summaryrefslogtreecommitdiffstats
path: root/src/plugins/urpf
diff options
context:
space:
mode:
Diffstat (limited to 'src/plugins/urpf')
-rw-r--r--src/plugins/urpf/CMakeLists.txt27
-rw-r--r--src/plugins/urpf/ip4_urpf.c171
-rw-r--r--src/plugins/urpf/ip6_urpf.c171
-rw-r--r--src/plugins/urpf/test/test_urpf.py295
-rw-r--r--src/plugins/urpf/urpf.api59
-rw-r--r--src/plugins/urpf/urpf.c323
-rw-r--r--src/plugins/urpf/urpf.h50
-rw-r--r--src/plugins/urpf/urpf_api.c108
-rw-r--r--src/plugins/urpf/urpf_dp.h331
9 files changed, 1535 insertions, 0 deletions
diff --git a/src/plugins/urpf/CMakeLists.txt b/src/plugins/urpf/CMakeLists.txt
new file mode 100644
index 00000000000..2f44e3b2344
--- /dev/null
+++ b/src/plugins/urpf/CMakeLists.txt
@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_vpp_plugin(urpf
+ SOURCES
+ urpf.c
+ urpf_api.c
+ ip4_urpf.c
+ ip6_urpf.c
+
+ MULTIARCH_SOURCES
+ ip4_urpf.c
+ ip6_urpf.c
+
+ API_FILES
+ urpf.api
+)
diff --git a/src/plugins/urpf/ip4_urpf.c b/src/plugins/urpf/ip4_urpf.c
new file mode 100644
index 00000000000..25b6c94bde3
--- /dev/null
+++ b/src/plugins/urpf/ip4_urpf.c
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip4_urpf_error_strings[] = {
+#define _(a,b) "ip4-" # b,
+ foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip4_rx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip4_rx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip4_tx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip4_tx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP4, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip4_rx_urpf_loose) = {
+ .name = "ip4-rx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_rx_urpf_strict) = {
+ .name = "ip4-rx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_tx_urpf_loose) = {
+ .name = "ip4-tx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip4_tx_urpf_strict) = {
+ .name = "ip4-tx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip4-drop",
+ },
+ .n_errors = ARRAY_LEN (ip4_urpf_error_strings),
+ .error_strings = ip4_urpf_error_strings,
+
+ .format_buffer = format_ip4_header,
+ .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip4_rx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip4-unicast",
+ .node_name = "ip4-rx-urpf-loose",
+ .runs_before = VNET_FEATURES ("ip4-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip4_rx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip4-unicast",
+ .node_name = "ip4-rx-urpf-strict",
+ .runs_before = VNET_FEATURES ("ip4-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip4_tx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip4-output",
+ .node_name = "ip4-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip4_tx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip4-output",
+ .node_name = "ip4-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/ip6_urpf.c b/src/plugins/urpf/ip6_urpf.c
new file mode 100644
index 00000000000..3a94a456cb7
--- /dev/null
+++ b/src/plugins/urpf/ip6_urpf.c
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <urpf/urpf.h>
+#include <urpf/urpf_dp.h>
+
+static char *ip6_urpf_error_strings[] = {
+#define _(a,b) "ip6-" # b,
+ foreach_urpf_error
+#undef _
+};
+
+VLIB_NODE_FN (ip6_rx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_rx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_RX, URPF_MODE_STRICT));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_loose) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_LOOSE));
+}
+
+VLIB_NODE_FN (ip6_tx_urpf_strict) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ return (urpf_inline (vm, node, frame, AF_IP6, VLIB_TX, URPF_MODE_STRICT));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip6_rx_urpf_loose) = {
+ .name = "ip6-rx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_rx_urpf_strict) = {
+ .name = "ip6-rx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_loose) = {
+ .name = "ip6-tx-urpf-loose",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VLIB_REGISTER_NODE (ip6_tx_urpf_strict) = {
+ .name = "ip6-tx-urpf-strict",
+ .vector_size = sizeof (u32),
+
+ .n_next_nodes = URPF_N_NEXT,
+ .next_nodes = {
+ [URPF_NEXT_DROP] = "ip6-drop",
+ },
+ .n_errors = ARRAY_LEN (ip6_urpf_error_strings),
+ .error_strings = ip6_urpf_error_strings,
+
+ .format_buffer = format_ip6_header,
+ .format_trace = format_urpf_trace,
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip6-unicast",
+ .node_name = "ip6-rx-urpf-loose",
+ .runs_before = VNET_FEATURES ("ip6-rx-urpf-strict"),
+};
+
+VNET_FEATURE_INIT (ip6_rx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip6-unicast",
+ .node_name = "ip6-rx-urpf-strict",
+ .runs_before = VNET_FEATURES ("ip6-policer-classify"),
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_loose_feat, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "ip6-tx-urpf-loose",
+};
+
+VNET_FEATURE_INIT (ip6_tx_urpf_strict_feat, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "ip6-tx-urpf-strict",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/test/test_urpf.py b/src/plugins/urpf/test/test_urpf.py
new file mode 100644
index 00000000000..64b246cd663
--- /dev/null
+++ b/src/plugins/urpf/test/test_urpf.py
@@ -0,0 +1,295 @@
+#!/usr/bin/env python3
+
+import unittest
+
+from framework import VppTestCase, VppTestRunner
+
+from scapy.packet import Raw
+from scapy.layers.l2 import Ether
+from scapy.layers.inet import IP, UDP, ICMP
+from scapy.layers.inet6 import IPv6
+
+from vpp_papi import VppEnum
+
+N_PKTS = 63
+
+
+class TestURPF(VppTestCase):
+ """ Unicast Reverse Path Forwarding Test Case """
+
+ @classmethod
+ def setUpClass(cls):
+ super(TestURPF, cls).setUpClass()
+
+ @classmethod
+ def tearDownClass(cls):
+ super(TestURPF, cls).tearDownClass()
+
+ def setUp(self):
+ super(TestURPF, self).setUp()
+
+ # create 4 pg interfaces so there are a few addresses
+ # in the FIB
+ self.create_pg_interfaces(range(4))
+
+ for i in self.pg_interfaces:
+ i.admin_up()
+ i.config_ip4()
+ i.resolve_arp()
+ i.config_ip6()
+ i.resolve_ndp()
+
+ def tearDown(self):
+ for i in self.pg_interfaces:
+ i.unconfig_ip4()
+ i.unconfig_ip6()
+ i.admin_down()
+ super(TestURPF, self).tearDown()
+
+ def test_urpf4(self):
+ """ uRPF IP4 """
+
+ e = VppEnum
+ p_spoof_loose = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src="3.3.3.3", dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src=self.pg2.remote_ip4,
+ dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_good = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src=self.pg0.remote_ip4,
+ dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ #
+ # before adding the uRPF, ensure all packets are forwarded
+ #
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # apply loose uRPF check on pg0 rx
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets from address for which there is a route are forwarded
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ # packets from address to which there is no route are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-rx-urpf-loose", N_PKTS)
+
+ #
+ # crank it up to strict mode
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets that would not be routed back thru pg0 are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-rx-urpf-strict", 2 * N_PKTS)
+
+ #
+ # disable uRPF, all traffic should pass
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg0.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # Now apply in the TX direction
+ # for loose it is the same deal, they should not be forwarded
+ # if there's no route
+ # for strict they should not be forwarded if they would be
+ # forwarded thru that interface.
+ #
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-tx-urpf-loose", N_PKTS)
+
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # the strict packet, from a peer is allowed, since it does
+ # not forward via pg1
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip4-tx-urpf-strict", N_PKTS)
+
+ # change the strict packet so that it would forward through pg1
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IP(src=self.pg1.remote_ip4,
+ dst=self.pg1.remote_ip4) /
+ UDP(sport=1234, dport=1234) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.assert_error_counter_equal("ip4-tx-urpf-strict", 2 * N_PKTS)
+
+ # cleanup
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP4,
+ sw_if_index=self.pg1.sw_if_index)
+
+ def test_urpf6(self):
+ """ uRPF IP6 """
+
+ e = VppEnum
+ p_spoof_loose = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src="3::3", dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src=self.pg2.remote_ip6,
+ dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+ p_good = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src=self.pg0.remote_ip6,
+ dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ #
+ # before adding the uRPF, ensure all packets are forwarded
+ #
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # apply loose uRPF check on pg0 rx
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets from address for which there is a route are forwarded
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ # packets from address to which there is no route are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-rx-urpf-loose", N_PKTS)
+
+ #
+ # crank it up to strict mode
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg0.sw_if_index)
+
+ # good packets still pass
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # packets that would not be routed back thru pg0 are dropped
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-rx-urpf-strict", 2 * N_PKTS)
+
+ #
+ # disable uRPF, all traffic should pass
+ #
+ self.vapi.urpf_update(is_input=True,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg0.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_loose, self.pg1)
+
+ #
+ # Now apply in the TX direction
+ # for loose it is the same deal, they should not be forwarded
+ # if there's no route
+ # for strict they should not be forwarded if they would be
+ # forwarded thru that interface.
+ #
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-tx-urpf-loose", N_PKTS)
+
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg1.sw_if_index)
+
+ self.send_and_expect(self.pg0, p_good, self.pg1)
+ # the strict packet, from a peer is allowed, since it does
+ # not forward via pg1
+ self.send_and_expect(self.pg0, p_spoof_strict, self.pg1)
+ self.send_and_assert_no_replies(self.pg0, p_spoof_loose)
+
+ self.assert_error_counter_equal("ip6-tx-urpf-strict", N_PKTS)
+
+ # change the strict packet so that it would forward through pg1
+ p_spoof_strict = (Ether(dst=self.pg0.local_mac,
+ src=self.pg0.remote_mac) /
+ IPv6(src=self.pg1.remote_ip6,
+ dst=self.pg1.remote_ip6) /
+ UDP(sport=1236, dport=1236) /
+ Raw(b'\xa5' * 100)) * N_PKTS
+
+ self.send_and_assert_no_replies(self.pg0, p_spoof_strict)
+ self.assert_error_counter_equal("ip6-tx-urpf-strict", 2 * N_PKTS)
+
+ # cleanup
+ self.vapi.urpf_update(is_input=False,
+ mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF,
+ af=e.vl_api_address_family_t.ADDRESS_IP6,
+ sw_if_index=self.pg1.sw_if_index)
+
+
+if __name__ == '__main__':
+ unittest.main(testRunner=VppTestRunner)
diff --git a/src/plugins/urpf/urpf.api b/src/plugins/urpf/urpf.api
new file mode 100644
index 00000000000..944db08cc94
--- /dev/null
+++ b/src/plugins/urpf/urpf.api
@@ -0,0 +1,59 @@
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** \file
+ This file defines the vpp control-plane API messages
+ used to control the URPF plugin
+*/
+
+option version = "1.0.0";
+import "vnet/ip/ip_types.api";
+import "vnet/fib/fib_types.api";
+import "vnet/interface_types.api";
+
+enum urpf_mode:u8
+{
+ URPF_API_MODE_OFF,
+ URPF_API_MODE_LOOSE,
+ URPF_API_MODE_STRICT,
+};
+
+/**
+ * @brief Enable uRPF on a given interface in a given direction
+ * @param client_index - opaque cookie to identify the sender
+ * @param context - sender context, to match reply w/ request
+ * @param mode - Mode
+ * @param af - Address Family
+ * @param sw_if_index - Interface
+ * @param is_input - Direction.
+ */
+autoreply define urpf_update
+{
+ u32 client_index;
+ u32 context;
+ bool is_input[default = true];
+ vl_api_urpf_mode_t mode;
+ vl_api_address_family_t af;
+ vl_api_interface_index_t sw_if_index;
+};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf.c b/src/plugins/urpf/urpf.c
new file mode 100644
index 00000000000..7e1986a4250
--- /dev/null
+++ b/src/plugins/urpf/urpf.c
@@ -0,0 +1,323 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <urpf/urpf.h>
+
+#include <vnet/fib/fib_table.h>
+
+/* *INDENT-OFF* */
+static const char *urpf_feat_arcs[N_AF][VLIB_N_DIR] =
+{
+ [AF_IP4] = {
+ [VLIB_RX] = "ip4-unicast",
+ [VLIB_TX] = "ip4-output",
+ },
+ [AF_IP6] = {
+ [VLIB_RX] = "ip6-unicast",
+ [VLIB_TX] = "ip6-output",
+ },
+};
+
+static const char *urpf_feats[N_AF][VLIB_N_DIR][URPF_N_MODES] =
+{
+ [AF_IP4] = {
+ [VLIB_RX] = {
+ [URPF_MODE_STRICT] = "ip4-rx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip4-rx-urpf-loose",
+ },
+ [VLIB_TX] = {
+ [URPF_MODE_STRICT] = "ip4-tx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip4-tx-urpf-loose",
+ },
+ },
+ [AF_IP6] = {
+ [VLIB_RX] = {
+ [URPF_MODE_STRICT] = "ip6-rx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip6-rx-urpf-loose",
+ },
+ [VLIB_TX] = {
+ [URPF_MODE_STRICT] = "ip6-tx-urpf-strict",
+ [URPF_MODE_LOOSE] = "ip6-tx-urpf-loose",
+ },
+ },
+};
+/* *INDENT-ON* */
+
+/**
+ * Per-af, per-direction, per-interface uRPF configs
+ */
+static urpf_mode_t *urpf_cfgs[N_AF][VLIB_N_DIR];
+
+u8 *
+format_urpf_mode (u8 * s, va_list * a)
+{
+ urpf_mode_t mode = va_arg (*a, int);
+
+ switch (mode)
+ {
+#define _(a,b) \
+ case URPF_MODE_##a: \
+ return (format (s, "%s", b));
+ foreach_urpf_mode
+#undef _
+ }
+
+ return (format (s, "unknown"));
+}
+
+static uword
+unformat_urpf_mode (unformat_input_t * input, va_list * args)
+{
+ urpf_mode_t *mode = va_arg (*args, urpf_mode_t *);
+
+ if (0)
+ ;
+#define _(a,b) \
+ else if (unformat (input, b)) \
+ { \
+ *mode = URPF_MODE_##a; \
+ return (1); \
+ }
+ foreach_urpf_mode
+#undef _
+ return 0;
+}
+
+void
+urpf_update (urpf_mode_t mode,
+ u32 sw_if_index, ip_address_family_t af, vlib_dir_t dir)
+{
+ urpf_mode_t old;
+
+ vec_validate_init_empty (urpf_cfgs[af][dir], sw_if_index, URPF_MODE_OFF);
+ old = urpf_cfgs[af][dir][sw_if_index];
+
+ if (mode != old)
+ {
+ if (URPF_MODE_OFF != old)
+ /* disable what we have */
+ vnet_feature_enable_disable (urpf_feat_arcs[af][dir],
+ urpf_feats[af][dir][old],
+ sw_if_index, 0, 0, 0);
+
+ if (URPF_MODE_OFF != mode)
+ /* enable what's new */
+ vnet_feature_enable_disable (urpf_feat_arcs[af][dir],
+ urpf_feats[af][dir][mode],
+ sw_if_index, 1, 0, 0);
+ }
+ /* else - no change to existing config */
+
+ urpf_cfgs[af][dir][sw_if_index] = mode;
+}
+
+static clib_error_t *
+urpf_cli_update (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ vnet_main_t *vnm = vnet_get_main ();
+ clib_error_t *error = NULL;
+ ip_address_family_t af;
+ urpf_mode_t mode;
+ u32 sw_if_index;
+ vlib_dir_t dir;
+
+ sw_if_index = ~0;
+ af = AF_IP4;
+ dir = VLIB_RX;
+ mode = URPF_MODE_STRICT;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "%U",
+ unformat_vnet_sw_interface, vnm, &sw_if_index))
+ ;
+ else if (unformat (line_input, "%U", unformat_urpf_mode, &mode))
+ ;
+ else if (unformat (line_input, "%U", unformat_ip_address_family, &af))
+ ;
+ else if (unformat (line_input, "%U", unformat_vlib_rx_tx, &dir))
+ ;
+ else
+ {
+ error = unformat_parse_error (line_input);
+ goto done;
+ }
+ }
+
+ if (~0 == sw_if_index)
+ {
+ error = clib_error_return (0, "unknown interface `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+
+ urpf_update (mode, sw_if_index, af, dir);
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+/*?
+ * This command configures uRPF on an interface.
+ * Two flavours are supported (the default is strict):
+ * - loose: accept ingress packet if there is a route to reach the source
+ * - strict: accept ingress packet if it arrived on an interface which
+ * the route to the source uses. i.e. an interface that the source
+ * is reachable via.
+ *
+ * @cliexpar
+ * @parblock
+ * Example of graph node before range checking is enabled:
+ * @cliexstart{show vlib graph ip4-rx-urpf-strict}
+ * Name Next Previous
+ * ip4-rx-urpf-strict ip4-drop [0]
+ * @cliexend
+ *
+ * Example of how to enable unicast source checking on an interface:
+ * @cliexcmd{set urpf ip4 rx GigabitEthernet2/0/0 loose}
+ *
+ * Example of graph node after range checking is enabled:
+ * @cliexstart{show vlib graph ip4-rx-urpf-loose}
+ * Name Next Previous
+ * ip4-rx-urpf-loose ip4-drop [0] ip4-input-no-checksum
+ * ip4-source-and-port-range- ip4-input
+ * @cliexend
+ *
+ * Example of how to display the feature enabed on an interface:
+ * @cliexstart{show ip interface features GigabitEthernet2/0/0}
+ * IP feature paths configured on GigabitEthernet2/0/0...
+ *
+ * ipv4 unicast:
+ * ip4-rx-urpf-loose
+ * ip4-lookup
+ *
+ * ipv4 multicast:
+ * ip4-lookup-multicast
+ *
+ * ipv4 multicast:
+ * interface-output
+ *
+ * ipv6 unicast:
+ * ip6-lookup
+ *
+ * ipv6 multicast:
+ * ip6-lookup
+ *
+ * ipv6 multicast:
+ * interface-output
+ * @cliexend
+ *
+ * Example of how to disable unicast source checking on an interface:
+ * @cliexcmd{set urpf ip4 off GigabitEthernet2/0/0}
+ * @endparblock
+?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = {
+ .path = "set urpf",
+ .function = urpf_cli_update,
+ .short_help = "set urpf [ip4|ip6] [rx|tx] [off|strict|loose] <INTERFACE>",
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+urpf_cli_accept (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ clib_error_t *error = NULL;
+ fib_prefix_t fpfx;
+ ip_prefix_t pfx;
+ u32 table_id, is_add, fib_index;
+
+ is_add = 1;
+ table_id = 0;
+
+ /* Get a line of input. */
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "table %d", &table_id))
+ ;
+ else if (unformat (line_input, "del"))
+ is_add = 0;
+ else if (unformat (line_input, "add"))
+ is_add = 1;
+ else if (unformat (line_input, "%U", unformat_ip_prefix, &pfx))
+ ;
+ else
+ {
+ error = unformat_parse_error (line_input);
+ goto done;
+ }
+ }
+
+ ip_prefix_to_fib_prefix (&pfx, &fpfx);
+
+ fib_index = fib_table_find (fpfx.fp_proto, table_id);
+
+ if (~0 == fib_index)
+ {
+ error = clib_error_return (0, "Nonexistent table id %d", table_id);
+ goto done;
+ }
+
+ if (is_add)
+ fib_table_entry_special_add (fib_index,
+ &fpfx,
+ FIB_SOURCE_URPF_EXEMPT, FIB_ENTRY_FLAG_DROP);
+ else
+ fib_table_entry_special_remove (fib_index, &fpfx, FIB_SOURCE_URPF_EXEMPT);
+
+done:
+ unformat_free (line_input);
+
+ return (error);
+}
+
+/*?
+ * Add an exemption for a prefix to pass the Unicast Reverse Path
+ * Forwarding (uRPF) loose check. This is for testing purposes only.
+ * If the '<em>table</em>' is not enter it is defaulted to 0. Default
+ * is to '<em>add</em>'. VPP always performs a loose uRPF check for
+ * for-us traffic.
+ *
+ * @cliexpar
+ * Example of how to add a uRPF exception to a FIB table to pass the
+ * loose RPF tests:
+ * @cliexcmd{set urpf-accept table 7 10.0.0.0/8 add}
+?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (urpf_accept_command, static) = {
+ .path = "set urpf-accept",
+ .function = urpf_cli_accept,
+ .short_help = "urpf-accept [table <table-id>] [add|del] <PREFIX>",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf.h b/src/plugins/urpf/urpf.h
new file mode 100644
index 00000000000..941cda25f4b
--- /dev/null
+++ b/src/plugins/urpf/urpf.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __URPF_H__
+#define __URPF_H__
+
+#include <vnet/ip/ip_types.h>
+
+#define foreach_urpf_mode \
+ _(OFF, "off") \
+ _(LOOSE, "loose") \
+ _(STRICT, "strict") \
+
+typedef enum urpf_mode_t_
+{
+#define _(a,b) URPF_MODE_##a,
+ foreach_urpf_mode
+#undef _
+} __clib_packed urpf_mode_t;
+
+#define URPF_N_MODES (URPF_MODE_STRICT+1)
+
+extern u8 *format_urpf_mode (u8 * s, va_list * a);
+
+extern void urpf_update (urpf_mode_t mode,
+ u32 sw_if_index,
+ ip_address_family_t af, vlib_dir_t dir);
+
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf_api.c b/src/plugins/urpf/urpf_api.c
new file mode 100644
index 00000000000..ad060399347
--- /dev/null
+++ b/src/plugins/urpf/urpf_api.c
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <urpf/urpf.h>
+#include <vnet/plugin/plugin.h>
+#include <vnet/ip/ip_types_api.h>
+
+#include <vpp/app/version.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+
+/* define message IDs */
+#include <vnet/format_fns.h>
+#include <urpf/urpf.api_enum.h>
+#include <urpf/urpf.api_types.h>
+
+/**
+ * Base message ID fot the plugin
+ */
+static u32 urpf_base_msg_id;
+#define REPLY_MSG_ID_BASE urpf_base_msg_id
+
+#include <vlibapi/api_helper_macros.h>
+
+static int
+urpf_mode_decode (vl_api_urpf_mode_t in, urpf_mode_t * out)
+{
+ if (0)
+ ;
+#define _(a,b) \
+ else if (URPF_API_MODE_##a == in) \
+ { \
+ *out = URPF_MODE_##a; \
+ return (0); \
+ }
+ foreach_urpf_mode
+#undef _
+ return (VNET_API_ERROR_INVALID_VALUE);
+}
+
+static void
+vl_api_urpf_update_t_handler (vl_api_urpf_update_t * mp)
+{
+ vl_api_urpf_update_reply_t *rmp;
+ ip_address_family_t af;
+ urpf_mode_t mode;
+ int rv = 0;
+
+ VALIDATE_SW_IF_INDEX (mp);
+
+ rv = urpf_mode_decode (mp->mode, &mode);
+
+ if (rv)
+ goto done;
+
+ rv = ip_address_family_decode (mp->af, &af);
+
+ if (rv)
+ goto done;
+
+ urpf_update (mode, htonl (mp->sw_if_index), af,
+ (mp->is_input ? VLIB_RX : VLIB_TX));
+
+ BAD_SW_IF_INDEX_LABEL;
+done:
+ REPLY_MACRO (VL_API_URPF_UPDATE_REPLY);
+}
+
+#include <urpf/urpf.api.c>
+
+static clib_error_t *
+urpf_api_init (vlib_main_t * vm)
+{
+ /* Ask for a correctly-sized block of API message decode slots */
+ urpf_base_msg_id = setup_message_id_table ();
+
+ return 0;
+}
+
+VLIB_INIT_FUNCTION (urpf_api_init);
+
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () = {
+ .version = VPP_BUILD_VER,
+ .description = "Unicast Reverse Path Forwarding (uRPF)",
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/urpf/urpf_dp.h b/src/plugins/urpf/urpf_dp.h
new file mode 100644
index 00000000000..3d3f19cfb1d
--- /dev/null
+++ b/src/plugins/urpf/urpf_dp.h
@@ -0,0 +1,331 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check)
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __URPF_DP_H__
+#define __URPF_DP_H__
+
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/fib/fib_urpf_list.h>
+#include <vnet/dpo/load_balance.h>
+
+#include <urpf/urpf.h>
+
+/**
+ * @file
+ * @brief Unicast Reverse Path forwarding.
+ *
+ * This file contains the interface unicast source check.
+ */
+typedef struct
+{
+ index_t urpf;
+} urpf_trace_t;
+
+static u8 *
+format_urpf_trace (u8 * s, va_list * va)
+{
+ CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
+ CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
+ urpf_trace_t *t = va_arg (*va, urpf_trace_t *);
+
+ s = format (s, "uRPF:%d", t->urpf);
+
+ return s;
+}
+
+#define foreach_urpf_error \
+ _(DROP, "uRPF Drop") \
+
+typedef enum urpf_error_t_
+{
+#define _(a,b) URPF_ERROR_##a,
+ foreach_urpf_error
+#undef _
+ URPF_N_ERROR,
+} urpf_error_t;
+
+typedef enum
+{
+ URPF_NEXT_DROP,
+ URPF_N_NEXT,
+} urpf_next_t;
+
+static_always_inline uword
+urpf_inline (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame,
+ ip_address_family_t af, vlib_dir_t dir, urpf_mode_t mode)
+{
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
+ u16 nexts[VLIB_FRAME_SIZE], *next;
+ u32 n_left, *from;
+
+ from = vlib_frame_vector_args (frame);
+ n_left = frame->n_vectors;
+ b = bufs;
+ next = nexts;
+
+ vlib_get_buffers (vm, from, bufs, n_left);
+
+ while (n_left >= 4)
+ {
+ u32 pass0, lb_index0, pass1, lb_index1;
+ const load_balance_t *lb0, *lb1;
+ u32 fib_index0, fib_index1;
+ const u8 *h0, *h1;
+
+ /* Prefetch next iteration. */
+ {
+ vlib_prefetch_buffer_header (b[2], LOAD);
+ vlib_prefetch_buffer_header (b[3], LOAD);
+ vlib_prefetch_buffer_data (b[2], LOAD);
+ vlib_prefetch_buffer_data (b[3], LOAD);
+ }
+
+ h0 = (u8 *) vlib_buffer_get_current (b[0]);
+ h1 = (u8 *) vlib_buffer_get_current (b[1]);
+
+ if (VLIB_TX == dir)
+ {
+ h0 += vnet_buffer (b[0])->ip.save_rewrite_length;
+ h1 += vnet_buffer (b[1])->ip.save_rewrite_length;
+ }
+
+ if (AF_IP4 == af)
+ {
+ const ip4_header_t *ip0, *ip1;
+
+ ip0 = (ip4_header_t *) h0;
+ ip1 = (ip4_header_t *) h1;
+
+ fib_index0 = ip4_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+ fib_index1 = ip4_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[1])->sw_if_index[dir]];
+
+ ip4_fib_forwarding_lookup_x2 (fib_index0,
+ fib_index1,
+ &ip0->src_address,
+ &ip1->src_address,
+ &lb_index0, &lb_index1);
+ /* Pass multicast. */
+ pass0 = (ip4_address_is_multicast (&ip0->src_address) ||
+ ip4_address_is_global_broadcast (&ip0->src_address));
+ pass1 = (ip4_address_is_multicast (&ip1->src_address) ||
+ ip4_address_is_global_broadcast (&ip1->src_address));
+ }
+ else
+ {
+ const ip6_header_t *ip0, *ip1;
+
+ fib_index0 = ip6_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+ fib_index1 = ip6_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[1])->sw_if_index[dir]];
+
+ ip0 = (ip6_header_t *) h0;
+ ip1 = (ip6_header_t *) h1;
+
+ lb_index0 = ip6_fib_table_fwding_lookup (fib_index0,
+ &ip0->src_address);
+ lb_index1 = ip6_fib_table_fwding_lookup (fib_index1,
+ &ip1->src_address);
+ pass0 = ip6_address_is_multicast (&ip0->src_address);
+ pass1 = ip6_address_is_multicast (&ip1->src_address);
+ }
+
+ lb0 = load_balance_get (lb_index0);
+ lb1 = load_balance_get (lb_index1);
+
+ if (URPF_MODE_STRICT == mode)
+ {
+ /* for RX the check is: would this source adddress be forwarded
+ * out of the interface on which it was recieved, if yes allow.
+ * For TX it's; would this source addres be forwarded out of the
+ * interface through which it is being sent, if yes drop.
+ */
+ int res0, res1;
+
+ res0 = fib_urpf_check (lb0->lb_urpf,
+ vnet_buffer (b[0])->sw_if_index[dir]);
+ res1 = fib_urpf_check (lb1->lb_urpf,
+ vnet_buffer (b[1])->sw_if_index[dir]);
+
+ if (VLIB_RX == dir)
+ {
+ pass0 |= res0;
+ pass1 |= res1;
+ }
+ else
+ {
+ pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf);
+ pass1 |= !res1 && fib_urpf_check_size (lb1->lb_urpf);
+ }
+ }
+ else
+ {
+ pass0 |= fib_urpf_check_size (lb0->lb_urpf);
+ pass1 |= fib_urpf_check_size (lb1->lb_urpf);
+ }
+
+ if (PREDICT_TRUE (pass0))
+ vnet_feature_next_u16 (&next[0], b[0]);
+ else
+ {
+ next[0] = URPF_NEXT_DROP;
+ b[0]->error = node->errors[URPF_ERROR_DROP];
+ }
+ if (PREDICT_TRUE (pass1))
+ vnet_feature_next_u16 (&next[1], b[1]);
+ else
+ {
+ next[1] = URPF_NEXT_DROP;
+ b[1]->error = node->errors[URPF_ERROR_DROP];
+ }
+
+ if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ urpf_trace_t *t;
+
+ t = vlib_add_trace (vm, node, b[0], sizeof (*t));
+ t->urpf = lb0->lb_urpf;
+ }
+ if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ urpf_trace_t *t;
+
+ t = vlib_add_trace (vm, node, b[1], sizeof (*t));
+ t->urpf = lb1->lb_urpf;
+ }
+
+ b += 2;
+ next += 2;
+ n_left -= 2;
+ }
+
+ while (n_left)
+ {
+ u32 pass0, lb_index0, fib_index0;
+ const load_balance_t *lb0;
+ const u8 *h0;
+
+ h0 = (u8 *) vlib_buffer_get_current (b[0]);
+
+ if (VLIB_TX == dir)
+ h0 += vnet_buffer (b[0])->ip.save_rewrite_length;
+
+ if (AF_IP4 == af)
+ {
+ const ip4_header_t *ip0;
+
+ fib_index0 = ip4_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+ ip0 = (ip4_header_t *) h0;
+
+ lb_index0 = ip4_fib_forwarding_lookup (fib_index0,
+ &ip0->src_address);
+
+ /* Pass multicast. */
+ pass0 = (ip4_address_is_multicast (&ip0->src_address) ||
+ ip4_address_is_global_broadcast (&ip0->src_address));
+ }
+ else
+ {
+ const ip6_header_t *ip0;
+
+ ip0 = (ip6_header_t *) h0;
+ fib_index0 = ip6_main.fib_index_by_sw_if_index
+ [vnet_buffer (b[0])->sw_if_index[dir]];
+
+ lb_index0 = ip6_fib_table_fwding_lookup (fib_index0,
+ &ip0->src_address);
+ pass0 = ip6_address_is_multicast (&ip0->src_address);
+ }
+
+ lb0 = load_balance_get (lb_index0);
+
+ if (URPF_MODE_STRICT == mode)
+ {
+ int res0;
+
+ res0 = fib_urpf_check (lb0->lb_urpf,
+ vnet_buffer (b[0])->sw_if_index[dir]);
+ if (VLIB_RX == dir)
+ pass0 |= res0;
+ else
+ pass0 |= !res0 && fib_urpf_check_size (lb0->lb_urpf);
+ }
+ else
+ pass0 |= fib_urpf_check_size (lb0->lb_urpf);
+
+ if (PREDICT_TRUE (pass0))
+ vnet_feature_next_u16 (&next[0], b[0]);
+ else
+ {
+ next[0] = URPF_NEXT_DROP;
+ b[0]->error = node->errors[URPF_ERROR_DROP];
+ }
+
+ if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ urpf_trace_t *t;
+
+ t = vlib_add_trace (vm, node, b[0], sizeof (*t));
+ t->urpf = lb0->lb_urpf;
+ }
+ b++;
+ next++;
+ n_left--;
+ }
+
+ vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */