aboutsummaryrefslogtreecommitdiffstats
path: root/README.md
AgeCommit message (Expand)AuthorFilesLines
2018-08-03API: Remove legacy vlibsocket code.Ole Troan1-1/+0
2018-04-26VPP 18.04 release notesChris Luke1-22/+22
2017-09-28General documentation updatesChris Luke1-7/+8
2017-06-09Sample plugin: Add sample plugin documentationRay Kinsella1-1/+1
2017-04-20Move vagrant stuff to extras/Damjan Marion1-2/+2
2017-02-22Add ref to test framework docs in doxygen output.Dave Wallace1-2/+6
2016-12-28Repair Doxygen build infrastructureChris Luke1-15/+15
2016-09-21Copy the 16.09 release notes to masterChris Luke1-7/+12
2016-09-20Add structure to some of the documentation; VPP-223Chris Luke1-1/+4
2016-07-26VPP-165 Update directory list in READMEChris Luke1-1/+1
2016-05-13VPP-57 Add Doxygen to VPPChris Luke1-0/+94
id='n52' href='#n52'>52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 
#!/usr/bin/env python3

# Copyright (c) 2020 Cisco and/or its affiliates.
#
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
#
# Licensed under the Apache License 2.0 or
# GNU General Public License v2.0 or later;  you may not use this file
# except in compliance with one of these Licenses. You
# may obtain a copy of the Licenses at:
#
#     http://www.apache.org/licenses/LICENSE-2.0
#     https://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html
#
# Note: If this file is linked with Scapy, which is GPLv2+, your use of it
# must be under GPLv2+.  If at any point in the future it is no longer linked
# with Scapy (or other GPLv2+ licensed software), you are free to choose Apache 2.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

"""Traffic script for NAT verification."""

import sys

import ipaddress

from scapy.layers.inet import IP, TCP, UDP
from scapy.layers.inet6 import IPv6, ICMPv6ND_NS
from scapy.layers.l2 import Ether
from scapy.packet import Raw

from .PacketVerifier import RxQueue, TxQueue
from .TrafficScriptArg import TrafficScriptArg


def valid_ipv4(ip):
    try:
        ipaddress.IPv4Address(ip)
        return True
    except (AttributeError, ipaddress.AddressValueError):
        return False


def valid_ipv6(ip):
    try:
        ipaddress.IPv6Address(ip)
        return True
    except (AttributeError, ipaddress.AddressValueError):
        return False


def main():
    """Send, receive and check IP/IPv6 packets with UDP/TCP layer passing
    through NAT.
    """
    args = TrafficScriptArg(
        [
            u"tx_src_mac", u"rx_dst_mac", u"src_ip_in", u"src_ip_out",
            u"dst_ip", u"tx_dst_mac", u"rx_src_mac", u"protocol",
            u"src_port_in", u"src_port_out", u"dst_port"
        ]
    )

    tx_src_mac = args.get_arg(u"tx_src_mac")
    tx_dst_mac = args.get_arg(u"tx_dst_mac")
    rx_dst_mac = args.get_arg(u"rx_dst_mac")
    rx_src_mac = args.get_arg(u"rx_src_mac")
    src_ip_in = args.get_arg(u"src_ip_in")
    src_ip_out = args.get_arg(u"src_ip_out")
    dst_ip = args.get_arg(u"dst_ip")
    protocol = args.get_arg(u"protocol")
    sport_in = int(args.get_arg(u"src_port_in"))
    try:
        sport_out = int(args.get_arg(u"src_port_out"))
    except ValueError:
        sport_out = None
    dst_port = int(args.get_arg(u"dst_port"))

    tx_txq = TxQueue(args.get_arg(u"tx_if"))
    tx_rxq = RxQueue(args.get_arg(u"tx_if"))
    rx_txq = TxQueue(args.get_arg(u"rx_if"))
    rx_rxq = RxQueue(args.get_arg(u"rx_if"))

    sent_packets = list()
    pkt_raw = Ether(src=tx_src_mac, dst=tx_dst_mac)

    if valid_ipv4(src_ip_in) and valid_ipv4(dst_ip):
        ip_layer = IP
    elif valid_ipv6(src_ip_in) and valid_ipv6(dst_ip):
        ip_layer = IPv6
    else:
        raise ValueError(u"IP not in correct format")
    pkt_raw /= ip_layer(src=src_ip_in, dst=dst_ip)

    if protocol == u"UDP":
        pkt_raw /= UDP(sport=sport_in, dport=dst_port)
        proto_layer = UDP
    elif protocol == u"TCP":
        # flags=0x2 => SYN flag set
        pkt_raw /= TCP(sport=sport_in, dport=dst_port, flags=0x2)
        proto_layer = TCP
    else:
        raise ValueError(u"Incorrect protocol")

    pkt_raw /= Raw()
    sent_packets.append(pkt_raw)
    tx_txq.send(pkt_raw)

    while True:
        ether = rx_rxq.recv(2)

        if ether is None:
            raise RuntimeError(u"IP packet Rx timeout")

        if ether.haslayer(ICMPv6ND_NS):
            # read another packet in the queue if the current one is ICMPv6ND_NS
            continue
        else:
            # otherwise process the current packet
            break

    if rx_dst_mac != ether[Ether].dst or rx_src_mac != ether[Ether].src:
        raise RuntimeError(f"Matching packet unsuccessful: {ether!r}")

    ip_pkt = ether.payload
    if not isinstance(ip_pkt, ip_layer):
        raise RuntimeError(f"Not an {ip_layer!s} packet received: {ip_pkt!r}")
    if ip_pkt.src != src_ip_out:
        raise RuntimeError(
            f"Matching Src IP address unsuccessful: "
            f"{src_ip_out} != {ip_pkt.src}"
        )
    if ip_pkt.dst != dst_ip:
        raise RuntimeError(
            f"Matching Dst IP address unsuccessful: {dst_ip} != {ip_pkt.dst}"
        )

    proto_pkt = ip_pkt.payload
    if not isinstance(proto_pkt, proto_layer):
        raise RuntimeError(
            f"Not a {proto_layer!s} packet received: {proto_pkt!r}"
        )
    if sport_out is not None:
        if proto_pkt.sport != sport_out:
            raise RuntimeError(
                f"Matching Src {proto_layer!s} port unsuccessful: "
                f"{sport_out} != {proto_pkt.sport}"
            )
    else:
        sport_out = proto_pkt.sport
    if proto_pkt.dport != dst_port:
        raise RuntimeError(
            f"Matching Dst {proto_layer!s} port unsuccessful: "
            f"{dst_port} != {proto_pkt.dport}"
        )
    if proto_layer == TCP:
        if proto_pkt.flags != 0x2:
            raise RuntimeError(
                f"Not a TCP SYN packet received: {proto_pkt!r}"
            )

    pkt_raw = Ether(src=rx_dst_mac, dst=rx_src_mac)
    pkt_raw /= ip_layer(src=dst_ip, dst=src_ip_out)
    pkt_raw /= proto_layer(sport=dst_port, dport=sport_out)
    if proto_layer == TCP:
        # flags=0x12 => SYN, ACK flags set
        pkt_raw[TCP].flags = 0x12
    pkt_raw /= Raw()
    rx_txq.send(pkt_raw)

    while True:
        ether = tx_rxq.recv(2, ignore=sent_packets)

        if ether is None:
            raise RuntimeError(u"IP packet Rx timeout")

        if ether.haslayer(ICMPv6ND_NS):
            # read another packet in the queue if the current one is ICMPv6ND_NS
            continue
        else:
            # otherwise process the current packet
            break

    if ether[Ether].dst != tx_src_mac or ether[Ether].src != tx_dst_mac:
        raise RuntimeError(f"Matching packet unsuccessful: {ether!r}")

    ip_pkt = ether.payload
    if not isinstance(ip_pkt, ip_layer):
        raise RuntimeError(f"Not an {ip_layer!s} packet received: {ip_pkt!r}")
    if ip_pkt.src != dst_ip:
        raise RuntimeError(
            f"Matching Src IP address unsuccessful: {dst_ip} != {ip_pkt.src}"
        )
    if ip_pkt.dst != src_ip_in:
        raise RuntimeError(
            f"Matching Dst IP address unsuccessful: {src_ip_in} != {ip_pkt.dst}"
        )

    proto_pkt = ip_pkt.payload
    if not isinstance(proto_pkt, proto_layer):
        raise RuntimeError(
            f"Not a {proto_layer!s} packet received: {proto_pkt!r}"
        )
    if proto_pkt.sport != dst_port:
        raise RuntimeError(
            f"Matching Src {proto_layer!s} port unsuccessful: "
            f"{dst_port} != {proto_pkt.sport}"
        )
    if proto_pkt.dport != sport_in:
        raise RuntimeError(
            f"Matching Dst {proto_layer!s} port unsuccessful: "
            f"{sport_in} != {proto_pkt.dport}"
        )
    if proto_layer == TCP:
        if proto_pkt.flags != 0x12:
            raise RuntimeError(
                f"Not a TCP SYN-ACK packet received: {proto_pkt!r}"
            )

    sys.exit(0)


if __name__ == u"__main__":
    main()