NAT: Twice NAT44 (VPP-969)

Translation of both source and destination addresses and ports for 1:1 NAT
session initiated from outside network (ExternalIP K8 use case).

Change-Id: Ic0000497cf71619aac996d6d580844f0ea0edc14
Signed-off-by: Matus Fabian <matfabia@cisco.com>

1 files changed, 508 insertions, 192 deletions

diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c
index 6aa2d81f073..52944014ab0 100644
--- a/src/plugins/nat/nat.c
+++ b/src/plugins/nat/nat.c
@@ -138,6 +138,208 @@ typedef enum {
   NAT44_CLASSIFY_N_NEXT,
 } nat44_classify_next_t;
 
+void
+nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index)
+{
+  snat_session_key_t key;
+  clib_bihash_kv_8_8_t kv;
+  nat_ed_ses_key_t ed_key;
+  clib_bihash_kv_16_8_t ed_kv;
+  int i;
+  snat_address_t *a;
+  snat_main_per_thread_data_t *tsm =
+    vec_elt_at_index (sm->per_thread_data, thread_index);
+
+  /* Endpoint dependent session lookup tables */
+  if (is_ed_session (s))
+    {
+      ed_key.l_addr = s->out2in.addr;
+      ed_key.r_addr = s->ext_host_addr;
+      ed_key.fib_index = s->out2in.fib_index;
+      if (snat_is_unk_proto_session (s))
+        {
+          ed_key.proto = s->in2out.port;
+          ed_key.r_port = 0;
+          ed_key.l_port = 0;
+        }
+      else
+        {
+          ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
+          ed_key.l_port = s->out2in.port;
+          ed_key.r_port = s->ext_host_port;
+        }
+      ed_kv.key[0] = ed_key.as_u64[0];
+      ed_kv.key[1] = ed_key.as_u64[1];
+      if (clib_bihash_add_del_16_8 (&sm->out2in_ed, &ed_kv, 0))
+        clib_warning ("out2in_ed key del failed");
+
+      ed_key.l_addr = s->in2out.addr;
+      ed_key.fib_index = s->in2out.fib_index;
+      if (!snat_is_unk_proto_session (s))
+        ed_key.l_port = s->in2out.port;
+      if (is_twice_nat_session (s))
+        {
+          ed_key.r_addr = s->ext_host_nat_addr;
+          ed_key.r_port = s->ext_host_nat_port;
+        }
+      ed_kv.key[0] = ed_key.as_u64[0];
+      ed_kv.key[1] = ed_key.as_u64[1];
+      if (clib_bihash_add_del_16_8 (&sm->in2out_ed, &ed_kv, 0))
+        clib_warning ("in2out_ed key del failed");
+    }
+
+  if (snat_is_unk_proto_session (s))
+    return;
+
+  /* log NAT event */
+  snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
+                                      s->out2in.addr.as_u32,
+                                      s->in2out.protocol,
+                                      s->in2out.port,
+                                      s->out2in.port,
+                                      s->in2out.fib_index);
+
+  /* Twice NAT address and port for external host */
+  if (is_twice_nat_session (s))
+    {
+      for (i = 0; i < vec_len (sm->twice_nat_addresses); i++)
+        {
+          key.protocol = s->in2out.protocol;
+          key.port = s->ext_host_nat_port;
+          a = sm->twice_nat_addresses + i;
+          if (a->addr.as_u32 == s->ext_host_nat_addr.as_u32)
+            {
+              snat_free_outside_address_and_port (sm->twice_nat_addresses,
+                                                  thread_index, &key, i);
+              break;
+            }
+        }
+    }
+
+  if (is_ed_session (s))
+    return;
+
+  /* Session lookup tables */
+  kv.key = s->in2out.as_u64;
+  if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
+    clib_warning ("in2out key del failed");
+  kv.key = s->out2in.as_u64;
+  if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
+    clib_warning ("out2in key del failed");
+
+  if (snat_is_session_static (s))
+    return;
+
+  if (s->outside_address_index != ~0)
+    snat_free_outside_address_and_port (sm->addresses, thread_index,
+                                        &s->out2in, s->outside_address_index);
+}
+
+snat_user_t *
+nat_user_get_or_create (snat_main_t *sm, ip4_address_t *addr, u32 fib_index,
+                        u32 thread_index)
+{
+  snat_user_t *u = 0;
+  snat_user_key_t user_key;
+  clib_bihash_kv_8_8_t kv, value;
+  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+  dlist_elt_t * per_user_list_head_elt;
+
+  user_key.addr.as_u32 = addr->as_u32;
+  user_key.fib_index = fib_index;
+  kv.key = user_key.as_u64;
+
+  /* Ever heard of the "user" = src ip4 address before? */
+  if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
+    {
+      /* no, make a new one */
+      pool_get (tsm->users, u);
+      memset (u, 0, sizeof (*u));
+      u->addr.as_u32 = addr->as_u32;
+      u->fib_index = fib_index;
+
+      pool_get (tsm->list_pool, per_user_list_head_elt);
+
+      u->sessions_per_user_list_head_index = per_user_list_head_elt -
+        tsm->list_pool;
+
+      clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
+
+      kv.value = u - tsm->users;
+
+      /* add user */
+      if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
+        clib_warning ("user_hash keay add failed");
+    }
+  else
+    {
+      u = pool_elt_at_index (tsm->users, value.value);
+    }
+
+  return u;
+}
+
+snat_session_t *
+nat_session_alloc_or_recycle (snat_main_t *sm, snat_user_t *u, u32 thread_index)
+{
+  snat_session_t *s;
+  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+  u32 oldest_per_user_translation_list_index, session_index;
+  dlist_elt_t * oldest_per_user_translation_list_elt;
+  dlist_elt_t * per_user_translation_list_elt;
+
+  /* Over quota? Recycle the least recently used translation */
+  if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
+    {
+      oldest_per_user_translation_list_index =
+        clib_dlist_remove_head (tsm->list_pool,
+                                u->sessions_per_user_list_head_index);
+
+      ASSERT (oldest_per_user_translation_list_index != ~0);
+
+      /* Add it back to the end of the LRU list */
+      clib_dlist_addtail (tsm->list_pool,
+                          u->sessions_per_user_list_head_index,
+                          oldest_per_user_translation_list_index);
+      /* Get the list element */
+      oldest_per_user_translation_list_elt =
+        pool_elt_at_index (tsm->list_pool,
+                           oldest_per_user_translation_list_index);
+
+      /* Get the session index from the list element */
+      session_index = oldest_per_user_translation_list_elt->value;
+
+      /* Get the session */
+      s = pool_elt_at_index (tsm->sessions, session_index);
+      nat_free_session_data (sm, s, thread_index);
+      s->outside_address_index = ~0;
+      s->flags = 0;
+      s->total_bytes = 0;
+      s->total_pkts = 0;
+    }
+  else
+    {
+      pool_get (tsm->sessions, s);
+      memset (s, 0, sizeof (*s));
+      s->outside_address_index = ~0;
+
+      /* Create list elts */
+      pool_get (tsm->list_pool, per_user_translation_list_elt);
+      clib_dlist_init (tsm->list_pool,
+                       per_user_translation_list_elt - tsm->list_pool);
+
+      per_user_translation_list_elt->value = s - tsm->sessions;
+      s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
+      s->per_user_list_head_index = u->sessions_per_user_list_head_index;
+
+      clib_dlist_addtail (tsm->list_pool,
+                          s->per_user_list_head_index,
+                          per_user_translation_list_elt - tsm->list_pool);
+    }
+
+  return s;
+}
+
 static inline uword
 nat44_classify_node_fn_inline (vlib_main_t * vm,
                                vlib_node_runtime_t * node,
@@ -326,20 +528,25 @@ snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
                            FIB_SOURCE_PLUGIN_HI);
 }
 
-void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id)
+void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id,
+                       u8 twice_nat)
 {
   snat_address_t * ap;
   snat_interface_t *i;
   vlib_thread_main_t *tm = vlib_get_thread_main ();
 
   /* Check if address already exists */
-  vec_foreach (ap, sm->addresses)
+  vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
     {
       if (ap->addr.as_u32 == addr->as_u32)
         return;
     }
 
-  vec_add2 (sm->addresses, ap, 1);
+  if (twice_nat)
+    vec_add2 (sm->twice_nat_addresses, ap, 1);
+  else
+    vec_add2 (sm->addresses, ap, 1);
+
   ap->addr = *addr;
   if (vrf_id != ~0)
     ap->fib_index =
@@ -354,6 +561,9 @@ void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id)
   foreach_snat_protocol
 #undef _
 
+  if (twice_nat)
+    return;
+
   /* Add external address to FIB */
   pool_foreach (i, sm->interfaces,
   ({
@@ -431,12 +641,14 @@ snat_add_static_mapping_when_resolved (snat_main_t * sm,
  * @param addr_only If 0 address port and pair mapping, otherwise address only.
  * @param sw_if_index External port instead of specific IP address.
  * @param is_add If 0 delete static mapping, otherwise add.
+ * @param twice_nat If 1 translate external host address and port.
  *
  * @returns
  */
 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
-                            u32 sw_if_index, snat_protocol_t proto, int is_add)
+                            u32 sw_if_index, snat_protocol_t proto, int is_add,
+                            u8 twice_nat)
 {
   snat_main_t * sm = &snat_main;
   snat_static_mapping_t *m;
@@ -447,6 +659,7 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
   uword * p;
   snat_interface_t *interface;
   int i;
+  snat_main_per_thread_data_t *tsm;
 
   /* If the external address is a specific interface address */
   if (sw_if_index != ~0)
@@ -489,6 +702,9 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
       if (m)
         return VNET_API_ERROR_VALUE_EXIST;
 
+      if (twice_nat && addr_only)
+        return VNET_API_ERROR_UNSUPPORTED;
+
       /* Convert VRF id to FIB index */
       if (vrf_id != ~0)
         {
@@ -548,6 +764,7 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
       m->addr_only = addr_only;
       m->vrf_id = vrf_id;
       m->fib_index = fib_index;
+      m->twice_nat = twice_nat;
       if (!addr_only)
         {
           m->local_port = l_port;
@@ -555,6 +772,17 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
           m->proto = proto;
         }
 
+      if (sm->workers)
+        {
+          ip4_header_t ip = {
+            .src_address = m->local_addr,
+          };
+          m->worker_index = sm->worker_in2out_cb (&ip, m->fib_index);
+          tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
+        }
+      else
+        tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+
       m_key.addr = m->local_addr;
       m_key.port = m->local_port;
       m_key.protocol = m->proto;
@@ -562,6 +790,14 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
       kv.key = m_key.as_u64;
       kv.value = m - sm->static_mappings;
       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
+      if (twice_nat)
+        {
+          m_key.port = clib_host_to_net_u16 (l_port);
+          kv.key = m_key.as_u64;
+          kv.value = ~0ULL;
+          if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
+            clib_warning ("in2out key add failed");
+        }
 
       m_key.addr = m->external_addr;
       m_key.port = m->external_port;
@@ -569,14 +805,15 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
       kv.key = m_key.as_u64;
       kv.value = m - sm->static_mappings;
       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
-
-      if (sm->workers)
+      if (twice_nat)
         {
-          ip4_header_t ip = {
-            .src_address = m->local_addr,
-          };
-          m->worker_index = sm->worker_in2out_cb (&ip, m->fib_index);
+          m_key.port = clib_host_to_net_u16 (e_port);
+          kv.key = m_key.as_u64;
+          kv.value = ~0ULL;
+          if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
+            clib_warning ("out2in key add failed");
         }
+
     }
   else
     {
@@ -613,18 +850,39 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
             }
         }
 
+      if (sm->num_workers > 1)
+        tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
+      else
+        tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+
       m_key.addr = m->local_addr;
       m_key.port = m->local_port;
       m_key.protocol = m->proto;
       m_key.fib_index = m->fib_index;
       kv.key = m_key.as_u64;
       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
+      if (twice_nat)
+        {
+          m_key.port = clib_host_to_net_u16 (m->local_port);
+          kv.key = m_key.as_u64;
+          kv.value = ~0ULL;
+          if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
+            clib_warning ("in2out key del failed");
+        }
 
       m_key.addr = m->external_addr;
       m_key.port = m->external_port;
       m_key.fib_index = sm->outside_fib_index;
       kv.key = m_key.as_u64;
       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
+      if (twice_nat)
+        {
+          m_key.port = clib_host_to_net_u16 (m->external_port);
+          kv.key = m_key.as_u64;
+          kv.value = ~0ULL;
+          if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
+            clib_warning ("in2out key del failed");
+        }
 
       /* Delete session(s) for static mapping if exist */
       if (!(sm->static_mapping_only) ||
@@ -633,19 +891,14 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
           snat_user_key_t u_key;
           snat_user_t *u;
           dlist_elt_t * head, * elt;
-          u32 elt_index, head_index, del_elt_index;
+          u32 elt_index, head_index;
           u32 ses_index;
           u64 user_index;
           snat_session_t * s;
-          snat_main_per_thread_data_t *tsm;
 
           u_key.addr = m->local_addr;
           u_key.fib_index = m->fib_index;
           kv.key = u_key.as_u64;
-          if (sm->num_workers > 1)
-            tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
-          else
-            tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
             {
               user_index = value.value;
@@ -660,9 +913,7 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
                   while (ses_index != ~0)
                     {
                       s =  pool_elt_at_index (tsm->sessions, ses_index);
-                      del_elt_index = elt_index;
-                      elt_index = elt->next;
-                      elt = pool_elt_at_index (tsm->list_pool, elt_index);
+                      elt = pool_elt_at_index (tsm->list_pool, elt->next);
                       ses_index = elt->value;
 
                       if (!addr_only)
@@ -672,51 +923,10 @@ int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
                             continue;
                         }
 
-                      if (snat_is_unk_proto_session (s))
-                        {
-                          clib_bihash_kv_16_8_t up_kv;
-                          nat_ed_ses_key_t up_key;
-                          up_key.l_addr = s->in2out.addr;
-                          up_key.r_addr = s->ext_host_addr;
-                          up_key.fib_index = s->in2out.fib_index;
-                          up_key.proto = s->in2out.port;
-                          up_key.rsvd = 0;
-                          up_key.l_port = 0;
-                          up_kv.key[0] = up_key.as_u64[0];
-                          up_kv.key[1] = up_key.as_u64[1];
-                          if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
-                                                        &up_kv, 0))
-                            clib_warning ("in2out key del failed");
-
-                          up_key.l_addr = s->out2in.addr;
-                          up_key.fib_index = s->out2in.fib_index;
-                          up_kv.key[0] = up_key.as_u64[0];
-                          up_kv.key[1] = up_key.as_u64[1];
-                          if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
-                                                        &up_kv, 0))
-                            clib_warning ("out2in key del failed");
-
-                          goto delete;
-                        }
-                      /* log NAT event */
-                      snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
-                                                          s->out2in.addr.as_u32,
-                                                          s->in2out.protocol,
-                                                          s->in2out.port,
-                                                          s->out2in.port,
-                                                          s->in2out.fib_index);
-
-                      value.key = s->in2out.as_u64;
-                      if (clib_bihash_add_del_8_8 (&tsm->in2out, &value, 0))
-                        clib_warning ("in2out key del failed");
-                      value.key = s->out2in.as_u64;
-                      if (clib_bihash_add_del_8_8 (&tsm->out2in, &value, 0))
-                        clib_warning ("out2in key del failed");
-delete:
+                      nat_free_session_data (sm, s, tsm - sm->per_thread_data);
+                      clib_dlist_remove (tsm->list_pool, s->per_user_index);
+                      pool_put_index (tsm->list_pool, s->per_user_index);
                       pool_put (tsm->sessions, s);
-
-                      clib_dlist_remove (tsm->list_pool, del_elt_index);
-                      pool_put_index (tsm->list_pool, del_elt_index);
                       u->nstaticsessions--;
 
                       if (!addr_only)
@@ -761,7 +971,8 @@ delete:
 
 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
                                      snat_protocol_t proto, u32 vrf_id,
-                                     nat44_lb_addr_port_t *locals, u8 is_add)
+                                     nat44_lb_addr_port_t *locals, u8 is_add,
+                                     u8 twice_nat)
 {
   snat_main_t * sm = &snat_main;
   snat_static_mapping_t *m;
@@ -771,8 +982,12 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
   snat_address_t *a = 0;
   int i;
   nat44_lb_addr_port_t *local;
-  u32 worker_index = 0;
+  u32 worker_index = 0, elt_index, head_index, ses_index;
   snat_main_per_thread_data_t *tsm;
+  snat_user_key_t u_key;
+  snat_user_t *u;
+  snat_session_t * s;
+  dlist_elt_t * head, * elt;
 
   m_key.addr = e_addr;
   m_key.port = e_port;
@@ -841,6 +1056,7 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
       m->fib_index = fib_index;
       m->external_port = e_port;
       m->proto = proto;
+      m->twice_nat = twice_nat;
 
       m_key.addr = m->external_addr;
       m_key.port = m->external_port;
@@ -870,7 +1086,7 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
       kv.value = ~0ULL;
       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
         {
-          clib_warning ("static_mapping_by_local key add failed");
+          clib_warning ("out2in key add failed");
           return VNET_API_ERROR_UNSPECIFIED;
         }
 
@@ -972,6 +1188,38 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
               clib_warning ("in2out key del failed");
               return VNET_API_ERROR_UNSPECIFIED;
             }
+          /* Delete sessions */
+          u_key.addr = local->addr;
+          u_key.fib_index = m->fib_index;
+          kv.key = u_key.as_u64;
+          if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
+            {
+              u = pool_elt_at_index (tsm->users, value.value);
+              if (u->nstaticsessions)
+                {
+                  head_index = u->sessions_per_user_list_head_index;
+                  head = pool_elt_at_index (tsm->list_pool, head_index);
+                  elt_index = head->next;
+                  elt = pool_elt_at_index (tsm->list_pool, elt_index);
+                  ses_index = elt->value;
+                  while (ses_index != ~0)
+                    {
+                      s =  pool_elt_at_index (tsm->sessions, ses_index);
+                      elt = pool_elt_at_index (tsm->list_pool, elt->next);
+                      ses_index = elt->value;
+
+                      if ((s->in2out.addr.as_u32 != local->addr.as_u32) &&
+                          (clib_net_to_host_u16 (s->in2out.port) != local->port))
+                        continue;
+
+                      nat_free_session_data (sm, s, tsm - sm->per_thread_data);
+                      clib_dlist_remove (tsm->list_pool, s->per_user_index);
+                      pool_put_index (tsm->list_pool, s->per_user_index);
+                      pool_put (tsm->sessions, s);
+                      u->nstaticsessions--;
+                    }
+                }
+            }
         }
       vec_free(m->locals);
 
@@ -981,7 +1229,9 @@ int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
   return 0;
 }
 
-int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
+int
+snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm,
+                  u8 twice_nat)
 {
   snat_address_t *a = 0;
   snat_session_t *ses;
@@ -993,13 +1243,14 @@ int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
   snat_static_mapping_t *m;
   snat_interface_t *interface;
   int i;
+  snat_address_t *addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
 
   /* Find SNAT address */
-  for (i=0; i < vec_len (sm->addresses); i++)
+  for (i=0; i < vec_len (addresses); i++)
     {
-      if (sm->addresses[i].addr.as_u32 == addr.as_u32)
+      if (addresses[i].addr.as_u32 == addr.as_u32)
         {
-          a = sm->addresses + i;
+          a = addresses + i;
           break;
         }
     }
@@ -1014,7 +1265,7 @@ int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
                                             m->local_port, m->external_port,
                                             m->vrf_id, m->addr_only, ~0,
-                                            m->proto, 0);
+                                            m->proto, 0, m->twice_nat);
       }));
     }
   else
@@ -1039,46 +1290,11 @@ int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
           pool_foreach (ses, tsm->sessions, ({
             if (ses->out2in.addr.as_u32 == addr.as_u32)
               {
-                if (snat_is_unk_proto_session (ses))
-                  {
-                    clib_bihash_kv_16_8_t up_kv;
-                    nat_ed_ses_key_t up_key;
-                    up_key.l_addr = ses->in2out.addr;
-                    up_key.r_addr = ses->ext_host_addr;
-                    up_key.fib_index = ses->in2out.fib_index;
-                    up_key.proto = ses->in2out.port;
-                    up_key.rsvd = 0;
-                    up_key.l_port = 0;
-                    up_kv.key[0] = up_key.as_u64[0];
-                    up_kv.key[1] = up_key.as_u64[1];
-                    if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
-                                                  &up_kv, 0))
-                      clib_warning ("in2out key del failed");
-
-                    up_key.l_addr = ses->out2in.addr;
-                    up_key.fib_index = ses->out2in.fib_index;
-                    up_kv.key[0] = up_key.as_u64[0];
-                    up_kv.key[1] = up_key.as_u64[1];
-                    if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
-                                                  &up_kv, 0))
-                      clib_warning ("out2in key del failed");
-                  }
-                else
-                  {
-                    /* log NAT event */
-                    snat_ipfix_logging_nat44_ses_delete(ses->in2out.addr.as_u32,
-                                                        ses->out2in.addr.as_u32,
-                                                        ses->in2out.protocol,
-                                                        ses->in2out.port,
-                                                        ses->out2in.port,
-                                                        ses->in2out.fib_index);
-                    kv.key = ses->in2out.as_u64;
-                    clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0);
-                    kv.key = ses->out2in.as_u64;
-                    clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0);
-                  }
-                vec_add1 (ses_to_be_removed, ses - tsm->sessions);
+                ses->outside_address_index = ~0;
+                nat_free_session_data (sm, ses, tsm - sm->per_thread_data);
                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
+                pool_put_index (tsm->list_pool, ses->per_user_index);
+                vec_add1 (ses_to_be_removed, ses - tsm->sessions);
                 user_key.addr = ses->in2out.addr;
                 user_key.fib_index = ses->in2out.fib_index;
                 kv.key = user_key.as_u64;
@@ -1097,7 +1313,13 @@ int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
        }
     }
 
-  vec_del1 (sm->addresses, i);
+  if (twice_nat)
+    {
+      vec_del1 (sm->twice_nat_addresses, i);
+      return 0;
+    }
+  else
+    vec_del1 (sm->addresses, i);
 
   /* Delete external address from FIB */
   pool_foreach (interface, sm->interfaces,
@@ -1513,6 +1735,7 @@ void snat_free_outside_address_and_port (snat_address_t * addresses,
  * @param by_external If 0 match by local address otherwise match by external
  *                    address.
  * @param is_addr_only If matched mapping is address only
+ * @param twice_nat If matched mapping is twice NAT.
  *
  * @returns 0 if match found otherwise 1.
  */
@@ -1520,7 +1743,8 @@ int snat_static_mapping_match (snat_main_t * sm,
                                snat_session_key_t match,
                                snat_session_key_t * mapping,
                                u8 by_external,
-                               u8 *is_addr_only)
+                               u8 *is_addr_only,
+                               u8 *twice_nat)
 {
   clib_bihash_kv_8_8_t kv, value;
   snat_static_mapping_t *m;
@@ -1588,6 +1812,9 @@ int snat_static_mapping_match (snat_main_t * sm,
   if (PREDICT_FALSE(is_addr_only != 0))
     *is_addr_only = m->addr_only;
 
+  if (PREDICT_FALSE(twice_nat != 0))
+    *twice_nat = m->twice_nat;
+
   return 0;
 }
 
@@ -1774,6 +2001,7 @@ add_address_command_fn (vlib_main_t * vm,
   int is_add = 1;
   int rv = 0;
   clib_error_t *error = 0;
+  u8 twice_nat = 0;
 
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
@@ -1789,6 +2017,8 @@ add_address_command_fn (vlib_main_t * vm,
         ;
       else if (unformat (line_input, "%U", unformat_ip4_address, &start_addr))
         end_addr = start_addr;
+      else if (unformat (line_input, "twice-nat"))
+        twice_nat = 1;
       else if (unformat (line_input, "del"))
         is_add = 0;
       else
@@ -1827,9 +2057,9 @@ add_address_command_fn (vlib_main_t * vm,
   for (i = 0; i < count; i++)
     {
       if (is_add)
-        snat_add_address (sm, &this_addr, vrf_id);
+        snat_add_address (sm, &this_addr, vrf_id, twice_nat);
       else
-        rv = snat_del_address (sm, this_addr, 0);
+        rv = snat_del_address (sm, this_addr, 0, twice_nat);
 
       switch (rv)
         {
@@ -1855,7 +2085,7 @@ done:
 VLIB_CLI_COMMAND (add_address_command, static) = {
   .path = "nat44 add address",
   .short_help = "nat44 add address <ip4-range-start> [- <ip4-range-end>] "
-                "[tenant-vrf <vrf-id>] [del]",
+                "[tenant-vrf <vrf-id>] [twice-nat] [del]",
   .function = add_address_command_fn,
 };
 
@@ -2028,6 +2258,7 @@ add_static_mapping_command_fn (vlib_main_t * vm,
   int rv;
   snat_protocol_t proto = ~0;
   u8 proto_set = 0;
+  u8 twice_nat = 0;
 
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
@@ -2058,6 +2289,8 @@ add_static_mapping_command_fn (vlib_main_t * vm,
         ;
       else if (unformat (line_input, "%U", unformat_snat_protocol, &proto))
         proto_set = 1;
+      else if (unformat (line_input, "twice-nat"))
+        twice_nat = 1;
       else if (unformat (line_input, "del"))
         is_add = 0;
       else
@@ -2068,6 +2301,12 @@ add_static_mapping_command_fn (vlib_main_t * vm,
         }
     }
 
+  if (twice_nat && addr_only)
+    {
+      error = clib_error_return (0, "twice NAT only for 1:1 NAPT");
+      goto done;
+    }
+
   if (!addr_only && !proto_set)
     {
       error = clib_error_return (0, "missing protocol");
@@ -2075,7 +2314,8 @@ add_static_mapping_command_fn (vlib_main_t * vm,
     }
 
   rv = snat_add_static_mapping(l_addr, e_addr, (u16) l_port, (u16) e_port,
-                               vrf_id, addr_only, sw_if_index, proto, is_add);
+                               vrf_id, addr_only, sw_if_index, proto, is_add,
+                               twice_nat);
 
   switch (rv)
     {
@@ -2122,7 +2362,8 @@ VLIB_CLI_COMMAND (add_static_mapping_command, static) = {
   .path = "nat44 add static mapping",
   .function = add_static_mapping_command_fn,
   .short_help =
-    "nat44 add static mapping tcp|udp|icmp local <addr> [<port>] external <addr> [<port>] [vrf <table-id>] [del]",
+    "nat44 add static mapping tcp|udp|icmp local <addr> [<port>] "
+    "external <addr> [<port>] [vrf <table-id>] [twice-nat] [del]",
 };
 
 static clib_error_t *
@@ -2170,7 +2411,8 @@ add_identity_mapping_command_fn (vlib_main_t * vm,
     }
 
   rv = snat_add_static_mapping(addr, addr, (u16) port, (u16) port,
-                               vrf_id, addr_only, sw_if_index, proto, is_add);
+                               vrf_id, addr_only, sw_if_index, proto, is_add,
+                               0);
 
   switch (rv)
     {
@@ -2233,6 +2475,7 @@ add_lb_static_mapping_command_fn (vlib_main_t * vm,
   snat_protocol_t proto;
   u8 proto_set = 0;
   nat44_lb_addr_port_t *locals = 0, local;
+  u8 twice_nat = 0;
 
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
@@ -2257,6 +2500,8 @@ add_lb_static_mapping_command_fn (vlib_main_t * vm,
       else if (unformat (line_input, "protocol %U", unformat_snat_protocol,
                          &proto))
         proto_set = 1;
+      else if (unformat (line_input, "twice-nat"))
+        twice_nat = 1;
       else if (unformat (line_input, "del"))
         is_add = 0;
       else
@@ -2280,7 +2525,7 @@ add_lb_static_mapping_command_fn (vlib_main_t * vm,
     }
 
   rv = nat44_add_del_lb_static_mapping (e_addr, (u16) e_port, proto, vrf_id,
-                                        locals, is_add);
+                                        locals, is_add, twice_nat);
 
   switch (rv)
     {
@@ -2311,7 +2556,9 @@ VLIB_CLI_COMMAND (add_lb_static_mapping_command, static) = {
   .path = "nat44 add load-balancing static mapping",
   .function = add_lb_static_mapping_command_fn,
   .short_help =
-    "nat44 add load-balancing static mapping protocol tcp|udp external <addr>:<port> local <addr>:<port> probability <n> [vrf <table-id>] [del]",
+    "nat44 add load-balancing static mapping protocol tcp|udp "
+    "external <addr>:<port> local <addr>:<port> probability <n> [twice-nat] "
+    "[vrf <table-id>] [del]",
 };
 
 static clib_error_t *
@@ -2524,7 +2771,7 @@ snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
       key.r_addr = ip0->src_address;
       key.fib_index = rx_fib_index0;
       key.proto = ip0->protocol;
-      key.rsvd = 0;
+      key.r_port = 0;
       key.l_port = 0;
       s_kv.key[0] = key.as_u64[0];
       s_kv.key[1] = key.as_u64[1];
@@ -2779,10 +3026,12 @@ u8 * format_snat_session (u8 * s, va_list * args)
   if (snat_is_unk_proto_session (sess))
     {
       s = format (s, "  i2o %U proto %u fib %u\n",
-                  format_ip4_address, &sess->in2out.addr, sess->in2out.port,
+                  format_ip4_address, &sess->in2out.addr,
+                  clib_net_to_host_u16 (sess->in2out.port),
                   sess->in2out.fib_index);
       s = format (s, "    o2i %U proto %u fib %u\n",
-                  format_ip4_address, &sess->out2in.addr, sess->out2in.port,
+                  format_ip4_address, &sess->out2in.addr,
+                  clib_net_to_host_u16 (sess->out2in.port),
                   sess->out2in.fib_index);
     }
   else
@@ -2790,9 +3039,20 @@ u8 * format_snat_session (u8 * s, va_list * args)
       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
     }
-  if (sess->ext_host_addr.as_u32)
-      s = format (s, "       external host %U\n",
-                  format_ip4_address, &sess->ext_host_addr);
+  if (is_twice_nat_session (sess))
+    {
+      s = format (s, "       external host o2i %U:%d i2o %U:%d\n",
+                  format_ip4_address, &sess->ext_host_addr,
+                  clib_net_to_host_u16 (sess->ext_host_port),
+                  format_ip4_address, &sess->ext_host_nat_addr,
+                  clib_net_to_host_u16 (sess->ext_host_nat_port));
+    }
+  else
+    {
+      if (sess->ext_host_addr.as_u32)
+          s = format (s, "       external host %U\n",
+                      format_ip4_address, &sess->ext_host_addr);
+    }
   s = format (s, "       last heard %.2f\n", sess->last_heard);
   s = format (s, "       total pkts %d, total bytes %lld\n",
               sess->total_pkts, sess->total_bytes);
@@ -2802,6 +3062,8 @@ u8 * format_snat_session (u8 * s, va_list * args)
     s = format (s, "       dynamic translation\n");
   if (sess->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
     s = format (s, "       load-balancing\n");
+  if (is_twice_nat_session (sess))
+    s = format (s, "       twice-nat\n");
 
   return s;
 }
@@ -2852,29 +3114,30 @@ u8 * format_snat_static_mapping (u8 * s, va_list * args)
   nat44_lb_addr_port_t *local;
 
   if (m->addr_only)
-      s = format (s, "local %U external %U vrf %d",
+      s = format (s, "local %U external %U vrf %d %s",
                   format_ip4_address, &m->local_addr,
                   format_ip4_address, &m->external_addr,
-                  m->vrf_id);
+                  m->vrf_id, m->twice_nat ? "twice-nat" : "");
   else
    {
       if (vec_len (m->locals))
         {
-          s = format (s, "%U vrf %d external %U:%d",
+          s = format (s, "%U vrf %d external %U:%d %s",
                       format_snat_protocol, m->proto,
                       m->vrf_id,
-                      format_ip4_address, &m->external_addr, m->external_port);
+                      format_ip4_address, &m->external_addr, m->external_port,
+                      m->twice_nat ? "twice-nat" : "");
           vec_foreach (local, m->locals)
             s = format (s, "\n  local %U:%d probability %d\%",
                         format_ip4_address, &local->addr, local->port,
                         local->probability);
         }
       else
-        s = format (s, "%U local %U:%d external %U:%d vrf %d",
+        s = format (s, "%U local %U:%d external %U:%d vrf %d %s",
                     format_snat_protocol, m->proto,
                     format_ip4_address, &m->local_addr, m->local_port,
                     format_ip4_address, &m->external_addr, m->external_port,
-                    m->vrf_id);
+                    m->vrf_id, m->twice_nat ? "twice-nat" : "");
    }
   return s;
 }
@@ -3002,6 +3265,17 @@ show_snat_command_fn (vlib_main_t * vm,
             }
         }
 
+      if (vec_len (sm->auto_add_sw_if_indices_twice_nat))
+        {
+          vlib_cli_output (vm, "NAT44 twice-nat pool addresses interfaces:");
+          vec_foreach (sw_if_index, sm->auto_add_sw_if_indices_twice_nat)
+            {
+              vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
+                               vnet_get_sw_interface (vnm, *sw_if_index));
+            }
+        }
+
+      vlib_cli_output (vm, "NAT44 pool addresses:");
       vec_foreach (ap, sm->addresses)
         {
           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
@@ -3015,6 +3289,21 @@ show_snat_command_fn (vlib_main_t * vm,
           foreach_snat_protocol
 #undef _
         }
+
+      vlib_cli_output (vm, "NAT44 twice-nat pool addresses:");
+      vec_foreach (ap, sm->twice_nat_addresses)
+        {
+          vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
+          if (ap->fib_index != ~0)
+              vlib_cli_output (vm, "  tenant VRF: %u",
+                               ip4_fib_get(ap->fib_index)->table_id);
+          else
+            vlib_cli_output (vm, "  tenant VRF independent");
+#define _(N, i, n, s) \
+          vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
+          foreach_snat_protocol
+#undef _
+        }
     }
 
   if (sm->num_workers > 1)
@@ -3090,11 +3379,12 @@ show_snat_command_fn (vlib_main_t * vm,
             }
 
           vlib_cli_output (vm, "%d users, %d outside addresses, %d active sessions,"
-                           " %d static mappings",
+                           " %d static mappings, %d twice-nat addresses",
                            users_num,
                            vec_len (sm->addresses),
                            sessions_num,
-                           pool_elts (sm->static_mappings));
+                           pool_elts (sm->static_mappings),
+                           vec_len (sm->twice_nat_addresses));
 
           if (verbose > 0)
             {
@@ -3169,87 +3459,104 @@ snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
   ip4_address_t l_addr;
   int i, j;
   int rv;
+  u8 twice_nat = 0;
+  snat_address_t *addresses = sm->addresses;
 
   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
     {
       if (sw_if_index == sm->auto_add_sw_if_indices[i])
+          goto match;
+    }
+
+  for (i = 0; i < vec_len(sm->auto_add_sw_if_indices_twice_nat); i++)
+    {
+      twice_nat = 1;
+      addresses = sm->twice_nat_addresses;
+      if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
+          goto match;
+    }
+
+  return;
+
+match:
+  if (!is_delete)
+    {
+      /* Don't trip over lease renewal, static config */
+      for (j = 0; j < vec_len(addresses); j++)
+        if (addresses[j].addr.as_u32 == address->as_u32)
+          return;
+
+      snat_add_address (sm, address, ~0, twice_nat);
+      /* Scan static map resolution vector */
+      for (j = 0; j < vec_len (sm->to_resolve); j++)
         {
-          if (!is_delete)
+          rp = sm->to_resolve + j;
+          /* On this interface? */
+          if (rp->sw_if_index == sw_if_index)
             {
-              /* Don't trip over lease renewal, static config */
-              for (j = 0; j < vec_len(sm->addresses); j++)
-                if (sm->addresses[j].addr.as_u32 == address->as_u32)
-                  return;
-
-              snat_add_address (sm, address, ~0);
-              /* Scan static map resolution vector */
-              for (j = 0; j < vec_len (sm->to_resolve); j++)
-                {
-                  rp = sm->to_resolve + j;
-                  /* On this interface? */
-                  if (rp->sw_if_index == sw_if_index)
-                    {
-                      /* Indetity mapping? */
-                      if (rp->l_addr.as_u32 == 0)
-                        l_addr.as_u32 = address[0].as_u32;
-                      else
-                        l_addr.as_u32 = rp->l_addr.as_u32;
-                      /* Add the static mapping */
-                      rv = snat_add_static_mapping (l_addr,
-                                                    address[0],
-                                                    rp->l_port,
-                                                    rp->e_port,
-                                                    rp->vrf_id,
-                                                    rp->addr_only,
-                                                    ~0 /* sw_if_index */,
-                                                    rp->proto,
-                                                    rp->is_add);
-                      if (rv)
-                        clib_warning ("snat_add_static_mapping returned %d",
-                                      rv);
-                      vec_add1 (indices_to_delete, j);
-                    }
-                }
-              /* If we resolved any of the outstanding static mappings */
-              if (vec_len(indices_to_delete))
-                {
-                  /* Delete them */
-                  for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
-                    vec_delete(sm->to_resolve, 1, j);
-                  vec_free(indices_to_delete);
-                }
-              return;
-            }
-          else
-            {
-              (void) snat_del_address(sm, address[0], 1);
-              return;
+              /* Indetity mapping? */
+              if (rp->l_addr.as_u32 == 0)
+                l_addr.as_u32 = address[0].as_u32;
+              else
+                l_addr.as_u32 = rp->l_addr.as_u32;
+              /* Add the static mapping */
+              rv = snat_add_static_mapping (l_addr,
+                                            address[0],
+                                            rp->l_port,
+                                            rp->e_port,
+                                            rp->vrf_id,
+                                            rp->addr_only,
+                                            ~0 /* sw_if_index */,
+                                            rp->proto,
+                                            rp->is_add,
+                                            0);
+              if (rv)
+                clib_warning ("snat_add_static_mapping returned %d",
+                              rv);
+              vec_add1 (indices_to_delete, j);
             }
         }
+      /* If we resolved any of the outstanding static mappings */
+      if (vec_len(indices_to_delete))
+        {
+          /* Delete them */
+          for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
+            vec_delete(sm->to_resolve, 1, j);
+          vec_free(indices_to_delete);
+        }
+      return;
+    }
+  else
+    {
+      (void) snat_del_address(sm, address[0], 1, twice_nat);
+      return;
     }
 }
 
 
-int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
+int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del,
+                                u8 twice_nat)
 {
   ip4_main_t * ip4_main = sm->ip4_main;
   ip4_address_t * first_int_addr;
   snat_static_map_resolve_t *rp;
   u32 *indices_to_delete = 0;
   int i, j;
+  u32 *auto_add_sw_if_indices =
+    twice_nat ? sm->auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
 
   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
                                                 0 /* just want the address*/);
 
-  for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
+  for (i = 0; i < vec_len(auto_add_sw_if_indices); i++)
     {
-      if (sm->auto_add_sw_if_indices[i] == sw_if_index)
+      if (auto_add_sw_if_indices[i] == sw_if_index)
         {
           if (is_del)
             {
               /* if have address remove it */
               if (first_int_addr)
-                  (void) snat_del_address (sm, first_int_addr[0], 1);
+                  (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
               else
                 {
                   for (j = 0; j < vec_len (sm->to_resolve); j++)
@@ -3265,7 +3572,10 @@ int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
                       vec_free(indices_to_delete);
                     }
                 }
-              vec_del1(sm->auto_add_sw_if_indices, i);
+              if (twice_nat)
+                vec_del1(sm->auto_add_sw_if_indices_twice_nat, i);
+              else
+                vec_del1(sm->auto_add_sw_if_indices, i);
             }
           else
             return VNET_API_ERROR_VALUE_EXIST;
@@ -3278,11 +3588,14 @@ int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
     return VNET_API_ERROR_NO_SUCH_ENTRY;
 
   /* add to the auto-address list */
-  vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
+  if (twice_nat)
+    vec_add1(sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
+  else
+    vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
 
   /* If the address is already bound - or static - add it now */
   if (first_int_addr)
-      snat_add_address (sm, first_int_addr, ~0);
+      snat_add_address (sm, first_int_addr, ~0, twice_nat);
 
   return 0;
 }
@@ -3298,6 +3611,7 @@ snat_add_interface_address_command_fn (vlib_main_t * vm,
   int rv;
   int is_del = 0;
   clib_error_t *error = 0;
+  u8 twice_nat = 0;
 
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
@@ -3308,6 +3622,8 @@ snat_add_interface_address_command_fn (vlib_main_t * vm,
       if (unformat (line_input, "%U", unformat_vnet_sw_interface,
                     sm->vnet_main, &sw_if_index))
         ;
+      else if (unformat (line_input, "twice-nat"))
+        twice_nat = 1;
       else if (unformat (line_input, "del"))
         is_del = 1;
       else
@@ -3318,7 +3634,7 @@ snat_add_interface_address_command_fn (vlib_main_t * vm,
         }
     }
 
-  rv = snat_add_interface_address (sm, sw_if_index, is_del);
+  rv = snat_add_interface_address (sm, sw_if_index, is_del, twice_nat);
 
   switch (rv)
     {
@@ -3339,7 +3655,7 @@ done:
 
 VLIB_CLI_COMMAND (snat_add_interface_address_command, static) = {
     .path = "nat44 add interface address",
-    .short_help = "nat44 add interface address <interface> [del]",
+    .short_help = "nat44 add interface address <interface> [twice-nat] [del]",
     .function = snat_add_interface_address_command_fn,
 };