diff options
| -rw-r--r-- | src/plugins/nat/nat.c | 144 | ||||
| -rw-r--r-- | src/plugins/nat/nat.h | 13 | ||||
| -rw-r--r-- | test/test_nat.py | 32 |
3 files changed, 181 insertions, 8 deletions
diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c index 7e651e5e9e5..8c188f65709 100644 --- a/src/plugins/nat/nat.c +++ b/src/plugins/nat/nat.c @@ -1378,6 +1378,16 @@ snat_ip4_add_del_interface_address_cb (ip4_main_t * im, u32 if_address_index, u32 is_delete); +static int +nat_alloc_addr_and_port_default (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index); + static clib_error_t * snat_init (vlib_main_t * vm) { snat_main_t * sm = &snat_main; @@ -1408,6 +1418,7 @@ static clib_error_t * snat_init (vlib_main_t * vm) sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT; sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT; sm->icmp_timeout = SNAT_ICMP_TIMEOUT; + sm->alloc_addr_and_port = nat_alloc_addr_and_port_default; p = hash_get_mem (tm->thread_registrations_by_name, "workers"); if (p) @@ -1587,14 +1598,32 @@ snat_random_port (u16 min, u16 max) (random_u32_max() / (max - min + 1) + 1); } -int snat_alloc_outside_address_and_port (snat_address_t * addresses, - u32 fib_index, - u32 thread_index, - snat_session_key_t * k, - u32 * address_indexp, - u8 vrf_mode, - u16 port_per_thread, - u32 snat_thread_index) +int +snat_alloc_outside_address_and_port (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index) +{ + snat_main_t *sm = &snat_main; + + return sm->alloc_addr_and_port(addresses, fib_index, thread_index, k, + address_indexp, vrf_mode, port_per_thread, + snat_thread_index); +} + +static int +nat_alloc_addr_and_port_default (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index) { int i; snat_address_t *a; @@ -1641,6 +1670,59 @@ int snat_alloc_outside_address_and_port (snat_address_t * addresses, return 1; } +static int +nat_alloc_addr_and_port_mape (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index) +{ + snat_main_t *sm = &snat_main; + snat_address_t *a = addresses; + u16 m, ports, portnum, A, j; + m = 16 - (sm->psid_offset + sm->psid_length); + ports = (1 << (16 - sm->psid_length)) - (1 << m); + + if (!vec_len (addresses)) + goto exhausted; + + switch (k->protocol) + { +#define _(N, i, n, s) \ + case SNAT_PROTOCOL_##N: \ + if (a->busy_##n##_ports < ports) \ + { \ + while (1) \ + { \ + A = snat_random_port(1, pow2_mask(sm->psid_offset)); \ + j = snat_random_port(0, pow2_mask(m)); \ + portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \ + if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \ + continue; \ + clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \ + a->busy_##n##_ports++; \ + k->addr = a->addr; \ + k->port = clib_host_to_net_u16 (portnum); \ + *address_indexp = i; \ + return 0; \ + } \ + } \ + break; + foreach_snat_protocol +#undef _ + default: + clib_warning("unknown protocol"); + return 1; + } + +exhausted: + /* Totally out of translations to use... */ + snat_ipfix_logging_addresses_exhausted(0); + return 1; +} static clib_error_t * add_address_command_fn (vlib_main_t * vm, @@ -3202,6 +3284,52 @@ VLIB_CLI_COMMAND (nat44_del_session_command, static) = { }; static clib_error_t * +nat44_set_alloc_addr_and_port_alg_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + snat_main_t *sm = &snat_main; + unformat_input_t _line_input, *line_input = &_line_input; + clib_error_t *error = 0; + u32 psid, psid_offset, psid_length; + + /* Get a line of input. */ + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "default")) + sm->alloc_addr_and_port = nat_alloc_addr_and_port_default; + else if (unformat (line_input, "map-e psid %d psid-offset %d psid-len %d", + &psid, &psid_offset, &psid_length)) + { + sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape; + sm->psid = (u16) psid; + sm->psid_offset = (u16) psid_offset; + sm->psid_length = (u16) psid_length; + } + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + +done: + unformat_free (line_input); + + return error; +}; + +VLIB_CLI_COMMAND (nat44_set_alloc_addr_and_port_alg_command, static) = { + .path = "nat44 addr-port-assignment-alg", + .short_help = "nat44 addr-port-assignment-alg <alg-name> [<alg-params>]", + .function = nat44_set_alloc_addr_and_port_alg_command_fn, +}; + +static clib_error_t * snat_det_map_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h index 5bd0a119f38..8178d76a4ac 100644 --- a/src/plugins/nat/nat.h +++ b/src/plugins/nat/nat.h @@ -269,6 +269,15 @@ typedef u32 snat_icmp_match_function_t (struct snat_main_s *sm, typedef u32 (snat_get_worker_function_t) (ip4_header_t * ip, u32 rx_fib_index); +typedef int nat_alloc_out_addr_and_port_function_t (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index); + typedef struct snat_main_s { /* Endpoint address dependent sessions lookup tables */ clib_bihash_16_8_t out2in_ed; @@ -304,6 +313,10 @@ typedef struct snat_main_s { /* Vector of outside addresses */ snat_address_t * addresses; + nat_alloc_out_addr_and_port_function_t *alloc_addr_and_port; + u8 psid_offset; + u8 psid_length; + u16 psid; /* sw_if_indices whose intfc addresses should be auto-added */ u32 * auto_add_sw_if_indices; diff --git a/test/test_nat.py b/test/test_nat.py index 76c52828ad9..b01fe076754 100644 --- a/test/test_nat.py +++ b/test/test_nat.py @@ -2756,11 +2756,43 @@ class TestNAT44(MethodHolder): self.assertEqual(p[TCP].dport, self.tcp_port_in) self.assertEqual(data, p[Raw].load) + def test_port_restricted(self): + """ Port restricted NAT44 (MAP-E CE) """ + self.nat44_add_address(self.nat_addr) + self.vapi.nat44_interface_add_del_feature(self.pg0.sw_if_index) + self.vapi.nat44_interface_add_del_feature(self.pg1.sw_if_index, + is_inside=0) + self.vapi.cli("nat44 addr-port-assignment-alg map-e psid 10 " + "psid-offset 6 psid-len 6") + + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + TCP(sport=4567, dport=22)) + self.pg0.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg1.get_capture(1) + p = capture[0] + try: + ip = p[IP] + tcp = p[TCP] + self.assertEqual(ip.dst, self.pg1.remote_ip4) + self.assertEqual(ip.src, self.nat_addr) + self.assertEqual(tcp.dport, 22) + self.assertNotEqual(tcp.sport, 4567) + self.assertEqual((tcp.sport >> 6) & 63, 10) + self.check_tcp_checksum(p) + self.check_ip_checksum(p) + except: + self.logger.error(ppp("Unexpected or invalid packet:", p)) + raise + def tearDown(self): super(TestNAT44, self).tearDown() if not self.vpp_dead: self.logger.info(self.vapi.cli("show nat44 verbose")) self.logger.info(self.vapi.cli("show nat virtual-reassembly")) + self.vapi.cli("nat44 addr-port-assignment-alg default") self.clear_nat44() |