vxlan-gbp: Add support for vxlan gbp

This patch implements vxlan with extension of group based
policy support.

Change-Id: I70405bf7332c02867286da8958d9652837edd3c2
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

5 files changed, 327 insertions, 2 deletions

diff --git a/test/patches/scapy-2.3.3/vxlan.patch b/test/patches/scapy-2.3.3/vxlan.patch
index 556df4dd70a..71493dd742c 100644
--- a/test/patches/scapy-2.3.3/vxlan.patch
+++ b/test/patches/scapy-2.3.3/vxlan.patch
@@ -8,4 +8,5 @@ diff --git a/scapy/layers/vxlan.py b/scapy/layers/vxlan.py
 +bind_layers(UDP, VXLAN, dport=4790)  # RFC standard vxlan-gpe port
  bind_layers(UDP, VXLAN, dport=6633)  # New IANA assigned port for use with NSH
  bind_layers(UDP, VXLAN, dport=8472)  # Linux implementation port
++bind_layers(UDP, VXLAN, dport=48879) # RFC standard vxlan-gbp port
  bind_layers(VXLAN, Ether, {'flags': 0x8})
diff --git a/test/patches/scapy-2.4/vxlan.py.patch b/test/patches/scapy-2.4/vxlan.py.patch
new file mode 100644
index 00000000000..c5876a4adbd
--- /dev/null
+++ b/test/patches/scapy-2.4/vxlan.py.patch
@@ -0,0 +1,12 @@
+diff --git a/scapy/layers/vxlan.py b/scapy/layers/vxlan.py
+index 03c3a5a..ee30f28 100644
+--- a/scapy/layers/vxlan.py
++++ b/scapy/layers/vxlan.py
+@@ -69,6 +69,7 @@ bind_layers(UDP, VXLAN, dport=4789)  # RFC standard vxlan port
+ bind_layers(UDP, VXLAN, dport=4790)  # RFC standard vxlan-gpe port
+ bind_layers(UDP, VXLAN, dport=6633)  # New IANA assigned port for use with NSH
+ bind_layers(UDP, VXLAN, dport=8472)  # Linux implementation port
++bind_layers(UDP, VXLAN, dport=48879) # iVXLAN port
+ bind_layers(UDP, VXLAN, sport=4789)
+ bind_layers(UDP, VXLAN, sport=4790)
+ bind_layers(UDP, VXLAN, sport=6633)
diff --git a/test/test_gbp.py b/test/test_gbp.py
index b6faa12c6a6..894690b216d 100644
--- a/test/test_gbp.py
+++ b/test/test_gbp.py
@@ -161,7 +161,7 @@ class VppGbpSubnet(VppObject):
             self.address_n,
             self.address_len,
             sw_if_index=self.sw_if_index if self.sw_if_index else 0xffffffff,
-            epg_id=self.epg if self.epg else 0xffffffff,
+            epg_id=self.epg if self.epg else 0xffff,
             is_ip6=self.is_ip6)
         self._test.registry.register(self, self._test.logger)
 
diff --git a/test/test_vxlan_gbp.py b/test/test_vxlan_gbp.py
new file mode 100644
index 00000000000..55594a59fa7
--- /dev/null
+++ b/test/test_vxlan_gbp.py
@@ -0,0 +1,277 @@
+#!/usr/bin/env python
+
+import socket
+from util import ip4n_range, ip4_range
+import unittest
+from framework import VppTestCase, VppTestRunner
+from template_bd import BridgeDomain
+
+from scapy.layers.l2 import Ether, Raw
+from scapy.layers.inet import IP, UDP
+from scapy.layers.vxlan import VXLAN
+from scapy.utils import atol
+
+import StringIO
+
+
+def reassemble(listoffragments):
+    buffer = StringIO.StringIO()
+    first = listoffragments[0]
+    buffer.seek(20)
+    for pkt in listoffragments:
+        buffer.seek(pkt[IP].frag*8)
+        buffer.write(pkt[IP].payload)
+    first.len = len(buffer.getvalue()) + 20
+    first.flags = 0
+    del(first.chksum)
+    header = str(first[Ether])[:34]
+    return first[Ether].__class__(header + buffer.getvalue())
+
+
+class TestVxlanGbp(VppTestCase):
+    """ VXLAN GBP Test Case """
+
+    @property
+    def frame_request(self):
+        """ Ethernet frame modeling a generic request """
+        return (Ether(src='00:00:00:00:00:01', dst='00:00:00:00:00:02') /
+                IP(src='1.2.3.4', dst='4.3.2.1') /
+                UDP(sport=10000, dport=20000) /
+                Raw('\xa5' * 100))
+
+    @property
+    def frame_reply(self):
+        """ Ethernet frame modeling a generic reply """
+        return (Ether(src='00:00:00:00:00:02', dst='00:00:00:00:00:01') /
+                IP(src='4.3.2.1', dst='1.2.3.4') /
+                UDP(sport=20000, dport=10000) /
+                Raw('\xa5' * 100))
+
+    def encapsulate(self, pkt, vni):
+        """
+        Encapsulate the original payload frame by adding VXLAN GBP header with
+        its UDP, IP and Ethernet fields
+        """
+        return (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+                IP(src=self.pg0.remote_ip4, dst=self.pg0.local_ip4) /
+                UDP(sport=self.dport, dport=self.dport, chksum=0) /
+                VXLAN(vni=vni, flags=self.flags, gpflags=self.gpflags,
+                gpid=self.sclass) / pkt)
+
+    def ip_range(self, start, end):
+        """ range of remote ip's """
+        return ip4_range(self.pg0.remote_ip4, start, end)
+
+    def decapsulate(self, pkt):
+        """
+        Decapsulate the original payload frame by removing VXLAN header
+        """
+        # check if is set G and I flag
+        self.assertEqual(pkt[VXLAN].flags, int('0x88', 16))
+        return pkt[VXLAN].payload
+
+    # Method for checking VXLAN GBP encapsulation.
+    #
+    def check_encapsulation(self, pkt, vni, local_only=False, mcast_pkt=False):
+        # TODO: add error messages
+        # Verify source MAC is VPP_MAC and destination MAC is MY_MAC resolved
+        #  by VPP using ARP.
+        self.assertEqual(pkt[Ether].src, self.pg0.local_mac)
+        if not local_only:
+            if not mcast_pkt:
+                self.assertEqual(pkt[Ether].dst, self.pg0.remote_mac)
+            else:
+                self.assertEqual(pkt[Ether].dst, type(self).mcast_mac)
+        # Verify VXLAN GBP tunnel source IP is VPP_IP and destination IP is
+        # MY_IP.
+        self.assertEqual(pkt[IP].src, self.pg0.local_ip4)
+        if not local_only:
+            if not mcast_pkt:
+                self.assertEqual(pkt[IP].dst, self.pg0.remote_ip4)
+            else:
+                self.assertEqual(pkt[IP].dst, type(self).mcast_ip4)
+        # Verify UDP destination port is VXLAN GBP 48879, source UDP port could
+        # be arbitrary.
+        self.assertEqual(pkt[UDP].dport, type(self).dport)
+        # TODO: checksum check
+        # Verify VNI
+        # pkt.show()
+        self.assertEqual(pkt[VXLAN].vni, vni)
+        # Verify Source Class
+        self.assertEqual(pkt[VXLAN].gpid, 0)
+
+    @classmethod
+    def create_vxlan_gbp_flood_test_bd(cls, vni, n_ucast_tunnels):
+        # Create 2 ucast vxlan tunnels under bd
+        ip_range_start = 10
+        ip_range_end = ip_range_start + n_ucast_tunnels
+        next_hop_address = cls.pg0.remote_ip4n
+        for dest_ip4n in ip4n_range(next_hop_address, ip_range_start,
+                                    ip_range_end):
+            # add host route so dest_ip4n will not be resolved
+            cls.vapi.ip_add_del_route(dest_ip4n, 32, next_hop_address)
+            r = cls.vapi.vxlan_gbp_add_del_tunnel(
+                src_addr=cls.pg0.local_ip4n,
+                dst_addr=dest_ip4n,
+                vni=vni)
+            cls.vapi.sw_interface_set_l2_bridge(r.sw_if_index, bd_id=vni)
+
+    # Class method to start the VXLAN GBP test case.
+    #  Overrides setUpClass method in VppTestCase class.
+    #  Python try..except statement is used to ensure that the tear down of
+    #  the class will be executed even if exception is raised.
+    #  @param cls The class pointer.
+    @classmethod
+    def setUpClass(cls):
+        super(TestVxlanGbp, cls).setUpClass()
+
+        try:
+            cls.dport = 48879
+            cls.flags = 0x88
+            cls.gpflags = 0x0
+            cls.sclass = 0
+
+            # Create 2 pg interfaces.
+            cls.create_pg_interfaces(range(4))
+            for pg in cls.pg_interfaces:
+                pg.admin_up()
+
+            # Configure IPv4 addresses on VPP pg0.
+            cls.pg0.config_ip4()
+
+            # Resolve MAC address for VPP's IP address on pg0.
+            cls.pg0.resolve_arp()
+
+            # Create VXLAN GBP VTEP on VPP pg0, and put vxlan_gbp_tunnel0 and
+            # pg1 into BD.
+            cls.single_tunnel_bd = 1
+            r = cls.vapi.vxlan_gbp_add_del_tunnel(
+                src_addr=cls.pg0.local_ip4n,
+                dst_addr=cls.pg0.remote_ip4n,
+                vni=cls.single_tunnel_bd)
+            cls.vapi.sw_interface_set_l2_bridge(r.sw_if_index,
+                                                bd_id=cls.single_tunnel_bd)
+            cls.vapi.sw_interface_set_l2_bridge(cls.pg1.sw_if_index,
+                                                bd_id=cls.single_tunnel_bd)
+
+            # Setup vni 2 to test multicast flooding
+            cls.n_ucast_tunnels = 2
+            # Setup vni 3 to test unicast flooding
+            cls.ucast_flood_bd = 3
+            cls.create_vxlan_gbp_flood_test_bd(cls.ucast_flood_bd,
+                                               cls.n_ucast_tunnels)
+            cls.vapi.sw_interface_set_l2_bridge(cls.pg3.sw_if_index,
+                                                bd_id=cls.ucast_flood_bd)
+        except Exception:
+            super(TestVxlanGbp, cls).tearDownClass()
+            raise
+
+    def assert_eq_pkts(self, pkt1, pkt2):
+        """ Verify the Ether, IP, UDP, payload are equal in both
+        packets
+        """
+        self.assertEqual(pkt1[Ether].src, pkt2[Ether].src)
+        self.assertEqual(pkt1[Ether].dst, pkt2[Ether].dst)
+        self.assertEqual(pkt1[IP].src, pkt2[IP].src)
+        self.assertEqual(pkt1[IP].dst, pkt2[IP].dst)
+        self.assertEqual(pkt1[UDP].sport, pkt2[UDP].sport)
+        self.assertEqual(pkt1[UDP].dport, pkt2[UDP].dport)
+        self.assertEqual(pkt1[Raw], pkt2[Raw])
+
+    def test_decap(self):
+        """ Decapsulation test
+        Send encapsulated frames from pg0
+        Verify receipt of decapsulated frames on pg1
+        """
+        encapsulated_pkt = self.encapsulate(self.frame_request,
+                                            self.single_tunnel_bd)
+
+        self.pg0.add_stream([encapsulated_pkt, ])
+
+        self.pg1.enable_capture()
+
+        self.pg_start()
+
+        # Pick first received frame and check if it's the non-encapsulated
+        # frame
+        out = self.pg1.get_capture(1)
+        pkt = out[0]
+        self.assert_eq_pkts(pkt, self.frame_request)
+
+    def test_encap(self):
+        """ Encapsulation test
+        Send frames from pg1
+        Verify receipt of encapsulated frames on pg0
+        """
+        self.pg1.add_stream([self.frame_reply])
+
+        self.pg0.enable_capture()
+
+        self.pg_start()
+
+        # Pick first received frame and check if it's corectly encapsulated.
+        out = self.pg0.get_capture(1)
+        pkt = out[0]
+        self.check_encapsulation(pkt, self.single_tunnel_bd)
+
+        payload = self.decapsulate(pkt)
+        self.assert_eq_pkts(payload, self.frame_reply)
+
+    def test_ucast_flood(self):
+        """ Unicast flood test
+        Send frames from pg3
+        Verify receipt of encapsulated frames on pg0
+        """
+        self.pg3.add_stream([self.frame_reply])
+
+        self.pg0.enable_capture()
+
+        self.pg_start()
+
+        # Get packet from each tunnel and assert it's corectly encapsulated.
+        out = self.pg0.get_capture(self.n_ucast_tunnels)
+        for pkt in out:
+            self.check_encapsulation(pkt, self.ucast_flood_bd, True)
+            payload = self.decapsulate(pkt)
+            self.assert_eq_pkts(payload, self.frame_reply)
+
+    def test_encap_big_packet(self):
+        """ Encapsulation test send big frame from pg1
+        Verify receipt of encapsulated frames on pg0
+        """
+
+        self.vapi.sw_interface_set_mtu(self.pg0.sw_if_index, [1500, 0, 0, 0])
+
+        frame = (Ether(src='00:00:00:00:00:02', dst='00:00:00:00:00:01') /
+                 IP(src='4.3.2.1', dst='1.2.3.4') /
+                 UDP(sport=20000, dport=10000) /
+                 Raw('\xa5' * 1450))
+
+        self.pg1.add_stream([frame])
+
+        self.pg0.enable_capture()
+
+        self.pg_start()
+
+        # Pick first received frame and check if it's correctly encapsulated.
+        out = self.pg0.get_capture(2)
+        pkt = reassemble(out)
+        self.check_encapsulation(pkt, self.single_tunnel_bd)
+
+        payload = self.decapsulate(pkt)
+        self.assert_eq_pkts(payload, frame)
+
+# Method to define VPP actions before tear down of the test case.
+#  Overrides tearDown method in VppTestCase class.
+#  @param self The object pointer.
+    def tearDown(self):
+        super(TestVxlanGbp, self).tearDown()
+        if not self.vpp_dead:
+            self.logger.info(self.vapi.cli("show bridge-domain 1 detail"))
+            self.logger.info(self.vapi.cli("show bridge-domain 3 detail"))
+            self.logger.info(self.vapi.cli("show vxlan-gbp tunnel"))
+            self.logger.info(self.vapi.cli("show error"))
+
+
+if __name__ == '__main__':
+    unittest.main(testRunner=VppTestRunner)
diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py
index 9a3a9741ed9..b575b8ad6ac 100644
--- a/test/vpp_papi_provider.py
+++ b/test/vpp_papi_provider.py
@@ -2723,6 +2723,41 @@ class VppPapiProvider(object):
                          'protocol': protocol,
                          'vni': vni})
 
+    def vxlan_gbp_add_del_tunnel(
+            self,
+            src_addr,
+            dst_addr,
+            mcast_sw_if_index=0xFFFFFFFF,
+            is_add=1,
+            is_ipv6=0,
+            encap_vrf_id=0,
+            decap_next_index=0xFFFFFFFF,
+            vni=0,
+            instance=0xFFFFFFFF):
+        """
+
+        :param dst_addr:
+        :param src_addr:
+        :param is_add:  (Default value = 1)
+        :param is_ipv6:  (Default value = 0)
+        :param encap_vrf_id:  (Default value = 0)
+        :param decap_next_index:  (Default value = 0xFFFFFFFF)
+        :param mcast_sw_if_index:  (Default value = 0xFFFFFFFF)
+        :param vni:  (Default value = 0)
+        :param instance:  (Default value = 0xFFFFFFFF)
+
+        """
+        return self.api(self.papi.vxlan_gbp_add_del_tunnel,
+                        {'is_add': is_add,
+                         'is_ipv6': is_ipv6,
+                         'src_address': src_addr,
+                         'dst_address': dst_addr,
+                         'mcast_sw_if_index': mcast_sw_if_index,
+                         'encap_vrf_id': encap_vrf_id,
+                         'decap_next_index': decap_next_index,
+                         'vni': vni,
+                         'instance': instance})
+
     def pppoe_add_del_session(
             self,
             client_ip,
@@ -3446,7 +3481,7 @@ class VppPapiProvider(object):
                            is_internal,
                            addr, addr_len,
                            sw_if_index=0xffffffff,
-                           epg_id=0xffffffff,
+                           epg_id=0xffff,
                            is_ip6=False):
         """ GBP Subnet Add/Del """
         return self.api(self.papi.gbp_subnet_add_del,