| #!/usr/bin/env python3 |
| |
| import unittest |
| |
| from framework import VppTestCase, VppTestRunner |
| |
| from scapy.packet import Raw |
| from scapy.layers.l2 import Ether |
| from scapy.layers.inet import IP, UDP, ICMP |
| from scapy.layers.inet6 import IPv6 |
| |
| from vpp_papi import VppEnum |
| |
| N_PKTS = 63 |
| |
| |
| class TestURPF(VppTestCase): |
| """Unicast Reverse Path Forwarding Test Case""" |
| |
| @classmethod |
| def setUpClass(cls): |
| super(TestURPF, cls).setUpClass() |
| |
| @classmethod |
| def tearDownClass(cls): |
| super(TestURPF, cls).tearDownClass() |
| |
| def setUp(self): |
| super(TestURPF, self).setUp() |
| |
| # create 4 pg interfaces so there are a few addresses |
| # in the FIB |
| self.create_pg_interfaces(range(4)) |
| |
| for i in self.pg_interfaces: |
| i.admin_up() |
| i.config_ip4() |
| i.resolve_arp() |
| i.config_ip6() |
| i.resolve_ndp() |
| |
| def tearDown(self): |
| for i in self.pg_interfaces: |
| i.unconfig_ip4() |
| i.unconfig_ip6() |
| i.admin_down() |
| super(TestURPF, self).tearDown() |
| |
| def test_urpf4(self): |
| """uRPF IP4""" |
| |
| e = VppEnum |
| p_spoof_loose = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IP(src="3.3.3.3", dst=self.pg1.remote_ip4) |
| / UDP(sport=1234, dport=1234) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| p_spoof_strict = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IP(src=self.pg2.remote_ip4, dst=self.pg1.remote_ip4) |
| / UDP(sport=1234, dport=1234) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| p_good = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) |
| / UDP(sport=1234, dport=1234) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| |
| # |
| # before adding the uRPF, ensure all packets are forwarded |
| # |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) |
| |
| # |
| # apply loose uRPF check on pg0 rx |
| # |
| self.vapi.urpf_update( |
| is_input=True, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, |
| af=e.vl_api_address_family_t.ADDRESS_IP4, |
| sw_if_index=self.pg0.sw_if_index, |
| ) |
| |
| # good packets still pass |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| # packets from address for which there is a route are forwarded |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| # packets from address to which there is no route are dropped |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip4-rx-urpf-loose/uRPF Drop", N_PKTS) |
| |
| # |
| # crank it up to strict mode |
| # |
| self.vapi.urpf_update( |
| is_input=True, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, |
| af=e.vl_api_address_family_t.ADDRESS_IP4, |
| sw_if_index=self.pg0.sw_if_index, |
| ) |
| |
| # good packets still pass |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| # packets that would not be routed back thru pg0 are dropped |
| self.send_and_assert_no_replies(self.pg0, p_spoof_strict) |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip4-rx-urpf-strict/uRPF Drop", 2 * N_PKTS) |
| |
| # |
| # disable uRPF, all traffic should pass |
| # |
| self.vapi.urpf_update( |
| is_input=True, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, |
| af=e.vl_api_address_family_t.ADDRESS_IP4, |
| sw_if_index=self.pg0.sw_if_index, |
| ) |
| |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) |
| |
| # |
| # Now apply in the TX direction |
| # for loose it is the same deal, they should not be forwarded |
| # if there's no route |
| # for strict they should not be forwarded if they would be |
| # forwarded thru that interface. |
| # |
| self.vapi.urpf_update( |
| is_input=False, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, |
| af=e.vl_api_address_family_t.ADDRESS_IP4, |
| sw_if_index=self.pg1.sw_if_index, |
| ) |
| |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip4-tx-urpf-loose/uRPF Drop", N_PKTS) |
| |
| self.vapi.urpf_update( |
| is_input=False, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, |
| af=e.vl_api_address_family_t.ADDRESS_IP4, |
| sw_if_index=self.pg1.sw_if_index, |
| ) |
| |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| # the strict packet, from a peer is allowed, since it does |
| # not forward via pg1 |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip4-tx-urpf-strict/uRPF Drop", N_PKTS) |
| |
| # change the strict packet so that it would forward through pg1 |
| p_spoof_strict = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IP(src=self.pg1.remote_ip4, dst=self.pg1.remote_ip4) |
| / UDP(sport=1234, dport=1234) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| |
| self.send_and_assert_no_replies(self.pg0, p_spoof_strict) |
| self.assert_error_counter_equal("/err/ip4-tx-urpf-strict/uRPF Drop", 2 * N_PKTS) |
| |
| # cleanup |
| self.vapi.urpf_update( |
| is_input=False, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, |
| af=e.vl_api_address_family_t.ADDRESS_IP4, |
| sw_if_index=self.pg1.sw_if_index, |
| ) |
| |
| def test_urpf6(self): |
| """uRPF IP6""" |
| |
| e = VppEnum |
| p_spoof_loose = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IPv6(src="3::3", dst=self.pg1.remote_ip6) |
| / UDP(sport=1236, dport=1236) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| p_spoof_strict = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IPv6(src=self.pg2.remote_ip6, dst=self.pg1.remote_ip6) |
| / UDP(sport=1236, dport=1236) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| p_good = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IPv6(src=self.pg0.remote_ip6, dst=self.pg1.remote_ip6) |
| / UDP(sport=1236, dport=1236) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| |
| # |
| # before adding the uRPF, ensure all packets are forwarded |
| # |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) |
| |
| # |
| # apply loose uRPF check on pg0 rx |
| # |
| self.vapi.urpf_update( |
| is_input=True, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, |
| af=e.vl_api_address_family_t.ADDRESS_IP6, |
| sw_if_index=self.pg0.sw_if_index, |
| ) |
| |
| # good packets still pass |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| # packets from address for which there is a route are forwarded |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| # packets from address to which there is no route are dropped |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip6-rx-urpf-loose/uRPF Drop", N_PKTS) |
| |
| # |
| # crank it up to strict mode |
| # |
| self.vapi.urpf_update( |
| is_input=True, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, |
| af=e.vl_api_address_family_t.ADDRESS_IP6, |
| sw_if_index=self.pg0.sw_if_index, |
| ) |
| |
| # good packets still pass |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| # packets that would not be routed back thru pg0 are dropped |
| self.send_and_assert_no_replies(self.pg0, p_spoof_strict) |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip6-rx-urpf-strict/uRPF Drop", 2 * N_PKTS) |
| |
| # |
| # disable uRPF, all traffic should pass |
| # |
| self.vapi.urpf_update( |
| is_input=True, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, |
| af=e.vl_api_address_family_t.ADDRESS_IP6, |
| sw_if_index=self.pg0.sw_if_index, |
| ) |
| |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_loose, self.pg1) |
| |
| # |
| # Now apply in the TX direction |
| # for loose it is the same deal, they should not be forwarded |
| # if there's no route |
| # for strict they should not be forwarded if they would be |
| # forwarded thru that interface. |
| # |
| self.vapi.urpf_update( |
| is_input=False, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_LOOSE, |
| af=e.vl_api_address_family_t.ADDRESS_IP6, |
| sw_if_index=self.pg1.sw_if_index, |
| ) |
| |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip6-tx-urpf-loose/uRPF Drop", N_PKTS) |
| |
| self.vapi.urpf_update( |
| is_input=False, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_STRICT, |
| af=e.vl_api_address_family_t.ADDRESS_IP6, |
| sw_if_index=self.pg1.sw_if_index, |
| ) |
| |
| self.send_and_expect(self.pg0, p_good, self.pg1) |
| # the strict packet, from a peer is allowed, since it does |
| # not forward via pg1 |
| self.send_and_expect(self.pg0, p_spoof_strict, self.pg1) |
| self.send_and_assert_no_replies(self.pg0, p_spoof_loose) |
| |
| self.assert_error_counter_equal("/err/ip6-tx-urpf-strict/uRPF Drop", N_PKTS) |
| |
| # change the strict packet so that it would forward through pg1 |
| p_spoof_strict = ( |
| Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) |
| / IPv6(src=self.pg1.remote_ip6, dst=self.pg1.remote_ip6) |
| / UDP(sport=1236, dport=1236) |
| / Raw(b"\xa5" * 100) |
| ) * N_PKTS |
| |
| self.send_and_assert_no_replies(self.pg0, p_spoof_strict) |
| self.assert_error_counter_equal("/err/ip6-tx-urpf-strict/uRPF Drop", 2 * N_PKTS) |
| |
| # cleanup |
| self.vapi.urpf_update( |
| is_input=False, |
| mode=e.vl_api_urpf_mode_t.URPF_API_MODE_OFF, |
| af=e.vl_api_address_family_t.ADDRESS_IP6, |
| sw_if_index=self.pg1.sw_if_index, |
| ) |
| |
| |
| if __name__ == "__main__": |
| unittest.main(testRunner=VppTestRunner) |