def egress_src_dest_pairs_policy(self):
policies = []
for src_dest_pair in self.nib.get_egress_src_dest_pairs():
(src_ip, dst_ip) = src_dest_pair
# Convert dst_ip to its real form. First find out what the egress switch actually is:
for ap in self.nib.alternate_paths():
if NetUtils.ip_in_network(dst_ip, ap["ithaca"]):
switch = "ithaca"
imaginary_net = ap["ithaca"]
elif NetUtils.ip_in_network(dst_ip, ap["nyc"]):
switch = "nyc"
imaginary_net = ap["nyc"]
real_net = self.nib.actual_net_for(switch)
dst_host = NetUtils.host_of_ip(dst_ip, imaginary_net)
new_dest_ip = NetUtils.ip_for_network(real_net, dst_host)
# If it's not in the ARP cache, it already has an ARP request on the way so ignore it for now.
if self.nib.learned_ip(new_dest_ip):
direct_net_port = self.nib.port_for_ip(new_dest_ip)
new_src_ip = self.nib.translate_alternate_net(src_ip)
output_actions = SetIP4Src(new_src_ip) >> SetIP4Dst(new_dest_ip) >> Send(direct_net_port)
policies.append(
Filter(SwitchEq(self.nib.switch_to_dpid(switch)) & Policies.is_ip_from_to(src_ip, dst_ip))
>> output_actions
)
return Union(policies)
def coscin_net_for(self, src_ip):
for side in [ "ithaca", "nyc" ]:
if NetUtils.ip_in_network(src_ip, self.actual_net_for(side)):
return self.actual_net_for(side)
for ap in self.alternate_paths():
if NetUtils.ip_in_network(src_ip, ap[side]):
return ap[side]
return None
def coscin_net_for(self, src_ip):
for side in ["ithaca", "nyc"]:
if NetUtils.ip_in_network(src_ip, self.actual_net_for(side)):
return self.actual_net_for(side)
for ap in self.alternate_paths():
if NetUtils.ip_in_network(src_ip, ap[side]):
return ap[side]
return None
def ip_in_coscin_network(self, dst_ip):
if NetUtils.ip_in_network(dst_ip, self.actual_net_for("ithaca")):
return True
if NetUtils.ip_in_network(dst_ip, self.actual_net_for("nyc")):
return True
for ap in self.alternate_paths():
if NetUtils.ip_in_network(dst_ip, ap["ithaca"]) or NetUtils.ip_in_network(dst_ip, ap["nyc"]):
return True
return False
def packet_in(self, dpid, port, payload):
p_eth = NetUtils.packet(payload, 'ethernet')
if p_eth.ethertype != 0x0806:
return
# Handle ARP requests.
p_arp = NetUtils.packet(payload, 'arp')
src_ip = p_arp.src_ip
dst_ip = p_arp.dst_ip
switch = self.nib.dpid_to_switch(dpid)
if p_arp.opcode == arp.ARP_REQUEST:
preferred_path = self.nib.get_preferred_path()
# If the request is for a host in the net we're already in, just broadcast it. The host
# itself will answer.
if NetUtils.ip_in_network(src_ip, self.nib.actual_net_for(switch)) and \
NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(switch)):
real_dest_ip = None
else: # It's an imaginary host on one of the alternate paths
real_dest_ip = self.nib.translate_alternate_net(dst_ip)
if real_dest_ip == None:
logging.info("Flooding ARP Request")
self.main_app.flood(switch, port, payload)
elif self.nib.learned_ip(real_dest_ip):
real_dest_mac = self.nib.mac_for_ip(real_dest_ip)
self.arp_reply(switch, port, p_eth.src, src_ip, real_dest_mac, dst_ip)
else:
# Send an ARP request to all ports, then just stay out of the way. If the host is up
# on an unlearned port, it'll send a response, and that'll trigger learning. Then
# when the NEXT ARP request for this address is received (it'll get retried a bunch of
# times in practice), the reply can be generated from the ARP cache.
# It doesn't matter so much where the ARP reply goes, because this switch will pick it up.
switch_net = self.nib.actual_net_for(switch)
# TODO: 250 will work as a host on subnets with a /24, but not any higher.
src_ip = NetUtils.ip_for_network(switch_net, 250)
self.main_app.send_arp_request(switch, src_ip, real_dest_ip)
# We don't do anything special to ARP replies, just forward them onto their destination
# unidirectionally
# TODO: Can't this be handled by L2Switch, since it's bound for a real Mac?
elif p_arp.opcode == arp.ARP_REPLY:
# We ignore the text of ARP replies bound for us. We just used them for learning the port.
if p_eth.dst == self.main_app.BOGUS_MAC:
pass
# The destination port was definitely learned because that's where the request originated
elif not self.nib.seen_mac(p_eth.dst):
logging.error("Ooops! ARP reply bound for a destination we don't know")
return
elif self.nib.switch_for_mac(p_eth.dst) != switch:
logging.error("Ooops! ARP reply is destined for a different network. Can't happen.")
return
else:
direct_net_port = self.nib.port_for_mac(p_eth.dst)
output_actions = [Output(Physical(direct_net_port))]
self.main_app.pkt_out(dpid, payload, output_actions)
def ip_in_coscin_network(self, dst_ip):
if NetUtils.ip_in_network(dst_ip, self.actual_net_for("ithaca")):
return True
if NetUtils.ip_in_network(dst_ip, self.actual_net_for("nyc")):
return True
for ap in self.alternate_paths():
if NetUtils.ip_in_network(dst_ip,
ap["ithaca"]) or NetUtils.ip_in_network(
dst_ip, ap["nyc"]):
return True
return False
def add_outgoing_dynamic_flow(self, msg):
dp = msg.datapath
switch = self.nib.switch_for_dp(dp)
ofproto = dp.ofproto
parser = dp.ofproto_parser
in_port = msg.match['in_port']
pkt = packet.Packet(msg.data)
eth = pkt.get_protocols(ethernet.ethernet)[0]
ip = pkt.get_protocols(ipv4.ipv4)[0]
src_ip = ip.src
dst_ip = ip.dst
actions = []
# We only add IP rewriting for Coscin packets. All non-coscin packets will get a flow rule, but no
# IP rewriting.
if self.nib.ip_rewriting() and self.nib.ip_in_coscin_network(dst_ip):
opposite_switch = self.nib.opposite_switch(switch)
# If this is bound for the "virtual" network on the other side, pick the path and rewrite
# the destination IP's
if NetUtils.ip_in_network(
dst_ip, self.nib.actual_net_for(opposite_switch)):
new_src_ip = self.nib.translate_ip(
src_ip, self.nib.preferred_net(switch))
actions.append(parser.OFPActionSetField(ipv4_src=new_src_ip))
new_dst_ip = self.nib.translate_ip(
dst_ip, self.nib.preferred_net(opposite_switch))
actions.append(parser.OFPActionSetField(ipv4_dst=new_dst_ip))
# If it's trying to communicate with the router on the same side (like ping), just let it
# through
elif NetUtils.ip_in_network(dst_ip,
self.nib.actual_net_for(switch)):
pass
else:
# If it's a direct route (e.g 56.100 -> 157.200), we only need to renumber the source.
# But we have to select the right imaginary net so the path is "straight"
new_src_ip = self.nib.translate_ip(
src_ip, self.nib.opposite_net_for(dst_ip))
actions.append(parser.OFPActionSetField(ipv4_src=new_src_ip))
# No matter what, our rule will always send the packet to the router
actions.append(
parser.OFPActionOutput(self.nib.router_port_for_switch(switch)))
# Only TCP and UDP packets are handled by installing rules in custom pipleine hash table.
# (But we had to compute the actios regardless because they'll be used in a Packet Out)
if ip.proto == in_proto.IPPROTO_TCP or ip.proto == in_proto.IPPROTO_UDP:
self.write_table_2_rule(switch, dp, ip, pkt, actions, "outgoing")
return actions
def opposite_net_for(self, src_ip):
for ap in self.alternate_paths():
for side in [ "ithaca", "nyc" ]:
opposite_side = self.opposite_switch(side)
if NetUtils.ip_in_network(src_ip, ap[opposite_side]):
return ap[side]
return None
def opposite_net_for(self, src_ip):
for ap in self.alternate_paths():
for side in ["ithaca", "nyc"]:
opposite_side = self.opposite_switch(side)
if NetUtils.ip_in_network(src_ip, ap[opposite_side]):
return ap[side]
return None
def add_outgoing_dynamic_flow(self, msg):
dp = msg.datapath
switch = self.nib.switch_for_dp(dp)
ofproto = dp.ofproto
parser = dp.ofproto_parser
in_port = msg.match['in_port']
pkt = packet.Packet(msg.data)
eth = pkt.get_protocols(ethernet.ethernet)[0]
ip = pkt.get_protocols(ipv4.ipv4)[0]
src_ip = ip.src
dst_ip = ip.dst
actions = [ ]
# We only add IP rewriting for Coscin packets. All non-coscin packets will get a flow rule, but no
# IP rewriting.
if self.nib.ip_rewriting() and self.nib.ip_in_coscin_network(dst_ip):
opposite_switch = self.nib.opposite_switch(switch)
# If this is bound for the "virtual" network on the other side, pick the path and rewrite
# the destination IP's
if NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(opposite_switch)):
new_src_ip = self.nib.translate_ip(src_ip, self.nib.preferred_net(switch))
actions.append( parser.OFPActionSetField( ipv4_src = new_src_ip ) )
new_dst_ip = self.nib.translate_ip(dst_ip, self.nib.preferred_net(opposite_switch))
actions.append( parser.OFPActionSetField( ipv4_dst = new_dst_ip ) )
# If it's trying to communicate with the router on the same side (like ping), just let it
# through
elif NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(switch)):
pass
else:
# If it's a direct route (e.g 56.100 -> 157.200), we only need to renumber the source.
# But we have to select the right imaginary net so the path is "straight"
new_src_ip = self.nib.translate_ip(src_ip, self.nib.opposite_net_for(dst_ip))
actions.append( parser.OFPActionSetField( ipv4_src = new_src_ip ) )
# No matter what, our rule will always send the packet to the router
actions.append(parser.OFPActionOutput(self.nib.router_port_for_switch(switch)))
# Only TCP and UDP packets are handled by installing rules in custom pipleine hash table.
# (But we had to compute the actios regardless because they'll be used in a Packet Out)
if ip.proto == in_proto.IPPROTO_TCP or ip.proto == in_proto.IPPROTO_UDP:
self.write_table_2_rule(switch, dp, ip, pkt, actions, "outgoing" )
return actions
def packet_in(self, dpid, port, payload):
p_eth = NetUtils.packet(payload, "ethernet")
if p_eth.ethertype != 0x0800:
return
p_ip = NetUtils.packet(payload, "ipv4")
src_ip = p_ip.src
dst_ip = p_ip.dst
switch = self.nib.dpid_to_switch(dpid)
# If we haven't seen this source, dest pair yet, add it, and the rule with it.
# Which list we put it in depends on whether we're at the ingress or egress switch
if self.nib.at_ingress_switch(switch, port):
# TODO: If this packet is bound for hosts outside the CoSciN network, in production just forward them,
# For now, just drop them.
if not self.nib.ip_in_coscin_network(dst_ip):
logging.info("Internet-bound packet dropped in this test network")
return
# It's possible that this is an intra-network packet even though the rule should 've been installed
# to handle such packets directly. send_along_direct_path will handle it below.
elif NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(switch)):
pass
elif not self.nib.seen_src_dest_pair_at_ingress(src_ip, dst_ip):
self.nib.add_ingress_src_dest_pair(src_ip, dst_ip)
self.nib.set_dirty()
elif self.nib.at_egress_switch(switch, port):
if not self.nib.seen_src_dest_pair_at_egress(src_ip, dst_ip):
self.nib.add_egress_src_dest_pair(src_ip, dst_ip)
self.nib.set_dirty()
# If we have seen it, the rule should've taken care of the next packets, but it might
# not be in effect yet so we handle it manually
opposite_switch = self.nib.opposite_switch(switch)
if NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(opposite_switch)):
self.send_along_preferred_path(switch, src_ip, dst_ip, payload)
elif self.nib.at_ingress_switch(switch, port):
if NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(switch)):
self.send_to_host_without_rewrite(switch, src_ip, dst_ip, payload)
else:
self.send_along_direct_path(switch, src_ip, dst_ip, payload)
elif self.nib.at_egress_switch(switch, port):
self.send_to_host(switch, src_ip, dst_ip, payload)
def src_dest_pair_not_learned(self, dest_net):
# Given a destination net, find all learned src, dest pairs that match it and return
# a clause that doesn't match any of them.
preds = []
for src_dest_pair in self.nib.get_egress_src_dest_pairs():
(src_ip, dst_ip) = src_dest_pair
if NetUtils.ip_in_network(dst_ip, dest_net):
preds.append(IP4SrcEq(src_ip) & IP4DstEq(dst_ip))
if not preds:
return true
else:
return Not(Or(preds))
def destination_not_known_host_on_net(self, host_ip, dest_net):
# Given an IP, find all src_dest pairs we've seen for this src, filter the dests down to
# those on the dest_net, and return a clause that doesn't match any of them
preds = []
for src_dest_pair in self.nib.get_ingress_src_dest_pairs():
(src_ip, dst_ip) = src_dest_pair
if src_ip == host_ip and NetUtils.ip_in_network(dst_ip, dest_net):
preds.append(IP4DstEq(dst_ip))
if not preds:
return true
else:
return Not(Or(preds))
def send_along_direct_path(self, switch, src_ip, dst_ip, payload):
opposite_switch = self.nib.opposite_switch(switch)
for ap in self.nib.alternate_paths():
if NetUtils.ip_in_network(dst_ip, ap[opposite_switch]):
src_net = ap[switch]
src_host = NetUtils.host_of_ip(src_ip, self.nib.actual_net_for(switch))
# Translate this to the direct path IP
new_src = NetUtils.ip_for_network(src_net, src_host)
output_actions = [SetIP4Src(new_src), Output(Physical(self.nib.router_port_for_switch(switch)))]
dpid = self.nib.switch_to_dpid(switch)
self.main_app.pkt_out(dpid, payload, output_actions)
def ingress_src_dest_pairs_policy(self):
policies = []
for src_dest_pair in self.nib.get_ingress_src_dest_pairs():
(src_ip, dst_ip) = src_dest_pair
switch = self.nib.switch_for_ip(src_ip)
dpid = self.nib.switch_to_dpid(switch)
port = self.nib.port_for_ip(src_ip)
src_host = NetUtils.host_of_ip(src_ip, self.nib.actual_net_for(switch))
# If this is going to the preferred network, write a rule choosing the
# correct route here.
opposite_switch = self.nib.opposite_switch(switch)
if NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(opposite_switch)):
# Get host from src_ip
src_pref_net = self.nib.preferred_net(switch)
new_src = NetUtils.ip_for_network(src_pref_net, src_host)
dest_host = NetUtils.host_of_ip(dst_ip, self.nib.actual_net_for(opposite_switch))
new_dest = NetUtils.ip_for_network(self.nib.preferred_net(opposite_switch), dest_host)
router_port = self.nib.router_port_for_switch(switch)
output_actions = SetIP4Src(new_src) >> SetIP4Dst(new_dest) >> Send(router_port)
policies.append(
Filter(Policies.at_switch_port(dpid, port) & Policies.is_ip_from_to(src_ip, dst_ip))
>> output_actions
)
else:
# It's a direct path. Find the path first.
for ap in self.nib.alternate_paths():
if NetUtils.ip_in_network(dst_ip, ap[opposite_switch]):
alternate_path = ap
new_src = NetUtils.ip_for_network(alternate_path[switch], src_host)
router_port = self.nib.router_port_for_switch(switch)
output_actions = SetIP4Src(new_src) >> Send(router_port)
policies.append(
Filter(Policies.at_switch_port(dpid, port) & Policies.is_ip_from_to(src_ip, dst_ip))
>> output_actions
)
return Union(policies)
def add_incoming_dynamic_flow(self, msg):
dp = msg.datapath
switch = self.nib.switch_for_dp(dp)
ofproto = dp.ofproto
parser = dp.ofproto_parser
pkt = packet.Packet(msg.data)
eth = pkt.get_protocols(ethernet.ethernet)[0]
ip = pkt.get_protocols(ipv4.ipv4)[0]
src_ip = ip.src
dst_ip = ip.dst
# If the destination IP is in the real network (ip_in_network returns true),
# then the other side of the network is not properly rewriting the destination.
# or the packet is coming from the non-Coscin Internet. Just leave those IP's alone (we assume
# there's nothing crazy like the source using a virtual address here.)
actions = []
if self.nib.ip_rewriting() and not NetUtils.ip_in_network(
dst_ip, self.nib.actual_net_for(switch)):
opposite_switch = self.nib.opposite_switch(switch)
# Check the source IP. It should be coming from the same path subnets as the detination. If it's not,
# it's some arbitrary Internet host trying to contact the imaginary net. Drop the packet like a hot potato.
new_src_ip = self.nib.translate_ip(
src_ip, self.nib.actual_net_for(opposite_switch))
if new_src_ip == None:
return []
actions.append(parser.OFPActionSetField(ipv4_src=new_src_ip))
# The destination IP is always on one of the imaginary nets, or else it wouldn't have been delivered
# to this switch at all.
new_dst_ip = self.nib.translate_ip(dst_ip,
self.nib.actual_net_for(switch))
actions.append(parser.OFPActionSetField(ipv4_dst=new_dst_ip))
# The destination mac in the packet is guaranteed OK because the router placed it there as a result
# of its ARP cache. However, that doesn't necessarily mean we have learned that port yet, so act like
# an L2 switch. But in that case, don't install the rule because we don't want to just flood the switch
# everytime it happens.
output_p = self.nib.port_for_mac(eth.dst)
if output_p == None:
output_p = ofproto.OFPP_FLOOD
actions.append(parser.OFPActionOutput(output_p))
if (ip.proto == in_proto.IPPROTO_TCP or ip.proto
== in_proto.IPPROTO_UDP) and output_p != ofproto.OFPP_FLOOD:
self.write_table_2_rule(switch, dp, ip, pkt, actions, "incoming")
return actions
def translate_alternate_net(self, dst_ip):
# First find out which side (ithaca or nyc) it's on
found_side = None
for ap in self.alternate_paths():
for side in ["ithaca", "nyc"]:
if NetUtils.ip_in_network(dst_ip, ap[side]):
found_side = side
imaginary_net = ap[side]
if side == None:
logging.error("Ooops. Got an ARP request for a net we don't know about. Oh well.")
return False
else:
host = NetUtils.host_of_ip(dst_ip, imaginary_net)
return NetUtils.ip_for_network(self.actual_net_for(found_side), host)
def add_incoming_dynamic_flow(self, msg):
dp = msg.datapath
switch = self.nib.switch_for_dp(dp)
ofproto = dp.ofproto
parser = dp.ofproto_parser
pkt = packet.Packet(msg.data)
eth = pkt.get_protocols(ethernet.ethernet)[0]
ip = pkt.get_protocols(ipv4.ipv4)[0]
src_ip = ip.src
dst_ip = ip.dst
# If the destination IP is in the real network (ip_in_network returns true),
# then the other side of the network is not properly rewriting the destination.
# or the packet is coming from the non-Coscin Internet. Just leave those IP's alone (we assume
# there's nothing crazy like the source using a virtual address here.)
actions = []
if self.nib.ip_rewriting() and not NetUtils.ip_in_network(dst_ip, self.nib.actual_net_for(switch)):
opposite_switch = self.nib.opposite_switch(switch)
# Check the source IP. It should be coming from the same path subnets as the detination. If it's not,
# it's some arbitrary Internet host trying to contact the imaginary net. Drop the packet like a hot potato.
new_src_ip = self.nib.translate_ip(src_ip, self.nib.actual_net_for(opposite_switch))
if new_src_ip == None:
return []
actions.append( parser.OFPActionSetField(ipv4_src=new_src_ip) )
# The destination IP is always on one of the imaginary nets, or else it wouldn't have been delivered
# to this switch at all.
new_dst_ip = self.nib.translate_ip(dst_ip, self.nib.actual_net_for(switch))
actions.append( parser.OFPActionSetField(ipv4_dst=new_dst_ip) )
# The destination mac in the packet is guaranteed OK because the router placed it there as a result
# of its ARP cache. However, that doesn't necessarily mean we have learned that port yet, so act like
# an L2 switch. But in that case, don't install the rule because we don't want to just flood the switch
# everytime it happens.
output_p = self.nib.port_for_mac(eth.dst)
if output_p == None:
output_p = ofproto.OFPP_FLOOD
actions.append(parser.OFPActionOutput(output_p))
if (ip.proto == in_proto.IPPROTO_TCP or ip.proto == in_proto.IPPROTO_UDP) and output_p != ofproto.OFPP_FLOOD:
self.write_table_2_rule(switch, dp, ip, pkt, actions, "incoming" )
return actions
def send_to_host(self, switch, src_ip, dst_ip, payload):
# Convert dst_ip to its real form. First find out what the egress switch actually is:
for ap in self.nib.alternate_paths():
if NetUtils.ip_in_network(dst_ip, ap[switch]):
imaginary_net = ap[switch]
real_net = self.nib.actual_net_for(switch)
dst_host = NetUtils.host_of_ip(dst_ip, imaginary_net)
new_dest_ip = NetUtils.ip_for_network(real_net, dst_host)
# If we don't know the port for this address (which might happen if the
# IP is on this network, but the host isn't up or doesn't exist) there's not
# much we can do with this packet. Send an ARP request and hope the
# original packet gets retransmitted (which is normally the case)
if not self.nib.learned_ip(new_dest_ip):
src_ip = NetUtils.ip_for_network(real_net, 250)
self.main_app.send_arp_request(switch, src_ip, new_dest_ip)
else:
direct_net_port = self.nib.port_for_ip(new_dest_ip)
# We also need to translate the alternately-numbered net to a real one. Otherwise the
# host (which only knows real networks) may not know what to do with it.
new_src_ip = self.nib.translate_alternate_net(src_ip)
output_actions = [SetIP4Src(new_src_ip), SetIP4Dst(new_dest_ip), Output(Physical(direct_net_port))]
dpid = self.nib.switch_to_dpid(switch)
self.main_app.pkt_out(dpid, payload, output_actions)
def subnet_for(self, ip):
for sn in self.subnets:
if NetUtils.ip_in_network(ip, sn.subnet_cidr):
return sn
return None
def subnet_for(self, ip):
for sn in self.subnets:
if NetUtils.ip_in_network(ip, sn.subnet_cidr):
return sn
return None