &pa->hi_addr, pa->fib_index, data))
+      break;
+  }
+}
+
+int
+arp_proxy_disable (u32 sw_if_index)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+
+  vec_validate (am->enabled_by_sw_if_index, sw_if_index);
+
+  if (am->enabled_by_sw_if_index[sw_if_index])
+    {
+      vnet_feature_enable_disable ("arp", "arp-proxy",
+				   sw_if_index, 0, NULL, 0);
+    }
+  am->enabled_by_sw_if_index[sw_if_index] = false;
+
+  return (0);
+}
+
+int
+arp_proxy_enable (u32 sw_if_index)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+
+  vec_validate (am->enabled_by_sw_if_index, sw_if_index);
+
+  if (!am->enabled_by_sw_if_index[sw_if_index])
+    {
+      vnet_feature_enable_disable ("arp", "arp-proxy",
+				   sw_if_index, 1, NULL, 0);
+    }
+  am->enabled_by_sw_if_index[sw_if_index] = true;
+
+  return (0);
+}
+
+static int
+vnet_proxy_arp_add_del (const ip4_address_t * lo_addr,
+			const ip4_address_t * hi_addr,
+			u32 fib_index, int is_del)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+  ethernet_proxy_arp_t *pa;
+  u32 found_at_index = ~0;
+
+  vec_foreach (pa, am->proxy_arps)
+  {
+    if (pa->lo_addr.as_u32 == lo_addr->as_u32 &&
+	pa->hi_addr.as_u32 == hi_addr->as_u32 && pa->fib_index == fib_index)
+      {
+	found_at_index = pa - am->proxy_arps;
+	break;
+      }
+  }
+
+  if (found_at_index != ~0)
+    {
+      /* Delete, otherwise it's already in the table */
+      if (is_del)
+	vec_delete (am->proxy_arps, 1, found_at_index);
+      return 0;
+    }
+  /* delete, no such entry */
+  if (is_del)
+    return VNET_API_ERROR_NO_SUCH_ENTRY;
+
+  /* add, not in table */
+  vec_add2 (am->proxy_arps, pa, 1);
+  pa->lo_addr.as_u32 = lo_addr->as_u32;
+  pa->hi_addr.as_u32 = hi_addr->as_u32;
+  pa->fib_index = fib_index;
+  return 0;
+}
+
+int
+arp_proxy_add (u32 fib_index,
+	       const ip4_address_t * lo, const ip4_address_t * hi)
+{
+  return (vnet_proxy_arp_add_del (lo, hi, fib_index, 0));
+}
+
+int
+arp_proxy_del (u32 fib_index,
+	       const ip4_address_t * lo, const ip4_address_t * hi)
+{
+  return (vnet_proxy_arp_add_del (lo, hi, fib_index, 1));
+}
+
+void
+proxy_arp_intfc_walk (proxy_arp_intf_walk_t cb, void *data)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+  bool *enabled;
+
+  vec_foreach (enabled, am->enabled_by_sw_if_index)
+  {
+    if (*enabled)
+      cb (enabled - am->enabled_by_sw_if_index, data);
+  }
+}
+
+static clib_error_t *
+set_int_proxy_arp_command_fn (vlib_main_t * vm,
+			      unformat_input_t *
+			      input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  u32 sw_if_index;
+  int enable = 0;
+
+  sw_if_index = ~0;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%U", unformat_vnet_sw_interface,
+		    vnm, &sw_if_index))
+	;
+      else if (unformat (input, "enable") || unformat (input, "on"))
+	enable = 1;
+      else if (unformat (input, "disable") || unformat (input, "off"))
+	enable = 0;
+      else
+	break;
+    }
+
+  if (~0 == sw_if_index)
+    return clib_error_return (0, "unknown input '%U'",
+			      format_unformat_error, input);
+
+  if (enable)
+    arp_proxy_enable (sw_if_index);
+  else
+    arp_proxy_disable (sw_if_index);
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+/*?
+ * Enable proxy-arp on an interface. The vpp stack will answer ARP
+ * requests for the indicated address range. Multiple proxy-arp
+ * ranges may be provisioned.
+ *
+ * @note Proxy ARP as a technology is infamous for blackholing traffic.
+ * Also, the underlying implementation has not been performance-tuned.
+ * Avoid creating an unnecessarily large set of ranges.
+ *
+ * @cliexpar
+ * To enable proxy arp on a range of addresses, use:
+ * @cliexcmd{set ip arp proxy 6.0.0.1 - 6.0.0.11}
+ * Append 'del' to delete a range of proxy ARP addresses:
+ * @cliexcmd{set ip arp proxy 6.0.0.1 - 6.0.0.11 del}
+ * You must then specifically enable proxy arp on individual interfaces:
+ * @cliexcmd{set interface proxy-arp GigabitEthernet0/8/0 enable}
+ * To disable proxy arp on an individual interface:
+ * @cliexcmd{set interface proxy-arp GigabitEthernet0/8/0 disable}
+ ?*/
+VLIB_CLI_COMMAND (set_int_proxy_enable_command, static) = {
+  .path = "set interface proxy-arp",
+  .short_help =
+  "set interface proxy-arp <intfc> [enable|disable]",
+  .function = set_int_proxy_arp_command_fn,
+};
+/* *INDENT-ON* */
+
+typedef struct
+{
+  u8 packet_data[64];
+} ethernet_arp_input_trace_t;
+
+static u8 *
+format_ethernet_arp_input_trace (u8 * s, va_list * va)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
+  ethernet_arp_input_trace_t *t = va_arg (*va, ethernet_arp_input_trace_t *);
+
+  s = format (s, "%U",
+	      format_ethernet_arp_header,
+	      t->packet_data, sizeof (t->packet_data));
+
+  return s;
+}
+
+static uword
+arp_proxy (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+  vnet_main_t *vnm = vnet_get_main ();
+  u32 n_left_from, next_index, *from, *to_next;
+  u32 n_arp_replies_sent = 0;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  next_index = node->cached_next_index;
+
+  if (node->flags & VLIB_NODE_FLAG_TRACE)
+    vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
+				   /* stride */ 1,
+				   sizeof (ethernet_arp_input_trace_t));
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  vlib_buffer_t *p0;
+	  ethernet_arp_header_t *arp0;
+	  ethernet_header_t *eth_rx;
+	  ip4_address_t proxy_src;
+	  u32 pi0, error0, next0, sw_if_index0, fib_index0;
+	  u8 is_request0;
+	  ethernet_proxy_arp_t *pa;
+
+	  pi0 = from[0];
+	  to_next[0] = pi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  p0 = vlib_get_buffer (vm, pi0);
+	  arp0 = vlib_buffer_get_current (p0);
+	  /* Fill in ethernet header. */
+	  eth_rx = ethernet_buffer_get_header (p0);
+
+	  is_request0 = arp0->opcode
+	    == clib_host_to_net_u16 (ETHERNET_ARP_OPCODE_request);
+
+	  error0 = ETHERNET_ARP_ERROR_replies_sent;
+	  sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
+	  next0 = ARP_REPLY_NEXT_DROP;
+
+	  fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+	  if (~0 == fib_index0)
+	    {
+	      error0 = ETHERNET_ARP_ERROR_interface_no_table;
+	    }
+
+	  if (0 == error0 && is_request0)
+	    {
+	      u32 this_addr = clib_net_to_host_u32
+		(arp0->ip4_over_ethernet[1].ip4.as_u32);
+
+	      vec_foreach (pa, am->proxy_arps)
+	      {
+		u32 lo_addr = clib_net_to_host_u32 (pa->lo_addr.as_u32);
+		u32 hi_addr = clib_net_to_host_u32 (pa->hi_addr.as_u32);
+
+		/* an ARP request hit in the proxy-arp table? */
+		if ((this_addr >= lo_addr && this_addr <= hi_addr) &&
+		    (fib_index0 == pa->fib_index))
+		  {
+		    proxy_src.as_u32 =
+		      arp0->ip4_over_ethernet[1].ip4.data_u32;
+
+		    /*
+		     * change the interface address to the proxied
+		     */
+		    n_arp_replies_sent++;
+
+		    next0 =
+		      arp_mk_reply (vnm, p0, sw_if_index0, &proxy_src, arp0,
+				    eth_rx);
+		  }
+	      }
+	    }
+	  else
+	    {
+	      p0->error = node->errors[error0];
+	    }
+
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
+					   n_left_to_next, pi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  vlib_error_count (vm, node->node_index,
+		    ETHERNET_ARP_ERROR_replies_sent, n_arp_replies_sent);
+
+  return frame->n_vectors;
+}
+
+static char *ethernet_arp_error_strings[] = {
+#define _(sym,string) string,
+  foreach_ethernet_arp_error
+#undef _
+};
+
+VLIB_REGISTER_NODE (arp_proxy_node, static) =
+{
+  .function = arp_proxy,.name = "arp-proxy",.vector_size =
+    sizeof (u32),.n_errors = ETHERNET_ARP_N_ERROR,.error_strings =
+    ethernet_arp_error_strings,.n_next_nodes = ARP_REPLY_N_NEXT,.next_nodes =
+  {
+  [ARP_REPLY_NEXT_DROP] = "error-drop",
+      [ARP_REPLY_NEXT_REPLY_TX] = "interface-output",}
+,.format_buffer = format_ethernet_arp_header,.format_trace =
+    format_ethernet_arp_input_trace,};
+
+static clib_error_t *
+show_ip4_arp (vlib_main_t * vm,
+	      unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  arp_proxy_main_t *am = &arp_proxy_main;
+  ethernet_proxy_arp_t *pa;
+
+  if (vec_len (am->proxy_arps))
+    {
+      vlib_cli_output (vm, "Proxy arps enabled for:");
+      vec_foreach (pa, am->proxy_arps)
+      {
+	vlib_cli_output (vm, "Fib_index %d   %U - %U ",
+			 pa->fib_index,
+			 format_ip4_address, &pa->lo_addr,
+			 format_ip4_address, &pa->hi_addr);
+      }
+    }
+
+  return (NULL);
+}
+
+/*?
+ * Display all the IPv4 ARP proxy entries.
+ *
+ * @cliexpar
+ * Example of how to display the IPv4 ARP table:
+ * @cliexstart{show ip arp}
+ *    Time      FIB        IP4       Flags      Ethernet              Interface
+ *    346.3028   0       6.1.1.3            de:ad:be:ef:ba:be   GigabitEthernet2/0/0
+ *   3077.4271   0       6.1.1.4       S    de:ad:be:ef:ff:ff   GigabitEthernet2/0/0
+ *   2998.6409   1       6.2.2.3            de:ad:be:ef:00:01   GigabitEthernet2/0/0
+ * Proxy arps enabled for:
+ * Fib_index 0   6.0.0.1 - 6.0.0.11
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_ip4_arp_command, static) = {
+  .path = "show arp proxy",
+  .function = show_ip4_arp,
+  .short_help = "show ip arp",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */