urpf: Unicast reverse Path Forwarding (plugin)

Type: feature

 - move the IP4 code to plugin
 - add ip6 support
 - add suport for uRPF on TX
 - add tests

Change-Id: I074c2debc486d3e79c12fad4b8dbd72c41e841a0
Signed-off-by: Neale Ranns <nranns@cisco.com>

19 files changed, 1653 insertions, 616 deletions

diff --git a/src/plugins/urpf/CMakeLists.txt b/src/plugins/urpf/CMakeLists.txt
new file mode 100644
index 00000000000..2f44e3b2344
--- /dev/null
+++ b/src/plugins/urpf/CMakeLists.txt
@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_vpp_plugin(urpf
+  SOURCES
+  urpf.c
+  urpf_api.c
+  ip4_urpf.c
+  ip6_urpf.c
+
+  MULTIARCH_SOURCES
+  ip4_urpf.c
+  ip6_urpf.c
+
+  API_FILES
+  urpf.api
+)
diff --git a/src/plugins/urpf/ip4_urpf.c b/src/plugins/urpf/ip4_urpf.c
new file mode 100644
index 00000000000..25b6c94bde3
--- /dev/null
+++ b/src/plugins/urpf/ip4_urpf.c
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ *  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ *  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ *  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip4_urpf_error_strings[] = {
+#define _(a,b) "ip4-" # b,
+  foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip4_rx_urpf_loose) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip4_rx_urpf_strict) (vlib_main_t * vm,
+				   vlib_node_runtime_t * node,
+				   vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip4_tx_urpf_loose) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip4_tx_urpf_strict) (vlib_main_t * vm,
+				   vlib_node_runtime_t * node,
+				   vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip4_rx_urpf_loose) = {
+  .name = "ip4-rx-urpf-loose",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip4-drop",
+  },
+  .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+  .error_strings = ip4_urpf_error_strings,
+
+  .format_buffer = format_ip4_header,
+  .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_rx_urpf_strict) = {
+  .name = "ip4-rx-urpf-strict",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip4-drop",
+  },
+  .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+  .error_strings = ip4_urpf_error_strings,
+
+  .format_buffer = format_ip4_header,
+  .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_tx_urpf_loose) = {
+  .name = "ip4-tx-urpf-loose",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip4-drop",
+  },
+  .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+  .error_strings = ip4_urpf_error_strings,
+
+  .format_buffer = format_ip4_header,
+  .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_tx_urpf_strict) = {
+  .name = "ip4-tx-urpf-strict",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip4-drop",
+  },
+  .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+  .error_strings = ip4_urpf_error_strings,
+
+  .format_buffer = format_ip4_header,
+  .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip4_rx_urpf_loose_feat, static) =
+{
+  .arc_name = "ip4-unicast",
+  .node_name = "ip4-rx-urpf-loose",
+  .runs_before = VNET_FEATURES ("ip4-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip4_rx_urpf_strict_feat, static) =
+{
+  .arc_name = "ip4-unicast",
+  .node_name = "ip4-rx-urpf-strict",
+  .runs_before = VNET_FEATURES ("ip4-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip4_tx_urpf_loose_feat, static) =
+{
+  .arc_name = "ip4-output",
+  .node_name = "ip4-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip4_tx_urpf_strict_feat, static) =
+{
+  .arc_name = "ip4-output",
+  .node_name = "ip4-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/ip6_urpf.c b/src/plugins/urpf/ip6_urpf.c
new file mode 100644
index 00000000000..3a94a456cb7
--- /dev/null
+++ b/src/plugins/urpf/ip6_urpf.c
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ *  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ *  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ *  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip6_urpf_error_strings[] = {
+#define _(a,b) "ip6-" # b,
+  foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip6_rx_urpf_loose) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_rx_urpf_strict) (vlib_main_t * vm,
+				   vlib_node_runtime_t * node,
+				   vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_loose) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_strict) (vlib_main_t * vm,
+				   vlib_node_runtime_t * node,
+				   vlib_frame_t * frame)
+{
+  return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip6_rx_urpf_loose) = {
+  .name = "ip6-rx-urpf-loose",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip6-drop",
+  },
+  .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+  .error_strings = ip6_urpf_error_strings,
+
+  .format_buffer = format_ip6_header,
+  .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_rx_urpf_strict) = {
+  .name = "ip6-rx-urpf-strict",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip6-drop",
+  },
+  .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+  .error_strings = ip6_urpf_error_strings,
+
+  .format_buffer = format_ip6_header,
+  .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_loose) = {
+  .name = "ip6-tx-urpf-loose",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip6-drop",
+  },
+  .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+  .error_strings = ip6_urpf_error_strings,
+
+  .format_buffer = format_ip6_header,
+  .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_strict) = {
+  .name = "ip6-tx-urpf-strict",
+  .vector_size = sizeof (u32),
+
+  .n_next_nodes = URPF_N_NEXT,
+  .next_nodes = {
+    [URPF_NEXT_DROP] = "ip6-drop",
+  },
+  .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+  .error_strings = ip6_urpf_error_strings,
+
+  .format_buffer = format_ip6_header,
+  .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_loose_feat, static) =
+{
+  .arc_name = "ip6-unicast",
+  .node_name = "ip6-rx-urpf-loose",
+  .runs_before = VNET_FEATURES ("ip6-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_strict_feat, static) =
+{
+  .arc_name = "ip6-unicast",
+  .node_name = "ip6-rx-urpf-strict",
+  .runs_before = VNET_FEATURES ("ip6-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_loose_feat, static) =
+{
+  .arc_name = "ip6-output",
+  .node_name = "ip6-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_strict_feat, static) =
+{
+  .arc_name = "ip6-output",
+  .node_name = "ip6-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/test/test_urpf.py b/src/plugins/urpf/test/test_urpf.py
new file mode 100644
index 00000000000..64b246cd663
--- /dev/null
+++ b/src/plugins/urpf/test/test_urpf.py
@@ -0,0 +1,295 @@
+#!/usr/bin/env python3
+
+import unittest
+
+from framework import VppTestCase, VppTestRunner
+
+from scapy.packet import Raw
+from scapy.layers.l2 import Ether
+from scapy.layers.inet import IP, UDP, ICMP
+from scapy.layers.inet6 import IPv6
+
+from vpp_papi import VppEnum
+
+N_PKTS = 63
+
+
+class TestURPF(VppTestCase):
+    """ Unicast Reverse Path Forwarding Test Case """
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestURPF, cls).setUpClass()
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestURPF, cls).tearDownClass()
+
+    def setUp(self):
+        super(TestURPF, self).setUp()
+
+        # create 4 pg interfaces so there are a few addresses
+        # in the FIB
+        self.create_pg_interfaces(range(4))
+
+        for i in self.pg_interfaces:
+            i.admin_up()
+            i.config_ip4()
+            i.resolve_arp()
+            i.config_ip6()
+            i.resolve_ndp()
+
+    def tearDown(self):
+        for i in self.pg_interfaces:
+            i.unconfig_ip4()
+            i.unconfig_ip6()
+            i.admin_down()
+        super(TestURPF, self).tearDown()
+
+    def test_urpf4(self):
+        """ uRPF IP4 """
+
+        e = VppEnum
+        p_spoof_loose = (Ether(dst=self.pg0.local_mac,
+                               src=self.pg0.remote_mac) /
+                         IP(src="3.3.3.3", dst=self.pg1.remote_ip4) /
+                         UDP(sport=1234, dport=1234) /
+                         Raw(b'\xa5' * 100)) * N_PKTS
+        p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+                                src=self.pg0.remote_mac) /
+                          IP(src=self.pg2.remote_ip4,
+                             dst=self.pg1.remote_ip4) /
+                          UDP(sport=1234, dport=1234) /
+                          Raw(b'\xa5' * 100)) * N_PKTS
+        p_good = (Ether(dst=self.pg0.local_mac,
+                        src=self.pg0.remote_mac) /
+                  IP(src=self.pg0.remote_ip4,
+                     dst=self.pg1.remote_ip4) /
+                  UDP(sport=1234, dport=1234) /
+                  Raw(b'\xa5' * 100)) * N_PKTS
+
+        #
+        # before adding the uRPF, ensure all packets are forwarded
+        #
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+        #
+        # apply loose uRPF check on pg0 rx
+        #
+        self.vapi.urpf_update(is_input=True,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+                              af=e.vl_api_address_family_t.ADDRESS_IP4,
+                              sw_if_index=self.pg0.sw_if_index)
+
+        # good packets still pass
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        # packets from address for which there is a route are forwarded
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        # packets from address to which there is no route are dropped
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip4-rx-urpf-loose", N_PKTS)
+
+        #
+        # crank it up to strict mode
+        #
+        self.vapi.urpf_update(is_input=True,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+                              af=e.vl_api_address_family_t.ADDRESS_IP4,
+                              sw_if_index=self.pg0.sw_if_index)
+
+        # good packets still pass
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        # packets that would not be routed back thru pg0 are dropped
+        self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip4-rx-urpf-strict", 2 * N_PKTS)
+
+        #
+        # disable uRPF, all traffic should pass
+        #
+        self.vapi.urpf_update(is_input=True,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+                              af=e.vl_api_address_family_t.ADDRESS_IP4,
+                              sw_if_index=self.pg0.sw_if_index)
+
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+        #
+        # Now apply in the TX direction
+        #  for loose it is the same deal, they should not be forwarded
+        #  if there's no route
+        #  for strict they should not be forwarded if they would be
+        #  forwarded thru that interface.
+        #
+        self.vapi.urpf_update(is_input=False,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+                              af=e.vl_api_address_family_t.ADDRESS_IP4,
+                              sw_if_index=self.pg1.sw_if_index)
+
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip4-tx-urpf-loose", N_PKTS)
+
+        self.vapi.urpf_update(is_input=False,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+                              af=e.vl_api_address_family_t.ADDRESS_IP4,
+                              sw_if_index=self.pg1.sw_if_index)
+
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        # the strict packet, from a peer is allowed, since it does
+        # not forward via pg1
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip4-tx-urpf-strict", N_PKTS)
+
+        # change the strict packet so that it would forward through pg1
+        p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+                                src=self.pg0.remote_mac) /
+                          IP(src=self.pg1.remote_ip4,
+                             dst=self.pg1.remote_ip4) /
+                          UDP(sport=1234, dport=1234) /
+                          Raw(b'\xa5' * 100)) * N_PKTS
+
+        self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+        self.assert_error_counter_equal("ip4-tx-urpf-strict", 2 * N_PKTS)
+
+        # cleanup
+        self.vapi.urpf_update(is_input=False,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+                              af=e.vl_api_address_family_t.ADDRESS_IP4,
+                              sw_if_index=self.pg1.sw_if_index)
+
+    def test_urpf6(self):
+        """ uRPF IP6 """
+
+        e = VppEnum
+        p_spoof_loose = (Ether(dst=self.pg0.local_mac,
+                               src=self.pg0.remote_mac) /
+                         IPv6(src="3::3", dst=self.pg1.remote_ip6) /
+                         UDP(sport=1236, dport=1236) /
+                         Raw(b'\xa5' * 100)) * N_PKTS
+        p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+                                src=self.pg0.remote_mac) /
+                          IPv6(src=self.pg2.remote_ip6,
+                               dst=self.pg1.remote_ip6) /
+                          UDP(sport=1236, dport=1236) /
+                          Raw(b'\xa5' * 100)) * N_PKTS
+        p_good = (Ether(dst=self.pg0.local_mac,
+                        src=self.pg0.remote_mac) /
+                  IPv6(src=self.pg0.remote_ip6,
+                       dst=self.pg1.remote_ip6) /
+                  UDP(sport=1236, dport=1236) /
+                  Raw(b'\xa5' * 100)) * N_PKTS
+
+        #
+        # before adding the uRPF, ensure all packets are forwarded
+        #
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+        #
+        # apply loose uRPF check on pg0 rx
+        #
+        self.vapi.urpf_update(is_input=True,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+                              af=e.vl_api_address_family_t.ADDRESS_IP6,
+                              sw_if_index=self.pg0.sw_if_index)
+
+        # good packets still pass
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        # packets from address for which there is a route are forwarded
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        # packets from address to which there is no route are dropped
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip6-rx-urpf-loose", N_PKTS)
+
+        #
+        # crank it up to strict mode
+        #
+        self.vapi.urpf_update(is_input=True,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+                              af=e.vl_api_address_family_t.ADDRESS_IP6,
+                              sw_if_index=self.pg0.sw_if_index)
+
+        # good packets still pass
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        # packets that would not be routed back thru pg0 are dropped
+        self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip6-rx-urpf-strict", 2 * N_PKTS)
+
+        #
+        # disable uRPF, all traffic should pass
+        #
+        self.vapi.urpf_update(is_input=True,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+                              af=e.vl_api_address_family_t.ADDRESS_IP6,
+                              sw_if_index=self.pg0.sw_if_index)
+
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+        #
+        # Now apply in the TX direction
+        #  for loose it is the same deal, they should not be forwarded
+        #  if there's no route
+        #  for strict they should not be forwarded if they would be
+        #  forwarded thru that interface.
+        #
+        self.vapi.urpf_update(is_input=False,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+                              af=e.vl_api_address_family_t.ADDRESS_IP6,
+                              sw_if_index=self.pg1.sw_if_index)
+
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip6-tx-urpf-loose", N_PKTS)
+
+        self.vapi.urpf_update(is_input=False,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+                              af=e.vl_api_address_family_t.ADDRESS_IP6,
+                              sw_if_index=self.pg1.sw_if_index)
+
+        self.send_and_expect(self.pg0, p_good, self.pg1)
+        # the strict packet, from a peer is allowed, since it does
+        # not forward via pg1
+        self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+        self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+        self.assert_error_counter_equal("ip6-tx-urpf-strict", N_PKTS)
+
+        # change the strict packet so that it would forward through pg1
+        p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+                                src=self.pg0.remote_mac) /
+                          IPv6(src=self.pg1.remote_ip6,
+                               dst=self.pg1.remote_ip6) /
+                          UDP(sport=1236, dport=1236) /
+                          Raw(b'\xa5' * 100)) * N_PKTS
+
+        self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+        self.assert_error_counter_equal("ip6-tx-urpf-strict", 2 * N_PKTS)
+
+        # cleanup
+        self.vapi.urpf_update(is_input=False,
+                              mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+                              af=e.vl_api_address_family_t.ADDRESS_IP6,
+                              sw_if_index=self.pg1.sw_if_index)
+
+
+if __name__ == '__main__':
+    unittest.main(testRunner=VppTestRunner)
diff --git a/src/plugins/urpf/urpf.api b/src/plugins/urpf/urpf.api
new file mode 100644
index 00000000000..944db08cc94
--- /dev/null
+++ b/src/plugins/urpf/urpf.api
@@ -0,0 +1,59 @@
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** \file
+    This file defines the vpp control-plane API messages
+    used to control the URPF plugin
+*/
+
+option version = "1.0.0";
+import "vnet/ip/ip_types.api";
+import "vnet/fib/fib_types.api";
+import "vnet/interface_types.api";
+
+enum urpf_mode:u8
+{
+  URPF_API_MODE_OFF,
+  URPF_API_MODE_LOOSE,
+  URPF_API_MODE_STRICT,
+};
+
+/**
+ * @brief Enable uRPF on a given interface in a given direction
+ * @param client_index - opaque cookie to identify the sender
+ * @param context - sender context, to match reply w/ request
+ * @param mode - Mode
+ * @param af - Address Family
+ * @param sw_if_index - Interface
+ * @param is_input - Direction.
+ */
+autoreply define urpf_update
+{
+  u32 client_index;
+  u32 context;
+  bool is_input[default = true];
+  vl_api_urpf_mode_t mode;
+  vl_api_address_family_t af;
+  vl_api_interface_index_t sw_if_index;
+};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf.c b/src/plugins/urpf/urpf.c
new file mode 100644
index 00000000000..7e1986a4250
--- /dev/null
+++ b/src/plugins/urpf/urpf.c
@@ -0,0 +1,323 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <urpf/urpf.h>
+
+#include <vnet/fib/fib_table.h>
+
+/* *INDENT-OFF* */
+static const char *urpf_feat_arcs[N_AF][VLIB_N_DIR] =
+{
+  [AF_IP4] = {
+    [VLIB_RX] = "ip4-unicast",
+    [VLIB_TX] = "ip4-output",
+  },
+  [AF_IP6] = {
+    [VLIB_RX] = "ip6-unicast",
+    [VLIB_TX] = "ip6-output",
+  },
+};
+
+static const char *urpf_feats[N_AF][VLIB_N_DIR][URPF_N_MODES] =
+{
+  [AF_IP4] = {
+    [VLIB_RX] = {
+      [URPF_MODE_STRICT] = "ip4-rx-urpf-strict",
+      [URPF_MODE_LOOSE] = "ip4-rx-urpf-loose",
+    },
+    [VLIB_TX] = {
+      [URPF_MODE_STRICT] = "ip4-tx-urpf-strict",
+      [URPF_MODE_LOOSE] = "ip4-tx-urpf-loose",
+    },
+  },
+  [AF_IP6] = {
+    [VLIB_RX] = {
+      [URPF_MODE_STRICT] = "ip6-rx-urpf-strict",
+      [URPF_MODE_LOOSE] = "ip6-rx-urpf-loose",
+    },
+    [VLIB_TX] = {
+      [URPF_MODE_STRICT] = "ip6-tx-urpf-strict",
+      [URPF_MODE_LOOSE] = "ip6-tx-urpf-loose",
+    },
+  },
+};
+/* *INDENT-ON* */
+
+/**
+ * Per-af, per-direction, per-interface uRPF configs
+ */
+static urpf_mode_t *urpf_cfgs[N_AF][VLIB_N_DIR];
+
+u8 *
+format_urpf_mode (u8 * s, va_list * a)
+{
+  urpf_mode_t mode = va_arg (*a, int);
+
+  switch (mode)
+    {
+#define _(a,b)                                  \
+    case URPF_MODE_##a:                         \
+      return (format (s, "%s", b));
+      foreach_urpf_mode
+#undef _
+    }
+
+  return (format (s, "unknown"));
+}
+
+static uword
+unformat_urpf_mode (unformat_input_t * input, va_list * args)
+{
+  urpf_mode_t *mode = va_arg (*args, urpf_mode_t *);
+
+  if (0)
+    ;
+#define _(a,b)                                                  \
+  else if (unformat (input, b))                                 \
+    {                                                           \
+    *mode = URPF_MODE_##a;                                      \
+    return (1);                                                 \
+    }
+  foreach_urpf_mode
+#undef _
+    return 0;
+}
+
+void
+urpf_update (urpf_mode_t mode,
+	     u32 sw_if_index, ip_address_family_t af, vlib_dir_t dir)
+{
+  urpf_mode_t old;
+
+  vec_validate_init_empty (urpf_cfgs[af][dir], sw_if_index, URPF_MODE_OFF);
+  old = urpf_cfgs[af][dir][sw_if_index];
+
+  if (mode != old)
+    {
+      if (URPF_MODE_OFF != old)
+	/* disable what we have */
+	vnet_feature_enable_disable (urpf_feat_arcs[af][dir],
+				     urpf_feats[af][dir][old],
+				     sw_if_index, 0, 0, 0);
+
+      if (URPF_MODE_OFF != mode)
+	/* enable what's new */
+	vnet_feature_enable_disable (urpf_feat_arcs[af][dir],
+				     urpf_feats[af][dir][mode],
+				     sw_if_index, 1, 0, 0);
+    }
+  /* else - no change to existing config */
+
+  urpf_cfgs[af][dir][sw_if_index] = mode;
+}
+
+static clib_error_t *
+urpf_cli_update (vlib_main_t * vm,
+		 unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  vnet_main_t *vnm = vnet_get_main ();
+  clib_error_t *error = NULL;
+  ip_address_family_t af;
+  urpf_mode_t mode;
+  u32 sw_if_index;
+  vlib_dir_t dir;
+
+  sw_if_index = ~0;
+  af = AF_IP4;
+  dir = VLIB_RX;
+  mode = URPF_MODE_STRICT;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%U",
+		    unformat_vnet_sw_interface, vnm, &sw_if_index))
+	;
+      else if (unformat (line_input, "%U", unformat_urpf_mode, &mode))
+	;
+      else if (unformat (line_input, "%U", unformat_ip_address_family, &af))
+	;
+      else if (unformat (line_input, "%U", unformat_vlib_rx_tx, &dir))
+	;
+      else
+	{
+	  error = unformat_parse_error (line_input);
+	  goto done;
+	}
+    }
+
+  if (~0 == sw_if_index)
+    {
+      error = clib_error_return (0, "unknown interface `%U'",
+				 format_unformat_error, line_input);
+      goto done;
+    }
+
+  urpf_update (mode, sw_if_index, af, dir);
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+/*?
+ * This command configures uRPF on an interface.
+ * Two flavours are supported (the default is strict):
+ * - loose: accept ingress packet if there is a route to reach the source
+ * - strict: accept ingress packet if it arrived on an interface which
+ *          the route to the source uses. i.e. an interface that the source
+ *          is reachable via.
+ *
+ * @cliexpar
+ * @parblock
+ * Example of graph node before range checking is enabled:
+ * @cliexstart{show vlib graph ip4-rx-urpf-strict}
+ *            Name                      Next                    Previous
+ * ip4-rx-urpf-strict         ip4-drop [0]
+ * @cliexend
+ *
+ * Example of how to enable unicast source checking on an interface:
+ * @cliexcmd{set urpf ip4 rx GigabitEthernet2/0/0 loose}
+ *
+ * Example of graph node after range checking is enabled:
+ * @cliexstart{show vlib graph ip4-rx-urpf-loose}
+ *            Name                      Next                    Previous
+ * ip4-rx-urpf-loose                ip4-drop [0]           ip4-input-no-checksum
+ *                           ip4-source-and-port-range-         ip4-input
+ * @cliexend
+ *
+ * Example of how to display the feature enabed on an interface:
+ * @cliexstart{show ip interface features GigabitEthernet2/0/0}
+ * IP feature paths configured on GigabitEthernet2/0/0...
+ *
+ * ipv4 unicast:
+ *   ip4-rx-urpf-loose
+ *   ip4-lookup
+ *
+ * ipv4 multicast:
+ *   ip4-lookup-multicast
+ *
+ * ipv4 multicast:
+ *   interface-output
+ *
+ * ipv6 unicast:
+ *   ip6-lookup
+ *
+ * ipv6 multicast:
+ *   ip6-lookup
+ *
+ * ipv6 multicast:
+ *   interface-output
+ * @cliexend
+ *
+ * Example of how to disable unicast source checking on an interface:
+ * @cliexcmd{set urpf ip4 off GigabitEthernet2/0/0}
+ * @endparblock
+?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = {
+  .path = "set urpf",
+  .function = urpf_cli_update,
+  .short_help = "set urpf [ip4|ip6] [rx|tx] [off|strict|loose] <INTERFACE>",
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+urpf_cli_accept (vlib_main_t * vm,
+		 unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  clib_error_t *error = NULL;
+  fib_prefix_t fpfx;
+  ip_prefix_t pfx;
+  u32 table_id, is_add, fib_index;
+
+  is_add = 1;
+  table_id = 0;
+
+  /* Get a line of input. */
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "table %d", &table_id))
+	;
+      else if (unformat (line_input, "del"))
+	is_add = 0;
+      else if (unformat (line_input, "add"))
+	is_add = 1;
+      else if (unformat (line_input, "%U", unformat_ip_prefix, &pfx))
+	;
+      else
+	{
+	  error = unformat_parse_error (line_input);
+	  goto done;
+	}
+    }
+
+  ip_prefix_to_fib_prefix (&pfx, &fpfx);
+
+  fib_index = fib_table_find (fpfx.fp_proto, table_id);
+
+  if (~0 == fib_index)
+    {
+      error = clib_error_return (0, "Nonexistent table id %d", table_id);
+      goto done;
+    }
+
+  if (is_add)
+    fib_table_entry_special_add (fib_index,
+				 &fpfx,
+				 FIB_SOURCE_URPF_EXEMPT, FIB_ENTRY_FLAG_DROP);
+  else
+    fib_table_entry_special_remove (fib_index, &fpfx, FIB_SOURCE_URPF_EXEMPT);
+
+done:
+  unformat_free (line_input);
+
+  return (error);
+}
+
+/*?
+ * Add an exemption for a prefix to pass the Unicast Reverse Path
+ * Forwarding (uRPF) loose check. This is for testing purposes only.
+ * If the '<em>table</em>' is not enter it is defaulted to 0. Default
+ * is to '<em>add</em>'. VPP always performs a loose uRPF check for
+ * for-us traffic.
+ *
+ * @cliexpar
+ * Example of how to add a uRPF exception to a FIB table to pass the
+ * loose RPF tests:
+ * @cliexcmd{set urpf-accept table 7 10.0.0.0/8 add}
+?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (urpf_accept_command, static) = {
+  .path = "set urpf-accept",
+  .function = urpf_cli_accept,
+  .short_help = "urpf-accept [table <table-id>] [add|del] <PREFIX>",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf.h b/src/plugins/urpf/urpf.h
new file mode 100644
index 00000000000..941cda25f4b
--- /dev/null
+++ b/src/plugins/urpf/urpf.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __URPF_H__
+#define __URPF_H__
+
+#include <vnet/ip/ip_types.h>
+
+#define foreach_urpf_mode \
+  _(OFF, "off")           \
+  _(LOOSE, "loose")       \
+  _(STRICT, "strict")     \
+
+typedef enum urpf_mode_t_
+{
+#define _(a,b) URPF_MODE_##a,
+  foreach_urpf_mode
+#undef _
+} __clib_packed urpf_mode_t;
+
+#define URPF_N_MODES (URPF_MODE_STRICT+1)
+
+extern u8 *format_urpf_mode (u8 * s, va_list * a);
+
+extern void urpf_update (urpf_mode_t mode,
+			 u32 sw_if_index,
+			 ip_address_family_t af, vlib_dir_t dir);
+
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf_api.c b/src/plugins/urpf/urpf_api.c
new file mode 100644
index 00000000000..ad060399347
--- /dev/null
+++ b/src/plugins/urpf/urpf_api.c
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <urpf/urpf.h>
+#include <vnet/plugin/plugin.h>
+#include <vnet/ip/ip_types_api.h>
+
+#include <vpp/app/version.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+
+/* define message IDs */
+#include <vnet/format_fns.h>
+#include <urpf/urpf.api_enum.h>
+#include <urpf/urpf.api_types.h>
+
+/**
+ * Base message ID fot the plugin
+ */
+static u32 urpf_base_msg_id;
+#define REPLY_MSG_ID_BASE urpf_base_msg_id
+
+#include <vlibapi/api_helper_macros.h>
+
+static int
+urpf_mode_decode (vl_api_urpf_mode_t in, urpf_mode_t * out)
+{
+  if (0)
+    ;
+#define _(a,b)                                  \
+  else if (URPF_API_MODE_##a == in)             \
+    {                                           \
+      *out = URPF_MODE_##a;                     \
+      return (0);                               \
+    }
+  foreach_urpf_mode
+#undef _
+    return (VNET_API_ERROR_INVALID_VALUE);
+}
+
+static void
+vl_api_urpf_update_t_handler (vl_api_urpf_update_t * mp)
+{
+  vl_api_urpf_update_reply_t *rmp;
+  ip_address_family_t af;
+  urpf_mode_t mode;
+  int rv = 0;
+
+  VALIDATE_SW_IF_INDEX (mp);
+
+  rv = urpf_mode_decode (mp->mode, &mode);
+
+  if (rv)
+    goto done;
+
+  rv = ip_address_family_decode (mp->af, &af);
+
+  if (rv)
+    goto done;
+
+  urpf_update (mode, htonl (mp->sw_if_index), af,
+	       (mp->is_input ? VLIB_RX : VLIB_TX));
+
+  BAD_SW_IF_INDEX_LABEL;
+done:
+  REPLY_MACRO (VL_API_URPF_UPDATE_REPLY);
+}
+
+#include <urpf/urpf.api.c>
+
+static clib_error_t *
+urpf_api_init (vlib_main_t * vm)
+{
+  /* Ask for a correctly-sized block of API message decode slots */
+  urpf_base_msg_id = setup_message_id_table ();
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (urpf_api_init);
+
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () = {
+    .version = VPP_BUILD_VER,
+    .description = "Unicast Reverse Path Forwarding (uRPF)",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf_dp.h b/src/plugins/urpf/urpf_dp.h
new file mode 100644
index 00000000000..3d3f19cfb1d
--- /dev/null
+++ b/src/plugins/urpf/urpf_dp.h
@@ -0,0 +1,331 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ *  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ *  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ *  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __URPF_DP_H__
+#define __URPF_DP_H__
+
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/fib/fib_urpf_list.h>
+#include <vnet/dpo/load_balance.h>
+
+#include <urpf/urpf.h>
+
+/**
+ * @file
+ * @brief Unicast Reverse Path forwarding.
+ *
+ * This file contains the interface unicast source check.
+ */
+typedef struct
+{
+  index_t urpf;
+} urpf_trace_t;
+
+static u8 *
+format_urpf_trace (u8 * s, va_list * va)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
+  urpf_trace_t *t = va_arg (*va, urpf_trace_t *);
+
+  s = format (s, "uRPF:%d", t->urpf);
+
+  return s;
+}
+
+#define foreach_urpf_error                 \
+  _(DROP, "uRPF Drop")                     \
+
+typedef enum urpf_error_t_
+{
+#define _(a,b) URPF_ERROR_##a,
+  foreach_urpf_error
+#undef _
+    URPF_N_ERROR,
+} urpf_error_t;
+
+typedef enum
+{
+  URPF_NEXT_DROP,
+  URPF_N_NEXT,
+} urpf_next_t;
+
+static_always_inline uword
+urpf_inline (vlib_main_t * vm,
+	     vlib_node_runtime_t * node,
+	     vlib_frame_t * frame,
+	     ip_address_family_t af, vlib_dir_t dir, urpf_mode_t mode)
+{
+  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
+  u16 nexts[VLIB_FRAME_SIZE], *next;
+  u32 n_left, *from;
+
+  from = vlib_frame_vector_args (frame);
+  n_left = frame->n_vectors;
+  b = bufs;
+  next = nexts;
+
+  vlib_get_buffers (vm, from, bufs, n_left);
+
+  while (n_left >= 4)
+    {
+      u32 pass0, lb_index0, pass1, lb_index1;
+      const load_balance_t *lb0, *lb1;
+      u32 fib_index0, fib_index1;
+      const u8 *h0, *h1;
+
+      /* Prefetch next iteration. */
+      {
+	vlib_prefetch_buffer_header (b[2], LOAD);
+	vlib_prefetch_buffer_header (b[3], LOAD);
+	vlib_prefetch_buffer_data (b[2], LOAD);
+	vlib_prefetch_buffer_data (b[3], LOAD);
+      }
+
+      h0 = (u8 *) vlib_buffer_get_current (b[0]);
+      h1 = (u8 *) vlib_buffer_get_current (b[1]);
+
+      if (VLIB_TX == dir)
+	{
+	  h0 += vnet_buffer (b[0])->ip.save_rewrite_length;
+	  h1 += vnet_buffer (b[1])->ip.save_rewrite_length;
+	}
+
+      if (AF_IP4 == af)
+	{
+	  const ip4_header_t *ip0, *ip1;
+
+	  ip0 = (ip4_header_t *) h0;
+	  ip1 = (ip4_header_t *) h1;
+
+	  fib_index0 = ip4_main.fib_index_by_sw_if_index
+	    [vnet_buffer (b[0])->sw_if_index[dir]];
+	  fib_index1 = ip4_main.fib_index_by_sw_if_index
+	    [vnet_buffer (b[1])->sw_if_index[dir]];
+
+	  ip4_fib_forwarding_lookup_x2 (fib_index0,
+					fib_index1,
+					&ip0->src_address,
+					&ip1->src_address,
+					&lb_index0, &lb_index1);
+	  /* Pass multicast. */
+	  pass0 = (ip4_address_is_multicast (&ip0->src_address) ||
+		   ip4_address_is_global_broadcast (&ip0->src_address));
+	  pass1 = (ip4_address_is_multicast (&ip1->src_address) ||
+		   ip4_address_is_global_broadcast (&ip1->src_address));
+	}
+      else
+	{
+	  const ip6_header_t *ip0, *ip1;
+
+	  fib_index0 = ip6_main.fib_index_by_sw_if_index
+	    [vnet_buffer (b[0])->sw_if_index[dir]];
+	  fib_index1 = ip6_main.fib_index_by_sw_if_index
+	    [vnet_buffer (b[1])->sw_if_index[dir]];
+
+	  ip0 = (ip6_header_t *) h0;
+	  ip1 = (ip6_header_t *) h1;
+
+	  lb_index0 = ip6_fib_table_fwding_lookup (fib_index0,
+						   &ip0->src_address);
+	  lb_index1 = ip6_fib_table_fwding_lookup (fib_index1,
+						   &ip1->src_address);
+	  pass0 = ip6_address_is_multicast (&ip0->src_address);
+	  pass1 = ip6_address_is_multicast (&ip1->src_address);
+	}
+
+      lb0 = load_balance_get (lb_index0);
+      lb1 = load_balance_get (lb_index1);
+
+      if (URPF_MODE_STRICT == mode)
+	{
+	  /* for RX the check is: would this source adddress be forwarded
+	   * out of the interface on which it was recieved, if yes allow.
+	   * For TX it's; would this source addres be forwarded out of the
+	   * interface through which it is being sent, if yes drop.
+	   */
+	  int res0, res1;
+
+	  res0 = fib_urpf_check (lb0->lb_urpf,
+				 vnet_buffer (b[0])->sw_if_index[dir]);
+	  res1 = fib_urpf_check (lb1->lb_urpf,
+				 vnet_buffer (b[1])->sw_if_index[dir]);
+
+	  if (VLIB_RX == dir)
+	    {
+	      pass0 |= res0;
+	      pass1 |= res1;
+	    }
+	  else
+	    {
+	      pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf);
+	      pass1 |= !res1 && fib_urpf_check_size (lb1->lb_urpf);
+	    }
+	}
+      else
+	{
+	  pass0 |= fib_urpf_check_size (lb0->lb_urpf);
+	  pass1 |= fib_urpf_check_size (lb1->lb_urpf);
+	}
+
+      if (PREDICT_TRUE (pass0))
+	vnet_feature_next_u16 (&next[0], b[0]);
+      else
+	{
+	  next[0] = URPF_NEXT_DROP;
+	  b[0]->error = node->errors[URPF_ERROR_DROP];
+	}
+      if (PREDICT_TRUE (pass1))
+	vnet_feature_next_u16 (&next[1], b[1]);
+      else
+	{
+	  next[1] = URPF_NEXT_DROP;
+	  b[1]->error = node->errors[URPF_ERROR_DROP];
+	}
+
+      if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
+	{
+	  urpf_trace_t *t;
+
+	  t = vlib_add_trace (vm, node, b[0], sizeof (*t));
+	  t->urpf = lb0->lb_urpf;
+	}
+      if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
+	{
+	  urpf_trace_t *t;
+
+	  t = vlib_add_trace (vm, node, b[1], sizeof (*t));
+	  t->urpf = lb1->lb_urpf;
+	}
+
+      b += 2;
+      next += 2;
+      n_left -= 2;
+    }
+
+  while (n_left)
+    {
+      u32 pass0, lb_index0, fib_index0;
+      const load_balance_t *lb0;
+      const u8 *h0;
+
+      h0 = (u8 *) vlib_buffer_get_current (b[0]);
+
+      if (VLIB_TX == dir)
+	h0 += vnet_buffer (b[0])->ip.save_rewrite_length;
+
+      if (AF_IP4 == af)
+	{
+	  const ip4_header_t *ip0;
+
+	  fib_index0 = ip4_main.fib_index_by_sw_if_index
+	    [vnet_buffer (b[0])->sw_if_index[dir]];
+	  ip0 = (ip4_header_t *) h0;
+
+	  lb_index0 = ip4_fib_forwarding_lookup (fib_index0,
+						 &ip0->src_address);
+
+	  /* Pass multicast. */
+	  pass0 = (ip4_address_is_multicast (&ip0->src_address) ||
+		   ip4_address_is_global_broadcast (&ip0->src_address));
+	}
+      else
+	{
+	  const ip6_header_t *ip0;
+
+	  ip0 = (ip6_header_t *) h0;
+	  fib_index0 = ip6_main.fib_index_by_sw_if_index
+	    [vnet_buffer (b[0])->sw_if_index[dir]];
+
+	  lb_index0 = ip6_fib_table_fwding_lookup (fib_index0,
+						   &ip0->src_address);
+	  pass0 = ip6_address_is_multicast (&ip0->src_address);
+	}
+
+      lb0 = load_balance_get (lb_index0);
+
+      if (URPF_MODE_STRICT == mode)
+	{
+	  int res0;
+
+	  res0 = fib_urpf_check (lb0->lb_urpf,
+				 vnet_buffer (b[0])->sw_if_index[dir]);
+	  if (VLIB_RX == dir)
+	    pass0 |= res0;
+	  else
+	    pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf);
+	}
+      else
+	pass0 |= fib_urpf_check_size (lb0->lb_urpf);
+
+      if (PREDICT_TRUE (pass0))
+	vnet_feature_next_u16 (&next[0], b[0]);
+      else
+	{
+	  next[0] = URPF_NEXT_DROP;
+	  b[0]->error = node->errors[URPF_ERROR_DROP];
+	}
+
+      if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
+	{
+	  urpf_trace_t *t;
+
+	  t = vlib_add_trace (vm, node, b[0], sizeof (*t));
+	  t->urpf = lb0->lb_urpf;
+	}
+      b++;
+      next++;
+      n_left--;
+    }
+
+  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+  return frame->n_vectors;
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/CMakeLists.txt b/src/vnet/CMakeLists.txt
index 9911b0420a6..f8948de5d5e 100644
--- a/src/vnet/CMakeLists.txt
+++ b/src/vnet/CMakeLists.txt
@@ -440,7 +440,6 @@ list(APPEND VNET_SOURCES
   ip/ip4_mtrie.c
   ip/ip4_pg.c
   ip/ip4_source_and_port_range_check.c
-  ip/ip4_source_check.c
   ip/reass/ip4_full_reass.c
   ip/reass/ip4_sv_reass.c
   ip/ip6_format.c
@@ -470,7 +469,6 @@ list(APPEND VNET_SOURCES
 )
 
 list(APPEND VNET_MULTIARCH_SOURCES
-  ip/ip4_source_check.c
   ip/ip4_punt_drop.c
   ip/reass/ip4_full_reass.c
   ip/ip6_hop_by_hop.c
diff --git a/src/vnet/fib/ip4_fib.h b/src/vnet/fib/ip4_fib.h
index ff00b4170c4..7d17baf2545 100644
--- a/src/vnet/fib/ip4_fib.h
+++ b/src/vnet/fib/ip4_fib.h
@@ -172,6 +172,30 @@ ip4_fib_forwarding_lookup (u32 fib_index,
     return (ip4_fib_mtrie_leaf_get_adj_index(leaf));
 }
 
+static_always_inline void
+ip4_fib_forwarding_lookup_x2 (u32 fib_index0,
+                              u32 fib_index1,
+                              const ip4_address_t * addr0,
+                              const ip4_address_t * addr1,
+                              index_t *lb0,
+                              index_t *lb1)
+{
+    ip4_fib_mtrie_leaf_t leaf[2];
+    ip4_fib_mtrie_t * mtrie[2];
+
+    mtrie[0] = &ip4_fib_get(fib_index0)->mtrie;
+    mtrie[1] = &ip4_fib_get(fib_index1)->mtrie;
+
+    leaf[0] = ip4_fib_mtrie_lookup_step_one (mtrie[0], addr0);
+    leaf[1] = ip4_fib_mtrie_lookup_step_one (mtrie[1], addr1);
+    leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 2);
+    leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 2);
+    leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 3);
+    leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 3);
+
+    *lb0 = ip4_fib_mtrie_leaf_get_adj_index(leaf[0]);
+    *lb1 = ip4_fib_mtrie_leaf_get_adj_index(leaf[1]);
+}
 
 #endif
 
diff --git a/src/vnet/interface_types_api.h b/src/vnet/interface_types_api.h
new file mode 100644
index 00000000000..37f6bad8737
--- /dev/null
+++ b/src/vnet/interface_types_api.h
@@ -0,0 +1,88 @@
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+typedef u32 interface_index;
+
+enum if_status_flags
+{
+  IF_STATUS_API_FLAG_ADMIN_UP = 1,
+  IF_STATUS_API_FLAG_LINK_UP = 2,
+};
+
+/* Per protocol MTU */
+enum mtu_proto
+{
+  MTU_PROTO_API_L3,		/* Default payload MTU (without L2 headers) */
+  MTU_PROTO_API_IP4,		/* Per-protocol MTUs overriding default */
+  MTU_PROTO_API_IP6,
+  MTU_PROTO_API_MPLS,
+  MTU_PROTO_API_N,
+};
+
+enum link_duplex
+{
+  LINK_DUPLEX_API_UNKNOWN = 0,
+  LINK_DUPLEX_API_HALF = 1,
+  LINK_DUPLEX_API_FULL = 2,
+};
+
+enum sub_if_flags
+{
+  SUB_IF_API_FLAG_NO_TAGS = 1,
+  SUB_IF_API_FLAG_ONE_TAG = 2,
+  SUB_IF_API_FLAG_TWO_TAGS = 4,
+  SUB_IF_API_FLAG_DOT1AD = 8,
+  SUB_IF_API_FLAG_EXACT_MATCH = 16,
+  SUB_IF_API_FLAG_DEFAULT = 32,
+  SUB_IF_API_FLAG_OUTER_VLAN_ID_ANY = 64,
+  SUB_IF_API_FLAG_INNER_VLAN_ID_ANY = 128,
+  SUB_IF_API_FLAG_MASK_VNET = 254,	/* use with vnet_sub_interface_t raw_flags */
+  SUB_IF_API_FLAG_DOT1AH = 256,
+};
+
+enum rx_mode
+{
+  RX_MODE_API_UNKNOWN = 0,
+  RX_MODE_API_POLLING,
+  RX_MODE_API_INTERRUPT,
+  RX_MODE_API_ADAPTIVE,
+  RX_MODE_API_DEFAULT,
+};
+
+enum if_type
+{
+  /* A hw interface. */
+  IF_API_TYPE_HARDWARE,
+
+  /* A sub-interface. */
+  IF_API_TYPE_SUB,
+  IF_API_TYPE_P2P,
+  IF_API_TYPE_PIPE,
+};
+
+enum direction:u8
+{
+  DIRECTION_RX,
+  DIRECTION_TX,
+};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ip/ip.api b/src/vnet/ip/ip.api
index edf995ed77d..73c73a3cee0 100644
--- a/src/vnet/ip/ip.api
+++ b/src/vnet/ip/ip.api
@@ -509,22 +509,6 @@ autoreply define ip_source_and_port_range_check_interface_add_del
   u32 udp_out_vrf_id;
 };
 
-/** \brief Set interface source check request
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param is_add - add or del
-    @param loose - strict or loose
-    @param sw_if_index - interface index
-*/
-autoreply define ip_source_check_interface_add_del
-{
-  u32 client_index;
-  u32 context;
-  bool is_add [default=true];
-  bool loose;
-  vl_api_interface_index_t sw_if_index;
-};
-
 /** \brief IPv6 set link local address on interface request
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
diff --git a/src/vnet/ip/ip4_error.h b/src/vnet/ip/ip4_error.h
index 073555a83b0..dce3dd4c1ab 100644
--- a/src/vnet/ip/ip4_error.h
+++ b/src/vnet/ip/ip4_error.h
@@ -67,9 +67,6 @@
   _ (UDP_CHECKSUM, "bad udp checksum")					\
   _ (UDP_LENGTH, "inconsistent udp/ip lengths")				\
 									\
-  /* Errors signalled by ip4-source-check. */				\
-  _ (UNICAST_SOURCE_CHECK_FAILS, "ip4 unicast source check fails")	\
-                                                                        \
   /* Spoofed packets in ip4-rewrite-local */                            \
   _ (SPOOFED_LOCAL_PACKETS, "ip4 spoofed local-address packet drops")   \
                                                                         \
diff --git a/src/vnet/ip/ip4_forward.c b/src/vnet/ip/ip4_forward.c
index c945f70a9d7..4ba0a731006 100644
--- a/src/vnet/ip/ip4_forward.c
+++ b/src/vnet/ip/ip4_forward.c
@@ -903,20 +903,6 @@ VNET_FEATURE_INIT (ip4_inacl, static) =
 {
   .arc_name = "ip4-unicast",
   .node_name = "ip4-inacl",
-  .runs_before = VNET_FEATURES ("ip4-source-check-via-rx"),
-};
-
-VNET_FEATURE_INIT (ip4_source_check_1, static) =
-{
-  .arc_name = "ip4-unicast",
-  .node_name = "ip4-source-check-via-rx",
-  .runs_before = VNET_FEATURES ("ip4-source-check-via-any"),
-};
-
-VNET_FEATURE_INIT (ip4_source_check_2, static) =
-{
-  .arc_name = "ip4-unicast",
-  .node_name = "ip4-source-check-via-any",
   .runs_before = VNET_FEATURES ("ip4-policer-classify"),
 };
 
diff --git a/src/vnet/ip/ip4_input.c b/src/vnet/ip/ip4_input.c
index 6093b136c3d..4d48db8f567 100644
--- a/src/vnet/ip/ip4_input.c
+++ b/src/vnet/ip/ip4_input.c
@@ -436,9 +436,6 @@ ip4_init (vlib_main_t * vm)
   if ((error = vlib_call_init_function (vm, ip4_cli_init)))
     return error;
 
-  if ((error = vlib_call_init_function (vm, ip4_source_check_init)))
-    return error;
-
   if ((error = vlib_call_init_function
        (vm, ip4_source_and_port_range_check_init)))
     return error;
diff --git a/src/vnet/ip/ip4_packet.h b/src/vnet/ip/ip4_packet.h
index 3872ccdd465..362805c8529 100644
--- a/src/vnet/ip/ip4_packet.h
+++ b/src/vnet/ip/ip4_packet.h
@@ -384,6 +384,12 @@ ip4_address_is_multicast (const ip4_address_t * a)
   return (a->data[0] & 0xf0) == 0xe0;
 }
 
+always_inline uword
+ip4_address_is_global_broadcast (const ip4_address_t * a)
+{
+  return (a->as_u32) == 0xffffffff;
+}
+
 always_inline void
 ip4_multicast_address_set_for_group (ip4_address_t * a,
 				     ip_multicast_group_t g)
diff --git a/src/vnet/ip/ip4_source_check.c b/src/vnet/ip/ip4_source_check.c
deleted file mode 100644
index b3d4b001e9e..00000000000
--- a/src/vnet/ip/ip4_source_check.c
+++ /dev/null
@@ -1,545 +0,0 @@
-/*
- * Copyright (c) 2015 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/*
- * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
- *
- * Copyright (c) 2008 Eliot Dresselhaus
- *
- * Permission is hereby granted, free of charge, to any person obtaining
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- *  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- *  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- *  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
- *  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
- *  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- *  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#include <vnet/ip/ip.h>
-#include <vnet/fib/ip4_fib.h>
-#include <vnet/fib/fib_urpf_list.h>
-#include <vnet/dpo/load_balance.h>
-
-/**
- * @file
- * @brief IPv4 Unicast Source Check.
- *
- * This file contains the IPv4 interface unicast source check.
- */
-
-
-typedef struct
-{
-  u8 packet_data[64];
-  index_t urpf;
-} ip4_source_check_trace_t;
-
-static u8 *
-format_ip4_source_check_trace (u8 * s, va_list * va)
-{
-  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
-  CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
-  ip4_source_check_trace_t *t = va_arg (*va, ip4_source_check_trace_t *);
-
-  s = format (s, "%U",
-	      format_ip4_header, t->packet_data, sizeof (t->packet_data));
-
-  return s;
-}
-
-typedef enum
-{
-  IP4_SOURCE_CHECK_NEXT_DROP,
-  IP4_SOURCE_CHECK_N_NEXT,
-} ip4_source_check_next_t;
-
-typedef enum
-{
-  IP4_SOURCE_CHECK_REACHABLE_VIA_RX,
-  IP4_SOURCE_CHECK_REACHABLE_VIA_ANY,
-} ip4_source_check_type_t;
-
-typedef union
-{
-  u32 fib_index;
-} ip4_source_check_config_t;
-
-always_inline uword
-ip4_source_check_inline (vlib_main_t * vm,
-			 vlib_node_runtime_t * node,
-			 vlib_frame_t * frame,
-			 ip4_source_check_type_t source_check_type)
-{
-  u32 n_left_from, *from, *to_next;
-  u32 next_index;
-  vlib_node_runtime_t *error_node =
-    vlib_node_get_runtime (vm, ip4_input_node.index);
-
-  from = vlib_frame_vector_args (frame);
-  n_left_from = frame->n_vectors;
-  next_index = node->cached_next_index;
-
-  if (node->flags & VLIB_NODE_FLAG_TRACE)
-    vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
-				   /* stride */ 1,
-				   sizeof (ip4_source_check_trace_t));
-
-  while (n_left_from > 0)
-    {
-      u32 n_left_to_next;
-
-      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
-
-      while (n_left_from >= 4 && n_left_to_next >= 2)
-	{
-	  vlib_buffer_t *p0, *p1;
-	  ip4_header_t *ip0, *ip1;
-	  ip4_fib_mtrie_t *mtrie0, *mtrie1;
-	  ip4_fib_mtrie_leaf_t leaf0, leaf1;
-	  ip4_source_check_config_t *c0, *c1;
-	  const load_balance_t *lb0, *lb1;
-	  u32 pi0, next0, pass0, lb_index0;
-	  u32 pi1, next1, pass1, lb_index1;
-
-	  /* Prefetch next iteration. */
-	  {
-	    vlib_buffer_t *p2, *p3;
-
-	    p2 = vlib_get_buffer (vm, from[2]);
-	    p3 = vlib_get_buffer (vm, from[3]);
-
-	    vlib_prefetch_buffer_header (p2, LOAD);
-	    vlib_prefetch_buffer_header (p3, LOAD);
-
-	    CLIB_PREFETCH (p2->data, sizeof (ip0[0]), LOAD);
-	    CLIB_PREFETCH (p3->data, sizeof (ip1[0]), LOAD);
-	  }
-
-	  pi0 = to_next[0] = from[0];
-	  pi1 = to_next[1] = from[1];
-	  from += 2;
-	  to_next += 2;
-	  n_left_from -= 2;
-	  n_left_to_next -= 2;
-
-	  p0 = vlib_get_buffer (vm, pi0);
-	  p1 = vlib_get_buffer (vm, pi1);
-
-	  ip0 = vlib_buffer_get_current (p0);
-	  ip1 = vlib_buffer_get_current (p1);
-
-	  c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0]));
-	  c1 = vnet_feature_next_with_data (&next1, p1, sizeof (c1[0]));
-
-	  mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie;
-	  mtrie1 = &ip4_fib_get (c1->fib_index)->mtrie;
-
-	  leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
-	  leaf1 = ip4_fib_mtrie_lookup_step_one (mtrie1, &ip1->src_address);
-
-	  leaf0 =
-	    ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2);
-	  leaf1 =
-	    ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 2);
-
-	  leaf0 =
-	    ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3);
-	  leaf1 =
-	    ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 3);
-
-	  lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0);
-	  lb_index1 = ip4_fib_mtrie_leaf_get_adj_index (leaf1);
-
-	  lb0 = load_balance_get (lb_index0);
-	  lb1 = load_balance_get (lb_index1);
-
-	  /* Pass multicast. */
-	  pass0 = ip4_address_is_multicast (&ip0->src_address)
-	    || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF);
-	  pass1 = ip4_address_is_multicast (&ip1->src_address)
-	    || ip1->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF);
-
-	  if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type)
-	    {
-	      pass0 |= fib_urpf_check (lb0->lb_urpf,
-				       vnet_buffer (p0)->sw_if_index
-				       [VLIB_RX]);
-	      pass1 |=
-		fib_urpf_check (lb1->lb_urpf,
-				vnet_buffer (p1)->sw_if_index[VLIB_RX]);
-	    }
-	  else
-	    {
-	      pass0 |= fib_urpf_check_size (lb0->lb_urpf);
-	      pass1 |= fib_urpf_check_size (lb1->lb_urpf);
-	    }
-	  next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP);
-	  next1 = (pass1 ? next1 : IP4_SOURCE_CHECK_NEXT_DROP);
-
-	  p0->error =
-	    error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS];
-	  p1->error =
-	    error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS];
-
-	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   pi0, pi1, next0, next1);
-	}
-
-      while (n_left_from > 0 && n_left_to_next > 0)
-	{
-	  vlib_buffer_t *p0;
-	  ip4_header_t *ip0;
-	  ip4_fib_mtrie_t *mtrie0;
-	  ip4_fib_mtrie_leaf_t leaf0;
-	  ip4_source_check_config_t *c0;
-	  u32 pi0, next0, pass0, lb_index0;
-	  const load_balance_t *lb0;
-
-	  pi0 = from[0];
-	  to_next[0] = pi0;
-	  from += 1;
-	  to_next += 1;
-	  n_left_from -= 1;
-	  n_left_to_next -= 1;
-
-	  p0 = vlib_get_buffer (vm, pi0);
-	  ip0 = vlib_buffer_get_current (p0);
-
-	  c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0]));
-
-	  mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie;
-
-	  leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
-
-	  leaf0 =
-	    ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2);
-
-	  leaf0 =
-	    ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3);
-
-	  lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0);
-
-	  lb0 = load_balance_get (lb_index0);
-
-	  /* Pass multicast. */
-	  pass0 = ip4_address_is_multicast (&ip0->src_address)
-	    || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF);
-
-	  if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type)
-	    {
-	      pass0 |= fib_urpf_check (lb0->lb_urpf,
-				       vnet_buffer (p0)->sw_if_index
-				       [VLIB_RX]);
-	    }
-	  else
-	    {
-	      pass0 |= fib_urpf_check_size (lb0->lb_urpf);
-	    }
-
-	  next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP);
-	  p0->error =
-	    error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS];
-
-	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   pi0, next0);
-	}
-
-      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
-    }
-
-  return frame->n_vectors;
-}
-
-VLIB_NODE_FN (ip4_check_source_reachable_via_any) (vlib_main_t * vm,
-						   vlib_node_runtime_t * node,
-						   vlib_frame_t * frame)
-{
-  return ip4_source_check_inline (vm, node, frame,
-				  IP4_SOURCE_CHECK_REACHABLE_VIA_ANY);
-}
-
-VLIB_NODE_FN (ip4_check_source_reachable_via_rx) (vlib_main_t * vm,
-						  vlib_node_runtime_t * node,
-						  vlib_frame_t * frame)
-{
-  return ip4_source_check_inline (vm, node, frame,
-				  IP4_SOURCE_CHECK_REACHABLE_VIA_RX);
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip4_check_source_reachable_via_any) = {
-  .name = "ip4-source-check-via-any",
-  .vector_size = sizeof (u32),
-
-  .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT,
-  .next_nodes = {
-    [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop",
-  },
-
-  .format_buffer = format_ip4_header,
-  .format_trace = format_ip4_source_check_trace,
-};
-/* *INDENT-ON* */
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (ip4_check_source_reachable_via_rx) = {
-  .name = "ip4-source-check-via-rx",
-  .vector_size = sizeof (u32),
-
-  .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT,
-  .next_nodes = {
-    [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop",
-  },
-
-  .format_buffer = format_ip4_header,
-  .format_trace = format_ip4_source_check_trace,
-};
-/* *INDENT-ON* */
-
-static clib_error_t *
-set_ip_source_check (vlib_main_t * vm,
-		     unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  unformat_input_t _line_input, *line_input = &_line_input;
-  vnet_main_t *vnm = vnet_get_main ();
-  ip4_main_t *im = &ip4_main;
-  clib_error_t *error = 0;
-  u32 sw_if_index, is_del;
-  ip4_source_check_config_t config;
-  char *feature_name = "ip4-source-check-via-rx";
-
-  sw_if_index = ~0;
-  is_del = 0;
-
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat_user
-	  (line_input, unformat_vnet_sw_interface, vnm, &sw_if_index))
-	;
-      else if (unformat (line_input, "del"))
-	is_del = 1;
-      else if (unformat (line_input, "loose"))
-	feature_name = "ip4-source-check-via-any";
-      else
-	{
-	  error = unformat_parse_error (line_input);
-	  goto done;
-	}
-    }
-
-  if (~0 == sw_if_index)
-    {
-      error = clib_error_return (0, "unknown interface `%U'",
-				 format_unformat_error, line_input);
-      goto done;
-    }
-
-  config.fib_index = im->fib_index_by_sw_if_index[sw_if_index];
-  vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
-			       is_del == 0, &config, sizeof (config));
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-/*?
- * This command adds the 'ip4-source-check-via-rx' graph node for
- * a given interface. By adding the IPv4 source check graph node to
- * an interface, the code verifies that the source address of incoming
- * unicast packets are reachable over the incoming interface. Two flavours
- * are supported (the default is strict):
- * - loose: accept ingress packet if there is a route to reach the source
- * - strict: accept ingress packet if it arrived on an interface which
- *          the route to the source uses. i.e. an interface that the source
- *          is reachable via.
- *
- * @cliexpar
- * @parblock
- * Example of graph node before range checking is enabled:
- * @cliexstart{show vlib graph ip4-source-check-via-rx}
- *            Name                      Next                    Previous
- * ip4-source-check-via-rx         ip4-drop [0]
- * @cliexend
- *
- * Example of how to enable unicast source checking on an interface:
- * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 loose}
- *
- * Example of graph node after range checking is enabled:
- * @cliexstart{show vlib graph ip4-source-check-via-rx}
- *            Name                      Next                    Previous
- * ip4-source-check-via-rx         ip4-drop [0]           ip4-input-no-checksum
- *                           ip4-source-and-port-range-         ip4-input
- * @cliexend
- *
- * Example of how to display the feature enabed on an interface:
- * @cliexstart{show ip interface features GigabitEthernet2/0/0}
- * IP feature paths configured on GigabitEthernet2/0/0...
- *
- * ipv4 unicast:
- *   ip4-source-check-via-rx
- *   ip4-lookup
- *
- * ipv4 multicast:
- *   ip4-lookup-multicast
- *
- * ipv4 multicast:
- *   interface-output
- *
- * ipv6 unicast:
- *   ip6-lookup
- *
- * ipv6 multicast:
- *   ip6-lookup
- *
- * ipv6 multicast:
- *   interface-output
- * @cliexend
- *
- * Example of how to disable unicast source checking on an interface:
- * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 del}
- * @endparblock
-?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = {
-  .path = "set interface ip source-check",
-  .function = set_ip_source_check,
-  .short_help = "set interface ip source-check <interface> [strict|loose] [del]",
-};
-/* *INDENT-ON* */
-
-static clib_error_t *
-ip_source_check_accept (vlib_main_t * vm,
-			unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  unformat_input_t _line_input, *line_input = &_line_input;
-  fib_prefix_t pfx = {
-    .fp_proto = FIB_PROTOCOL_IP4,
-  };
-  clib_error_t *error = NULL;
-  u32 table_id, is_add, fib_index;
-
-  is_add = 1;
-  table_id = ~0;
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (line_input, "table %d", &table_id))
-	;
-      else if (unformat (line_input, "del"))
-	is_add = 0;
-      else if (unformat (line_input, "add"))
-	is_add = 1;
-      else if (unformat (line_input, "%U/%d",
-			 unformat_ip4_address, &pfx.fp_addr.ip4, &pfx.fp_len))
-	pfx.fp_proto = FIB_PROTOCOL_IP4;
-      else
-	{
-	  error = unformat_parse_error (line_input);
-	  goto done;
-	}
-    }
-
-  if (~0 != table_id)
-    {
-      fib_index = fib_table_find (pfx.fp_proto, table_id);
-      if (~0 == fib_index)
-	{
-	  error = clib_error_return (0, "Nonexistent table id %d", table_id);
-	  goto done;
-	}
-    }
-  else
-    {
-      fib_index = 0;
-    }
-
-  if (is_add)
-    {
-      fib_table_entry_special_add (fib_index,
-				   &pfx,
-				   FIB_SOURCE_URPF_EXEMPT,
-				   FIB_ENTRY_FLAG_DROP);
-    }
-  else
-    {
-      fib_table_entry_special_remove (fib_index,
-				      &pfx, FIB_SOURCE_URPF_EXEMPT);
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-/*?
- * Add an exemption for a prefix to pass the Unicast Reverse Path
- * Forwarding (uRPF) loose check. This is for testing purposes only.
- * If the '<em>table</em>' is not enter it is defaulted to 0. Default
- * is to '<em>add</em>'. VPP always performs a loose uRPF check for
- * for-us traffic.
- *
- * @cliexpar
- * Example of how to add a uRPF exception to a FIB table to pass the
- * loose RPF tests:
- * @cliexcmd{ip urpf-accept table 7 add}
-?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (ip_source_check_accept_command, static) = {
-  .path = "ip urpf-accept",
-  .function = ip_source_check_accept,
-  .short_help = "ip urpf-accept [table <table-id>] [add|del]",
-};
-/* *INDENT-ON* */
-
-
-#ifndef CLIB_MARCH_VARIANT
-/* Dummy init function to get us linked in. */
-clib_error_t *
-ip4_source_check_init (vlib_main_t * vm)
-{
-  return 0;
-}
-
-VLIB_INIT_FUNCTION (ip4_source_check_init);
-#endif /* CLIB_MARCH_VARIANT */
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
diff --git a/src/vnet/ip/ip_api.c b/src/vnet/ip/ip_api.c
index 4f5b6b9d0a6..5c0784f9cb3 100644
--- a/src/vnet/ip/ip_api.c
+++ b/src/vnet/ip/ip_api.c
@@ -94,8 +94,6 @@ _(IP_SOURCE_AND_PORT_RANGE_CHECK_ADD_DEL,                               \
   ip_source_and_port_range_check_add_del)                               \
 _(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL,                     \
   ip_source_and_port_range_check_interface_add_del)                     \
-_(IP_SOURCE_CHECK_INTERFACE_ADD_DEL,                                    \
-  ip_source_check_interface_add_del)                                    \
  _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS,                             \
    sw_interface_ip6_set_link_local_address)                             \
 _(IP_REASSEMBLY_SET, ip_reassembly_set)                                 \
@@ -1270,37 +1268,6 @@ static void
   REPLY_MACRO (VL_API_SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS_REPLY);
 }
 
-typedef union
-{
-  u32 fib_index;
-} ip4_source_check_config_t;
-
-static void
-  vl_api_ip_source_check_interface_add_del_t_handler
-  (vl_api_ip_source_check_interface_add_del_t * mp)
-{
-  vl_api_ip_source_check_interface_add_del_reply_t *rmp;
-  int rv;
-  u32 sw_if_index = ntohl (mp->sw_if_index);
-  u8 is_add = mp->is_add;
-  char *feature_name =
-    mp->loose ? "ip4-source-check-via-any" : "ip4-source-check-via-rx";
-
-  ip4_source_check_config_t config;
-
-  VALIDATE_SW_IF_INDEX (mp);
-
-  config.fib_index =
-    fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index);
-  rv =
-    vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
-				 is_add, &config, sizeof (config));
-  BAD_SW_IF_INDEX_LABEL;
-
-  REPLY_MACRO (VL_API_IP_SOURCE_CHECK_INTERFACE_ADD_DEL_REPLY);
-}
-
-
 static void
 vl_api_ip_table_replace_begin_t_handler (vl_api_ip_table_replace_begin_t * mp)
 {