summaryrefslogtreecommitdiffstats
path: root/src/vnet/ip-neighbor/ip6_neighbor.h
blob: 934a2885ee147294d87ffc9e75301ecf68118a5a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
/*
 * ip/ip6_neighbor.h: IP6 NS transmit
 *
 * Copyright (c) 2019 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#ifndef __IP6_NEIGHBOR_H__
#define __IP6_NEIGHBOR_H__

#include <vlib/vlib.h>
#include <vnet/ip/format.h>
#include <vnet/ip/ip6.h>
#include <vnet/ip/ip6_link.h>
#include <vnet/ip/icmp46_packet.h>
#include <vnet/ethernet/ethernet.h>
#include <vnet/adj/adj_internal.h>

/* Template used to generate IP6 neighbor solicitation packets. */
extern vlib_packet_template_t ip6_neighbor_packet_template;

extern void ip6_neighbor_advertise (vlib_main_t * vm,
				    vnet_main_t * vnm,
				    u32 sw_if_index,
				    const ip6_address_t * addr);

extern void ip6_neighbor_probe_dst (const ip_adjacency_t * adj,
				    const ip6_address_t * dst);

always_inline vlib_buffer_t *
ip6_neighbor_probe (vlib_main_t * vm,
		    vnet_main_t * vnm,
		    const ip_adjacency_t * adj,
		    const ip6_address_t * src, const ip6_address_t * dst)
{
  icmp6_neighbor_solicitation_header_t *h0;
  vnet_hw_interface_t *hw_if0;
  vlib_buffer_t *b0;
  int bogus_length;
  u32 bi0 = 0;

  h0 = vlib_packet_template_get_packet
    (vm, &ip6_neighbor_packet_template, &bi0);
  if (!h0)
    return NULL;;

  b0 = vlib_get_buffer (vm, bi0);

  hw_if0 = vnet_get_sup_hw_interface (vnm, adj->rewrite_header.sw_if_index);

  /*
   * Destination address is a solicited node multicast address.
   * We need to fill in
   * the low 24 bits with low 24 bits of target's address.
   */
  h0->ip.src_address = *src;
  h0->ip.dst_address.as_u8[13] = dst->as_u8[13];
  h0->ip.dst_address.as_u8[14] = dst->as_u8[14];
  h0->ip.dst_address.as_u8[15] = dst->as_u8[15];

  h0->neighbor.target_address = *dst;

  clib_memcpy (h0->link_layer_option.ethernet_address,
	       hw_if0->hw_address, vec_len (hw_if0->hw_address));

  /* $$$$ appears we need this; why is the checksum non-zero? */
  h0->neighbor.icmp.checksum = 0;
  h0->neighbor.icmp.checksum =
    ip6_tcp_udp_icmp_compute_checksum (vm, 0, &h0->ip, &bogus_length);

  ASSERT (bogus_length == 0);
  VLIB_BUFFER_TRACE_TRAJECTORY_INIT (b0);

  vnet_buffer (b0)->sw_if_index[VLIB_TX] = adj->rewrite_header.sw_if_index;

  /* Use the link's mcast adj to ship the packet */
  vnet_buffer (b0)->ip.adj_index[VLIB_TX] =
    ip6_link_get_mcast_adj (adj->rewrite_header.sw_if_index);
  adj = adj_get (vnet_buffer (b0)->ip.adj_index[VLIB_TX]);

  b0->flags |= VNET_BUFFER_F_LOCALLY_ORIGINATED;

  {
    vlib_frame_t *f = vlib_get_frame_to_node (vm, adj->ia_node_index);
    u32 *to_next = vlib_frame_vector_args (f);
    to_next[0] = bi0;
    f->n_vectors = 1;
    vlib_put_frame_to_node (vm, adj->ia_node_index, f);
  }

  return b0;
}

#endif

/*
 * fd.io coding-style-patch-verification: ON
 *
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */
n>(ConfigIpsecAH, self).setUp() def tearDown(self): super(ConfigIpsecAH, self).tearDown() def config_network(self, params): self.net_objs = [] self.tun_if = self.pg0 self.tra_if = self.pg2 self.logger.info(self.vapi.ppcli("show int addr")) self.tra_spd = VppIpsecSpd(self, self.tra_spd_id) self.tra_spd.add_vpp_config() self.net_objs.append(self.tra_spd) self.tun_spd = VppIpsecSpd(self, self.tun_spd_id) self.tun_spd.add_vpp_config() self.net_objs.append(self.tun_spd) b = VppIpsecSpdItfBinding(self, self.tra_spd, self.tra_if) b.add_vpp_config() self.net_objs.append(b) b = VppIpsecSpdItfBinding(self, self.tun_spd, self.tun_if) b.add_vpp_config() self.net_objs.append(b) for p in params: self.config_ah_tra(p) config_tra_params(p, self.encryption_type) for p in params: self.config_ah_tun(p) for p in params: d = DpoProto.DPO_PROTO_IP6 if p.is_ipv6 else DpoProto.DPO_PROTO_IP4 r = VppIpRoute(self, p.remote_tun_if_host, p.addr_len, [VppRoutePath(self.tun_if.remote_addr[p.addr_type], 0xffffffff, proto=d)]) r.add_vpp_config() self.net_objs.append(r) self.logger.info(self.vapi.ppcli("show ipsec all")) def unconfig_network(self): for o in reversed(self.net_objs): o.remove_vpp_config() self.net_objs = [] def config_ah_tun(self, params): addr_type = params.addr_type scapy_tun_sa_id = params.scapy_tun_sa_id scapy_tun_spi = params.scapy_tun_spi vpp_tun_sa_id = params.vpp_tun_sa_id vpp_tun_spi = params.vpp_tun_spi auth_algo_vpp_id = params.auth_algo_vpp_id auth_key = params.auth_key crypt_algo_vpp_id = params.crypt_algo_vpp_id crypt_key = params.crypt_key remote_tun_if_host = params.remote_tun_if_host addr_any = params.addr_any addr_bcast = params.addr_bcast flags = params.flags e = VppEnum.vl_api_ipsec_spd_action_t objs = [] params.tun_sa_in = VppIpsecSA(self, scapy_tun_sa_id, scapy_tun_spi, auth_algo_vpp_id, auth_key, crypt_algo_vpp_id, crypt_key, self.vpp_ah_protocol, self.tun_if.local_addr[addr_type], self.tun_if.remote_addr[addr_type], flags=flags) params.tun_sa_out = VppIpsecSA(self, vpp_tun_sa_id, vpp_tun_spi, auth_algo_vpp_id, auth_key, crypt_algo_vpp_id, crypt_key, self.vpp_ah_protocol, self.tun_if.remote_addr[addr_type], self.tun_if.local_addr[addr_type], flags=flags) objs.append(params.tun_sa_in) objs.append(params.tun_sa_out) params.spd_policy_in_any = VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, addr_any, addr_bcast, addr_any, addr_bcast, socket.IPPROTO_AH) params.spd_policy_out_any = VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, addr_any, addr_bcast, addr_any, addr_bcast, socket.IPPROTO_AH, is_outbound=0) objs.append(params.spd_policy_out_any) objs.append(params.spd_policy_in_any) e1 = VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, remote_tun_if_host, remote_tun_if_host, self.pg1.remote_addr[addr_type], self.pg1.remote_addr[addr_type], 0, priority=10, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=0) e2 = VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id, self.pg1.remote_addr[addr_type], self.pg1.remote_addr[addr_type], remote_tun_if_host, remote_tun_if_host, 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT, priority=10) e3 = VppIpsecSpdEntry(self, self.tun_spd, vpp_tun_sa_id, remote_tun_if_host, remote_tun_if_host, self.pg0.local_addr[addr_type], self.pg0.local_addr[addr_type], 0, priority=20, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=0) e4 = VppIpsecSpdEntry(self, self.tun_spd, scapy_tun_sa_id, self.pg0.local_addr[addr_type], self.pg0.local_addr[addr_type], remote_tun_if_host, remote_tun_if_host, 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT, priority=20) objs = objs + [e1, e2, e3, e4] for o in objs: o.add_vpp_config() self.net_objs = self.net_objs + objs def config_ah_tra(self, params): addr_type = params.addr_type scapy_tra_sa_id = params.scapy_tra_sa_id scapy_tra_spi = params.scapy_tra_spi vpp_tra_sa_id = params.vpp_tra_sa_id vpp_tra_spi = params.vpp_tra_spi auth_algo_vpp_id = params.auth_algo_vpp_id auth_key = params.auth_key crypt_algo_vpp_id = params.crypt_algo_vpp_id crypt_key = params.crypt_key addr_any = params.addr_any addr_bcast = params.addr_bcast flags = params.flags | (VppEnum.vl_api_ipsec_sad_flags_t. IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY) e = VppEnum.vl_api_ipsec_spd_action_t objs = [] params.tra_sa_in = VppIpsecSA(self, scapy_tra_sa_id, scapy_tra_spi, auth_algo_vpp_id, auth_key, crypt_algo_vpp_id, crypt_key, self.vpp_ah_protocol, flags=flags) params.tra_sa_out = VppIpsecSA(self, vpp_tra_sa_id, vpp_tra_spi, auth_algo_vpp_id, auth_key, crypt_algo_vpp_id, crypt_key, self.vpp_ah_protocol, flags=flags) objs.append(params.tra_sa_in) objs.append(params.tra_sa_out) objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, addr_any, addr_bcast, addr_any, addr_bcast, socket.IPPROTO_AH)) objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id, addr_any, addr_bcast, addr_any, addr_bcast, socket.IPPROTO_AH, is_outbound=0)) objs.append(VppIpsecSpdEntry(self, self.tra_spd, vpp_tra_sa_id, self.tra_if.local_addr[addr_type], self.tra_if.local_addr[addr_type], self.tra_if.remote_addr[addr_type], self.tra_if.remote_addr[addr_type], 0, priority=10, policy=e.IPSEC_API_SPD_ACTION_PROTECT, is_outbound=0)) objs.append(VppIpsecSpdEntry(self, self.tra_spd, scapy_tra_sa_id, self.tra_if.local_addr[addr_type], self.tra_if.local_addr[addr_type], self.tra_if.remote_addr[addr_type], self.tra_if.remote_addr[addr_type], 0, policy=e.IPSEC_API_SPD_ACTION_PROTECT, priority=10)) for o in objs: o.add_vpp_config() self.net_objs = self.net_objs + objs class TemplateIpsecAh(ConfigIpsecAH): """ Basic test for IPSEC using AH transport and Tunnel mode TRANSPORT MODE: --- encrypt --- |pg2| <-------> |VPP| --- decrypt --- TUNNEL MODE: --- encrypt --- plain --- |pg0| <------- |VPP| <------ |pg1| --- --- --- --- decrypt --- plain --- |pg0| -------> |VPP| ------> |pg1| --- --- --- """ @classmethod def setUpClass(cls): super(TemplateIpsecAh, cls).setUpClass() @classmethod def tearDownClass(cls): super(TemplateIpsecAh, cls).tearDownClass() def setUp(self): super(TemplateIpsecAh, self).setUp() self.config_network(self.params.values()) def tearDown(self): self.unconfig_network() super(TemplateIpsecAh, self).tearDown() class TestIpsecAh1(TemplateIpsecAh, IpsecTcpTests): """ Ipsec AH - TCP tests """ pass class TestIpsecAh2(TemplateIpsecAh, IpsecTra46Tests, IpsecTun46Tests): """ Ipsec AH w/ SHA1 """ pass class TestIpsecAhAll(ConfigIpsecAH, IpsecTra4, IpsecTra6, IpsecTun4, IpsecTun6): """ Ipsec AH all Algos """ def setUp(self): super(TestIpsecAhAll, self).setUp() def tearDown(self): super(TestIpsecAhAll, self).tearDown() def test_integ_algs(self): """All Engines SHA[1_96, 256, 384, 512] w/ & w/o ESN""" # foreach VPP crypto engine engines = ["ia32", "ipsecmb", "openssl"] algos = [{'vpp': VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA1_96, 'scapy': "HMAC-SHA1-96"}, {'vpp': VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA_256_128, 'scapy': "SHA2-256-128"}, {'vpp': VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA_384_192, 'scapy': "SHA2-384-192"}, {'vpp': VppEnum.vl_api_ipsec_integ_alg_t. IPSEC_API_INTEG_ALG_SHA_512_256, 'scapy': "SHA2-512-256"}] flags = [0, (VppEnum.vl_api_ipsec_sad_flags_t. IPSEC_API_SAD_FLAG_USE_ESN)] # # loop through the VPP engines # for engine in engines: self.vapi.cli("set crypto handler all %s" % engine) # # loop through each of the algorithms # for algo in algos: # with self.subTest(algo=algo['scapy']): for flag in flags: # # setup up the config paramters # self.ipv4_params = IPsecIPv4Params() self.ipv6_params = IPsecIPv6Params() self.params = {self.ipv4_params.addr_type: self.ipv4_params, self.ipv6_params.addr_type: self.ipv6_params} for _, p in self.params.items(): p.auth_algo_vpp_id = algo['vpp'] p.auth_algo = algo['scapy'] p.flags = p.flags | flag # # configure the SPDs. SAs, etc # self.config_network(self.params.values()) # # run some traffic. # An exhautsive 4o6, 6o4 is not necessary for each algo # self.verify_tra_basic6(count=17) self.verify_tra_basic4(count=17) self.verify_tun_66(self.params[socket.AF_INET6], count=17) self.verify_tun_44(self.params[socket.AF_INET], count=17) # # remove the SPDs, SAs, etc # self.unconfig_network() if __name__ == '__main__': unittest.main(testRunner=VppTestRunner)