csit - Integration tests

Integration tests

Grokmirror user

about summary refs log tree commit diff stats

path: root/tests/suites/honeycomb/resources/vxlan_gpe.py

Age	Commit message (Expand)	Author	Files	Lines
2016-07-22	CSIT-219: Realocate resources for Honeycomb tests	Tibor Frank	1	-99/+0
2016-06-20	Modify tests for Honeycomb sub-interfaces	Tibor Frank	1	-3/+3
2016-06-08	Add Tests for Honeycomb VxLAN GPE support	Tibor Frank	1	-0/+99

>248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447

/*
 * Copyright (c) 2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
/**
 * @file NAT plugin global declarations
 */
#ifndef __included_nat_h__
#define __included_nat_h__

#include <vnet/vnet.h>
#include <vnet/ip/ip.h>
#include <vnet/ethernet/ethernet.h>
#include <vnet/ip/icmp46_packet.h>
#include <vnet/api_errno.h>
#include <vnet/fib/fib_source.h>
#include <vppinfra/elog.h>
#include <vppinfra/bihash_8_8.h>
#include <vppinfra/bihash_16_8.h>
#include <vppinfra/dlist.h>
#include <vppinfra/error.h>
#include <vlibapi/api.h>
#include <vlib/log.h>

/* default session timeouts */
#define SNAT_UDP_TIMEOUT 300
#define SNAT_TCP_TRANSITORY_TIMEOUT 240
#define SNAT_TCP_ESTABLISHED_TIMEOUT 7440
#define SNAT_ICMP_TIMEOUT 60

/* number of worker handoff frame queue elements */
#define NAT_FQ_NELTS 64

/* NAT buffer flags */
#define SNAT_FLAG_HAIRPINNING (1 << 0)

typedef struct
{
  u32 arc_next;
} nat_buffer_opaque_t;

typedef enum
{
  NAT_NEXT_DROP,
  NAT_NEXT_ICMP_ERROR,
  NAT_NEXT_IN2OUT_PRE,
  NAT_NEXT_OUT2IN_PRE,
  NAT_NEXT_IN2OUT_ED_FAST_PATH,
  NAT_NEXT_IN2OUT_ED_SLOW_PATH,
  NAT_NEXT_IN2OUT_ED_OUTPUT_SLOW_PATH,
  NAT_NEXT_OUT2IN_ED_FAST_PATH,
  NAT_NEXT_OUT2IN_ED_SLOW_PATH,
  NAT_N_NEXT,
} nat_next_t;

typedef struct
{
  u32 next_index;
} nat_pre_trace_t;

#define nat_buffer_opaque(b) \
  ((nat_buffer_opaque_t *)((vnet_buffer_opaque2_t *)b->opaque2)->__unused2)

/*
STATIC_ASSERT (sizeof (nat_buffer_opaque_t) <=
               STRUCT_SIZE_OF (vnet_buffer_opaque_t, unused),
               "Custom meta-data too large for vnet_buffer_opaque_t");

#define nat_buffer_opaque(b) \
  ((nat_buffer_opaque_t *)((u8 *)((b)->opaque) + \
    STRUCT_OFFSET_OF (vnet_buffer_opaque_t, unused)))*/

/* session key (4-tuple) */
typedef struct
{
  union
  {
    struct
    {
      ip4_address_t addr;
      u16 port;
      u16 protocol:3, fib_index:13;
    };
    u64 as_u64;
  };
} snat_session_key_t;

/* endpoint-dependent session key (6-tuple) */
typedef struct
{
  union
  {
    struct
    {
      ip4_address_t l_addr;
      ip4_address_t r_addr;
      u32 proto:8, fib_index:24;
      u16 l_port;
      u16 r_port;
    };
    u64 as_u64[2];
  };
} nat_ed_ses_key_t;

/* deterministic session outside key */
typedef struct
{
  union
  {
    struct
    {
      ip4_address_t ext_host_addr;
      u16 ext_host_port;
      u16 out_port;
    };
    u64 as_u64;
  };
} snat_det_out_key_t;

/* user (internal host) key */
typedef struct
{
  union
  {
    struct
    {
      ip4_address_t addr;
      u32 fib_index;
    };
    u64 as_u64;
  };
} snat_user_key_t;

typedef struct
{
  u32 sw_if_index;
  u32 next_index;
  u8 cached;
} nat44_reass_trace_t;

/* NAT API Configuration flags */
#define foreach_nat_config_flag \
  _(0x01, IS_TWICE_NAT)         \
  _(0x02, IS_SELF_TWICE_NAT)    \
  _(0x04, IS_OUT2IN_ONLY)       \
  _(0x08, IS_ADDR_ONLY)         \
  _(0x10, IS_OUTSIDE)           \
  _(0x20, IS_INSIDE)            \
  _(0x40, IS_STATIC)            \
  _(0x80, IS_EXT_HOST_VALID)    \

typedef enum nat_config_flags_t_
{
#define _(n,f) NAT_API_##f = n,
  foreach_nat_config_flag
#undef _
} nat_config_flags_t;

/* External address and port allocation modes */
#define foreach_nat_addr_and_port_alloc_alg \
  _(0, DEFAULT, "default")         \
  _(1, MAPE, "map-e")              \
  _(2, RANGE, "port-range")

typedef enum
{
#define _(v, N, s) NAT_ADDR_AND_PORT_ALLOC_ALG_##N = v,
  foreach_nat_addr_and_port_alloc_alg
#undef _
} nat_addr_and_port_alloc_alg_t;


/* Supported L4 protocols */
#define foreach_snat_protocol \
  _(UDP, 0, udp, "udp")       \
  _(TCP, 1, tcp, "tcp")       \
  _(ICMP, 2, icmp, "icmp")

typedef enum
{
#define _(N, i, n, s) SNAT_PROTOCOL_##N = i,
  foreach_snat_protocol
#undef _
} snat_protocol_t;


/* Session state */
#define foreach_snat_session_state          \
  _(0, UNKNOWN, "unknown")                 \
  _(1, UDP_ACTIVE, "udp-active")           \
  _(2, TCP_SYN_SENT, "tcp-syn-sent")       \
  _(3, TCP_ESTABLISHED, "tcp-established") \
  _(4, TCP_FIN_WAIT, "tcp-fin-wait")       \
  _(5, TCP_CLOSE_WAIT, "tcp-close-wait")   \
  _(6, TCP_CLOSING, "tcp-closing")         \
  _(7, TCP_LAST_ACK, "tcp-last-ack")       \
  _(8, TCP_CLOSED, "tcp-closed")           \
  _(9, ICMP_ACTIVE, "icmp-active")

typedef enum
{
#define _(v, N, s) SNAT_SESSION_##N = v,
  foreach_snat_session_state
#undef _
} snat_session_state_t;

#define foreach_nat_in2out_ed_error                     \
_(UNSUPPORTED_PROTOCOL, "unsupported protocol")         \
_(IN2OUT_PACKETS, "good in2out packets processed")      \
_(OUT_OF_PORTS, "out of ports")                         \
_(BAD_ICMP_TYPE, "unsupported ICMP type")               \
_(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded")   \
_(DROP_FRAGMENT, "drop fragment")                       \
_(MAX_REASS, "maximum reassemblies exceeded")           \
_(MAX_FRAG, "maximum fragments per reassembly exceeded")\
_(NON_SYN, "non-SYN packet try to create session")      \
_(TCP_PACKETS, "TCP packets")                           \
_(UDP_PACKETS, "UDP packets")                           \
_(ICMP_PACKETS, "ICMP packets")                         \
_(OTHER_PACKETS, "other protocol packets")              \
_(FRAGMENTS, "fragments")                               \
_(CACHED_FRAGMENTS, "cached fragments")                 \
_(PROCESSED_FRAGMENTS, "processed fragments")

typedef enum
{
#define _(sym,str) NAT_IN2OUT_ED_ERROR_##sym,
  foreach_nat_in2out_ed_error
#undef _
    NAT_IN2OUT_ED_N_ERROR,
} nat_in2out_ed_error_t;

#define foreach_nat_out2in_ed_error                     \
_(UNSUPPORTED_PROTOCOL, "unsupported protocol")         \
_(OUT2IN_PACKETS, "good out2in packets processed")      \
_(OUT_OF_PORTS, "out of ports")                         \
_(BAD_ICMP_TYPE, "unsupported ICMP type")               \
_(NO_TRANSLATION, "no translation")                     \
_(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded")   \
_(DROP_FRAGMENT, "drop fragment")                       \
_(MAX_REASS, "maximum reassemblies exceeded")           \
_(MAX_FRAG, "maximum fragments per reassembly exceeded")\
_(NON_SYN, "non-SYN packet try to create session")      \
_(TCP_PACKETS, "TCP packets")                           \
_(UDP_PACKETS, "UDP packets")                           \
_(ICMP_PACKETS, "ICMP packets")                         \
_(OTHER_PACKETS, "other protocol packets")              \
_(FRAGMENTS, "fragments")                               \
_(CACHED_FRAGMENTS, "cached fragments")                 \
_(PROCESSED_FRAGMENTS, "processed fragments")

typedef enum
{
#define _(sym,str) NAT_OUT2IN_ED_ERROR_##sym,
  foreach_nat_out2in_ed_error
#undef _
    NAT_OUT2IN_ED_N_ERROR,
} nat_out2in_ed_error_t;


/* Endpoint dependent TCP session state */
#define NAT44_SES_I2O_FIN 1
#define NAT44_SES_O2I_FIN 2
#define NAT44_SES_I2O_FIN_ACK 4
#define NAT44_SES_O2I_FIN_ACK 8
#define NAT44_SES_I2O_SYN 16
#define NAT44_SES_O2I_SYN 32
#define NAT44_SES_RST     64

/* Session flags */
#define SNAT_SESSION_FLAG_STATIC_MAPPING       1
#define SNAT_SESSION_FLAG_UNKNOWN_PROTO        2
#define SNAT_SESSION_FLAG_LOAD_BALANCING       4
#define SNAT_SESSION_FLAG_TWICE_NAT            8
#define SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT   16
#define SNAT_SESSION_FLAG_FWD_BYPASS           32
#define SNAT_SESSION_FLAG_AFFINITY             64
#define SNAT_SESSION_FLAG_OUTPUT_FEATURE       128

/* NAT interface flags */
#define NAT_INTERFACE_FLAG_IS_INSIDE 1
#define NAT_INTERFACE_FLAG_IS_OUTSIDE 2

/* Static mapping flags */
#define NAT_STATIC_MAPPING_FLAG_ADDR_ONLY    1
#define NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY  2
#define NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT 4
#define NAT_STATIC_MAPPING_FLAG_LB           8

/* *INDENT-OFF* */
typedef CLIB_PACKED(struct
{
  /* Outside network key */
  snat_session_key_t out2in;

  /* Inside network key */
  snat_session_key_t in2out;

  /* Flags */
  u32 flags;

  /* Per-user translations */
  u32 per_user_index;
  u32 per_user_list_head_index;

  /* Last heard timer */
  f64 last_heard;

  /* Last HA refresh */
  f64 ha_last_refreshed;

  /* Counters */
  u64 total_bytes;
  u32 total_pkts;

  /* External host address and port */
  ip4_address_t ext_host_addr;
  u16 ext_host_port;

  /* External host address and port after translation */
  ip4_address_t ext_host_nat_addr;
  u16 ext_host_nat_port;

  /* TCP session state */
  u8 state;
  u32 i2o_fin_seq;
  u32 o2i_fin_seq;

  /* user index */
  u32 user_index;
}) snat_session_t;
/* *INDENT-ON* */


typedef struct
{
  ip4_address_t addr;
  u32 fib_index;
  u32 sessions_per_user_list_head_index;
  u32 nsessions;
  u32 nstaticsessions;
} snat_user_t;

typedef struct
{
  ip4_address_t addr;
  u32 fib_index;
/* *INDENT-OFF* */
#define _(N, i, n, s) \
  u16 busy_##n##_ports; \
  u16 * busy_##n##_ports_per_thread; \
  uword * busy_##n##_port_bitmap;
  foreach_snat_protocol
#undef _
/* *INDENT-ON* */
} snat_address_t;

typedef struct
{
  u32 fib_index;
  u32 refcount;
} nat_outside_fib_t;

typedef struct
{
  /* Inside network port */
  u16 in_port;
  /* Outside network address and port */
  snat_det_out_key_t out;
  /* Session state */
  u8 state;
  /* Expire timeout */
  u32 expire;
} snat_det_session_t;

typedef struct
{
  /* inside IP address range */
  ip4_address_t in_addr;
  u8 in_plen;
  /* outside IP address range */
  ip4_address_t out_addr;
  u8 out_plen;
  /* inside IP addresses / outside IP addresses */
  u32 sharing_ratio;
  /* number of ports available to internal host */
  u16 ports_per_host;
  /* session counter */
  u32 ses_num;
  /* vector of sessions */
  snat_det_session_t *sessions;
} snat_det_map_t;

typedef struct
{
  /* backend IP address */
  ip4_address_t addr;
  /* backend port number */
  u16 port;
  /* probability of the backend to be randomly matched */
  u8 probability;
  u8 prefix;
  /* backend FIB table */
  u32 vrf_id;
  u32 fib_index;
} nat44_lb_addr_port_t;

typedef enum
{
  /* twice-nat disabled */
  TWICE_NAT_DISABLED,
  /* twice-nat enabled */
  TWICE_NAT,
  /* twice-nat only when src IP equals dst IP after translation */
  TWICE_NAT_SELF,
} twice_nat_type_t;

typedef enum
{
  /* no load-balancing */
  NO_LB_NAT,
  /* load-balancing */
  LB_NAT,
  /* load-balancing with affinity */
  AFFINITY_LB_NAT,
} lb_nat_type_t;

typedef struct
{
  /* local IP address */
  ip4_address_t local_addr;
  /* external IP address */
  ip4_address_t external_addr;
  /* local port */
  u16 local_port;
  /* external port */
  u16 external_port;
  /* is twice-nat */
  twice_nat_type_t twice_nat;
  /* local FIB table */
  u32 vrf_id;
  u32 fib_index;
  /* protocol */
  snat_protocol_t proto;
  /* 0 = disabled, otherwise client IP affinity sticky time in seconds */
  u32 affinity;
  /* worker threads used by backends/local host */
  u32 *workers;
  /* opaque string tag */
  u8 *tag;
  /* backends for load-balancing mode */
  nat44_lb_addr_port_t *locals;
  /* affinity per service lis */
  u32 affinity_per_service_list_head_index;
  /* flags */
  u32 flags;
} snat_static_mapping_t;

typedef struct
{
  u32 sw_if_index;
  u8 flags;
} snat_interface_t;

typedef struct
{
  ip4_address_t l_addr;
  u16 l_port;
  u16 e_port;
  u32 sw_if_index;
  u32 vrf_id;
  snat_protocol_t proto;
  u32 flags;
  int addr_only;
  int twice_nat;
  int is_add;
  int out2in_only;
  int identity_nat;
  u8 *tag;
} snat_static_map_resolve_t;

typedef struct
{
  /* Main lookup tables */
  clib_bihash_8_8_t out2in;
  clib_bihash_8_8_t in2out;

  /* Endpoint dependent sessions lookup tables */
  clib_bihash_16_8_t out2in_ed;
  clib_bihash_16_8_t in2out_ed;

  /* Find-a-user => src address lookup */
  clib_bihash_8_8_t user_hash;

  /* User pool */
  snat_user_t *users;

  /* Session pool */
  snat_session_t *sessions;

  /* Pool of doubly-linked list elements */
  dlist_elt_t *list_pool;

  /* NAT thread index */
  u32 snat_thread_index;

  /* real thread index */
  u32 thread_index;

  /* discovered minimum session timeout time */
  u64 min_session_timeout;
} snat_main_per_thread_data_t;

struct snat_main_s;

/* ICMP session match function */
typedef u32 (snat_icmp_match_function_t) (struct snat_main_s * sm,
					  vlib_node_runtime_t * node,
					  u32 thread_index,
					  vlib_buffer_t * b0,
					  ip4_header_t * ip0, u8 * p_proto,
					  snat_session_key_t * p_value,
					  u8 * p_dont_translate, void *d,
					  void *e);

/* Return worker thread index for given packet */
typedef u32 (snat_get_worker_in2out_function_t) (ip4_header_t * ip,
						 u32 rx_fib_index,
						 u8 is_output);

typedef u32 (snat_get_worker_out2in_function_t) (vlib_buffer_t * b,
						 ip4_header_t * ip,
						 u32 rx_fib_index,
						 u8 is_output);

/* NAT address and port allacotaion function */
typedef int (nat_alloc_out_addr_and_port_function_t) (snat_address_t *
						      addresses,
						      u32 fib_index,
						      u32 thread_index,
						      snat_session_key_t * k,
						      u16 port_per_thread,
						      u32 snat_thread_index);

typedef struct snat_main_s
{
  /* ICMP session match functions */
  snat_icmp_match_function_t *icmp_match_in2out_cb;
  snat_icmp_match_function_t *icmp_match_out2in_cb;

  /* Thread settings */
  u32 num_workers;
  u32 first_worker_index;
  u32 *workers;
  snat_get_worker_in2out_function_t *worker_in2out_cb;
  snat_get_worker_out2in_function_t *worker_out2in_cb;
  u16 port_per_thread;
  u32 num_snat_thread;

  /* Per thread data */
  snat_main_per_thread_data_t *per_thread_data;

  /* Find a static mapping by local */
  clib_bihash_8_8_t static_mapping_by_local;

  /* Find a static mapping by external */
  clib_bihash_8_8_t static_mapping_by_external;

  /* Static mapping pool */
  snat_static_mapping_t *static_mappings;

  /* Interface pool */
  snat_interface_t *interfaces;
  snat_interface_t *output_feature_interfaces;

  /* Vector of outside addresses */
  snat_address_t *addresses;
  /* Address and port allocation function */
  nat_alloc_out_addr_and_port_function_t *alloc_addr_and_port;
  /* Address and port allocation type */
  nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg;
  /* Port set parameters (MAP-E) */
  u8 psid_offset;
  u8 psid_length;
  u16 psid;
  /* Port range parameters */
  u16 start_port;
  u16 end_port;

  /* vector of outside fibs */
  nat_outside_fib_t *outside_fibs;

  /* Vector of twice NAT addresses for extenal hosts */
  snat_address_t *twice_nat_addresses;

  /* sw_if_indices whose intfc addresses should be auto-added */
  u32 *auto_add_sw_if_indices;
  u32 *auto_add_sw_if_indices_twice_nat;

  /* vector of interface address static mappings to resolve. */
  snat_static_map_resolve_t *to_resolve;

  /* Randomize port allocation order */
  u32 random_seed;

  /* Worker handoff frame-queue index */
  u32 fq_in2out_index;
  u32 fq_in2out_output_index;
  u32 fq_out2in_index;

  /* node indexes */
  u32 error_node_index;

  /* handoff fq nodes  */
  u32 handoff_out2in_index;
  u32 handoff_in2out_index;
  u32 handoff_in2out_output_index;

  /* respect feature arc nodes */
  u32 pre_out2in_node_index;
  u32 pre_in2out_node_index;

  u32 in2out_node_index;
  u32 in2out_output_node_index;
  u32 in2out_fast_node_index;
  u32 in2out_slowpath_node_index;
  u32 in2out_slowpath_output_node_index;
  u32 ed_in2out_node_index;
  u32 ed_in2out_slowpath_node_index;
  u32 out2in_node_index;
  u32 out2in_fast_node_index;
  u32 ed_out2in_node_index;
  u32 ed_out2in_slowpath_node_index;
  u32 det_in2out_node_index;
  u32 det_out2in_node_index;

  u32 hairpinning_node_index;
  u32 hairpin_dst_node_index;
  u32 hairpin_src_node_index;
  u32 ed_hairpinning_node_index;
  u32 ed_hairpin_dst_node_index;
  u32 ed_hairpin_src_node_index;


  /* Deterministic NAT mappings */
  snat_det_map_t *det_maps;

  /* If forwarding is enabled */
  u8 forwarding_enabled;

  /* Config parameters */
  u8 static_mapping_only;
  u8 static_mapping_connection_tracking;
  u8 deterministic;
  u8 out2in_dpo;
  u8 endpoint_dependent;
  u32 translation_buckets;
  u32 translation_memory_size;
  u32 max_translations;
  u32 user_buckets;
  u32 user_memory_size;
  u32 max_translations_per_user;
  u32 outside_vrf_id;
  u32 outside_fib_index;
  u32 inside_vrf_id;
  u32 inside_fib_index;

  /* values of various timeouts */
  u32 udp_timeout;
  u32 icmp_timeout;
  u32 tcp_transitory_timeout;
  u32 tcp_established_timeout;

  /* TCP MSS clamping */
  u16 mss_clamping;
  u16 mss_value_net;

  /* counters/gauges */
  vlib_simple_counter_main_t total_users;
  vlib_simple_counter_main_t total_sessions;

  /* API message ID base */
  u16 msg_id_base;

  /* log class */
  vlib_log_class_t log_class;
  /* logging level */
  u8 log_level;

  /* convenience */
  vlib_main_t *vlib_main;
  vnet_main_t *vnet_main;
  ip4_main_t *ip4_main;
  ip_lookup_main_t *ip4_lookup_main;
  api_main_t *api_main;
} snat_main_t;

typedef struct
{
  u32 thread_index;
  f64 now;
} nat44_is_idle_session_ctx_t;

typedef struct
{
  u32 cached_sw_if_index;
  u32 cached_ip4_address;
} snat_runtime_t;

extern snat_main_t snat_main;

// nat pre ed next_node feature classification
extern vlib_node_registration_t nat_default_node;
extern vlib_node_registration_t nat_pre_in2out_node;
extern vlib_node_registration_t nat_pre_out2in_node;

extern vlib_node_registration_t snat_in2out_node;
extern vlib_node_registration_t snat_in2out_output_node;
extern vlib_node_registration_t snat_out2in_node;
extern vlib_node_registration_t snat_in2out_fast_node;
extern vlib_node_registration_t snat_out2in_fast_node;
extern vlib_node_registration_t snat_in2out_worker_handoff_node;
extern vlib_node_registration_t snat_in2out_output_worker_handoff_node;
extern vlib_node_registration_t snat_out2in_worker_handoff_node;
extern vlib_node_registration_t snat_det_in2out_node;
extern vlib_node_registration_t snat_det_out2in_node;
extern vlib_node_registration_t snat_hairpin_dst_node;
extern vlib_node_registration_t snat_hairpin_src_node;
extern vlib_node_registration_t nat44_ed_in2out_node;
extern vlib_node_registration_t nat44_ed_in2out_output_node;
extern vlib_node_registration_t nat44_ed_out2in_node;
extern vlib_node_registration_t nat44_ed_hairpin_dst_node;
extern vlib_node_registration_t nat44_ed_hairpin_src_node;
extern vlib_node_registration_t nat44_ed_in2out_worker_handoff_node;
extern vlib_node_registration_t nat44_ed_in2out_output_worker_handoff_node;
extern vlib_node_registration_t nat44_ed_out2in_worker_handoff_node;

extern fib_source_t nat_fib_src_hi;
extern fib_source_t nat_fib_src_low;

/* format functions */
format_function_t format_snat_user;
format_function_t format_snat_static_mapping;
format_function_t format_snat_static_map_to_resolve;
format_function_t format_snat_session;
format_function_t format_det_map_ses;
format_function_t format_snat_key;
format_function_t format_static_mapping_key;
format_function_t format_snat_protocol;
format_function_t format_nat_addr_and_port_alloc_alg;
/* unformat functions */
unformat_function_t unformat_snat_protocol;

/** \brief Check if SNAT session is created from static mapping.
    @param s SNAT session
    @return 1 if SNAT session is created from static mapping otherwise 0
*/
#define snat_is_session_static(s) (s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING)

/** \brief Check if SNAT session for unknown protocol.
    @param s SNAT session
    @return 1 if SNAT session for unknown protocol otherwise 0
*/
#define snat_is_unk_proto_session(s) (s->flags & SNAT_SESSION_FLAG_UNKNOWN_PROTO)

/** \brief Check if NAT session is twice NAT.
    @param s NAT session
    @return 1 if NAT session is twice NAT
*/
#define is_twice_nat_session(s) (s->flags & SNAT_SESSION_FLAG_TWICE_NAT)

/** \brief Check if NAT session is load-balancing.
    @param s NAT session
    @return 1 if NAT session is load-balancing
*/
#define is_lb_session(s) (s->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)

/** \brief Check if NAT session is forwarding bypass.
    @param s NAT session
    @return 1 if NAT session is load-balancing
*/
#define is_fwd_bypass_session(s) (s->flags & SNAT_SESSION_FLAG_FWD_BYPASS)

/** \brief Check if NAT session is endpoint dependent.
    @param s NAT session
    @return 1 if NAT session is endpoint dependent
*/
#define is_ed_session(s) (s->flags & SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT)

/** \brief Check if NAT session has affinity record.
    @param s NAT session
    @return 1 if NAT session has affinity record
*/
#define is_affinity_sessions(s) (s->flags & SNAT_SESSION_FLAG_AFFINITY)

/** \brief Check if NAT interface is inside.
    @param i NAT interfce
    @return 1 if inside interface
*/
#define nat_interface_is_inside(i) i->flags & NAT_INTERFACE_FLAG_IS_INSIDE

/** \brief Check if NAT interface is outside.
    @param i NAT interfce
    @return 1 if outside interface
*/
#define nat_interface_is_outside(i) i->flags & NAT_INTERFACE_FLAG_IS_OUTSIDE

/** \brief Check if NAT44 endpoint-dependent TCP session is closed.
    @param s NAT session
    @return 1 if session is closed
*/
#define nat44_is_ses_closed(s) s->state == 0xf

/** \brief Check if NAT static mapping is address only (1:1NAT).
    @param sm NAT static mapping
    @return 1 if 1:1NAT, 0 if 1:1NAPT
*/
#define is_addr_only_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_ADDR_ONLY)

/** \brief Check if NAT static mapping match only out2in direction.
    @param sm NAT static mapping
    @return 1 if rule match only out2in direction
*/
#define is_out2in_only_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY)

/** \brief Check if NAT static mapping is identity NAT.
    @param sm NAT static mapping
    @return 1 if identity NAT
*/
#define is_identity_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT)

/** \brief Check if NAT static mapping is load-balancing.
    @param sm NAT static mapping
    @return 1 if load-balancing
*/
#define is_lb_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_LB)

/** \brief Check if client initiating TCP connection (received SYN from client)
    @param t TCP header
    @return 1 if client initiating TCP connection
*/
always_inline bool
tcp_flags_is_init (u8 f)
{
  return (f & TCP_FLAG_SYN) && !(f & TCP_FLAG_ACK);
}

/* logging */
#define nat_log_err(...) \
  vlib_log(VLIB_LOG_LEVEL_ERR, snat_main.log_class, __VA_ARGS__)
#define nat_log_warn(...) \
  vlib_log(VLIB_LOG_LEVEL_WARNING, snat_main.log_class, __VA_ARGS__)
#define nat_log_notice(...) \
  vlib_log(VLIB_LOG_LEVEL_NOTICE, snat_main.log_class, __VA_ARGS__)
#define nat_log_info(...) \
  vlib_log(VLIB_LOG_LEVEL_INFO, snat_main.log_class, __VA_ARGS__)
#define nat_log_debug(...)\
  vlib_log(VLIB_LOG_LEVEL_DEBUG, snat_main.log_class, __VA_ARGS__)

/* NAT API Logging Levels */
#define foreach_nat_log_level \
  _(0x00, LOG_NONE)           \
  _(0x01, LOG_ERROR)          \
  _(0x02, LOG_WARNING)        \
  _(0x03, LOG_NOTICE)         \
  _(0x04, LOG_INFO)           \
  _(0x05, LOG_DEBUG)

typedef enum nat_log_level_t_
{
#define _(n,f) SNAT_##f = n,
  foreach_nat_log_level
#undef _
} nat_log_level_t;

#define nat_elog(_level, _str)                    \
do                                                \
  {                                               \
    snat_main_t *sm = &snat_main;                 \
    if (PREDICT_FALSE (sm->log_level >= _level))  \
      {                                           \
        ELOG_TYPE_DECLARE (e) =                   \
          {                                       \
            .format = "nat-msg " _str,            \
            .format_args = "",                    \
          };                                      \
        ELOG_DATA (&sm->vlib_main->elog_main, e); \
      }                                           \
  } while (0);

#define nat_elog_addr(_level, _str, _addr)               \
do                                                       \
  {                                                      \
    if (PREDICT_FALSE (sm->log_level >= _level))         \
      {                                                  \
        ELOG_TYPE_DECLARE (e) =                          \
          {                                              \
            .format = "nat-msg " _str " %d.%d.%d.%d",    \
            .format_args = "i1i1i1i1",                   \
          };                                             \
        CLIB_PACKED(struct                               \
          {                                              \
            u8 oct1;                                     \
            u8 oct2;                                     \
            u8 oct3;                                     \
            u8 oct4;                                     \
          }) *ed;                                        \
        ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
        ed->oct4 = _addr >> 24;                          \
        ed->oct3 = _addr >> 16;                          \
        ed->oct2 = _addr >> 8;                           \
        ed->oct1 = _addr;                                \
    }                                                    \
  } while (0);

#define nat_elog_debug_handoff(_str, _tid, _fib, _src, _dst)                \
do                                                                          \
  {                                                                         \
  if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG))                      \
    {                                                                       \
      ELOG_TYPE_DECLARE (e) =                                               \
        {                                                                   \
          .format = "nat-msg " _str " ip src: %d.%d.%d.%d dst: %d.%d.%d.%d" \
                                    " tid from: %d to: %d fib: %d",         \
        .format_args = "i1i1i1i1i1i1i1i1i4i4i4",                            \
      };                                                                    \
      CLIB_PACKED(struct                                                    \
        {                                                                   \
          u8 src_oct1;                                                      \
          u8 src_oct2;                                                      \
          u8 src_oct3;                                                      \
          u8 src_oct4;                                                      \
          u8 dst_oct1;                                                      \
          u8 dst_oct2;                                                      \
          u8 dst_oct3;                                                      \
          u8 dst_oct4;                                                      \
          u32 ftid;                                                         \
          u32 ttid;                                                         \
          u32 fib;                                                          \
        }) *ed;                                                             \
      ed = ELOG_DATA (&vlib_global_main.elog_main, e);                      \
      ed->src_oct1 = _src >> 24;                                            \
      ed->src_oct2 = _src >> 16;                                            \
      ed->src_oct3 = _src >> 8;                                             \
      ed->src_oct4 = _src;                                                  \
      ed->dst_oct1 = _dst >> 24;                                            \
      ed->dst_oct2 = _dst >> 16;                                            \
      ed->dst_oct3 = _dst >> 8;                                             \
      ed->dst_oct4 = _dst;                                                  \
      ed->ftid = vlib_get_thread_index ();                                  \
      ed->ttid = _tid;                                                      \
      ed->fib = _fib;                                                       \
    }                                                                       \
  } while (0);

#define nat_elog_debug_handoff_v2(_str, _prt, _fib, _src, _dst)              \
do                                                                           \
  {                                                                          \
  if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG))                       \
    {                                                                        \
      ELOG_TYPE_DECLARE (e) =                                                \
        {                                                                    \
          .format = "nat-msg " _str " ip_src:%d.%d.%d.%d ip_dst:%d.%d.%d.%d" \
                                    " tid:%d prt:%d fib:%d",                 \
        .format_args = "i1i1i1i1i1i1i1i1i4i4i4",                             \
      };                                                                     \
      CLIB_PACKED(struct                                                     \
        {                                                                    \
          u8 src_oct1;                                                       \
          u8 src_oct2;                                                       \
          u8 src_oct3;                                                       \
          u8 src_oct4;                                                       \
          u8 dst_oct1;                                                       \
          u8 dst_oct2;                                                       \
          u8 dst_oct3;                                                       \
          u8 dst_oct4;                                                       \
          u32 tid;                                                           \
          u32 prt;                                                           \
          u32 fib;                                                           \
        }) *ed;                                                              \
      ed = ELOG_DATA (&vlib_global_main.elog_main, e);                       \
      ed->src_oct1 = _src >> 24;                                             \
      ed->src_oct2 = _src >> 16;                                             \
      ed->src_oct3 = _src >> 8;                                              \
      ed->src_oct4 = _src;                                                   \
      ed->dst_oct1 = _dst >> 24;                                             \
      ed->dst_oct2 = _dst >> 16;                                             \
      ed->dst_oct3 = _dst >> 8;                                              \
      ed->dst_oct4 = _dst;                                                   \
      ed->tid = vlib_get_thread_index ();                                    \
      ed->prt = _prt;                                                        \
      ed->fib = _fib;                                                        \
    }                                                                        \
  } while (0);

#define nat_elog_X1(_level, _fmt, _arg, _val1)         \
do                                                     \
  {                                                    \
    snat_main_t *sm = &snat_main;                      \
    if (PREDICT_FALSE (sm->log_level >= _level))       \
      {                                                \
        ELOG_TYPE_DECLARE (e) =                        \
          {                                            \
            .format = "nat-msg " _fmt,                 \
            .format_args = _arg,                       \
          };                                           \
        CLIB_PACKED(struct                             \
          {                                            \
            typeof (_val1) val1;                       \
          }) *ed;                                      \
        ed = ELOG_DATA (&sm->vlib_main->elog_main, e); \
        ed->val1 = _val1;                              \
      }                                                \
  } while (0);

#define nat_elog_notice(nat_elog_str) \
  nat_elog(SNAT_LOG_INFO, "[notice] " nat_elog_str)
#define nat_elog_warn(nat_elog_str) \
  nat_elog(SNAT_LOG_WARNING, "[warning] " nat_elog_str)
#define nat_elog_err(nat_elog_str) \
  nat_elog(SNAT_LOG_ERROR, "[error] " nat_elog_str)
#define nat_elog_debug(nat_elog_str) \
  nat_elog(SNAT_LOG_DEBUG, "[debug] " nat_elog_str)
#define nat_elog_info(nat_elog_str) \
  nat_elog(SNAT_LOG_INFO, "[info] " nat_elog_str)

#define nat_elog_notice_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
  nat_elog_X1(SNAT_LOG_NOTICE, "[notice] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
#define nat_elog_warn_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
  nat_elog_X1(SNAT_LOG_WARNING, "[warning] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
#define nat_elog_err_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
  nat_elog_X1(SNAT_LOG_ERROR, "[error] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
#define nat_elog_debug_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
  nat_elog_X1(SNAT_LOG_DEBUG, "[debug] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
#define nat_elog_info_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
  nat_elog_X1(SNAT_LOG_INFO, "[info] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)

/* ICMP session match functions */
u32 icmp_match_in2out_fast (snat_main_t * sm, vlib_node_runtime_t * node,
			    u32 thread_index, vlib_buffer_t * b0,
			    ip4_header_t * ip0, u8 * p_proto,
			    snat_session_key_t * p_value,
			    u8 * p_dont_translate, void *d, void *e);
u32 icmp_match_in2out_slow (snat_main_t * sm, vlib_node_runtime_t * node,
			    u32 thread_index, vlib_buffer_t * b0,
			    ip4_header_t * ip0, u8 * p_proto,
			    snat_session_key_t * p_value,
			    u8 * p_dont_translate, void *d, void *e);
u32 icmp_match_out2in_fast (snat_main_t * sm, vlib_node_runtime_t * node,
			    u32 thread_index, vlib_buffer_t * b0,
			    ip4_header_t * ip0, u8 * p_proto,
			    snat_session_key_t * p_value,
			    u8 * p_dont_translate, void *d, void *e);
u32 icmp_match_out2in_slow (snat_main_t * sm, vlib_node_runtime_t * node,
			    u32 thread_index, vlib_buffer_t * b0,
			    ip4_header_t * ip0, u8 * p_proto,
			    snat_session_key_t * p_value,
			    u8 * p_dont_translate, void *d, void *e);

/* ICMP deterministic NAT session match functions */
u32 icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node,
			   u32 thread_index, vlib_buffer_t * b0,
			   ip4_header_t * ip0, u8 * p_proto,
			   snat_session_key_t * p_value,
			   u8 * p_dont_translate, void *d, void *e);
u32 icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node,
			   u32 thread_index, vlib_buffer_t * b0,
			   ip4_header_t * ip0, u8 * p_proto,
			   snat_session_key_t * p_value,
			   u8 * p_dont_translate, void *d, void *e);

/* ICMP endpoint-dependent session match functions */
u32 icmp_match_out2in_ed (snat_main_t * sm, vlib_node_runtime_t * node,
			  u32 thread_index, vlib_buffer_t * b0,
			  ip4_header_t * ip0, u8 * p_proto,
			  snat_session_key_t * p_value,
			  u8 * p_dont_translate, void *d, void *e);
u32 icmp_match_in2out_ed (snat_main_t * sm, vlib_node_runtime_t * node,
			  u32 thread_index, vlib_buffer_t * b0,
			  ip4_header_t * ip0, u8 * p_proto,
			  snat_session_key_t * p_value,
			  u8 * p_dont_translate, void *d, void *e);

u32 icmp_in2out (snat_main_t * sm, vlib_buffer_t * b0, ip4_header_t * ip0,
		 icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
		 vlib_node_runtime_t * node, u32 next0, u32 thread_index,
		 void *d, void *e);

u32 icmp_out2in (snat_main_t * sm, vlib_buffer_t * b0, ip4_header_t * ip0,
		 icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
		 vlib_node_runtime_t * node, u32 next0, u32 thread_index,
		 void *d, void *e);

/* hairpinning functions */
u32 snat_icmp_hairpinning (snat_main_t * sm, vlib_buffer_t * b0,
			   ip4_header_t * ip0, icmp46_header_t * icmp0,
			   int is_ed);
void nat_hairpinning_sm_unknown_proto (snat_main_t * sm, vlib_buffer_t * b,
				       ip4_header_t * ip);
void nat44_ed_hairpinning_unknown_proto (snat_main_t * sm, vlib_buffer_t * b,
					 ip4_header_t * ip);
int snat_hairpinning (snat_main_t * sm, vlib_buffer_t * b0,
		      ip4_header_t * ip0, udp_header_t * udp0,
		      tcp_header_t * tcp0, u32 proto0, int is_ed);
void nat44_reass_hairpinning (snat_main_t * sm, vlib_buffer_t * b0,
			      ip4_header_t * ip0, u16 sport, u16 dport,
			      u32 proto0, int is_ed);

/* Call back functions for clib_bihash_add_or_overwrite_stale */
int nat44_i2o_ed_is_idle_session_cb (clib_bihash_kv_16_8_t * kv, void *arg);
int nat44_o2i_ed_is_idle_session_cb (clib_bihash_kv_16_8_t * kv, void *arg);
int nat44_i2o_is_idle_session_cb (clib_bihash_kv_8_8_t * kv, void *arg);
int nat44_o2i_is_idle_session_cb (clib_bihash_kv_8_8_t * kv, void *arg);

/**
 * @brief Add external address to NAT44 pool
 *
 * @param addr      IPv4 address
 * @param vrf_id    VRF id of tenant, ~0 means independent of VRF
 * @param twice_nat 1 if twice NAT address
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_add_address (snat_main_t * sm, ip4_address_t * addr, u32 vrf_id,
		      u8 twice_nat);

/**
 * @brief Delete external address from NAT44 pool
 *
 * @param addr      IPv4 address
 * @param delete_sm 1 if delete static mapping using address
 * @param twice_nat 1 if twice NAT address
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
		      u8 twice_nat);

/**
 * @brief Add/delete external address to FIB DPO (out2in DPO mode)
 *
 * @param addr   IPv4 address
 * @param is_add 1 = add, 0 = delete
 *
 * @return 0 on success, non-zero value otherwise
 */
void nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add);

/**
 * @brief Add/delete NAT44 static mapping
 *
 * @param l_addr       local IPv4 address
 * @param e_addr       external IPv4 address
 * @param l_port       local port number
 * @param e_port       external port number
 * @param vrf_id       local VRF ID
 * @param addr_only    1 = 1:1NAT, 0 = 1:1NAPT
 * @param sw_if_index  use interface address as external IPv4 address
 * @param proto        L4 protocol
 * @param is_add       1 = add, 0 = delete
 * @param twice_nat    twice-nat mode
 * @param out2in_only  if 1 rule match only out2in direction
 * @param tag          opaque string tag
 * @param identity_nat identity NAT
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr,
			     u16 l_port, u16 e_port, u32 vrf_id,
			     int addr_only, u32 sw_if_index,
			     snat_protocol_t proto, int is_add,
			     twice_nat_type_t twice_nat, u8 out2in_only,
			     u8 * tag, u8 identity_nat);

/**
 * @brief Add/delete static mapping with load-balancing (multiple backends)
 *
 * @param e_addr      external IPv4 address
 * @param e_port      external port number
 * @param proto       L4 protocol
 * @param locals      list of local backends
 * @param is_add      1 = add, 0 = delete
 * @param twice_nat   twice-nat mode
 * @param out2in_only if 1 rule match only out2in direction
 * @param tag         opaque string tag
 * @param affinity    0 = disabled, otherwise client IP affinity sticky time
 *
 * @return 0 on success, non-zero value otherwise
 */
int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
				     snat_protocol_t proto,
				     nat44_lb_addr_port_t * locals, u8 is_add,
				     twice_nat_type_t twice_nat,
				     u8 out2in_only, u8 * tag, u32 affinity);

int nat44_lb_static_mapping_add_del_local (ip4_address_t e_addr, u16 e_port,
					   ip4_address_t l_addr, u16 l_port,
					   snat_protocol_t proto, u32 vrf_id,
					   u8 probability, u8 is_add);

clib_error_t *snat_api_init (vlib_main_t * vm, snat_main_t * sm);

/**
 * @brief Set NAT plugin workers
 *
 * @param bitmap NAT workers bitmap
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_set_workers (uword * bitmap);

/**
 * @brief Enable/disable NAT44 feature on the interface
 *
 * @param sw_if_index software index of the interface
 * @param is_inside   1 = inside, 0 = outside
 * @param is_del      1 = delete, 0 = add
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del);

/**
 * @brief Enable/disable NAT44 output feature on the interface (postrouting NAT)
 *
 * @param sw_if_index software index of the interface
 * @param is_inside   1 = inside, 0 = outside
 * @param is_del      1 = delete, 0 = add
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_interface_add_del_output_feature (u32 sw_if_index, u8 is_inside,
					   int is_del);

/**
 * @brief Add/delete NAT44 pool address from specific interfce
 *
 * @param sw_if_index software index of the interface
 * @param is_del      1 = delete, 0 = add
 * @param twice_nat   1 = twice NAT address for extenal hosts
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
				u8 twice_nat);

/**
 * @brief Delete NAT44 session
 *
 * @param addr   IPv4 address
 * @param port   L4 port number
 * @param proto  L4 protocol
 * @param vrf_id VRF ID
 * @param is_in  1 = inside network address and port pair, 0 = outside
 *
 * @return 0 on success, non-zero value otherwise
 */
int nat44_del_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
		       snat_protocol_t proto, u32 vrf_id, int is_in);

/**
 * @brief Delete NAT44 endpoint-dependent session
 *
 * @param addr   IPv4 address
 * @param port   L4 port number
 * @param proto  L4 protocol
 * @param vrf_id VRF ID
 * @param is_in  1 = inside network address and port pair, 0 = outside
 *
 * @return 0 on success, non-zero value otherwise
 */
int nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
			  ip4_address_t * eh_addr, u16 eh_port, u8 proto,
			  u32 vrf_id, int is_in);

/**
 * @brief Free NAT44 session data (lookup keys, external addrres port)
 *
 * @param s            NAT session
 * @param thread_index thread index
 * @param is_ha        is HA event
 */
void nat_free_session_data (snat_main_t * sm, snat_session_t * s,
			    u32 thread_index, u8 is_ha);

/**
 * @brief Find or create NAT user
 *
 * @param addr         IPv4 address
 * @param fib_index    FIB table index
 * @param thread_index thread index
 *
 * @return NAT user data structure on success otherwise zero value
 */
snat_user_t *nat_user_get_or_create (snat_main_t * sm, ip4_address_t * addr,
				     u32 fib_index, u32 thread_index);

/**
 * @brief Allocate new NAT session or recycle last used
 *
 * @param u            NAT user
 * @param thread_index thread index
 *
 * @return session data structure on success otherwise zero value
 */
snat_session_t *nat_session_alloc_or_recycle (snat_main_t * sm,
					      snat_user_t * u,
					      u32 thread_index, f64 now);

/**
 * @brief Allocate NAT endpoint-dependent session
 *
 * @param u            NAT user
 * @param thread_index thread index
 *
 * @return session data structure on success otherwise zero value
 */
snat_session_t *nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u,
				      u32 thread_index, f64 now);

/**
 * @brief Set address and port assignment algorithm for MAP-E CE
 *
 * @param psid        Port Set Identifier value
 * @param psid_offset number of offset bits
 * @param psid_length length of PSID
 */
void nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset,
				       u16 psid_length);

/**
 * @brief Set address and port assignment algorithm for port range
 *
 * @param start_port beginning of the port range
 * @param end_port   end of the port range
 */
void nat_set_alloc_addr_and_port_range (u16 start_port, u16 end_port);

/**
 * @brief Set address and port assignment algorithm to default/standard
 */
void nat_set_alloc_addr_and_port_default (void);

/**
 * @brief Free outside address and port pair
 *
 * @param addresses    vector of outside addresses
 * @param thread_index thread index
 * @param k            address, port and protocol
 */
void snat_free_outside_address_and_port (snat_address_t * addresses,
					 u32 thread_index,
					 snat_session_key_t * k);

/**
 * @brief Alloc outside address and port
 *
 * @param addresses         vector of outside addresses
 * @param fib_index         FIB table index
 * @param thread_index      thread index
 * @param k                 allocated address and port pair
 * @param port_per_thread   number of ports per threead
 * @param snat_thread_index NAT thread index
 *
 * @return 0 on success, non-zero value otherwise
 */
int snat_alloc_outside_address_and_port (snat_address_t * addresses,
					 u32 fib_index,
					 u32 thread_index,
					 snat_session_key_t * k,
					 u16 port_per_thread,
					 u32 snat_thread_index);

/**
 * @brief Match NAT44 static mapping.
 *
 * @param match         address and port to match
 * @param mapping       external/local address and port of the matched mapping
 * @param by_external   if 0 match by local address otherwise match by external
 *                      address
 * @param is_addr_only  1 if matched mapping is address only
 * @param twice_nat     matched mapping is twice NAT type
 * @param lb            1 if matched mapping is load-balanced
 * @param ext_host_addr external host address
 *
 * @returns 0 if match found otherwise 1.
 */
int snat_static_mapping_match (snat_main_t * sm,
			       snat_session_key_t match,
			       snat_session_key_t * mapping,
			       u8 by_external,
			       u8 * is_addr_only,
			       twice_nat_type_t * twice_nat,
			       lb_nat_type_t * lb,
			       ip4_address_t * ext_host_addr,
			       u8 * is_identity_nat);

/**
 * @brief Add/del NAT address to FIB.
 *
 * Add the external NAT address to the FIB as receive entries. This ensures
 * that VPP will reply to ARP for this address and we don't need to enable
 * proxy ARP on the outside interface.
 *
 * @param addr        IPv4 address
 * @param plen        address prefix length
 * @param sw_if_index software index of the outside interface
 * @param is_add      0 = delete, 1 = add.
 */
void snat_add_del_addr_to_fib (ip4_address_t * addr,
			       u8 p_len, u32 sw_if_index, int is_add);

/*
 * Why is this here? Because we don't need to touch this layer to
 * simply reply to an icmp. We need to change id to a unique
 * value to NAT an echo request/reply.
 */

typedef struct
{
  u16 identifier;
  u16 sequence;
} icmp_echo_header_t;

typedef struct
{
  u16 src_port, dst_port;
} tcp_udp_header_t;

#endif /* __included_nat_h__ */
/*
 * fd.io coding-style-patch-verification: ON
 *
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */