[vpp] add plugins for CoPP dataplane enforcement

docker-syncd-vpp/conf/startup.conf.tmpl

@@ -243,6 +243,8 @@ plugins {
 	plugin ip_validate_plugin.so { enable }
 	plugin sflow_plugin.so { enable }
 	plugin sonic_ext_plugin.so { enable }
+	plugin policer_plugin.so { enable }
+	plugin copp_punt_policer_plugin.so { enable }
 
 	## Enable all plugins by default and then selectively disable specific plugins
 	# plugin dpdk_plugin.so { disable }

rules/vpp.mk

@@ -7,7 +7,7 @@ VPP_VERSION_BASE = 2606
 # https://packages.buildkite.com/sonic-vpp/vpp; if the suffix isn't bumped,
 # downstream sonic-buildimage builds will silently pull stale debs that
 # pre-date the new patch series and end up with VPP/SAI CRC drift.
-VPP_VERSION = $(VPP_VERSION_BASE)-0.6
+VPP_VERSION = $(VPP_VERSION_BASE)-0.7
 VPP_VERSION_SONIC = $(VPP_VERSION)+b1sonic1
 VPP_SRC_PATH = platform/vpp/vppbld
 

vppbld/plugins/copp_ip2me_policer/CMakeLists.txt

@@ -0,0 +1,21 @@
+# Copyright (c) 2026 SONiC-VPP contributors
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_vpp_plugin(copp_ip2me_policer
+  SOURCES
+  copp_ip2me_policer.c
+  copp_ip2me_policer_node.c
+
+  API_FILES
+  copp_ip2me_policer.api
+)

vppbld/plugins/copp_ip2me_policer/FEATURE.yaml

@@ -0,0 +1,26 @@
+---
+name: CoPP IP2ME Policer
+maintainer: SONiC-VPP contributors
+features:
+  - Applies rate policing to IP2ME/SNMP/SSH traffic (destined to one of
+    the router's own IPv4 addresses that VPP's own dataplane does not
+    answer itself) on the ip4-punt feature arc, ahead of
+    ip4-punt-redirect. ip4-punt is only reached after ip4-lookup/
+    ip4-local have already decided a packet is host-bound, and is a
+    single global arc (not per-interface), so no per-interface or
+    per-router-interface binding bookkeeping is needed -- unlike VPP's
+    existing classify-based policer-classify feature, which only meters
+    traffic on whichever interfaces it has been explicitly bound to.
+  - Reuses VPP's existing policer objects and metering primitive
+    (vnet_police_packet()) -- no new token-bucket implementation.
+  - IPv4 addresses to track are added/removed via
+    copp_ip2me_policer_addr_add_del (API) or the "copp ip2me policer
+    addr" debug CLI; the shared policer is bound via
+    copp_ip2me_policer_bind (API) or "copp ip2me policer bind". The
+    feature is enabled once, globally, at plugin init -- no
+    per-interface enable step, ever.
+  - conform/exceed/violate packet counters are exposed via
+    copp_ip2me_policer_get_counters (API) or "show copp ip2me policer"
+    (CLI).
+description: "IP2ME/SNMP/SSH punt policing on ip4-punt, for SONiC/VPP CoPP"
+state: experimental

vppbld/plugins/copp_ip2me_policer/copp_ip2me_policer.api

@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2026 SONiC-VPP contributors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+option version = "1.0.0";
+
+/** \brief Add or remove one IPv4 address from the IP2ME set enforced on
+    the ip4-punt feature arc (device-agnostic -- addresses are checked
+    regardless of which interface the packet arrived on, since ip4-punt
+    only runs after routing has already decided the packet is destined
+    to one of the router's own addresses).
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param addr - the IPv4 address (network byte order) to add/remove
+    @param is_add - 1 to add, 0 to remove
+*/
+define copp_ip2me_policer_addr_add_del
+{
+  u32 client_index;
+  u32 context;
+  u32 addr;
+  bool is_add;
+};
+
+define copp_ip2me_policer_addr_add_del_reply
+{
+  u32 context;
+  i32 retval;
+};
+
+/** \brief Bind (or unbind) the shared IP2ME policer used to meter all
+    currently-registered IP2ME addresses (SSH/SNMP/IP2ME all map to the
+    same SAI ip2me trap and therefore the same policer).
+
+    @param policer_name - name of an existing VPP policer object
+           (created via policer_add), looked up once via policer_main's
+           policer_index_by_name hash
+    @param is_bind - 1 to bind, 0 to unbind
+*/
+define copp_ip2me_policer_bind
+{
+  u32 client_index;
+  u32 context;
+  string policer_name[64];
+  bool is_bind;
+};
+
+define copp_ip2me_policer_bind_reply
+{
+  u32 context;
+  i32 retval;
+};
+
+/** \brief Read back this plugin's own conform/exceed/violate packet
+    counters.
+*/
+define copp_ip2me_policer_get_counters
+{
+  u32 client_index;
+  u32 context;
+};
+
+define copp_ip2me_policer_get_counters_reply
+{
+  u32 context;
+  i32 retval;
+  u64 conform_packets;
+  u64 exceed_packets;
+  u64 violate_packets;
+};