nat: user deletion function & extra metrics

Type: improvement

Signed-off-by: Filip Varga <fivarga@cisco.com>
Change-Id: Ia5dbfe864c18e953ff49147a9a4684d2ca14b96e

4 files changed, 272 insertions, 0 deletions

diff --git a/src/plugins/nat/nat.api b/src/plugins/nat/nat.api
index 0294d400966..4567cb5f99c 100644
--- a/src/plugins/nat/nat.api
+++ b/src/plugins/nat/nat.api
@@ -456,6 +456,19 @@ service {
  * NAT44 APIs
  */
 
+/** \brief Del NAT44 user
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param ip_address - IPv4 address
+    @param fib_index - FIB index
+*/
+autoreply define nat44_del_user {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t ip_address;
+  u32 fib_index;
+};
+
 /** \brief Add/del NAT44 address range
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
diff --git a/src/plugins/nat/nat44/inlines.h b/src/plugins/nat/nat44/inlines.h
index 52dd37c9321..0c8487b473d 100644
--- a/src/plugins/nat/nat44/inlines.h
+++ b/src/plugins/nat/nat44/inlines.h
@@ -41,6 +41,74 @@ nat44_session_cleanup (snat_session_t * s, u32 thread_index)
 }
 
 static_always_inline void
+nat44_user_del_sessions (snat_user_t * u, u32 thread_index)
+{
+  dlist_elt_t *elt;
+  snat_session_t *s;
+
+  snat_main_t *sm = &snat_main;
+  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+
+  // get head
+  elt = pool_elt_at_index (tsm->list_pool,
+			   u->sessions_per_user_list_head_index);
+  // get first element
+  elt = pool_elt_at_index (tsm->list_pool, elt->next);
+
+  while (elt->value != ~0)
+    {
+      s = pool_elt_at_index (tsm->sessions, elt->value);
+      elt = pool_elt_at_index (tsm->list_pool, elt->next);
+      nat44_session_cleanup (s, thread_index);
+    }
+}
+
+static_always_inline int
+nat44_user_del (ip4_address_t * addr, u32 fib_index)
+{
+  int rv = 1;
+
+  snat_main_t *sm = &snat_main;
+  snat_main_per_thread_data_t *tsm;
+
+  snat_user_key_t user_key;
+  clib_bihash_kv_8_8_t kv, value;
+
+  user_key.addr.as_u32 = addr->as_u32;
+  user_key.fib_index = fib_index;
+  kv.key = user_key.as_u64;
+
+  if (sm->num_workers > 1)
+    {
+      /* *INDENT-OFF* */
+      vec_foreach (tsm, sm->per_thread_data)
+        {
+          if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
+            {
+              nat44_user_del_sessions (
+                  pool_elt_at_index (tsm->users, value.value),
+                  tsm->thread_index);
+              rv = 0;
+              break;
+            }
+        }
+      /* *INDENT-ON* */
+    }
+  else
+    {
+      tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+      if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
+	{
+	  nat44_user_del_sessions (pool_elt_at_index
+				   (tsm->users, value.value),
+				   tsm->thread_index);
+	  rv = 0;
+	}
+    }
+  return rv;
+}
+
+static_always_inline void
 nat44_user_try_cleanup (snat_user_t * u, u32 thread_index, f64 now)
 {
   dlist_elt_t *elt;
diff --git a/src/plugins/nat/nat44_cli.c b/src/plugins/nat/nat44_cli.c
index 659dbb2247e..11e87092ae7 100644
--- a/src/plugins/nat/nat44_cli.c
+++ b/src/plugins/nat/nat44_cli.c
@@ -640,6 +640,101 @@ done:
 }
 
 static clib_error_t *
+nat44_show_summary_command_fn (vlib_main_t * vm, unformat_input_t * input,
+			       vlib_cli_command_t * cmd)
+{
+  snat_main_per_thread_data_t *tsm;
+  snat_main_t *sm = &snat_main;
+  snat_address_t *a;
+  snat_session_t *s;
+  u32 free_ports, free_ports_addr;
+
+  if (sm->deterministic)
+    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
+
+  if (sm->endpoint_dependent)
+    vlib_cli_output (vm, "mode: endpoint-depenent");
+
+  // print timeouts
+  vlib_cli_output (vm, "icmp timeout: %u", sm->icmp_timeout);
+  vlib_cli_output (vm, "udp timeout: %u", sm->udp_timeout);
+
+  vlib_cli_output (vm, "tcp established timeout: %u",
+		   sm->tcp_established_timeout);
+  vlib_cli_output (vm, "tcp transitory timeout: %u",
+		   sm->tcp_transitory_timeout);
+
+  // print session configuration values
+  vlib_cli_output (vm, "max translations: %u", sm->max_translations);
+  vlib_cli_output (vm, "max translations per user: %u",
+		   sm->max_translations_per_user);
+
+  // do we need also twice-nat addresses ??
+  if (vec_len (sm->addresses))
+    {
+      free_ports = 0;
+      /* *INDENT-OFF* */
+      vec_foreach (a, sm->addresses)
+        {
+          free_ports_addr = sm->port_per_thread;
+
+          #define _(N, i, n, s) \
+            free_ports_addr -= a->busy_##n##_ports;
+            foreach_snat_protocol
+          #undef _
+
+          vlib_cli_output (vm, "addr: %U free ports: %u out of: %u",
+              format_ip4_address, &a->addr, free_ports_addr, sm->port_per_thread);
+
+          free_ports += free_ports_addr;
+        }
+      /* *INDENT-ON* */
+      vlib_cli_output (vm, "free ports overall: %u out of: %u",
+		       free_ports,
+		       vec_len (sm->addresses) * sm->port_per_thread);
+    }
+
+  u32 count = 0;
+  u32 transitory = 0;
+  u32 established = 0;
+
+  if (sm->num_workers > 1)
+    {
+      /* *INDENT-OFF* */
+      vec_foreach (tsm, sm->per_thread_data)
+        {
+          count += vec_len (tsm->sessions);
+          pool_foreach (s, tsm->sessions,
+          ({
+            if (s->state)
+              transitory++;
+            else
+              established++;
+          }));
+        }
+      /* *INDENT-ON* */
+    }
+  else
+    {
+      tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
+      /* *INDENT-OFF* */
+      pool_foreach (s, tsm->sessions,
+      ({
+        if (s->state)
+          transitory++;
+        else
+          established++;
+      }));
+      /* *INDENT-ON* */
+      count = vec_len (tsm->sessions);
+    }
+  vlib_cli_output (vm, "established sessions: %u", established);
+  vlib_cli_output (vm, "transitory sessions: %u", transitory);
+  vlib_cli_output (vm, "sessions: %u", count);
+  return 0;
+}
+
+static clib_error_t *
 nat44_show_addresses_command_fn (vlib_main_t * vm, unformat_input_t * input,
 				 vlib_cli_command_t * cmd)
 {
@@ -1377,6 +1472,51 @@ nat44_show_sessions_command_fn (vlib_main_t * vm, unformat_input_t * input,
 }
 
 static clib_error_t *
+nat44_del_user_command_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  snat_main_t *sm = &snat_main;
+  unformat_input_t _line_input, *line_input = &_line_input;
+  clib_error_t *error = 0;
+  ip4_address_t addr;
+  u32 fib_index = 0;
+  int rv;
+
+  if (sm->deterministic)
+    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
+
+  /* Get a line of input. */
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%U", unformat_ip4_address, &addr))
+	;
+      else if (unformat (line_input, "fib %u", &fib_index))
+	;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  rv = nat44_user_del (&addr, fib_index);
+
+  if (!rv)
+    {
+      error = clib_error_return (0, "nat44_user_del returned %d", rv);
+    }
+
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+static clib_error_t *
 nat44_del_session_command_fn (vlib_main_t * vm,
 			      unformat_input_t * input,
 			      vlib_cli_command_t * cmd)
@@ -2180,6 +2320,19 @@ VLIB_CLI_COMMAND (add_address_command, static) = {
 
 /*?
  * @cliexpar
+ * @cliexstart{show nat44 summary}
+ * Show NAT44 summary
+ * vpp# show nat44 summary
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (nat44_show_summary_command, static) = {
+  .path = "show nat44 summary",
+  .short_help = "show nat44 summary",
+  .function = nat44_show_summary_command_fn,
+};
+
+/*?
+ * @cliexpar
  * @cliexstart{show nat44 addresses}
  * Show NAT44 pool addresses.
  * vpp# show nat44 addresses
@@ -2388,6 +2541,19 @@ VLIB_CLI_COMMAND (nat44_show_sessions_command, static) = {
 
 /*?
  * @cliexpar
+ * @cliexstart{nat44 del user}
+ * To delete all NAT44 user sessions:
+ *  vpp# nat44 del user 10.0.0.3
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (nat44_del_user_command, static) = {
+    .path = "nat44 del user",
+    .short_help = "nat44 del user <addr> [fib <index>]",
+    .function = nat44_del_user_command_fn,
+};
+
+/*?
+ * @cliexpar
  * @cliexstart{nat44 del session}
  * To administratively delete NAT44 session by inside address and port use:
  *  vpp# nat44 del session in 10.0.0.3:6303 tcp
diff --git a/src/plugins/nat/nat_api.c b/src/plugins/nat/nat_api.c
index 4c162b7433c..d8c2c5fd1c9 100644
--- a/src/plugins/nat/nat_api.c
+++ b/src/plugins/nat/nat_api.c
@@ -741,6 +741,30 @@ vl_api_nat_ha_resync_t_print (vl_api_nat_ha_resync_t * mp, void *handle)
 /*** NAT44 ***/
 /*************/
 static void
+vl_api_nat44_del_user_t_handler (vl_api_nat44_del_user_t * mp)
+{
+  snat_main_t *sm = &snat_main;
+  vl_api_nat44_del_user_reply_t *rmp;
+  ip4_address_t addr;
+  int rv;
+
+  memcpy (&addr.as_u8, mp->ip_address, 4);
+  rv = nat44_user_del (&addr, ntohl (mp->fib_index));
+
+  REPLY_MACRO (VL_API_NAT44_DEL_USER_REPLY);
+}
+
+static void *vl_api_nat44_del_user_t_print
+  (vl_api_nat44_del_user_t * mp, void *handle)
+{
+  u8 *s;
+  s = format (0, "SCRIPT: nat44_del_user ");
+  s = format (s, "ip_address %U fib_index %U ",
+	      format_ip4_address, mp->ip_address, ntohl (mp->fib_index));
+  FINISH;
+}
+
+static void
   vl_api_nat44_add_del_address_range_t_handler
   (vl_api_nat44_add_del_address_range_t * mp)
 {
@@ -3119,6 +3143,7 @@ _(NAT_CONTROL_PING, nat_control_ping)                                   \
 _(NAT_SHOW_CONFIG, nat_show_config)                                     \
 _(NAT_SET_WORKERS, nat_set_workers)                                     \
 _(NAT_WORKER_DUMP, nat_worker_dump)                                     \
+_(NAT44_DEL_USER, nat44_del_user)                                       \
 _(NAT44_SESSION_CLEANUP, nat44_session_cleanup)                         \
 _(NAT_SET_LOG_LEVEL, nat_set_log_level)                                 \
 _(NAT_IPFIX_ENABLE_DISABLE, nat_ipfix_enable_disable)                   \