nat: 1:1 policy NAT

A NAT sub-plugin doing statically configured match/rewrite on IP4 input or output.
It's stateless (no connection tracking).
Currently it supports rewriting of SA, DA and TCP/UDP ports.
It should be simple to add new rewrites if required.

API:
pnat_binding_add, pnat_binding_del, pnat_bindings_get, pnat_interfaces_get

CLI:
set pnat translation interface <name> match <5-tuple> rewrite <5-tuple> {in|out} [del]
show pnat translations
show pnat interfaces

Trying a new C based unit testing scheme. Where the graph node is tested
in isolation. See pnat/pnat_test.c.
Also added new cmake targets to generate coverage directly.
E.g.:
make test_pnat-ccov-report

File '/vpp/sdnat/src/plugins/nat/pnat/pnat.c':
Name                               Regions    Miss   Cover     Lines    Miss   Cover
------------------------------------------------------------------------------------
pnat_interface_by_sw_if_index           39       8  79.49%        13       0 100.00%
pnat_instructions_from_mask              9       0 100.00%        13       0 100.00%
pnat_binding_add                        64       8  87.50%        31       2  93.55%
pnat_flow_lookup                         4       4   0.00%        10      10   0.00%
pnat_binding_attach                    104      75  27.88%        33       6  81.82%
pnat_binding_detach                     30       5  83.33%        23       2  91.30%
pnat_binding_del                        97      33  65.98%        17       3  82.35%
pnat.c:pnat_calc_key_from_5tuple         9       1  88.89%        14       1  92.86%
pnat.c:pnat_interface_check_mask        10       2  80.00%        11       2  81.82%
pnat.c:pnat_enable                       5       0 100.00%        11       0 100.00%
pnat.c:pnat_enable_interface           107      26  75.70%        60      15  75.00%
pnat.c:pnat_disable_interface           91      30  67.03%        32       7  78.12%
pnat.c:pnat_disable                      7       2  71.43%        13       7  46.15%
------------------------------------------------------------------------------------
TOTAL                                  576     194  66.32%       281      55  80.43%

File '/vpp/sdnat/src/plugins/nat/pnat/pnat_node.h':
Name                               Regions    Miss   Cover     Lines    Miss   Cover
------------------------------------------------------------------------------------
pnat_test.c:pnat_node_inline            67      11  83.58%       115       1  99.13%
pnat_test.c:pnat_calc_key                9       2  77.78%        14       2  85.71%
pnat_test.c:pnat_rewrite_ip4            55      11  80.00%        60      12  80.00%
pnat_test.c:format_pnat_trace            1       1   0.00%        12      12   0.00%
pnat_node.c:pnat_node_inline            63      63   0.00%       115     115   0.00%
pnat_node.c:pnat_calc_key                9       9   0.00%        14      14   0.00%
pnat_node.c:pnat_rewrite_ip4            55      55   0.00%        60      60   0.00%
pnat_node.c:format_pnat_trace            5       5   0.00%        12      12   0.00%
------------------------------------------------------------------------------------
TOTAL                                  264     157  40.53%       402     228  43.28%

Type: feature
Change-Id: I9c897f833603054a8303e7369ebff6512517c9e0
Signed-off-by: Ole Troan <ot@cisco.com>

1 files changed, 196 insertions, 0 deletions

diff --git a/src/plugins/nat/pnat/pnat_node.h b/src/plugins/nat/pnat/pnat_node.h
new file mode 100644
index 00000000000..3f2235509fa
--- /dev/null
+++ b/src/plugins/nat/pnat/pnat_node.h
@@ -0,0 +1,196 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_pnat_node_h
+#define included_pnat_node_h
+
+#include "pnat.h"
+#include <pnat/pnat.api_enum.h>
+#include <vnet/feature/feature.h>
+#include <vnet/udp/udp_packet.h>
+#include <vnet/ip/format.h>
+
+/* PNAT next-nodes */
+typedef enum { PNAT_NEXT_DROP, PNAT_N_NEXT } pnat_next_t;
+
+// u8 *format_pnat_key(u8 *s, va_list *args);
+u8 *format_pnat_5tuple(u8 *s, va_list *args);
+static inline u8 *format_pnat_trace(u8 *s, va_list *args) {
+    CLIB_UNUSED(vlib_main_t * vm) = va_arg(*args, vlib_main_t *);
+    CLIB_UNUSED(vlib_node_t * node) = va_arg(*args, vlib_node_t *);
+    pnat_trace_t *t = va_arg(*args, pnat_trace_t *);
+
+    s = format(s, "pnat: index %d\n", t->pool_index);
+    if (t->pool_index != ~0) {
+        s = format(s, "        match: %U\n", format_pnat_5tuple, &t->match);
+        s = format(s, "        rewrite: %U", format_pnat_5tuple, &t->rewrite);
+    }
+    return s;
+}
+
+/*
+ * Given a packet and rewrite instructions from a translation modify packet.
+ */
+static u32 pnat_rewrite_ip4(u32 pool_index, ip4_header_t *ip) {
+    pnat_main_t *pm = &pnat_main;
+    if (pool_is_free_index(pm->translations, pool_index))
+        return PNAT_ERROR_REWRITE;
+    pnat_translation_t *t = pool_elt_at_index(pm->translations, pool_index);
+
+    ip_csum_t csumd = 0;
+
+    if (t->instructions & PNAT_INSTR_DESTINATION_ADDRESS) {
+        csumd = ip_csum_sub_even(csumd, ip->dst_address.as_u32);
+        csumd = ip_csum_add_even(csumd, t->post_da.as_u32);
+        ip->dst_address = t->post_da;
+    }
+    if (t->instructions & PNAT_INSTR_SOURCE_ADDRESS) {
+        csumd = ip_csum_sub_even(csumd, ip->src_address.as_u32);
+        csumd = ip_csum_add_even(csumd, t->post_sa.as_u32);
+        ip->src_address = t->post_sa;
+    }
+
+    ip_csum_t csum = ip->checksum;
+    csum = ip_csum_sub_even(csum, csumd);
+    ip->checksum = ip_csum_fold(csum);
+    ASSERT(ip->checksum == ip4_header_checksum(ip));
+
+    /* L4 ports */
+    if (ip->protocol == IP_PROTOCOL_TCP) {
+        tcp_header_t *tcp = ip4_next_header(ip);
+        ip_csum_t l4csum = tcp->checksum;
+        if (t->instructions & PNAT_INSTR_DESTINATION_PORT) {
+            l4csum = ip_csum_sub_even(l4csum, tcp->dst_port);
+            l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_dp));
+            tcp->dst_port = clib_net_to_host_u16(t->post_dp);
+        }
+        if (t->instructions & PNAT_INSTR_SOURCE_PORT) {
+            l4csum = ip_csum_sub_even(l4csum, tcp->src_port);
+            l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_sp));
+            tcp->src_port = clib_net_to_host_u16(t->post_sp);
+        }
+        l4csum = ip_csum_sub_even(l4csum, csumd);
+        tcp->checksum = ip_csum_fold(l4csum);
+    } else if (ip->protocol == IP_PROTOCOL_UDP) {
+        udp_header_t *udp = ip4_next_header(ip);
+        ip_csum_t l4csum = udp->checksum;
+        if (t->instructions & PNAT_INSTR_DESTINATION_PORT) {
+            l4csum = ip_csum_sub_even(l4csum, udp->dst_port);
+            l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_dp));
+            udp->dst_port = clib_net_to_host_u16(t->post_dp);
+        }
+        if (t->instructions & PNAT_INSTR_SOURCE_PORT) {
+            l4csum = ip_csum_sub_even(l4csum, udp->src_port);
+            l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_sp));
+            udp->src_port = clib_net_to_host_u16(t->post_sp);
+        }
+        if (udp->checksum) {
+            l4csum = ip_csum_sub_even(l4csum, csumd);
+            udp->checksum = ip_csum_fold(l4csum);
+        }
+    }
+    return PNAT_ERROR_NONE;
+}
+
+/*
+ * Lookup the packet tuple in the flow cache, given the lookup mask.
+ * If a binding is found, rewrite the packet according to instructions,
+ * otherwise follow configured default action (forward, punt or drop)
+ */
+static_always_inline uword pnat_node_inline(vlib_main_t *vm,
+                                            vlib_node_runtime_t *node,
+                                            vlib_frame_t *frame,
+                                            pnat_attachment_point_t attachment,
+                                            int dir) {
+    pnat_main_t *pm = &pnat_main;
+    u32 n_left_from, *from;
+    u16 nexts[VLIB_FRAME_SIZE] = {0}, *next = nexts;
+    u32 pool_indicies[VLIB_FRAME_SIZE], *pi = pool_indicies;
+    vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
+    clib_bihash_kv_16_8_t kv, value;
+    ip4_header_t *ip0;
+
+    from = vlib_frame_vector_args(frame);
+    n_left_from = frame->n_vectors;
+    vlib_get_buffers(vm, from, b, n_left_from);
+    pnat_interface_t *interface;
+
+    /* Stage 1: build vector of flow hash (based on lookup mask) */
+    while (n_left_from > 0) {
+        u32 sw_if_index0 = vnet_buffer(b[0])->sw_if_index[dir];
+        u16 sport0 = vnet_buffer(b[0])->ip.reass.l4_src_port;
+        u16 dport0 = vnet_buffer(b[0])->ip.reass.l4_dst_port;
+        u32 iph_offset = vnet_buffer(b[0])->ip.reass.save_rewrite_length;
+        ip0 = (ip4_header_t *)(vlib_buffer_get_current(b[0]) + iph_offset);
+        interface = pnat_interface_by_sw_if_index(sw_if_index0);
+        ASSERT(interface);
+        pnat_mask_fast_t mask = interface->lookup_mask_fast[attachment];
+        pnat_calc_key(sw_if_index0, attachment, ip0->src_address,
+                      ip0->dst_address, ip0->protocol, sport0, dport0, mask,
+                      &kv);
+        /* By default pass packet to next node in the feature chain */
+        vnet_feature_next_u16(next, b[0]);
+
+        if (clib_bihash_search_16_8(&pm->flowhash, &kv, &value) == 0) {
+            /* Cache hit */
+            *pi = value.value;
+            u32 iph_offset = vnet_buffer(b[0])->ip.reass.save_rewrite_length;
+            ip0 = (ip4_header_t *)(vlib_buffer_get_current(b[0]) + iph_offset);
+            u32 errno0 = pnat_rewrite_ip4(value.value, ip0);
+            if (PREDICT_FALSE(errno0)) {
+                next[0] = PNAT_NEXT_DROP;
+                b[0]->error = node->errors[errno0];
+            }
+        } else {
+            /* Cache miss */
+            *pi = ~0;
+        }
+        next += 1;
+
+        /*next: */
+        n_left_from -= 1;
+        b += 1;
+        pi += 1;
+    }
+
+    /* Packet trace */
+    if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE))) {
+        u32 i;
+        b = bufs;
+        pi = pool_indicies;
+        for (i = 0; i < frame->n_vectors; i++) {
+            if (b[0]->flags & VLIB_BUFFER_IS_TRACED) {
+                pnat_trace_t *t = vlib_add_trace(vm, node, b[0], sizeof(*t));
+                if (*pi != ~0) {
+                    if (!pool_is_free_index(pm->translations, *pi)) {
+                        pnat_translation_t *tr =
+                            pool_elt_at_index(pm->translations, *pi);
+                        t->match = tr->match;
+                        t->rewrite = tr->rewrite;
+                    }
+                }
+                t->pool_index = *pi;
+                b += 1;
+                pi += 1;
+            } else
+                break;
+        }
+    }
+
+    vlib_buffer_enqueue_to_next(vm, node, from, nexts, frame->n_vectors);
+
+    return frame->n_vectors;
+}
+#endif