Fix Vxlan code + small additions

net/src/headers.rs

@@ -319,6 +319,11 @@ impl Headers {
         Headers::default()
     }
 
+    /// Add / Replace Ethernet header
+    pub fn set_eth(&mut self, eth: Eth) {
+        self.eth = Some(eth);
+    }
+
     /// Push a VLAN header to the top of the stack.
     ///
     /// # Errors:

net/src/ipv4/dscp.rs

@@ -35,7 +35,7 @@ impl Dscp {
     ///
     /// Will return an [`InvalidDscpError`] if the supplied value for `raw` exceeds 6-bits.
     #[allow(dead_code)]
-    fn new(raw: u8) -> Result<Dscp, InvalidDscpError> {
+    pub fn new(raw: u8) -> Result<Dscp, InvalidDscpError> {
         Ok(Dscp(
             IpDscp::try_new(raw).map_err(|e| InvalidDscpError::TooBig(e.actual))?,
         ))

net/src/ipv4/mod.rs

@@ -36,6 +36,16 @@ pub use contract::*;
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct Ipv4(Ipv4Header);
 
+/// Error describing illegal length in an IPv4 header
+#[derive(Debug, thiserror::Error)]
+#[error(
+    "Invalid IPv4 length requested: {requested}, max is {max} when considering all options and headers"
+)]
+pub struct Ipv4LengthError {
+    requested: usize,
+    max: usize,
+}
+
 impl Ipv4 {
     /// The minimum length of an IPv4 header (i.e., a header with no options)
     #[allow(clippy::unwrap_used)] // const-eval and trivially safe
@@ -191,6 +201,7 @@ impl Ipv4 {
             return Err(TtlAlreadyZero);
         }
         self.0.time_to_live -= 1;
+        self.update_checksum();
         Ok(())
     }
 
@@ -257,6 +268,42 @@ impl Ipv4 {
         self.0.protocol = next_header.0;
         self
     }
+
+    /// get the header checksum
+    #[must_use]
+    pub fn checksum(&self) -> u16 {
+        self.0.header_checksum
+    }
+
+    /// set the header checksum
+    pub fn set_checksum(&mut self, checksum: u16) -> &mut Self {
+        self.0.header_checksum = checksum;
+        self
+    }
+
+    /// update the header checksum
+    pub fn update_checksum(&mut self) -> &mut Self {
+        self.set_checksum(self.0.calc_header_checksum());
+        self
+    }
+
+    /// Set the length _of the payload_ of the ipv4 packet.
+    ///
+    /// This method will adjust the total length of the header to account for options and the length
+    /// of this header.
+    ///
+    /// This method _will not_ update the checksum of the header.
+    /// # Errors
+    ///    This method returns [`Ipv4LengthError`] if the value is too big
+    pub fn set_payload_len(&mut self, payload_len: u16) -> Result<(), Ipv4LengthError> {
+        match self.0.set_payload_len(payload_len as usize) {
+            Ok(()) => Ok(()),
+            Err(err) => Err(Ipv4LengthError {
+                requested: payload_len as usize + self.header_len(),
+                max: err.max_allowed,
+            }),
+        }
+    }
 }
 
 /// Error which is triggered when decrementing the TTL which is already zero.

net/src/packet/display.rs

@@ -4,15 +4,15 @@
 //! Display of Packets
 
 use crate::eth::Eth;
+use crate::headers::{Headers, Net, Transport};
 use crate::icmp4::Icmp4;
 use crate::icmp6::Icmp6;
 use crate::ipv4::Ipv4;
 use crate::ipv6::Ipv6;
 use crate::tcp::Tcp;
-use crate::udp::Udp;
+use crate::udp::{Udp, UdpEncap};
 
 use crate::buffer::PacketBufferMut;
-use crate::headers::{Headers, Net, Transport};
 use crate::packet::{BridgeDomain, DoneReason, InterfaceId, InvalidPacket, Packet, PacketMeta};
 use std::fmt::{Display, Formatter};
 
@@ -161,6 +161,14 @@ impl Display for Transport {
         }
     }
 }
+impl Display for UdpEncap {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "  ENCAP:")?;
+        match self {
+            UdpEncap::Vxlan(vxlan) => writeln!(f, "  vxlan, vni={}", vxlan.vni()),
+        }
+    }
+}
 
 /* ============= All headers ============ */
 impl Display for Headers {
@@ -175,6 +183,9 @@ impl Display for Headers {
         if let Some(transport) = &self.transport {
             write!(f, "{transport}")?;
         }
+        if let Some(udp_encap) = &self.udp_encap {
+            write!(f, "{udp_encap}")?;
+        }
         Ok(())
     }
 }

net/src/packet/hash.rs

@@ -3,9 +3,9 @@
 
 //! Module to compute packet hashes
 
-use crate::buffer::PacketBufferMut;
 use crate::headers::{Net, Transport, TryHeaders, TryIp, TryTransport};
 use crate::packet::Packet;
+use crate::{buffer::PacketBufferMut, headers::TryEth};
 use ahash::AHasher;
 use std::hash::{Hash, Hasher};
 
@@ -44,13 +44,39 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
         }
     }
 
+    /// Computes a hash over a `Packet` including Ethernet header, vlans if present and IP invariant fields
+    pub fn hash_l2_frame<H: Hasher>(&self, state: &mut H) {
+        // ethernet
+        if let Some(eth) = self.headers().try_eth() {
+            eth.source().hash(state);
+            eth.destination().hash(state);
+            eth.ether_type().hash(state);
+        }
+        // vlan tags - we don't include PCP/DEI
+        for tag in &self.headers.vlan {
+            tag.vid().hash(state);
+        }
+        // Ip and transport
+        self.hash_ip(state);
+    }
+
     #[allow(unused)]
     /// Uses the ip hash `Packet` method to provide a value in the range [first, last].
     pub fn packet_hash_ecmp(&self, first: u8, last: u8) -> u64 {
         let mut hasher = AHasher::default();
         self.hash_ip(&mut hasher);
         hasher.finish() % u64::from(last - first + 1) + u64::from(first)
     }
+
+    #[allow(unused)]
+    /// Uses the `hash_l2_frame` `Packet` method to provide a hash in the range [49152,65535] suitable
+    /// as UDP source port for vxlan-encapsulated packets, as recommended by RFC7348.
+    #[allow(clippy::cast_possible_truncation)]
+    pub fn packet_hash_vxlan(&self) -> u16 {
+        let mut hasher = AHasher::default();
+        self.hash_l2_frame(&mut hasher);
+        (hasher.finish() % (65535u64 - 49152 + 1) + 49152u64) as u16
+    }
 }
 
 #[cfg(test)]

net/src/packet/meta.rs

@@ -57,6 +57,8 @@ pub enum DoneReason {
     Filtered,             /* The packet was administratively filtered */
     Unhandled,            /* there exists no support to handle this type of packet */
     MissL2resolution,     /* adjacency failure: we don't know mac of some ip next-hop */
+    Malformed,            /* the packet does not conform / is malformed */
+    MissingEtherType,     /* can't determine ethertype to use */
     Delivered,            /* the packet buffer was delivered by the NF - e.g. for xmit */
 }
 

net/src/packet/mod.rs

@@ -11,21 +11,21 @@ mod meta;
 pub mod test_utils;
 
 use crate::buffer::{Headroom, PacketBufferMut, Prepend, Tailroom, TrimFromStart};
+use crate::eth::Eth;
 use crate::eth::EthError;
 use crate::headers::{
-    AbstractHeaders, AbstractHeadersMut, Headers, Net, TryHeaders, TryHeadersMut, TryIpMut,
-    TryUdpMut, TryVxlan,
+    AbstractHeaders, AbstractHeadersMut, Headers, Net, Transport, TryHeaders, TryHeadersMut,
+    TryIpMut, TryVxlan,
 };
 use crate::parse::{DeParse, Parse, ParseError};
 use crate::udp::Udp;
-use crate::vxlan::{Vxlan, VxlanEncap};
 
+use crate::vxlan::{Vxlan, VxlanEncap};
 #[allow(unused_imports)] // re-export
 pub use hash::*;
 #[allow(unused_imports)] // re-export
 pub use meta::*;
 use std::num::NonZero;
-use tracing::debug;
 
 mod utils;
 
@@ -61,7 +61,7 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
             }
         };
         mbuf.trim_from_start(consumed.get())
-            .unwrap_or_else(|_| unreachable!());
+            .unwrap_or_else(|e| unreachable!("{:?}", e));
         Ok(Packet {
             headers,
             payload: mbuf,
@@ -74,6 +74,11 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
         &self.payload
     }
 
+    /// Add / Replace Ethernet header
+    pub fn set_eth(&mut self, eth: Eth) {
+        self.headers.set_eth(eth);
+    }
+
     /// Get the length of the packet's payload
     ///
     /// # Note
@@ -133,10 +138,7 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
     /// ```
     pub fn vxlan_decap(&mut self) -> Option<Result<Vxlan, ParseError<EthError>>> {
         match self.headers.try_vxlan() {
-            None => {
-                debug!("attempted to remove VXLAN header from non-vxlan packet");
-                None
-            }
+            None => None,
             Some(vxlan) => {
                 match Headers::parse(self.payload.as_ref()) {
                     Ok((headers, consumed)) => {
@@ -161,7 +163,10 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
 
     /// Encapsulate the packet in the supplied [`Vxlan`] [`Headers`]
     ///
-    /// The supplied [`Headers`] will be validated to ensure they form a VXLAN header.
+    /// * The supplied [`Headers`] will be validated to ensure they form a VXLAN header.
+    /// * If the supplied headers describe an IPv4 encapsulation, then the IPv4 checksum will be
+    ///   updated.
+    /// * The IPv4 / IPv6 headers will be updated to correctly describe the length of the packet.
     ///
     /// # Errors
     ///
@@ -175,6 +180,7 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
     /// This is extremely unlikely in that the maximum mbuf length is far less than that, and we
     /// don't currently support multi-segment packets.
     pub fn vxlan_encap(&mut self, params: &VxlanEncap) -> Result<(), <Buf as Prepend>::Error> {
+        //compute room required
         let needed = self.headers.size().get();
         let buf = self.payload.prepend(needed)?;
         self.headers
@@ -187,9 +193,26 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
             u16::try_from(len).is_ok(),
             "encap would result in frame larger than 2^16 bytes"
         );
+
+        // compute UDP entropy source port for UDP header
+        let udp_src_port = self
+            .packet_hash_vxlan()
+            .try_into()
+            .unwrap_or_else(|_| unreachable!());
+
+        // build UDP header for Vxlan, setting ports, length and checksum.
+        let mut udp = Udp::new(udp_src_port, Vxlan::PORT);
+        udp.set_checksum(0); /* optional in ipv4 (must be zero if unused) */
+
         #[allow(clippy::cast_possible_truncation)] // checked
         let udp_len = NonZero::new(len as u16).unwrap_or_else(|| unreachable!());
+        #[allow(unsafe_code)] // sound usage due to length check
+        unsafe {
+            udp.set_length(udp_len);
+        }
+
         let mut headers = params.headers().clone();
+        headers.transport = Some(Transport::Udp(udp));
         match headers.try_ip_mut() {
             None => unreachable!(),
             Some(Net::Ipv6(ipv6)) => {
@@ -199,18 +222,13 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
                     ipv6.set_payload_length(udp_len.get());
                 }
             }
-            Some(Net::Ipv4(_)) => { /* nothing to do here */ }
-        }
-        match headers.try_udp_mut() {
-            None => {
-                unreachable!();
+            Some(Net::Ipv4(ipv4)) => {
+                ipv4.set_payload_len(udp_len.get())
+                    .unwrap_or_else(|e| unreachable!("{:?}", e));
+                ipv4.update_checksum();
             }
-            #[allow(unsafe_code)] // sound usage due to length check
-            Some(udp) => unsafe {
-                udp.set_length(udp_len);
-                udp.set_checksum(0);
-            },
         }
+        self.headers = headers;
         Ok(())
     }
 
@@ -311,4 +329,18 @@ impl<Buf: PacketBufferMut> Packet<Buf> {
     pub fn get_meta_mut(&mut self) -> &mut PacketMeta {
         &mut self.meta
     }
+
+    /// Wraps a packet in an `Option` depending on the metadata:
+    /// If [`Packet`] is to be dropped, returns `None`. Else, `Some`.
+    pub fn enforce(self) -> Option<Self> {
+        #[cfg(test)]
+        if self.meta.keep {
+            // ignore the request to drop and keep the packet instead.
+            return Some(self);
+        }
+        match self.get_done() {
+            Some(DoneReason::Delivered) | None => Some(self),
+            Some(_) => None,
+        }
+    }
 }