#!/usr/bin/env python import unittest import socket import binascii import sys from framework import VppTestCase, VppTestRunner from scapy.packet import Raw from scapy.layers.l2 import Ether from scapy.layers.inet6 import IPv6, UDP, TCP from util import ppp class TestClassifier(VppTestCase): """ Classifier Test Case """ @classmethod def setUpClass(cls): """ Perform standard class setup (defined by class method setUpClass in class VppTestCase) before running the test case, set test case related variables and configure VPP. """ super(TestClassifier, cls).setUpClass() cls.acl_active_table = '' def setUp(self): """ Perform test setup before test case. **Config:** - create 4 pg interfaces - untagged pg0/pg1/pg2 interface pg0 -------> pg1 (IP ACL) \ ---> pg2 (MAC ACL)) - setup interfaces: - put it into UP state - set IPv6 addresses - resolve neighbor address using NDP :ivar list interfaces: pg interfaces. :ivar list pg_if_packet_sizes: packet sizes in test. :ivar dict acl_tbl_idx: ACL table index. :ivar int pbr_vrfid: VRF id for PBR test. """ self.reset_packet_infos() super(TestClassifier, self).setUp() # create 4 pg interfaces self.create_pg_interfaces(range(3)) # packet sizes to test self.pg_if_packet_sizes = [64, 9018] self.interfaces = list(self.pg_interfaces) # ACL vars self.acl_tbl_idx = {} # setup all interfaces for intf in self.interfaces: intf.admin_up() intf.config_ip6() intf.resolve_ndp() def tearDown(self): """Run standard test teardown and acl related log.""" if not self.vpp_dead: self.logger.info(self.vapi.ppcli("show inacl type ip6")) self.logger.info(self.vapi.ppcli("show outacl type ip6")) self.logger.info(self.vapi.cli("show classify table verbose")) self.logger.info(self.vapi.cli("show ip fib")) if self.acl_active_table == 'ip6_out': self.output_acl_set_interface( self.pg0, self.acl_tbl_idx.get(self.acl_active_table), 0) self.acl_active_table = '' elif self.acl_active_table != '': self.input_acl_set_interface( self.pg0, self.acl_tbl_idx.get(self.acl_active_table), 0) self.acl_active_table = '' for intf in self.interfaces: intf.unconfig_ip6() intf.admin_down() super(TestClassifier, self).tearDown() def create_stream(self, src_if, dst_if, packet_sizes, proto_l=UDP(sport=1234, dport=5678)): """Create input packet stream for defined interfaces. :param VppInterface src_if: Source Interface for packet stream. :param VppInterface dst_if: Destination Interface for packet stream. :param list packet_sizes: packet size to test. :param Scapy proto_l: Required IP protocol. Default protocol is UDP. """ pkts = [] for size in packet_sizes: info = self.create_packet_info(src_if, dst_if) payload = self.info_to_payload(info) p = (Ether(dst=src_if.local_mac, src=src_if.remote_mac) / IPv6(src=src_if.remote_ip6, dst=dst_if.remote_ip6) / proto_l / Raw(payload)) info.data = p.copy() self.extend_packet(p, size) pkts.append(p) return pkts def verify_capture(self, dst_if, capture, proto_l=UDP): """Verify captured input packet stream for defined interface. :param VppInterface dst_if: Interface to verify captured packet stream. :param list capture: Captured packet stream. :param Scapy proto_l: Required IP protocol. Default protocol is UDP. """ self.logger.info("Verifying capture on interface %s" % dst_if.name) last_info = dict() for i in self.interfaces: last_info[i.sw_if_index] = None dst_sw_if_index = dst_if.sw_if_index for packet in capture: try: ip6_received = packet[IPv6] proto_received = packet[proto_l] payload_info = self.payload_to_info(str(packet[Raw])) packet_index = payload_info.index self.assertEqual(payload_info.dst, dst_sw_if_index) self.logger.debug( "Got packet on port %s: src=%u (id=%u)" % (dst_if.name, payload_info.src, packet_index)) next_info = self.get_next_packet_info_for_interface2( payload_info.src, dst_sw_if_index, last_info[payload_info.src]) last_info[payload_info.src] = next_info self.assertTrue(next_info is not None) self.assertEqual(packet_index, next_info.index) saved_packet = next_info.data ip_saved = saved_packet[IPv6] proto_saved = saved_packet[proto_l] # Check standard fields self.assertEqual(ip6_received.src, ip_saved.src) self.assertEqual(ip6_received.dst, ip_saved.dst) self.assertEqual(proto_received.sport, proto_saved.sport) self.assertEqual(proto_received.dport, proto_saved.dport) except: self.logger.error(ppp("Unexpected or invalid packet:", packet)) raise for i in self.interfaces: remaining_packet = self.get_next_packet_info_for_interface2( i.sw_if_index, dst_sw_if_index, last_info[i.sw_if_index]) self.assertTrue(remaining_packet is None, "Interface %s: Packet expected from interface %s " "didn't arrive" % (dst_if.name, i.name)) @staticmethod def build_ip6_mask(nh='', src_ip='', dst_ip='', src_port='', dst_port=''): """Build IPv6 ACL mask data with hexstring format. :param str nh: next header number <0-ff> :param str src_ip: source ip address <0-ffffffff> :param str dst_ip: destination ip address <0-ffffffff> :param str src_port: source port number <0-ffff> :param str dst_port: destination port number <0-ffff> """ return ('{:0>14}{:0>34}{:0>32}{:0>4}{:0>4}'.format( nh, src_ip, dst_ip, src_port, dst_port)).rstrip('0') @staticmethod def build_ip6_match(nh=0, src_ip='', dst_ip='', src_port=0, dst_port=0): """Build IPv6 ACL match data with hexstring format. :param int nh: next header number with valid option "x" :param str src_ip: source ip6 address with format of "xxx:xxxx::xxxx" :param str dst_ip: destination ip6 address with format of "xxx:xxxx::xxxx" :param int src_port: source port number "x" :param int dst_port: destination port number "x" """ if src_ip: src_ip = binascii.hexlify(socket.inet_pton( socket.AF_INET6, src_ip)) if dst_ip: dst_ip = binascii.hexlify(socket.inet_pton( socket.AF_INET6, dst_ip)) return ('{:0>14}{:0>34}{:0>32}{:0>4}{:0>4}'.format( hex(nh)[2:], src_ip, dst_ip, hex(src_port)[2:], hex(dst_port)[2:])).rstrip('0') @staticmethod def build_mac_mask(dst_mac='', src_mac='', ether_type=''): """Build MAC ACL mask data with hexstring format. :param str dst_mac: source MAC address <0-ffffffffffff> :param str src_mac: destination MAC address <0-ffffffffffff> :param str ether_type: ethernet type <0-ffff> """ return ('{:0>12}{:0>12}{:0>4}'.format(dst_mac, src_mac, ether_type)).rstrip('0') @staticmethod def build_mac_match(dst_mac='', src_mac='', ether_type=''): """Build MAC ACL match data with hexstring format. :param str dst_mac: source MAC address :param str src_mac: destination MAC address :param str ether_type: ethernet type <0-ffff> """ if dst_mac: dst_mac = dst_mac.replace(':', '') if src_mac: src_mac = src_mac.replace(':', '') return ('{:0>12}{:0>12}{:0>4}'.format(dst_mac, src_mac, ether_type)).rstrip('0') def create_classify_table(self, key, mask, data_offset=0): """Create Classify Table :param str key: key for classify table (ex, ACL name). :param str mask: mask value for interested traffic. :param int data_offset: """ r = self.vapi.classify_add_del_table( is_add=1, mask=binascii.unhexlify(mask), match_n_vectors=(len(mask) - 1) // 32 + 1, miss_next_index=0, current_data_flag=1, current_data_offset=data_offset) self.assertIsNotNone(r, msg='No response msg for add_del_table') self.acl_tbl_idx[key] = r.new_table_index def create_classify_session(self, table_index, match, vrfid=0, is_add=1): """Create Classify Session :param int table_index: table index to identify classify table. :param str match: matched value for interested traffic. :param int vrfid: VRF id. :param int is_add: option to configure classify session. - create(1) or delete(0) """ r = self.vapi.classify_add_del_session( is_add, table_index, binascii.unhexlify(match), opaque_index=0, metadata=vrfid) self.assertIsNotNone(r, msg='No response msg for add_del_session') def input_acl_set_interface(self, intf, table_index, is_add=1): """Configure Input ACL interface :param VppInterface intf: Interface to apply Input ACL feature. :param int table_index: table index to identify classify table. :param int is_add: opt
/*
 * Copyright (c) 2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
/**
 * @brief
 * Neighbour Adjacency sub-type. These adjs represent an L3 peer on a
 * connected link. 
 */

#ifndef __ADJ_NBR_H__
#define __ADJ_NBR_H__

#include <vnet/vnet.h>
#include <vnet/adj/adj_types.h>
#include <vnet/fib/fib_node.h>
#include <vnet/dpo/dpo.h>

/**
 * @brief
 *  Add (and lock) a new or lock an existing neighbour adjacency
 *
 * @param nh_proto
 *  The protocol for the next-hop address (v4 or v6)
 *
 * @param link_type
 *  A description of the protocol of the packets that will forward
 *  through this adj. On an ethernet interface this is the MAC header's
 *  ether-type
 *
 * @param nh_addr
 *  The address of the next-hop/peer to send the packet to
 *
 * @param sw_if_index
 *  The interface on which the peer resides
 */
extern adj_index_t adj_nbr_add_or_lock(fib_protocol_t nh_proto,
				       vnet_link_t link_type,
				       const ip46_address_t *nh_addr,
				       u32 sw_if_index);

/**
 * @brief
 *  Add (and lock) a new or lock an existing neighbour adjacency
 *
 * @param nh_proto
 *  The protocol for the next-hop address (v4 or v6)
 *
 * @param link_type
 *  A description of the protocol of the packets that will forward
 *  through this adj. On an ethernet interface this is the MAC header's
 *  ether-type
 *
 * @param nh_addr
 *  The address of the next-hop/peer to send the packet to
 *
 * @param sw_if_index
 *  The interface on which the peer resides
 *
 * @param rewrite
 *  The rewrite to prepend to packets
 */
extern adj_index_t adj_nbr_add_or_lock_w_rewrite(fib_protocol_t nh_proto,
						 vnet_link_t link_type,
						 const ip46_address_t *nh_addr,
						 u32 sw_if_index,
						 u8 *rewrite);
/**
 * @brief When adding a rewrite to an adjacency these are flags that
 * apply to that rewrite
 */
typedef enum adj_nbr_rewrite_flag_t_
{
    ADJ_NBR_REWRITE_FLAG_NONE,

    /**
     * An indication that the rewrite is incomplete, i.e. that it describes the
     * ARP/ND rewrite when probing.
     */
    ADJ_NBR_REWRITE_FLAG_INCOMPLETE = ADJ_NBR_REWRITE_FLAG_NONE,

    /**
     * An indication that the rewrite is complete, i.e. that it fully describes
     * the link-layer addressing for the desintation.
     * The opposite of this is an incomplete rewrite that describes the ARP/ND
     * rewrite when probing.
     */
    ADJ_NBR_REWRITE_FLAG_COMPLETE = (1 << 0),
} adj_nbr_rewrite_flag_t;

/**
 * @brief
 *  Update the rewrite string for an existing adjacecny.
 *
 * @param
 *  The index of the adj to update
 *
 * @param
 *  The new rewrite
 */
extern void adj_nbr_update_rewrite(adj_index_t adj_index,
				   adj_nbr_rewrite_flag_t flags,
				   u8 *rewrite);

/**
 * @brief
 * Format aa incomplete neigbour (ARP) adjacency
 */
extern u8* format_adj_nbr_incomplete(u8* s, va_list *ap);

/**
 * @brief
 * Format a neigbour (REWRITE) adjacency
 */
extern u8* format_adj_nbr(u8* s, va_list *ap);

/**
 * @brief Walk the neighbour Adjacencies on a given interface
 */
extern void adj_nbr_walk (u32 sw_if_index,
			  fib_protocol_t adj_nh_proto,
			  adj_walk_cb_t cb,
			  void *ctx);
/**
 * @brief Walk the neighbour Adjacencies on a given interface with a given next-hop
 */
void
adj_nbr_walk_nh (