FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
urpf.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <urpf/urpf.h>
17 
18 #include <vnet/fib/fib_table.h>
19 
20 /* *INDENT-OFF* */
21 static const char *urpf_feat_arcs[N_AF][VLIB_N_DIR] =
22 {
23  [AF_IP4] = {
24  [VLIB_RX] = "ip4-unicast",
25  [VLIB_TX] = "ip4-output",
26  },
27  [AF_IP6] = {
28  [VLIB_RX] = "ip6-unicast",
29  [VLIB_TX] = "ip6-output",
30  },
31 };
32 
33 static const char *urpf_feats[N_AF][VLIB_N_DIR][URPF_N_MODES] =
34 {
35  [AF_IP4] = {
36  [VLIB_RX] = {
37  [URPF_MODE_STRICT] = "ip4-rx-urpf-strict",
38  [URPF_MODE_LOOSE] = "ip4-rx-urpf-loose",
39  },
40  [VLIB_TX] = {
41  [URPF_MODE_STRICT] = "ip4-tx-urpf-strict",
42  [URPF_MODE_LOOSE] = "ip4-tx-urpf-loose",
43  },
44  },
45  [AF_IP6] = {
46  [VLIB_RX] = {
47  [URPF_MODE_STRICT] = "ip6-rx-urpf-strict",
48  [URPF_MODE_LOOSE] = "ip6-rx-urpf-loose",
49  },
50  [VLIB_TX] = {
51  [URPF_MODE_STRICT] = "ip6-tx-urpf-strict",
52  [URPF_MODE_LOOSE] = "ip6-tx-urpf-loose",
53  },
54  },
55 };
56 /* *INDENT-ON* */
57 
58 /**
59  * Per-af, per-direction, per-interface uRPF configs
60  */
62 
63 u8 *
64 format_urpf_mode (u8 * s, va_list * a)
65 {
66  urpf_mode_t mode = va_arg (*a, int);
67 
68  switch (mode)
69  {
70 #define _(a,b) \
71  case URPF_MODE_##a: \
72  return (format (s, "%s", b));
74 #undef _
75  }
76 
77  return (format (s, "unknown"));
78 }
79 
80 static uword
81 unformat_urpf_mode (unformat_input_t * input, va_list * args)
82 {
83  urpf_mode_t *mode = va_arg (*args, urpf_mode_t *);
84 
85  if (0)
86  ;
87 #define _(a,b) \
88  else if (unformat (input, b)) \
89  { \
90  *mode = URPF_MODE_##a; \
91  return (1); \
92  }
94 #undef _
95  return 0;
96 }
97 
98 void
101 {
102  urpf_mode_t old;
103 
104  vec_validate_init_empty (urpf_cfgs[af][dir], sw_if_index, URPF_MODE_OFF);
105  old = urpf_cfgs[af][dir][sw_if_index];
106 
107  if (mode != old)
108  {
109  if (URPF_MODE_OFF != old)
110  /* disable what we have */
112  urpf_feats[af][dir][old],
113  sw_if_index, 0, 0, 0);
114 
115  if (URPF_MODE_OFF != mode)
116  /* enable what's new */
118  urpf_feats[af][dir][mode],
119  sw_if_index, 1, 0, 0);
120  }
121  /* else - no change to existing config */
122 
123  urpf_cfgs[af][dir][sw_if_index] = mode;
124 }
125 
126 static clib_error_t *
128  unformat_input_t * input, vlib_cli_command_t * cmd)
129 {
130  unformat_input_t _line_input, *line_input = &_line_input;
131  vnet_main_t *vnm = vnet_get_main ();
132  clib_error_t *error = NULL;
136  vlib_dir_t dir;
137 
138  sw_if_index = ~0;
139  af = AF_IP4;
140  dir = VLIB_RX;
141  mode = URPF_MODE_STRICT;
142 
143  if (!unformat_user (input, unformat_line_input, line_input))
144  return 0;
145 
146  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
147  {
148  if (unformat (line_input, "%U",
149  unformat_vnet_sw_interface, vnm, &sw_if_index))
150  ;
151  else if (unformat (line_input, "%U", unformat_urpf_mode, &mode))
152  ;
153  else if (unformat (line_input, "%U", unformat_ip_address_family, &af))
154  ;
155  else if (unformat (line_input, "%U", unformat_vlib_rx_tx, &dir))
156  ;
157  else
158  {
159  error = unformat_parse_error (line_input);
160  goto done;
161  }
162  }
163 
164  if (~0 == sw_if_index)
165  {
166  error = clib_error_return (0, "unknown interface `%U'",
167  format_unformat_error, line_input);
168  goto done;
169  }
170 
171  urpf_update (mode, sw_if_index, af, dir);
172 done:
173  unformat_free (line_input);
174 
175  return error;
176 }
177 
178 /*?
179  * This command configures uRPF on an interface.
180  * Two flavours are supported (the default is strict):
181  * - loose: accept ingress packet if there is a route to reach the source
182  * - strict: accept ingress packet if it arrived on an interface which
183  * the route to the source uses. i.e. an interface that the source
184  * is reachable via.
185  *
186  * @cliexpar
187  * @parblock
188  * Example of graph node before range checking is enabled:
189  * @cliexstart{show vlib graph ip4-rx-urpf-strict}
190  * Name Next Previous
191  * ip4-rx-urpf-strict ip4-drop [0]
192  * @cliexend
193  *
194  * Example of how to enable unicast source checking on an interface:
195  * @cliexcmd{set urpf ip4 rx GigabitEthernet2/0/0 loose}
196  *
197  * Example of graph node after range checking is enabled:
198  * @cliexstart{show vlib graph ip4-rx-urpf-loose}
199  * Name Next Previous
200  * ip4-rx-urpf-loose ip4-drop [0] ip4-input-no-checksum
201  * ip4-source-and-port-range- ip4-input
202  * @cliexend
203  *
204  * Example of how to display the feature enabed on an interface:
205  * @cliexstart{show ip interface features GigabitEthernet2/0/0}
206  * IP feature paths configured on GigabitEthernet2/0/0...
207  *
208  * ipv4 unicast:
209  * ip4-rx-urpf-loose
210  * ip4-lookup
211  *
212  * ipv4 multicast:
213  * ip4-lookup-multicast
214  *
215  * ipv4 multicast:
216  * interface-output
217  *
218  * ipv6 unicast:
219  * ip6-lookup
220  *
221  * ipv6 multicast:
222  * ip6-lookup
223  *
224  * ipv6 multicast:
225  * interface-output
226  * @cliexend
227  *
228  * Example of how to disable unicast source checking on an interface:
229  * @cliexcmd{set urpf ip4 off GigabitEthernet2/0/0}
230  * @endparblock
231 ?*/
232 /* *INDENT-OFF* */
233 VLIB_CLI_COMMAND (set_interface_ip_source_check_command, static) = {
234  .path = "set urpf",
235  .function = urpf_cli_update,
236  .short_help = "set urpf [ip4|ip6] [rx|tx] [off|strict|loose] <INTERFACE>",
237 };
238 /* *INDENT-ON* */
239 
240 static clib_error_t *
242  unformat_input_t * input, vlib_cli_command_t * cmd)
243 {
244  unformat_input_t _line_input, *line_input = &_line_input;
245  clib_error_t *error = NULL;
246  fib_prefix_t fpfx;
247  ip_prefix_t pfx;
248  u32 table_id, is_add, fib_index;
249 
250  is_add = 1;
251  table_id = 0;
252 
253  /* Get a line of input. */
254  if (!unformat_user (input, unformat_line_input, line_input))
255  return 0;
256 
257  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
258  {
259  if (unformat (line_input, "table %d", &table_id))
260  ;
261  else if (unformat (line_input, "del"))
262  is_add = 0;
263  else if (unformat (line_input, "add"))
264  is_add = 1;
265  else if (unformat (line_input, "%U", unformat_ip_prefix, &pfx))
266  ;
267  else
268  {
269  error = unformat_parse_error (line_input);
270  goto done;
271  }
272  }
273 
274  ip_prefix_to_fib_prefix (&pfx, &fpfx);
275 
276  fib_index = fib_table_find (fpfx.fp_proto, table_id);
277 
278  if (~0 == fib_index)
279  {
280  error = clib_error_return (0, "Nonexistent table id %d", table_id);
281  goto done;
282  }
283 
284  if (is_add)
285  fib_table_entry_special_add (fib_index,
286  &fpfx,
288  else
290 
291 done:
292  unformat_free (line_input);
293 
294  return (error);
295 }
296 
297 /*?
298  * Add an exemption for a prefix to pass the Unicast Reverse Path
299  * Forwarding (uRPF) loose check. This is for testing purposes only.
300  * If the '<em>table</em>' is not enter it is defaulted to 0. Default
301  * is to '<em>add</em>'. VPP always performs a loose uRPF check for
302  * for-us traffic.
303  *
304  * @cliexpar
305  * Example of how to add a uRPF exception to a FIB table to pass the
306  * loose RPF tests:
307  * @cliexcmd{set urpf-accept table 7 10.0.0.0/8 add}
308 ?*/
309 /* *INDENT-OFF* */
310 VLIB_CLI_COMMAND (urpf_accept_command, static) = {
311  .path = "set urpf-accept",
312  .function = urpf_cli_accept,
313  .short_help = "urpf-accept [table <table-id>] [add|del] <PREFIX>",
314 };
315 /* *INDENT-ON* */
316 
317 /*
318  * fd.io coding-style-patch-verification: ON
319  *
320  * Local Variables:
321  * eval: (c-set-style "gnu")
322  * End:
323  */
static const char * urpf_feats[N_AF][VLIB_N_DIR][URPF_N_MODES]
Definition: urpf.c:33
fib_protocol_t fp_proto
protocol type
Definition: fib_types.h:212
uRPF bypass/exemption.
Definition: fib_source.h:124
void ip_prefix_to_fib_prefix(const ip_prefix_t *ip_prefix, fib_prefix_t *fib_prefix)
convert from a LISP to a FIB prefix
Definition: ip_types.c:395
a
Definition: bitmap.h:538
vnet_main_t * vnet_get_main(void)
Definition: misc.c:46
uword unformat_user(unformat_input_t *input, unformat_function_t *func,...)
Definition: unformat.c:989
vlib_main_t * vm
Definition: in2out_ed.c:1582
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
unformat_function_t unformat_vnet_sw_interface
unsigned char u8
Definition: types.h:56
static const char * urpf_feat_arcs[N_AF][VLIB_N_DIR]
Definition: urpf.c:21
vlib_rx_or_tx_t
Definition: defs.h:44
void fib_table_entry_special_remove(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source)
Remove a &#39;special&#39; entry from the FIB.
Definition: fib_table.c:424
Aggregate type for a prefix.
Definition: fib_types.h:203
#define clib_error_return(e, args...)
Definition: error.h:99
unsigned int u32
Definition: types.h:88
u32 fib_table_find(fib_protocol_t proto, u32 table_id)
Get the index of the FIB for a Table-ID.
Definition: fib_table.c:1097
unformat_function_t unformat_line_input
Definition: format.h:283
static urpf_mode_t * urpf_cfgs[N_AF][VLIB_N_DIR]
Per-af, per-direction, per-interface uRPF configs.
Definition: urpf.c:61
static clib_error_t * urpf_cli_update(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: urpf.c:127
static uword unformat_urpf_mode(unformat_input_t *input, va_list *args)
Definition: urpf.c:81
struct _unformat_input_t unformat_input_t
vl_api_tunnel_mode_t mode
Definition: gre.api:48
fib_node_index_t fib_table_entry_special_add(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source, fib_entry_flag_t flags)
Add a &#39;special&#39; entry to the FIB.
Definition: fib_table.c:405
uword unformat_ip_address_family(unformat_input_t *input, va_list *args)
Definition: ip.c:122
#define UNFORMAT_END_OF_INPUT
Definition: format.h:145
uword unformat_vlib_rx_tx(unformat_input_t *input, va_list *args)
Definition: format.c:134
Definition: fib_entry.h:115
u8 * format_urpf_mode(u8 *s, va_list *a)
Definition: urpf.c:64
#define VLIB_CLI_COMMAND(x,...)
Definition: cli.h:158
#define VLIB_N_DIR
Definition: defs.h:57
enum ip_address_family_t_ ip_address_family_t
#define unformat_parse_error(input)
Definition: format.h:269
#define N_AF
Definition: ip_types.h:29
Definition: defs.h:47
void urpf_update(urpf_mode_t mode, u32 sw_if_index, ip_address_family_t af, vlib_dir_t dir)
Definition: urpf.c:99
u64 uword
Definition: types.h:112
static void unformat_free(unformat_input_t *i)
Definition: format.h:163
static clib_error_t * urpf_cli_accept(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: urpf.c:241
u32 table_id
Definition: wireguard.api:100
u8 * format_unformat_error(u8 *s, va_list *va)
Definition: unformat.c:91
uword unformat_ip_prefix(unformat_input_t *input, va_list *args)
Definition: ip_types.c:64
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Definition: vec.h:556
vl_api_interface_index_t sw_if_index
Definition: wireguard.api:33
uword unformat(unformat_input_t *i, const char *fmt,...)
Definition: unformat.c:978
Definition: defs.h:46
enum urpf_mode_t_ urpf_mode_t
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:303
static uword unformat_check_input(unformat_input_t *i)
Definition: format.h:171
#define URPF_N_MODES
Definition: urpf.h:33