summaryrefslogtreecommitdiffstats
path: root/src/plugins/nat/det44
diff options
context:
space:
mode:
authorFilip Varga <fivarga@cisco.com>2020-07-21 10:27:39 +0200
committerOle Trøan <otroan@employees.org>2020-08-13 10:06:33 +0000
commit603e75465899385a95350f3c96499050f7f960a5 (patch)
treef7a7130769ea795c1c3460db3aea99a49a309b13 /src/plugins/nat/det44
parentde118da58e80aec43f4b816a1ea957634a8bc07c (diff)
nat: move deterministic nat to det44 sub feature
Type: refactor Change-Id: I0bb203102a0e13dd7448e2125925ab356bbd7937 Signed-off-by: Filip Varga <fivarga@cisco.com>
Diffstat (limited to 'src/plugins/nat/det44')
-rw-r--r--src/plugins/nat/det44/det44.api469
-rw-r--r--src/plugins/nat/det44/det44.c608
-rw-r--r--src/plugins/nat/det44/det44.h449
-rw-r--r--src/plugins/nat/det44/det44_api.c633
-rw-r--r--src/plugins/nat/det44/det44_cli.c697
-rw-r--r--src/plugins/nat/det44/det44_in2out.c1067
-rw-r--r--src/plugins/nat/det44/det44_inlines.h130
-rw-r--r--src/plugins/nat/det44/det44_out2in.c866
8 files changed, 4919 insertions, 0 deletions
diff --git a/src/plugins/nat/det44/det44.api b/src/plugins/nat/det44/det44.api
new file mode 100644
index 00000000000..818d46a1d5a
--- /dev/null
+++ b/src/plugins/nat/det44/det44.api
@@ -0,0 +1,469 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+option version = "1.0.0";
+import "vnet/ip/ip_types.api";
+import "vnet/interface_types.api";
+import "plugins/nat/nat_types.api";
+
+/**
+ * @file det44.api
+ * @brief VPP control-plane API messages.
+ *
+ * This file defines VPP control-plane API messages which are generally
+ * called through a shared memory interface.
+ */
+
+/** \brief Enable/disable DET44 plugin
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param inside_vrf - inside VRF id
+ @param outside_vrf - outside VRF id
+ @param enable - true if enable, false if disable
+*/
+autoreply define det44_plugin_enable_disable {
+ u32 client_index;
+ u32 context;
+ u32 inside_vrf;
+ u32 outside_vrf;
+ bool enable;
+ vl_api_interface_index_t sw_if_index;
+ option status="in_progress";
+};
+
+/** \brief Enable/disable DET44 feature on the interface
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param is_add - true if add, false if delete
+ @param is_inside - true if interface is inside, false if outside
+ @param sw_if_index - software index of the interface
+*/
+autoreply define det44_interface_add_del_feature {
+ u32 client_index;
+ u32 context;
+ bool is_add;
+ bool is_inside;
+ vl_api_interface_index_t sw_if_index;
+ option status="in_progress";
+};
+
+/** \brief Dump interfaces with DET44 feature
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+*/
+define det44_interface_dump {
+ u32 client_index;
+ u32 context;
+ option status="in_progress";
+};
+
+/** \brief DET44 interface details response
+ @param context - sender context, to match reply w/ request
+ @param is_inside - true if interface is inside, false if outside
+ @param sw_if_index - software index of the interface
+*/
+define det44_interface_details {
+ u32 context;
+ bool is_inside;
+ bool is_outside;
+ vl_api_interface_index_t sw_if_index;
+ option status="in_progress";
+};
+
+/** \brief Add/delete DET44 mapping
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param is_add - true if add, false if delete
+ @param in_addr - inside IPv4 address
+ @param in_plen - inside IPv4 address prefix length
+ @param out_addr - outside IPv4 address
+ @param out_plen - outside IPv4 address prefix length
+*/
+autoreply define det44_add_del_map {
+ u32 client_index;
+ u32 context;
+ bool is_add;
+ vl_api_ip4_address_t in_addr;
+ u8 in_plen;
+ vl_api_ip4_address_t out_addr;
+ u8 out_plen;
+};
+
+/** \brief Get outside address and port range from inside address
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param in_addr - inside IP address
+*/
+define det44_forward {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t in_addr;
+};
+
+/** \brief Get outside address and port range from inside address
+ @param context - sender context, to match reply w/ request
+ @param retval - return code
+ @param out_port_lo - outside port range start
+ @param out_port_hi - outside port range end
+ @param out_addr - outside IPv4 address
+*/
+define det44_forward_reply {
+ u32 context;
+ i32 retval;
+ u16 out_port_lo;
+ u16 out_port_hi;
+ vl_api_ip4_address_t out_addr;
+};
+
+/** \brief Get inside address from outside address and port
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param out_port - outside port
+ @param out_addr - outside IPv4 address
+*/
+define det44_reverse {
+ u32 client_index;
+ u32 context;
+ u16 out_port;
+ vl_api_ip4_address_t out_addr;
+};
+
+/** \brief Get inside address from outside address and port reply
+ @param context - sender context, to match reply w/ request
+ @param retval - return code
+ @param in_addr - inside IP address
+*/
+define det44_reverse_reply {
+ u32 context;
+ i32 retval;
+ vl_api_ip4_address_t in_addr;
+};
+
+/** \brief Dump DET44 mappings
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+*/
+define det44_map_dump {
+ u32 client_index;
+ u32 context;
+};
+
+/** \brief DET44 users response
+ @param context - sender context, to match reply w/ request
+ @param in_addr - inside IPv4 address
+ @param in_plen - inside IPv4 address prefix length
+ @param out_addr - outside IPv4 address
+ @param out_plen - outside IPv4 address prefix length
+ @param sharing_ratio - outside to inside address sharing ratio
+ @param ports_per_host - number of ports available to a host
+ @param ses_num - number of sessions belonging to this mapping
+*/
+define det44_map_details {
+ u32 context;
+ vl_api_ip4_address_t in_addr;
+ u8 in_plen;
+ vl_api_ip4_address_t out_addr;
+ u8 out_plen;
+ u32 sharing_ratio;
+ u16 ports_per_host;
+ u32 ses_num;
+};
+
+/** \brief Close DET44 session by outside address and port
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param out_addr - outside IPv4 address
+ @param out_port - outside port
+ @param ext_addr - external host IPv4 address
+ @param ext_port - external host port
+*/
+autoreply define det44_close_session_out {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t out_addr;
+ u16 out_port;
+ vl_api_ip4_address_t ext_addr;
+ u16 ext_port;
+};
+
+/** \brief Close DET44 session by inside address and port
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param in_addr - inside IP address
+ @param in_port - inside port
+ @param ext_addr - external host IP address
+ @param ext_port - external host port
+*/
+autoreply define det44_close_session_in {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t in_addr;
+ u16 in_port;
+ vl_api_ip4_address_t ext_addr;
+ u16 ext_port;
+};
+
+/** \brief Dump DET44 sessions
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param user_addr - address of an inside user whose sessions to dump
+*/
+define det44_session_dump {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t user_addr;
+};
+
+/** \brief DET44 sessions reply
+ @param context - sender context, to match reply w/ request
+ @param in_port - inside port
+ @param ext_addr - external host IPv4 address
+ @param ext_port - external host port
+ @param out_port - outside port
+ @param state - session state
+ @param expire - session expiration timestamp
+*/
+define det44_session_details {
+ u32 context;
+ u16 in_port;
+ vl_api_ip4_address_t ext_addr;
+ u16 ext_port;
+ u16 out_port;
+ u8 state;
+ u32 expire;
+};
+
+/** \brief Set values of timeouts for DET44 sessions (seconds)
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param udp - UDP timeout (default 300sec)
+ @param tcp_established - TCP established timeout (default 7440sec)
+ @param tcp_transitory - TCP transitory timeout (default 240sec)
+ @param icmp - ICMP timeout (default 60sec)
+*/
+autoreply define det44_set_timeouts {
+ u32 client_index;
+ u32 context;
+ u32 udp;
+ u32 tcp_established;
+ u32 tcp_transitory;
+ u32 icmp;
+ option status="in_progress";
+};
+
+/** \brief Get values of timeouts for DET44 sessions (seconds)
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+*/
+define det44_get_timeouts {
+ u32 client_index;
+ u32 context;
+};
+
+/** \brief Get values of timeouts for DET44 sessions reply
+ @param context - sender context, to match reply w/ request
+ @param retval - return code
+ @param udp - UDP timeout
+ @param tcp_established - TCP established timeout
+ @param tcp_transitory - TCP transitory timeout
+ @param icmp - ICMP timeout
+*/
+define det44_get_timeouts_reply {
+ u32 context;
+ i32 retval;
+ u32 udp;
+ u32 tcp_established;
+ u32 tcp_transitory;
+ u32 icmp;
+ option status="in_progress";
+};
+
+/*
+ * Obsolete deterministic API to be removed
+ */
+
+/** \brief Add/delete NAT deterministic mapping
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param is_add - true if add, false if delete
+ @param in_addr - inside IPv4 address
+ @param in_plen - inside IPv4 address prefix length
+ @param out_addr - outside IPv4 address
+ @param out_plen - outside IPv4 address prefix length
+*/
+autoreply define nat_det_add_del_map {
+ u32 client_index;
+ u32 context;
+ bool is_add;
+ vl_api_ip4_address_t in_addr;
+ u8 in_plen;
+ vl_api_ip4_address_t out_addr;
+ u8 out_plen;
+ option status="deprecated";
+};
+
+/** \brief Get outside address and port range from inside address
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param in_addr - inside IP address
+*/
+define nat_det_forward {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t in_addr;
+ option status="deprecated";
+};
+
+/** \brief Get outside address and port range from inside address
+ @param context - sender context, to match reply w/ request
+ @param retval - return code
+ @param out_port_lo - outside port range start
+ @param out_port_hi - outside port range end
+ @param out_addr - outside IPv4 address
+*/
+define nat_det_forward_reply {
+ u32 context;
+ i32 retval;
+ u16 out_port_lo;
+ u16 out_port_hi;
+ vl_api_ip4_address_t out_addr;
+ option status="deprecated";
+};
+
+/** \brief Get inside address from outside address and port
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param out_port - outside port
+ @param out_addr - outside IPv4 address
+*/
+define nat_det_reverse {
+ u32 client_index;
+ u32 context;
+ u16 out_port;
+ vl_api_ip4_address_t out_addr;
+ option status="deprecated";
+};
+
+/** \brief Get inside address from outside address and port reply
+ @param context - sender context, to match reply w/ request
+ @param retval - return code
+ @param in_addr - inside IP address
+*/
+define nat_det_reverse_reply {
+ u32 context;
+ i32 retval;
+ vl_api_ip4_address_t in_addr;
+ option status="deprecated";
+};
+
+/** \brief Dump NAT deterministic mappings
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+*/
+define nat_det_map_dump {
+ u32 client_index;
+ u32 context;
+ option status="deprecated";
+};
+
+/** \brief NAT users response
+ @param context - sender context, to match reply w/ request
+ @param in_addr - inside IPv4 address
+ @param in_plen - inside IPv4 address prefix length
+ @param out_addr - outside IPv4 address
+ @param out_plen - outside IPv4 address prefix length
+ @param sharing_ratio - outside to inside address sharing ratio
+ @param ports_per_host - number of ports available to a host
+ @param ses_num - number of sessions belonging to this mapping
+*/
+define nat_det_map_details {
+ u32 context;
+ vl_api_ip4_address_t in_addr;
+ u8 in_plen;
+ vl_api_ip4_address_t out_addr;
+ u8 out_plen;
+ u32 sharing_ratio;
+ u16 ports_per_host;
+ u32 ses_num;
+ option status="deprecated";
+};
+
+/** \brief Close deterministic NAT session by outside address and port
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param out_addr - outside IPv4 address
+ @param out_port - outside port
+ @param ext_addr - external host IPv4 address
+ @param ext_port - external host port
+*/
+autoreply define nat_det_close_session_out {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t out_addr;
+ u16 out_port;
+ vl_api_ip4_address_t ext_addr;
+ u16 ext_port;
+ option status="deprecated";
+};
+
+/** \brief Close deterministic NAT session by inside address and port
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param in_addr - inside IP address
+ @param in_port - inside port
+ @param ext_addr - external host IP address
+ @param ext_port - external host port
+*/
+autoreply define nat_det_close_session_in {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t in_addr;
+ u16 in_port;
+ vl_api_ip4_address_t ext_addr;
+ u16 ext_port;
+ option status="deprecated";
+};
+
+/** \brief Dump determinstic NAT sessions
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param user_addr - address of an inside user whose sessions to dump
+*/
+define nat_det_session_dump {
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t user_addr;
+ option status="deprecated";
+};
+
+/** \brief Deterministic NAT sessions reply
+ @param context - sender context, to match reply w/ request
+ @param in_port - inside port
+ @param ext_addr - external host IPv4 address
+ @param ext_port - external host port
+ @param out_port - outside NAT port
+ @param state - session state
+ @param expire - session expiration timestamp
+*/
+define nat_det_session_details {
+ u32 context;
+ u16 in_port;
+ vl_api_ip4_address_t ext_addr;
+ u16 ext_port;
+ u16 out_port;
+ u8 state;
+ u32 expire;
+ option status="deprecated";
+};
diff --git a/src/plugins/nat/det44/det44.c b/src/plugins/nat/det44/det44.c
new file mode 100644
index 00000000000..886092cea50
--- /dev/null
+++ b/src/plugins/nat/det44/det44.c
@@ -0,0 +1,608 @@
+/*
+ * det44.c - deterministic NAT
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * @file
+ * @brief deterministic NAT (CGN)
+ */
+
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/ip/ip4.h>
+#include <vpp/app/version.h>
+#include <vnet/plugin/plugin.h>
+
+#include <nat/det44/det44.h>
+
+det44_main_t det44_main;
+
+/* *INDENT-OFF* */
+VNET_FEATURE_INIT (ip4_det44_in2out, static) = {
+ .arc_name = "ip4-unicast",
+ .node_name = "det44-in2out",
+ .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
+ "ip4-sv-reassembly-feature"),
+};
+VNET_FEATURE_INIT (ip4_det44_out2in, static) = {
+ .arc_name = "ip4-unicast",
+ .node_name = "det44-out2in",
+ .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
+ "ip4-sv-reassembly-feature",
+ "ip4-dhcp-client-detect"),
+};
+VLIB_PLUGIN_REGISTER () = {
+ .version = VPP_BUILD_VER,
+ .description = "Deterministic NAT (CGN)",
+};
+/* *INDENT-ON* */
+
+void
+det44_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
+ int is_add)
+{
+ det44_main_t *dm = &det44_main;
+ fib_prefix_t prefix = {
+ .fp_len = p_len,
+ .fp_proto = FIB_PROTOCOL_IP4,
+ .fp_addr = {
+ .ip4.as_u32 = addr->as_u32,
+ },
+ };
+ u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
+
+ if (is_add)
+ {
+ fib_table_entry_update_one_path (fib_index,
+ &prefix,
+ dm->fib_src_low,
+ (FIB_ENTRY_FLAG_CONNECTED |
+ FIB_ENTRY_FLAG_LOCAL |
+ FIB_ENTRY_FLAG_EXCLUSIVE),
+ DPO_PROTO_IP4,
+ NULL,
+ sw_if_index,
+ ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
+ }
+ else
+ {
+ fib_table_entry_delete (fib_index, &prefix, dm->fib_src_low);
+ }
+}
+
+/**
+ * @brief Add/delete deterministic NAT mapping.
+ *
+ * Create bijective mapping of inside address to outside address and port range
+ * pairs, with the purpose of enabling deterministic NAT to reduce logging in
+ * CGN deployments.
+ *
+ * @param in_addr Inside network address.
+ * @param in_plen Inside network prefix length.
+ * @param out_addr Outside network address.
+ * @param out_plen Outside network prefix length.
+ * @param is_add If 0 delete, otherwise add.
+ */
+int
+snat_det_add_map (ip4_address_t * in_addr, u8 in_plen,
+ ip4_address_t * out_addr, u8 out_plen, int is_add)
+{
+ static snat_det_session_t empty_snat_det_session = { 0 };
+ det44_main_t *dm = &det44_main;
+ ip4_address_t in_cmp, out_cmp;
+ det44_interface_t *i;
+ snat_det_map_t *mp;
+ u8 found = 0;
+
+ in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
+ out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
+ vec_foreach (mp, dm->det_maps)
+ {
+ /* Checking for overlapping addresses to be added here */
+ if (mp->in_addr.as_u32 == in_cmp.as_u32 &&
+ mp->in_plen == in_plen &&
+ mp->out_addr.as_u32 == out_cmp.as_u32 && mp->out_plen == out_plen)
+ {
+ found = 1;
+ break;
+ }
+ }
+
+ /* If found, don't add again */
+ if (found && is_add)
+ return VNET_API_ERROR_VALUE_EXIST;
+
+ /* If not found, don't delete */
+ if (!found && !is_add)
+ return VNET_API_ERROR_NO_SUCH_ENTRY;
+
+ if (is_add)
+ {
+ pool_get (dm->det_maps, mp);
+ clib_memset (mp, 0, sizeof (*mp));
+ mp->in_addr.as_u32 = in_cmp.as_u32;
+ mp->in_plen = in_plen;
+ mp->out_addr.as_u32 = out_cmp.as_u32;
+ mp->out_plen = out_plen;
+ mp->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
+ mp->ports_per_host = (65535 - 1023) / mp->sharing_ratio;
+
+ vec_validate_init_empty (mp->sessions,
+ DET44_SES_PER_USER * (1 << (32 - in_plen)) -
+ 1, empty_snat_det_session);
+ }
+ else
+ {
+ vec_free (mp->sessions);
+ vec_del1 (dm->det_maps, mp - dm->det_maps);
+ }
+
+ /* Add/del external address range to FIB */
+ /* *INDENT-OFF* */
+ pool_foreach (i, dm->interfaces, ({
+ if (det44_interface_is_inside(i))
+ continue;
+ det44_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
+ goto out;
+ }));
+ /* *INDENT-ON* */
+out:
+ return 0;
+}
+
+int
+det44_set_timeouts (nat_timeouts_t * timeouts)
+{
+ det44_main_t *dm = &det44_main;
+ if (timeouts->udp)
+ dm->timeouts.udp = timeouts->udp;
+ if (timeouts->tcp.established)
+ dm->timeouts.tcp.established = timeouts->tcp.established;
+ if (timeouts->tcp.transitory)
+ dm->timeouts.tcp.transitory = timeouts->tcp.transitory;
+ if (timeouts->icmp)
+ dm->timeouts.icmp = timeouts->icmp;
+ return 0;
+}
+
+nat_timeouts_t
+det44_get_timeouts ()
+{
+ det44_main_t *dm = &det44_main;
+ return dm->timeouts;
+}
+
+void
+det44_reset_timeouts ()
+{
+ det44_main_t *dm = &det44_main;
+ dm->timeouts.udp = 300;
+ dm->timeouts.tcp.established = 7440;
+ dm->timeouts.tcp.transitory = 240;
+ dm->timeouts.icmp = 60;
+}
+
+int
+det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
+{
+ det44_main_t *dm = &det44_main;
+ det44_interface_t *tmp, *i = 0;
+ const char *feature_name;
+ int rv;
+
+ // TODO: if plugin is not enabled do not register nodes on interfaces
+ // rather make a structure and when enable call is used
+ // then register nodes
+
+ /* *INDENT-OFF* */
+ pool_foreach (tmp, dm->interfaces, ({
+ if (tmp->sw_if_index == sw_if_index)
+ {
+ i = tmp;
+ goto out;
+ }
+ }));
+ /* *INDENT-ON* */
+out:
+
+ feature_name = is_inside ? "det44-in2out" : "det44-out2in";
+
+ if (is_del)
+ {
+ if (!i)
+ {
+ det44_log_err ("det44 is not enabled on this interface");
+ return VNET_API_ERROR_INVALID_VALUE;
+ }
+
+ rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0);
+ if (rv)
+ return rv;
+
+ rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
+ sw_if_index, 1, 0, 0);
+ if (rv)
+ return rv;
+
+ pool_put (dm->interfaces, i);
+ }
+ else
+ {
+ if (i)
+ {
+ det44_log_err ("det44 is already enabled on this interface");
+ return VNET_API_ERROR_INVALID_VALUE;
+ }
+
+ rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 1);
+ if (rv)
+ return rv;
+
+ rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
+ sw_if_index, 1, 0, 0);
+ if (rv)
+ return rv;
+
+ pool_get (dm->interfaces, i);
+ clib_memset (i, 0, sizeof (*i));
+
+ i->sw_if_index = sw_if_index;
+
+ if (is_inside)
+ i->flags |= DET44_INTERFACE_FLAG_IS_INSIDE;
+ else
+ i->flags |= DET44_INTERFACE_FLAG_IS_OUTSIDE;
+ }
+
+ if (!is_inside)
+ {
+ u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
+ sw_if_index);
+ // add/del outside interface fib to registry
+ u8 found = 0;
+ det44_fib_t *outside_fib;
+ /* *INDENT-OFF* */
+ vec_foreach (outside_fib, dm->outside_fibs)
+ {
+ if (outside_fib->fib_index == fib_index)
+ {
+ if (!is_del)
+ {
+ outside_fib->refcount++;
+ }
+ else
+ {
+ outside_fib->refcount--;
+ if (!outside_fib->refcount)
+ {
+ vec_del1 (dm->outside_fibs,
+ outside_fib - dm->outside_fibs);
+ }
+ }
+ found = 1;
+ break;
+ }
+ }
+ /* *INDENT-ON* */
+ if (!is_del && !found)
+ {
+ vec_add2 (dm->outside_fibs, outside_fib, 1);
+ outside_fib->fib_index = fib_index;
+ outside_fib->refcount = 1;
+ }
+ // add/del outside address to FIB
+ snat_det_map_t *mp;
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps, ({
+ det44_add_del_addr_to_fib(&mp->out_addr,
+ mp->out_plen, sw_if_index, !is_del);
+ }));
+ /* *INDENT-ON* */
+ }
+ return 0;
+}
+
+/**
+ * @brief The 'det44-expire-walk' process's main loop.
+ *
+ * Check expire time for active sessions.
+ */
+static uword
+det44_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
+ vlib_frame_t * f)
+{
+ det44_main_t *dm = &det44_main;
+ snat_det_session_t *ses;
+ snat_det_map_t *mp;
+
+ vlib_process_wait_for_event_or_clock (vm, 10.0);
+ vlib_process_get_events (vm, NULL);
+ u32 now = (u32) vlib_time_now (vm);
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps, ({
+ vec_foreach(ses, mp->sessions)
+ {
+ /* Delete if session expired */
+ if (ses->in_port && (ses->expire < now))
+ snat_det_ses_close (mp, ses);
+ }
+ }));
+ /* *INDENT-ON* */
+ return 0;
+}
+
+void
+det44_create_expire_walk_process ()
+{
+ det44_main_t *dm = &det44_main;
+
+ if (dm->expire_walk_node_index)
+ return;
+
+ dm->expire_walk_node_index = vlib_process_create (vlib_get_main (),
+ "det44-expire-walk",
+ det44_expire_walk_fn,
+ 16 /* stack_bytes */ );
+}
+
+int
+det44_plugin_enable (det44_config_t c)
+{
+ det44_main_t *dm = &det44_main;
+
+ if (plugin_enabled () == 1)
+ {
+ det44_log_err ("plugin already enabled!");
+ return 1;
+ }
+
+ det44_log_err ("inside %u, outside %u", c.inside_vrf_id, c.outside_vrf_id);
+
+ dm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
+ c.outside_vrf_id,
+ dm->fib_src_hi);
+ dm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
+ c.inside_vrf_id,
+ dm->fib_src_hi);
+
+ det44_create_expire_walk_process ();
+ dm->mss_clamping = 0;
+ dm->config = c;
+ dm->enabled = 1;
+ return 0;
+}
+
+int
+det44_plugin_disable ()
+{
+ det44_main_t *dm = &det44_main;
+ det44_interface_t *i, *interfaces;
+ snat_det_map_t *mp;
+ int rv = 0;
+
+ if (plugin_enabled () == 0)
+ {
+ det44_log_err ("plugin already disabled!");
+ return 1;
+ }
+
+ // DET44 cleanup (order dependent)
+ // 1) remove interfaces (det44_interface_add_del) removes map ranges from fib
+ // 2) free sessions
+ // 3) free maps
+
+ interfaces = vec_dup (dm->interfaces);
+ vec_foreach (i, interfaces)
+ {
+ vnet_main_t *vnm = vnet_get_main ();
+
+ if (i->flags & DET44_INTERFACE_FLAG_IS_INSIDE)
+ {
+ rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
+ if (rv)
+ {
+ det44_log_err ("inside interface %U del failed",
+ unformat_vnet_sw_interface, vnm, i->sw_if_index);
+ }
+ }
+
+ if (i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE)
+ {
+ rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
+ if (rv)
+ {
+ det44_log_err ("outside interface %U del failed",
+ unformat_vnet_sw_interface, vnm, i->sw_if_index);
+ }
+
+ }
+ }
+ vec_free (interfaces);
+
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps,
+ ({
+ vec_free (mp->sessions);
+ }));
+ /* *INDENT-ON* */
+
+ det44_reset_timeouts ();
+ dm->enabled = 0;
+
+ pool_free (dm->interfaces);
+ pool_free (dm->det_maps);
+
+ return rv;
+}
+
+static void
+det44_update_outside_fib (ip4_main_t * im,
+ uword opaque,
+ u32 sw_if_index, u32 new_fib_index,
+ u32 old_fib_index)
+{
+ det44_main_t *dm = &det44_main;
+
+ det44_fib_t *outside_fib;
+ det44_interface_t *i;
+
+ u8 is_add = 1;
+ u8 match = 0;
+
+ if (plugin_enabled () == 0)
+ return;
+
+ if (new_fib_index == old_fib_index)
+ return;
+
+ if (!vec_len (dm->outside_fibs))
+ return;
+
+ /* *INDENT-OFF* */
+ pool_foreach (i, dm->interfaces,
+ ({
+ if (i->sw_if_index == sw_if_index)
+ {
+ if (!(det44_interface_is_outside (i)))
+ return;
+ match = 1;
+ }
+ }));
+ /* *INDENT-ON* */
+
+ if (!match)
+ return;
+
+ vec_foreach (outside_fib, dm->outside_fibs)
+ {
+ if (outside_fib->fib_index == old_fib_index)
+ {
+ outside_fib->refcount--;
+ if (!outside_fib->refcount)
+ vec_del1 (dm->outside_fibs, outside_fib - dm->outside_fibs);
+ break;
+ }
+ }
+
+ vec_foreach (outside_fib, dm->outside_fibs)
+ {
+ if (outside_fib->fib_index == new_fib_index)
+ {
+ outside_fib->refcount++;
+ is_add = 0;
+ break;
+ }
+ }
+
+ if (is_add)
+ {
+ vec_add2 (dm->outside_fibs, outside_fib, 1);
+ outside_fib->refcount = 1;
+ outside_fib->fib_index = new_fib_index;
+ }
+}
+
+static clib_error_t *
+det44_init (vlib_main_t * vm)
+{
+ det44_main_t *dm = &det44_main;
+ ip4_table_bind_callback_t cb;
+ vlib_node_t *node;
+
+ clib_memset (dm, 0, sizeof (*dm));
+
+ dm->ip4_main = &ip4_main;
+ dm->log_class = vlib_log_register_class ("det44", 0);
+
+ node = vlib_get_node_by_name (vm, (u8 *) "det44-in2out");
+ dm->in2out_node_index = node->index;
+ node = vlib_get_node_by_name (vm, (u8 *) "det44-out2in");
+ dm->out2in_node_index = node->index;
+
+ dm->fib_src_hi = fib_source_allocate ("det44-hi",
+ FIB_SOURCE_PRIORITY_HI,
+ FIB_SOURCE_BH_SIMPLE);
+ dm->fib_src_low = fib_source_allocate ("det44-low",
+ FIB_SOURCE_PRIORITY_LOW,
+ FIB_SOURCE_BH_SIMPLE);
+
+ cb.function = det44_update_outside_fib;
+ cb.function_opaque = 0;
+ vec_add1 (dm->ip4_main->table_bind_callbacks, cb);
+
+ det44_reset_timeouts ();
+ return det44_api_hookup (vm);
+}
+
+VLIB_INIT_FUNCTION (det44_init);
+
+u8 *
+format_det44_session_state (u8 * s, va_list * args)
+{
+ u32 i = va_arg (*args, u32);
+ u8 *t = 0;
+
+ switch (i)
+ {
+#define _(v, N, str) case DET44_SESSION_##N: t = (u8 *) str; break;
+ foreach_det44_session_state
+#undef _
+ default:
+ t = format (t, "unknown");
+ }
+ s = format (s, "%s", t);
+ return s;
+}
+
+u8 *
+format_det_map_ses (u8 * s, va_list * args)
+{
+ snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *);
+ ip4_address_t in_addr, out_addr;
+ u32 in_offset, out_offset;
+ snat_det_session_t *ses = va_arg (*args, snat_det_session_t *);
+ u32 *i = va_arg (*args, u32 *);
+
+ u32 user_index = *i / DET44_SES_PER_USER;
+ in_addr.as_u32 =
+ clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) +
+ user_index);
+ in_offset =
+ clib_net_to_host_u32 (in_addr.as_u32) -
+ clib_net_to_host_u32 (det_map->in_addr.as_u32);
+ out_offset = in_offset / det_map->sharing_ratio;
+ out_addr.as_u32 =
+ clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) +
+ out_offset);
+ s =
+ format (s,
+ "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
+ format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port),
+ format_ip4_address, &out_addr,
+ clib_net_to_host_u16 (ses->out.out_port), format_ip4_address,
+ &ses->out.ext_host_addr,
+ clib_net_to_host_u16 (ses->out.ext_host_port),
+ format_det44_session_state, ses->state, ses->expire);
+
+ return s;
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44.h b/src/plugins/nat/det44/det44.h
new file mode 100644
index 00000000000..3ddba6d1405
--- /dev/null
+++ b/src/plugins/nat/det44/det44.h
@@ -0,0 +1,449 @@
+/*
+ * det44.h - deterministic NAT definitions
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) definitions
+ */
+
+#ifndef __included_det44_h__
+#define __included_det44_h__
+
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/ethernet/ethernet.h>
+#include <vnet/ip/icmp46_packet.h>
+#include <vnet/api_errno.h>
+#include <vnet/fib/fib_source.h>
+#include <vppinfra/dlist.h>
+#include <vppinfra/error.h>
+#include <vlibapi/api.h>
+#include <vlib/log.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/ip/reass/ip4_sv_reass.h>
+
+#include <nat/lib/lib.h>
+#include <nat/lib/inlines.h>
+
+/* Session state */
+#define foreach_det44_session_state \
+ _(0, UNKNOWN, "unknown") \
+ _(1, UDP_ACTIVE, "udp-active") \
+ _(2, TCP_SYN_SENT, "tcp-syn-sent") \
+ _(3, TCP_ESTABLISHED, "tcp-established") \
+ _(4, TCP_FIN_WAIT, "tcp-fin-wait") \
+ _(5, TCP_CLOSE_WAIT, "tcp-close-wait") \
+ _(6, TCP_CLOSING, "tcp-closing") \
+ _(7, TCP_LAST_ACK, "tcp-last-ack") \
+ _(8, TCP_CLOSED, "tcp-closed") \
+ _(9, ICMP_ACTIVE, "icmp-active")
+
+typedef enum
+{
+#define _(v, N, s) DET44_SESSION_##N = v,
+ foreach_det44_session_state
+#undef _
+} det44_session_state_t;
+
+#define DET44_SES_PER_USER 1000
+
+typedef struct
+{
+ u16 identifier;
+ u16 sequence;
+} icmp_echo_header_t;
+
+typedef struct
+{
+ u16 src_port, dst_port;
+} tcp_udp_header_t;
+
+typedef struct
+{
+ u32 cached_sw_if_index;
+ u32 cached_ip4_address;
+} det44_runtime_t;
+
+typedef struct nat_timeouts_s
+{
+ u32 udp;
+
+ struct
+ {
+ u32 transitory;
+ u32 established;
+ } tcp;
+
+ u32 icmp;
+
+} nat_timeouts_t;
+
+/* deterministic session outside key */
+typedef struct
+{
+ union
+ {
+ struct
+ {
+ ip4_address_t ext_host_addr;
+ u16 ext_host_port;
+ u16 out_port;
+ };
+ u64 as_u64;
+ };
+} snat_det_out_key_t;
+
+typedef struct
+{
+ /* Inside network port */
+ u16 in_port;
+ /* Outside network address and port */
+ snat_det_out_key_t out;
+ /* Session state */
+ u8 state;
+ /* Expire timeout */
+ u32 expire;
+} snat_det_session_t;
+
+typedef struct
+{
+ /* inside IP address range */
+ ip4_address_t in_addr;
+ u8 in_plen;
+ /* outside IP address range */
+ ip4_address_t out_addr;
+ u8 out_plen;
+ /* inside IP addresses / outside IP addresses */
+ u32 sharing_ratio;
+ /* number of ports available to internal host */
+ u16 ports_per_host;
+ /* session counter */
+ u32 ses_num;
+ /* vector of sessions */
+ snat_det_session_t *sessions;
+} snat_det_map_t;
+
+typedef struct
+{
+ u32 sw_if_index;
+ u8 flags;
+} det44_interface_t;
+
+typedef struct
+{
+
+ u32 outside_vrf_id;
+ u32 inside_vrf_id;
+
+} det44_config_t;
+
+typedef struct
+{
+ u32 fib_index;
+ u32 refcount;
+} det44_fib_t;
+
+typedef struct det44_main_s
+{
+ det44_config_t config;
+
+ u32 outside_fib_index;
+ u32 inside_fib_index;
+
+ /* Vector of outside fibs */
+ det44_fib_t *outside_fibs;
+
+ fib_source_t fib_src_hi;
+ fib_source_t fib_src_low;
+
+ u32 out2in_node_index;
+ u32 in2out_node_index;
+
+ /* Deterministic NAT mappings */
+ snat_det_map_t *det_maps;
+
+ /* TCP MSS clamping */
+ u16 mss_clamping;
+
+ /* Protocol timeouts */
+ nat_timeouts_t timeouts;
+
+ /* Expire walk process node index */
+ u32 expire_walk_node_index;
+
+ u32 enabled;
+
+ /* API message ID base */
+ u16 msg_id_base;
+
+ /* log class */
+ vlib_log_class_t log_class;
+
+ det44_interface_t *interfaces;
+
+ /* convenience */
+ ip4_main_t *ip4_main;
+ /* required */
+ vnet_main_t *vnet_main;
+
+} det44_main_t;
+
+extern det44_main_t det44_main;
+
+/* logging */
+#define det44_log_err(...) \
+ vlib_log(VLIB_LOG_LEVEL_ERR, det44_main.log_class, __VA_ARGS__)
+#define det44_log_warn(...) \
+ vlib_log(VLIB_LOG_LEVEL_WARNING, det44_main.log_class, __VA_ARGS__)
+#define det44_log_notice(...) \
+ vlib_log(VLIB_LOG_LEVEL_NOTICE, det44_main.log_class, __VA_ARGS__)
+#define det44_log_info(...) \
+ vlib_log(VLIB_LOG_LEVEL_INFO, det44_main.log_class, __VA_ARGS__)
+#define det44_log_debug(...)\
+ vlib_log(VLIB_LOG_LEVEL_DEBUG, det44_main.log_class, __VA_ARGS__)
+
+/* Deterministic NAT interface flags */
+#define DET44_INTERFACE_FLAG_IS_INSIDE 1
+#define DET44_INTERFACE_FLAG_IS_OUTSIDE 2
+
+/** \brief Check if Deterministic NAT interface is inside.
+ @param i Deterministic NAT interface
+ @return 1 if inside interface
+*/
+#define det44_interface_is_inside(i) i->flags & DET44_INTERFACE_FLAG_IS_INSIDE
+
+/** \brief Check if Deterministic NAT interface is outside.
+ @param i Deterministic NAT interface
+ @return 1 if outside interface
+*/
+#define det44_interface_is_outside(i) i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE
+
+static_always_inline u8
+plugin_enabled ()
+{
+ det44_main_t *dm = &det44_main;
+ return dm->enabled;
+}
+
+extern vlib_node_registration_t det44_in2out_node;
+extern vlib_node_registration_t det44_out2in_node;
+
+int det44_plugin_enable ();
+int det44_plugin_disable ();
+
+int det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del);
+
+int det44_set_timeouts (nat_timeouts_t * timeouts);
+nat_timeouts_t det44_get_timeouts ();
+void det44_reset_timeouts ();
+
+/* format functions */
+format_function_t format_det_map_ses;
+
+int snat_det_add_map (ip4_address_t * in_addr, u8 in_plen,
+ ip4_address_t * out_addr, u8 out_plen, int is_add);
+
+/* icmp session match functions */
+u32 icmp_match_out2in_det (vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, ip4_address_t * addr,
+ u16 * port, u32 * fib_index,
+ nat_protocol_t * proto, void *d, void *e,
+ u8 * dont_translate);
+u32 icmp_match_in2out_det (vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, ip4_address_t * addr,
+ u16 * port, u32 * fib_index,
+ nat_protocol_t * proto, void *d, void *e,
+ u8 * dont_translate);
+u32 det44_icmp_in2out (vlib_buffer_t * b0, ip4_header_t * ip0,
+ icmp46_header_t * icmp0, u32 sw_if_index0,
+ u32 rx_fib_index0, vlib_node_runtime_t * node,
+ u32 next0, u32 thread_index, void *d, void *e);
+u32 det44_icmp_out2in (vlib_buffer_t * b0, ip4_header_t * ip0,
+ icmp46_header_t * icmp0, u32 sw_if_index0,
+ u32 rx_fib_index0, vlib_node_runtime_t * node,
+ u32 next0, u32 thread_index, void *d, void *e);
+
+static_always_inline int
+is_addr_in_net (ip4_address_t * addr, ip4_address_t * net, u8 plen)
+{
+ if (net->as_u32 == (addr->as_u32 & ip4_main.fib_masks[plen]))
+ return 1;
+ return 0;
+}
+
+static_always_inline snat_det_map_t *
+snat_det_map_by_user (ip4_address_t * user_addr)
+{
+ det44_main_t *dm = &det44_main;
+ snat_det_map_t *mp;
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps,
+ ({
+ if (is_addr_in_net(user_addr, &mp->in_addr, mp->in_plen))
+ return mp;
+ }));
+ /* *INDENT-ON* */
+ return 0;
+}
+
+static_always_inline snat_det_map_t *
+snat_det_map_by_out (ip4_address_t * out_addr)
+{
+ det44_main_t *dm = &det44_main;
+ snat_det_map_t *mp;
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps,
+ ({
+ if (is_addr_in_net(out_addr, &mp->out_addr, mp->out_plen))
+ return mp;
+ }));
+ /* *INDENT-ON* */
+ return 0;
+}
+
+static_always_inline void
+snat_det_forward (snat_det_map_t * dm, ip4_address_t * in_addr,
+ ip4_address_t * out_addr, u16 * lo_port)
+{
+ u32 in_offset, out_offset;
+
+ in_offset = clib_net_to_host_u32 (in_addr->as_u32) -
+ clib_net_to_host_u32 (dm->in_addr.as_u32);
+ out_offset = in_offset / dm->sharing_ratio;
+ out_addr->as_u32 =
+ clib_host_to_net_u32 (clib_net_to_host_u32 (dm->out_addr.as_u32) +
+ out_offset);
+ *lo_port = 1024 + dm->ports_per_host * (in_offset % dm->sharing_ratio);
+}
+
+static_always_inline void
+snat_det_reverse (snat_det_map_t * dm, ip4_address_t * out_addr, u16 out_port,
+ ip4_address_t * in_addr)
+{
+ u32 in_offset1, in_offset2, out_offset;
+
+ out_offset = clib_net_to_host_u32 (out_addr->as_u32) -
+ clib_net_to_host_u32 (dm->out_addr.as_u32);
+ in_offset1 = out_offset * dm->sharing_ratio;
+ in_offset2 = (out_port - 1024) / dm->ports_per_host;
+ in_addr->as_u32 =
+ clib_host_to_net_u32 (clib_net_to_host_u32 (dm->in_addr.as_u32) +
+ in_offset1 + in_offset2);
+}
+
+static_always_inline u32
+snat_det_user_ses_offset (ip4_address_t * addr, u8 plen)
+{
+ return (clib_net_to_host_u32 (addr->as_u32) & pow2_mask (32 - plen)) *
+ DET44_SES_PER_USER;
+}
+
+static_always_inline snat_det_session_t *
+snat_det_get_ses_by_out (snat_det_map_t * dm, ip4_address_t * in_addr,
+ u64 out_key)
+{
+ u32 user_offset;
+ u16 i;
+
+ user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
+ for (i = 0; i < DET44_SES_PER_USER; i++)
+ {
+ if (dm->sessions[i + user_offset].out.as_u64 == out_key)
+ return &dm->sessions[i + user_offset];
+ }
+
+ return 0;
+}
+
+static_always_inline snat_det_session_t *
+snat_det_find_ses_by_in (snat_det_map_t * dm, ip4_address_t * in_addr,
+ u16 in_port, snat_det_out_key_t out_key)
+{
+ snat_det_session_t *ses;
+ u32 user_offset;
+ u16 i;
+
+ user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
+ for (i = 0; i < DET44_SES_PER_USER; i++)
+ {
+ ses = &dm->sessions[i + user_offset];
+ if (ses->in_port == in_port &&
+ ses->out.ext_host_addr.as_u32 == out_key.ext_host_addr.as_u32 &&
+ ses->out.ext_host_port == out_key.ext_host_port)
+ return &dm->sessions[i + user_offset];
+ }
+
+ return 0;
+}
+
+static_always_inline snat_det_session_t *
+snat_det_ses_create (u32 thread_index, snat_det_map_t * dm,
+ ip4_address_t * in_addr, u16 in_port,
+ snat_det_out_key_t * out)
+{
+ u32 user_offset;
+ u16 i;
+
+ user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
+
+ for (i = 0; i < DET44_SES_PER_USER; i++)
+ {
+ if (!dm->sessions[i + user_offset].in_port)
+ {
+ if (clib_atomic_bool_cmp_and_swap
+ (&dm->sessions[i + user_offset].in_port, 0, in_port))
+ {
+ dm->sessions[i + user_offset].out.as_u64 = out->as_u64;
+ dm->sessions[i + user_offset].state = DET44_SESSION_UNKNOWN;
+ dm->sessions[i + user_offset].expire = 0;
+ clib_atomic_add_fetch (&dm->ses_num, 1);
+ return &dm->sessions[i + user_offset];
+ }
+ }
+ }
+
+ // TODO:
+ /*snat_ipfix_logging_max_entries_per_user (thread_index,
+ DET44_SES_PER_USER,
+ in_addr->as_u32); */
+ return 0;
+}
+
+static_always_inline void
+snat_det_ses_close (snat_det_map_t * dm, snat_det_session_t * ses)
+{
+ if (clib_atomic_bool_cmp_and_swap (&ses->in_port, ses->in_port, 0))
+ {
+ ses->out.as_u64 = 0;
+ clib_atomic_add_fetch (&dm->ses_num, -1);
+ }
+}
+
+clib_error_t *det44_api_hookup (vlib_main_t * vm);
+
+#endif /* __included_det44_h__ */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_api.c b/src/plugins/nat/det44/det44_api.c
new file mode 100644
index 00000000000..7c7b1788009
--- /dev/null
+++ b/src/plugins/nat/det44/det44_api.c
@@ -0,0 +1,633 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) plugin API implementation
+ */
+
+#include <vnet/ip/ip_types_api.h>
+#include <nat/det44/det44.h>
+#include <nat/det44/det44.api_enum.h>
+#include <nat/det44/det44.api_types.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/ip/ip.h>
+
+#include <vlibmemory/api.h>
+
+#define REPLY_MSG_ID_BASE dm->msg_id_base
+#include <vlibapi/api_helper_macros.h>
+
+static void
+vl_api_det44_add_del_map_t_handler (vl_api_det44_add_del_map_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_add_del_map_reply_t *rmp;
+ int rv = 0;
+ ip4_address_t in_addr, out_addr;
+ clib_memcpy (&in_addr, mp->in_addr, 4);
+ clib_memcpy (&out_addr, mp->out_addr, 4);
+ rv = snat_det_add_map (&in_addr, mp->in_plen, &out_addr,
+ mp->out_plen, mp->is_add);
+ REPLY_MACRO (VL_API_DET44_ADD_DEL_MAP_REPLY);
+}
+
+static void
+vl_api_det44_forward_t_handler (vl_api_det44_forward_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_forward_reply_t *rmp;
+ int rv = 0;
+ u16 lo_port = 0, hi_port = 0;
+ snat_det_map_t *m;
+ ip4_address_t in_addr, out_addr;
+
+ out_addr.as_u32 = 0;
+ clib_memcpy (&in_addr, mp->in_addr, 4);
+ m = snat_det_map_by_user (&in_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+
+ snat_det_forward (m, &in_addr, &out_addr, &lo_port);
+ hi_port = lo_port + m->ports_per_host - 1;
+
+send_reply:
+ /* *INDENT-OFF* */
+ REPLY_MACRO2 (VL_API_DET44_FORWARD_REPLY,
+ ({
+ rmp->out_port_lo = ntohs (lo_port);
+ rmp->out_port_hi = ntohs (hi_port);
+ clib_memcpy (rmp->out_addr, &out_addr, 4);
+ }))
+ /* *INDENT-ON* */
+}
+
+static void
+vl_api_det44_reverse_t_handler (vl_api_det44_reverse_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_reverse_reply_t *rmp;
+ int rv = 0;
+ ip4_address_t out_addr, in_addr;
+ snat_det_map_t *m;
+
+ in_addr.as_u32 = 0;
+ clib_memcpy (&out_addr, mp->out_addr, 4);
+ m = snat_det_map_by_out (&out_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+
+ snat_det_reverse (m, &out_addr, htons (mp->out_port), &in_addr);
+
+send_reply:
+ /* *INDENT-OFF* */
+ REPLY_MACRO2 (VL_API_DET44_REVERSE_REPLY,
+ ({
+ clib_memcpy (rmp->in_addr, &in_addr, 4);
+ }))
+ /* *INDENT-ON* */
+}
+
+static void
+sent_det44_map_details (snat_det_map_t * m, vl_api_registration_t * reg,
+ u32 context)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_map_details_t *rmp;
+
+ rmp = vl_msg_api_alloc (sizeof (*rmp));
+ clib_memset (rmp, 0, sizeof (*rmp));
+ rmp->_vl_msg_id = ntohs (VL_API_DET44_MAP_DETAILS + dm->msg_id_base);
+ clib_memcpy (rmp->in_addr, &m->in_addr, 4);
+ rmp->in_plen = m->in_plen;
+ clib_memcpy (rmp->out_addr, &m->out_addr, 4);
+ rmp->out_plen = m->out_plen;
+ rmp->sharing_ratio = htonl (m->sharing_ratio);
+ rmp->ports_per_host = htons (m->ports_per_host);
+ rmp->ses_num = htonl (m->ses_num);
+ rmp->context = context;
+
+ vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_det44_map_dump_t_handler (vl_api_det44_map_dump_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_registration_t *reg;
+ snat_det_map_t *m;
+
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ /* *INDENT-OFF* */
+ vec_foreach(m, dm->det_maps)
+ sent_det44_map_details(m, reg, mp->context);
+ /* *INDENT-ON* */
+}
+
+static void
+vl_api_det44_close_session_out_t_handler (vl_api_det44_close_session_out_t
+ * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_close_session_out_reply_t *rmp;
+ ip4_address_t out_addr, ext_addr, in_addr;
+ snat_det_out_key_t key;
+ snat_det_map_t *m;
+ snat_det_session_t *ses;
+ int rv = 0;
+
+ clib_memcpy (&out_addr, mp->out_addr, 4);
+ clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+ m = snat_det_map_by_out (&out_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ snat_det_reverse (m, &ext_addr, ntohs (mp->out_port), &in_addr);
+ key.ext_host_addr = ext_addr;
+ key.ext_host_port = mp->ext_port;
+ key.out_port = mp->out_port;
+ ses = snat_det_get_ses_by_out (m, &in_addr, key.as_u64);
+ if (!ses)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ snat_det_ses_close (m, ses);
+
+send_reply:
+ REPLY_MACRO (VL_API_DET44_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+vl_api_det44_close_session_in_t_handler (vl_api_det44_close_session_in_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_close_session_in_reply_t *rmp;
+ ip4_address_t in_addr, ext_addr;
+ snat_det_out_key_t key;
+ snat_det_map_t *m;
+ snat_det_session_t *ses;
+ int rv = 0;
+
+ clib_memcpy (&in_addr, mp->in_addr, 4);
+ clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+ m = snat_det_map_by_user (&in_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ key.ext_host_addr = ext_addr;
+ key.ext_host_port = mp->ext_port;
+ ses = snat_det_find_ses_by_in (m, &in_addr, mp->in_port, key);
+ if (!ses)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ snat_det_ses_close (m, ses);
+
+send_reply:
+ REPLY_MACRO (VL_API_DET44_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+send_det44_session_details (snat_det_session_t * s,
+ vl_api_registration_t * reg, u32 context)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_session_details_t *rmp;
+
+ rmp = vl_msg_api_alloc (sizeof (*rmp));
+ clib_memset (rmp, 0, sizeof (*rmp));
+ rmp->_vl_msg_id = ntohs (VL_API_DET44_SESSION_DETAILS + dm->msg_id_base);
+ rmp->in_port = s->in_port;
+ clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4);
+ rmp->ext_port = s->out.ext_host_port;
+ rmp->out_port = s->out.out_port;
+ rmp->state = s->state;
+ rmp->expire = ntohl (s->expire);
+ rmp->context = context;
+
+ vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_det44_session_dump_t_handler (vl_api_det44_session_dump_t * mp)
+{
+ vl_api_registration_t *reg;
+ ip4_address_t user_addr;
+ snat_det_map_t *m;
+ snat_det_session_t *s, empty_ses;
+ u16 i;
+
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ clib_memset (&empty_ses, 0, sizeof (empty_ses));
+ clib_memcpy (&user_addr, mp->user_addr, 4);
+ m = snat_det_map_by_user (&user_addr);
+ if (!m)
+ return;
+
+ s = m->sessions + snat_det_user_ses_offset (&user_addr, m->in_plen);
+ for (i = 0; i < DET44_SES_PER_USER; i++)
+ {
+ if (s->out.as_u64)
+ send_det44_session_details (s, reg, mp->context);
+ s++;
+ }
+}
+
+static void
+ vl_api_det44_plugin_enable_disable_t_handler
+ (vl_api_det44_plugin_enable_disable_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_plugin_enable_disable_reply_t *rmp;
+ det44_config_t c = { 0 };
+ int rv = 0;
+ if (mp->enable)
+ {
+ c.outside_vrf_id = ntohl (mp->outside_vrf);
+ c.inside_vrf_id = ntohl (mp->inside_vrf);
+ rv = det44_plugin_enable (c);
+ }
+ else
+ {
+ rv = det44_plugin_disable ();
+ }
+ REPLY_MACRO (VL_API_DET44_PLUGIN_ENABLE_DISABLE_REPLY);
+}
+
+static void
+ vl_api_det44_interface_add_del_feature_t_handler
+ (vl_api_det44_interface_add_del_feature_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_interface_add_del_feature_reply_t *rmp;
+ u32 sw_if_index = ntohl (mp->sw_if_index);
+ int rv = 0;
+ VALIDATE_SW_IF_INDEX (mp);
+ rv = det44_interface_add_del (sw_if_index, mp->is_inside, !mp->is_add);
+ BAD_SW_IF_INDEX_LABEL;
+ REPLY_MACRO (VL_API_DET44_INTERFACE_ADD_DEL_FEATURE_REPLY);
+}
+
+static void
+det44_send_interface_details (det44_interface_t * i,
+ vl_api_registration_t * reg, u32 context)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_interface_details_t *rmp;
+
+ rmp = vl_msg_api_alloc (sizeof (*rmp));
+ clib_memset (rmp, 0, sizeof (*rmp));
+ rmp->_vl_msg_id = ntohs (VL_API_DET44_INTERFACE_DETAILS + dm->msg_id_base);
+ rmp->sw_if_index = ntohl (i->sw_if_index);
+ rmp->is_outside = det44_interface_is_outside (i);
+ rmp->is_inside = det44_interface_is_inside (i);
+ rmp->context = context;
+ vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_det44_interface_dump_t_handler (vl_api_det44_interface_dump_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_registration_t *reg;
+ det44_interface_t *i;
+
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ /* *INDENT-OFF* */
+ pool_foreach (i, dm->interfaces,
+ ({
+ det44_send_interface_details(i, reg, mp->context);
+ }));
+ /* *INDENT-ON* */
+}
+
+static void
+vl_api_det44_set_timeouts_t_handler (vl_api_det44_set_timeouts_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_set_timeouts_reply_t *rmp;
+ nat_timeouts_t timeouts;
+ int rv = 0;
+ timeouts.udp = ntohl (mp->udp);
+ timeouts.tcp.established = ntohl (mp->tcp_established);
+ timeouts.tcp.transitory = ntohl (mp->tcp_transitory);
+ timeouts.icmp = ntohl (mp->icmp);
+ rv = det44_set_timeouts (&timeouts);
+ REPLY_MACRO (VL_API_DET44_SET_TIMEOUTS_REPLY);
+}
+
+static void
+vl_api_det44_get_timeouts_t_handler (vl_api_det44_get_timeouts_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_det44_get_timeouts_reply_t *rmp;
+ nat_timeouts_t timeouts;
+ int rv = 0;
+ timeouts = det44_get_timeouts ();
+ /* *INDENT-OFF* */
+ REPLY_MACRO2 (VL_API_DET44_GET_TIMEOUTS_REPLY,
+ ({
+ rmp->udp = htonl (timeouts.udp);
+ rmp->tcp_established = htonl (timeouts.tcp.established);
+ rmp->tcp_transitory = htonl (timeouts.tcp.transitory);
+ rmp->icmp = htonl (timeouts.icmp);
+ }))
+ /* *INDENT-ON* */
+}
+
+/*
+ * Obsolete deterministic API to be removed
+ */
+
+static void
+vl_api_nat_det_add_del_map_t_handler (vl_api_nat_det_add_del_map_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_add_del_map_reply_t *rmp;
+ int rv = 0;
+ ip4_address_t in_addr, out_addr;
+
+ clib_memcpy (&in_addr, mp->in_addr, 4);
+ clib_memcpy (&out_addr, mp->out_addr, 4);
+ rv = snat_det_add_map (&in_addr, mp->in_plen, &out_addr,
+ mp->out_plen, mp->is_add);
+ REPLY_MACRO (VL_API_NAT_DET_ADD_DEL_MAP_REPLY);
+}
+
+static void
+vl_api_nat_det_forward_t_handler (vl_api_nat_det_forward_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_forward_reply_t *rmp;
+ int rv = 0;
+ u16 lo_port = 0, hi_port = 0;
+ snat_det_map_t *m;
+ ip4_address_t in_addr, out_addr;
+
+ out_addr.as_u32 = 0;
+ clib_memcpy (&in_addr, mp->in_addr, 4);
+ m = snat_det_map_by_user (&in_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+
+ snat_det_forward (m, &in_addr, &out_addr, &lo_port);
+ hi_port = lo_port + m->ports_per_host - 1;
+
+send_reply:
+ /* *INDENT-OFF* */
+ REPLY_MACRO2 (VL_API_NAT_DET_FORWARD_REPLY,
+ ({
+ rmp->out_port_lo = ntohs (lo_port);
+ rmp->out_port_hi = ntohs (hi_port);
+ clib_memcpy (rmp->out_addr, &out_addr, 4);
+ }))
+ /* *INDENT-ON* */
+}
+
+static void
+vl_api_nat_det_reverse_t_handler (vl_api_nat_det_reverse_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_reverse_reply_t *rmp;
+ int rv = 0;
+ ip4_address_t out_addr, in_addr;
+ snat_det_map_t *m;
+
+ in_addr.as_u32 = 0;
+ clib_memcpy (&out_addr, mp->out_addr, 4);
+ m = snat_det_map_by_out (&out_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+
+ snat_det_reverse (m, &out_addr, htons (mp->out_port), &in_addr);
+
+send_reply:
+ /* *INDENT-OFF* */
+ REPLY_MACRO2 (VL_API_NAT_DET_REVERSE_REPLY,
+ ({
+ clib_memcpy (rmp->in_addr, &in_addr, 4);
+ }))
+ /* *INDENT-ON* */
+}
+
+static void
+sent_nat_det_map_details (snat_det_map_t * m, vl_api_registration_t * reg,
+ u32 context)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_map_details_t *rmp;
+
+ rmp = vl_msg_api_alloc (sizeof (*rmp));
+ clib_memset (rmp, 0, sizeof (*rmp));
+ rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_MAP_DETAILS + dm->msg_id_base);
+ clib_memcpy (rmp->in_addr, &m->in_addr, 4);
+ rmp->in_plen = m->in_plen;
+ clib_memcpy (rmp->out_addr, &m->out_addr, 4);
+ rmp->out_plen = m->out_plen;
+ rmp->sharing_ratio = htonl (m->sharing_ratio);
+ rmp->ports_per_host = htons (m->ports_per_host);
+ rmp->ses_num = htonl (m->ses_num);
+ rmp->context = context;
+
+ vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_nat_det_map_dump_t_handler (vl_api_nat_det_map_dump_t * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_registration_t *reg;
+ snat_det_map_t *m;
+
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ /* *INDENT-OFF* */
+ vec_foreach(m, dm->det_maps)
+ sent_nat_det_map_details(m, reg, mp->context);
+ /* *INDENT-ON* */
+}
+
+static void
+vl_api_nat_det_close_session_out_t_handler (vl_api_nat_det_close_session_out_t
+ * mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_close_session_out_reply_t *rmp;
+ ip4_address_t out_addr, ext_addr, in_addr;
+ snat_det_out_key_t key;
+ snat_det_map_t *m;
+ snat_det_session_t *ses;
+ int rv = 0;
+
+ clib_memcpy (&out_addr, mp->out_addr, 4);
+ clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+ m = snat_det_map_by_out (&out_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ snat_det_reverse (m, &ext_addr, ntohs (mp->out_port), &in_addr);
+ key.ext_host_addr = ext_addr;
+ key.ext_host_port = mp->ext_port;
+ key.out_port = mp->out_port;
+ ses = snat_det_get_ses_by_out (m, &in_addr, key.as_u64);
+ if (!ses)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ snat_det_ses_close (m, ses);
+
+send_reply:
+ REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+vl_api_nat_det_close_session_in_t_handler (vl_api_nat_det_close_session_in_t *
+ mp)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_close_session_in_reply_t *rmp;
+ ip4_address_t in_addr, ext_addr;
+ snat_det_out_key_t key;
+ snat_det_map_t *m;
+ snat_det_session_t *ses;
+ int rv = 0;
+
+ clib_memcpy (&in_addr, mp->in_addr, 4);
+ clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+ m = snat_det_map_by_user (&in_addr);
+ if (!m)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ key.ext_host_addr = ext_addr;
+ key.ext_host_port = mp->ext_port;
+ ses = snat_det_find_ses_by_in (m, &in_addr, mp->in_port, key);
+ if (!ses)
+ {
+ rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+ goto send_reply;
+ }
+ snat_det_ses_close (m, ses);
+
+send_reply:
+ REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+send_nat_det_session_details (snat_det_session_t * s,
+ vl_api_registration_t * reg, u32 context)
+{
+ det44_main_t *dm = &det44_main;
+ vl_api_nat_det_session_details_t *rmp;
+
+ rmp = vl_msg_api_alloc (sizeof (*rmp));
+ clib_memset (rmp, 0, sizeof (*rmp));
+ rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_SESSION_DETAILS + dm->msg_id_base);
+ rmp->in_port = s->in_port;
+ clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4);
+ rmp->ext_port = s->out.ext_host_port;
+ rmp->out_port = s->out.out_port;
+ rmp->state = s->state;
+ rmp->expire = ntohl (s->expire);
+ rmp->context = context;
+
+ vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_nat_det_session_dump_t_handler (vl_api_nat_det_session_dump_t * mp)
+{
+ vl_api_registration_t *reg;
+ ip4_address_t user_addr;
+ snat_det_map_t *m;
+ snat_det_session_t *s, empty_ses;
+ u16 i;
+
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ clib_memset (&empty_ses, 0, sizeof (empty_ses));
+ clib_memcpy (&user_addr, mp->user_addr, 4);
+ m = snat_det_map_by_user (&user_addr);
+ if (!m)
+ return;
+
+ s = m->sessions + snat_det_user_ses_offset (&user_addr, m->in_plen);
+ for (i = 0; i < DET44_SES_PER_USER; i++)
+ {
+ if (s->out.as_u64)
+ send_nat_det_session_details (s, reg, mp->context);
+ s++;
+ }
+}
+
+/* API definitions */
+#include <vnet/format_fns.h>
+#include <nat/det44/det44.api.c>
+
+/* Set up the API message handling tables */
+clib_error_t *
+det44_api_hookup (vlib_main_t * vm)
+{
+ det44_main_t *dm = &det44_main;
+ dm->msg_id_base = setup_message_id_table ();
+ return 0;
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_cli.c b/src/plugins/nat/det44/det44_cli.c
new file mode 100644
index 00000000000..7085eba06ef
--- /dev/null
+++ b/src/plugins/nat/det44/det44_cli.c
@@ -0,0 +1,697 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * @file
+ * @brief DET44 CLI
+ */
+#include <nat/det44/det44.h>
+
+static clib_error_t *
+det44_map_command_fn (vlib_main_t * vm, unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ ip4_address_t in_addr, out_addr;
+ u32 in_plen, out_plen;
+ int is_add = 1, rv;
+ clib_error_t *error = 0;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat
+ (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
+ ;
+ else
+ if (unformat
+ (line_input, "out %U/%u", unformat_ip4_address, &out_addr,
+ &out_plen))
+ ;
+ else if (unformat (line_input, "del"))
+ is_add = 0;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ rv = snat_det_add_map (&in_addr, (u8) in_plen, &out_addr, (u8) out_plen,
+ is_add);
+
+ if (rv)
+ {
+ error = clib_error_return (0, "snat_det_add_map return %d", rv);
+ goto done;
+ }
+
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+static clib_error_t *
+det44_show_mappings_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ det44_main_t *dm = &det44_main;
+ snat_det_map_t *mp;
+ vlib_cli_output (vm, "NAT44 deterministic mappings:");
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps,
+ ({
+ vlib_cli_output (vm, " in %U/%d out %U/%d\n",
+ format_ip4_address, &mp->in_addr, mp->in_plen,
+ format_ip4_address, &mp->out_addr, mp->out_plen);
+ vlib_cli_output (vm, " outside address sharing ratio: %d\n",
+ mp->sharing_ratio);
+ vlib_cli_output (vm, " number of ports per inside host: %d\n",
+ mp->ports_per_host);
+ vlib_cli_output (vm, " sessions number: %d\n", mp->ses_num);
+ }));
+ /* *INDENT-ON* */
+ return 0;
+}
+
+static clib_error_t *
+det44_forward_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ ip4_address_t in_addr, out_addr;
+ u16 lo_port;
+ snat_det_map_t *mp;
+ clib_error_t *error = 0;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
+ ;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ mp = snat_det_map_by_user (&in_addr);
+ if (!mp)
+ vlib_cli_output (vm, "no match");
+ else
+ {
+ snat_det_forward (mp, &in_addr, &out_addr, &lo_port);
+ vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
+ lo_port, lo_port + mp->ports_per_host - 1);
+ }
+
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+static clib_error_t *
+det44_reverse_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ ip4_address_t in_addr, out_addr;
+ clib_error_t *error = 0;
+ snat_det_map_t *mp;
+ u32 out_port;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat
+ (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
+ ;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ if (out_port < 1024 || out_port > 65535)
+ {
+ error = clib_error_return (0, "wrong port, must be <1024-65535>");
+ goto done;
+ }
+
+ mp = snat_det_map_by_out (&out_addr);
+ if (!mp)
+ vlib_cli_output (vm, "no match");
+ else
+ {
+ snat_det_reverse (mp, &out_addr, (u16) out_port, &in_addr);
+ vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
+ }
+
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+static clib_error_t *
+det44_show_sessions_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ det44_main_t *dm = &det44_main;
+ snat_det_session_t *ses;
+ snat_det_map_t *mp;
+ vlib_cli_output (vm, "NAT44 deterministic sessions:");
+ /* *INDENT-OFF* */
+ pool_foreach (mp, dm->det_maps,
+ ({
+ int i;
+ vec_foreach_index (i, mp->sessions)
+ {
+ ses = vec_elt_at_index (mp->sessions, i);
+ if (ses->in_port)
+ vlib_cli_output (vm, " %U", format_det_map_ses, mp, ses, &i);
+ }
+ }));
+ /* *INDENT-ON* */
+ return 0;
+}
+
+static clib_error_t *
+det44_close_session_out_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ ip4_address_t out_addr, ext_addr, in_addr;
+ u32 out_port, ext_port;
+ snat_det_map_t *mp;
+ snat_det_session_t *ses;
+ snat_det_out_key_t key;
+ clib_error_t *error = 0;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "%U:%d %U:%d",
+ unformat_ip4_address, &out_addr, &out_port,
+ unformat_ip4_address, &ext_addr, &ext_port))
+ ;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ unformat_free (line_input);
+
+ mp = snat_det_map_by_out (&out_addr);
+ if (!mp)
+ vlib_cli_output (vm, "no match");
+ else
+ {
+ snat_det_reverse (mp, &ext_addr, (u16) out_port, &in_addr);
+ key.ext_host_addr = out_addr;
+ key.ext_host_port = ntohs ((u16) ext_port);
+ key.out_port = ntohs ((u16) out_port);
+ ses = snat_det_get_ses_by_out (mp, &out_addr, key.as_u64);
+ if (!ses)
+ vlib_cli_output (vm, "no match");
+ else
+ snat_det_ses_close (mp, ses);
+ }
+
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+static clib_error_t *
+det44_close_session_in_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ ip4_address_t in_addr, ext_addr;
+ u32 in_port, ext_port;
+ snat_det_map_t *mp;
+ snat_det_session_t *ses;
+ snat_det_out_key_t key;
+ clib_error_t *error = 0;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "%U:%d %U:%d",
+ unformat_ip4_address, &in_addr, &in_port,
+ unformat_ip4_address, &ext_addr, &ext_port))
+ ;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ unformat_free (line_input);
+
+ mp = snat_det_map_by_user (&in_addr);
+ if (!mp)
+ vlib_cli_output (vm, "no match");
+ else
+ {
+ key.ext_host_addr = ext_addr;
+ key.ext_host_port = ntohs ((u16) ext_port);
+ ses =
+ snat_det_find_ses_by_in (mp, &in_addr, ntohs ((u16) in_port), key);
+ if (!ses)
+ vlib_cli_output (vm, "no match");
+ else
+ snat_det_ses_close (mp, ses);
+ }
+
+done:
+ unformat_free (line_input);
+
+ return error;
+}
+
+static clib_error_t *
+det44_set_timeouts_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ nat_timeouts_t timeouts = { 0 };
+ clib_error_t *error = 0;
+ u8 reset = 0;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "udp %u", &timeouts.udp));
+ else if (unformat (line_input, "tcp established %u",
+ &timeouts.tcp.established));
+ else if (unformat (line_input, "tcp transitory %u",
+ &timeouts.tcp.transitory));
+ else if (unformat (line_input, "icmp %u", &timeouts.icmp));
+ else if (unformat (line_input, "reset"))
+ reset = 1;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ if (!reset)
+ {
+ if (det44_set_timeouts (&timeouts))
+ {
+ error = clib_error_return (0, "error configuring timeouts");
+ }
+ }
+ else
+ det44_reset_timeouts ();
+done:
+ unformat_free (line_input);
+ return error;
+}
+
+static clib_error_t *
+det44_show_timeouts_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ nat_timeouts_t timeouts;
+ timeouts = det44_get_timeouts ();
+ vlib_cli_output (vm, "udp timeout: %dsec", timeouts.udp);
+ vlib_cli_output (vm, "tcp established timeout: %dsec",
+ timeouts.tcp.established);
+ vlib_cli_output (vm, "tcp transitory timeout: %dsec",
+ timeouts.tcp.transitory);
+ vlib_cli_output (vm, "icmp timeout: %dsec", timeouts.icmp);
+ return 0;
+}
+
+static clib_error_t *
+det44_plugin_enable_disable_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ u8 enable = 0, is_set = 0;
+ clib_error_t *error = 0;
+ det44_config_t c = { 0 };
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (!is_set && unformat (line_input, "enable"))
+ {
+ unformat (line_input, "inside vrf %u", &c.inside_vrf_id);
+ unformat (line_input, "outside vrf %u", &c.outside_vrf_id);
+ enable = 1;
+ }
+ else if (!is_set && unformat (line_input, "disable"));
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ is_set = 1;
+ }
+
+ if (enable)
+ {
+ if (det44_plugin_enable (c))
+ error = clib_error_return (0, "plugin enable failed");
+ }
+ else
+ {
+ if (det44_plugin_disable ())
+ error = clib_error_return (0, "plugin disable failed");
+ }
+done:
+ unformat_free (line_input);
+ return error;
+}
+
+typedef struct
+{
+ u32 sw_if_index;
+ u8 is_inside;
+} sw_if_indices_t;
+
+static clib_error_t *
+det44_feature_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ unformat_input_t _line_input, *line_input = &_line_input;
+ sw_if_indices_t *sw_if_indices = 0, *p, e;
+ vnet_main_t *vnm = vnet_get_main ();
+ clib_error_t *error = 0;
+ u8 is_del = 0;
+
+ if (!unformat_user (input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ {
+ if (unformat (line_input, "inside %U", unformat_vnet_sw_interface,
+ vnm, &e.sw_if_index))
+ {
+ e.is_inside = 1;
+ vec_add1 (sw_if_indices, e);
+ }
+ else if (unformat (line_input, "outside %U", unformat_vnet_sw_interface,
+ vnm, &e.sw_if_index))
+ {
+ e.is_inside = 0;
+ vec_add1 (sw_if_indices, e);
+ }
+ else if (unformat (line_input, "del"))
+ is_del = 1;
+ else
+ {
+ error = clib_error_return (0, "unknown input '%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+
+ /* *INDENT-OFF* */
+ vec_foreach (p, sw_if_indices)
+ {
+ if (det44_interface_add_del (p->sw_if_index, p->is_inside, is_del))
+ {
+ error = clib_error_return (0, "%s %s %U failed",
+ is_del ? "del" : "add",
+ p->is_inside ? "inside" : "outside",
+ format_vnet_sw_if_index_name,
+ vnm, p->sw_if_index);
+ break;
+ }
+ }
+ /* *INDENT-ON* */
+done:
+ unformat_free (line_input);
+ vec_free (sw_if_indices);
+ return error;
+}
+
+static clib_error_t *
+det44_show_interfaces_command_fn (vlib_main_t * vm, unformat_input_t * input,
+ vlib_cli_command_t * cmd)
+{
+ vnet_main_t *vnm = vnet_get_main ();
+ det44_main_t *dm = &det44_main;
+ det44_interface_t *i;
+ vlib_cli_output (vm, "DET44 interfaces:");
+ /* *INDENT-OFF* */
+ pool_foreach (i, dm->interfaces,
+ ({
+ vlib_cli_output (vm, " %U %s", format_vnet_sw_if_index_name, vnm,
+ i->sw_if_index,
+ (det44_interface_is_inside(i) &&
+ det44_interface_is_outside(i)) ? "in out" :
+ (det44_interface_is_inside(i) ? "in" : "out"));
+ }));
+ /* *INDENT-ON* */
+ return 0;
+}
+
+/* *INDENT-OFF* */
+/*?
+ * @cliexpar
+ * @cliexstart{det44 add}
+ * Create bijective mapping of inside address to outside address and port range
+ * pairs, with the purpose of enabling DET44 to reduce logging in CGN
+ * deployments.
+ * To create mapping between inside network 10.0.0.0/18 and
+ * outside network 1.1.1.0/30 use:
+ * # vpp# det44 add in 10.0.0.0/18 out 1.1.1.0/30
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_map_command, static) = {
+ .path = "det44 add",
+ .short_help = "det44 add in <addr>/<plen> out <addr>/<plen> [del]",
+ .function = det44_map_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexpstart{show det44 mappings}
+ * Show DET44 mappings
+ * vpp# show det44 mappings
+ * DET44 mappings:
+ * in 10.0.0.0/24 out 1.1.1.1/32
+ * outside address sharing ratio: 256
+ * number of ports per inside host: 252
+ * sessions number: 0
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_mappings_command, static) = {
+ .path = "show det44 mappings",
+ .short_help = "show det44 mappings",
+ .function = det44_show_mappings_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 forward}
+ * Return outside address and port range from inside address for DET44.
+ * To obtain outside address and port of inside host use:
+ * vpp# det44 forward 10.0.0.2
+ * 1.1.1.0:<1054-1068>
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_forward_command, static) = {
+ .path = "det44 forward",
+ .short_help = "det44 forward <addr>",
+ .function = det44_forward_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 reverse}
+ * Return inside address from outside address and port for DET44.
+ * To obtain inside host address from outside address and port use:
+ * #vpp det44 reverse 1.1.1.1:1276
+ * 10.0.16.16
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_reverse_command, static) = {
+ .path = "det44 reverse",
+ .short_help = "det44 reverse <addr>:<port>",
+ .function = det44_reverse_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{show det44 sessions}
+ * Show DET44 sessions.
+ * vpp# show det44 sessions
+ * DET44 sessions:
+ * in 10.0.0.3:3005 out 1.1.1.2:1146 external host 172.16.1.2:3006 state: udp-active expire: 306
+ * in 10.0.0.3:3000 out 1.1.1.2:1141 external host 172.16.1.2:3001 state: udp-active expire: 306
+ * in 10.0.0.4:3005 out 1.1.1.2:1177 external host 172.16.1.2:3006 state: udp-active expire: 306
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_sessions_command, static) = {
+ .path = "show det44 sessions",
+ .short_help = "show det44 sessions",
+ .function = det44_show_sessions_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 close session out}
+ * Close session using outside ip address and port
+ * and external ip address and port, use:
+ * vpp# det44 close session out 1.1.1.1:1276 2.2.2.2:2387
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_close_sesion_out_command, static) = {
+ .path = "det44 close session out",
+ .short_help = "det44 close session out "
+ "<out_addr>:<out_port> <ext_addr>:<ext_port>",
+ .function = det44_close_session_out_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 deterministic close session in}
+ * Close session using inside ip address and port
+ * and external ip address and port, use:
+ * vpp# det44 close session in 3.3.3.3:3487 2.2.2.2:2387
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_close_session_in_command, static) = {
+ .path = "det44 close session in",
+ .short_help = "det44 close session in "
+ "<in_addr>:<in_port> <ext_addr>:<ext_port>",
+ .function = det44_close_session_in_fn,
+};
+/* *INDENT-ON* */
+
+/*?
+ * @cliexpar
+ * @cliexstart{set det44 timeout}
+ * Set values of timeouts for DET44 sessions (in seconds), use:
+ * vpp# set det44 timeouts udp 120 tcp established 7500 tcp transitory 250 icmp 90
+ * To reset default values use:
+ * vpp# set det44 timeouts reset
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_set_timeouts_command, static) =
+{
+.path = "set det44 timeouts",.short_help =
+ "set det44 timeouts <[udp <sec>] [tcp established <sec>] "
+ "[tcp transitory <sec>] [icmp <sec>]|reset>",.function =
+ det44_set_timeouts_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{show det44 timeouts}
+ * Show values of timeouts for DET44 sessions.
+ * vpp# show det44 timeouts
+ * udp timeout: 300sec
+ * tcp-established timeout: 7440sec
+ * tcp-transitory timeout: 240sec
+ * icmp timeout: 60sec
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_timeouts_command, static) =
+{
+.path = "show det44 timeouts",.short_help =
+ "show det44 timeouts",.function = det44_show_timeouts_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 plugin}
+ * Enable/disable DET44 plugin.
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_plugin_enable_disable_command, static) =
+{
+.path = "det44 plugin",.short_help =
+ "det44 plugin <enable [inside vrf] [outside vrf]|disable>",.function =
+ det44_plugin_enable_disable_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{set interface det44}
+ * Enable/disable DET44 feature on the interface.
+ * To enable DET44 feature with local network interface use:
+ * vpp# set interface det44 inside GigabitEthernet0/8/0
+ * To enable DET44 feature with external network interface use:
+ * vpp# set interface det44 outside GigabitEthernet0/a/0
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_feature_command, static) =
+{
+.path = "set interface det44",.short_help =
+ "set interface det44 inside <intfc> outside <intfc> [del]",.function =
+ det44_feature_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{show det44 interfaces}
+ * Show interfaces with DET44 feature.
+ * vpp# show det44 interfaces
+ * DET44 interfaces:
+ * GigabitEthernet0/8/0 in
+ * GigabitEthernet0/a/0 out
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_interfaces_command, static) =
+{
+.path = "show det44 interfaces",.short_help =
+ "show det44 interfaces",.function = det44_show_interfaces_command_fn,};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_in2out.c b/src/plugins/nat/det44/det44_in2out.c
new file mode 100644
index 00000000000..3ed1cc77ff6
--- /dev/null
+++ b/src/plugins/nat/det44/det44_in2out.c
@@ -0,0 +1,1067 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) inside to outside translation
+ */
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vppinfra/error.h>
+#include <vppinfra/elog.h>
+
+#include <nat/det44/det44.h>
+#include <nat/det44/det44_inlines.h>
+
+#include <nat/lib/lib.h>
+#include <nat/lib/inlines.h>
+#include <nat/lib/nat_inlines.h>
+
+typedef enum
+{
+ DET44_IN2OUT_NEXT_LOOKUP,
+ DET44_IN2OUT_NEXT_DROP,
+ DET44_IN2OUT_NEXT_ICMP_ERROR,
+ DET44_IN2OUT_N_NEXT,
+} det44_in2out_next_t;
+
+typedef struct
+{
+ u32 sw_if_index;
+ u32 next_index;
+ u32 session_index;
+} det44_in2out_trace_t;
+
+#define foreach_det44_in2out_error \
+_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
+_(NO_TRANSLATION, "No translation") \
+_(BAD_ICMP_TYPE, "unsupported ICMP type") \
+_(OUT_OF_PORTS, "Out of ports") \
+_(IN2OUT_PACKETS, "Good in2out packets processed")
+
+typedef enum
+{
+#define _(sym,str) DET44_IN2OUT_ERROR_##sym,
+ foreach_det44_in2out_error
+#undef _
+ DET44_IN2OUT_N_ERROR,
+} det44_in2out_error_t;
+
+static char *det44_in2out_error_strings[] = {
+#define _(sym,string) string,
+ foreach_det44_in2out_error
+#undef _
+};
+
+static u8 *
+format_det44_in2out_trace (u8 * s, va_list * args)
+{
+ CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+ CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+ det44_in2out_trace_t *t = va_arg (*args, det44_in2out_trace_t *);
+
+ s = format (s, "DET44_IN2OUT: sw_if_index %d, next index %d, session %d",
+ t->sw_if_index, t->next_index, t->session_index);
+
+ return s;
+}
+
+#ifndef CLIB_MARCH_VARIANT
+/**
+ * Get address and port values to be used for ICMP packet translation
+ * and create session if needed
+ *
+ * @param[in,out] node NAT node runtime
+ * @param[in] thread_index thread index
+ * @param[in,out] b0 buffer containing packet to be translated
+ * @param[in,out] ip0 ip header
+ * @param[out] p_proto protocol used for matching
+ * @param[out] p_value address and port after NAT translation
+ * @param[out] p_dont_translate if packet should not be translated
+ * @param d optional parameter
+ * @param e optional parameter
+ */
+u32
+icmp_match_in2out_det (vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, ip4_address_t * addr,
+ u16 * port, u32 * fib_index,
+ nat_protocol_t * proto, void *d, void *e,
+ u8 * dont_translate)
+{
+ det44_main_t *dm = &det44_main;
+ vlib_main_t *vm = vlib_get_main ();
+ icmp46_header_t *icmp0;
+ u32 sw_if_index0;
+ u32 rx_fib_index0;
+ nat_protocol_t protocol;
+ snat_det_out_key_t key0;
+ u32 next0 = ~0;
+ icmp_echo_header_t *echo0, *inner_echo0 = 0;
+ ip4_header_t *inner_ip0;
+ void *l4_header = 0;
+ icmp46_header_t *inner_icmp0;
+ snat_det_map_t *mp0 = 0;
+ ip4_address_t new_addr0;
+ u16 lo_port0, i0;
+ snat_det_session_t *ses0 = 0;
+ ip4_address_t in_addr;
+ u16 in_port;
+ *dont_translate = 0;
+
+ icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
+ echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+ sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+ rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+
+ if (!icmp_type_is_error_message
+ (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
+ {
+ protocol = NAT_PROTOCOL_ICMP;
+ in_addr = ip0->src_address;
+ in_port = vnet_buffer (b0)->ip.reass.l4_src_port;
+ }
+ else
+ {
+ /* if error message, then it's not fragmented and we can access it */
+ inner_ip0 = (ip4_header_t *) (echo0 + 1);
+ l4_header = ip4_next_header (inner_ip0);
+ protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
+ in_addr = inner_ip0->dst_address;
+ switch (protocol)
+ {
+ case NAT_PROTOCOL_ICMP:
+ inner_icmp0 = (icmp46_header_t *) l4_header;
+ inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+ in_port = inner_echo0->identifier;
+ break;
+ case NAT_PROTOCOL_UDP:
+ case NAT_PROTOCOL_TCP:
+ in_port = ((tcp_udp_header_t *) l4_header)->dst_port;
+ break;
+ default:
+ b0->error = node->errors[DET44_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ goto out;
+ }
+ }
+
+ mp0 = snat_det_map_by_user (&in_addr);
+ if (PREDICT_FALSE (!mp0))
+ {
+ if (PREDICT_FALSE (det44_translate (node, sw_if_index0, ip0,
+ IP_PROTOCOL_ICMP, rx_fib_index0)))
+ {
+ *dont_translate = 1;
+ goto out;
+ }
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+ goto out;
+ }
+
+ snat_det_forward (mp0, &in_addr, &new_addr0, &lo_port0);
+
+ key0.ext_host_addr = ip0->dst_address;
+ key0.ext_host_port = 0;
+
+ ses0 = snat_det_find_ses_by_in (mp0, &in_addr, in_port, key0);
+ if (PREDICT_FALSE (!ses0))
+ {
+ if (PREDICT_FALSE (det44_translate (node, sw_if_index0, ip0,
+ IP_PROTOCOL_ICMP, rx_fib_index0)))
+ {
+ *dont_translate = 1;
+ goto out;
+ }
+ if (icmp0->type != ICMP4_echo_request)
+ {
+ b0->error = node->errors[DET44_IN2OUT_ERROR_BAD_ICMP_TYPE];
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ goto out;
+ }
+ for (i0 = 0; i0 < mp0->ports_per_host; i0++)
+ {
+ key0.out_port = clib_host_to_net_u16 (lo_port0 +
+ ((i0 +
+ clib_net_to_host_u16
+ (echo0->identifier)) %
+ mp0->ports_per_host));
+
+ if (snat_det_get_ses_by_out (mp0, &in_addr, key0.as_u64))
+ continue;
+
+ ses0 =
+ snat_det_ses_create (thread_index, mp0,
+ &in_addr, echo0->identifier, &key0);
+ break;
+ }
+ if (PREDICT_FALSE (!ses0))
+ {
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ b0->error = node->errors[DET44_IN2OUT_ERROR_OUT_OF_PORTS];
+ goto out;
+ }
+ }
+
+ if (PREDICT_FALSE
+ (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_request
+ && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
+ reass.icmp_type_or_tcp_flags)))
+ {
+ b0->error = node->errors[DET44_IN2OUT_ERROR_BAD_ICMP_TYPE];
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ goto out;
+ }
+
+ u32 now = (u32) vlib_time_now (vm);
+
+ ses0->state = DET44_SESSION_ICMP_ACTIVE;
+ ses0->expire = now + dm->timeouts.icmp;
+
+out:
+ *proto = protocol;
+ if (ses0)
+ {
+ *addr = new_addr0;
+ *fib_index = dm->outside_fib_index;
+ *port = ses0->out.out_port;
+ }
+ if (d)
+ *(snat_det_session_t **) d = ses0;
+ if (e)
+ *(snat_det_map_t **) e = mp0;
+ return next0;
+}
+#endif
+
+#ifndef CLIB_MARCH_VARIANT
+u32
+det44_icmp_in2out (vlib_buffer_t * b0,
+ ip4_header_t * ip0,
+ icmp46_header_t * icmp0,
+ u32 sw_if_index0,
+ u32 rx_fib_index0,
+ vlib_node_runtime_t * node,
+ u32 next0, u32 thread_index, void *d, void *e)
+{
+ vlib_main_t *vm = vlib_get_main ();
+ u16 old_id0, new_id0, port, checksum0, old_checksum0, new_checksum0;
+ u32 new_addr0, old_addr0, next0_tmp, fib_index;
+ icmp_echo_header_t *echo0, *inner_echo0;
+ icmp46_header_t *inner_icmp0;
+ ip4_header_t *inner_ip0;
+ ip4_address_t addr;
+ void *l4_header;
+ u8 dont_translate;
+ ip_csum_t sum0;
+ nat_protocol_t protocol;
+
+ echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+ next0_tmp = icmp_match_in2out_det (node, thread_index, b0, ip0,
+ &addr, &port, &fib_index, &protocol,
+ d, e, &dont_translate);
+ if (next0_tmp != ~0)
+ next0 = next0_tmp;
+ if (next0 == DET44_IN2OUT_NEXT_DROP || dont_translate)
+ goto out;
+
+ if (PREDICT_TRUE (!ip4_is_fragment (ip0)))
+ {
+ sum0 =
+ ip_incremental_checksum_buffer (vm, b0,
+ (u8 *) icmp0 -
+ (u8 *) vlib_buffer_get_current (b0),
+ ntohs (ip0->length) -
+ ip4_header_bytes (ip0), 0);
+ checksum0 = ~ip_csum_fold (sum0);
+ if (PREDICT_FALSE (checksum0 != 0 && checksum0 != 0xffff))
+ {
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ goto out;
+ }
+ }
+
+ old_addr0 = ip0->src_address.as_u32;
+ new_addr0 = ip0->src_address.as_u32 = addr.as_u32;
+
+ sum0 = ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+ src_address /* changed member */ );
+ ip0->checksum = ip_csum_fold (sum0);
+
+ if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
+ {
+ if (icmp0->checksum == 0)
+ icmp0->checksum = 0xffff;
+
+ if (!icmp_type_is_error_message (icmp0->type))
+ {
+ new_id0 = port;
+ if (PREDICT_FALSE (new_id0 != echo0->identifier))
+ {
+ old_id0 = echo0->identifier;
+ new_id0 = port;
+ echo0->identifier = new_id0;
+
+ sum0 = icmp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+ identifier);
+ icmp0->checksum = ip_csum_fold (sum0);
+ }
+ }
+ else
+ {
+ inner_ip0 = (ip4_header_t *) (echo0 + 1);
+ l4_header = ip4_next_header (inner_ip0);
+
+ if (!ip4_header_checksum_is_valid (inner_ip0))
+ {
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ goto out;
+ }
+
+ /* update inner destination IP address */
+ old_addr0 = inner_ip0->dst_address.as_u32;
+ inner_ip0->dst_address = addr;
+ new_addr0 = inner_ip0->dst_address.as_u32;
+ sum0 = icmp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+ dst_address /* changed member */ );
+ icmp0->checksum = ip_csum_fold (sum0);
+
+ /* update inner IP header checksum */
+ old_checksum0 = inner_ip0->checksum;
+ sum0 = inner_ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+ dst_address /* changed member */ );
+ inner_ip0->checksum = ip_csum_fold (sum0);
+ new_checksum0 = inner_ip0->checksum;
+ sum0 = icmp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_checksum0, new_checksum0, ip4_header_t,
+ checksum);
+ icmp0->checksum = ip_csum_fold (sum0);
+
+ switch (protocol)
+ {
+ case NAT_PROTOCOL_ICMP:
+ inner_icmp0 = (icmp46_header_t *) l4_header;
+ inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+
+ old_id0 = inner_echo0->identifier;
+ new_id0 = port;
+ inner_echo0->identifier = new_id0;
+
+ sum0 = icmp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+ identifier);
+ icmp0->checksum = ip_csum_fold (sum0);
+ break;
+ case NAT_PROTOCOL_UDP:
+ case NAT_PROTOCOL_TCP:
+ old_id0 = ((tcp_udp_header_t *) l4_header)->dst_port;
+ new_id0 = port;
+ ((tcp_udp_header_t *) l4_header)->dst_port = new_id0;
+
+ sum0 = icmp0->checksum;
+ sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t,
+ dst_port);
+ icmp0->checksum = ip_csum_fold (sum0);
+ break;
+ default:
+ ASSERT (0);
+ }
+ }
+ }
+
+ if (vnet_buffer (b0)->sw_if_index[VLIB_TX] == ~0)
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index;
+out:
+ return next0;
+}
+#endif
+
+VLIB_NODE_FN (det44_in2out_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ u32 n_left_from, *from, *to_next;
+ det44_in2out_next_t next_index;
+ u32 pkts_processed = 0;
+ det44_main_t *dm = &det44_main;
+ u32 now = (u32) vlib_time_now (vm);
+ u32 thread_index = vm->thread_index;
+
+ from = vlib_frame_vector_args (frame);
+ n_left_from = frame->n_vectors;
+ next_index = node->cached_next_index;
+
+ while (n_left_from > 0)
+ {
+ u32 n_left_to_next;
+
+ vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+ while (n_left_from >= 4 && n_left_to_next >= 2)
+ {
+ u32 bi0, bi1;
+ vlib_buffer_t *b0, *b1;
+ u32 next0, next1;
+ u32 sw_if_index0, sw_if_index1;
+ ip4_header_t *ip0, *ip1;
+ ip_csum_t sum0, sum1;
+ ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
+ u16 old_port0, new_port0, lo_port0, i0;
+ u16 old_port1, new_port1, lo_port1, i1;
+ udp_header_t *udp0, *udp1;
+ tcp_header_t *tcp0, *tcp1;
+ u32 proto0, proto1;
+ snat_det_out_key_t key0, key1;
+ snat_det_map_t *mp0, *mp1;
+ snat_det_session_t *ses0 = 0, *ses1 = 0;
+ u32 rx_fib_index0, rx_fib_index1;
+ icmp46_header_t *icmp0, *icmp1;
+
+ /* Prefetch next iteration. */
+ {
+ vlib_buffer_t *p2, *p3;
+
+ p2 = vlib_get_buffer (vm, from[2]);
+ p3 = vlib_get_buffer (vm, from[3]);
+
+ vlib_prefetch_buffer_header (p2, LOAD);
+ vlib_prefetch_buffer_header (p3, LOAD);
+
+ CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ }
+
+ /* speculatively enqueue b0 and b1 to the current next frame */
+ to_next[0] = bi0 = from[0];
+ to_next[1] = bi1 = from[1];
+ from += 2;
+ to_next += 2;
+ n_left_from -= 2;
+ n_left_to_next -= 2;
+
+ b0 = vlib_get_buffer (vm, bi0);
+ b1 = vlib_get_buffer (vm, bi1);
+
+ next0 = DET44_IN2OUT_NEXT_LOOKUP;
+ next1 = DET44_IN2OUT_NEXT_LOOKUP;
+
+ ip0 = vlib_buffer_get_current (b0);
+ udp0 = ip4_next_header (ip0);
+ tcp0 = (tcp_header_t *) udp0;
+
+ sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+ if (PREDICT_FALSE (ip0->ttl == 1))
+ {
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+ ICMP4_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+ goto trace0;
+ }
+
+ proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+ if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+ {
+ rx_fib_index0 =
+ ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+ icmp0 = (icmp46_header_t *) udp0;
+
+ // TODO:
+ next0 = det44_icmp_in2out (b0, ip0, icmp0, sw_if_index0,
+ rx_fib_index0, node, next0,
+ thread_index, &ses0, &mp0);
+ goto trace0;
+ }
+
+ mp0 = snat_det_map_by_user (&ip0->src_address);
+ if (PREDICT_FALSE (!mp0))
+ {
+ det44_log_info ("no match for internal host %U",
+ format_ip4_address, &ip0->src_address);
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+ goto trace0;
+ }
+
+ snat_det_forward (mp0, &ip0->src_address, &new_addr0, &lo_port0);
+
+ key0.ext_host_addr = ip0->dst_address;
+ key0.ext_host_port = tcp0->dst;
+
+ ses0 =
+ snat_det_find_ses_by_in (mp0, &ip0->src_address, tcp0->src, key0);
+ if (PREDICT_FALSE (!ses0))
+ {
+ for (i0 = 0; i0 < mp0->ports_per_host; i0++)
+ {
+ key0.out_port = clib_host_to_net_u16 (lo_port0 +
+ ((i0 +
+ clib_net_to_host_u16
+ (tcp0->src)) %
+ mp0->
+ ports_per_host));
+
+ if (snat_det_get_ses_by_out
+ (mp0, &ip0->src_address, key0.as_u64))
+ continue;
+
+ ses0 =
+ snat_det_ses_create (thread_index, mp0, &ip0->src_address,
+ tcp0->src, &key0);
+ break;
+ }
+ if (PREDICT_FALSE (!ses0))
+ {
+ /* too many sessions for user, send ICMP error packet */
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b0,
+ ICMP4_destination_unreachable,
+ ICMP4_destination_unreachable_destination_unreachable_host,
+ 0);
+ next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+ goto trace0;
+ }
+ }
+
+ old_port0 = udp0->src_port;
+ udp0->src_port = new_port0 = ses0->out.out_port;
+
+ old_addr0.as_u32 = ip0->src_address.as_u32;
+ ip0->src_address.as_u32 = new_addr0.as_u32;
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->outside_fib_index;
+
+ sum0 = ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ src_address /* changed member */ );
+ ip0->checksum = ip_csum_fold (sum0);
+
+ if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+ {
+ if (tcp0->flags & TCP_FLAG_SYN)
+ ses0->state = DET44_SESSION_TCP_SYN_SENT;
+ else if (tcp0->flags & TCP_FLAG_ACK
+ && ses0->state == DET44_SESSION_TCP_SYN_SENT)
+ ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+ else if (tcp0->flags & TCP_FLAG_FIN
+ && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+ ses0->state = DET44_SESSION_TCP_FIN_WAIT;
+ else if (tcp0->flags & TCP_FLAG_ACK
+ && ses0->state == DET44_SESSION_TCP_FIN_WAIT)
+ snat_det_ses_close (mp0, ses0);
+ else if (tcp0->flags & TCP_FLAG_FIN
+ && ses0->state == DET44_SESSION_TCP_CLOSE_WAIT)
+ ses0->state = DET44_SESSION_TCP_LAST_ACK;
+ else if (tcp0->flags == 0
+ && ses0->state == DET44_SESSION_UNKNOWN)
+ ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+
+ sum0 = tcp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 = ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ mss_clamping (dm->mss_clamping, tcp0, &sum0);
+ tcp0->checksum = ip_csum_fold (sum0);
+ }
+ else
+ {
+ ses0->state = DET44_SESSION_UDP_ACTIVE;
+
+ if (PREDICT_FALSE (udp0->checksum))
+ {
+ sum0 = udp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 =
+ ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ udp0->checksum = ip_csum_fold (sum0);
+ }
+ }
+
+ switch (ses0->state)
+ {
+ case DET44_SESSION_UDP_ACTIVE:
+ ses0->expire = now + dm->timeouts.udp;
+ break;
+ case DET44_SESSION_TCP_SYN_SENT:
+ case DET44_SESSION_TCP_FIN_WAIT:
+ case DET44_SESSION_TCP_CLOSE_WAIT:
+ case DET44_SESSION_TCP_LAST_ACK:
+ ses0->expire = now + dm->timeouts.tcp.transitory;
+ break;
+ case DET44_SESSION_TCP_ESTABLISHED:
+ ses0->expire = now + dm->timeouts.tcp.established;
+ break;
+ }
+
+ trace0:
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+ && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+ {
+ det44_in2out_trace_t *t =
+ vlib_add_trace (vm, node, b0, sizeof (*t));
+ t->sw_if_index = sw_if_index0;
+ t->next_index = next0;
+ t->session_index = ~0;
+ if (ses0)
+ t->session_index = ses0 - mp0->sessions;
+ }
+
+ pkts_processed += next0 != DET44_IN2OUT_NEXT_DROP;
+
+ ip1 = vlib_buffer_get_current (b1);
+ udp1 = ip4_next_header (ip1);
+ tcp1 = (tcp_header_t *) udp1;
+
+ sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
+
+ if (PREDICT_FALSE (ip1->ttl == 1))
+ {
+ vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
+ ICMP4_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ next1 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+ goto trace1;
+ }
+
+ proto1 = ip_proto_to_nat_proto (ip1->protocol);
+
+ if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
+ {
+ rx_fib_index1 =
+ ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
+ icmp1 = (icmp46_header_t *) udp1;
+
+ next1 = det44_icmp_in2out (b1, ip1, icmp1, sw_if_index1,
+ rx_fib_index1, node, next1,
+ thread_index, &ses1, &mp1);
+ goto trace1;
+ }
+
+ mp1 = snat_det_map_by_user (&ip1->src_address);
+ if (PREDICT_FALSE (!mp1))
+ {
+ det44_log_info ("no match for internal host %U",
+ format_ip4_address, &ip0->src_address);
+ next1 = DET44_IN2OUT_NEXT_DROP;
+ b1->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+ goto trace1;
+ }
+
+ snat_det_forward (mp1, &ip1->src_address, &new_addr1, &lo_port1);
+
+ key1.ext_host_addr = ip1->dst_address;
+ key1.ext_host_port = tcp1->dst;
+
+ ses1 =
+ snat_det_find_ses_by_in (mp1, &ip1->src_address, tcp1->src, key1);
+ if (PREDICT_FALSE (!ses1))
+ {
+ for (i1 = 0; i1 < mp1->ports_per_host; i1++)
+ {
+ key1.out_port = clib_host_to_net_u16 (lo_port1 +
+ ((i1 +
+ clib_net_to_host_u16
+ (tcp1->src)) %
+ mp1->
+ ports_per_host));
+
+ if (snat_det_get_ses_by_out
+ (mp1, &ip1->src_address, key1.as_u64))
+ continue;
+
+ ses1 =
+ snat_det_ses_create (thread_index, mp1, &ip1->src_address,
+ tcp1->src, &key1);
+ break;
+ }
+ if (PREDICT_FALSE (!ses1))
+ {
+ /* too many sessions for user, send ICMP error packet */
+ vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b1,
+ ICMP4_destination_unreachable,
+ ICMP4_destination_unreachable_destination_unreachable_host,
+ 0);
+ next1 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+ goto trace1;
+ }
+ }
+
+ old_port1 = udp1->src_port;
+ udp1->src_port = new_port1 = ses1->out.out_port;
+
+ old_addr1.as_u32 = ip1->src_address.as_u32;
+ ip1->src_address.as_u32 = new_addr1.as_u32;
+ vnet_buffer (b1)->sw_if_index[VLIB_TX] = dm->outside_fib_index;
+
+ sum1 = ip1->checksum;
+ sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+ ip4_header_t,
+ src_address /* changed member */ );
+ ip1->checksum = ip_csum_fold (sum1);
+
+ if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
+ {
+ if (tcp1->flags & TCP_FLAG_SYN)
+ ses1->state = DET44_SESSION_TCP_SYN_SENT;
+ else if (tcp1->flags & TCP_FLAG_ACK
+ && ses1->state == DET44_SESSION_TCP_SYN_SENT)
+ ses1->state = DET44_SESSION_TCP_ESTABLISHED;
+ else if (tcp1->flags & TCP_FLAG_FIN
+ && ses1->state == DET44_SESSION_TCP_ESTABLISHED)
+ ses1->state = DET44_SESSION_TCP_FIN_WAIT;
+ else if (tcp1->flags & TCP_FLAG_ACK
+ && ses1->state == DET44_SESSION_TCP_FIN_WAIT)
+ snat_det_ses_close (mp1, ses1);
+ else if (tcp1->flags & TCP_FLAG_FIN
+ && ses1->state == DET44_SESSION_TCP_CLOSE_WAIT)
+ ses1->state = DET44_SESSION_TCP_LAST_ACK;
+ else if (tcp1->flags == 0
+ && ses1->state == DET44_SESSION_UNKNOWN)
+ ses1->state = DET44_SESSION_TCP_ESTABLISHED;
+
+ sum1 = tcp1->checksum;
+ sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum1 = ip_csum_update (sum1, old_port1, new_port1,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ mss_clamping (dm->mss_clamping, tcp1, &sum1);
+ tcp1->checksum = ip_csum_fold (sum1);
+ }
+ else
+ {
+ ses1->state = DET44_SESSION_UDP_ACTIVE;
+
+ if (PREDICT_FALSE (udp1->checksum))
+ {
+ sum1 = udp1->checksum;
+ sum1 =
+ ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum1 =
+ ip_csum_update (sum1, old_port1, new_port1,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ udp1->checksum = ip_csum_fold (sum1);
+ }
+ }
+
+ switch (ses1->state)
+ {
+ case DET44_SESSION_UDP_ACTIVE:
+ ses1->expire = now + dm->timeouts.udp;
+ break;
+ case DET44_SESSION_TCP_SYN_SENT:
+ case DET44_SESSION_TCP_FIN_WAIT:
+ case DET44_SESSION_TCP_CLOSE_WAIT:
+ case DET44_SESSION_TCP_LAST_ACK:
+ ses1->expire = now + dm->timeouts.tcp.transitory;
+ break;
+ case DET44_SESSION_TCP_ESTABLISHED:
+ ses1->expire = now + dm->timeouts.tcp.established;
+ break;
+ }
+
+ trace1:
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+ && (b1->flags & VLIB_BUFFER_IS_TRACED)))
+ {
+ det44_in2out_trace_t *t =
+ vlib_add_trace (vm, node, b1, sizeof (*t));
+ t->sw_if_index = sw_if_index1;
+ t->next_index = next1;
+ t->session_index = ~0;
+ if (ses1)
+ t->session_index = ses1 - mp1->sessions;
+ }
+
+ pkts_processed += next1 != DET44_IN2OUT_NEXT_DROP;
+
+ /* verify speculative enqueues, maybe switch current next frame */
+ vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
+ to_next, n_left_to_next,
+ bi0, bi1, next0, next1);
+ }
+
+ while (n_left_from > 0 && n_left_to_next > 0)
+ {
+ u32 bi0;
+ vlib_buffer_t *b0;
+ u32 next0;
+ u32 sw_if_index0;
+ ip4_header_t *ip0;
+ ip_csum_t sum0;
+ ip4_address_t new_addr0, old_addr0;
+ u16 old_port0, new_port0, lo_port0, i0;
+ udp_header_t *udp0;
+ tcp_header_t *tcp0;
+ u32 proto0;
+ snat_det_out_key_t key0;
+ snat_det_map_t *mp0;
+ snat_det_session_t *ses0 = 0;
+ u32 rx_fib_index0;
+ icmp46_header_t *icmp0;
+
+ /* speculatively enqueue b0 to the current next frame */
+ bi0 = from[0];
+ to_next[0] = bi0;
+ from += 1;
+ to_next += 1;
+ n_left_from -= 1;
+ n_left_to_next -= 1;
+
+ b0 = vlib_get_buffer (vm, bi0);
+ next0 = DET44_IN2OUT_NEXT_LOOKUP;
+
+ ip0 = vlib_buffer_get_current (b0);
+ udp0 = ip4_next_header (ip0);
+ tcp0 = (tcp_header_t *) udp0;
+
+ sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+ if (PREDICT_FALSE (ip0->ttl == 1))
+ {
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+ ICMP4_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+ goto trace00;
+ }
+
+ proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+ if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+ {
+ rx_fib_index0 =
+ ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+ icmp0 = (icmp46_header_t *) udp0;
+
+ next0 = det44_icmp_in2out (b0, ip0, icmp0, sw_if_index0,
+ rx_fib_index0, node, next0,
+ thread_index, &ses0, &mp0);
+ goto trace00;
+ }
+
+ mp0 = snat_det_map_by_user (&ip0->src_address);
+ if (PREDICT_FALSE (!mp0))
+ {
+ det44_log_info ("no match for internal host %U",
+ format_ip4_address, &ip0->src_address);
+ next0 = DET44_IN2OUT_NEXT_DROP;
+ b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+ goto trace00;
+ }
+
+ snat_det_forward (mp0, &ip0->src_address, &new_addr0, &lo_port0);
+
+ key0.ext_host_addr = ip0->dst_address;
+ key0.ext_host_port = tcp0->dst;
+
+ ses0 =
+ snat_det_find_ses_by_in (mp0, &ip0->src_address, tcp0->src, key0);
+ if (PREDICT_FALSE (!ses0))
+ {
+ for (i0 = 0; i0 < mp0->ports_per_host; i0++)
+ {
+ key0.out_port = clib_host_to_net_u16 (lo_port0 +
+ ((i0 +
+ clib_net_to_host_u16
+ (tcp0->src)) %
+ mp0->
+ ports_per_host));
+
+ if (snat_det_get_ses_by_out
+ (mp0, &ip0->src_address, key0.as_u64))
+ continue;
+
+ ses0 =
+ snat_det_ses_create (thread_index, mp0, &ip0->src_address,
+ tcp0->src, &key0);
+ break;
+ }
+ if (PREDICT_FALSE (!ses0))
+ {
+ /* too many sessions for user, send ICMP error packet */
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b0,
+ ICMP4_destination_unreachable,
+ ICMP4_destination_unreachable_destination_unreachable_host,
+ 0);
+ next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+ goto trace00;
+ }
+ }
+
+ old_port0 = udp0->src_port;
+ udp0->src_port = new_port0 = ses0->out.out_port;
+
+ old_addr0.as_u32 = ip0->src_address.as_u32;
+ ip0->src_address.as_u32 = new_addr0.as_u32;
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->outside_fib_index;
+
+ sum0 = ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ src_address /* changed member */ );
+ ip0->checksum = ip_csum_fold (sum0);
+
+ if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+ {
+ if (tcp0->flags & TCP_FLAG_SYN)
+ ses0->state = DET44_SESSION_TCP_SYN_SENT;
+ else if (tcp0->flags & TCP_FLAG_ACK
+ && ses0->state == DET44_SESSION_TCP_SYN_SENT)
+ ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+ else if (tcp0->flags & TCP_FLAG_FIN
+ && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+ ses0->state = DET44_SESSION_TCP_FIN_WAIT;
+ else if (tcp0->flags & TCP_FLAG_ACK
+ && ses0->state == DET44_SESSION_TCP_FIN_WAIT)
+ snat_det_ses_close (mp0, ses0);
+ else if (tcp0->flags & TCP_FLAG_FIN
+ && ses0->state == DET44_SESSION_TCP_CLOSE_WAIT)
+ ses0->state = DET44_SESSION_TCP_LAST_ACK;
+ else if (tcp0->flags == 0
+ && ses0->state == DET44_SESSION_UNKNOWN)
+ ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+
+ sum0 = tcp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 = ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ mss_clamping (dm->mss_clamping, tcp0, &sum0);
+ tcp0->checksum = ip_csum_fold (sum0);
+ }
+ else
+ {
+ ses0->state = DET44_SESSION_UDP_ACTIVE;
+
+ if (PREDICT_FALSE (udp0->checksum))
+ {
+ sum0 = udp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 =
+ ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ udp0->checksum = ip_csum_fold (sum0);
+ }
+ }
+
+ switch (ses0->state)
+ {
+ case DET44_SESSION_UDP_ACTIVE:
+ ses0->expire = now + dm->timeouts.udp;
+ break;
+ case DET44_SESSION_TCP_SYN_SENT:
+ case DET44_SESSION_TCP_FIN_WAIT:
+ case DET44_SESSION_TCP_CLOSE_WAIT:
+ case DET44_SESSION_TCP_LAST_ACK:
+ ses0->expire = now + dm->timeouts.tcp.transitory;
+ break;
+ case DET44_SESSION_TCP_ESTABLISHED:
+ ses0->expire = now + dm->timeouts.tcp.established;
+ break;
+ }
+
+ trace00:
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+ && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+ {
+ det44_in2out_trace_t *t =
+ vlib_add_trace (vm, node, b0, sizeof (*t));
+ t->sw_if_index = sw_if_index0;
+ t->next_index = next0;
+ t->session_index = ~0;
+ if (ses0)
+ t->session_index = ses0 - mp0->sessions;
+ }
+
+ pkts_processed += next0 != DET44_IN2OUT_NEXT_DROP;
+
+ /* verify speculative enqueue, maybe switch current next frame */
+ vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+ to_next, n_left_to_next,
+ bi0, next0);
+ }
+
+ vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+ }
+
+ vlib_node_increment_counter (vm, dm->in2out_node_index,
+ DET44_IN2OUT_ERROR_IN2OUT_PACKETS,
+ pkts_processed);
+ return frame->n_vectors;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (det44_in2out_node) = {
+ .name = "det44-in2out",
+ .vector_size = sizeof (u32),
+ .format_trace = format_det44_in2out_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+ .n_errors = ARRAY_LEN(det44_in2out_error_strings),
+ .error_strings = det44_in2out_error_strings,
+ .runtime_data_bytes = sizeof (det44_runtime_t),
+ .n_next_nodes = DET44_IN2OUT_N_NEXT,
+ /* edit / add dispositions here */
+ .next_nodes = {
+ [DET44_IN2OUT_NEXT_DROP] = "error-drop",
+ [DET44_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
+ [DET44_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
+ },
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_inlines.h b/src/plugins/nat/det44/det44_inlines.h
new file mode 100644
index 00000000000..e4be469562c
--- /dev/null
+++ b/src/plugins/nat/det44/det44_inlines.h
@@ -0,0 +1,130 @@
+/*
+ * det44.h - deterministic NAT definitions
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) inlines
+ */
+
+#ifndef __included_det44_inlines_h__
+#define __included_det44_inlines_h__
+
+static_always_inline int
+det44_is_interface_addr (vlib_node_runtime_t * node,
+ u32 sw_if_index0, u32 ip4_addr)
+{
+ det44_runtime_t *rt = (det44_runtime_t *) node->runtime_data;
+ det44_main_t *dm = &det44_main;
+ ip4_address_t *first_int_addr;
+
+ if (PREDICT_FALSE (rt->cached_sw_if_index != sw_if_index0))
+ {
+ first_int_addr = ip4_interface_first_address (dm->ip4_main,
+ sw_if_index0, 0);
+ rt->cached_sw_if_index = sw_if_index0;
+ if (first_int_addr)
+ rt->cached_ip4_address = first_int_addr->as_u32;
+ else
+ rt->cached_ip4_address = 0;
+ }
+ if (PREDICT_FALSE (rt->cached_ip4_address == ip4_addr))
+ return 0;
+ return 1;
+}
+
+/**
+ * @brief Check if packet should be translated
+ *
+ * Packets aimed at outside interface and external address with active session
+ * should be translated.
+ *
+ * @param node NAT runtime data
+ * @param sw_if_index0 index of the inside interface
+ * @param ip0 IPv4 header
+ * @param proto0 NAT protocol
+ * @param rx_fib_index0 RX FIB index
+ *
+ * @returns 0 if packet should be translated otherwise 1
+ */
+static_always_inline int
+det44_translate (vlib_node_runtime_t * node, u32 sw_if_index0,
+ ip4_header_t * ip0, u32 proto0, u32 rx_fib_index0)
+{
+ det44_main_t *dm = &det44_main;
+ fib_node_index_t fei = FIB_NODE_INDEX_INVALID;
+ det44_fib_t *outside_fib;
+ fib_prefix_t pfx = {
+ .fp_proto = FIB_PROTOCOL_IP4,
+ .fp_len = 32,
+ .fp_addr = {
+ .ip4.as_u32 = ip0->dst_address.as_u32,
+ }
+ ,
+ };
+
+ /* Don't NAT packet aimed at the interface address */
+ if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0,
+ ip0->dst_address.as_u32)))
+ {
+ return 1;
+ }
+
+ /* find out if there is outside feature enabled for this destination */
+ fei = fib_table_lookup (rx_fib_index0, &pfx);
+ if (FIB_NODE_INDEX_INVALID != fei)
+ {
+ u32 sw_if_index = fib_entry_get_resolving_interface (fei);
+ if (sw_if_index == ~0)
+ {
+ // TODO: go over use cases
+ /* *INDENT-OFF* */
+ vec_foreach (outside_fib, dm->outside_fibs)
+ {
+ fei = fib_table_lookup (outside_fib->fib_index, &pfx);
+ if (FIB_NODE_INDEX_INVALID != fei)
+ {
+ sw_if_index = fib_entry_get_resolving_interface (fei);
+ if (sw_if_index != ~0)
+ break;
+ }
+ }
+ /* *INDENT-ON* */
+ }
+ if (sw_if_index != ~0)
+ {
+ det44_interface_t *i;
+ /* *INDENT-OFF* */
+ pool_foreach (i, dm->interfaces, ({
+ /* NAT packet aimed at outside interface */
+ if ((det44_interface_is_outside (i)) && (sw_if_index == i->sw_if_index))
+ return 0;
+ }));
+ /* *INDENT-ON* */
+ }
+ }
+ return 1;
+}
+
+#endif /* __included_det44_inlines_h__ */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_out2in.c b/src/plugins/nat/det44/det44_out2in.c
new file mode 100644
index 00000000000..5ee28777b84
--- /dev/null
+++ b/src/plugins/nat/det44/det44_out2in.c
@@ -0,0 +1,866 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) outside to inside translation
+ */
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vppinfra/error.h>
+#include <vppinfra/elog.h>
+
+#include <nat/det44/det44.h>
+#include <nat/det44/det44_inlines.h>
+
+#include <nat/lib/lib.h>
+#include <nat/lib/inlines.h>
+#include <nat/lib/nat_inlines.h>
+
+typedef enum
+{
+ DET44_OUT2IN_NEXT_DROP,
+ DET44_OUT2IN_NEXT_LOOKUP,
+ DET44_OUT2IN_NEXT_ICMP_ERROR,
+ DET44_OUT2IN_N_NEXT,
+} det44_out2in_next_t;
+
+typedef struct
+{
+ u32 sw_if_index;
+ u32 next_index;
+ u32 session_index;
+} det44_out2in_trace_t;
+
+#define foreach_det44_out2in_error \
+_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
+_(NO_TRANSLATION, "No translation") \
+_(BAD_ICMP_TYPE, "unsupported ICMP type") \
+_(OUT2IN_PACKETS, "Good out2in packets processed")
+
+typedef enum
+{
+#define _(sym,str) DET44_OUT2IN_ERROR_##sym,
+ foreach_det44_out2in_error
+#undef _
+ DET44_OUT2IN_N_ERROR,
+} det44_out2in_error_t;
+
+static char *det44_out2in_error_strings[] = {
+#define _(sym,string) string,
+ foreach_det44_out2in_error
+#undef _
+};
+
+static u8 *
+format_det44_out2in_trace (u8 * s, va_list * args)
+{
+ CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+ CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+ det44_out2in_trace_t *t = va_arg (*args, det44_out2in_trace_t *);
+
+ s =
+ format (s,
+ "DET44_OUT2IN: sw_if_index %d, next index %d, session index %d",
+ t->sw_if_index, t->next_index, t->session_index);
+ return s;
+}
+
+#ifndef CLIB_MARCH_VARIANT
+/**
+ * Get address and port values to be used for ICMP packet translation
+ * and create session if needed
+ *
+ * @param[in,out] node NAT node runtime
+ * @param[in] thread_index thread index
+ * @param[in,out] b0 buffer containing packet to be translated
+ * @param[in,out] ip0 ip header
+ * @param[out] p_proto protocol used for matching
+ * @param[out] p_value address and port after NAT translation
+ * @param[out] p_dont_translate if packet should not be translated
+ * @param d optional parameter
+ * @param e optional parameter
+ */
+u32
+icmp_match_out2in_det (vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, ip4_address_t * addr,
+ u16 * port, u32 * fib_index,
+ nat_protocol_t * proto, void *d, void *e,
+ u8 * dont_translate)
+{
+ det44_main_t *dm = &det44_main;
+ icmp46_header_t *icmp0;
+ u32 sw_if_index0;
+ u8 protocol;
+ snat_det_out_key_t key0;
+ u32 next0 = ~0;
+ icmp_echo_header_t *echo0, *inner_echo0 = 0;
+ ip4_header_t *inner_ip0;
+ void *l4_header = 0;
+ icmp46_header_t *inner_icmp0;
+ snat_det_map_t *mp0 = 0;
+ ip4_address_t new_addr0 = { {0} };
+ snat_det_session_t *ses0 = 0;
+ ip4_address_t out_addr;
+ *dont_translate = 0;
+
+ icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
+ echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+ sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+ if (!icmp_type_is_error_message
+ (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
+ {
+ protocol = NAT_PROTOCOL_ICMP;
+ key0.ext_host_addr = ip0->src_address;
+ key0.ext_host_port = 0;
+ key0.out_port = vnet_buffer (b0)->ip.reass.l4_src_port;
+ out_addr = ip0->dst_address;
+ }
+ else
+ {
+ /* if error message, then it's not fragmented and we can access it */
+ inner_ip0 = (ip4_header_t *) (echo0 + 1);
+ l4_header = ip4_next_header (inner_ip0);
+ protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
+ key0.ext_host_addr = inner_ip0->dst_address;
+ out_addr = inner_ip0->src_address;
+ switch (protocol)
+ {
+ case NAT_PROTOCOL_ICMP:
+ inner_icmp0 = (icmp46_header_t *) l4_header;
+ inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+ key0.ext_host_port = 0;
+ key0.out_port = inner_echo0->identifier;
+ break;
+ case NAT_PROTOCOL_UDP:
+ case NAT_PROTOCOL_TCP:
+ key0.ext_host_port = ((tcp_udp_header_t *) l4_header)->dst_port;
+ key0.out_port = ((tcp_udp_header_t *) l4_header)->src_port;
+ break;
+ default:
+ b0->error = node->errors[DET44_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ goto out;
+ }
+ }
+
+ mp0 = snat_det_map_by_out (&out_addr);
+ if (PREDICT_FALSE (!mp0))
+ {
+ /* Don't NAT packet aimed at the intfc address */
+ if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0,
+ ip0->dst_address.as_u32)))
+ {
+ *dont_translate = 1;
+ goto out;
+ }
+ det44_log_info ("unknown dst address: %U",
+ format_ip4_address, &ip0->dst_address);
+ goto out;
+ }
+
+ snat_det_reverse (mp0, &ip0->dst_address,
+ clib_net_to_host_u16 (key0.out_port), &new_addr0);
+
+ ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64);
+ if (PREDICT_FALSE (!ses0))
+ {
+ /* Don't NAT packet aimed at the intfc address */
+ if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0,
+ ip0->dst_address.as_u32)))
+ {
+ *dont_translate = 1;
+ goto out;
+ }
+ det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+ format_ip4_address, &key0.ext_host_addr,
+ clib_net_to_host_u16 (key0.ext_host_port),
+ format_ip4_address, &out_addr,
+ clib_net_to_host_u16 (key0.out_port),
+ format_ip4_address, &new_addr0);
+ b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ goto out;
+ }
+
+ if (PREDICT_FALSE
+ (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_reply
+ && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
+ reass.icmp_type_or_tcp_flags)))
+ {
+ b0->error = node->errors[DET44_OUT2IN_ERROR_BAD_ICMP_TYPE];
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ goto out;
+ }
+
+ goto out;
+
+out:
+ *proto = protocol;
+ if (ses0)
+ {
+ *addr = new_addr0;
+ *fib_index = dm->inside_fib_index;
+ *port = ses0->in_port;
+ }
+ if (d)
+ *(snat_det_session_t **) d = ses0;
+ if (e)
+ *(snat_det_map_t **) e = mp0;
+ return next0;
+}
+#endif
+
+#ifndef CLIB_MARCH_VARIANT
+u32
+det44_icmp_out2in (vlib_buffer_t * b0,
+ ip4_header_t * ip0,
+ icmp46_header_t * icmp0,
+ u32 sw_if_index0,
+ u32 rx_fib_index0,
+ vlib_node_runtime_t * node,
+ u32 next0, u32 thread_index, void *d, void *e)
+{
+ vlib_main_t *vm = vlib_get_main ();
+ u32 new_addr0, old_addr0, next0_tmp, fib_index;
+ u16 old_id0, new_id0, port, checksum0;
+ icmp_echo_header_t *echo0, *inner_echo0;
+ icmp46_header_t *inner_icmp0;
+ ip4_header_t *inner_ip0;
+ ip4_address_t addr;
+ void *l4_header;
+ u8 dont_translate;
+ ip_csum_t sum0;
+ nat_protocol_t proto;
+
+ echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+ next0_tmp = icmp_match_out2in_det (node, thread_index, b0, ip0,
+ &addr, &port, &fib_index, &proto,
+ d, e, &dont_translate);
+ if (next0_tmp != ~0)
+ next0 = next0_tmp;
+ if (next0 == DET44_OUT2IN_NEXT_DROP || dont_translate)
+ goto out;
+
+ if (PREDICT_TRUE (!ip4_is_fragment (ip0)))
+ {
+ sum0 =
+ ip_incremental_checksum_buffer (vm, b0,
+ (u8 *) icmp0 -
+ (u8 *) vlib_buffer_get_current (b0),
+ ntohs (ip0->length) -
+ ip4_header_bytes (ip0), 0);
+ checksum0 = ~ip_csum_fold (sum0);
+ if (checksum0 != 0 && checksum0 != 0xffff)
+ {
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ goto out;
+ }
+ }
+
+ old_addr0 = ip0->dst_address.as_u32;
+ new_addr0 = ip0->dst_address.as_u32 = addr.as_u32;
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index;
+
+ sum0 = ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+ dst_address /* changed member */ );
+ ip0->checksum = ip_csum_fold (sum0);
+
+
+ if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
+ {
+ if (icmp0->checksum == 0)
+ icmp0->checksum = 0xffff;
+
+ if (!icmp_type_is_error_message (icmp0->type))
+ {
+ new_id0 = port;
+ if (PREDICT_FALSE (new_id0 != echo0->identifier))
+ {
+ old_id0 = echo0->identifier;
+ new_id0 = port;
+ echo0->identifier = new_id0;
+
+ sum0 = icmp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+ identifier /* changed member */ );
+ icmp0->checksum = ip_csum_fold (sum0);
+ }
+ }
+ else
+ {
+ inner_ip0 = (ip4_header_t *) (echo0 + 1);
+ l4_header = ip4_next_header (inner_ip0);
+
+ if (!ip4_header_checksum_is_valid (inner_ip0))
+ {
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ goto out;
+ }
+
+ old_addr0 = inner_ip0->src_address.as_u32;
+ inner_ip0->src_address = addr;
+ new_addr0 = inner_ip0->src_address.as_u32;
+
+ sum0 = icmp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+ src_address /* changed member */ );
+ icmp0->checksum = ip_csum_fold (sum0);
+
+ switch (proto)
+ {
+ case NAT_PROTOCOL_ICMP:
+ inner_icmp0 = (icmp46_header_t *) l4_header;
+ inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+
+ old_id0 = inner_echo0->identifier;
+ new_id0 = port;
+ inner_echo0->identifier = new_id0;
+
+ sum0 = icmp0->checksum;
+ sum0 =
+ ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+ identifier);
+ icmp0->checksum = ip_csum_fold (sum0);
+ break;
+ case NAT_PROTOCOL_UDP:
+ case NAT_PROTOCOL_TCP:
+ old_id0 = ((tcp_udp_header_t *) l4_header)->src_port;
+ new_id0 = port;
+ ((tcp_udp_header_t *) l4_header)->src_port = new_id0;
+
+ sum0 = icmp0->checksum;
+ sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t,
+ src_port);
+ icmp0->checksum = ip_csum_fold (sum0);
+ break;
+ default:
+ ASSERT (0);
+ }
+ }
+ }
+
+out:
+ return next0;
+}
+#endif
+
+VLIB_NODE_FN (det44_out2in_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * frame)
+{
+ u32 n_left_from, *from, *to_next;
+ det44_out2in_next_t next_index;
+ u32 pkts_processed = 0;
+ det44_main_t *dm = &det44_main;
+ u32 thread_index = vm->thread_index;
+
+ from = vlib_frame_vector_args (frame);
+ n_left_from = frame->n_vectors;
+ next_index = node->cached_next_index;
+
+ while (n_left_from > 0)
+ {
+ u32 n_left_to_next;
+
+ vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+ while (n_left_from >= 4 && n_left_to_next >= 2)
+ {
+ u32 bi0, bi1;
+ vlib_buffer_t *b0, *b1;
+ u32 next0 = DET44_OUT2IN_NEXT_LOOKUP;
+ u32 next1 = DET44_OUT2IN_NEXT_LOOKUP;
+ u32 sw_if_index0, sw_if_index1;
+ ip4_header_t *ip0, *ip1;
+ ip_csum_t sum0, sum1;
+ ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
+ u16 new_port0, old_port0, old_port1, new_port1;
+ udp_header_t *udp0, *udp1;
+ tcp_header_t *tcp0, *tcp1;
+ u32 proto0, proto1;
+ snat_det_out_key_t key0, key1;
+ snat_det_map_t *mp0, *mp1;
+ snat_det_session_t *ses0 = 0, *ses1 = 0;
+ u32 rx_fib_index0, rx_fib_index1;
+ icmp46_header_t *icmp0, *icmp1;
+
+ /* Prefetch next iteration. */
+ {
+ vlib_buffer_t *p2, *p3;
+
+ p2 = vlib_get_buffer (vm, from[2]);
+ p3 = vlib_get_buffer (vm, from[3]);
+
+ vlib_prefetch_buffer_header (p2, LOAD);
+ vlib_prefetch_buffer_header (p3, LOAD);
+
+ CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ }
+
+ /* speculatively enqueue b0 and b1 to the current next frame */
+ to_next[0] = bi0 = from[0];
+ to_next[1] = bi1 = from[1];
+ from += 2;
+ to_next += 2;
+ n_left_from -= 2;
+ n_left_to_next -= 2;
+
+ b0 = vlib_get_buffer (vm, bi0);
+ b1 = vlib_get_buffer (vm, bi1);
+
+ ip0 = vlib_buffer_get_current (b0);
+ udp0 = ip4_next_header (ip0);
+ tcp0 = (tcp_header_t *) udp0;
+
+ sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+ if (PREDICT_FALSE (ip0->ttl == 1))
+ {
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+ ICMP4_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ next0 = DET44_OUT2IN_NEXT_ICMP_ERROR;
+ goto trace0;
+ }
+
+ proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+ if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+ {
+ rx_fib_index0 =
+ ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+ icmp0 = (icmp46_header_t *) udp0;
+
+ next0 = det44_icmp_out2in (b0, ip0, icmp0, sw_if_index0,
+ rx_fib_index0, node, next0,
+ thread_index, &ses0, &mp0);
+ goto trace0;
+ }
+
+ key0.ext_host_addr = ip0->src_address;
+ key0.ext_host_port = tcp0->src;
+ key0.out_port = tcp0->dst;
+
+ mp0 = snat_det_map_by_out (&ip0->dst_address);
+ if (PREDICT_FALSE (!mp0))
+ {
+ det44_log_info ("unknown dst address: %U",
+ format_ip4_address, &ip0->dst_address);
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ goto trace0;
+ }
+
+ snat_det_reverse (mp0, &ip0->dst_address,
+ clib_net_to_host_u16 (tcp0->dst), &new_addr0);
+
+ ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64);
+ if (PREDICT_FALSE (!ses0))
+ {
+ det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+ format_ip4_address, &ip0->src_address,
+ clib_net_to_host_u16 (tcp0->src),
+ format_ip4_address, &ip0->dst_address,
+ clib_net_to_host_u16 (tcp0->dst),
+ format_ip4_address, &new_addr0);
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ goto trace0;
+ }
+ old_port0 = udp0->dst_port;
+ udp0->dst_port = new_port0 = ses0->in_port;
+
+ old_addr0 = ip0->dst_address;
+ ip0->dst_address = new_addr0;
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->inside_fib_index;
+
+ sum0 = ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ ip0->checksum = ip_csum_fold (sum0);
+
+ if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+ {
+ if (tcp0->flags & TCP_FLAG_FIN
+ && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+ ses0->state = DET44_SESSION_TCP_CLOSE_WAIT;
+ else if (tcp0->flags & TCP_FLAG_ACK
+ && ses0->state == DET44_SESSION_TCP_LAST_ACK)
+ snat_det_ses_close (mp0, ses0);
+
+ sum0 = tcp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 = ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ tcp0->checksum = ip_csum_fold (sum0);
+ }
+ else if (udp0->checksum)
+ {
+ sum0 = udp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 = ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ udp0->checksum = ip_csum_fold (sum0);
+ }
+
+ trace0:
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+ && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+ {
+ det44_out2in_trace_t *t =
+ vlib_add_trace (vm, node, b0, sizeof (*t));
+ t->sw_if_index = sw_if_index0;
+ t->next_index = next0;
+ t->session_index = ~0;
+ if (ses0)
+ t->session_index = ses0 - mp0->sessions;
+ }
+
+ pkts_processed += next0 != DET44_OUT2IN_NEXT_DROP;
+
+ b1 = vlib_get_buffer (vm, bi1);
+
+ ip1 = vlib_buffer_get_current (b1);
+ udp1 = ip4_next_header (ip1);
+ tcp1 = (tcp_header_t *) udp1;
+
+ sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
+
+ if (PREDICT_FALSE (ip1->ttl == 1))
+ {
+ vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
+ ICMP4_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ next1 = DET44_OUT2IN_NEXT_ICMP_ERROR;
+ goto trace1;
+ }
+
+ proto1 = ip_proto_to_nat_proto (ip1->protocol);
+
+ if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
+ {
+ rx_fib_index1 =
+ ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
+ icmp1 = (icmp46_header_t *) udp1;
+
+ next1 = det44_icmp_out2in (b1, ip1, icmp1, sw_if_index1,
+ rx_fib_index1, node, next1,
+ thread_index, &ses1, &mp1);
+ goto trace1;
+ }
+
+ key1.ext_host_addr = ip1->src_address;
+ key1.ext_host_port = tcp1->src;
+ key1.out_port = tcp1->dst;
+
+ mp1 = snat_det_map_by_out (&ip1->dst_address);
+ if (PREDICT_FALSE (!mp1))
+ {
+ det44_log_info ("unknown dst address: %U",
+ format_ip4_address, &ip1->dst_address);
+ next1 = DET44_OUT2IN_NEXT_DROP;
+ b1->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ goto trace1;
+ }
+
+ snat_det_reverse (mp1, &ip1->dst_address,
+ clib_net_to_host_u16 (tcp1->dst), &new_addr1);
+
+ ses1 = snat_det_get_ses_by_out (mp1, &new_addr1, key1.as_u64);
+ if (PREDICT_FALSE (!ses1))
+ {
+ det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+ format_ip4_address, &ip1->src_address,
+ clib_net_to_host_u16 (tcp1->src),
+ format_ip4_address, &ip1->dst_address,
+ clib_net_to_host_u16 (tcp1->dst),
+ format_ip4_address, &new_addr1);
+ next1 = DET44_OUT2IN_NEXT_DROP;
+ b1->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ goto trace1;
+ }
+ old_port1 = udp1->dst_port;
+ udp1->dst_port = new_port1 = ses1->in_port;
+
+ old_addr1 = ip1->dst_address;
+ ip1->dst_address = new_addr1;
+ vnet_buffer (b1)->sw_if_index[VLIB_TX] = dm->inside_fib_index;
+
+ sum1 = ip1->checksum;
+ sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ ip1->checksum = ip_csum_fold (sum1);
+
+ if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
+ {
+ if (tcp1->flags & TCP_FLAG_FIN
+ && ses1->state == DET44_SESSION_TCP_ESTABLISHED)
+ ses1->state = DET44_SESSION_TCP_CLOSE_WAIT;
+ else if (tcp1->flags & TCP_FLAG_ACK
+ && ses1->state == DET44_SESSION_TCP_LAST_ACK)
+ snat_det_ses_close (mp1, ses1);
+
+ sum1 = tcp1->checksum;
+ sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum1 = ip_csum_update (sum1, old_port1, new_port1,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ tcp1->checksum = ip_csum_fold (sum1);
+ }
+ else if (udp1->checksum)
+ {
+ sum1 = udp1->checksum;
+ sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum1 = ip_csum_update (sum1, old_port1, new_port1,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ udp1->checksum = ip_csum_fold (sum1);
+ }
+
+ trace1:
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+ && (b1->flags & VLIB_BUFFER_IS_TRACED)))
+ {
+ det44_out2in_trace_t *t =
+ vlib_add_trace (vm, node, b1, sizeof (*t));
+ t->sw_if_index = sw_if_index1;
+ t->next_index = next1;
+ t->session_index = ~0;
+ if (ses1)
+ t->session_index = ses1 - mp1->sessions;
+ }
+
+ pkts_processed += next1 != DET44_OUT2IN_NEXT_DROP;
+
+ /* verify speculative enqueues, maybe switch current next frame */
+ vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
+ to_next, n_left_to_next,
+ bi0, bi1, next0, next1);
+ }
+
+ while (n_left_from > 0 && n_left_to_next > 0)
+ {
+ u32 bi0;
+ vlib_buffer_t *b0;
+ u32 next0 = DET44_OUT2IN_NEXT_LOOKUP;
+ u32 sw_if_index0;
+ ip4_header_t *ip0;
+ ip_csum_t sum0;
+ ip4_address_t new_addr0, old_addr0;
+ u16 new_port0, old_port0;
+ udp_header_t *udp0;
+ tcp_header_t *tcp0;
+ u32 proto0;
+ snat_det_out_key_t key0;
+ snat_det_map_t *mp0;
+ snat_det_session_t *ses0 = 0;
+ u32 rx_fib_index0;
+ icmp46_header_t *icmp0;
+
+ /* speculatively enqueue b0 to the current next frame */
+ bi0 = from[0];
+ to_next[0] = bi0;
+ from += 1;
+ to_next += 1;
+ n_left_from -= 1;
+ n_left_to_next -= 1;
+
+ b0 = vlib_get_buffer (vm, bi0);
+
+ ip0 = vlib_buffer_get_current (b0);
+ udp0 = ip4_next_header (ip0);
+ tcp0 = (tcp_header_t *) udp0;
+
+ sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+ if (PREDICT_FALSE (ip0->ttl == 1))
+ {
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+ icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+ ICMP4_time_exceeded_ttl_exceeded_in_transit,
+ 0);
+ next0 = DET44_OUT2IN_NEXT_ICMP_ERROR;
+ goto trace00;
+ }
+
+ proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+ if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+ {
+ rx_fib_index0 =
+ ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+ icmp0 = (icmp46_header_t *) udp0;
+
+ next0 = det44_icmp_out2in (b0, ip0, icmp0, sw_if_index0,
+ rx_fib_index0, node, next0,
+ thread_index, &ses0, &mp0);
+ goto trace00;
+ }
+
+ key0.ext_host_addr = ip0->src_address;
+ key0.ext_host_port = tcp0->src;
+ key0.out_port = tcp0->dst;
+
+ mp0 = snat_det_map_by_out (&ip0->dst_address);
+ if (PREDICT_FALSE (!mp0))
+ {
+ det44_log_info ("unknown dst address: %U",
+ format_ip4_address, &ip0->dst_address);
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ goto trace00;
+ }
+
+ snat_det_reverse (mp0, &ip0->dst_address,
+ clib_net_to_host_u16 (tcp0->dst), &new_addr0);
+
+ ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64);
+ if (PREDICT_FALSE (!ses0))
+ {
+ det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+ format_ip4_address, &ip0->src_address,
+ clib_net_to_host_u16 (tcp0->src),
+ format_ip4_address, &ip0->dst_address,
+ clib_net_to_host_u16 (tcp0->dst),
+ format_ip4_address, &new_addr0);
+ next0 = DET44_OUT2IN_NEXT_DROP;
+ b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+ goto trace00;
+ }
+ old_port0 = udp0->dst_port;
+ udp0->dst_port = new_port0 = ses0->in_port;
+
+ old_addr0 = ip0->dst_address;
+ ip0->dst_address = new_addr0;
+ vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->inside_fib_index;
+
+ sum0 = ip0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ ip0->checksum = ip_csum_fold (sum0);
+
+ if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+ {
+ if (tcp0->flags & TCP_FLAG_FIN
+ && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+ ses0->state = DET44_SESSION_TCP_CLOSE_WAIT;
+ else if (tcp0->flags & TCP_FLAG_ACK
+ && ses0->state == DET44_SESSION_TCP_LAST_ACK)
+ snat_det_ses_close (mp0, ses0);
+
+ sum0 = tcp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 = ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ tcp0->checksum = ip_csum_fold (sum0);
+ }
+ else if (udp0->checksum)
+ {
+ sum0 = udp0->checksum;
+ sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+ ip4_header_t,
+ dst_address /* changed member */ );
+ sum0 = ip_csum_update (sum0, old_port0, new_port0,
+ ip4_header_t /* cheat */ ,
+ length /* changed member */ );
+ udp0->checksum = ip_csum_fold (sum0);
+ }
+
+ trace00:
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+ && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+ {
+ det44_out2in_trace_t *t =
+ vlib_add_trace (vm, node, b0, sizeof (*t));
+ t->sw_if_index = sw_if_index0;
+ t->next_index = next0;
+ t->session_index = ~0;
+ if (ses0)
+ t->session_index = ses0 - mp0->sessions;
+ }
+
+ pkts_processed += next0 != DET44_OUT2IN_NEXT_DROP;
+
+ /* verify speculative enqueue, maybe switch current next frame */
+ vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+ to_next, n_left_to_next,
+ bi0, next0);
+ }
+
+ vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+ }
+
+ vlib_node_increment_counter (vm, dm->out2in_node_index,
+ DET44_OUT2IN_ERROR_OUT2IN_PACKETS,
+ pkts_processed);
+ return frame->n_vectors;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (det44_out2in_node) = {
+ .name = "det44-out2in",
+ .vector_size = sizeof (u32),
+ .format_trace = format_det44_out2in_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+ .n_errors = ARRAY_LEN(det44_out2in_error_strings),
+ .error_strings = det44_out2in_error_strings,
+ .runtime_data_bytes = sizeof (det44_runtime_t),
+ .n_next_nodes = DET44_OUT2IN_N_NEXT,
+ /* edit / add dispositions here */
+ .next_nodes = {
+ [DET44_OUT2IN_NEXT_DROP] = "error-drop",
+ [DET44_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
+ [DET44_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
+ },
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */