aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/nat/pnat/pnat_cli.c
diff options
context:
space:
mode:
authorOle Troan <ot@cisco.com>2021-01-12 21:49:38 +0100
committerNeale Ranns <neale@graphiant.com>2021-02-05 13:27:48 +0000
commit18327be5d458f9f73c12d76e677ee5a068ec6b10 (patch)
treebac6dbc08280e5bd6d5749ea56c862e6cdc38434 /src/plugins/nat/pnat/pnat_cli.c
parent490b92738f3cc1c8d534abd6dee8dba942cb652d (diff)
nat: 1:1 policy NAT
A NAT sub-plugin doing statically configured match/rewrite on IP4 input or output. It's stateless (no connection tracking). Currently it supports rewriting of SA, DA and TCP/UDP ports. It should be simple to add new rewrites if required. API: pnat_binding_add, pnat_binding_del, pnat_bindings_get, pnat_interfaces_get CLI: set pnat translation interface <name> match <5-tuple> rewrite <5-tuple> {in|out} [del] show pnat translations show pnat interfaces Trying a new C based unit testing scheme. Where the graph node is tested in isolation. See pnat/pnat_test.c. Also added new cmake targets to generate coverage directly. E.g.: make test_pnat-ccov-report File '/vpp/sdnat/src/plugins/nat/pnat/pnat.c': Name Regions Miss Cover Lines Miss Cover ------------------------------------------------------------------------------------ pnat_interface_by_sw_if_index 39 8 79.49% 13 0 100.00% pnat_instructions_from_mask 9 0 100.00% 13 0 100.00% pnat_binding_add 64 8 87.50% 31 2 93.55% pnat_flow_lookup 4 4 0.00% 10 10 0.00% pnat_binding_attach 104 75 27.88% 33 6 81.82% pnat_binding_detach 30 5 83.33% 23 2 91.30% pnat_binding_del 97 33 65.98% 17 3 82.35% pnat.c:pnat_calc_key_from_5tuple 9 1 88.89% 14 1 92.86% pnat.c:pnat_interface_check_mask 10 2 80.00% 11 2 81.82% pnat.c:pnat_enable 5 0 100.00% 11 0 100.00% pnat.c:pnat_enable_interface 107 26 75.70% 60 15 75.00% pnat.c:pnat_disable_interface 91 30 67.03% 32 7 78.12% pnat.c:pnat_disable 7 2 71.43% 13 7 46.15% ------------------------------------------------------------------------------------ TOTAL 576 194 66.32% 281 55 80.43% File '/vpp/sdnat/src/plugins/nat/pnat/pnat_node.h': Name Regions Miss Cover Lines Miss Cover ------------------------------------------------------------------------------------ pnat_test.c:pnat_node_inline 67 11 83.58% 115 1 99.13% pnat_test.c:pnat_calc_key 9 2 77.78% 14 2 85.71% pnat_test.c:pnat_rewrite_ip4 55 11 80.00% 60 12 80.00% pnat_test.c:format_pnat_trace 1 1 0.00% 12 12 0.00% pnat_node.c:pnat_node_inline 63 63 0.00% 115 115 0.00% pnat_node.c:pnat_calc_key 9 9 0.00% 14 14 0.00% pnat_node.c:pnat_rewrite_ip4 55 55 0.00% 60 60 0.00% pnat_node.c:format_pnat_trace 5 5 0.00% 12 12 0.00% ------------------------------------------------------------------------------------ TOTAL 264 157 40.53% 402 228 43.28% Type: feature Change-Id: I9c897f833603054a8303e7369ebff6512517c9e0 Signed-off-by: Ole Troan <ot@cisco.com>
Diffstat (limited to 'src/plugins/nat/pnat/pnat_cli.c')
-rw-r--r--src/plugins/nat/pnat/pnat_cli.c274
1 files changed, 274 insertions, 0 deletions
diff --git a/src/plugins/nat/pnat/pnat_cli.c b/src/plugins/nat/pnat/pnat_cli.c
new file mode 100644
index 00000000000..2d389013c08
--- /dev/null
+++ b/src/plugins/nat/pnat/pnat_cli.c
@@ -0,0 +1,274 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdbool.h>
+#include <vlib/vlib.h>
+#include <vnet/feature/feature.h>
+#include <vnet/ip/ip.h>
+#include <vnet/ip/ip4.h>
+#include <vnet/ip/ip4_packet.h>
+#include <vppinfra/clib_error.h>
+#include <vppinfra/pool.h>
+#include "pnat.h"
+
+/*
+ * This file contains the handlers for the (unsupported) VPP debug CLI.
+ */
+u8 *format_pnat_5tuple(u8 *s, va_list *args) {
+ pnat_5tuple_t *t = va_arg(*args, pnat_5tuple_t *);
+ s = format(s, "{");
+ if (t->mask & PNAT_SA)
+ s = format(s, "%U", format_ip4_address, &t->src);
+ else
+ s = format(s, "*");
+ if (t->mask & PNAT_SPORT)
+ s = format(s, ":%u,", t->sport);
+ else
+ s = format(s, ":*,");
+ if (t->proto > 0)
+ s = format(s, "%U,", format_ip_protocol, t->proto);
+ else
+ s = format(s, "*,");
+ if (t->mask & PNAT_DA)
+ s = format(s, "%U", format_ip4_address, &t->dst);
+ else
+ s = format(s, "*");
+ if (t->mask & PNAT_DPORT)
+ s = format(s, ":%u", t->dport);
+ else
+ s = format(s, ":*");
+ s = format(s, "}");
+ return s;
+}
+
+u8 *format_pnat_translation(u8 *s, va_list *args) {
+ u32 index = va_arg(*args, u32);
+ pnat_translation_t *t = va_arg(*args, pnat_translation_t *);
+ s = format(s, "[%d] match: %U rewrite: %U", index, format_pnat_5tuple,
+ &t->match, format_pnat_5tuple, &t->rewrite);
+ return s;
+}
+
+static u8 *format_pnat_mask(u8 *s, va_list *args) {
+ pnat_mask_t t = va_arg(*args, pnat_mask_t);
+ if (t & PNAT_SA)
+ s = format(s, "SA ");
+ if (t & PNAT_SPORT)
+ s = format(s, "SP ");
+ if (t & PNAT_DA)
+ s = format(s, "DA ");
+ if (t & PNAT_DPORT)
+ s = format(s, "DP");
+ return s;
+}
+
+static u8 *format_pnat_interface(u8 *s, va_list *args) {
+ pnat_interface_t *interface = va_arg(*args, pnat_interface_t *);
+ s = format(s, "sw_if_index: %d", interface->sw_if_index);
+ if (interface->enabled[PNAT_IP4_INPUT]) {
+ s = format(s, " input mask: %U", format_pnat_mask,
+ interface->lookup_mask[PNAT_IP4_INPUT]);
+ }
+ if (interface->enabled[PNAT_IP4_OUTPUT]) {
+ s = format(s, " output mask: %U", format_pnat_mask,
+ interface->lookup_mask[PNAT_IP4_OUTPUT]);
+ }
+ return s;
+}
+
+uword unformat_pnat_5tuple(unformat_input_t *input, va_list *args) {
+ pnat_5tuple_t *t = va_arg(*args, pnat_5tuple_t *);
+ u32 dport, sport;
+ while (1) {
+ if (unformat(input, "src %U", unformat_ip4_address, &t->src))
+ t->mask |= PNAT_SA;
+ else if (unformat(input, "dst %U", unformat_ip4_address, &t->dst))
+ t->mask |= PNAT_DA;
+ else if (unformat(input, "sport %d", &sport)) {
+ if (sport < 0 || sport > 65535)
+ return 0;
+ t->mask |= PNAT_SPORT;
+ t->sport = sport;
+ } else if (unformat(input, "dport %d", &dport)) {
+ if (dport < 0 || dport > 65535)
+ return 0;
+ t->mask |= PNAT_DPORT;
+ t->dport = dport;
+ } else if (unformat(input, "proto %U", unformat_ip_protocol, &t->proto))
+ ;
+ else
+ break;
+ }
+ return 1;
+}
+
+static clib_error_t *set_pnat_translation_command_fn(vlib_main_t *vm,
+ unformat_input_t *input,
+ vlib_cli_command_t *cmd) {
+ unformat_input_t _line_input, *line_input = &_line_input;
+ clib_error_t *error = 0;
+ bool in = false, out = false;
+ bool match_set = false, rewrite_set = false;
+ bool add = true;
+ u32 sw_if_index = ~0;
+ pnat_5tuple_t match = {0};
+ pnat_5tuple_t rewrite = {0};
+
+ /* Get a line of input. */
+ if (!unformat_user(input, unformat_line_input, line_input))
+ return 0;
+
+ while (unformat_check_input(line_input) != UNFORMAT_END_OF_INPUT) {
+ if (unformat(line_input, "match %U", unformat_pnat_5tuple, &match))
+ match_set = true;
+ else if (unformat(line_input, "rewrite %U", unformat_pnat_5tuple,
+ &rewrite))
+ rewrite_set = true;
+ else if (unformat(line_input, "interface %U",
+ unformat_vnet_sw_interface, vnet_get_main(),
+ &sw_if_index))
+ ;
+ else if (unformat(line_input, "in")) {
+ in = true;
+ } else if (unformat(line_input, "out")) {
+ out = true;
+ } else if (unformat(line_input, "del")) {
+ add = false;
+ } else {
+ error = clib_error_return(0, "unknown input `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ }
+ if (sw_if_index == ~0) {
+ error = clib_error_return(0, "interface is required `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ if ((in && out) || (!in && !out)) {
+ error = clib_error_return(0, "in or out is required `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ if (!match_set) {
+ error = clib_error_return(0, "missing parameter: match `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ if (!rewrite_set) {
+ error = clib_error_return(0, "missing parameter: rewrite `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+
+ if ((match.dport || match.sport) &&
+ (match.proto != 17 && match.proto != 6)) {
+ error = clib_error_return(0, "missing protocol (TCP|UDP): match `%U'",
+ format_unformat_error, line_input);
+ goto done;
+ }
+ pnat_attachment_point_t attachment = in ? PNAT_IP4_INPUT : PNAT_IP4_OUTPUT;
+
+ if (add) {
+ u32 binding_index;
+ int rv = pnat_binding_add(&match, &rewrite, &binding_index);
+ if (rv) {
+ error = clib_error_return(0, "Adding binding failed %d", rv);
+ goto done;
+ }
+ rv = pnat_binding_attach(sw_if_index, attachment, binding_index);
+ if (rv) {
+ pnat_binding_del(binding_index);
+ error = clib_error_return(
+ 0, "Attaching binding to interface failed %d", rv);
+ goto done;
+ }
+ } else {
+ /* Lookup binding and lookup interface if both exists proceed with
+ * delete */
+ u32 binding_index = pnat_flow_lookup(sw_if_index, attachment, &match);
+ if (binding_index == ~0) {
+ error = clib_error_return(0, "Binding does not exist");
+ goto done;
+ }
+ pnat_attachment_point_t attachment =
+ in ? PNAT_IP4_INPUT : PNAT_IP4_OUTPUT;
+ int rv = pnat_binding_detach(sw_if_index, attachment, binding_index);
+ if (rv) {
+ error = clib_error_return(0, "Detaching binding failed %d %d",
+ binding_index, rv);
+ goto done;
+ }
+ rv = pnat_binding_del(binding_index);
+ if (rv) {
+ error = clib_error_return(0, "Deleting translation failed %d %d",
+ binding_index, rv);
+ goto done;
+ }
+ }
+
+done:
+ unformat_free(line_input);
+
+ return error;
+}
+
+VLIB_CLI_COMMAND(set_pnat_translation_command, static) = {
+ .path = "set pnat translation",
+ .short_help = "set pnat translation interface <name> match <5-tuple> "
+ "rewrite <5-tuple> {in|out} [del]",
+ .function = set_pnat_translation_command_fn,
+};
+
+static clib_error_t *
+show_pnat_translations_command_fn(vlib_main_t *vm, unformat_input_t *input,
+ vlib_cli_command_t *cmd) {
+ pnat_main_t *pm = &pnat_main;
+ pnat_translation_t *s;
+ clib_error_t *error = 0;
+
+ /* Get a line of input. */
+ pool_foreach(s, pm->translations) {
+ vlib_cli_output(vm, "%U", format_pnat_translation, s - pm->translations,
+ s);
+ }
+ return error;
+}
+
+VLIB_CLI_COMMAND(show_pnat_translations_command, static) = {
+ .path = "show pnat translations",
+ .short_help = "show pnat translations",
+ .function = show_pnat_translations_command_fn,
+};
+
+static clib_error_t *show_pnat_interfaces_command_fn(vlib_main_t *vm,
+ unformat_input_t *input,
+ vlib_cli_command_t *cmd) {
+ pnat_main_t *pm = &pnat_main;
+ pnat_interface_t *interface;
+ clib_error_t *error = 0;
+
+ /* Get a line of input. */
+ pool_foreach(interface, pm->interfaces) {
+ vlib_cli_output(vm, "%U", format_pnat_interface, interface);
+ }
+ return error;
+}
+
+VLIB_CLI_COMMAND(show_pnat_interfaces_command, static) = {
+ .path = "show pnat interfaces",
+ .short_help = "show pnat interfaces",
+ .function = show_pnat_interfaces_command_fn,
+};