diff options
| -rw-r--r-- | MAINTAINERS | 5 | ||||
| -rw-r--r-- | src/plugins/urpf/CMakeLists.txt | 27 | ||||
| -rw-r--r-- | src/plugins/urpf/ip4_urpf.c | 171 | ||||
| -rw-r--r-- | src/plugins/urpf/ip6_urpf.c | 171 | ||||
| -rw-r--r-- | src/plugins/urpf/test/test_urpf.py | 295 | ||||
| -rw-r--r-- | src/plugins/urpf/urpf.api | 59 | ||||
| -rw-r--r-- | src/plugins/urpf/urpf.c | 323 | ||||
| -rw-r--r-- | src/plugins/urpf/urpf.h | 50 | ||||
| -rw-r--r-- | src/plugins/urpf/urpf_api.c | 108 | ||||
| -rw-r--r-- | src/plugins/urpf/urpf_dp.h | 331 | ||||
| -rw-r--r-- | src/vnet/CMakeLists.txt | 2 | ||||
| -rw-r--r-- | src/vnet/fib/ip4_fib.h | 24 | ||||
| -rw-r--r-- | src/vnet/interface_types_api.h | 88 | ||||
| -rw-r--r-- | src/vnet/ip/ip.api | 16 | ||||
| -rw-r--r-- | src/vnet/ip/ip4_error.h | 3 | ||||
| -rw-r--r-- | src/vnet/ip/ip4_forward.c | 14 | ||||
| -rw-r--r-- | src/vnet/ip/ip4_input.c | 3 | ||||
| -rw-r--r-- | src/vnet/ip/ip4_packet.h | 6 | ||||
| -rw-r--r-- | src/vnet/ip/ip4_source_check.c | 545 | ||||
| -rw-r--r-- | src/vnet/ip/ip_api.c | 33 |
20 files changed, 1658 insertions, 616 deletions
diff --git a/MAINTAINERS b/MAINTAINERS index 08b8bc48bee..cf36e7a6207 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -660,6 +660,11 @@ I: vrrp M: Matthew Smith <mgsmith@netgate.com> F: src/plugins/vrrp +Plugin - Unicast Reverse Path forwarding +I: urpf +M: Neale Ranns <nranns@cisco.com> +F: src/plugins/urpf + VPP Config Tooling I: vpp_config M: John DeNisco <jdenisco@cisco.com> diff --git a/src/plugins/urpf/CMakeLists.txt b/src/plugins/urpf/CMakeLists.txt new file mode 100644 index 00000000000..2f44e3b2344 --- /dev/null +++ b/src/plugins/urpf/CMakeLists.txt @@ -0,0 +1,27 @@ +# Copyright (c) 2020 Cisco and/or its affiliates. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +add_vpp_plugin(urpf + SOURCES + urpf.c + urpf_api.c + ip4_urpf.c + ip6_urpf.c + + MULTIARCH_SOURCES + ip4_urpf.c + ip6_urpf.c + + API_FILES + urpf.api +) diff --git a/src/plugins/urpf/ip4_urpf.c b/src/plugins/urpf/ip4_urpf.c new file mode 100644 index 00000000000..25b6c94bde3 --- /dev/null +++ b/src/plugins/urpf/ip4_urpf.c @@ -0,0 +1,171 @@ +/* + * Copyright (c) 2015 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check) + * + * Copyright (c) 2008 Eliot Dresselhaus + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ + +#include <urpf/urpf.h> +#include <urpf/urpf_dp.h> + +static char *ip4_urpf_error_strings[] = { +#define _(a,b) "ip4-" # b, + foreach_urpf_error +#undef _ +}; + +VLIB_NODE_FN (ip4_rx_urpf_loose) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_LOOSE)); +} + +VLIB_NODE_FN (ip4_rx_urpf_strict) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_STRICT)); +} + +VLIB_NODE_FN (ip4_tx_urpf_loose) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_LOOSE)); +} + +VLIB_NODE_FN (ip4_tx_urpf_strict) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_STRICT)); +} + +/* *INDENT-OFF* */ +VLIB_REGISTER_NODE (ip4_rx_urpf_loose) = { + .name = "ip4-rx-urpf-loose", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip4-drop", + }, + .n_errors = ARRAY_LEN (ip4_urpf_error_strings), + .error_strings = ip4_urpf_error_strings, + + .format_buffer = format_ip4_header, + .format_trace = format_urpf_trace, +}; + +VLIB_REGISTER_NODE (ip4_rx_urpf_strict) = { + .name = "ip4-rx-urpf-strict", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip4-drop", + }, + .n_errors = ARRAY_LEN (ip4_urpf_error_strings), + .error_strings = ip4_urpf_error_strings, + + .format_buffer = format_ip4_header, + .format_trace = format_urpf_trace, +}; + +VLIB_REGISTER_NODE (ip4_tx_urpf_loose) = { + .name = "ip4-tx-urpf-loose", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip4-drop", + }, + .n_errors = ARRAY_LEN (ip4_urpf_error_strings), + .error_strings = ip4_urpf_error_strings, + + .format_buffer = format_ip4_header, + .format_trace = format_urpf_trace, +}; + +VLIB_REGISTER_NODE (ip4_tx_urpf_strict) = { + .name = "ip4-tx-urpf-strict", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip4-drop", + }, + .n_errors = ARRAY_LEN (ip4_urpf_error_strings), + .error_strings = ip4_urpf_error_strings, + + .format_buffer = format_ip4_header, + .format_trace = format_urpf_trace, +}; + +VNET_FEATURE_INIT (ip4_rx_urpf_loose_feat, static) = +{ + .arc_name = "ip4-unicast", + .node_name = "ip4-rx-urpf-loose", + .runs_before = VNET_FEATURES ("ip4-rx-urpf-strict"), +}; + +VNET_FEATURE_INIT (ip4_rx_urpf_strict_feat, static) = +{ + .arc_name = "ip4-unicast", + .node_name = "ip4-rx-urpf-strict", + .runs_before = VNET_FEATURES ("ip4-policer-classify"), +}; + +VNET_FEATURE_INIT (ip4_tx_urpf_loose_feat, static) = +{ + .arc_name = "ip4-output", + .node_name = "ip4-tx-urpf-loose", +}; + +VNET_FEATURE_INIT (ip4_tx_urpf_strict_feat, static) = +{ + .arc_name = "ip4-output", + .node_name = "ip4-tx-urpf-strict", +}; +/* *INDENT-ON* */ + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/urpf/ip6_urpf.c b/src/plugins/urpf/ip6_urpf.c new file mode 100644 index 00000000000..3a94a456cb7 --- /dev/null +++ b/src/plugins/urpf/ip6_urpf.c @@ -0,0 +1,171 @@ +/* + * Copyright (c) 2015 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check) + * + * Copyright (c) 2008 Eliot Dresselhaus + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ + +#include <urpf/urpf.h> +#include <urpf/urpf_dp.h> + +static char *ip6_urpf_error_strings[] = { +#define _(a,b) "ip6-" # b, + foreach_urpf_error +#undef _ +}; + +VLIB_NODE_FN (ip6_rx_urpf_loose) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_LOOSE)); +} + +VLIB_NODE_FN (ip6_rx_urpf_strict) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_STRICT)); +} + +VLIB_NODE_FN (ip6_tx_urpf_loose) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_LOOSE)); +} + +VLIB_NODE_FN (ip6_tx_urpf_strict) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_STRICT)); +} + +/* *INDENT-OFF* */ +VLIB_REGISTER_NODE (ip6_rx_urpf_loose) = { + .name = "ip6-rx-urpf-loose", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip6-drop", + }, + .n_errors = ARRAY_LEN (ip6_urpf_error_strings), + .error_strings = ip6_urpf_error_strings, + + .format_buffer = format_ip6_header, + .format_trace = format_urpf_trace, +}; + +VLIB_REGISTER_NODE (ip6_rx_urpf_strict) = { + .name = "ip6-rx-urpf-strict", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip6-drop", + }, + .n_errors = ARRAY_LEN (ip6_urpf_error_strings), + .error_strings = ip6_urpf_error_strings, + + .format_buffer = format_ip6_header, + .format_trace = format_urpf_trace, +}; + +VLIB_REGISTER_NODE (ip6_tx_urpf_loose) = { + .name = "ip6-tx-urpf-loose", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip6-drop", + }, + .n_errors = ARRAY_LEN (ip6_urpf_error_strings), + .error_strings = ip6_urpf_error_strings, + + .format_buffer = format_ip6_header, + .format_trace = format_urpf_trace, +}; + +VLIB_REGISTER_NODE (ip6_tx_urpf_strict) = { + .name = "ip6-tx-urpf-strict", + .vector_size = sizeof (u32), + + .n_next_nodes = URPF_N_NEXT, + .next_nodes = { + [URPF_NEXT_DROP] = "ip6-drop", + }, + .n_errors = ARRAY_LEN (ip6_urpf_error_strings), + .error_strings = ip6_urpf_error_strings, + + .format_buffer = format_ip6_header, + .format_trace = format_urpf_trace, +}; + +VNET_FEATURE_INIT (ip6_rx_urpf_loose_feat, static) = +{ + .arc_name = "ip6-unicast", + .node_name = "ip6-rx-urpf-loose", + .runs_before = VNET_FEATURES ("ip6-rx-urpf-strict"), +}; + +VNET_FEATURE_INIT (ip6_rx_urpf_strict_feat, static) = +{ + .arc_name = "ip6-unicast", + .node_name = "ip6-rx-urpf-strict", + .runs_before = VNET_FEATURES ("ip6-policer-classify"), +}; + +VNET_FEATURE_INIT (ip6_tx_urpf_loose_feat, static) = +{ + .arc_name = "ip6-output", + .node_name = "ip6-tx-urpf-loose", +}; + +VNET_FEATURE_INIT (ip6_tx_urpf_strict_feat, static) = +{ + .arc_name = "ip6-output", + .node_name = "ip6-tx-urpf-strict", +}; +/* *INDENT-ON* */ + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/urpf/test/test_urpf.py b/src/plugins/urpf/test/test_urpf.py new file mode 100644 index 00000000000..64b246cd663 --- /dev/null +++ b/src/plugins/urpf/test/test_urpf.py @@ -0,0 +1,295 @@ +#!/usr/bin/env python3 + +import unittest + +from framework import VppTestCase, VppTestRunner + +from scapy.packet import Raw +from scapy.layers.l2 import Ether +from scapy.layers.inet import IP, UDP, ICMP +from scapy.layers.inet6 import IPv6 + +from vpp_papi import VppEnum + +N_PKTS = 63 + + +class TestURPF(VppTestCase): + """ Unicast Reverse Path Forwarding Test Case """ + + @classmethod + def setUpClass(cls): + super(TestURPF, cls).setUpClass() + + @classmethod + def tearDownClass(cls): + super(TestURPF, cls).tearDownClass() + + def setUp(self): + super(TestURPF, self).setUp() + + # create 4 pg interfaces so there are a few addresses + # in the FIB + self.create_pg_interfaces(range(4)) + + for i in self.pg_interfaces: + i.admin_up() + i.config_ip4() + i.resolve_arp() + i.config_ip6() + i.resolve_ndp() + + def tearDown(self): + for i in self.pg_interfaces: + i.unconfig_ip4() + i.unconfig_ip6() + i.admin_down() + super(TestURPF, self).tearDown() + + def test_urpf4(self): + """ uRPF IP4 """ + + e = VppEnum + p_spoof_loose = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IP(src="3.3.3.3", dst=self.pg1.remote_ip4) / + UDP(sport=1234, dport=1234) / + Raw(b'\xa5' * 100)) * N_PKTS + p_spoof_strict = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IP(src=self.pg2.remote_ip4, + dst=self.pg1.remote_ip4) / + UDP(sport=1234, dport=1234) / + Raw(b'\xa5' * 100)) * N_PKTS + p_good = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IP(src=self.pg0.remote_ip4, + dst=self.pg1.remote_ip4) / + UDP(sport=1234, dport=1234) / + Raw(b'\xa5' * 100)) * N_PKTS + + # + # before adding the uRPF, ensure all packets are forwarded + # + self.send_and_expect(self.pg0, p_good, self.pg1) + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) + + # + # apply loose uRPF check on pg0 rx + # + self.vapi.urpf_update(is_input=True, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, + af=e.vl_api_address_family_t.ADDRESS_IP4, + sw_if_index=self.pg0.sw_if_index) + + # good packets still pass + self.send_and_expect(self.pg0, p_good, self.pg1) + # packets from address for which there is a route are forwarded + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + # packets from address to which there is no route are dropped + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip4-rx-urpf-loose", N_PKTS) + + # + # crank it up to strict mode + # + self.vapi.urpf_update(is_input=True, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, + af=e.vl_api_address_family_t.ADDRESS_IP4, + sw_if_index=self.pg0.sw_if_index) + + # good packets still pass + self.send_and_expect(self.pg0, p_good, self.pg1) + # packets that would not be routed back thru pg0 are dropped + self.send_and_assert_no_replies(self.pg0, p_spoof_strict) + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip4-rx-urpf-strict", 2 * N_PKTS) + + # + # disable uRPF, all traffic should pass + # + self.vapi.urpf_update(is_input=True, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, + af=e.vl_api_address_family_t.ADDRESS_IP4, + sw_if_index=self.pg0.sw_if_index) + + self.send_and_expect(self.pg0, p_good, self.pg1) + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) + + # + # Now apply in the TX direction + # for loose it is the same deal, they should not be forwarded + # if there's no route + # for strict they should not be forwarded if they would be + # forwarded thru that interface. + # + self.vapi.urpf_update(is_input=False, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, + af=e.vl_api_address_family_t.ADDRESS_IP4, + sw_if_index=self.pg1.sw_if_index) + + self.send_and_expect(self.pg0, p_good, self.pg1) + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip4-tx-urpf-loose", N_PKTS) + + self.vapi.urpf_update(is_input=False, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, + af=e.vl_api_address_family_t.ADDRESS_IP4, + sw_if_index=self.pg1.sw_if_index) + + self.send_and_expect(self.pg0, p_good, self.pg1) + # the strict packet, from a peer is allowed, since it does + # not forward via pg1 + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip4-tx-urpf-strict", N_PKTS) + + # change the strict packet so that it would forward through pg1 + p_spoof_strict = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IP(src=self.pg1.remote_ip4, + dst=self.pg1.remote_ip4) / + UDP(sport=1234, dport=1234) / + Raw(b'\xa5' * 100)) * N_PKTS + + self.send_and_assert_no_replies(self.pg0, p_spoof_strict) + self.assert_error_counter_equal("ip4-tx-urpf-strict", 2 * N_PKTS) + + # cleanup + self.vapi.urpf_update(is_input=False, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, + af=e.vl_api_address_family_t.ADDRESS_IP4, + sw_if_index=self.pg1.sw_if_index) + + def test_urpf6(self): + """ uRPF IP6 """ + + e = VppEnum + p_spoof_loose = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IPv6(src="3::3", dst=self.pg1.remote_ip6) / + UDP(sport=1236, dport=1236) / + Raw(b'\xa5' * 100)) * N_PKTS + p_spoof_strict = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IPv6(src=self.pg2.remote_ip6, + dst=self.pg1.remote_ip6) / + UDP(sport=1236, dport=1236) / + Raw(b'\xa5' * 100)) * N_PKTS + p_good = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IPv6(src=self.pg0.remote_ip6, + dst=self.pg1.remote_ip6) / + UDP(sport=1236, dport=1236) / + Raw(b'\xa5' * 100)) * N_PKTS + + # + # before adding the uRPF, ensure all packets are forwarded + # + self.send_and_expect(self.pg0, p_good, self.pg1) + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) + + # + # apply loose uRPF check on pg0 rx + # + self.vapi.urpf_update(is_input=True, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, + af=e.vl_api_address_family_t.ADDRESS_IP6, + sw_if_index=self.pg0.sw_if_index) + + # good packets still pass + self.send_and_expect(self.pg0, p_good, self.pg1) + # packets from address for which there is a route are forwarded + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + # packets from address to which there is no route are dropped + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip6-rx-urpf-loose", N_PKTS) + + # + # crank it up to strict mode + # + self.vapi.urpf_update(is_input=True, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, + af=e.vl_api_address_family_t.ADDRESS_IP6, + sw_if_index=self.pg0.sw_if_index) + + # good packets still pass + self.send_and_expect(self.pg0, p_good, self.pg1) + # packets that would not be routed back thru pg0 are dropped + self.send_and_assert_no_replies(self.pg0, p_spoof_strict) + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip6-rx-urpf-strict", 2 * N_PKTS) + + # + # disable uRPF, all traffic should pass + # + self.vapi.urpf_update(is_input=True, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, + af=e.vl_api_address_family_t.ADDRESS_IP6, + sw_if_index=self.pg0.sw_if_index) + + self.send_and_expect(self.pg0, p_good, self.pg1) + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) + + # + # Now apply in the TX direction + # for loose it is the same deal, they should not be forwarded + # if there's no route + # for strict they should not be forwarded if they would be + # forwarded thru that interface. + # + self.vapi.urpf_update(is_input=False, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, + af=e.vl_api_address_family_t.ADDRESS_IP6, + sw_if_index=self.pg1.sw_if_index) + + self.send_and_expect(self.pg0, p_good, self.pg1) + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip6-tx-urpf-loose", N_PKTS) + + self.vapi.urpf_update(is_input=False, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, + af=e.vl_api_address_family_t.ADDRESS_IP6, + sw_if_index=self.pg1.sw_if_index) + + self.send_and_expect(self.pg0, p_good, self.pg1) + # the strict packet, from a peer is allowed, since it does + # not forward via pg1 + self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) + self.send_and_assert_no_replies(self.pg0, p_spoof_loose) + + self.assert_error_counter_equal("ip6-tx-urpf-strict", N_PKTS) + + # change the strict packet so that it would forward through pg1 + p_spoof_strict = (Ether(dst=self.pg0.local_mac, + src=self.pg0.remote_mac) / + IPv6(src=self.pg1.remote_ip6, + dst=self.pg1.remote_ip6) / + UDP(sport=1236, dport=1236) / + Raw(b'\xa5' * 100)) * N_PKTS + + self.send_and_assert_no_replies(self.pg0, p_spoof_strict) + self.assert_error_counter_equal("ip6-tx-urpf-strict", 2 * N_PKTS) + + # cleanup + self.vapi.urpf_update(is_input=False, + mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, + af=e.vl_api_address_family_t.ADDRESS_IP6, + sw_if_index=self.pg1.sw_if_index) + + +if __name__ == '__main__': + unittest.main(testRunner=VppTestRunner) diff --git a/src/plugins/urpf/urpf.api b/src/plugins/urpf/urpf.api new file mode 100644 index 00000000000..944db08cc94 --- /dev/null +++ b/src/plugins/urpf/urpf.api @@ -0,0 +1,59 @@ +/* Hey Emacs use -*- mode: C -*- */ +/* + * Copyright (c) 2016 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** \file + This file defines the vpp control-plane API messages + used to control the URPF plugin +*/ + +option version = "1.0.0"; +import "vnet/ip/ip_types.api"; +import "vnet/fib/fib_types.api"; +import "vnet/interface_types.api"; + +enum urpf_mode:u8 +{ + URPF_API_MODE_OFF, + URPF_API_MODE_LOOSE, + URPF_API_MODE_STRICT, +}; + +/** + * @brief Enable uRPF on a given interface in a given direction + * @param client_index - opaque cookie to identify the sender + * @param context - sender context, to match reply w/ request + * @param mode - Mode + * @param af - Address Family + * @param sw_if_index - Interface + * @param is_input - Direction. + */ +autoreply define urpf_update +{ + u32 client_index; + u32 context; + bool is_input[default = true]; + vl_api_urpf_mode_t mode; + vl_api_address_family_t af; + vl_api_interface_index_t sw_if_index; +}; + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/urpf/urpf.c b/src/plugins/urpf/urpf.c new file mode 100644 index 00000000000..7e1986a4250 --- /dev/null +++ b/src/plugins/urpf/urpf.c @@ -0,0 +1,323 @@ +/* + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include <urpf/urpf.h> + +#include <vnet/fib/fib_table.h> + +/* *INDENT-OFF* */ +static const char *urpf_feat_arcs[N_AF][VLIB_N_DIR] = +{ + [AF_IP4] = { + [VLIB_RX] = "ip4-unicast", + [VLIB_TX] = "ip4-output", + }, + [AF_IP6] = { + [VLIB_RX] = "ip6-unicast", + [VLIB_TX] = "ip6-output", + }, +}; + +static const char *urpf_feats[N_AF][VLIB_N_DIR][URPF_N_MODES] = +{ + [AF_IP4] = { + [VLIB_RX] = { + [URPF_MODE_STRICT] = "ip4-rx-urpf-strict", + [URPF_MODE_LOOSE] = "ip4-rx-urpf-loose", + }, + [VLIB_TX] = { + [URPF_MODE_STRICT] = "ip4-tx-urpf-strict", + [URPF_MODE_LOOSE] = "ip4-tx-urpf-loose", + }, + }, + [AF_IP6] = { + [VLIB_RX] = { + [URPF_MODE_STRICT] = "ip6-rx-urpf-strict", + [URPF_MODE_LOOSE] = "ip6-rx-urpf-loose", + }, + [VLIB_TX] = { + [URPF_MODE_STRICT] = "ip6-tx-urpf-strict", + [URPF_MODE_LOOSE] = "ip6-tx-urpf-loose", + }, + }, +}; +/* *INDENT-ON* */ + +/** + * Per-af, per-direction, per-interface uRPF configs + */ +static urpf_mode_t *urpf_cfgs[N_AF][VLIB_N_DIR]; + +u8 * +format_urpf_mode (u8 * s, va_list * a) +{ + urpf_mode_t mode = va_arg (*a, int); + + switch (mode) + { +#define _(a,b) \ + case URPF_MODE_##a: \ + return (format (s, "%s", b)); + foreach_urpf_mode +#undef _ + } + + return (format (s, "unknown")); +} + +static uword +unformat_urpf_mode (unformat_input_t * input, va_list * args) +{ + urpf_mode_t *mode = va_arg (*args, urpf_mode_t *); + + if (0) + ; +#define _(a,b) \ + else if (unformat (input, b)) \ + { \ + *mode = URPF_MODE_##a; \ + return (1); \ + } + foreach_urpf_mode +#undef _ + return 0; +} + +void +urpf_update (urpf_mode_t mode, + u32 sw_if_index, ip_address_family_t af, vlib_dir_t dir) +{ + urpf_mode_t old; + + vec_validate_init_empty (urpf_cfgs[af][dir], sw_if_index, URPF_MODE_OFF); + old = urpf_cfgs[af][dir][sw_if_index]; + + if (mode != old) + { + if (URPF_MODE_OFF != old) + /* disable what we have */ + vnet_feature_enable_disable (urpf_feat_arcs[af][dir], + urpf_feats[af][dir][old], + sw_if_index, 0, 0, 0); + + if (URPF_MODE_OFF != mode) + /* enable what's new */ + vnet_feature_enable_disable (urpf_feat_arcs[af][dir], + urpf_feats[af][dir][mode], + sw_if_index, 1, 0, 0); + } + /* else - no change to existing config */ + + urpf_cfgs[af][dir][sw_if_index] = mode; +} + +static clib_error_t * +urpf_cli_update (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + vnet_main_t *vnm = vnet_get_main (); + clib_error_t *error = NULL; + ip_address_family_t af; + urpf_mode_t mode; + u32 sw_if_index; + vlib_dir_t dir; + + sw_if_index = ~0; + af = AF_IP4; + dir = VLIB_RX; + mode = URPF_MODE_STRICT; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "%U", + unformat_vnet_sw_interface, vnm, &sw_if_index)) + ; + else if (unformat (line_input, "%U", unformat_urpf_mode, &mode)) + ; + else if (unformat (line_input, "%U", unformat_ip_address_family, &af)) + ; + else if (unformat (line_input, "%U", unformat_vlib_rx_tx, &dir)) + ; + else + { + error = unformat_parse_error (line_input); + goto done; + } + } + + if (~0 == sw_if_index) + { + error = clib_error_return (0, "unknown interface `%U'", + format_unformat_error, line_input); + goto done; + } + + urpf_update (mode, sw_if_index, af, dir); +done: + unformat_free (line_input); + + return error; +} + +/*? + * This command configures uRPF on an interface. + * Two flavours are supported (the default is strict): + * - loose: accept ingress packet if there is a route to reach the source + * - strict: accept ingress packet if it arrived on an interface which + * the route to the source uses. i.e. an interface that the source + * is reachable via. + * + * @cliexpar + * @parblock + * Example of graph node before range checking is enabled: + * @cliexstart{show vlib graph ip4-rx-urpf-strict} + * Name Next Previous + * ip4-rx-urpf-strict ip4-drop [0] + * @cliexend + * + * Example of how to enable unicast source checking on an interface: + * @cliexcmd{set urpf ip4 rx GigabitEthernet2/0/0 loose} + * + * Example of graph node after range checking is enabled: + * @cliexstart{show vlib graph ip4-rx-urpf-loose} + * Name Next Previous + * ip4-rx-urpf-loose ip4-drop [0] ip4-input-no-checksum + * ip4-source-and-port-range- ip4-input + * @cliexend + * + * Example of how to display the feature enabed on an interface: + * @cliexstart{show ip interface features GigabitEthernet2/0/0} + * IP feature paths configured on GigabitEthernet2/0/0... + * + * ipv4 unicast: + * ip4-rx-urpf-loose + * ip4-lookup + * + * ipv4 multicast: + * ip4-lookup-multicast + * + * ipv4 multicast: + * interface-output + * + * ipv6 unicast: + * ip6-lookup + * + * ipv6 multicast: + * ip6-lookup + * + * ipv6 multicast: + * interface-output + * @cliexend + * + * Example of how to disable unicast source checking on an interface: + * @cliexcmd{set urpf ip4 off GigabitEthernet2/0/0} + * @endparblock +?*/ +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = { + .path = "set urpf", + .function = urpf_cli_update, + .short_help = "set urpf [ip4|ip6] [rx|tx] [off|strict|loose] <INTERFACE>", +}; +/* *INDENT-ON* */ + +static clib_error_t * +urpf_cli_accept (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + clib_error_t *error = NULL; + fib_prefix_t fpfx; + ip_prefix_t pfx; + u32 table_id, is_add, fib_index; + + is_add = 1; + table_id = 0; + + /* Get a line of input. */ + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "table %d", &table_id)) + ; + else if (unformat (line_input, "del")) + is_add = 0; + else if (unformat (line_input, "add")) + is_add = 1; + else if (unformat (line_input, "%U", unformat_ip_prefix, &pfx)) + ; + else + { + error = unformat_parse_error (line_input); + goto done; + } + } + + ip_prefix_to_fib_prefix (&pfx, &fpfx); + + fib_index = fib_table_find (fpfx.fp_proto, table_id); + + if (~0 == fib_index) + { + error = clib_error_return (0, "Nonexistent table id %d", table_id); + goto done; + } + + if (is_add) + fib_table_entry_special_add (fib_index, + &fpfx, + FIB_SOURCE_URPF_EXEMPT, FIB_ENTRY_FLAG_DROP); + else + fib_table_entry_special_remove (fib_index, &fpfx, FIB_SOURCE_URPF_EXEMPT); + +done: + unformat_free (line_input); + + return (error); +} + +/*? + * Add an exemption for a prefix to pass the Unicast Reverse Path + * Forwarding (uRPF) loose check. This is for testing purposes only. + * If the '<em>table</em>' is not enter it is defaulted to 0. Default + * is to '<em>add</em>'. VPP always performs a loose uRPF check for + * for-us traffic. + * + * @cliexpar + * Example of how to add a uRPF exception to a FIB table to pass the + * loose RPF tests: + * @cliexcmd{set urpf-accept table 7 10.0.0.0/8 add} +?*/ +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (urpf_accept_command, static) = { + .path = "set urpf-accept", + .function = urpf_cli_accept, + .short_help = "urpf-accept [table <table-id>] [add|del] <PREFIX>", +}; +/* *INDENT-ON* */ + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/urpf/urpf.h b/src/plugins/urpf/urpf.h new file mode 100644 index 00000000000..941cda25f4b --- /dev/null +++ b/src/plugins/urpf/urpf.h @@ -0,0 +1,50 @@ +/* + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef __URPF_H__ +#define __URPF_H__ + +#include <vnet/ip/ip_types.h> + +#define foreach_urpf_mode \ + _(OFF, "off") \ + _(LOOSE, "loose") \ + _(STRICT, "strict") \ + +typedef enum urpf_mode_t_ +{ +#define _(a,b) URPF_MODE_##a, + foreach_urpf_mode +#undef _ +} __clib_packed urpf_mode_t; + +#define URPF_N_MODES (URPF_MODE_STRICT+1) + +extern u8 *format_urpf_mode (u8 * s, va_list * a); + +extern void urpf_update (urpf_mode_t mode, + u32 sw_if_index, + ip_address_family_t af, vlib_dir_t dir); + + +#endif + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/urpf/urpf_api.c b/src/plugins/urpf/urpf_api.c new file mode 100644 index 00000000000..ad060399347 --- /dev/null +++ b/src/plugins/urpf/urpf_api.c @@ -0,0 +1,108 @@ +/* + * Copyright (c) 2016 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include <urpf/urpf.h> +#include <vnet/plugin/plugin.h> +#include <vnet/ip/ip_types_api.h> + +#include <vpp/app/version.h> + +#include <vlibapi/api.h> +#include <vlibmemory/api.h> + +/* define message IDs */ +#include <vnet/format_fns.h> +#include <urpf/urpf.api_enum.h> +#include <urpf/urpf.api_types.h> + +/** + * Base message ID fot the plugin + */ +static u32 urpf_base_msg_id; +#define REPLY_MSG_ID_BASE urpf_base_msg_id + +#include <vlibapi/api_helper_macros.h> + +static int +urpf_mode_decode (vl_api_urpf_mode_t in, urpf_mode_t * out) +{ + if (0) + ; +#define _(a,b) \ + else if (URPF_API_MODE_##a == in) \ + { \ + *out = URPF_MODE_##a; \ + return (0); \ + } + foreach_urpf_mode +#undef _ + return (VNET_API_ERROR_INVALID_VALUE); +} + +static void +vl_api_urpf_update_t_handler (vl_api_urpf_update_t * mp) +{ + vl_api_urpf_update_reply_t *rmp; + ip_address_family_t af; + urpf_mode_t mode; + int rv = 0; + + VALIDATE_SW_IF_INDEX (mp); + + rv = urpf_mode_decode (mp->mode, &mode); + + if (rv) + goto done; + + rv = ip_address_family_decode (mp->af, &af); + + if (rv) + goto done; + + urpf_update (mode, htonl (mp->sw_if_index), af, + (mp->is_input ? VLIB_RX : VLIB_TX)); + + BAD_SW_IF_INDEX_LABEL; +done: + REPLY_MACRO (VL_API_URPF_UPDATE_REPLY); +} + +#include <urpf/urpf.api.c> + +static clib_error_t * +urpf_api_init (vlib_main_t * vm) +{ + /* Ask for a correctly-sized block of API message decode slots */ + urpf_base_msg_id = setup_message_id_table (); + + return 0; +} + +VLIB_INIT_FUNCTION (urpf_api_init); + +/* *INDENT-OFF* */ +VLIB_PLUGIN_REGISTER () = { + .version = VPP_BUILD_VER, + .description = "Unicast Reverse Path Forwarding (uRPF)", +}; +/* *INDENT-ON* */ + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/urpf/urpf_dp.h b/src/plugins/urpf/urpf_dp.h new file mode 100644 index 00000000000..3d3f19cfb1d --- /dev/null +++ b/src/plugins/urpf/urpf_dp.h @@ -0,0 +1,331 @@ +/* + * Copyright (c) 2015 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check) + * + * Copyright (c) 2008 Eliot Dresselhaus + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ + +#ifndef __URPF_DP_H__ +#define __URPF_DP_H__ + +#include <vnet/fib/ip4_fib.h> +#include <vnet/fib/ip6_fib.h> +#include <vnet/fib/fib_urpf_list.h> +#include <vnet/dpo/load_balance.h> + +#include <urpf/urpf.h> + +/** + * @file + * @brief Unicast Reverse Path forwarding. + * + * This file contains the interface unicast source check. + */ +typedef struct +{ + index_t urpf; +} urpf_trace_t; + +static u8 * +format_urpf_trace (u8 * s, va_list * va) +{ + CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *); + CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *); + urpf_trace_t *t = va_arg (*va, urpf_trace_t *); + + s = format (s, "uRPF:%d", t->urpf); + + return s; +} + +#define foreach_urpf_error \ + _(DROP, "uRPF Drop") \ + +typedef enum urpf_error_t_ +{ +#define _(a,b) URPF_ERROR_##a, + foreach_urpf_error +#undef _ + URPF_N_ERROR, +} urpf_error_t; + +typedef enum +{ + URPF_NEXT_DROP, + URPF_N_NEXT, +} urpf_next_t; + +static_always_inline uword +urpf_inline (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame, + ip_address_family_t af, vlib_dir_t dir, urpf_mode_t mode) +{ + vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b; + u16 nexts[VLIB_FRAME_SIZE], *next; + u32 n_left, *from; + + from = vlib_frame_vector_args (frame); + n_left = frame->n_vectors; + b = bufs; + next = nexts; + + vlib_get_buffers (vm, from, bufs, n_left); + + while (n_left >= 4) + { + u32 pass0, lb_index0, pass1, lb_index1; + const load_balance_t *lb0, *lb1; + u32 fib_index0, fib_index1; + const u8 *h0, *h1; + + /* Prefetch next iteration. */ + { + vlib_prefetch_buffer_header (b[2], LOAD); + vlib_prefetch_buffer_header (b[3], LOAD); + vlib_prefetch_buffer_data (b[2], LOAD); + vlib_prefetch_buffer_data (b[3], LOAD); + } + + h0 = (u8 *) vlib_buffer_get_current (b[0]); + h1 = (u8 *) vlib_buffer_get_current (b[1]); + + if (VLIB_TX == dir) + { + h0 += vnet_buffer (b[0])->ip.save_rewrite_length; + h1 += vnet_buffer (b[1])->ip.save_rewrite_length; + } + + if (AF_IP4 == af) + { + const ip4_header_t *ip0, *ip1; + + ip0 = (ip4_header_t *) h0; + ip1 = (ip4_header_t *) h1; + + fib_index0 = ip4_main.fib_index_by_sw_if_index + [vnet_buffer (b[0])->sw_if_index[dir]]; + fib_index1 = ip4_main.fib_index_by_sw_if_index + [vnet_buffer (b[1])->sw_if_index[dir]]; + + ip4_fib_forwarding_lookup_x2 (fib_index0, + fib_index1, + &ip0->src_address, + &ip1->src_address, + &lb_index0, &lb_index1); + /* Pass multicast. */ + pass0 = (ip4_address_is_multicast (&ip0->src_address) || + ip4_address_is_global_broadcast (&ip0->src_address)); + pass1 = (ip4_address_is_multicast (&ip1->src_address) || + ip4_address_is_global_broadcast (&ip1->src_address)); + } + else + { + const ip6_header_t *ip0, *ip1; + + fib_index0 = ip6_main.fib_index_by_sw_if_index + [vnet_buffer (b[0])->sw_if_index[dir]]; + fib_index1 = ip6_main.fib_index_by_sw_if_index + [vnet_buffer (b[1])->sw_if_index[dir]]; + + ip0 = (ip6_header_t *) h0; + ip1 = (ip6_header_t *) h1; + + lb_index0 = ip6_fib_table_fwding_lookup (fib_index0, + &ip0->src_address); + lb_index1 = ip6_fib_table_fwding_lookup (fib_index1, + &ip1->src_address); + pass0 = ip6_address_is_multicast (&ip0->src_address); + pass1 = ip6_address_is_multicast (&ip1->src_address); + } + + lb0 = load_balance_get (lb_index0); + lb1 = load_balance_get (lb_index1); + + if (URPF_MODE_STRICT == mode) + { + /* for RX the check is: would this source adddress be forwarded + * out of the interface on which it was recieved, if yes allow. + * For TX it's; would this source addres be forwarded out of the + * interface through which it is being sent, if yes drop. + */ + int res0, res1; + + res0 = fib_urpf_check (lb0->lb_urpf, + vnet_buffer (b[0])->sw_if_index[dir]); + res1 = fib_urpf_check (lb1->lb_urpf, + vnet_buffer (b[1])->sw_if_index[dir]); + + if (VLIB_RX == dir) + { + pass0 |= res0; + pass1 |= res1; + } + else + { + pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf); + pass1 |= !res1 && fib_urpf_check_size (lb1->lb_urpf); + } + } + else + { + pass0 |= fib_urpf_check_size (lb0->lb_urpf); + pass1 |= fib_urpf_check_size (lb1->lb_urpf); + } + + if (PREDICT_TRUE (pass0)) + vnet_feature_next_u16 (&next[0], b[0]); + else + { + next[0] = URPF_NEXT_DROP; + b[0]->error = node->errors[URPF_ERROR_DROP]; + } + if (PREDICT_TRUE (pass1)) + vnet_feature_next_u16 (&next[1], b[1]); + else + { + next[1] = URPF_NEXT_DROP; + b[1]->error = node->errors[URPF_ERROR_DROP]; + } + + if (b[0]->flags & VLIB_BUFFER_IS_TRACED) + { + urpf_trace_t *t; + + t = vlib_add_trace (vm, node, b[0], sizeof (*t)); + t->urpf = lb0->lb_urpf; + } + if (b[1]->flags & VLIB_BUFFER_IS_TRACED) + { + urpf_trace_t *t; + + t = vlib_add_trace (vm, node, b[1], sizeof (*t)); + t->urpf = lb1->lb_urpf; + } + + b += 2; + next += 2; + n_left -= 2; + } + + while (n_left) + { + u32 pass0, lb_index0, fib_index0; + const load_balance_t *lb0; + const u8 *h0; + + h0 = (u8 *) vlib_buffer_get_current (b[0]); + + if (VLIB_TX == dir) + h0 += vnet_buffer (b[0])->ip.save_rewrite_length; + + if (AF_IP4 == af) + { + const ip4_header_t *ip0; + + fib_index0 = ip4_main.fib_index_by_sw_if_index + [vnet_buffer (b[0])->sw_if_index[dir]]; + ip0 = (ip4_header_t *) h0; + + lb_index0 = ip4_fib_forwarding_lookup (fib_index0, + &ip0->src_address); + + /* Pass multicast. */ + pass0 = (ip4_address_is_multicast (&ip0->src_address) || + ip4_address_is_global_broadcast (&ip0->src_address)); + } + else + { + const ip6_header_t *ip0; + + ip0 = (ip6_header_t *) h0; + fib_index0 = ip6_main.fib_index_by_sw_if_index + [vnet_buffer (b[0])->sw_if_index[dir]]; + + lb_index0 = ip6_fib_table_fwding_lookup (fib_index0, + &ip0->src_address); + pass0 = ip6_address_is_multicast (&ip0->src_address); + } + + lb0 = load_balance_get (lb_index0); + + if (URPF_MODE_STRICT == mode) + { + int res0; + + res0 = fib_urpf_check (lb0->lb_urpf, + vnet_buffer (b[0])->sw_if_index[dir]); + if (VLIB_RX == dir) + pass0 |= res0; + else + pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf); + } + else + pass0 |= fib_urpf_check_size (lb0->lb_urpf); + + if (PREDICT_TRUE (pass0)) + vnet_feature_next_u16 (&next[0], b[0]); + else + { + next[0] = URPF_NEXT_DROP; + b[0]->error = node->errors[URPF_ERROR_DROP]; + } + + if (b[0]->flags & VLIB_BUFFER_IS_TRACED) + { + urpf_trace_t *t; + + t = vlib_add_trace (vm, node, b[0], sizeof (*t)); + t->urpf = lb0->lb_urpf; + } + b++; + next++; + n_left--; + } + + vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors); + + return frame->n_vectors; +} + +#endif + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/vnet/CMakeLists.txt b/src/vnet/CMakeLists.txt index 9911b0420a6..f8948de5d5e 100644 --- a/src/vnet/CMakeLists.txt +++ b/src/vnet/CMakeLists.txt @@ -440,7 +440,6 @@ list(APPEND VNET_SOURCES ip/ip4_mtrie.c ip/ip4_pg.c ip/ip4_source_and_port_range_check.c - ip/ip4_source_check.c ip/reass/ip4_full_reass.c ip/reass/ip4_sv_reass.c ip/ip6_format.c @@ -470,7 +469,6 @@ list(APPEND VNET_SOURCES ) list(APPEND VNET_MULTIARCH_SOURCES - ip/ip4_source_check.c ip/ip4_punt_drop.c ip/reass/ip4_full_reass.c ip/ip6_hop_by_hop.c diff --git a/src/vnet/fib/ip4_fib.h b/src/vnet/fib/ip4_fib.h index ff00b4170c4..7d17baf2545 100644 --- a/src/vnet/fib/ip4_fib.h +++ b/src/vnet/fib/ip4_fib.h @@ -172,6 +172,30 @@ ip4_fib_forwarding_lookup (u32 fib_index, return (ip4_fib_mtrie_leaf_get_adj_index(leaf)); } +static_always_inline void +ip4_fib_forwarding_lookup_x2 (u32 fib_index0, + u32 fib_index1, + const ip4_address_t * addr0, + const ip4_address_t * addr1, + index_t *lb0, + index_t *lb1) +{ + ip4_fib_mtrie_leaf_t leaf[2]; + ip4_fib_mtrie_t * mtrie[2]; + + mtrie[0] = &ip4_fib_get(fib_index0)->mtrie; + mtrie[1] = &ip4_fib_get(fib_index1)->mtrie; + + leaf[0] = ip4_fib_mtrie_lookup_step_one (mtrie[0], addr0); + leaf[1] = ip4_fib_mtrie_lookup_step_one (mtrie[1], addr1); + leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 2); + leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 2); + leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 3); + leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 3); + + *lb0 = ip4_fib_mtrie_leaf_get_adj_index(leaf[0]); + *lb1 = ip4_fib_mtrie_leaf_get_adj_index(leaf[1]); +} #endif diff --git a/src/vnet/interface_types_api.h b/src/vnet/interface_types_api.h new file mode 100644 index 00000000000..37f6bad8737 --- /dev/null +++ b/src/vnet/interface_types_api.h @@ -0,0 +1,88 @@ +/* Hey Emacs use -*- mode: C -*- */ +/* + * Copyright (c) 2018 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +typedef u32 interface_index; + +enum if_status_flags +{ + IF_STATUS_API_FLAG_ADMIN_UP = 1, + IF_STATUS_API_FLAG_LINK_UP = 2, +}; + +/* Per protocol MTU */ +enum mtu_proto +{ + MTU_PROTO_API_L3, /* Default payload MTU (without L2 headers) */ + MTU_PROTO_API_IP4, /* Per-protocol MTUs overriding default */ + MTU_PROTO_API_IP6, + MTU_PROTO_API_MPLS, + MTU_PROTO_API_N, +}; + +enum link_duplex +{ + LINK_DUPLEX_API_UNKNOWN = 0, + LINK_DUPLEX_API_HALF = 1, + LINK_DUPLEX_API_FULL = 2, +}; + +enum sub_if_flags +{ + SUB_IF_API_FLAG_NO_TAGS = 1, + SUB_IF_API_FLAG_ONE_TAG = 2, + SUB_IF_API_FLAG_TWO_TAGS = 4, + SUB_IF_API_FLAG_DOT1AD = 8, + SUB_IF_API_FLAG_EXACT_MATCH = 16, + SUB_IF_API_FLAG_DEFAULT = 32, + SUB_IF_API_FLAG_OUTER_VLAN_ID_ANY = 64, + SUB_IF_API_FLAG_INNER_VLAN_ID_ANY = 128, + SUB_IF_API_FLAG_MASK_VNET = 254, /* use with vnet_sub_interface_t raw_flags */ + SUB_IF_API_FLAG_DOT1AH = 256, +}; + +enum rx_mode +{ + RX_MODE_API_UNKNOWN = 0, + RX_MODE_API_POLLING, + RX_MODE_API_INTERRUPT, + RX_MODE_API_ADAPTIVE, + RX_MODE_API_DEFAULT, +}; + +enum if_type +{ + /* A hw interface. */ + IF_API_TYPE_HARDWARE, + + /* A sub-interface. */ + IF_API_TYPE_SUB, + IF_API_TYPE_P2P, + IF_API_TYPE_PIPE, +}; + +enum direction:u8 +{ + DIRECTION_RX, + DIRECTION_TX, +}; + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/vnet/ip/ip.api b/src/vnet/ip/ip.api index edf995ed77d..73c73a3cee0 100644 --- a/src/vnet/ip/ip.api +++ b/src/vnet/ip/ip.api @@ -509,22 +509,6 @@ autoreply define ip_source_and_port_range_check_interface_add_del u32 udp_out_vrf_id; }; -/** \brief Set interface source check request - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param is_add - add or del - @param loose - strict or loose - @param sw_if_index - interface index -*/ -autoreply define ip_source_check_interface_add_del -{ - u32 client_index; - u32 context; - bool is_add [default=true]; - bool loose; - vl_api_interface_index_t sw_if_index; -}; - /** \brief IPv6 set link local address on interface request @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request diff --git a/src/vnet/ip/ip4_error.h b/src/vnet/ip/ip4_error.h index 073555a83b0..dce3dd4c1ab 100644 --- a/src/vnet/ip/ip4_error.h +++ b/src/vnet/ip/ip4_error.h @@ -67,9 +67,6 @@ _ (UDP_CHECKSUM, "bad udp checksum") \ _ (UDP_LENGTH, "inconsistent udp/ip lengths") \ \ - /* Errors signalled by ip4-source-check. */ \ - _ (UNICAST_SOURCE_CHECK_FAILS, "ip4 unicast source check fails") \ - \ /* Spoofed packets in ip4-rewrite-local */ \ _ (SPOOFED_LOCAL_PACKETS, "ip4 spoofed local-address packet drops") \ \ diff --git a/src/vnet/ip/ip4_forward.c b/src/vnet/ip/ip4_forward.c index c945f70a9d7..4ba0a731006 100644 --- a/src/vnet/ip/ip4_forward.c +++ b/src/vnet/ip/ip4_forward.c @@ -903,20 +903,6 @@ VNET_FEATURE_INIT (ip4_inacl, static) = { .arc_name = "ip4-unicast", .node_name = "ip4-inacl", - .runs_before = VNET_FEATURES ("ip4-source-check-via-rx"), -}; - -VNET_FEATURE_INIT (ip4_source_check_1, static) = -{ - .arc_name = "ip4-unicast", - .node_name = "ip4-source-check-via-rx", - .runs_before = VNET_FEATURES ("ip4-source-check-via-any"), -}; - -VNET_FEATURE_INIT (ip4_source_check_2, static) = -{ - .arc_name = "ip4-unicast", - .node_name = "ip4-source-check-via-any", .runs_before = VNET_FEATURES ("ip4-policer-classify"), }; diff --git a/src/vnet/ip/ip4_input.c b/src/vnet/ip/ip4_input.c index 6093b136c3d..4d48db8f567 100644 --- a/src/vnet/ip/ip4_input.c +++ b/src/vnet/ip/ip4_input.c @@ -436,9 +436,6 @@ ip4_init (vlib_main_t * vm) if ((error = vlib_call_init_function (vm, ip4_cli_init))) return error; - if ((error = vlib_call_init_function (vm, ip4_source_check_init))) - return error; - if ((error = vlib_call_init_function (vm, ip4_source_and_port_range_check_init))) return error; diff --git a/src/vnet/ip/ip4_packet.h b/src/vnet/ip/ip4_packet.h index 3872ccdd465..362805c8529 100644 --- a/src/vnet/ip/ip4_packet.h +++ b/src/vnet/ip/ip4_packet.h @@ -384,6 +384,12 @@ ip4_address_is_multicast (const ip4_address_t * a) return (a->data[0] & 0xf0) == 0xe0; } +always_inline uword +ip4_address_is_global_broadcast (const ip4_address_t * a) +{ + return (a->as_u32) == 0xffffffff; +} + always_inline void ip4_multicast_address_set_for_group (ip4_address_t * a, ip_multicast_group_t g) diff --git a/src/vnet/ip/ip4_source_check.c b/src/vnet/ip/ip4_source_check.c deleted file mode 100644 index b3d4b001e9e..00000000000 --- a/src/vnet/ip/ip4_source_check.c +++ /dev/null @@ -1,545 +0,0 @@ -/* - * Copyright (c) 2015 Cisco and/or its affiliates. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -/* - * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check) - * - * Copyright (c) 2008 Eliot Dresselhaus - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including - * without limitation the rights to use, copy, modify, merge, publish, - * distribute, sublicense, and/or sell copies of the Software, and to - * permit persons to whom the Software is furnished to do so, subject to - * the following conditions: - * - * The above copyright notice and this permission notice shall be - * included in all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND - * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE - * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION - * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION - * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - */ - -#include <vnet/ip/ip.h> -#include <vnet/fib/ip4_fib.h> -#include <vnet/fib/fib_urpf_list.h> -#include <vnet/dpo/load_balance.h> - -/** - * @file - * @brief IPv4 Unicast Source Check. - * - * This file contains the IPv4 interface unicast source check. - */ - - -typedef struct -{ - u8 packet_data[64]; - index_t urpf; -} ip4_source_check_trace_t; - -static u8 * -format_ip4_source_check_trace (u8 * s, va_list * va) -{ - CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *); - CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *); - ip4_source_check_trace_t *t = va_arg (*va, ip4_source_check_trace_t *); - - s = format (s, "%U", - format_ip4_header, t->packet_data, sizeof (t->packet_data)); - - return s; -} - -typedef enum -{ - IP4_SOURCE_CHECK_NEXT_DROP, - IP4_SOURCE_CHECK_N_NEXT, -} ip4_source_check_next_t; - -typedef enum -{ - IP4_SOURCE_CHECK_REACHABLE_VIA_RX, - IP4_SOURCE_CHECK_REACHABLE_VIA_ANY, -} ip4_source_check_type_t; - -typedef union -{ - u32 fib_index; -} ip4_source_check_config_t; - -always_inline uword -ip4_source_check_inline (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame, - ip4_source_check_type_t source_check_type) -{ - u32 n_left_from, *from, *to_next; - u32 next_index; - vlib_node_runtime_t *error_node = - vlib_node_get_runtime (vm, ip4_input_node.index); - - from = vlib_frame_vector_args (frame); - n_left_from = frame->n_vectors; - next_index = node->cached_next_index; - - if (node->flags & VLIB_NODE_FLAG_TRACE) - vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors, - /* stride */ 1, - sizeof (ip4_source_check_trace_t)); - - while (n_left_from > 0) - { - u32 n_left_to_next; - - vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); - - while (n_left_from >= 4 && n_left_to_next >= 2) - { - vlib_buffer_t *p0, *p1; - ip4_header_t *ip0, *ip1; - ip4_fib_mtrie_t *mtrie0, *mtrie1; - ip4_fib_mtrie_leaf_t leaf0, leaf1; - ip4_source_check_config_t *c0, *c1; - const load_balance_t *lb0, *lb1; - u32 pi0, next0, pass0, lb_index0; - u32 pi1, next1, pass1, lb_index1; - - /* Prefetch next iteration. */ - { - vlib_buffer_t *p2, *p3; - - p2 = vlib_get_buffer (vm, from[2]); - p3 = vlib_get_buffer (vm, from[3]); - - vlib_prefetch_buffer_header (p2, LOAD); - vlib_prefetch_buffer_header (p3, LOAD); - - CLIB_PREFETCH (p2->data, sizeof (ip0[0]), LOAD); - CLIB_PREFETCH (p3->data, sizeof (ip1[0]), LOAD); - } - - pi0 = to_next[0] = from[0]; - pi1 = to_next[1] = from[1]; - from += 2; - to_next += 2; - n_left_from -= 2; - n_left_to_next -= 2; - - p0 = vlib_get_buffer (vm, pi0); - p1 = vlib_get_buffer (vm, pi1); - - ip0 = vlib_buffer_get_current (p0); - ip1 = vlib_buffer_get_current (p1); - - c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0])); - c1 = vnet_feature_next_with_data (&next1, p1, sizeof (c1[0])); - - mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie; - mtrie1 = &ip4_fib_get (c1->fib_index)->mtrie; - - leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address); - leaf1 = ip4_fib_mtrie_lookup_step_one (mtrie1, &ip1->src_address); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2); - leaf1 = - ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 2); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3); - leaf1 = - ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 3); - - lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0); - lb_index1 = ip4_fib_mtrie_leaf_get_adj_index (leaf1); - - lb0 = load_balance_get (lb_index0); - lb1 = load_balance_get (lb_index1); - - /* Pass multicast. */ - pass0 = ip4_address_is_multicast (&ip0->src_address) - || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF); - pass1 = ip4_address_is_multicast (&ip1->src_address) - || ip1->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF); - - if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type) - { - pass0 |= fib_urpf_check (lb0->lb_urpf, - vnet_buffer (p0)->sw_if_index - [VLIB_RX]); - pass1 |= - fib_urpf_check (lb1->lb_urpf, - vnet_buffer (p1)->sw_if_index[VLIB_RX]); - } - else - { - pass0 |= fib_urpf_check_size (lb0->lb_urpf); - pass1 |= fib_urpf_check_size (lb1->lb_urpf); - } - next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP); - next1 = (pass1 ? next1 : IP4_SOURCE_CHECK_NEXT_DROP); - - p0->error = - error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS]; - p1->error = - error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS]; - - vlib_validate_buffer_enqueue_x2 (vm, node, next_index, - to_next, n_left_to_next, - pi0, pi1, next0, next1); - } - - while (n_left_from > 0 && n_left_to_next > 0) - { - vlib_buffer_t *p0; - ip4_header_t *ip0; - ip4_fib_mtrie_t *mtrie0; - ip4_fib_mtrie_leaf_t leaf0; - ip4_source_check_config_t *c0; - u32 pi0, next0, pass0, lb_index0; - const load_balance_t *lb0; - - pi0 = from[0]; - to_next[0] = pi0; - from += 1; - to_next += 1; - n_left_from -= 1; - n_left_to_next -= 1; - - p0 = vlib_get_buffer (vm, pi0); - ip0 = vlib_buffer_get_current (p0); - - c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0])); - - mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie; - - leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3); - - lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0); - - lb0 = load_balance_get (lb_index0); - - /* Pass multicast. */ - pass0 = ip4_address_is_multicast (&ip0->src_address) - || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF); - - if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type) - { - pass0 |= fib_urpf_check (lb0->lb_urpf, - vnet_buffer (p0)->sw_if_index - [VLIB_RX]); - } - else - { - pass0 |= fib_urpf_check_size (lb0->lb_urpf); - } - - next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP); - p0->error = - error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS]; - - vlib_validate_buffer_enqueue_x1 (vm, node, next_index, - to_next, n_left_to_next, - pi0, next0); - } - - vlib_put_next_frame (vm, node, next_index, n_left_to_next); - } - - return frame->n_vectors; -} - -VLIB_NODE_FN (ip4_check_source_reachable_via_any) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) -{ - return ip4_source_check_inline (vm, node, frame, - IP4_SOURCE_CHECK_REACHABLE_VIA_ANY); -} - -VLIB_NODE_FN (ip4_check_source_reachable_via_rx) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) -{ - return ip4_source_check_inline (vm, node, frame, - IP4_SOURCE_CHECK_REACHABLE_VIA_RX); -} - -/* *INDENT-OFF* */ -VLIB_REGISTER_NODE (ip4_check_source_reachable_via_any) = { - .name = "ip4-source-check-via-any", - .vector_size = sizeof (u32), - - .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT, - .next_nodes = { - [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop", - }, - - .format_buffer = format_ip4_header, - .format_trace = format_ip4_source_check_trace, -}; -/* *INDENT-ON* */ - -/* *INDENT-OFF* */ -VLIB_REGISTER_NODE (ip4_check_source_reachable_via_rx) = { - .name = "ip4-source-check-via-rx", - .vector_size = sizeof (u32), - - .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT, - .next_nodes = { - [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop", - }, - - .format_buffer = format_ip4_header, - .format_trace = format_ip4_source_check_trace, -}; -/* *INDENT-ON* */ - -static clib_error_t * -set_ip_source_check (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) -{ - unformat_input_t _line_input, *line_input = &_line_input; - vnet_main_t *vnm = vnet_get_main (); - ip4_main_t *im = &ip4_main; - clib_error_t *error = 0; - u32 sw_if_index, is_del; - ip4_source_check_config_t config; - char *feature_name = "ip4-source-check-via-rx"; - - sw_if_index = ~0; - is_del = 0; - - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat_user - (line_input, unformat_vnet_sw_interface, vnm, &sw_if_index)) - ; - else if (unformat (line_input, "del")) - is_del = 1; - else if (unformat (line_input, "loose")) - feature_name = "ip4-source-check-via-any"; - else - { - error = unformat_parse_error (line_input); - goto done; - } - } - - if (~0 == sw_if_index) - { - error = clib_error_return (0, "unknown interface `%U'", - format_unformat_error, line_input); - goto done; - } - - config.fib_index = im->fib_index_by_sw_if_index[sw_if_index]; - vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, - is_del == 0, &config, sizeof (config)); -done: - unformat_free (line_input); - - return error; -} - -/*? - * This command adds the 'ip4-source-check-via-rx' graph node for - * a given interface. By adding the IPv4 source check graph node to - * an interface, the code verifies that the source address of incoming - * unicast packets are reachable over the incoming interface. Two flavours - * are supported (the default is strict): - * - loose: accept ingress packet if there is a route to reach the source - * - strict: accept ingress packet if it arrived on an interface which - * the route to the source uses. i.e. an interface that the source - * is reachable via. - * - * @cliexpar - * @parblock - * Example of graph node before range checking is enabled: - * @cliexstart{show vlib graph ip4-source-check-via-rx} - * Name Next Previous - * ip4-source-check-via-rx ip4-drop [0] - * @cliexend - * - * Example of how to enable unicast source checking on an interface: - * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 loose} - * - * Example of graph node after range checking is enabled: - * @cliexstart{show vlib graph ip4-source-check-via-rx} - * Name Next Previous - * ip4-source-check-via-rx ip4-drop [0] ip4-input-no-checksum - * ip4-source-and-port-range- ip4-input - * @cliexend - * - * Example of how to display the feature enabed on an interface: - * @cliexstart{show ip interface features GigabitEthernet2/0/0} - * IP feature paths configured on GigabitEthernet2/0/0... - * - * ipv4 unicast: - * ip4-source-check-via-rx - * ip4-lookup - * - * ipv4 multicast: - * ip4-lookup-multicast - * - * ipv4 multicast: - * interface-output - * - * ipv6 unicast: - * ip6-lookup - * - * ipv6 multicast: - * ip6-lookup - * - * ipv6 multicast: - * interface-output - * @cliexend - * - * Example of how to disable unicast source checking on an interface: - * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 del} - * @endparblock -?*/ -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = { - .path = "set interface ip source-check", - .function = set_ip_source_check, - .short_help = "set interface ip source-check <interface> [strict|loose] [del]", -}; -/* *INDENT-ON* */ - -static clib_error_t * -ip_source_check_accept (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) -{ - unformat_input_t _line_input, *line_input = &_line_input; - fib_prefix_t pfx = { - .fp_proto = FIB_PROTOCOL_IP4, - }; - clib_error_t *error = NULL; - u32 table_id, is_add, fib_index; - - is_add = 1; - table_id = ~0; - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "table %d", &table_id)) - ; - else if (unformat (line_input, "del")) - is_add = 0; - else if (unformat (line_input, "add")) - is_add = 1; - else if (unformat (line_input, "%U/%d", - unformat_ip4_address, &pfx.fp_addr.ip4, &pfx.fp_len)) - pfx.fp_proto = FIB_PROTOCOL_IP4; - else - { - error = unformat_parse_error (line_input); - goto done; - } - } - - if (~0 != table_id) - { - fib_index = fib_table_find (pfx.fp_proto, table_id); - if (~0 == fib_index) - { - error = clib_error_return (0, "Nonexistent table id %d", table_id); - goto done; - } - } - else - { - fib_index = 0; - } - - if (is_add) - { - fib_table_entry_special_add (fib_index, - &pfx, - FIB_SOURCE_URPF_EXEMPT, - FIB_ENTRY_FLAG_DROP); - } - else - { - fib_table_entry_special_remove (fib_index, - &pfx, FIB_SOURCE_URPF_EXEMPT); - } - -done: - unformat_free (line_input); - - return error; -} - -/*? - * Add an exemption for a prefix to pass the Unicast Reverse Path - * Forwarding (uRPF) loose check. This is for testing purposes only. - * If the '<em>table</em>' is not enter it is defaulted to 0. Default - * is to '<em>add</em>'. VPP always performs a loose uRPF check for - * for-us traffic. - * - * @cliexpar - * Example of how to add a uRPF exception to a FIB table to pass the - * loose RPF tests: - * @cliexcmd{ip urpf-accept table 7 add} -?*/ -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (ip_source_check_accept_command, static) = { - .path = "ip urpf-accept", - .function = ip_source_check_accept, - .short_help = "ip urpf-accept [table <table-id>] [add|del]", -}; -/* *INDENT-ON* */ - - -#ifndef CLIB_MARCH_VARIANT -/* Dummy init function to get us linked in. */ -clib_error_t * -ip4_source_check_init (vlib_main_t * vm) -{ - return 0; -} - -VLIB_INIT_FUNCTION (ip4_source_check_init); -#endif /* CLIB_MARCH_VARIANT */ - -/* - * fd.io coding-style-patch-verification: ON - * - * Local Variables: - * eval: (c-set-style "gnu") - * End: - */ diff --git a/src/vnet/ip/ip_api.c b/src/vnet/ip/ip_api.c index 4f5b6b9d0a6..5c0784f9cb3 100644 --- a/src/vnet/ip/ip_api.c +++ b/src/vnet/ip/ip_api.c @@ -94,8 +94,6 @@ _(IP_SOURCE_AND_PORT_RANGE_CHECK_ADD_DEL, \ ip_source_and_port_range_check_add_del) \ _(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL, \ ip_source_and_port_range_check_interface_add_del) \ -_(IP_SOURCE_CHECK_INTERFACE_ADD_DEL, \ - ip_source_check_interface_add_del) \ _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS, \ sw_interface_ip6_set_link_local_address) \ _(IP_REASSEMBLY_SET, ip_reassembly_set) \ @@ -1270,37 +1268,6 @@ static void REPLY_MACRO (VL_API_SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS_REPLY); } -typedef union -{ - u32 fib_index; -} ip4_source_check_config_t; - -static void - vl_api_ip_source_check_interface_add_del_t_handler - (vl_api_ip_source_check_interface_add_del_t * mp) -{ - vl_api_ip_source_check_interface_add_del_reply_t *rmp; - int rv; - u32 sw_if_index = ntohl (mp->sw_if_index); - u8 is_add = mp->is_add; - char *feature_name = - mp->loose ? "ip4-source-check-via-any" : "ip4-source-check-via-rx"; - - ip4_source_check_config_t config; - - VALIDATE_SW_IF_INDEX (mp); - - config.fib_index = - fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index); - rv = - vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, - is_add, &config, sizeof (config)); - BAD_SW_IF_INDEX_LABEL; - - REPLY_MACRO (VL_API_IP_SOURCE_CHECK_INTERFACE_ADD_DEL_REPLY); -} - - static void vl_api_ip_table_replace_begin_t_handler (vl_api_ip_table_replace_begin_t * mp) { |