| Beide kanten vorige revisieVorige revisieVolgende revisie | Vorige revisie |
| tmp:2021feb22 [2021/02/23 14:21] – [host 3 can ping host 1] ndsk | tmp:2021feb22 [2026/10/08 12:31] (huidige) – verwijderd blaauwgeers |
|---|
| ===== Floodlight ===== | |
| ==== Links ==== | |
| * [[https://osrg.github.io/ryu-book/en/html/openflow_protocol.html]] | |
| * [[https://osrg.github.io/ryu-book/en/html/rest_firewall.html#example-of-operation-of-a-single-tenant-ipv4]] | |
| |
| ==== pcap script ==== | |
| <code bash> | |
| sudo timeout 30s tcpdump -i lo -w /vagrant/T4-lo.pcap & | |
| sudo timeout 30s tcpdump -i s1-eth1 -w /vagrant/T4-eth1.pcap & | |
| sudo timeout 30s tcpdump -i s1-eth2 -w /vagrant/T4-eth2.pcap & | |
| sudo timeout 30s tcpdump -i s1-eth3 -w /vagrant/T4-eth3.pcap & | |
| </code> | |
| |
| ===== staticentrypusher ==== | |
| ==== clear all flows ==== | |
| <code bash>curl -X GET http://127.0.0.1:8080/wm/staticentrypusher/clear/all/json</code> | |
| |
| ==== push norm ==== | |
| <code bash>curl -X POST -d '{"switch":"00:00:00:00:00:00:00:01", "name":"flow-mod-1", "cookie":"0", "priority":"555", "in_port":"1","active":"true", "actions":"output=2"}' http://127.0.01:8080/wm/staticentrypusher/json</code> | |
| <code bash>curl -X POST -d '{"switch":"00:00:00:00:00:00:00:01", "name":"flow-mod-2", "cookie":"0", "priority":"555", "in_port":"2","active":"true", "actions":"output=1"}' http://127.0.01:8080/wm/staticentrypusher/json</code> | |
| |
| |
| ==== push modify flow ==== | |
| <code bash>curl -X POST -d '{"switch":"00:00:00:00:00:00:00:01","name":"flow-1arp","priority":"02501","in_port":"1","active":"true", "eth_type":"0x0890","eth_src":"00:00:00:00:00:01", "eth_dst":"ff:ff:ff:ff:ff:ff", "arp_tpa":"10.0.0.2", "actions":"set_field=arp_tpa->10.0.0.3,output=3"}' http://localhost:8080/wm/staticflowpusher/json | |
| </code> | |
| |
| ==== push modify flow ==== | |
| <code bash>curl -X POST -d '{"switch":"00:00:00:00:00:00:00:01","name":"flow-1arp","priority":"02501","in_port":"1","active":"true", "eth_type":"0x0890","eth_src":"00:00:00:00:00:01", "eth_dst":"ff:ff:ff:ff:ff:ff", "arp_tpa":"10.0.0.2", "actions":"set_field=arp_tpa->10.0.0.3,output=3"}' http://localhost:8080/wm/staticflowpusher/json | |
| </code> | |
| |
| ===== firewall ===== | |
| ==== list firewall ==== | |
| <code bash>curl -X GET http://127.0.0.1:8080/wm/firewall/rules/json</code> | |
| |
| ==== enable firewall ==== | |
| <code bash>curl -X PUT http://127.0.0.1:8080//wm/firewall/module/enable/json</code> | |
| |
| ==== disablefirewall ==== | |
| <code bash>curl -X PUT http://127.0.0.1:8080/wm/firewall/module/disable/json</code> | |
| |
| ==== status firewall ==== | |
| <code bash>curl -X GET http://127.0.0.1:8080/wm/firewall/module/status/json</code> | |
| |
| ==== add rule firewall ==== | |
| <code bash>curl -X POST -d '{"switch":"00:00:00:00:00:00:00:01", "name":"flow-mod-1", "cookie":"0", "priority":"555", "in_port":"1","active":"true", "actions":"output=2"}' http://127.0.01:8080/wm/staticentrypusher/json</code> | |
| |
| <code bash>curl -X POST -d '"switchid":"00:00:00:00:00:00:00:01", "src-inport":"<short>","src-mac":"xx:xx:xx:xx:xx:xx>", "dst-mac": "<xx:xx:xx:xx:xx:xx>","dl-type": "<ARP or IPv4>", "src-ip": "<A.B.C.D/M>", "dst-ip": "<A.B.C.D/M>", "nw-proto": "<TCP or UDP or ICMP>", "tp-src": "<short>", "tp-dst": "<short>","priority": "<int>", "action": "<ALLOW or DENY>"}' http://127.0.01:8080/wm/staticentrypusher/json</code> | |
| |
| <code Javascript> | |
| "switchid":"<xx:xx:xx:xx:xx:xx:xx:xx>", | |
| "src-inport":"<short>", | |
| "src-mac": "<xx:xx:xx:xx:xx:xx>", | |
| "dst-mac": "<xx:xx:xx:xx:xx:xx>", | |
| "dl-type": "<ARP or IPv4>", | |
| "src-ip": "<A.B.C.D/M>", | |
| "dst-ip": "<A.B.C.D/M>", | |
| "nw-proto": "<TCP or UDP or ICMP>", | |
| "tp-src": "<short>", | |
| "tp-dst": "<short>", | |
| "priority": "<int>", | |
| "action": "<ALLOW or DENY>" | |
| </code> | |
| |
| ===== Config ===== | |
| |
| ==== ARP ===== | |
| <code Javascript> | |
| curl -X POST -d '{ | |
| "switch_id":"00:00:00:00:00:00:00:01", | |
| "src-inport":"1", | |
| "src-mac": "00:00:00:00:00:01", | |
| "dl-type": "ARP", | |
| "priority": "400", | |
| "action": "ALLOW" | |
| }' http://127.0.01:8080/wm/firewall/rules/json | |
| </code> | |
| <code Javascript> | |
| curl -X POST -d '{ | |
| "switch_id":"00:00:00:00:00:00:00:01", | |
| "src-inport":"2", | |
| "src-mac": "00:00:00:00:00:02", | |
| "dl-type": "ARP", | |
| "priority": "400", | |
| "action": "ALLOW" | |
| }' http://127.0.01:8080/wm/firewall/rules/json | |
| </code> | |
| <code Javascript> | |
| curl -X POST -d '{ | |
| "switch_id":"00:00:00:00:00:00:00:01", | |
| "src-inport":"3", | |
| "src-mac": "00:00:00:00:00:03", | |
| "dl-type": "ARP", | |
| "priority": "400", | |
| "action": "ALLOW" | |
| }' http://127.0.01:8080/wm/firewall/rules/json | |
| </code> | |
| |
| ==== host 3 can SSH to host 1 ===== | |
| === AB === | |
| <code Javascript> | |
| "switchid":"00:00:00:00:00:00:00:01", | |
| "src-inport":"3", | |
| "src-mac": "00:00:00:00:00:03", | |
| "dst-mac": "00:00:00:00:00:01", | |
| "dl-type": "IPv4", | |
| "src-ip": "10.0.0.3/32", | |
| "dst-ip": "10.0.0.1/32", | |
| "nw-proto": "TCP", | |
| "tp-dst": "22", | |
| "priority": "300", | |
| "action": "ALLOW" | |
| </code> | |
| === BA === | |
| <code Javascript> | |
| "switchid":"00:00:00:00:00:00:00:01", | |
| "src-inport":"1", | |
| "src-mac": "00:00:00:00:00:01", | |
| "dst-mac": "00:00:00:00:00:03", | |
| "dl-type": "IPv4", | |
| "src-ip": "10.0.0.3/32", | |
| "dst-ip": "10.0.0.2/32", | |
| "nw-proto": "TCP", | |
| "tp-src": "22", | |
| "priority": "300", | |
| "action": "ALLOW" | |
| </code> | |
| ==== host 3 can ping host 1 ===== | |
| === AB === | |
| |
| curl -X POST -d '{ | |
| }' http://127.0.01:8080/wm/firewall/rules/json | |
| |
| |
| <code Javascript> | |
| curl -X POST -d '{ | |
| "switchid":"00:00:00:00:00:00:00:01", | |
| "src-inport":"1", | |
| "src-mac": "00:00:00:00:00:01", | |
| "dst-mac": "00:00:00:00:00:03", | |
| "dl-type": "IPv4", | |
| "src-ip": "10.0.0.1/32", | |
| "dst-ip": "10.0.0.3/32", | |
| "nw-proto": "ICMP", | |
| "priority": "300", | |
| "action": "ALLOW" | |
| }' http://127.0.01:8080/wm/firewall/rules/json | |
| </code> | |
| === BA === | |
| <code Javascript> | |
| curl -X POST -d '{ | |
| "switchid":"00:00:00:00:00:00:00:01", | |
| "src-inport":"3", | |
| "src-mac": "00:00:00:00:00:03", | |
| "dst-mac": "00:00:00:00:00:01", | |
| "dl-type": "IPv4", | |
| "src-ip": "10.0.0.1", | |
| "dst-ip": "10.0.0.3", | |
| "nw-proto": "ICMP", | |
| "priority": "300", | |
| "action": "ALLOW" | |
| }' http://127.0.01:8080/wm/firewall/rules/json | |
| </code> | |
| |
| ==== host 3 can perform HTTPS requests to host 2 ===== | |
| <code Javascript> | |
| "switchid":"00:00:00:00:00:00:00:01", | |
| "src-inport":"3", | |
| "src-mac": "00:00:00:00:00:01", | |
| "dst-mac": "00:00:00:00:00:02", | |
| "dl-type": "IPv4", | |
| "src-ip": "10.0.0.3", | |
| "dst-ip": "10.0.0.2", | |
| "nw-proto": "TCP", | |
| "tp-dst": "443", | |
| "priority": "300", | |
| "action": "ALLOW" | |
| </code> | |
| |
| ==== host 2 can send UDP traffic to host 3 ===== | |
| <code Javascript> | |
| "switchid":"00:00:00:00:00:00:00:01", | |
| "src-inport":"2", | |
| "src-mac": "00:00:00:00:00:01", | |
| "dst-mac": "00:00:00:00:00:03", | |
| "dl-type": "IPv4", | |
| "src-ip": "10.0.0.2", | |
| "dst-ip": "10.0.0.3", | |
| "nw-proto": "UDP", | |
| "priority": "300", | |
| "action": "ALLOW" | |
| </code> | |
| |
| |
