nat: 1:1 policy NAT

A NAT sub-plugin doing statically configured match/rewrite on IP4 input or output.
It's stateless (no connection tracking).
Currently it supports rewriting of SA, DA and TCP/UDP ports.
It should be simple to add new rewrites if required.

API:
pnat_binding_add, pnat_binding_del, pnat_bindings_get, pnat_interfaces_get

CLI:
set pnat translation interface <name> match <5-tuple> rewrite <5-tuple> {in|out} [del]
show pnat translations
show pnat interfaces

Trying a new C based unit testing scheme. Where the graph node is tested
in isolation. See pnat/pnat_test.c.
Also added new cmake targets to generate coverage directly.
E.g.:
make test_pnat-ccov-report

File '/vpp/sdnat/src/plugins/nat/pnat/pnat.c':
Name                               Regions    Miss   Cover     Lines    Miss   Cover
------------------------------------------------------------------------------------
pnat_interface_by_sw_if_index           39       8  79.49%        13       0 100.00%
pnat_instructions_from_mask              9       0 100.00%        13       0 100.00%
pnat_binding_add                        64       8  87.50%        31       2  93.55%
pnat_flow_lookup                         4       4   0.00%        10      10   0.00%
pnat_binding_attach                    104      75  27.88%        33       6  81.82%
pnat_binding_detach                     30       5  83.33%        23       2  91.30%
pnat_binding_del                        97      33  65.98%        17       3  82.35%
pnat.c:pnat_calc_key_from_5tuple         9       1  88.89%        14       1  92.86%
pnat.c:pnat_interface_check_mask        10       2  80.00%        11       2  81.82%
pnat.c:pnat_enable                       5       0 100.00%        11       0 100.00%
pnat.c:pnat_enable_interface           107      26  75.70%        60      15  75.00%
pnat.c:pnat_disable_interface           91      30  67.03%        32       7  78.12%
pnat.c:pnat_disable                      7       2  71.43%        13       7  46.15%
------------------------------------------------------------------------------------
TOTAL                                  576     194  66.32%       281      55  80.43%

File '/vpp/sdnat/src/plugins/nat/pnat/pnat_node.h':
Name                               Regions    Miss   Cover     Lines    Miss   Cover
------------------------------------------------------------------------------------
pnat_test.c:pnat_node_inline            67      11  83.58%       115       1  99.13%
pnat_test.c:pnat_calc_key                9       2  77.78%        14       2  85.71%
pnat_test.c:pnat_rewrite_ip4            55      11  80.00%        60      12  80.00%
pnat_test.c:format_pnat_trace            1       1   0.00%        12      12   0.00%
pnat_node.c:pnat_node_inline            63      63   0.00%       115     115   0.00%
pnat_node.c:pnat_calc_key                9       9   0.00%        14      14   0.00%
pnat_node.c:pnat_rewrite_ip4            55      55   0.00%        60      60   0.00%
pnat_node.c:format_pnat_trace            5       5   0.00%        12      12   0.00%
------------------------------------------------------------------------------------
TOTAL                                  264     157  40.53%       402     228  43.28%

Type: feature
Change-Id: I9c897f833603054a8303e7369ebff6512517c9e0
Signed-off-by: Ole Troan <ot@cisco.com>

1 files changed, 83 insertions, 0 deletions

diff --git a/src/plugins/nat/pnat/pnat_node.c b/src/plugins/nat/pnat/pnat_node.c
new file mode 100644
index 00000000000..0209b49b0aa
--- /dev/null
+++ b/src/plugins/nat/pnat/pnat_node.c
@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * Policy NAT.
+ * Match packet against rule in a hash and translate according to given
+ * instructions. Rules are kept in a flow-cache bihash. Instructions in a pool
+ * of translation entries.
+ *
+ * All rules for a given interface/direction must use the same lookup pattern.
+ * E.g. SA+SP.
+ *
+ * A dynamic NAT would punt to slow path on a miss in the flow cache, in this
+ * case the miss behaviour is configurable. Default behaviour is pass packet
+ * along unchanged.
+ *
+ * The data structures are shared and assuming that updates to the tables are
+ * rare. Data-structures are protected depending on the API/CLI barriers.
+ */
+
+#include <stdbool.h>
+#include <vlib/vlib.h>
+#include <pnat/pnat.api_enum.h> /* For error counters */
+#include "pnat_node.h"          /* Graph nodes */
+
+VLIB_NODE_FN(pnat_input_node)
+(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) {
+    return pnat_node_inline(vm, node, frame, PNAT_IP4_INPUT, VLIB_RX);
+}
+VLIB_NODE_FN(pnat_output_node)
+(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) {
+    return pnat_node_inline(vm, node, frame, PNAT_IP4_OUTPUT, VLIB_TX);
+}
+
+VLIB_REGISTER_NODE(pnat_input_node) = {
+    .name = "pnat-input",
+    .vector_size = sizeof(u32),
+    .format_trace = format_pnat_trace,
+    .type = VLIB_NODE_TYPE_INTERNAL,
+    .n_errors = PNAT_N_ERROR,
+    .error_counters = pnat_error_counters,
+    .n_next_nodes = PNAT_N_NEXT,
+    .next_nodes =
+        {
+            [PNAT_NEXT_DROP] = "error-drop",
+        },
+};
+
+VLIB_REGISTER_NODE(pnat_output_node) = {
+    .name = "pnat-output",
+    .vector_size = sizeof(u32),
+    .format_trace = format_pnat_trace,
+    .type = VLIB_NODE_TYPE_INTERNAL,
+    .n_errors = PNAT_N_ERROR,
+    .error_counters = pnat_error_counters,
+    .sibling_of = "pnat-input",
+};
+
+/* Hook up features */
+VNET_FEATURE_INIT(pnat_input, static) = {
+    .arc_name = "ip4-unicast",
+    .node_name = "pnat-input",
+    .runs_after = VNET_FEATURES("acl-plugin-in-ip4-fa",
+                                "ip4-sv-reassembly-feature"),
+};
+VNET_FEATURE_INIT(pnat_output, static) = {
+    .arc_name = "ip4-output",
+    .node_name = "pnat-output",
+    .runs_after = VNET_FEATURES("acl-plugin-out-ip4-fa",
+                                "ip4-sv-reassembly-output-feature"),
+};