diff options
| author |   Klement Sekera <ksekera@cisco.com> | 2021-02-02 13:25:40 +0100 |
|---|---|---|
| committer |   Ole Tr�an <otroan@employees.org> | 2021-02-10 13:12:33 +0000 |
| commit | 98d82ca04ba438cd2ba3c03de6e1e82e4786cd83 (patch) | |
| tree | d63d0b002555b63730fab3cea261d824c21986b1 /src/plugins/nat/nat.c | |
| parent | 4f423bf6b4f3dedf6a3e8d5bbb38c31558d13534 (diff) | |
nat: fix EI hairpinning thread safety
Avoid doing inter-thread reads without locks by doing a handoff before
destination address rewrite. Destination address is read from a session
which is possibly owned by a different thread. By splitting the work in
two parts with a handoff in the middle, we can do both in a thread safe
way.
Type: improvement
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: I1c50d188393a610f5564fa230c75771a8065f273
Diffstat (limited to 'src/plugins/nat/nat.c')
| -rw-r--r-- | src/plugins/nat/nat.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c index 11e2d193240..85d4775c8fe 100644 --- a/src/plugins/nat/nat.c +++ b/src/plugins/nat/nat.c @@ -2514,6 +2514,13 @@ do \ vlib_zero_simple_counter (&c, 0); \ } while (0); +extern vlib_node_registration_t nat44_hairpinning_node; +extern vlib_node_registration_t snat_hairpin_dst_node; +extern vlib_node_registration_t + nat44_in2out_hairpinning_finish_ip4_lookup_node; +extern vlib_node_registration_t + nat44_in2out_hairpinning_finish_interface_output_node; + static clib_error_t * nat_init (vlib_main_t * vm) { @@ -2632,6 +2639,17 @@ nat_init (vlib_main_t * vm) nat_ha_init (vm, sm->num_workers, num_threads); test_key_calc_split (); + + sm->nat44_hairpinning_fq_index = + vlib_frame_queue_main_init (nat44_hairpinning_node.index, 0); + sm->snat_hairpin_dst_fq_index = + vlib_frame_queue_main_init (snat_hairpin_dst_node.index, 0); + sm->nat44_in2out_hairpinning_finish_ip4_lookup_node_fq_index = + vlib_frame_queue_main_init ( + nat44_in2out_hairpinning_finish_ip4_lookup_node.index, 0); + sm->nat44_in2out_hairpinning_finish_interface_output_node_fq_index = + vlib_frame_queue_main_init ( + nat44_in2out_hairpinning_finish_interface_output_node.index, 0); return nat44_api_hookup (vm); } |