nat: 1:1 policy NAT

A NAT sub-plugin doing statically configured match/rewrite on IP4 input or output.
It's stateless (no connection tracking).
Currently it supports rewriting of SA, DA and TCP/UDP ports.
It should be simple to add new rewrites if required.

API:
pnat_binding_add, pnat_binding_del, pnat_bindings_get, pnat_interfaces_get

CLI:
set pnat translation interface <name> match <5-tuple> rewrite <5-tuple> {in|out} [del]
show pnat translations
show pnat interfaces

Trying a new C based unit testing scheme. Where the graph node is tested
in isolation. See pnat/pnat_test.c.
Also added new cmake targets to generate coverage directly.
E.g.:
make test_pnat-ccov-report

File '/vpp/sdnat/src/plugins/nat/pnat/pnat.c':
Name                               Regions    Miss   Cover     Lines    Miss   Cover
------------------------------------------------------------------------------------
pnat_interface_by_sw_if_index           39       8  79.49%        13       0 100.00%
pnat_instructions_from_mask              9       0 100.00%        13       0 100.00%
pnat_binding_add                        64       8  87.50%        31       2  93.55%
pnat_flow_lookup                         4       4   0.00%        10      10   0.00%
pnat_binding_attach                    104      75  27.88%        33       6  81.82%
pnat_binding_detach                     30       5  83.33%        23       2  91.30%
pnat_binding_del                        97      33  65.98%        17       3  82.35%
pnat.c:pnat_calc_key_from_5tuple         9       1  88.89%        14       1  92.86%
pnat.c:pnat_interface_check_mask        10       2  80.00%        11       2  81.82%
pnat.c:pnat_enable                       5       0 100.00%        11       0 100.00%
pnat.c:pnat_enable_interface           107      26  75.70%        60      15  75.00%
pnat.c:pnat_disable_interface           91      30  67.03%        32       7  78.12%
pnat.c:pnat_disable                      7       2  71.43%        13       7  46.15%
------------------------------------------------------------------------------------
TOTAL                                  576     194  66.32%       281      55  80.43%

File '/vpp/sdnat/src/plugins/nat/pnat/pnat_node.h':
Name                               Regions    Miss   Cover     Lines    Miss   Cover
------------------------------------------------------------------------------------
pnat_test.c:pnat_node_inline            67      11  83.58%       115       1  99.13%
pnat_test.c:pnat_calc_key                9       2  77.78%        14       2  85.71%
pnat_test.c:pnat_rewrite_ip4            55      11  80.00%        60      12  80.00%
pnat_test.c:format_pnat_trace            1       1   0.00%        12      12   0.00%
pnat_node.c:pnat_node_inline            63      63   0.00%       115     115   0.00%
pnat_node.c:pnat_calc_key                9       9   0.00%        14      14   0.00%
pnat_node.c:pnat_rewrite_ip4            55      55   0.00%        60      60   0.00%
pnat_node.c:format_pnat_trace            5       5   0.00%        12      12   0.00%
------------------------------------------------------------------------------------
TOTAL                                  264     157  40.53%       402     228  43.28%

Type: feature
Change-Id: I9c897f833603054a8303e7369ebff6512517c9e0
Signed-off-by: Ole Troan <ot@cisco.com>

1 files changed, 121 insertions, 0 deletions

diff --git a/src/plugins/nat/pnat/pnat.h b/src/plugins/nat/pnat/pnat.h
new file mode 100644
index 00000000000..c5869ce3ca6
--- /dev/null
+++ b/src/plugins/nat/pnat/pnat.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_pnat_h
+#define included_pnat_h
+
+#include <stdbool.h>
+#include <vnet/ip/ip4_packet.h>
+#include <vppinfra/bihash_16_8.h>
+
+#define PNAT_FLOW_HASH_BUCKETS 256
+
+/* Definitions from pnat.api */
+#include <pnat/pnat.api_types.h>
+typedef vl_api_pnat_5tuple_t pnat_5tuple_t;
+typedef vl_api_pnat_mask_t pnat_mask_t;
+typedef vl_api_pnat_attachment_point_t pnat_attachment_point_t;
+
+/* Rewrite instructions */
+typedef enum {
+    PNAT_INSTR_NONE = 1 << 0,
+    PNAT_INSTR_SOURCE_ADDRESS = 1 << 1,
+    PNAT_INSTR_SOURCE_PORT = 1 << 2,
+    PNAT_INSTR_DESTINATION_ADDRESS = 1 << 3,
+    PNAT_INSTR_DESTINATION_PORT = 1 << 4,
+} pnat_instructions_t;
+
+typedef struct {
+    u64 as_u64[2];
+} pnat_mask_fast_t;
+
+/* Session cache entries */
+typedef struct {
+    /* What to translate to */
+    pnat_instructions_t instructions;
+
+    /* Stored in network byte order */
+    ip4_address_t post_sa;
+    ip4_address_t post_da;
+    u16 post_sp;
+    u16 post_dp;
+
+    /* Used for trace/show commands */
+    pnat_5tuple_t match;
+    pnat_5tuple_t rewrite;
+} pnat_translation_t;
+
+/* Interface object */
+typedef struct {
+    u32 sw_if_index;
+    pnat_mask_t lookup_mask[PNAT_ATTACHMENT_POINT_MAX];
+    pnat_mask_fast_t lookup_mask_fast[PNAT_ATTACHMENT_POINT_MAX];
+
+    /* Feature chain enabled on interface */
+    bool enabled[PNAT_ATTACHMENT_POINT_MAX];
+
+    u32 refcount;
+} pnat_interface_t;
+
+/* Globals */
+typedef struct {
+    bool enabled;
+
+    clib_bihash_16_8_t flowhash; /* Bi-directional */
+
+    /* Interface pool */
+    pnat_interface_t *interfaces;
+    u32 *interface_by_sw_if_index;
+
+    /* Translations pool */
+    pnat_translation_t *translations;
+
+    u16 msg_id_base;
+} pnat_main_t;
+extern pnat_main_t pnat_main;
+
+pnat_interface_t *pnat_interface_by_sw_if_index(u32 sw_if_index);
+
+/* Packet trace information */
+typedef struct {
+    u32 pool_index;
+    pnat_5tuple_t match;
+    pnat_5tuple_t rewrite;
+} pnat_trace_t;
+
+int pnat_binding_add(pnat_5tuple_t *match, pnat_5tuple_t *rewrite,
+                     u32 *binding_index);
+int pnat_binding_del(u32 binding_index);
+int pnat_binding_attach(u32 sw_if_index, pnat_attachment_point_t attachment,
+                        u32 binding_index);
+int pnat_binding_detach(u32 sw_if_index, pnat_attachment_point_t attachment,
+                        u32 binding_index);
+u32 pnat_flow_lookup(u32 sw_if_index, pnat_attachment_point_t attachment,
+                     pnat_5tuple_t *match);
+
+static inline void
+pnat_calc_key(u32 sw_if_index, pnat_attachment_point_t attachment,
+              ip4_address_t src, ip4_address_t dst, u8 protocol, u16 sport,
+              u16 dport, pnat_mask_fast_t mask, clib_bihash_kv_16_8_t *kv) {
+    kv->key[0] = kv->key[1] = 0;
+    kv->key[0] = (u64)src.as_u32 << 32 | dst.as_u32;
+    kv->key[0] &= mask.as_u64[0];
+    kv->key[1] |=
+        (u64)protocol << 56 | (u64)sw_if_index << 36 | (u64)attachment << 32;
+    kv->key[1] |= sport << 16 | dport;
+    kv->key[1] &= mask.as_u64[1];
+}
+
+#endif