From d724e4f43b1d143a3f35492bce72fdc3e8af553e Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Thu, 2 Apr 2020 15:02:16 +0000 Subject: urpf: Unicast reverse Path Forwarding (plugin) Type: feature - move the IP4 code to plugin - add ip6 support - add suport for uRPF on TX - add tests Change-Id: I074c2debc486d3e79c12fad4b8dbd72c41e841a0 Signed-off-by: Neale Ranns --- src/vnet/CMakeLists.txt | 2 - src/vnet/fib/ip4_fib.h | 24 ++ src/vnet/interface_types_api.h | 88 +++++++ src/vnet/ip/ip.api | 16 -- src/vnet/ip/ip4_error.h | 3 - src/vnet/ip/ip4_forward.c | 14 -- src/vnet/ip/ip4_input.c | 3 - src/vnet/ip/ip4_packet.h | 6 + src/vnet/ip/ip4_source_check.c | 545 ----------------------------------------- src/vnet/ip/ip_api.c | 33 --- 10 files changed, 118 insertions(+), 616 deletions(-) create mode 100644 src/vnet/interface_types_api.h delete mode 100644 src/vnet/ip/ip4_source_check.c (limited to 'src/vnet') diff --git a/src/vnet/CMakeLists.txt b/src/vnet/CMakeLists.txt index 9911b0420a6..f8948de5d5e 100644 --- a/src/vnet/CMakeLists.txt +++ b/src/vnet/CMakeLists.txt @@ -440,7 +440,6 @@ list(APPEND VNET_SOURCES ip/ip4_mtrie.c ip/ip4_pg.c ip/ip4_source_and_port_range_check.c - ip/ip4_source_check.c ip/reass/ip4_full_reass.c ip/reass/ip4_sv_reass.c ip/ip6_format.c @@ -470,7 +469,6 @@ list(APPEND VNET_SOURCES ) list(APPEND VNET_MULTIARCH_SOURCES - ip/ip4_source_check.c ip/ip4_punt_drop.c ip/reass/ip4_full_reass.c ip/ip6_hop_by_hop.c diff --git a/src/vnet/fib/ip4_fib.h b/src/vnet/fib/ip4_fib.h index ff00b4170c4..7d17baf2545 100644 --- a/src/vnet/fib/ip4_fib.h +++ b/src/vnet/fib/ip4_fib.h @@ -172,6 +172,30 @@ ip4_fib_forwarding_lookup (u32 fib_index, return (ip4_fib_mtrie_leaf_get_adj_index(leaf)); } +static_always_inline void +ip4_fib_forwarding_lookup_x2 (u32 fib_index0, + u32 fib_index1, + const ip4_address_t * addr0, + const ip4_address_t * addr1, + index_t *lb0, + index_t *lb1) +{ + ip4_fib_mtrie_leaf_t leaf[2]; + ip4_fib_mtrie_t * mtrie[2]; + + mtrie[0] = &ip4_fib_get(fib_index0)->mtrie; + mtrie[1] = &ip4_fib_get(fib_index1)->mtrie; + + leaf[0] = ip4_fib_mtrie_lookup_step_one (mtrie[0], addr0); + leaf[1] = ip4_fib_mtrie_lookup_step_one (mtrie[1], addr1); + leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 2); + leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 2); + leaf[0] = ip4_fib_mtrie_lookup_step (mtrie[0], leaf[0], addr0, 3); + leaf[1] = ip4_fib_mtrie_lookup_step (mtrie[1], leaf[1], addr1, 3); + + *lb0 = ip4_fib_mtrie_leaf_get_adj_index(leaf[0]); + *lb1 = ip4_fib_mtrie_leaf_get_adj_index(leaf[1]); +} #endif diff --git a/src/vnet/interface_types_api.h b/src/vnet/interface_types_api.h new file mode 100644 index 00000000000..37f6bad8737 --- /dev/null +++ b/src/vnet/interface_types_api.h @@ -0,0 +1,88 @@ +/* Hey Emacs use -*- mode: C -*- */ +/* + * Copyright (c) 2018 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +typedef u32 interface_index; + +enum if_status_flags +{ + IF_STATUS_API_FLAG_ADMIN_UP = 1, + IF_STATUS_API_FLAG_LINK_UP = 2, +}; + +/* Per protocol MTU */ +enum mtu_proto +{ + MTU_PROTO_API_L3, /* Default payload MTU (without L2 headers) */ + MTU_PROTO_API_IP4, /* Per-protocol MTUs overriding default */ + MTU_PROTO_API_IP6, + MTU_PROTO_API_MPLS, + MTU_PROTO_API_N, +}; + +enum link_duplex +{ + LINK_DUPLEX_API_UNKNOWN = 0, + LINK_DUPLEX_API_HALF = 1, + LINK_DUPLEX_API_FULL = 2, +}; + +enum sub_if_flags +{ + SUB_IF_API_FLAG_NO_TAGS = 1, + SUB_IF_API_FLAG_ONE_TAG = 2, + SUB_IF_API_FLAG_TWO_TAGS = 4, + SUB_IF_API_FLAG_DOT1AD = 8, + SUB_IF_API_FLAG_EXACT_MATCH = 16, + SUB_IF_API_FLAG_DEFAULT = 32, + SUB_IF_API_FLAG_OUTER_VLAN_ID_ANY = 64, + SUB_IF_API_FLAG_INNER_VLAN_ID_ANY = 128, + SUB_IF_API_FLAG_MASK_VNET = 254, /* use with vnet_sub_interface_t raw_flags */ + SUB_IF_API_FLAG_DOT1AH = 256, +}; + +enum rx_mode +{ + RX_MODE_API_UNKNOWN = 0, + RX_MODE_API_POLLING, + RX_MODE_API_INTERRUPT, + RX_MODE_API_ADAPTIVE, + RX_MODE_API_DEFAULT, +}; + +enum if_type +{ + /* A hw interface. */ + IF_API_TYPE_HARDWARE, + + /* A sub-interface. */ + IF_API_TYPE_SUB, + IF_API_TYPE_P2P, + IF_API_TYPE_PIPE, +}; + +enum direction:u8 +{ + DIRECTION_RX, + DIRECTION_TX, +}; + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/vnet/ip/ip.api b/src/vnet/ip/ip.api index edf995ed77d..73c73a3cee0 100644 --- a/src/vnet/ip/ip.api +++ b/src/vnet/ip/ip.api @@ -509,22 +509,6 @@ autoreply define ip_source_and_port_range_check_interface_add_del u32 udp_out_vrf_id; }; -/** \brief Set interface source check request - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param is_add - add or del - @param loose - strict or loose - @param sw_if_index - interface index -*/ -autoreply define ip_source_check_interface_add_del -{ - u32 client_index; - u32 context; - bool is_add [default=true]; - bool loose; - vl_api_interface_index_t sw_if_index; -}; - /** \brief IPv6 set link local address on interface request @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request diff --git a/src/vnet/ip/ip4_error.h b/src/vnet/ip/ip4_error.h index 073555a83b0..dce3dd4c1ab 100644 --- a/src/vnet/ip/ip4_error.h +++ b/src/vnet/ip/ip4_error.h @@ -67,9 +67,6 @@ _ (UDP_CHECKSUM, "bad udp checksum") \ _ (UDP_LENGTH, "inconsistent udp/ip lengths") \ \ - /* Errors signalled by ip4-source-check. */ \ - _ (UNICAST_SOURCE_CHECK_FAILS, "ip4 unicast source check fails") \ - \ /* Spoofed packets in ip4-rewrite-local */ \ _ (SPOOFED_LOCAL_PACKETS, "ip4 spoofed local-address packet drops") \ \ diff --git a/src/vnet/ip/ip4_forward.c b/src/vnet/ip/ip4_forward.c index c945f70a9d7..4ba0a731006 100644 --- a/src/vnet/ip/ip4_forward.c +++ b/src/vnet/ip/ip4_forward.c @@ -903,20 +903,6 @@ VNET_FEATURE_INIT (ip4_inacl, static) = { .arc_name = "ip4-unicast", .node_name = "ip4-inacl", - .runs_before = VNET_FEATURES ("ip4-source-check-via-rx"), -}; - -VNET_FEATURE_INIT (ip4_source_check_1, static) = -{ - .arc_name = "ip4-unicast", - .node_name = "ip4-source-check-via-rx", - .runs_before = VNET_FEATURES ("ip4-source-check-via-any"), -}; - -VNET_FEATURE_INIT (ip4_source_check_2, static) = -{ - .arc_name = "ip4-unicast", - .node_name = "ip4-source-check-via-any", .runs_before = VNET_FEATURES ("ip4-policer-classify"), }; diff --git a/src/vnet/ip/ip4_input.c b/src/vnet/ip/ip4_input.c index 6093b136c3d..4d48db8f567 100644 --- a/src/vnet/ip/ip4_input.c +++ b/src/vnet/ip/ip4_input.c @@ -436,9 +436,6 @@ ip4_init (vlib_main_t * vm) if ((error = vlib_call_init_function (vm, ip4_cli_init))) return error; - if ((error = vlib_call_init_function (vm, ip4_source_check_init))) - return error; - if ((error = vlib_call_init_function (vm, ip4_source_and_port_range_check_init))) return error; diff --git a/src/vnet/ip/ip4_packet.h b/src/vnet/ip/ip4_packet.h index 3872ccdd465..362805c8529 100644 --- a/src/vnet/ip/ip4_packet.h +++ b/src/vnet/ip/ip4_packet.h @@ -384,6 +384,12 @@ ip4_address_is_multicast (const ip4_address_t * a) return (a->data[0] & 0xf0) == 0xe0; } +always_inline uword +ip4_address_is_global_broadcast (const ip4_address_t * a) +{ + return (a->as_u32) == 0xffffffff; +} + always_inline void ip4_multicast_address_set_for_group (ip4_address_t * a, ip_multicast_group_t g) diff --git a/src/vnet/ip/ip4_source_check.c b/src/vnet/ip/ip4_source_check.c deleted file mode 100644 index b3d4b001e9e..00000000000 --- a/src/vnet/ip/ip4_source_check.c +++ /dev/null @@ -1,545 +0,0 @@ -/* - * Copyright (c) 2015 Cisco and/or its affiliates. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -/* - * ip/ip4_source_check.c: IP v4 check source address (unicast RPF check) - * - * Copyright (c) 2008 Eliot Dresselhaus - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including - * without limitation the rights to use, copy, modify, merge, publish, - * distribute, sublicense, and/or sell copies of the Software, and to - * permit persons to whom the Software is furnished to do so, subject to - * the following conditions: - * - * The above copyright notice and this permission notice shall be - * included in all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND - * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE - * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION - * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION - * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - */ - -#include -#include -#include -#include - -/** - * @file - * @brief IPv4 Unicast Source Check. - * - * This file contains the IPv4 interface unicast source check. - */ - - -typedef struct -{ - u8 packet_data[64]; - index_t urpf; -} ip4_source_check_trace_t; - -static u8 * -format_ip4_source_check_trace (u8 * s, va_list * va) -{ - CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *); - CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *); - ip4_source_check_trace_t *t = va_arg (*va, ip4_source_check_trace_t *); - - s = format (s, "%U", - format_ip4_header, t->packet_data, sizeof (t->packet_data)); - - return s; -} - -typedef enum -{ - IP4_SOURCE_CHECK_NEXT_DROP, - IP4_SOURCE_CHECK_N_NEXT, -} ip4_source_check_next_t; - -typedef enum -{ - IP4_SOURCE_CHECK_REACHABLE_VIA_RX, - IP4_SOURCE_CHECK_REACHABLE_VIA_ANY, -} ip4_source_check_type_t; - -typedef union -{ - u32 fib_index; -} ip4_source_check_config_t; - -always_inline uword -ip4_source_check_inline (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame, - ip4_source_check_type_t source_check_type) -{ - u32 n_left_from, *from, *to_next; - u32 next_index; - vlib_node_runtime_t *error_node = - vlib_node_get_runtime (vm, ip4_input_node.index); - - from = vlib_frame_vector_args (frame); - n_left_from = frame->n_vectors; - next_index = node->cached_next_index; - - if (node->flags & VLIB_NODE_FLAG_TRACE) - vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors, - /* stride */ 1, - sizeof (ip4_source_check_trace_t)); - - while (n_left_from > 0) - { - u32 n_left_to_next; - - vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); - - while (n_left_from >= 4 && n_left_to_next >= 2) - { - vlib_buffer_t *p0, *p1; - ip4_header_t *ip0, *ip1; - ip4_fib_mtrie_t *mtrie0, *mtrie1; - ip4_fib_mtrie_leaf_t leaf0, leaf1; - ip4_source_check_config_t *c0, *c1; - const load_balance_t *lb0, *lb1; - u32 pi0, next0, pass0, lb_index0; - u32 pi1, next1, pass1, lb_index1; - - /* Prefetch next iteration. */ - { - vlib_buffer_t *p2, *p3; - - p2 = vlib_get_buffer (vm, from[2]); - p3 = vlib_get_buffer (vm, from[3]); - - vlib_prefetch_buffer_header (p2, LOAD); - vlib_prefetch_buffer_header (p3, LOAD); - - CLIB_PREFETCH (p2->data, sizeof (ip0[0]), LOAD); - CLIB_PREFETCH (p3->data, sizeof (ip1[0]), LOAD); - } - - pi0 = to_next[0] = from[0]; - pi1 = to_next[1] = from[1]; - from += 2; - to_next += 2; - n_left_from -= 2; - n_left_to_next -= 2; - - p0 = vlib_get_buffer (vm, pi0); - p1 = vlib_get_buffer (vm, pi1); - - ip0 = vlib_buffer_get_current (p0); - ip1 = vlib_buffer_get_current (p1); - - c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0])); - c1 = vnet_feature_next_with_data (&next1, p1, sizeof (c1[0])); - - mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie; - mtrie1 = &ip4_fib_get (c1->fib_index)->mtrie; - - leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address); - leaf1 = ip4_fib_mtrie_lookup_step_one (mtrie1, &ip1->src_address); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2); - leaf1 = - ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 2); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3); - leaf1 = - ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 3); - - lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0); - lb_index1 = ip4_fib_mtrie_leaf_get_adj_index (leaf1); - - lb0 = load_balance_get (lb_index0); - lb1 = load_balance_get (lb_index1); - - /* Pass multicast. */ - pass0 = ip4_address_is_multicast (&ip0->src_address) - || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF); - pass1 = ip4_address_is_multicast (&ip1->src_address) - || ip1->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF); - - if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type) - { - pass0 |= fib_urpf_check (lb0->lb_urpf, - vnet_buffer (p0)->sw_if_index - [VLIB_RX]); - pass1 |= - fib_urpf_check (lb1->lb_urpf, - vnet_buffer (p1)->sw_if_index[VLIB_RX]); - } - else - { - pass0 |= fib_urpf_check_size (lb0->lb_urpf); - pass1 |= fib_urpf_check_size (lb1->lb_urpf); - } - next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP); - next1 = (pass1 ? next1 : IP4_SOURCE_CHECK_NEXT_DROP); - - p0->error = - error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS]; - p1->error = - error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS]; - - vlib_validate_buffer_enqueue_x2 (vm, node, next_index, - to_next, n_left_to_next, - pi0, pi1, next0, next1); - } - - while (n_left_from > 0 && n_left_to_next > 0) - { - vlib_buffer_t *p0; - ip4_header_t *ip0; - ip4_fib_mtrie_t *mtrie0; - ip4_fib_mtrie_leaf_t leaf0; - ip4_source_check_config_t *c0; - u32 pi0, next0, pass0, lb_index0; - const load_balance_t *lb0; - - pi0 = from[0]; - to_next[0] = pi0; - from += 1; - to_next += 1; - n_left_from -= 1; - n_left_to_next -= 1; - - p0 = vlib_get_buffer (vm, pi0); - ip0 = vlib_buffer_get_current (p0); - - c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0])); - - mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie; - - leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2); - - leaf0 = - ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 3); - - lb_index0 = ip4_fib_mtrie_leaf_get_adj_index (leaf0); - - lb0 = load_balance_get (lb_index0); - - /* Pass multicast. */ - pass0 = ip4_address_is_multicast (&ip0->src_address) - || ip0->src_address.as_u32 == clib_host_to_net_u32 (0xFFFFFFFF); - - if (IP4_SOURCE_CHECK_REACHABLE_VIA_RX == source_check_type) - { - pass0 |= fib_urpf_check (lb0->lb_urpf, - vnet_buffer (p0)->sw_if_index - [VLIB_RX]); - } - else - { - pass0 |= fib_urpf_check_size (lb0->lb_urpf); - } - - next0 = (pass0 ? next0 : IP4_SOURCE_CHECK_NEXT_DROP); - p0->error = - error_node->errors[IP4_ERROR_UNICAST_SOURCE_CHECK_FAILS]; - - vlib_validate_buffer_enqueue_x1 (vm, node, next_index, - to_next, n_left_to_next, - pi0, next0); - } - - vlib_put_next_frame (vm, node, next_index, n_left_to_next); - } - - return frame->n_vectors; -} - -VLIB_NODE_FN (ip4_check_source_reachable_via_any) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) -{ - return ip4_source_check_inline (vm, node, frame, - IP4_SOURCE_CHECK_REACHABLE_VIA_ANY); -} - -VLIB_NODE_FN (ip4_check_source_reachable_via_rx) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) -{ - return ip4_source_check_inline (vm, node, frame, - IP4_SOURCE_CHECK_REACHABLE_VIA_RX); -} - -/* *INDENT-OFF* */ -VLIB_REGISTER_NODE (ip4_check_source_reachable_via_any) = { - .name = "ip4-source-check-via-any", - .vector_size = sizeof (u32), - - .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT, - .next_nodes = { - [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop", - }, - - .format_buffer = format_ip4_header, - .format_trace = format_ip4_source_check_trace, -}; -/* *INDENT-ON* */ - -/* *INDENT-OFF* */ -VLIB_REGISTER_NODE (ip4_check_source_reachable_via_rx) = { - .name = "ip4-source-check-via-rx", - .vector_size = sizeof (u32), - - .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT, - .next_nodes = { - [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop", - }, - - .format_buffer = format_ip4_header, - .format_trace = format_ip4_source_check_trace, -}; -/* *INDENT-ON* */ - -static clib_error_t * -set_ip_source_check (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) -{ - unformat_input_t _line_input, *line_input = &_line_input; - vnet_main_t *vnm = vnet_get_main (); - ip4_main_t *im = &ip4_main; - clib_error_t *error = 0; - u32 sw_if_index, is_del; - ip4_source_check_config_t config; - char *feature_name = "ip4-source-check-via-rx"; - - sw_if_index = ~0; - is_del = 0; - - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat_user - (line_input, unformat_vnet_sw_interface, vnm, &sw_if_index)) - ; - else if (unformat (line_input, "del")) - is_del = 1; - else if (unformat (line_input, "loose")) - feature_name = "ip4-source-check-via-any"; - else - { - error = unformat_parse_error (line_input); - goto done; - } - } - - if (~0 == sw_if_index) - { - error = clib_error_return (0, "unknown interface `%U'", - format_unformat_error, line_input); - goto done; - } - - config.fib_index = im->fib_index_by_sw_if_index[sw_if_index]; - vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, - is_del == 0, &config, sizeof (config)); -done: - unformat_free (line_input); - - return error; -} - -/*? - * This command adds the 'ip4-source-check-via-rx' graph node for - * a given interface. By adding the IPv4 source check graph node to - * an interface, the code verifies that the source address of incoming - * unicast packets are reachable over the incoming interface. Two flavours - * are supported (the default is strict): - * - loose: accept ingress packet if there is a route to reach the source - * - strict: accept ingress packet if it arrived on an interface which - * the route to the source uses. i.e. an interface that the source - * is reachable via. - * - * @cliexpar - * @parblock - * Example of graph node before range checking is enabled: - * @cliexstart{show vlib graph ip4-source-check-via-rx} - * Name Next Previous - * ip4-source-check-via-rx ip4-drop [0] - * @cliexend - * - * Example of how to enable unicast source checking on an interface: - * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 loose} - * - * Example of graph node after range checking is enabled: - * @cliexstart{show vlib graph ip4-source-check-via-rx} - * Name Next Previous - * ip4-source-check-via-rx ip4-drop [0] ip4-input-no-checksum - * ip4-source-and-port-range- ip4-input - * @cliexend - * - * Example of how to display the feature enabed on an interface: - * @cliexstart{show ip interface features GigabitEthernet2/0/0} - * IP feature paths configured on GigabitEthernet2/0/0... - * - * ipv4 unicast: - * ip4-source-check-via-rx - * ip4-lookup - * - * ipv4 multicast: - * ip4-lookup-multicast - * - * ipv4 multicast: - * interface-output - * - * ipv6 unicast: - * ip6-lookup - * - * ipv6 multicast: - * ip6-lookup - * - * ipv6 multicast: - * interface-output - * @cliexend - * - * Example of how to disable unicast source checking on an interface: - * @cliexcmd{set interface ip source-check GigabitEthernet2/0/0 del} - * @endparblock -?*/ -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = { - .path = "set interface ip source-check", - .function = set_ip_source_check, - .short_help = "set interface ip source-check [strict|loose] [del]", -}; -/* *INDENT-ON* */ - -static clib_error_t * -ip_source_check_accept (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) -{ - unformat_input_t _line_input, *line_input = &_line_input; - fib_prefix_t pfx = { - .fp_proto = FIB_PROTOCOL_IP4, - }; - clib_error_t *error = NULL; - u32 table_id, is_add, fib_index; - - is_add = 1; - table_id = ~0; - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "table %d", &table_id)) - ; - else if (unformat (line_input, "del")) - is_add = 0; - else if (unformat (line_input, "add")) - is_add = 1; - else if (unformat (line_input, "%U/%d", - unformat_ip4_address, &pfx.fp_addr.ip4, &pfx.fp_len)) - pfx.fp_proto = FIB_PROTOCOL_IP4; - else - { - error = unformat_parse_error (line_input); - goto done; - } - } - - if (~0 != table_id) - { - fib_index = fib_table_find (pfx.fp_proto, table_id); - if (~0 == fib_index) - { - error = clib_error_return (0, "Nonexistent table id %d", table_id); - goto done; - } - } - else - { - fib_index = 0; - } - - if (is_add) - { - fib_table_entry_special_add (fib_index, - &pfx, - FIB_SOURCE_URPF_EXEMPT, - FIB_ENTRY_FLAG_DROP); - } - else - { - fib_table_entry_special_remove (fib_index, - &pfx, FIB_SOURCE_URPF_EXEMPT); - } - -done: - unformat_free (line_input); - - return error; -} - -/*? - * Add an exemption for a prefix to pass the Unicast Reverse Path - * Forwarding (uRPF) loose check. This is for testing purposes only. - * If the 'table' is not enter it is defaulted to 0. Default - * is to 'add'. VPP always performs a loose uRPF check for - * for-us traffic. - * - * @cliexpar - * Example of how to add a uRPF exception to a FIB table to pass the - * loose RPF tests: - * @cliexcmd{ip urpf-accept table 7 add} -?*/ -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (ip_source_check_accept_command, static) = { - .path = "ip urpf-accept", - .function = ip_source_check_accept, - .short_help = "ip urpf-accept [table ] [add|del]", -}; -/* *INDENT-ON* */ - - -#ifndef CLIB_MARCH_VARIANT -/* Dummy init function to get us linked in. */ -clib_error_t * -ip4_source_check_init (vlib_main_t * vm) -{ - return 0; -} - -VLIB_INIT_FUNCTION (ip4_source_check_init); -#endif /* CLIB_MARCH_VARIANT */ - -/* - * fd.io coding-style-patch-verification: ON - * - * Local Variables: - * eval: (c-set-style "gnu") - * End: - */ diff --git a/src/vnet/ip/ip_api.c b/src/vnet/ip/ip_api.c index 4f5b6b9d0a6..5c0784f9cb3 100644 --- a/src/vnet/ip/ip_api.c +++ b/src/vnet/ip/ip_api.c @@ -94,8 +94,6 @@ _(IP_SOURCE_AND_PORT_RANGE_CHECK_ADD_DEL, \ ip_source_and_port_range_check_add_del) \ _(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL, \ ip_source_and_port_range_check_interface_add_del) \ -_(IP_SOURCE_CHECK_INTERFACE_ADD_DEL, \ - ip_source_check_interface_add_del) \ _(SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS, \ sw_interface_ip6_set_link_local_address) \ _(IP_REASSEMBLY_SET, ip_reassembly_set) \ @@ -1270,37 +1268,6 @@ static void REPLY_MACRO (VL_API_SW_INTERFACE_IP6_SET_LINK_LOCAL_ADDRESS_REPLY); } -typedef union -{ - u32 fib_index; -} ip4_source_check_config_t; - -static void - vl_api_ip_source_check_interface_add_del_t_handler - (vl_api_ip_source_check_interface_add_del_t * mp) -{ - vl_api_ip_source_check_interface_add_del_reply_t *rmp; - int rv; - u32 sw_if_index = ntohl (mp->sw_if_index); - u8 is_add = mp->is_add; - char *feature_name = - mp->loose ? "ip4-source-check-via-any" : "ip4-source-check-via-rx"; - - ip4_source_check_config_t config; - - VALIDATE_SW_IF_INDEX (mp); - - config.fib_index = - fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index); - rv = - vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, - is_add, &config, sizeof (config)); - BAD_SW_IF_INDEX_LABEL; - - REPLY_MACRO (VL_API_IP_SOURCE_CHECK_INTERFACE_ADD_DEL_REPLY); -} - - static void vl_api_ip_table_replace_begin_t_handler (vl_api_ip_table_replace_begin_t * mp) { -- cgit 1.2.3-korg