ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipv6 connection tracking plugin

Browse Source 
A security feature: drop unsolicited global unicast traffic.

Change-Id: I421da7d52e08b7acf40c62a1f6e2a6caac349e7e
Signed-off-by: Dave Barach <dave@barachs.net>
This commit is contained in:
Dave Barach
2019-03-06 11:14:03 -05:00
committed by Florin Coras
parent e275bed64d
commit a55df10817
9 changed files with 1706 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
src/plugins/ct6/CMakeLists.txt Normal file
View File

@@ -0,0 +1,35 @@
# Copyright (c) <current-year> <your-organization>
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
add_vpp_plugin(ct6
SOURCES
ct6.c
ct6_in2out.c
ct6_out2in.c
ct6.h
MULTIARCH_SOURCES
ct6_in2out.c
ct6_out2in.c
API_FILES
ct6.api
INSTALL_HEADERS
ct6_all_api_h.h
ct6_msg_enum.h
API_TEST_SOURCES
ct6_test.c
)

27
src/plugins/ct6/ct6.api Normal file
View File

@@ -0,0 +1,27 @@
/* Define a simple enable-disable binary API to control the feature */
define ct6_enable_disable {
/* Client identifier, set from api_main.my_client_index */
u32 client_index;
/* Arbitrary context, so client can match reply to request */
u32 context;
/* Enable / disable the feature */
u8 enable_disable;
/* Inside or outside interface */
u8 is_inside;
/* Interface handle */
u32 sw_if_index;
};
define ct6_enable_disable_reply {
/* From the request */
u32 context;
/* Return value, zero means all OK */
i32 retval;
};

573
src/plugins/ct6/ct6.c Normal file
View File

File diff suppressed because it is too large Load Diff

179
src/plugins/ct6/ct6.h Normal file
View File

@@ -0,0 +1,179 @@
/*
* ct6.h - skeleton vpp engine plug-in header file
*
* Copyright (c) <current-year> <your-organization>
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef __included_ct6_h__
#define __included_ct6_h__
#include <vnet/vnet.h>
#include <vnet/ip/ip.h>
#include <vnet/ethernet/ethernet.h>
#include <vppinfra/bihash_48_8.h>
#include <vppinfra/hash.h>
#include <vppinfra/error.h>
/* *INDENT-OFF* */
typedef CLIB_PACKED (struct
{
union
{
struct
{
/* out2in */
ip6_address_t src;
ip6_address_t dst;
u16 sport;
u16 dport;
u8 proto; /* byte 37 */
};
u64 as_u64[6];
};
}) ct6_session_key_t;
/* *INDENT-ON* */
typedef struct
{
ct6_session_key_t key;
u32 thread_index;
u32 next_index;
u32 prev_index;
u32 hits;
f64 expires;
} ct6_session_t;
typedef struct
{
/* API message ID base */
u16 msg_id_base;
/* session lookup table */
clib_bihash_48_8_t session_hash;
u8 feature_initialized;
/* per_thread session pools */
ct6_session_t **sessions;
u32 *first_index;
u32 *last_index;
/* Config parameters */
f64 session_timeout_interval;
uword session_hash_memory;
u32 session_hash_buckets;
u32 max_sessions_per_worker;
/* convenience */
vlib_main_t *vlib_main;
vnet_main_t *vnet_main;
ethernet_main_t *ethernet_main;
} ct6_main_t;
extern ct6_main_t ct6_main;
extern vlib_node_registration_t ct6_out2in_node;
extern vlib_node_registration_t ct6_in2out_node;
format_function_t format_ct6_session;
ct6_session_t *ct6_create_or_recycle_session (ct6_main_t * cmp,
clib_bihash_kv_48_8_t * kvpp,
f64 now, u32 my_thread_index,
u32 * recyclep, u32 * createp);
static inline void
ct6_lru_remove (ct6_main_t * cmp, ct6_session_t * s0)
{
ct6_session_t *next_sess, *prev_sess;
u32 thread_index;
u32 s0_index;
thread_index = s0->thread_index;
s0_index = s0 - cmp->sessions[thread_index];
/* Deal with list heads */
if (s0_index == cmp->first_index[thread_index])
cmp->first_index[thread_index] = s0->next_index;
if (s0_index == cmp->last_index[thread_index])
cmp->last_index[thread_index] = s0->prev_index;
/* Fix next->prev */
if (s0->next_index != ~0)
{
next_sess = pool_elt_at_index (cmp->sessions[thread_index],
s0->next_index);
next_sess->prev_index = s0->prev_index;
}
/* Fix prev->next */
if (s0->prev_index != ~0)
{
prev_sess = pool_elt_at_index (cmp->sessions[thread_index],
s0->prev_index);
prev_sess->next_index = s0->next_index;
}
}
static inline void
ct6_lru_add (ct6_main_t * cmp, ct6_session_t * s0, f64 now)
{
ct6_session_t *next_sess;
u32 thread_index;
u32 s0_index;
s0->hits++;
s0->expires = now + cmp->session_timeout_interval;
thread_index = s0->thread_index;
s0_index = s0 - cmp->sessions[thread_index];
/*
* Re-add at the head of the forward LRU list,
* tail of the reverse LRU list
*/
if (cmp->first_index[thread_index] != ~0)
{
next_sess = pool_elt_at_index (cmp->sessions[thread_index],
cmp->first_index[thread_index]);
next_sess->prev_index = s0_index;
}
s0->prev_index = ~0;
/* s0 now the new head of the LRU forward list */
s0->next_index = cmp->first_index[thread_index];
cmp->first_index[thread_index] = s0_index;
/* single session case: also the tail of the reverse LRU list */
if (cmp->last_index[thread_index] == ~0)
cmp->last_index[thread_index] = s0_index;
}
static inline void
ct6_update_session_hit (ct6_main_t * cmp, ct6_session_t * s0, f64 now)
{
ct6_lru_remove (cmp, s0);
ct6_lru_add (cmp, s0, now);
}
#endif /* __included_ct6_h__ */
/*
* fd.io coding-style-patch-verification: ON
*
* Local Variables:
* eval: (c-set-style "gnu")
* End:
*/

19
src/plugins/ct6/ct6_all_api_h.h Normal file
View File

@@ -0,0 +1,19 @@
/*
* ct6_all_api_h.h - skeleton vpp engine plug-in api #include file
*
* Copyright (c) <current-year> <your-organization>
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* Include the generated file, see BUILT_SOURCES in Makefile.am */
#include <ct6/ct6.api.h>

362
src/plugins/ct6/ct6_in2out.c Normal file
View File

File diff suppressed because it is too large Load Diff

31
src/plugins/ct6/ct6_msg_enum.h Normal file
View File

@@ -0,0 +1,31 @@
/*
* ct6_msg_enum.h - skeleton vpp engine plug-in message enumeration
*
* Copyright (c) <current-year> <your-organization>
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef included_ct6_msg_enum_h
#define included_ct6_msg_enum_h
#include <vppinfra/byte_order.h>
#define vl_msg_id(n,h) n,
typedef enum {
#include <ct6/ct6_all_api_h.h>
/* We'll want to know how many messages IDs we need... */
VL_MSG_FIRST_AVAILABLE,
} vl_msg_id_t;
#undef vl_msg_id
#endif /* included_ct6_msg_enum_h */

278
src/plugins/ct6/ct6_out2in.c Normal file
View File

@@ -0,0 +1,278 @@
/*
* ct6_out2in.c - ip6 connection tracker, inside-to-outside path
*
* Copyright (c) 2019 Cisco and/or its affiliates.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <vlib/vlib.h>
#include <vnet/vnet.h>
#include <vnet/pg/pg.h>
#include <vppinfra/error.h>
#include <ct6/ct6.h>
typedef struct
{
u32 sw_if_index;
u32 next_index;
u32 session_index;
} ct6_out2in_trace_t;
#ifndef CLIB_MARCH_VARIANT
/* packet trace format function */
static u8 *
format_ct6_out2in_trace (u8 * s, va_list * args)
{
CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
ct6_out2in_trace_t *t = va_arg (*args, ct6_out2in_trace_t *);
s = format (s, "CT6_OUT2IN: sw_if_index %d, next index %d session %d\n",
t->sw_if_index, t->next_index, t->session_index);
return s;
}
vlib_node_registration_t ct6_out2in_node;
#endif /* CLIB_MARCH_VARIANT */
#define foreach_ct6_out2in_error \
_(PROCESSED, "ct6 packets processed") \
_(NO_SESSION, "ct6 no session drops")
typedef enum
{
#define _(sym,str) CT6_OUT2IN_ERROR_##sym,
foreach_ct6_out2in_error
#undef _
CT6_OUT2IN_N_ERROR,
} ct6_out2in_error_t;
#ifndef CLIB_MARCH_VARIANT
static char *ct6_out2in_error_strings[] = {
#define _(sym,string) string,
foreach_ct6_out2in_error
#undef _
};
#endif /* CLIB_MARCH_VARIANT */
typedef enum
{
CT6_OUT2IN_NEXT_DROP,
CT6_OUT2IN_N_NEXT,
} ct6_next_t;
always_inline uword
ct6_out2in_inline (vlib_main_t * vm,
vlib_node_runtime_t * node, vlib_frame_t * frame,
int is_trace)
{
u32 n_left_from, *from;
vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
u16 nexts[VLIB_FRAME_SIZE], *next;
ct6_main_t *cmp = &ct6_main;
u32 my_thread_index = vm->thread_index;
f64 now = vlib_time_now (vm);
u32 dropped = 0;
from = vlib_frame_vector_args (frame);
n_left_from = frame->n_vectors;
vlib_get_buffers (vm, from, bufs, n_left_from);
b = bufs;
next = nexts;
#if 0
while (n_left_from >= 4)
{
/* Prefetch next iteration. */
if (PREDICT_TRUE (n_left_from >= 8))
{
vlib_prefetch_buffer_header (b[4], STORE);
vlib_prefetch_buffer_header (b[5], STORE);
vlib_prefetch_buffer_header (b[6], STORE);
vlib_prefetch_buffer_header (b[7], STORE);
CLIB_PREFETCH (b[4]->data, CLIB_CACHE_LINE_BYTES, STORE);
CLIB_PREFETCH (b[5]->data, CLIB_CACHE_LINE_BYTES, STORE);
CLIB_PREFETCH (b[6]->data, CLIB_CACHE_LINE_BYTES, STORE);
CLIB_PREFETCH (b[7]->data, CLIB_CACHE_LINE_BYTES, STORE);
}
/* $$$$ process 4x pkts right here */
next[0] = 0;
next[1] = 0;
next[2] = 0;
next[3] = 0;
if (is_trace)
{
if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
{
ct6_trace_t *t = vlib_add_trace (vm, node, b[0], sizeof (*t));
t->next_index = next[0];
t->sw_if_index = vnet_buffer (b[0])->sw_if_index[VLIB_RX];
}
if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
{
ct6_trace_t *t = vlib_add_trace (vm, node, b[1], sizeof (*t));
t->next_index = next[1];
t->sw_if_index = vnet_buffer (b[1])->sw_if_index[VLIB_RX];
}
if (b[2]->flags & VLIB_BUFFER_IS_TRACED)
{
ct6_trace_t *t = vlib_add_trace (vm, node, b[2], sizeof (*t));
t->next_index = next[2];
t->sw_if_index = vnet_buffer (b[2])->sw_if_index[VLIB_RX];
}
if (b[3]->flags & VLIB_BUFFER_IS_TRACED)
{
ct6_trace_t *t = vlib_add_trace (vm, node, b[3], sizeof (*t));
t->next_index = next[3];
t->sw_if_index = vnet_buffer (b[3])->sw_if_index[VLIB_RX];
}
}
b += 4;
next += 4;
n_left_from -= 4;
}
#endif
while (n_left_from > 0)
{
clib_bihash_kv_48_8_t kvp0;
ct6_session_key_t *key0;
ct6_session_t *s0;
u32 session_index0 = ~0;
u32 next0;
ip6_header_t *ip0;
udp_header_t *udp0;
/* Are we having fun yet? */
vnet_feature_next (&next0, b[0]);
next[0] = next0;
ip0 = vlib_buffer_get_current (b[0]);
/*
* Pass non-global unicast traffic
*/
if (PREDICT_FALSE (!ip6_address_is_global_unicast (&ip0->src_address)
||
!ip6_address_is_global_unicast (&ip0->src_address)))
goto trace0;
/* Pass non-udp, non-tcp traffic */
if (PREDICT_FALSE (ip0->protocol != IP_PROTOCOL_TCP &&
ip0->protocol != IP_PROTOCOL_UDP))
goto trace0;
udp0 = ip6_next_header (ip0);
/*
* See if we know about this flow.
*/
key0 = (ct6_session_key_t *) & kvp0;
clib_memcpy_fast (&key0->src, &ip0->src_address,
sizeof (ip6_address_t));
clib_memcpy_fast (&key0->dst, &ip0->dst_address,
sizeof (ip6_address_t));
key0->as_u64[4] = 0;
key0->as_u64[5] = 0;
key0->sport = udp0->src_port;
key0->dport = udp0->dst_port;
key0->proto = ip0->protocol;
/* Do we know about this session? */
if (clib_bihash_search_48_8 (&cmp->session_hash, &kvp0, &kvp0) < 0)
{
/* Bad engineer, no donut for you... */
next[0] = CT6_OUT2IN_NEXT_DROP;
b[0]->error = node->errors[CT6_OUT2IN_ERROR_NO_SESSION];
dropped++;
goto trace0;
}
else
{
s0 = pool_elt_at_index (cmp->sessions[my_thread_index], kvp0.value);
session_index0 = kvp0.value;
ct6_update_session_hit (cmp, s0, now);
}
trace0:
if (is_trace)
{
if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
{
ct6_out2in_trace_t *t =
vlib_add_trace (vm, node, b[0], sizeof (*t));
t->next_index = next[0];
t->sw_if_index = vnet_buffer (b[0])->sw_if_index[VLIB_RX];
t->session_index = session_index0;
}
}
b += 1;
next += 1;
n_left_from -= 1;
}
vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
vlib_node_increment_counter (vm, node->node_index,
CT6_OUT2IN_ERROR_PROCESSED, frame->n_vectors);
vlib_node_increment_counter (vm, node->node_index,
CT6_OUT2IN_ERROR_NO_SESSION, dropped);
return frame->n_vectors;
}
VLIB_NODE_FN (ct6_out2in_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * frame)
{
if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
return ct6_out2in_inline (vm, node, frame, 1 /* is_trace */ );
else
return ct6_out2in_inline (vm, node, frame, 0 /* is_trace */ );
}
/* *INDENT-OFF* */
#ifndef CLIB_MARCH_VARIANT
VLIB_REGISTER_NODE (ct6_out2in_node) =
{
.name = "ct6-out2in",
.vector_size = sizeof (u32),
.format_trace = format_ct6_out2in_trace,
.type = VLIB_NODE_TYPE_INTERNAL,
.n_errors = ARRAY_LEN(ct6_out2in_error_strings),
.error_strings = ct6_out2in_error_strings,
.n_next_nodes = CT6_OUT2IN_N_NEXT,
/* edit / add dispositions here */
.next_nodes = {
[CT6_OUT2IN_NEXT_DROP] = "error-drop",
},
};
#endif /* CLIB_MARCH_VARIANT */
/* *INDENT-ON* */
/*
* fd.io coding-style-patch-verification: ON
*
* Local Variables:
* eval: (c-set-style "gnu")
* End:
*/

202
src/plugins/ct6/ct6_test.c Normal file
View File

@@ -0,0 +1,202 @@
/*
* ct6.c - skeleton vpp-api-test plug-in
*
* Copyright (c) <current-year> <your-organization>
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <vat/vat.h>
#include <vlibapi/api.h>
#include <vlibmemory/api.h>
#include <vppinfra/error.h>
uword unformat_sw_if_index (unformat_input_t * input, va_list * args);
/* Declare message IDs */
#include <ct6/ct6_msg_enum.h>
/* define message structures */
#define vl_typedefs
#include <ct6/ct6_all_api_h.h>
#undef vl_typedefs
/* declare message handlers for each api */
#define vl_endianfun /* define message structures */
#include <ct6/ct6_all_api_h.h>
#undef vl_endianfun
/* instantiate all the print functions we know about */
#define vl_print(handle, ...)
#define vl_printfun
#include <ct6/ct6_all_api_h.h>
#undef vl_printfun
/* Get the API version number. */
#define vl_api_version(n,v) static u32 api_version=(v);
#include <ct6/ct6_all_api_h.h>
#undef vl_api_version
typedef struct
{
/* API message ID base */
u16 msg_id_base;
vat_main_t *vat_main;
} ct6_test_main_t;
ct6_test_main_t ct6_test_main;
#define __plugin_msg_base ct6_test_main.msg_id_base
#include <vlibapi/vat_helper_macros.h>
#define foreach_standard_reply_retval_handler \
_(ct6_enable_disable_reply)
#define _(n) \
static void vl_api_##n##_t_handler \
(vl_api_##n##_t * mp) \
{ \
vat_main_t * vam = ct6_test_main.vat_main; \
i32 retval = ntohl(mp->retval); \
if (vam->async_mode) { \
vam->async_errors += (retval < 0); \
} else { \
vam->retval = retval; \
vam->result_ready = 1; \
} \
}
foreach_standard_reply_retval_handler;
#undef _
/*
* Table of message reply handlers, must include boilerplate handlers
* we just generated
*/
#define foreach_vpe_api_reply_msg \
_(CT6_ENABLE_DISABLE_REPLY, ct6_enable_disable_reply)
static int
api_ct6_enable_disable (vat_main_t * vam)
{
unformat_input_t *i = vam->input;
int enable_disable = 1;
u32 sw_if_index = ~0;
vl_api_ct6_enable_disable_t *mp;
u32 inside = ~0;
int ret;
/* Parse args required to build the message */
while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT)
{
if (unformat (i, "%U", unformat_sw_if_index, vam, &sw_if_index))
;
else if (unformat (i, "sw_if_index %d", &sw_if_index))
;
else if (unformat (i, "disable"))
enable_disable = 0;
else if (unformat (i, "inside") || unformat (i, "in"))
inside = 1;
else if (unformat (i, "outside") || unformat (i, "out"))
inside = 0;
else
break;
}
if (inside == ~0)
{
errmsg ("must specify inside or outside");
return -99;
}
if (sw_if_index == ~0)
{
errmsg ("missing interface name / explicit sw_if_index number \n");
return -99;
}
/* Construct the API message */
M (CT6_ENABLE_DISABLE, mp);
mp->sw_if_index = ntohl (sw_if_index);
mp->enable_disable = enable_disable;
mp->is_inside = (u8) inside;
/* send it... */
S (mp);
/* Wait for a reply... */
W (ret);
return ret;
}
/*
* List of messages that the api test plugin sends,
* and that the data plane plugin processes
*/
#define foreach_vpe_api_msg \
_(ct6_enable_disable, "<intfc> [disable]")
static void
ct6_api_hookup (vat_main_t * vam)
{
ct6_test_main_t *ctmp = &ct6_test_main;
/* Hook up handlers for replies from the data plane plug-in */
#define _(N,n) \
vl_msg_api_set_handlers((VL_API_##N + ctmp->msg_id_base), \
#n, \
vl_api_##n##_t_handler, \
vl_noop_handler, \
vl_api_##n##_t_endian, \
vl_api_##n##_t_print, \
sizeof(vl_api_##n##_t), 1);
foreach_vpe_api_reply_msg;
#undef _
/* API messages we can send */
#define _(n,h) hash_set_mem (vam->function_by_name, #n, api_##n);
foreach_vpe_api_msg;
#undef _
/* Help strings */
#define _(n,h) hash_set_mem (vam->help_by_name, #n, h);
foreach_vpe_api_msg;
#undef _
}
clib_error_t *
vat_plugin_register (vat_main_t * vam)
{
ct6_test_main_t *ctmp = &ct6_test_main;
u8 *name;
ctmp->vat_main = vam;
/* Ask the vpp engine for the first assigned message-id */
name = format (0, "ct6_%08x%c", api_version, 0);
ctmp->msg_id_base = vl_client_get_first_plugin_msg_id ((char *) name);
if (ctmp->msg_id_base != (u16) ~ 0)
ct6_api_hookup (vam);
vec_free (name);
return 0;
}
/*
* fd.io coding-style-patch-verification: ON
*
* Local Variables:
* eval: (c-set-style "gnu")
* End:
*/