diff options
27 files changed, 4484 insertions, 3108 deletions
diff --git a/src/plugins/nat/CMakeLists.txt b/src/plugins/nat/CMakeLists.txt index 5ce8b8a3273..688eb4f1207 100644 --- a/src/plugins/nat/CMakeLists.txt +++ b/src/plugins/nat/CMakeLists.txt @@ -30,9 +30,6 @@ add_vpp_plugin(nat out2in.c out2in_ed.c nat_ipfix_logging.c - nat_det.c - nat_det_in2out.c - nat_det_out2in.c nat_dpo.c nat44_cli.c nat44_handoff.c @@ -56,8 +53,6 @@ add_vpp_plugin(nat nat44_handoff.c nat64_in2out.c nat64_out2in.c - nat_det_in2out.c - nat_det_out2in.c out2in.c out2in_ed.c @@ -116,3 +111,22 @@ add_vpp_plugin(nat66 LINK_LIBRARIES nat ) + +add_vpp_plugin(det44 + SOURCES + det44/det44.c + det44/det44_cli.c + det44/det44_api.c + det44/det44_in2out.c + det44/det44_out2in.c + + MULTIARCH_SOURCES + det44/det44_in2out.c + det44/det44_out2in.c + + API_FILES + det44/det44.api + nat_types.api + + LINK_LIBRARIES nat +) diff --git a/src/plugins/nat/FEATURE.yaml b/src/plugins/nat/FEATURE.yaml index 183db052771..175d2c8b1dd 100644 --- a/src/plugins/nat/FEATURE.yaml +++ b/src/plugins/nat/FEATURE.yaml @@ -15,7 +15,7 @@ features: - Endpoint dependent NAT - TCP MSS clamping - Local bypass (DHCP) - - CGN - deterministic NAT + - DET44 - deterministic NAT (CGN) - NAT64 - NAT66 - DS-lite diff --git a/src/plugins/nat/det44/det44.api b/src/plugins/nat/det44/det44.api new file mode 100644 index 00000000000..818d46a1d5a --- /dev/null +++ b/src/plugins/nat/det44/det44.api @@ -0,0 +1,469 @@ +/* + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +option version = "1.0.0"; +import "vnet/ip/ip_types.api"; +import "vnet/interface_types.api"; +import "plugins/nat/nat_types.api"; + +/** + * @file det44.api + * @brief VPP control-plane API messages. + * + * This file defines VPP control-plane API messages which are generally + * called through a shared memory interface. + */ + +/** \brief Enable/disable DET44 plugin + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param inside_vrf - inside VRF id + @param outside_vrf - outside VRF id + @param enable - true if enable, false if disable +*/ +autoreply define det44_plugin_enable_disable { + u32 client_index; + u32 context; + u32 inside_vrf; + u32 outside_vrf; + bool enable; + vl_api_interface_index_t sw_if_index; + option status="in_progress"; +}; + +/** \brief Enable/disable DET44 feature on the interface + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param is_add - true if add, false if delete + @param is_inside - true if interface is inside, false if outside + @param sw_if_index - software index of the interface +*/ +autoreply define det44_interface_add_del_feature { + u32 client_index; + u32 context; + bool is_add; + bool is_inside; + vl_api_interface_index_t sw_if_index; + option status="in_progress"; +}; + +/** \brief Dump interfaces with DET44 feature + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request +*/ +define det44_interface_dump { + u32 client_index; + u32 context; + option status="in_progress"; +}; + +/** \brief DET44 interface details response + @param context - sender context, to match reply w/ request + @param is_inside - true if interface is inside, false if outside + @param sw_if_index - software index of the interface +*/ +define det44_interface_details { + u32 context; + bool is_inside; + bool is_outside; + vl_api_interface_index_t sw_if_index; + option status="in_progress"; +}; + +/** \brief Add/delete DET44 mapping + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param is_add - true if add, false if delete + @param in_addr - inside IPv4 address + @param in_plen - inside IPv4 address prefix length + @param out_addr - outside IPv4 address + @param out_plen - outside IPv4 address prefix length +*/ +autoreply define det44_add_del_map { + u32 client_index; + u32 context; + bool is_add; + vl_api_ip4_address_t in_addr; + u8 in_plen; + vl_api_ip4_address_t out_addr; + u8 out_plen; +}; + +/** \brief Get outside address and port range from inside address + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param in_addr - inside IP address +*/ +define det44_forward { + u32 client_index; + u32 context; + vl_api_ip4_address_t in_addr; +}; + +/** \brief Get outside address and port range from inside address + @param context - sender context, to match reply w/ request + @param retval - return code + @param out_port_lo - outside port range start + @param out_port_hi - outside port range end + @param out_addr - outside IPv4 address +*/ +define det44_forward_reply { + u32 context; + i32 retval; + u16 out_port_lo; + u16 out_port_hi; + vl_api_ip4_address_t out_addr; +}; + +/** \brief Get inside address from outside address and port + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param out_port - outside port + @param out_addr - outside IPv4 address +*/ +define det44_reverse { + u32 client_index; + u32 context; + u16 out_port; + vl_api_ip4_address_t out_addr; +}; + +/** \brief Get inside address from outside address and port reply + @param context - sender context, to match reply w/ request + @param retval - return code + @param in_addr - inside IP address +*/ +define det44_reverse_reply { + u32 context; + i32 retval; + vl_api_ip4_address_t in_addr; +}; + +/** \brief Dump DET44 mappings + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request +*/ +define det44_map_dump { + u32 client_index; + u32 context; +}; + +/** \brief DET44 users response + @param context - sender context, to match reply w/ request + @param in_addr - inside IPv4 address + @param in_plen - inside IPv4 address prefix length + @param out_addr - outside IPv4 address + @param out_plen - outside IPv4 address prefix length + @param sharing_ratio - outside to inside address sharing ratio + @param ports_per_host - number of ports available to a host + @param ses_num - number of sessions belonging to this mapping +*/ +define det44_map_details { + u32 context; + vl_api_ip4_address_t in_addr; + u8 in_plen; + vl_api_ip4_address_t out_addr; + u8 out_plen; + u32 sharing_ratio; + u16 ports_per_host; + u32 ses_num; +}; + +/** \brief Close DET44 session by outside address and port + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param out_addr - outside IPv4 address + @param out_port - outside port + @param ext_addr - external host IPv4 address + @param ext_port - external host port +*/ +autoreply define det44_close_session_out { + u32 client_index; + u32 context; + vl_api_ip4_address_t out_addr; + u16 out_port; + vl_api_ip4_address_t ext_addr; + u16 ext_port; +}; + +/** \brief Close DET44 session by inside address and port + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param in_addr - inside IP address + @param in_port - inside port + @param ext_addr - external host IP address + @param ext_port - external host port +*/ +autoreply define det44_close_session_in { + u32 client_index; + u32 context; + vl_api_ip4_address_t in_addr; + u16 in_port; + vl_api_ip4_address_t ext_addr; + u16 ext_port; +}; + +/** \brief Dump DET44 sessions + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param user_addr - address of an inside user whose sessions to dump +*/ +define det44_session_dump { + u32 client_index; + u32 context; + vl_api_ip4_address_t user_addr; +}; + +/** \brief DET44 sessions reply + @param context - sender context, to match reply w/ request + @param in_port - inside port + @param ext_addr - external host IPv4 address + @param ext_port - external host port + @param out_port - outside port + @param state - session state + @param expire - session expiration timestamp +*/ +define det44_session_details { + u32 context; + u16 in_port; + vl_api_ip4_address_t ext_addr; + u16 ext_port; + u16 out_port; + u8 state; + u32 expire; +}; + +/** \brief Set values of timeouts for DET44 sessions (seconds) + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param udp - UDP timeout (default 300sec) + @param tcp_established - TCP established timeout (default 7440sec) + @param tcp_transitory - TCP transitory timeout (default 240sec) + @param icmp - ICMP timeout (default 60sec) +*/ +autoreply define det44_set_timeouts { + u32 client_index; + u32 context; + u32 udp; + u32 tcp_established; + u32 tcp_transitory; + u32 icmp; + option status="in_progress"; +}; + +/** \brief Get values of timeouts for DET44 sessions (seconds) + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request +*/ +define det44_get_timeouts { + u32 client_index; + u32 context; +}; + +/** \brief Get values of timeouts for DET44 sessions reply + @param context - sender context, to match reply w/ request + @param retval - return code + @param udp - UDP timeout + @param tcp_established - TCP established timeout + @param tcp_transitory - TCP transitory timeout + @param icmp - ICMP timeout +*/ +define det44_get_timeouts_reply { + u32 context; + i32 retval; + u32 udp; + u32 tcp_established; + u32 tcp_transitory; + u32 icmp; + option status="in_progress"; +}; + +/* + * Obsolete deterministic API to be removed + */ + +/** \brief Add/delete NAT deterministic mapping + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param is_add - true if add, false if delete + @param in_addr - inside IPv4 address + @param in_plen - inside IPv4 address prefix length + @param out_addr - outside IPv4 address + @param out_plen - outside IPv4 address prefix length +*/ +autoreply define nat_det_add_del_map { + u32 client_index; + u32 context; + bool is_add; + vl_api_ip4_address_t in_addr; + u8 in_plen; + vl_api_ip4_address_t out_addr; + u8 out_plen; + option status="deprecated"; +}; + +/** \brief Get outside address and port range from inside address + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param in_addr - inside IP address +*/ +define nat_det_forward { + u32 client_index; + u32 context; + vl_api_ip4_address_t in_addr; + option status="deprecated"; +}; + +/** \brief Get outside address and port range from inside address + @param context - sender context, to match reply w/ request + @param retval - return code + @param out_port_lo - outside port range start + @param out_port_hi - outside port range end + @param out_addr - outside IPv4 address +*/ +define nat_det_forward_reply { + u32 context; + i32 retval; + u16 out_port_lo; + u16 out_port_hi; + vl_api_ip4_address_t out_addr; + option status="deprecated"; +}; + +/** \brief Get inside address from outside address and port + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param out_port - outside port + @param out_addr - outside IPv4 address +*/ +define nat_det_reverse { + u32 client_index; + u32 context; + u16 out_port; + vl_api_ip4_address_t out_addr; + option status="deprecated"; +}; + +/** \brief Get inside address from outside address and port reply + @param context - sender context, to match reply w/ request + @param retval - return code + @param in_addr - inside IP address +*/ +define nat_det_reverse_reply { + u32 context; + i32 retval; + vl_api_ip4_address_t in_addr; + option status="deprecated"; +}; + +/** \brief Dump NAT deterministic mappings + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request +*/ +define nat_det_map_dump { + u32 client_index; + u32 context; + option status="deprecated"; +}; + +/** \brief NAT users response + @param context - sender context, to match reply w/ request + @param in_addr - inside IPv4 address + @param in_plen - inside IPv4 address prefix length + @param out_addr - outside IPv4 address + @param out_plen - outside IPv4 address prefix length + @param sharing_ratio - outside to inside address sharing ratio + @param ports_per_host - number of ports available to a host + @param ses_num - number of sessions belonging to this mapping +*/ +define nat_det_map_details { + u32 context; + vl_api_ip4_address_t in_addr; + u8 in_plen; + vl_api_ip4_address_t out_addr; + u8 out_plen; + u32 sharing_ratio; + u16 ports_per_host; + u32 ses_num; + option status="deprecated"; +}; + +/** \brief Close deterministic NAT session by outside address and port + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param out_addr - outside IPv4 address + @param out_port - outside port + @param ext_addr - external host IPv4 address + @param ext_port - external host port +*/ +autoreply define nat_det_close_session_out { + u32 client_index; + u32 context; + vl_api_ip4_address_t out_addr; + u16 out_port; + vl_api_ip4_address_t ext_addr; + u16 ext_port; + option status="deprecated"; +}; + +/** \brief Close deterministic NAT session by inside address and port + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param in_addr - inside IP address + @param in_port - inside port + @param ext_addr - external host IP address + @param ext_port - external host port +*/ +autoreply define nat_det_close_session_in { + u32 client_index; + u32 context; + vl_api_ip4_address_t in_addr; + u16 in_port; + vl_api_ip4_address_t ext_addr; + u16 ext_port; + option status="deprecated"; +}; + +/** \brief Dump determinstic NAT sessions + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param user_addr - address of an inside user whose sessions to dump +*/ +define nat_det_session_dump { + u32 client_index; + u32 context; + vl_api_ip4_address_t user_addr; + option status="deprecated"; +}; + +/** \brief Deterministic NAT sessions reply + @param context - sender context, to match reply w/ request + @param in_port - inside port + @param ext_addr - external host IPv4 address + @param ext_port - external host port + @param out_port - outside NAT port + @param state - session state + @param expire - session expiration timestamp +*/ +define nat_det_session_details { + u32 context; + u16 in_port; + vl_api_ip4_address_t ext_addr; + u16 ext_port; + u16 out_port; + u8 state; + u32 expire; + option status="deprecated"; +}; diff --git a/src/plugins/nat/det44/det44.c b/src/plugins/nat/det44/det44.c new file mode 100644 index 00000000000..886092cea50 --- /dev/null +++ b/src/plugins/nat/det44/det44.c @@ -0,0 +1,608 @@ +/* + * det44.c - deterministic NAT + * + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/** + * @file + * @brief deterministic NAT (CGN) + */ + +#include <vnet/vnet.h> +#include <vnet/ip/ip.h> +#include <vnet/ip/ip4.h> +#include <vpp/app/version.h> +#include <vnet/plugin/plugin.h> + +#include <nat/det44/det44.h> + +det44_main_t det44_main; + +/* *INDENT-OFF* */ +VNET_FEATURE_INIT (ip4_det44_in2out, static) = { + .arc_name = "ip4-unicast", + .node_name = "det44-in2out", + .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa", + "ip4-sv-reassembly-feature"), +}; +VNET_FEATURE_INIT (ip4_det44_out2in, static) = { + .arc_name = "ip4-unicast", + .node_name = "det44-out2in", + .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa", + "ip4-sv-reassembly-feature", + "ip4-dhcp-client-detect"), +}; +VLIB_PLUGIN_REGISTER () = { + .version = VPP_BUILD_VER, + .description = "Deterministic NAT (CGN)", +}; +/* *INDENT-ON* */ + +void +det44_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index, + int is_add) +{ + det44_main_t *dm = &det44_main; + fib_prefix_t prefix = { + .fp_len = p_len, + .fp_proto = FIB_PROTOCOL_IP4, + .fp_addr = { + .ip4.as_u32 = addr->as_u32, + }, + }; + u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index); + + if (is_add) + { + fib_table_entry_update_one_path (fib_index, + &prefix, + dm->fib_src_low, + (FIB_ENTRY_FLAG_CONNECTED | + FIB_ENTRY_FLAG_LOCAL | + FIB_ENTRY_FLAG_EXCLUSIVE), + DPO_PROTO_IP4, + NULL, + sw_if_index, + ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE); + } + else + { + fib_table_entry_delete (fib_index, &prefix, dm->fib_src_low); + } +} + +/** + * @brief Add/delete deterministic NAT mapping. + * + * Create bijective mapping of inside address to outside address and port range + * pairs, with the purpose of enabling deterministic NAT to reduce logging in + * CGN deployments. + * + * @param in_addr Inside network address. + * @param in_plen Inside network prefix length. + * @param out_addr Outside network address. + * @param out_plen Outside network prefix length. + * @param is_add If 0 delete, otherwise add. + */ +int +snat_det_add_map (ip4_address_t * in_addr, u8 in_plen, + ip4_address_t * out_addr, u8 out_plen, int is_add) +{ + static snat_det_session_t empty_snat_det_session = { 0 }; + det44_main_t *dm = &det44_main; + ip4_address_t in_cmp, out_cmp; + det44_interface_t *i; + snat_det_map_t *mp; + u8 found = 0; + + in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen]; + out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen]; + vec_foreach (mp, dm->det_maps) + { + /* Checking for overlapping addresses to be added here */ + if (mp->in_addr.as_u32 == in_cmp.as_u32 && + mp->in_plen == in_plen && + mp->out_addr.as_u32 == out_cmp.as_u32 && mp->out_plen == out_plen) + { + found = 1; + break; + } + } + + /* If found, don't add again */ + if (found && is_add) + return VNET_API_ERROR_VALUE_EXIST; + + /* If not found, don't delete */ + if (!found && !is_add) + return VNET_API_ERROR_NO_SUCH_ENTRY; + + if (is_add) + { + pool_get (dm->det_maps, mp); + clib_memset (mp, 0, sizeof (*mp)); + mp->in_addr.as_u32 = in_cmp.as_u32; + mp->in_plen = in_plen; + mp->out_addr.as_u32 = out_cmp.as_u32; + mp->out_plen = out_plen; + mp->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen)); + mp->ports_per_host = (65535 - 1023) / mp->sharing_ratio; + + vec_validate_init_empty (mp->sessions, + DET44_SES_PER_USER * (1 << (32 - in_plen)) - + 1, empty_snat_det_session); + } + else + { + vec_free (mp->sessions); + vec_del1 (dm->det_maps, mp - dm->det_maps); + } + + /* Add/del external address range to FIB */ + /* *INDENT-OFF* */ + pool_foreach (i, dm->interfaces, ({ + if (det44_interface_is_inside(i)) + continue; + det44_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add); + goto out; + })); + /* *INDENT-ON* */ +out: + return 0; +} + +int +det44_set_timeouts (nat_timeouts_t * timeouts) +{ + det44_main_t *dm = &det44_main; + if (timeouts->udp) + dm->timeouts.udp = timeouts->udp; + if (timeouts->tcp.established) + dm->timeouts.tcp.established = timeouts->tcp.established; + if (timeouts->tcp.transitory) + dm->timeouts.tcp.transitory = timeouts->tcp.transitory; + if (timeouts->icmp) + dm->timeouts.icmp = timeouts->icmp; + return 0; +} + +nat_timeouts_t +det44_get_timeouts () +{ + det44_main_t *dm = &det44_main; + return dm->timeouts; +} + +void +det44_reset_timeouts () +{ + det44_main_t *dm = &det44_main; + dm->timeouts.udp = 300; + dm->timeouts.tcp.established = 7440; + dm->timeouts.tcp.transitory = 240; + dm->timeouts.icmp = 60; +} + +int +det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del) +{ + det44_main_t *dm = &det44_main; + det44_interface_t *tmp, *i = 0; + const char *feature_name; + int rv; + + // TODO: if plugin is not enabled do not register nodes on interfaces + // rather make a structure and when enable call is used + // then register nodes + + /* *INDENT-OFF* */ + pool_foreach (tmp, dm->interfaces, ({ + if (tmp->sw_if_index == sw_if_index) + { + i = tmp; + goto out; + } + })); + /* *INDENT-ON* */ +out: + + feature_name = is_inside ? "det44-in2out" : "det44-out2in"; + + if (is_del) + { + if (!i) + { + det44_log_err ("det44 is not enabled on this interface"); + return VNET_API_ERROR_INVALID_VALUE; + } + + rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0); + if (rv) + return rv; + + rv = vnet_feature_enable_disable ("ip4-unicast", feature_name, + sw_if_index, 1, 0, 0); + if (rv) + return rv; + + pool_put (dm->interfaces, i); + } + else + { + if (i) + { + det44_log_err ("det44 is already enabled on this interface"); + return VNET_API_ERROR_INVALID_VALUE; + } + + rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 1); + if (rv) + return rv; + + rv = vnet_feature_enable_disable ("ip4-unicast", feature_name, + sw_if_index, 1, 0, 0); + if (rv) + return rv; + + pool_get (dm->interfaces, i); + clib_memset (i, 0, sizeof (*i)); + + i->sw_if_index = sw_if_index; + + if (is_inside) + i->flags |= DET44_INTERFACE_FLAG_IS_INSIDE; + else + i->flags |= DET44_INTERFACE_FLAG_IS_OUTSIDE; + } + + if (!is_inside) + { + u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, + sw_if_index); + // add/del outside interface fib to registry + u8 found = 0; + det44_fib_t *outside_fib; + /* *INDENT-OFF* */ + vec_foreach (outside_fib, dm->outside_fibs) + { + if (outside_fib->fib_index == fib_index) + { + if (!is_del) + { + outside_fib->refcount++; + } + else + { + outside_fib->refcount--; + if (!outside_fib->refcount) + { + vec_del1 (dm->outside_fibs, + outside_fib - dm->outside_fibs); + } + } + found = 1; + break; + } + } + /* *INDENT-ON* */ + if (!is_del && !found) + { + vec_add2 (dm->outside_fibs, outside_fib, 1); + outside_fib->fib_index = fib_index; + outside_fib->refcount = 1; + } + // add/del outside address to FIB + snat_det_map_t *mp; + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, ({ + det44_add_del_addr_to_fib(&mp->out_addr, + mp->out_plen, sw_if_index, !is_del); + })); + /* *INDENT-ON* */ + } + return 0; +} + +/** + * @brief The 'det44-expire-walk' process's main loop. + * + * Check expire time for active sessions. + */ +static uword +det44_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, + vlib_frame_t * f) +{ + det44_main_t *dm = &det44_main; + snat_det_session_t *ses; + snat_det_map_t *mp; + + vlib_process_wait_for_event_or_clock (vm, 10.0); + vlib_process_get_events (vm, NULL); + u32 now = (u32) vlib_time_now (vm); + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, ({ + vec_foreach(ses, mp->sessions) + { + /* Delete if session expired */ + if (ses->in_port && (ses->expire < now)) + snat_det_ses_close (mp, ses); + } + })); + /* *INDENT-ON* */ + return 0; +} + +void +det44_create_expire_walk_process () +{ + det44_main_t *dm = &det44_main; + + if (dm->expire_walk_node_index) + return; + + dm->expire_walk_node_index = vlib_process_create (vlib_get_main (), + "det44-expire-walk", + det44_expire_walk_fn, + 16 /* stack_bytes */ ); +} + +int +det44_plugin_enable (det44_config_t c) +{ + det44_main_t *dm = &det44_main; + + if (plugin_enabled () == 1) + { + det44_log_err ("plugin already enabled!"); + return 1; + } + + det44_log_err ("inside %u, outside %u", c.inside_vrf_id, c.outside_vrf_id); + + dm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, + c.outside_vrf_id, + dm->fib_src_hi); + dm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, + c.inside_vrf_id, + dm->fib_src_hi); + + det44_create_expire_walk_process (); + dm->mss_clamping = 0; + dm->config = c; + dm->enabled = 1; + return 0; +} + +int +det44_plugin_disable () +{ + det44_main_t *dm = &det44_main; + det44_interface_t *i, *interfaces; + snat_det_map_t *mp; + int rv = 0; + + if (plugin_enabled () == 0) + { + det44_log_err ("plugin already disabled!"); + return 1; + } + + // DET44 cleanup (order dependent) + // 1) remove interfaces (det44_interface_add_del) removes map ranges from fib + // 2) free sessions + // 3) free maps + + interfaces = vec_dup (dm->interfaces); + vec_foreach (i, interfaces) + { + vnet_main_t *vnm = vnet_get_main (); + + if (i->flags & DET44_INTERFACE_FLAG_IS_INSIDE) + { + rv = det44_interface_add_del (i->sw_if_index, i->flags, 1); + if (rv) + { + det44_log_err ("inside interface %U del failed", + unformat_vnet_sw_interface, vnm, i->sw_if_index); + } + } + + if (i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE) + { + rv = det44_interface_add_del (i->sw_if_index, i->flags, 1); + if (rv) + { + det44_log_err ("outside interface %U del failed", + unformat_vnet_sw_interface, vnm, i->sw_if_index); + } + + } + } + vec_free (interfaces); + + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, + ({ + vec_free (mp->sessions); + })); + /* *INDENT-ON* */ + + det44_reset_timeouts (); + dm->enabled = 0; + + pool_free (dm->interfaces); + pool_free (dm->det_maps); + + return rv; +} + +static void +det44_update_outside_fib (ip4_main_t * im, + uword opaque, + u32 sw_if_index, u32 new_fib_index, + u32 old_fib_index) +{ + det44_main_t *dm = &det44_main; + + det44_fib_t *outside_fib; + det44_interface_t *i; + + u8 is_add = 1; + u8 match = 0; + + if (plugin_enabled () == 0) + return; + + if (new_fib_index == old_fib_index) + return; + + if (!vec_len (dm->outside_fibs)) + return; + + /* *INDENT-OFF* */ + pool_foreach (i, dm->interfaces, + ({ + if (i->sw_if_index == sw_if_index) + { + if (!(det44_interface_is_outside (i))) + return; + match = 1; + } + })); + /* *INDENT-ON* */ + + if (!match) + return; + + vec_foreach (outside_fib, dm->outside_fibs) + { + if (outside_fib->fib_index == old_fib_index) + { + outside_fib->refcount--; + if (!outside_fib->refcount) + vec_del1 (dm->outside_fibs, outside_fib - dm->outside_fibs); + break; + } + } + + vec_foreach (outside_fib, dm->outside_fibs) + { + if (outside_fib->fib_index == new_fib_index) + { + outside_fib->refcount++; + is_add = 0; + break; + } + } + + if (is_add) + { + vec_add2 (dm->outside_fibs, outside_fib, 1); + outside_fib->refcount = 1; + outside_fib->fib_index = new_fib_index; + } +} + +static clib_error_t * +det44_init (vlib_main_t * vm) +{ + det44_main_t *dm = &det44_main; + ip4_table_bind_callback_t cb; + vlib_node_t *node; + + clib_memset (dm, 0, sizeof (*dm)); + + dm->ip4_main = &ip4_main; + dm->log_class = vlib_log_register_class ("det44", 0); + + node = vlib_get_node_by_name (vm, (u8 *) "det44-in2out"); + dm->in2out_node_index = node->index; + node = vlib_get_node_by_name (vm, (u8 *) "det44-out2in"); + dm->out2in_node_index = node->index; + + dm->fib_src_hi = fib_source_allocate ("det44-hi", + FIB_SOURCE_PRIORITY_HI, + FIB_SOURCE_BH_SIMPLE); + dm->fib_src_low = fib_source_allocate ("det44-low", + FIB_SOURCE_PRIORITY_LOW, + FIB_SOURCE_BH_SIMPLE); + + cb.function = det44_update_outside_fib; + cb.function_opaque = 0; + vec_add1 (dm->ip4_main->table_bind_callbacks, cb); + + det44_reset_timeouts (); + return det44_api_hookup (vm); +} + +VLIB_INIT_FUNCTION (det44_init); + +u8 * +format_det44_session_state (u8 * s, va_list * args) +{ + u32 i = va_arg (*args, u32); + u8 *t = 0; + + switch (i) + { +#define _(v, N, str) case DET44_SESSION_##N: t = (u8 *) str; break; + foreach_det44_session_state +#undef _ + default: + t = format (t, "unknown"); + } + s = format (s, "%s", t); + return s; +} + +u8 * +format_det_map_ses (u8 * s, va_list * args) +{ + snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *); + ip4_address_t in_addr, out_addr; + u32 in_offset, out_offset; + snat_det_session_t *ses = va_arg (*args, snat_det_session_t *); + u32 *i = va_arg (*args, u32 *); + + u32 user_index = *i / DET44_SES_PER_USER; + in_addr.as_u32 = + clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) + + user_index); + in_offset = + clib_net_to_host_u32 (in_addr.as_u32) - + clib_net_to_host_u32 (det_map->in_addr.as_u32); + out_offset = in_offset / det_map->sharing_ratio; + out_addr.as_u32 = + clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) + + out_offset); + s = + format (s, + "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n", + format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port), + format_ip4_address, &out_addr, + clib_net_to_host_u16 (ses->out.out_port), format_ip4_address, + &ses->out.ext_host_addr, + clib_net_to_host_u16 (ses->out.ext_host_port), + format_det44_session_state, ses->state, ses->expire); + + return s; +} + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/nat/det44/det44.h b/src/plugins/nat/det44/det44.h new file mode 100644 index 00000000000..3ddba6d1405 --- /dev/null +++ b/src/plugins/nat/det44/det44.h @@ -0,0 +1,449 @@ +/* + * det44.h - deterministic NAT definitions + * + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * @file + * @brief Deterministic NAT (CGN) definitions + */ + +#ifndef __included_det44_h__ +#define __included_det44_h__ + +#include <vnet/vnet.h> +#include <vnet/ip/ip.h> +#include <vnet/ethernet/ethernet.h> +#include <vnet/ip/icmp46_packet.h> +#include <vnet/api_errno.h> +#include <vnet/fib/fib_source.h> +#include <vppinfra/dlist.h> +#include <vppinfra/error.h> +#include <vlibapi/api.h> +#include <vlib/log.h> +#include <vnet/fib/fib_table.h> +#include <vnet/fib/ip4_fib.h> +#include <vnet/ip/reass/ip4_sv_reass.h> + +#include <nat/lib/lib.h> +#include <nat/lib/inlines.h> + +/* Session state */ +#define foreach_det44_session_state \ + _(0, UNKNOWN, "unknown") \ + _(1, UDP_ACTIVE, "udp-active") \ + _(2, TCP_SYN_SENT, "tcp-syn-sent") \ + _(3, TCP_ESTABLISHED, "tcp-established") \ + _(4, TCP_FIN_WAIT, "tcp-fin-wait") \ + _(5, TCP_CLOSE_WAIT, "tcp-close-wait") \ + _(6, TCP_CLOSING, "tcp-closing") \ + _(7, TCP_LAST_ACK, "tcp-last-ack") \ + _(8, TCP_CLOSED, "tcp-closed") \ + _(9, ICMP_ACTIVE, "icmp-active") + +typedef enum +{ +#define _(v, N, s) DET44_SESSION_##N = v, + foreach_det44_session_state +#undef _ +} det44_session_state_t; + +#define DET44_SES_PER_USER 1000 + +typedef struct +{ + u16 identifier; + u16 sequence; +} icmp_echo_header_t; + +typedef struct +{ + u16 src_port, dst_port; +} tcp_udp_header_t; + +typedef struct +{ + u32 cached_sw_if_index; + u32 cached_ip4_address; +} det44_runtime_t; + +typedef struct nat_timeouts_s +{ + u32 udp; + + struct + { + u32 transitory; + u32 established; + } tcp; + + u32 icmp; + +} nat_timeouts_t; + +/* deterministic session outside key */ +typedef struct +{ + union + { + struct + { + ip4_address_t ext_host_addr; + u16 ext_host_port; + u16 out_port; + }; + u64 as_u64; + }; +} snat_det_out_key_t; + +typedef struct +{ + /* Inside network port */ + u16 in_port; + /* Outside network address and port */ + snat_det_out_key_t out; + /* Session state */ + u8 state; + /* Expire timeout */ + u32 expire; +} snat_det_session_t; + +typedef struct +{ + /* inside IP address range */ + ip4_address_t in_addr; + u8 in_plen; + /* outside IP address range */ + ip4_address_t out_addr; + u8 out_plen; + /* inside IP addresses / outside IP addresses */ + u32 sharing_ratio; + /* number of ports available to internal host */ + u16 ports_per_host; + /* session counter */ + u32 ses_num; + /* vector of sessions */ + snat_det_session_t *sessions; +} snat_det_map_t; + +typedef struct +{ + u32 sw_if_index; + u8 flags; +} det44_interface_t; + +typedef struct +{ + + u32 outside_vrf_id; + u32 inside_vrf_id; + +} det44_config_t; + +typedef struct +{ + u32 fib_index; + u32 refcount; +} det44_fib_t; + +typedef struct det44_main_s +{ + det44_config_t config; + + u32 outside_fib_index; + u32 inside_fib_index; + + /* Vector of outside fibs */ + det44_fib_t *outside_fibs; + + fib_source_t fib_src_hi; + fib_source_t fib_src_low; + + u32 out2in_node_index; + u32 in2out_node_index; + + /* Deterministic NAT mappings */ + snat_det_map_t *det_maps; + + /* TCP MSS clamping */ + u16 mss_clamping; + + /* Protocol timeouts */ + nat_timeouts_t timeouts; + + /* Expire walk process node index */ + u32 expire_walk_node_index; + + u32 enabled; + + /* API message ID base */ + u16 msg_id_base; + + /* log class */ + vlib_log_class_t log_class; + + det44_interface_t *interfaces; + + /* convenience */ + ip4_main_t *ip4_main; + /* required */ + vnet_main_t *vnet_main; + +} det44_main_t; + +extern det44_main_t det44_main; + +/* logging */ +#define det44_log_err(...) \ + vlib_log(VLIB_LOG_LEVEL_ERR, det44_main.log_class, __VA_ARGS__) +#define det44_log_warn(...) \ + vlib_log(VLIB_LOG_LEVEL_WARNING, det44_main.log_class, __VA_ARGS__) +#define det44_log_notice(...) \ + vlib_log(VLIB_LOG_LEVEL_NOTICE, det44_main.log_class, __VA_ARGS__) +#define det44_log_info(...) \ + vlib_log(VLIB_LOG_LEVEL_INFO, det44_main.log_class, __VA_ARGS__) +#define det44_log_debug(...)\ + vlib_log(VLIB_LOG_LEVEL_DEBUG, det44_main.log_class, __VA_ARGS__) + +/* Deterministic NAT interface flags */ +#define DET44_INTERFACE_FLAG_IS_INSIDE 1 +#define DET44_INTERFACE_FLAG_IS_OUTSIDE 2 + +/** \brief Check if Deterministic NAT interface is inside. + @param i Deterministic NAT interface + @return 1 if inside interface +*/ +#define det44_interface_is_inside(i) i->flags & DET44_INTERFACE_FLAG_IS_INSIDE + +/** \brief Check if Deterministic NAT interface is outside. + @param i Deterministic NAT interface + @return 1 if outside interface +*/ +#define det44_interface_is_outside(i) i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE + +static_always_inline u8 +plugin_enabled () +{ + det44_main_t *dm = &det44_main; + return dm->enabled; +} + +extern vlib_node_registration_t det44_in2out_node; +extern vlib_node_registration_t det44_out2in_node; + +int det44_plugin_enable (); +int det44_plugin_disable (); + +int det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del); + +int det44_set_timeouts (nat_timeouts_t * timeouts); +nat_timeouts_t det44_get_timeouts (); +void det44_reset_timeouts (); + +/* format functions */ +format_function_t format_det_map_ses; + +int snat_det_add_map (ip4_address_t * in_addr, u8 in_plen, + ip4_address_t * out_addr, u8 out_plen, int is_add); + +/* icmp session match functions */ +u32 icmp_match_out2in_det (vlib_node_runtime_t * node, + u32 thread_index, vlib_buffer_t * b0, + ip4_header_t * ip0, ip4_address_t * addr, + u16 * port, u32 * fib_index, + nat_protocol_t * proto, void *d, void *e, + u8 * dont_translate); +u32 icmp_match_in2out_det (vlib_node_runtime_t * node, + u32 thread_index, vlib_buffer_t * b0, + ip4_header_t * ip0, ip4_address_t * addr, + u16 * port, u32 * fib_index, + nat_protocol_t * proto, void *d, void *e, + u8 * dont_translate); +u32 det44_icmp_in2out (vlib_buffer_t * b0, ip4_header_t * ip0, + icmp46_header_t * icmp0, u32 sw_if_index0, + u32 rx_fib_index0, vlib_node_runtime_t * node, + u32 next0, u32 thread_index, void *d, void *e); +u32 det44_icmp_out2in (vlib_buffer_t * b0, ip4_header_t * ip0, + icmp46_header_t * icmp0, u32 sw_if_index0, + u32 rx_fib_index0, vlib_node_runtime_t * node, + u32 next0, u32 thread_index, void *d, void *e); + +static_always_inline int +is_addr_in_net (ip4_address_t * addr, ip4_address_t * net, u8 plen) +{ + if (net->as_u32 == (addr->as_u32 & ip4_main.fib_masks[plen])) + return 1; + return 0; +} + +static_always_inline snat_det_map_t * +snat_det_map_by_user (ip4_address_t * user_addr) +{ + det44_main_t *dm = &det44_main; + snat_det_map_t *mp; + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, + ({ + if (is_addr_in_net(user_addr, &mp->in_addr, mp->in_plen)) + return mp; + })); + /* *INDENT-ON* */ + return 0; +} + +static_always_inline snat_det_map_t * +snat_det_map_by_out (ip4_address_t * out_addr) +{ + det44_main_t *dm = &det44_main; + snat_det_map_t *mp; + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, + ({ + if (is_addr_in_net(out_addr, &mp->out_addr, mp->out_plen)) + return mp; + })); + /* *INDENT-ON* */ + return 0; +} + +static_always_inline void +snat_det_forward (snat_det_map_t * dm, ip4_address_t * in_addr, + ip4_address_t * out_addr, u16 * lo_port) +{ + u32 in_offset, out_offset; + + in_offset = clib_net_to_host_u32 (in_addr->as_u32) - + clib_net_to_host_u32 (dm->in_addr.as_u32); + out_offset = in_offset / dm->sharing_ratio; + out_addr->as_u32 = + clib_host_to_net_u32 (clib_net_to_host_u32 (dm->out_addr.as_u32) + + out_offset); + *lo_port = 1024 + dm->ports_per_host * (in_offset % dm->sharing_ratio); +} + +static_always_inline void +snat_det_reverse (snat_det_map_t * dm, ip4_address_t * out_addr, u16 out_port, + ip4_address_t * in_addr) +{ + u32 in_offset1, in_offset2, out_offset; + + out_offset = clib_net_to_host_u32 (out_addr->as_u32) - + clib_net_to_host_u32 (dm->out_addr.as_u32); + in_offset1 = out_offset * dm->sharing_ratio; + in_offset2 = (out_port - 1024) / dm->ports_per_host; + in_addr->as_u32 = + clib_host_to_net_u32 (clib_net_to_host_u32 (dm->in_addr.as_u32) + + in_offset1 + in_offset2); +} + +static_always_inline u32 +snat_det_user_ses_offset (ip4_address_t * addr, u8 plen) +{ + return (clib_net_to_host_u32 (addr->as_u32) & pow2_mask (32 - plen)) * + DET44_SES_PER_USER; +} + +static_always_inline snat_det_session_t * +snat_det_get_ses_by_out (snat_det_map_t * dm, ip4_address_t * in_addr, + u64 out_key) +{ + u32 user_offset; + u16 i; + + user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen); + for (i = 0; i < DET44_SES_PER_USER; i++) + { + if (dm->sessions[i + user_offset].out.as_u64 == out_key) + return &dm->sessions[i + user_offset]; + } + + return 0; +} + +static_always_inline snat_det_session_t * +snat_det_find_ses_by_in (snat_det_map_t * dm, ip4_address_t * in_addr, + u16 in_port, snat_det_out_key_t out_key) +{ + snat_det_session_t *ses; + u32 user_offset; + u16 i; + + user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen); + for (i = 0; i < DET44_SES_PER_USER; i++) + { + ses = &dm->sessions[i + user_offset]; + if (ses->in_port == in_port && + ses->out.ext_host_addr.as_u32 == out_key.ext_host_addr.as_u32 && + ses->out.ext_host_port == out_key.ext_host_port) + return &dm->sessions[i + user_offset]; + } + + return 0; +} + +static_always_inline snat_det_session_t * +snat_det_ses_create (u32 thread_index, snat_det_map_t * dm, + ip4_address_t * in_addr, u16 in_port, + snat_det_out_key_t * out) +{ + u32 user_offset; + u16 i; + + user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen); + + for (i = 0; i < DET44_SES_PER_USER; i++) + { + if (!dm->sessions[i + user_offset].in_port) + { + if (clib_atomic_bool_cmp_and_swap + (&dm->sessions[i + user_offset].in_port, 0, in_port)) + { + dm->sessions[i + user_offset].out.as_u64 = out->as_u64; + dm->sessions[i + user_offset].state = DET44_SESSION_UNKNOWN; + dm->sessions[i + user_offset].expire = 0; + clib_atomic_add_fetch (&dm->ses_num, 1); + return &dm->sessions[i + user_offset]; + } + } + } + + // TODO: + /*snat_ipfix_logging_max_entries_per_user (thread_index, + DET44_SES_PER_USER, + in_addr->as_u32); */ + return 0; +} + +static_always_inline void +snat_det_ses_close (snat_det_map_t * dm, snat_det_session_t * ses) +{ + if (clib_atomic_bool_cmp_and_swap (&ses->in_port, ses->in_port, 0)) + { + ses->out.as_u64 = 0; + clib_atomic_add_fetch (&dm->ses_num, -1); + } +} + +clib_error_t *det44_api_hookup (vlib_main_t * vm); + +#endif /* __included_det44_h__ */ + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/nat/det44/det44_api.c b/src/plugins/nat/det44/det44_api.c new file mode 100644 index 00000000000..7c7b1788009 --- /dev/null +++ b/src/plugins/nat/det44/det44_api.c @@ -0,0 +1,633 @@ +/* + * Copyright (c) 2020 Cisco and/or its affiliates. + * * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * @file + * @brief Deterministic NAT (CGN) plugin API implementation + */ + +#include <vnet/ip/ip_types_api.h> +#include <nat/det44/det44.h> +#include <nat/det44/det44.api_enum.h> +#include <nat/det44/det44.api_types.h> +#include <vnet/fib/fib_table.h> +#include <vnet/ip/ip.h> + +#include <vlibmemory/api.h> + +#define REPLY_MSG_ID_BASE dm->msg_id_base +#include <vlibapi/api_helper_macros.h> + +static void +vl_api_det44_add_del_map_t_handler (vl_api_det44_add_del_map_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_add_del_map_reply_t *rmp; + int rv = 0; + ip4_address_t in_addr, out_addr; + clib_memcpy (&in_addr, mp->in_addr, 4); + clib_memcpy (&out_addr, mp->out_addr, 4); + rv = snat_det_add_map (&in_addr, mp->in_plen, &out_addr, + mp->out_plen, mp->is_add); + REPLY_MACRO (VL_API_DET44_ADD_DEL_MAP_REPLY); +} + +static void +vl_api_det44_forward_t_handler (vl_api_det44_forward_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_forward_reply_t *rmp; + int rv = 0; + u16 lo_port = 0, hi_port = 0; + snat_det_map_t *m; + ip4_address_t in_addr, out_addr; + + out_addr.as_u32 = 0; + clib_memcpy (&in_addr, mp->in_addr, 4); + m = snat_det_map_by_user (&in_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + + snat_det_forward (m, &in_addr, &out_addr, &lo_port); + hi_port = lo_port + m->ports_per_host - 1; + +send_reply: + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_DET44_FORWARD_REPLY, + ({ + rmp->out_port_lo = ntohs (lo_port); + rmp->out_port_hi = ntohs (hi_port); + clib_memcpy (rmp->out_addr, &out_addr, 4); + })) + /* *INDENT-ON* */ +} + +static void +vl_api_det44_reverse_t_handler (vl_api_det44_reverse_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_reverse_reply_t *rmp; + int rv = 0; + ip4_address_t out_addr, in_addr; + snat_det_map_t *m; + + in_addr.as_u32 = 0; + clib_memcpy (&out_addr, mp->out_addr, 4); + m = snat_det_map_by_out (&out_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + + snat_det_reverse (m, &out_addr, htons (mp->out_port), &in_addr); + +send_reply: + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_DET44_REVERSE_REPLY, + ({ + clib_memcpy (rmp->in_addr, &in_addr, 4); + })) + /* *INDENT-ON* */ +} + +static void +sent_det44_map_details (snat_det_map_t * m, vl_api_registration_t * reg, + u32 context) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_map_details_t *rmp; + + rmp = vl_msg_api_alloc (sizeof (*rmp)); + clib_memset (rmp, 0, sizeof (*rmp)); + rmp->_vl_msg_id = ntohs (VL_API_DET44_MAP_DETAILS + dm->msg_id_base); + clib_memcpy (rmp->in_addr, &m->in_addr, 4); + rmp->in_plen = m->in_plen; + clib_memcpy (rmp->out_addr, &m->out_addr, 4); + rmp->out_plen = m->out_plen; + rmp->sharing_ratio = htonl (m->sharing_ratio); + rmp->ports_per_host = htons (m->ports_per_host); + rmp->ses_num = htonl (m->ses_num); + rmp->context = context; + + vl_api_send_msg (reg, (u8 *) rmp); +} + +static void +vl_api_det44_map_dump_t_handler (vl_api_det44_map_dump_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_registration_t *reg; + snat_det_map_t *m; + + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; + + /* *INDENT-OFF* */ + vec_foreach(m, dm->det_maps) + sent_det44_map_details(m, reg, mp->context); + /* *INDENT-ON* */ +} + +static void +vl_api_det44_close_session_out_t_handler (vl_api_det44_close_session_out_t + * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_close_session_out_reply_t *rmp; + ip4_address_t out_addr, ext_addr, in_addr; + snat_det_out_key_t key; + snat_det_map_t *m; + snat_det_session_t *ses; + int rv = 0; + + clib_memcpy (&out_addr, mp->out_addr, 4); + clib_memcpy (&ext_addr, mp->ext_addr, 4); + + m = snat_det_map_by_out (&out_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + snat_det_reverse (m, &ext_addr, ntohs (mp->out_port), &in_addr); + key.ext_host_addr = ext_addr; + key.ext_host_port = mp->ext_port; + key.out_port = mp->out_port; + ses = snat_det_get_ses_by_out (m, &in_addr, key.as_u64); + if (!ses) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + snat_det_ses_close (m, ses); + +send_reply: + REPLY_MACRO (VL_API_DET44_CLOSE_SESSION_OUT_REPLY); +} + +static void +vl_api_det44_close_session_in_t_handler (vl_api_det44_close_session_in_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_close_session_in_reply_t *rmp; + ip4_address_t in_addr, ext_addr; + snat_det_out_key_t key; + snat_det_map_t *m; + snat_det_session_t *ses; + int rv = 0; + + clib_memcpy (&in_addr, mp->in_addr, 4); + clib_memcpy (&ext_addr, mp->ext_addr, 4); + + m = snat_det_map_by_user (&in_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + key.ext_host_addr = ext_addr; + key.ext_host_port = mp->ext_port; + ses = snat_det_find_ses_by_in (m, &in_addr, mp->in_port, key); + if (!ses) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + snat_det_ses_close (m, ses); + +send_reply: + REPLY_MACRO (VL_API_DET44_CLOSE_SESSION_OUT_REPLY); +} + +static void +send_det44_session_details (snat_det_session_t * s, + vl_api_registration_t * reg, u32 context) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_session_details_t *rmp; + + rmp = vl_msg_api_alloc (sizeof (*rmp)); + clib_memset (rmp, 0, sizeof (*rmp)); + rmp->_vl_msg_id = ntohs (VL_API_DET44_SESSION_DETAILS + dm->msg_id_base); + rmp->in_port = s->in_port; + clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4); + rmp->ext_port = s->out.ext_host_port; + rmp->out_port = s->out.out_port; + rmp->state = s->state; + rmp->expire = ntohl (s->expire); + rmp->context = context; + + vl_api_send_msg (reg, (u8 *) rmp); +} + +static void +vl_api_det44_session_dump_t_handler (vl_api_det44_session_dump_t * mp) +{ + vl_api_registration_t *reg; + ip4_address_t user_addr; + snat_det_map_t *m; + snat_det_session_t *s, empty_ses; + u16 i; + + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; + + clib_memset (&empty_ses, 0, sizeof (empty_ses)); + clib_memcpy (&user_addr, mp->user_addr, 4); + m = snat_det_map_by_user (&user_addr); + if (!m) + return; + + s = m->sessions + snat_det_user_ses_offset (&user_addr, m->in_plen); + for (i = 0; i < DET44_SES_PER_USER; i++) + { + if (s->out.as_u64) + send_det44_session_details (s, reg, mp->context); + s++; + } +} + +static void + vl_api_det44_plugin_enable_disable_t_handler + (vl_api_det44_plugin_enable_disable_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_plugin_enable_disable_reply_t *rmp; + det44_config_t c = { 0 }; + int rv = 0; + if (mp->enable) + { + c.outside_vrf_id = ntohl (mp->outside_vrf); + c.inside_vrf_id = ntohl (mp->inside_vrf); + rv = det44_plugin_enable (c); + } + else + { + rv = det44_plugin_disable (); + } + REPLY_MACRO (VL_API_DET44_PLUGIN_ENABLE_DISABLE_REPLY); +} + +static void + vl_api_det44_interface_add_del_feature_t_handler + (vl_api_det44_interface_add_del_feature_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_interface_add_del_feature_reply_t *rmp; + u32 sw_if_index = ntohl (mp->sw_if_index); + int rv = 0; + VALIDATE_SW_IF_INDEX (mp); + rv = det44_interface_add_del (sw_if_index, mp->is_inside, !mp->is_add); + BAD_SW_IF_INDEX_LABEL; + REPLY_MACRO (VL_API_DET44_INTERFACE_ADD_DEL_FEATURE_REPLY); +} + +static void +det44_send_interface_details (det44_interface_t * i, + vl_api_registration_t * reg, u32 context) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_interface_details_t *rmp; + + rmp = vl_msg_api_alloc (sizeof (*rmp)); + clib_memset (rmp, 0, sizeof (*rmp)); + rmp->_vl_msg_id = ntohs (VL_API_DET44_INTERFACE_DETAILS + dm->msg_id_base); + rmp->sw_if_index = ntohl (i->sw_if_index); + rmp->is_outside = det44_interface_is_outside (i); + rmp->is_inside = det44_interface_is_inside (i); + rmp->context = context; + vl_api_send_msg (reg, (u8 *) rmp); +} + +static void +vl_api_det44_interface_dump_t_handler (vl_api_det44_interface_dump_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_registration_t *reg; + det44_interface_t *i; + + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; + + /* *INDENT-OFF* */ + pool_foreach (i, dm->interfaces, + ({ + det44_send_interface_details(i, reg, mp->context); + })); + /* *INDENT-ON* */ +} + +static void +vl_api_det44_set_timeouts_t_handler (vl_api_det44_set_timeouts_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_set_timeouts_reply_t *rmp; + nat_timeouts_t timeouts; + int rv = 0; + timeouts.udp = ntohl (mp->udp); + timeouts.tcp.established = ntohl (mp->tcp_established); + timeouts.tcp.transitory = ntohl (mp->tcp_transitory); + timeouts.icmp = ntohl (mp->icmp); + rv = det44_set_timeouts (&timeouts); + REPLY_MACRO (VL_API_DET44_SET_TIMEOUTS_REPLY); +} + +static void +vl_api_det44_get_timeouts_t_handler (vl_api_det44_get_timeouts_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_det44_get_timeouts_reply_t *rmp; + nat_timeouts_t timeouts; + int rv = 0; + timeouts = det44_get_timeouts (); + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_DET44_GET_TIMEOUTS_REPLY, + ({ + rmp->udp = htonl (timeouts.udp); + rmp->tcp_established = htonl (timeouts.tcp.established); + rmp->tcp_transitory = htonl (timeouts.tcp.transitory); + rmp->icmp = htonl (timeouts.icmp); + })) + /* *INDENT-ON* */ +} + +/* + * Obsolete deterministic API to be removed + */ + +static void +vl_api_nat_det_add_del_map_t_handler (vl_api_nat_det_add_del_map_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_add_del_map_reply_t *rmp; + int rv = 0; + ip4_address_t in_addr, out_addr; + + clib_memcpy (&in_addr, mp->in_addr, 4); + clib_memcpy (&out_addr, mp->out_addr, 4); + rv = snat_det_add_map (&in_addr, mp->in_plen, &out_addr, + mp->out_plen, mp->is_add); + REPLY_MACRO (VL_API_NAT_DET_ADD_DEL_MAP_REPLY); +} + +static void +vl_api_nat_det_forward_t_handler (vl_api_nat_det_forward_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_forward_reply_t *rmp; + int rv = 0; + u16 lo_port = 0, hi_port = 0; + snat_det_map_t *m; + ip4_address_t in_addr, out_addr; + + out_addr.as_u32 = 0; + clib_memcpy (&in_addr, mp->in_addr, 4); + m = snat_det_map_by_user (&in_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + + snat_det_forward (m, &in_addr, &out_addr, &lo_port); + hi_port = lo_port + m->ports_per_host - 1; + +send_reply: + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_NAT_DET_FORWARD_REPLY, + ({ + rmp->out_port_lo = ntohs (lo_port); + rmp->out_port_hi = ntohs (hi_port); + clib_memcpy (rmp->out_addr, &out_addr, 4); + })) + /* *INDENT-ON* */ +} + +static void +vl_api_nat_det_reverse_t_handler (vl_api_nat_det_reverse_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_reverse_reply_t *rmp; + int rv = 0; + ip4_address_t out_addr, in_addr; + snat_det_map_t *m; + + in_addr.as_u32 = 0; + clib_memcpy (&out_addr, mp->out_addr, 4); + m = snat_det_map_by_out (&out_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + + snat_det_reverse (m, &out_addr, htons (mp->out_port), &in_addr); + +send_reply: + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_NAT_DET_REVERSE_REPLY, + ({ + clib_memcpy (rmp->in_addr, &in_addr, 4); + })) + /* *INDENT-ON* */ +} + +static void +sent_nat_det_map_details (snat_det_map_t * m, vl_api_registration_t * reg, + u32 context) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_map_details_t *rmp; + + rmp = vl_msg_api_alloc (sizeof (*rmp)); + clib_memset (rmp, 0, sizeof (*rmp)); + rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_MAP_DETAILS + dm->msg_id_base); + clib_memcpy (rmp->in_addr, &m->in_addr, 4); + rmp->in_plen = m->in_plen; + clib_memcpy (rmp->out_addr, &m->out_addr, 4); + rmp->out_plen = m->out_plen; + rmp->sharing_ratio = htonl (m->sharing_ratio); + rmp->ports_per_host = htons (m->ports_per_host); + rmp->ses_num = htonl (m->ses_num); + rmp->context = context; + + vl_api_send_msg (reg, (u8 *) rmp); +} + +static void +vl_api_nat_det_map_dump_t_handler (vl_api_nat_det_map_dump_t * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_registration_t *reg; + snat_det_map_t *m; + + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; + + /* *INDENT-OFF* */ + vec_foreach(m, dm->det_maps) + sent_nat_det_map_details(m, reg, mp->context); + /* *INDENT-ON* */ +} + +static void +vl_api_nat_det_close_session_out_t_handler (vl_api_nat_det_close_session_out_t + * mp) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_close_session_out_reply_t *rmp; + ip4_address_t out_addr, ext_addr, in_addr; + snat_det_out_key_t key; + snat_det_map_t *m; + snat_det_session_t *ses; + int rv = 0; + + clib_memcpy (&out_addr, mp->out_addr, 4); + clib_memcpy (&ext_addr, mp->ext_addr, 4); + + m = snat_det_map_by_out (&out_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + snat_det_reverse (m, &ext_addr, ntohs (mp->out_port), &in_addr); + key.ext_host_addr = ext_addr; + key.ext_host_port = mp->ext_port; + key.out_port = mp->out_port; + ses = snat_det_get_ses_by_out (m, &in_addr, key.as_u64); + if (!ses) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + snat_det_ses_close (m, ses); + +send_reply: + REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY); +} + +static void +vl_api_nat_det_close_session_in_t_handler (vl_api_nat_det_close_session_in_t * + mp) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_close_session_in_reply_t *rmp; + ip4_address_t in_addr, ext_addr; + snat_det_out_key_t key; + snat_det_map_t *m; + snat_det_session_t *ses; + int rv = 0; + + clib_memcpy (&in_addr, mp->in_addr, 4); + clib_memcpy (&ext_addr, mp->ext_addr, 4); + + m = snat_det_map_by_user (&in_addr); + if (!m) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + key.ext_host_addr = ext_addr; + key.ext_host_port = mp->ext_port; + ses = snat_det_find_ses_by_in (m, &in_addr, mp->in_port, key); + if (!ses) + { + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + goto send_reply; + } + snat_det_ses_close (m, ses); + +send_reply: + REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY); +} + +static void +send_nat_det_session_details (snat_det_session_t * s, + vl_api_registration_t * reg, u32 context) +{ + det44_main_t *dm = &det44_main; + vl_api_nat_det_session_details_t *rmp; + + rmp = vl_msg_api_alloc (sizeof (*rmp)); + clib_memset (rmp, 0, sizeof (*rmp)); + rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_SESSION_DETAILS + dm->msg_id_base); + rmp->in_port = s->in_port; + clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4); + rmp->ext_port = s->out.ext_host_port; + rmp->out_port = s->out.out_port; + rmp->state = s->state; + rmp->expire = ntohl (s->expire); + rmp->context = context; + + vl_api_send_msg (reg, (u8 *) rmp); +} + +static void +vl_api_nat_det_session_dump_t_handler (vl_api_nat_det_session_dump_t * mp) +{ + vl_api_registration_t *reg; + ip4_address_t user_addr; + snat_det_map_t *m; + snat_det_session_t *s, empty_ses; + u16 i; + + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; + + clib_memset (&empty_ses, 0, sizeof (empty_ses)); + clib_memcpy (&user_addr, mp->user_addr, 4); + m = snat_det_map_by_user (&user_addr); + if (!m) + return; + + s = m->sessions + snat_det_user_ses_offset (&user_addr, m->in_plen); + for (i = 0; i < DET44_SES_PER_USER; i++) + { + if (s->out.as_u64) + send_nat_det_session_details (s, reg, mp->context); + s++; + } +} + +/* API definitions */ +#include <vnet/format_fns.h> +#include <nat/det44/det44.api.c> + +/* Set up the API message handling tables */ +clib_error_t * +det44_api_hookup (vlib_main_t * vm) +{ + det44_main_t *dm = &det44_main; + dm->msg_id_base = setup_message_id_table (); + return 0; +} + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/nat/det44/det44_cli.c b/src/plugins/nat/det44/det44_cli.c new file mode 100644 index 00000000000..7085eba06ef --- /dev/null +++ b/src/plugins/nat/det44/det44_cli.c @@ -0,0 +1,697 @@ +/* + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/** + * @file + * @brief DET44 CLI + */ +#include <nat/det44/det44.h> + +static clib_error_t * +det44_map_command_fn (vlib_main_t * vm, unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + ip4_address_t in_addr, out_addr; + u32 in_plen, out_plen; + int is_add = 1, rv; + clib_error_t *error = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat + (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen)) + ; + else + if (unformat + (line_input, "out %U/%u", unformat_ip4_address, &out_addr, + &out_plen)) + ; + else if (unformat (line_input, "del")) + is_add = 0; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + rv = snat_det_add_map (&in_addr, (u8) in_plen, &out_addr, (u8) out_plen, + is_add); + + if (rv) + { + error = clib_error_return (0, "snat_det_add_map return %d", rv); + goto done; + } + +done: + unformat_free (line_input); + + return error; +} + +static clib_error_t * +det44_show_mappings_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + det44_main_t *dm = &det44_main; + snat_det_map_t *mp; + vlib_cli_output (vm, "NAT44 deterministic mappings:"); + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, + ({ + vlib_cli_output (vm, " in %U/%d out %U/%d\n", + format_ip4_address, &mp->in_addr, mp->in_plen, + format_ip4_address, &mp->out_addr, mp->out_plen); + vlib_cli_output (vm, " outside address sharing ratio: %d\n", + mp->sharing_ratio); + vlib_cli_output (vm, " number of ports per inside host: %d\n", + mp->ports_per_host); + vlib_cli_output (vm, " sessions number: %d\n", mp->ses_num); + })); + /* *INDENT-ON* */ + return 0; +} + +static clib_error_t * +det44_forward_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + ip4_address_t in_addr, out_addr; + u16 lo_port; + snat_det_map_t *mp; + clib_error_t *error = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "%U", unformat_ip4_address, &in_addr)) + ; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + mp = snat_det_map_by_user (&in_addr); + if (!mp) + vlib_cli_output (vm, "no match"); + else + { + snat_det_forward (mp, &in_addr, &out_addr, &lo_port); + vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr, + lo_port, lo_port + mp->ports_per_host - 1); + } + +done: + unformat_free (line_input); + + return error; +} + +static clib_error_t * +det44_reverse_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + ip4_address_t in_addr, out_addr; + clib_error_t *error = 0; + snat_det_map_t *mp; + u32 out_port; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat + (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port)) + ; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + if (out_port < 1024 || out_port > 65535) + { + error = clib_error_return (0, "wrong port, must be <1024-65535>"); + goto done; + } + + mp = snat_det_map_by_out (&out_addr); + if (!mp) + vlib_cli_output (vm, "no match"); + else + { + snat_det_reverse (mp, &out_addr, (u16) out_port, &in_addr); + vlib_cli_output (vm, "%U", format_ip4_address, &in_addr); + } + +done: + unformat_free (line_input); + + return error; +} + +static clib_error_t * +det44_show_sessions_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + det44_main_t *dm = &det44_main; + snat_det_session_t *ses; + snat_det_map_t *mp; + vlib_cli_output (vm, "NAT44 deterministic sessions:"); + /* *INDENT-OFF* */ + pool_foreach (mp, dm->det_maps, + ({ + int i; + vec_foreach_index (i, mp->sessions) + { + ses = vec_elt_at_index (mp->sessions, i); + if (ses->in_port) + vlib_cli_output (vm, " %U", format_det_map_ses, mp, ses, &i); + } + })); + /* *INDENT-ON* */ + return 0; +} + +static clib_error_t * +det44_close_session_out_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + ip4_address_t out_addr, ext_addr, in_addr; + u32 out_port, ext_port; + snat_det_map_t *mp; + snat_det_session_t *ses; + snat_det_out_key_t key; + clib_error_t *error = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "%U:%d %U:%d", + unformat_ip4_address, &out_addr, &out_port, + unformat_ip4_address, &ext_addr, &ext_port)) + ; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + unformat_free (line_input); + + mp = snat_det_map_by_out (&out_addr); + if (!mp) + vlib_cli_output (vm, "no match"); + else + { + snat_det_reverse (mp, &ext_addr, (u16) out_port, &in_addr); + key.ext_host_addr = out_addr; + key.ext_host_port = ntohs ((u16) ext_port); + key.out_port = ntohs ((u16) out_port); + ses = snat_det_get_ses_by_out (mp, &out_addr, key.as_u64); + if (!ses) + vlib_cli_output (vm, "no match"); + else + snat_det_ses_close (mp, ses); + } + +done: + unformat_free (line_input); + + return error; +} + +static clib_error_t * +det44_close_session_in_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + ip4_address_t in_addr, ext_addr; + u32 in_port, ext_port; + snat_det_map_t *mp; + snat_det_session_t *ses; + snat_det_out_key_t key; + clib_error_t *error = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "%U:%d %U:%d", + unformat_ip4_address, &in_addr, &in_port, + unformat_ip4_address, &ext_addr, &ext_port)) + ; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + unformat_free (line_input); + + mp = snat_det_map_by_user (&in_addr); + if (!mp) + vlib_cli_output (vm, "no match"); + else + { + key.ext_host_addr = ext_addr; + key.ext_host_port = ntohs ((u16) ext_port); + ses = + snat_det_find_ses_by_in (mp, &in_addr, ntohs ((u16) in_port), key); + if (!ses) + vlib_cli_output (vm, "no match"); + else + snat_det_ses_close (mp, ses); + } + +done: + unformat_free (line_input); + + return error; +} + +static clib_error_t * +det44_set_timeouts_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + nat_timeouts_t timeouts = { 0 }; + clib_error_t *error = 0; + u8 reset = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "udp %u", &timeouts.udp)); + else if (unformat (line_input, "tcp established %u", + &timeouts.tcp.established)); + else if (unformat (line_input, "tcp transitory %u", + &timeouts.tcp.transitory)); + else if (unformat (line_input, "icmp %u", &timeouts.icmp)); + else if (unformat (line_input, "reset")) + reset = 1; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + if (!reset) + { + if (det44_set_timeouts (&timeouts)) + { + error = clib_error_return (0, "error configuring timeouts"); + } + } + else + det44_reset_timeouts (); +done: + unformat_free (line_input); + return error; +} + +static clib_error_t * +det44_show_timeouts_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + nat_timeouts_t timeouts; + timeouts = det44_get_timeouts (); + vlib_cli_output (vm, "udp timeout: %dsec", timeouts.udp); + vlib_cli_output (vm, "tcp established timeout: %dsec", + timeouts.tcp.established); + vlib_cli_output (vm, "tcp transitory timeout: %dsec", + timeouts.tcp.transitory); + vlib_cli_output (vm, "icmp timeout: %dsec", timeouts.icmp); + return 0; +} + +static clib_error_t * +det44_plugin_enable_disable_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + u8 enable = 0, is_set = 0; + clib_error_t *error = 0; + det44_config_t c = { 0 }; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (!is_set && unformat (line_input, "enable")) + { + unformat (line_input, "inside vrf %u", &c.inside_vrf_id); + unformat (line_input, "outside vrf %u", &c.outside_vrf_id); + enable = 1; + } + else if (!is_set && unformat (line_input, "disable")); + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + is_set = 1; + } + + if (enable) + { + if (det44_plugin_enable (c)) + error = clib_error_return (0, "plugin enable failed"); + } + else + { + if (det44_plugin_disable ()) + error = clib_error_return (0, "plugin disable failed"); + } +done: + unformat_free (line_input); + return error; +} + +typedef struct +{ + u32 sw_if_index; + u8 is_inside; +} sw_if_indices_t; + +static clib_error_t * +det44_feature_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + sw_if_indices_t *sw_if_indices = 0, *p, e; + vnet_main_t *vnm = vnet_get_main (); + clib_error_t *error = 0; + u8 is_del = 0; + + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "inside %U", unformat_vnet_sw_interface, + vnm, &e.sw_if_index)) + { + e.is_inside = 1; + vec_add1 (sw_if_indices, e); + } + else if (unformat (line_input, "outside %U", unformat_vnet_sw_interface, + vnm, &e.sw_if_index)) + { + e.is_inside = 0; + vec_add1 (sw_if_indices, e); + } + else if (unformat (line_input, "del")) + is_del = 1; + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + + /* *INDENT-OFF* */ + vec_foreach (p, sw_if_indices) + { + if (det44_interface_add_del (p->sw_if_index, p->is_inside, is_del)) + { + error = clib_error_return (0, "%s %s %U failed", + is_del ? "del" : "add", + p->is_inside ? "inside" : "outside", + format_vnet_sw_if_index_name, + vnm, p->sw_if_index); + break; + } + } + /* *INDENT-ON* */ +done: + unformat_free (line_input); + vec_free (sw_if_indices); + return error; +} + +static clib_error_t * +det44_show_interfaces_command_fn (vlib_main_t * vm, unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + vnet_main_t *vnm = vnet_get_main (); + det44_main_t *dm = &det44_main; + det44_interface_t *i; + vlib_cli_output (vm, "DET44 interfaces:"); + /* *INDENT-OFF* */ + pool_foreach (i, dm->interfaces, + ({ + vlib_cli_output (vm, " %U %s", format_vnet_sw_if_index_name, vnm, + i->sw_if_index, + (det44_interface_is_inside(i) && + det44_interface_is_outside(i)) ? "in out" : + (det44_interface_is_inside(i) ? "in" : "out")); + })); + /* *INDENT-ON* */ + return 0; +} + +/* *INDENT-OFF* */ +/*? + * @cliexpar + * @cliexstart{det44 add} + * Create bijective mapping of inside address to outside address and port range + * pairs, with the purpose of enabling DET44 to reduce logging in CGN + * deployments. + * To create mapping between inside network 10.0.0.0/18 and + * outside network 1.1.1.0/30 use: + * # vpp# det44 add in 10.0.0.0/18 out 1.1.1.0/30 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_map_command, static) = { + .path = "det44 add", + .short_help = "det44 add in <addr>/<plen> out <addr>/<plen> [del]", + .function = det44_map_command_fn, +}; + +/*? + * @cliexpar + * @cliexpstart{show det44 mappings} + * Show DET44 mappings + * vpp# show det44 mappings + * DET44 mappings: + * in 10.0.0.0/24 out 1.1.1.1/32 + * outside address sharing ratio: 256 + * number of ports per inside host: 252 + * sessions number: 0 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_show_mappings_command, static) = { + .path = "show det44 mappings", + .short_help = "show det44 mappings", + .function = det44_show_mappings_command_fn, +}; + +/*? + * @cliexpar + * @cliexstart{det44 forward} + * Return outside address and port range from inside address for DET44. + * To obtain outside address and port of inside host use: + * vpp# det44 forward 10.0.0.2 + * 1.1.1.0:<1054-1068> + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_forward_command, static) = { + .path = "det44 forward", + .short_help = "det44 forward <addr>", + .function = det44_forward_command_fn, +}; + +/*? + * @cliexpar + * @cliexstart{det44 reverse} + * Return inside address from outside address and port for DET44. + * To obtain inside host address from outside address and port use: + * #vpp det44 reverse 1.1.1.1:1276 + * 10.0.16.16 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_reverse_command, static) = { + .path = "det44 reverse", + .short_help = "det44 reverse <addr>:<port>", + .function = det44_reverse_command_fn, +}; + +/*? + * @cliexpar + * @cliexstart{show det44 sessions} + * Show DET44 sessions. + * vpp# show det44 sessions + * DET44 sessions: + * in 10.0.0.3:3005 out 1.1.1.2:1146 external host 172.16.1.2:3006 state: udp-active expire: 306 + * in 10.0.0.3:3000 out 1.1.1.2:1141 external host 172.16.1.2:3001 state: udp-active expire: 306 + * in 10.0.0.4:3005 out 1.1.1.2:1177 external host 172.16.1.2:3006 state: udp-active expire: 306 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_show_sessions_command, static) = { + .path = "show det44 sessions", + .short_help = "show det44 sessions", + .function = det44_show_sessions_command_fn, +}; + +/*? + * @cliexpar + * @cliexstart{det44 close session out} + * Close session using outside ip address and port + * and external ip address and port, use: + * vpp# det44 close session out 1.1.1.1:1276 2.2.2.2:2387 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_close_sesion_out_command, static) = { + .path = "det44 close session out", + .short_help = "det44 close session out " + "<out_addr>:<out_port> <ext_addr>:<ext_port>", + .function = det44_close_session_out_fn, +}; + +/*? + * @cliexpar + * @cliexstart{det44 deterministic close session in} + * Close session using inside ip address and port + * and external ip address and port, use: + * vpp# det44 close session in 3.3.3.3:3487 2.2.2.2:2387 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_close_session_in_command, static) = { + .path = "det44 close session in", + .short_help = "det44 close session in " + "<in_addr>:<in_port> <ext_addr>:<ext_port>", + .function = det44_close_session_in_fn, +}; +/* *INDENT-ON* */ + +/*? + * @cliexpar + * @cliexstart{set det44 timeout} + * Set values of timeouts for DET44 sessions (in seconds), use: + * vpp# set det44 timeouts udp 120 tcp established 7500 tcp transitory 250 icmp 90 + * To reset default values use: + * vpp# set det44 timeouts reset + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_set_timeouts_command, static) = +{ +.path = "set det44 timeouts",.short_help = + "set det44 timeouts <[udp <sec>] [tcp established <sec>] " + "[tcp transitory <sec>] [icmp <sec>]|reset>",.function = + det44_set_timeouts_command_fn,}; + +/*? + * @cliexpar + * @cliexstart{show det44 timeouts} + * Show values of timeouts for DET44 sessions. + * vpp# show det44 timeouts + * udp timeout: 300sec + * tcp-established timeout: 7440sec + * tcp-transitory timeout: 240sec + * icmp timeout: 60sec + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_show_timeouts_command, static) = +{ +.path = "show det44 timeouts",.short_help = + "show det44 timeouts",.function = det44_show_timeouts_command_fn,}; + +/*? + * @cliexpar + * @cliexstart{det44 plugin} + * Enable/disable DET44 plugin. + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_plugin_enable_disable_command, static) = +{ +.path = "det44 plugin",.short_help = + "det44 plugin <enable [inside vrf] [outside vrf]|disable>",.function = + det44_plugin_enable_disable_command_fn,}; + +/*? + * @cliexpar + * @cliexstart{set interface det44} + * Enable/disable DET44 feature on the interface. + * To enable DET44 feature with local network interface use: + * vpp# set interface det44 inside GigabitEthernet0/8/0 + * To enable DET44 feature with external network interface use: + * vpp# set interface det44 outside GigabitEthernet0/a/0 + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_feature_command, static) = +{ +.path = "set interface det44",.short_help = + "set interface det44 inside <intfc> outside <intfc> [del]",.function = + det44_feature_command_fn,}; + +/*? + * @cliexpar + * @cliexstart{show det44 interfaces} + * Show interfaces with DET44 feature. + * vpp# show det44 interfaces + * DET44 interfaces: + * GigabitEthernet0/8/0 in + * GigabitEthernet0/a/0 out + * @cliexend +?*/ +VLIB_CLI_COMMAND (det44_show_interfaces_command, static) = +{ +.path = "show det44 interfaces",.short_help = + "show det44 interfaces",.function = det44_show_interfaces_command_fn,}; + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/nat/nat_det_in2out.c b/src/plugins/nat/det44/det44_in2out.c index 74b4149ba8f..3ed1cc77ff6 100644 --- a/src/plugins/nat/nat_det_in2out.c +++ b/src/plugins/nat/det44/det44_in2out.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2018 Cisco and/or its affiliates. + * Copyright (c) 2020 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: @@ -12,9 +12,10 @@ * See the License for the specific language governing permissions and * limitations under the License. */ + /** * @file - * @brief Deterministic/CGN NAT44 inside to outside network translation + * @brief Deterministic NAT (CGN) inside to outside translation */ #include <vlib/vlib.h> @@ -23,55 +24,58 @@ #include <vnet/fib/ip4_fib.h> #include <vppinfra/error.h> #include <vppinfra/elog.h> -#include <nat/nat.h> -#include <nat/nat_det.h> -#include <nat/nat_inlines.h> + +#include <nat/det44/det44.h> +#include <nat/det44/det44_inlines.h> + +#include <nat/lib/lib.h> +#include <nat/lib/inlines.h> #include <nat/lib/nat_inlines.h> +typedef enum +{ + DET44_IN2OUT_NEXT_LOOKUP, + DET44_IN2OUT_NEXT_DROP, + DET44_IN2OUT_NEXT_ICMP_ERROR, + DET44_IN2OUT_N_NEXT, +} det44_in2out_next_t; + typedef struct { u32 sw_if_index; u32 next_index; u32 session_index; -} nat_det_in2out_trace_t; +} det44_in2out_trace_t; -typedef enum -{ - NAT_DET_IN2OUT_NEXT_LOOKUP, - NAT_DET_IN2OUT_NEXT_DROP, - NAT_DET_IN2OUT_NEXT_ICMP_ERROR, - NAT_DET_IN2OUT_N_NEXT, -} nat_det_in2out_next_t; - -#define foreach_nat_det_in2out_error \ -_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ -_(NO_TRANSLATION, "No translation") \ -_(BAD_ICMP_TYPE, "unsupported ICMP type") \ -_(OUT_OF_PORTS, "Out of ports") \ +#define foreach_det44_in2out_error \ +_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ +_(NO_TRANSLATION, "No translation") \ +_(BAD_ICMP_TYPE, "unsupported ICMP type") \ +_(OUT_OF_PORTS, "Out of ports") \ _(IN2OUT_PACKETS, "Good in2out packets processed") typedef enum { -#define _(sym,str) NAT_DET_IN2OUT_ERROR_##sym, - foreach_nat_det_in2out_error +#define _(sym,str) DET44_IN2OUT_ERROR_##sym, + foreach_det44_in2out_error #undef _ - NAT_DET_IN2OUT_N_ERROR, -} nat_det_in2out_error_t; + DET44_IN2OUT_N_ERROR, +} det44_in2out_error_t; -static char *nat_det_in2out_error_strings[] = { +static char *det44_in2out_error_strings[] = { #define _(sym,string) string, - foreach_nat_det_in2out_error + foreach_det44_in2out_error #undef _ }; static u8 * -format_nat_det_in2out_trace (u8 * s, va_list * args) +format_det44_in2out_trace (u8 * s, va_list * args) { CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); - nat_det_in2out_trace_t *t = va_arg (*args, nat_det_in2out_trace_t *); + det44_in2out_trace_t *t = va_arg (*args, det44_in2out_trace_t *); - s = format (s, "NAT_DET_IN2OUT: sw_if_index %d, next index %d, session %d", + s = format (s, "DET44_IN2OUT: sw_if_index %d, next index %d, session %d", t->sw_if_index, t->next_index, t->session_index); return s; @@ -82,7 +86,6 @@ format_nat_det_in2out_trace (u8 * s, va_list * args) * Get address and port values to be used for ICMP packet translation * and create session if needed * - * @param[in,out] sm NAT main * @param[in,out] node NAT node runtime * @param[in] thread_index thread index * @param[in,out] b0 buffer containing packet to be translated @@ -94,13 +97,14 @@ format_nat_det_in2out_trace (u8 * s, va_list * args) * @param e optional parameter */ u32 -icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node, +icmp_match_in2out_det (vlib_node_runtime_t * node, u32 thread_index, vlib_buffer_t * b0, ip4_header_t * ip0, ip4_address_t * addr, u16 * port, u32 * fib_index, nat_protocol_t * proto, void *d, void *e, u8 * dont_translate) { + det44_main_t *dm = &det44_main; vlib_main_t *vm = vlib_get_main (); icmp46_header_t *icmp0; u32 sw_if_index0; @@ -112,7 +116,7 @@ icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node, ip4_header_t *inner_ip0; void *l4_header = 0; icmp46_header_t *inner_icmp0; - snat_det_map_t *dm0 = 0; + snat_det_map_t *mp0 = 0; ip4_address_t new_addr0; u16 lo_port0, i0; snat_det_session_t *ses0 = 0; @@ -151,70 +155,66 @@ icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node, in_port = ((tcp_udp_header_t *) l4_header)->dst_port; break; default: - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL]; - next0 = NAT_DET_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL]; + next0 = DET44_IN2OUT_NEXT_DROP; goto out; } } - dm0 = snat_det_map_by_user (sm, &in_addr); - if (PREDICT_FALSE (!dm0)) + mp0 = snat_det_map_by_user (&in_addr); + if (PREDICT_FALSE (!mp0)) { - nat_log_info ("no match for internal host %U", - format_ip4_address, &in_addr); - if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0, - IP_PROTOCOL_ICMP, - rx_fib_index0))) + if (PREDICT_FALSE (det44_translate (node, sw_if_index0, ip0, + IP_PROTOCOL_ICMP, rx_fib_index0))) { *dont_translate = 1; goto out; } - next0 = NAT_DET_IN2OUT_NEXT_DROP; - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION]; + next0 = DET44_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION]; goto out; } - snat_det_forward (dm0, &in_addr, &new_addr0, &lo_port0); + snat_det_forward (mp0, &in_addr, &new_addr0, &lo_port0); key0.ext_host_addr = ip0->dst_address; key0.ext_host_port = 0; - ses0 = snat_det_find_ses_by_in (dm0, &in_addr, in_port, key0); + ses0 = snat_det_find_ses_by_in (mp0, &in_addr, in_port, key0); if (PREDICT_FALSE (!ses0)) { - if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0, - IP_PROTOCOL_ICMP, - rx_fib_index0))) + if (PREDICT_FALSE (det44_translate (node, sw_if_index0, ip0, + IP_PROTOCOL_ICMP, rx_fib_index0))) { *dont_translate = 1; goto out; } if (icmp0->type != ICMP4_echo_request) { - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE]; - next0 = NAT_DET_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_BAD_ICMP_TYPE]; + next0 = DET44_IN2OUT_NEXT_DROP; goto out; } - for (i0 = 0; i0 < dm0->ports_per_host; i0++) + for (i0 = 0; i0 < mp0->ports_per_host; i0++) { key0.out_port = clib_host_to_net_u16 (lo_port0 + ((i0 + clib_net_to_host_u16 (echo0->identifier)) % - dm0->ports_per_host)); + mp0->ports_per_host)); - if (snat_det_get_ses_by_out (dm0, &in_addr, key0.as_u64)) + if (snat_det_get_ses_by_out (mp0, &in_addr, key0.as_u64)) continue; ses0 = - snat_det_ses_create (thread_index, dm0, + snat_det_ses_create (thread_index, mp0, &in_addr, echo0->identifier, &key0); break; } if (PREDICT_FALSE (!ses0)) { - next0 = NAT_DET_IN2OUT_NEXT_DROP; - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_OUT_OF_PORTS]; + next0 = DET44_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_OUT_OF_PORTS]; goto out; } } @@ -224,40 +224,189 @@ icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node, && !icmp_type_is_error_message (vnet_buffer (b0)->ip. reass.icmp_type_or_tcp_flags))) { - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE]; - next0 = NAT_DET_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_BAD_ICMP_TYPE]; + next0 = DET44_IN2OUT_NEXT_DROP; goto out; } u32 now = (u32) vlib_time_now (vm); - ses0->state = SNAT_SESSION_ICMP_ACTIVE; - ses0->expire = now + sm->icmp_timeout; + ses0->state = DET44_SESSION_ICMP_ACTIVE; + ses0->expire = now + dm->timeouts.icmp; out: *proto = protocol; if (ses0) { *addr = new_addr0; - *fib_index = sm->outside_fib_index; + *fib_index = dm->outside_fib_index; *port = ses0->out.out_port; } if (d) *(snat_det_session_t **) d = ses0; if (e) - *(snat_det_map_t **) e = dm0; + *(snat_det_map_t **) e = mp0; + return next0; +} +#endif + +#ifndef CLIB_MARCH_VARIANT +u32 +det44_icmp_in2out (vlib_buffer_t * b0, + ip4_header_t * ip0, + icmp46_header_t * icmp0, + u32 sw_if_index0, + u32 rx_fib_index0, + vlib_node_runtime_t * node, + u32 next0, u32 thread_index, void *d, void *e) +{ + vlib_main_t *vm = vlib_get_main (); + u16 old_id0, new_id0, port, checksum0, old_checksum0, new_checksum0; + u32 new_addr0, old_addr0, next0_tmp, fib_index; + icmp_echo_header_t *echo0, *inner_echo0; + icmp46_header_t *inner_icmp0; + ip4_header_t *inner_ip0; + ip4_address_t addr; + void *l4_header; + u8 dont_translate; + ip_csum_t sum0; + nat_protocol_t protocol; + + echo0 = (icmp_echo_header_t *) (icmp0 + 1); + next0_tmp = icmp_match_in2out_det (node, thread_index, b0, ip0, + &addr, &port, &fib_index, &protocol, + d, e, &dont_translate); + if (next0_tmp != ~0) + next0 = next0_tmp; + if (next0 == DET44_IN2OUT_NEXT_DROP || dont_translate) + goto out; + + if (PREDICT_TRUE (!ip4_is_fragment (ip0))) + { + sum0 = + ip_incremental_checksum_buffer (vm, b0, + (u8 *) icmp0 - + (u8 *) vlib_buffer_get_current (b0), + ntohs (ip0->length) - + ip4_header_bytes (ip0), 0); + checksum0 = ~ip_csum_fold (sum0); + if (PREDICT_FALSE (checksum0 != 0 && checksum0 != 0xffff)) + { + next0 = DET44_IN2OUT_NEXT_DROP; + goto out; + } + } + + old_addr0 = ip0->src_address.as_u32; + new_addr0 = ip0->src_address.as_u32 = addr.as_u32; + + sum0 = ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + src_address /* changed member */ ); + ip0->checksum = ip_csum_fold (sum0); + + if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment) + { + if (icmp0->checksum == 0) + icmp0->checksum = 0xffff; + + if (!icmp_type_is_error_message (icmp0->type)) + { + new_id0 = port; + if (PREDICT_FALSE (new_id0 != echo0->identifier)) + { + old_id0 = echo0->identifier; + new_id0 = port; + echo0->identifier = new_id0; + + sum0 = icmp0->checksum; + sum0 = + ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t, + identifier); + icmp0->checksum = ip_csum_fold (sum0); + } + } + else + { + inner_ip0 = (ip4_header_t *) (echo0 + 1); + l4_header = ip4_next_header (inner_ip0); + + if (!ip4_header_checksum_is_valid (inner_ip0)) + { + next0 = DET44_IN2OUT_NEXT_DROP; + goto out; + } + + /* update inner destination IP address */ + old_addr0 = inner_ip0->dst_address.as_u32; + inner_ip0->dst_address = addr; + new_addr0 = inner_ip0->dst_address.as_u32; + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + dst_address /* changed member */ ); + icmp0->checksum = ip_csum_fold (sum0); + + /* update inner IP header checksum */ + old_checksum0 = inner_ip0->checksum; + sum0 = inner_ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + dst_address /* changed member */ ); + inner_ip0->checksum = ip_csum_fold (sum0); + new_checksum0 = inner_ip0->checksum; + sum0 = icmp0->checksum; + sum0 = + ip_csum_update (sum0, old_checksum0, new_checksum0, ip4_header_t, + checksum); + icmp0->checksum = ip_csum_fold (sum0); + + switch (protocol) + { + case NAT_PROTOCOL_ICMP: + inner_icmp0 = (icmp46_header_t *) l4_header; + inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1); + + old_id0 = inner_echo0->identifier; + new_id0 = port; + inner_echo0->identifier = new_id0; + + sum0 = icmp0->checksum; + sum0 = + ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t, + identifier); + icmp0->checksum = ip_csum_fold (sum0); + break; + case NAT_PROTOCOL_UDP: + case NAT_PROTOCOL_TCP: + old_id0 = ((tcp_udp_header_t *) l4_header)->dst_port; + new_id0 = port; + ((tcp_udp_header_t *) l4_header)->dst_port = new_id0; + + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t, + dst_port); + icmp0->checksum = ip_csum_fold (sum0); + break; + default: + ASSERT (0); + } + } + } + + if (vnet_buffer (b0)->sw_if_index[VLIB_TX] == ~0) + vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index; +out: return next0; } #endif -VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) +VLIB_NODE_FN (det44_in2out_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) { u32 n_left_from, *from, *to_next; - nat_det_in2out_next_t next_index; + det44_in2out_next_t next_index; u32 pkts_processed = 0; - snat_main_t *sm = &snat_main; + det44_main_t *dm = &det44_main; u32 now = (u32) vlib_time_now (vm); u32 thread_index = vm->thread_index; @@ -286,7 +435,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, tcp_header_t *tcp0, *tcp1; u32 proto0, proto1; snat_det_out_key_t key0, key1; - snat_det_map_t *dm0, *dm1; + snat_det_map_t *mp0, *mp1; snat_det_session_t *ses0 = 0, *ses1 = 0; u32 rx_fib_index0, rx_fib_index1; icmp46_header_t *icmp0, *icmp1; @@ -316,8 +465,8 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, b0 = vlib_get_buffer (vm, bi0); b1 = vlib_get_buffer (vm, bi1); - next0 = NAT_DET_IN2OUT_NEXT_LOOKUP; - next1 = NAT_DET_IN2OUT_NEXT_LOOKUP; + next0 = DET44_IN2OUT_NEXT_LOOKUP; + next1 = DET44_IN2OUT_NEXT_LOOKUP; ip0 = vlib_buffer_get_current (b0); udp0 = ip4_next_header (ip0); @@ -331,7 +480,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded, ICMP4_time_exceeded_ttl_exceeded_in_transit, 0); - next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR; + next0 = DET44_IN2OUT_NEXT_ICMP_ERROR; goto trace0; } @@ -343,46 +492,47 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, ip4_fib_table_get_index_for_sw_if_index (sw_if_index0); icmp0 = (icmp46_header_t *) udp0; - next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0, - rx_fib_index0, node, next0, thread_index, - &ses0, &dm0); + // TODO: + next0 = det44_icmp_in2out (b0, ip0, icmp0, sw_if_index0, + rx_fib_index0, node, next0, + thread_index, &ses0, &mp0); goto trace0; } - dm0 = snat_det_map_by_user (sm, &ip0->src_address); - if (PREDICT_FALSE (!dm0)) + mp0 = snat_det_map_by_user (&ip0->src_address); + if (PREDICT_FALSE (!mp0)) { - nat_log_info ("no match for internal host %U", - format_ip4_address, &ip0->src_address); - next0 = NAT_DET_IN2OUT_NEXT_DROP; - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION]; + det44_log_info ("no match for internal host %U", + format_ip4_address, &ip0->src_address); + next0 = DET44_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION]; goto trace0; } - snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0); + snat_det_forward (mp0, &ip0->src_address, &new_addr0, &lo_port0); key0.ext_host_addr = ip0->dst_address; key0.ext_host_port = tcp0->dst; ses0 = - snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0); + snat_det_find_ses_by_in (mp0, &ip0->src_address, tcp0->src, key0); if (PREDICT_FALSE (!ses0)) { - for (i0 = 0; i0 < dm0->ports_per_host; i0++) + for (i0 = 0; i0 < mp0->ports_per_host; i0++) { key0.out_port = clib_host_to_net_u16 (lo_port0 + ((i0 + clib_net_to_host_u16 (tcp0->src)) % - dm0-> + mp0-> ports_per_host)); if (snat_det_get_ses_by_out - (dm0, &ip0->src_address, key0.as_u64)) + (mp0, &ip0->src_address, key0.as_u64)) continue; ses0 = - snat_det_ses_create (thread_index, dm0, &ip0->src_address, + snat_det_ses_create (thread_index, mp0, &ip0->src_address, tcp0->src, &key0); break; } @@ -394,7 +544,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, ICMP4_destination_unreachable, ICMP4_destination_unreachable_destination_unreachable_host, 0); - next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR; + next0 = DET44_IN2OUT_NEXT_ICMP_ERROR; goto trace0; } } @@ -404,7 +554,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, old_addr0.as_u32 = ip0->src_address.as_u32; ip0->src_address.as_u32 = new_addr0.as_u32; - vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index; + vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->outside_fib_index; sum0 = ip0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -415,22 +565,22 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP)) { if (tcp0->flags & TCP_FLAG_SYN) - ses0->state = SNAT_SESSION_TCP_SYN_SENT; + ses0->state = DET44_SESSION_TCP_SYN_SENT; else if (tcp0->flags & TCP_FLAG_ACK - && ses0->state == SNAT_SESSION_TCP_SYN_SENT) - ses0->state = SNAT_SESSION_TCP_ESTABLISHED; + && ses0->state == DET44_SESSION_TCP_SYN_SENT) + ses0->state = DET44_SESSION_TCP_ESTABLISHED; else if (tcp0->flags & TCP_FLAG_FIN - && ses0->state == SNAT_SESSION_TCP_ESTABLISHED) - ses0->state = SNAT_SESSION_TCP_FIN_WAIT; + && ses0->state == DET44_SESSION_TCP_ESTABLISHED) + ses0->state = DET44_SESSION_TCP_FIN_WAIT; else if (tcp0->flags & TCP_FLAG_ACK - && ses0->state == SNAT_SESSION_TCP_FIN_WAIT) - snat_det_ses_close (dm0, ses0); + && ses0->state == DET44_SESSION_TCP_FIN_WAIT) + snat_det_ses_close (mp0, ses0); else if (tcp0->flags & TCP_FLAG_FIN - && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT) - ses0->state = SNAT_SESSION_TCP_LAST_ACK; + && ses0->state == DET44_SESSION_TCP_CLOSE_WAIT) + ses0->state = DET44_SESSION_TCP_LAST_ACK; else if (tcp0->flags == 0 - && ses0->state == SNAT_SESSION_UNKNOWN) - ses0->state = SNAT_SESSION_TCP_ESTABLISHED; + && ses0->state == DET44_SESSION_UNKNOWN) + ses0->state = DET44_SESSION_TCP_ESTABLISHED; sum0 = tcp0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -439,12 +589,12 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, sum0 = ip_csum_update (sum0, old_port0, new_port0, ip4_header_t /* cheat */ , length /* changed member */ ); - mss_clamping (sm->mss_clamping, tcp0, &sum0); + mss_clamping (dm->mss_clamping, tcp0, &sum0); tcp0->checksum = ip_csum_fold (sum0); } else { - ses0->state = SNAT_SESSION_UDP_ACTIVE; + ses0->state = DET44_SESSION_UDP_ACTIVE; if (PREDICT_FALSE (udp0->checksum)) { @@ -463,17 +613,17 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, switch (ses0->state) { - case SNAT_SESSION_UDP_ACTIVE: - ses0->expire = now + sm->udp_timeout; + case DET44_SESSION_UDP_ACTIVE: + ses0->expire = now + dm->timeouts.udp; break; - case SNAT_SESSION_TCP_SYN_SENT: - case SNAT_SESSION_TCP_FIN_WAIT: - case SNAT_SESSION_TCP_CLOSE_WAIT: - case SNAT_SESSION_TCP_LAST_ACK: - ses0->expire = now + sm->tcp_transitory_timeout; + case DET44_SESSION_TCP_SYN_SENT: + case DET44_SESSION_TCP_FIN_WAIT: + case DET44_SESSION_TCP_CLOSE_WAIT: + case DET44_SESSION_TCP_LAST_ACK: + ses0->expire = now + dm->timeouts.tcp.transitory; break; - case SNAT_SESSION_TCP_ESTABLISHED: - ses0->expire = now + sm->tcp_established_timeout; + case DET44_SESSION_TCP_ESTABLISHED: + ses0->expire = now + dm->timeouts.tcp.established; break; } @@ -481,16 +631,16 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b0->flags & VLIB_BUFFER_IS_TRACED))) { - nat_det_in2out_trace_t *t = + det44_in2out_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); t->sw_if_index = sw_if_index0; t->next_index = next0; t->session_index = ~0; if (ses0) - t->session_index = ses0 - dm0->sessions; + t->session_index = ses0 - mp0->sessions; } - pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP; + pkts_processed += next0 != DET44_IN2OUT_NEXT_DROP; ip1 = vlib_buffer_get_current (b1); udp1 = ip4_next_header (ip1); @@ -504,7 +654,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded, ICMP4_time_exceeded_ttl_exceeded_in_transit, 0); - next1 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR; + next1 = DET44_IN2OUT_NEXT_ICMP_ERROR; goto trace1; } @@ -516,46 +666,46 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, ip4_fib_table_get_index_for_sw_if_index (sw_if_index1); icmp1 = (icmp46_header_t *) udp1; - next1 = icmp_in2out (sm, b1, ip1, icmp1, sw_if_index1, - rx_fib_index1, node, next1, thread_index, - &ses1, &dm1); + next1 = det44_icmp_in2out (b1, ip1, icmp1, sw_if_index1, + rx_fib_index1, node, next1, + thread_index, &ses1, &mp1); goto trace1; } - dm1 = snat_det_map_by_user (sm, &ip1->src_address); - if (PREDICT_FALSE (!dm1)) + mp1 = snat_det_map_by_user (&ip1->src_address); + if (PREDICT_FALSE (!mp1)) { - nat_log_info ("no match for internal host %U", - format_ip4_address, &ip0->src_address); - next1 = NAT_DET_IN2OUT_NEXT_DROP; - b1->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION]; + det44_log_info ("no match for internal host %U", + format_ip4_address, &ip0->src_address); + next1 = DET44_IN2OUT_NEXT_DROP; + b1->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION]; goto trace1; } - snat_det_forward (dm1, &ip1->src_address, &new_addr1, &lo_port1); + snat_det_forward (mp1, &ip1->src_address, &new_addr1, &lo_port1); key1.ext_host_addr = ip1->dst_address; key1.ext_host_port = tcp1->dst; ses1 = - snat_det_find_ses_by_in (dm1, &ip1->src_address, tcp1->src, key1); + snat_det_find_ses_by_in (mp1, &ip1->src_address, tcp1->src, key1); if (PREDICT_FALSE (!ses1)) { - for (i1 = 0; i1 < dm1->ports_per_host; i1++) + for (i1 = 0; i1 < mp1->ports_per_host; i1++) { key1.out_port = clib_host_to_net_u16 (lo_port1 + ((i1 + clib_net_to_host_u16 (tcp1->src)) % - dm1-> + mp1-> ports_per_host)); if (snat_det_get_ses_by_out - (dm1, &ip1->src_address, key1.as_u64)) + (mp1, &ip1->src_address, key1.as_u64)) continue; ses1 = - snat_det_ses_create (thread_index, dm1, &ip1->src_address, + snat_det_ses_create (thread_index, mp1, &ip1->src_address, tcp1->src, &key1); break; } @@ -567,7 +717,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, ICMP4_destination_unreachable, ICMP4_destination_unreachable_destination_unreachable_host, 0); - next1 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR; + next1 = DET44_IN2OUT_NEXT_ICMP_ERROR; goto trace1; } } @@ -577,7 +727,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, old_addr1.as_u32 = ip1->src_address.as_u32; ip1->src_address.as_u32 = new_addr1.as_u32; - vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->outside_fib_index; + vnet_buffer (b1)->sw_if_index[VLIB_TX] = dm->outside_fib_index; sum1 = ip1->checksum; sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32, @@ -588,22 +738,22 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP)) { if (tcp1->flags & TCP_FLAG_SYN) - ses1->state = SNAT_SESSION_TCP_SYN_SENT; + ses1->state = DET44_SESSION_TCP_SYN_SENT; else if (tcp1->flags & TCP_FLAG_ACK - && ses1->state == SNAT_SESSION_TCP_SYN_SENT) - ses1->state = SNAT_SESSION_TCP_ESTABLISHED; + && ses1->state == DET44_SESSION_TCP_SYN_SENT) + ses1->state = DET44_SESSION_TCP_ESTABLISHED; else if (tcp1->flags & TCP_FLAG_FIN - && ses1->state == SNAT_SESSION_TCP_ESTABLISHED) - ses1->state = SNAT_SESSION_TCP_FIN_WAIT; + && ses1->state == DET44_SESSION_TCP_ESTABLISHED) + ses1->state = DET44_SESSION_TCP_FIN_WAIT; else if (tcp1->flags & TCP_FLAG_ACK - && ses1->state == SNAT_SESSION_TCP_FIN_WAIT) - snat_det_ses_close (dm1, ses1); + && ses1->state == DET44_SESSION_TCP_FIN_WAIT) + snat_det_ses_close (mp1, ses1); else if (tcp1->flags & TCP_FLAG_FIN - && ses1->state == SNAT_SESSION_TCP_CLOSE_WAIT) - ses1->state = SNAT_SESSION_TCP_LAST_ACK; + && ses1->state == DET44_SESSION_TCP_CLOSE_WAIT) + ses1->state = DET44_SESSION_TCP_LAST_ACK; else if (tcp1->flags == 0 - && ses1->state == SNAT_SESSION_UNKNOWN) - ses1->state = SNAT_SESSION_TCP_ESTABLISHED; + && ses1->state == DET44_SESSION_UNKNOWN) + ses1->state = DET44_SESSION_TCP_ESTABLISHED; sum1 = tcp1->checksum; sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32, @@ -612,12 +762,12 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, sum1 = ip_csum_update (sum1, old_port1, new_port1, ip4_header_t /* cheat */ , length /* changed member */ ); - mss_clamping (sm->mss_clamping, tcp1, &sum1); + mss_clamping (dm->mss_clamping, tcp1, &sum1); tcp1->checksum = ip_csum_fold (sum1); } else { - ses1->state = SNAT_SESSION_UDP_ACTIVE; + ses1->state = DET44_SESSION_UDP_ACTIVE; if (PREDICT_FALSE (udp1->checksum)) { @@ -636,17 +786,17 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, switch (ses1->state) { - case SNAT_SESSION_UDP_ACTIVE: - ses1->expire = now + sm->udp_timeout; + case DET44_SESSION_UDP_ACTIVE: + ses1->expire = now + dm->timeouts.udp; break; - case SNAT_SESSION_TCP_SYN_SENT: - case SNAT_SESSION_TCP_FIN_WAIT: - case SNAT_SESSION_TCP_CLOSE_WAIT: - case SNAT_SESSION_TCP_LAST_ACK: - ses1->expire = now + sm->tcp_transitory_timeout; + case DET44_SESSION_TCP_SYN_SENT: + case DET44_SESSION_TCP_FIN_WAIT: + case DET44_SESSION_TCP_CLOSE_WAIT: + case DET44_SESSION_TCP_LAST_ACK: + ses1->expire = now + dm->timeouts.tcp.transitory; break; - case SNAT_SESSION_TCP_ESTABLISHED: - ses1->expire = now + sm->tcp_established_timeout; + case DET44_SESSION_TCP_ESTABLISHED: + ses1->expire = now + dm->timeouts.tcp.established; break; } @@ -654,16 +804,16 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b1->flags & VLIB_BUFFER_IS_TRACED))) { - nat_det_in2out_trace_t *t = + det44_in2out_trace_t *t = vlib_add_trace (vm, node, b1, sizeof (*t)); t->sw_if_index = sw_if_index1; t->next_index = next1; t->session_index = ~0; if (ses1) - t->session_index = ses1 - dm1->sessions; + t->session_index = ses1 - mp1->sessions; } - pkts_processed += next1 != NAT_DET_IN2OUT_NEXT_DROP; + pkts_processed += next1 != DET44_IN2OUT_NEXT_DROP; /* verify speculative enqueues, maybe switch current next frame */ vlib_validate_buffer_enqueue_x2 (vm, node, next_index, @@ -685,7 +835,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, tcp_header_t *tcp0; u32 proto0; snat_det_out_key_t key0; - snat_det_map_t *dm0; + snat_det_map_t *mp0; snat_det_session_t *ses0 = 0; u32 rx_fib_index0; icmp46_header_t *icmp0; @@ -699,7 +849,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, n_left_to_next -= 1; b0 = vlib_get_buffer (vm, bi0); - next0 = NAT_DET_IN2OUT_NEXT_LOOKUP; + next0 = DET44_IN2OUT_NEXT_LOOKUP; ip0 = vlib_buffer_get_current (b0); udp0 = ip4_next_header (ip0); @@ -713,7 +863,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded, ICMP4_time_exceeded_ttl_exceeded_in_transit, 0); - next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR; + next0 = DET44_IN2OUT_NEXT_ICMP_ERROR; goto trace00; } @@ -725,46 +875,46 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, ip4_fib_table_get_index_for_sw_if_index (sw_if_index0); icmp0 = (icmp46_header_t *) udp0; - next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0, - rx_fib_index0, node, next0, thread_index, - &ses0, &dm0); + next0 = det44_icmp_in2out (b0, ip0, icmp0, sw_if_index0, + rx_fib_index0, node, next0, + thread_index, &ses0, &mp0); goto trace00; } - dm0 = snat_det_map_by_user (sm, &ip0->src_address); - if (PREDICT_FALSE (!dm0)) + mp0 = snat_det_map_by_user (&ip0->src_address); + if (PREDICT_FALSE (!mp0)) { - nat_log_info ("no match for internal host %U", - format_ip4_address, &ip0->src_address); - next0 = NAT_DET_IN2OUT_NEXT_DROP; - b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION]; + det44_log_info ("no match for internal host %U", + format_ip4_address, &ip0->src_address); + next0 = DET44_IN2OUT_NEXT_DROP; + b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION]; goto trace00; } - snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0); + snat_det_forward (mp0, &ip0->src_address, &new_addr0, &lo_port0); key0.ext_host_addr = ip0->dst_address; key0.ext_host_port = tcp0->dst; ses0 = - snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0); + snat_det_find_ses_by_in (mp0, &ip0->src_address, tcp0->src, key0); if (PREDICT_FALSE (!ses0)) { - for (i0 = 0; i0 < dm0->ports_per_host; i0++) + for (i0 = 0; i0 < mp0->ports_per_host; i0++) { key0.out_port = clib_host_to_net_u16 (lo_port0 + ((i0 + clib_net_to_host_u16 (tcp0->src)) % - dm0-> + mp0-> ports_per_host)); if (snat_det_get_ses_by_out - (dm0, &ip0->src_address, key0.as_u64)) + (mp0, &ip0->src_address, key0.as_u64)) continue; ses0 = - snat_det_ses_create (thread_index, dm0, &ip0->src_address, + snat_det_ses_create (thread_index, mp0, &ip0->src_address, tcp0->src, &key0); break; } @@ -776,7 +926,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, ICMP4_destination_unreachable, ICMP4_destination_unreachable_destination_unreachable_host, 0); - next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR; + next0 = DET44_IN2OUT_NEXT_ICMP_ERROR; goto trace00; } } @@ -786,7 +936,7 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, old_addr0.as_u32 = ip0->src_address.as_u32; ip0->src_address.as_u32 = new_addr0.as_u32; - vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index; + vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->outside_fib_index; sum0 = ip0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -797,22 +947,22 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP)) { if (tcp0->flags & TCP_FLAG_SYN) - ses0->state = SNAT_SESSION_TCP_SYN_SENT; + ses0->state = DET44_SESSION_TCP_SYN_SENT; else if (tcp0->flags & TCP_FLAG_ACK - && ses0->state == SNAT_SESSION_TCP_SYN_SENT) - ses0->state = SNAT_SESSION_TCP_ESTABLISHED; + && ses0->state == DET44_SESSION_TCP_SYN_SENT) + ses0->state = DET44_SESSION_TCP_ESTABLISHED; else if (tcp0->flags & TCP_FLAG_FIN - && ses0->state == SNAT_SESSION_TCP_ESTABLISHED) - ses0->state = SNAT_SESSION_TCP_FIN_WAIT; + && ses0->state == DET44_SESSION_TCP_ESTABLISHED) + ses0->state = DET44_SESSION_TCP_FIN_WAIT; else if (tcp0->flags & TCP_FLAG_ACK - && ses0->state == SNAT_SESSION_TCP_FIN_WAIT) - snat_det_ses_close (dm0, ses0); + && ses0->state == DET44_SESSION_TCP_FIN_WAIT) + snat_det_ses_close (mp0, ses0); else if (tcp0->flags & TCP_FLAG_FIN - && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT) - ses0->state = SNAT_SESSION_TCP_LAST_ACK; + && ses0->state == DET44_SESSION_TCP_CLOSE_WAIT) + ses0->state = DET44_SESSION_TCP_LAST_ACK; else if (tcp0->flags == 0 - && ses0->state == SNAT_SESSION_UNKNOWN) - ses0->state = SNAT_SESSION_TCP_ESTABLISHED; + && ses0->state == DET44_SESSION_UNKNOWN) + ses0->state = DET44_SESSION_TCP_ESTABLISHED; sum0 = tcp0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -821,12 +971,12 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, sum0 = ip_csum_update (sum0, old_port0, new_port0, ip4_header_t /* cheat */ , length /* changed member */ ); - mss_clamping (sm->mss_clamping, tcp0, &sum0); + mss_clamping (dm->mss_clamping, tcp0, &sum0); tcp0->checksum = ip_csum_fold (sum0); } else { - ses0->state = SNAT_SESSION_UDP_ACTIVE; + ses0->state = DET44_SESSION_UDP_ACTIVE; if (PREDICT_FALSE (udp0->checksum)) { @@ -845,17 +995,17 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, switch (ses0->state) { - case SNAT_SESSION_UDP_ACTIVE: - ses0->expire = now + sm->udp_timeout; + case DET44_SESSION_UDP_ACTIVE: + ses0->expire = now + dm->timeouts.udp; break; - case SNAT_SESSION_TCP_SYN_SENT: - case SNAT_SESSION_TCP_FIN_WAIT: - case SNAT_SESSION_TCP_CLOSE_WAIT: - case SNAT_SESSION_TCP_LAST_ACK: - ses0->expire = now + sm->tcp_transitory_timeout; + case DET44_SESSION_TCP_SYN_SENT: + case DET44_SESSION_TCP_FIN_WAIT: + case DET44_SESSION_TCP_CLOSE_WAIT: + case DET44_SESSION_TCP_LAST_ACK: + ses0->expire = now + dm->timeouts.tcp.transitory; break; - case SNAT_SESSION_TCP_ESTABLISHED: - ses0->expire = now + sm->tcp_established_timeout; + case DET44_SESSION_TCP_ESTABLISHED: + ses0->expire = now + dm->timeouts.tcp.established; break; } @@ -863,16 +1013,16 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b0->flags & VLIB_BUFFER_IS_TRACED))) { - nat_det_in2out_trace_t *t = + det44_in2out_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); t->sw_if_index = sw_if_index0; t->next_index = next0; t->session_index = ~0; if (ses0) - t->session_index = ses0 - dm0->sessions; + t->session_index = ses0 - mp0->sessions; } - pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP; + pkts_processed += next0 != DET44_IN2OUT_NEXT_DROP; /* verify speculative enqueue, maybe switch current next frame */ vlib_validate_buffer_enqueue_x1 (vm, node, next_index, @@ -883,26 +1033,27 @@ VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm, vlib_put_next_frame (vm, node, next_index, n_left_to_next); } - vlib_node_increment_counter (vm, sm->det_in2out_node_index, - NAT_DET_IN2OUT_ERROR_IN2OUT_PACKETS, + vlib_node_increment_counter (vm, dm->in2out_node_index, + DET44_IN2OUT_ERROR_IN2OUT_PACKETS, pkts_processed); return frame->n_vectors; } /* *INDENT-OFF* */ -VLIB_REGISTER_NODE (snat_det_in2out_node) = { - .name = "nat44-det-in2out", +VLIB_REGISTER_NODE (det44_in2out_node) = { + .name = "det44-in2out", .vector_size = sizeof (u32), - .format_trace = format_nat_det_in2out_trace, + .format_trace = format_det44_in2out_trace, .type = VLIB_NODE_TYPE_INTERNAL, - .n_errors = ARRAY_LEN(nat_det_in2out_error_strings), - .error_strings = nat_det_in2out_error_strings, - .n_next_nodes = NAT_DET_IN2OUT_N_NEXT, + .n_errors = ARRAY_LEN(det44_in2out_error_strings), + .error_strings = det44_in2out_error_strings, + .runtime_data_bytes = sizeof (det44_runtime_t), + .n_next_nodes = DET44_IN2OUT_N_NEXT, /* edit / add dispositions here */ .next_nodes = { - [NAT_DET_IN2OUT_NEXT_DROP] = "error-drop", - [NAT_DET_IN2OUT_NEXT_LOOKUP] = "ip4-lookup", - [NAT_DET_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", + [DET44_IN2OUT_NEXT_DROP] = "error-drop", + [DET44_IN2OUT_NEXT_LOOKUP] = "ip4-lookup", + [DET44_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", }, }; /* *INDENT-ON* */ diff --git a/src/plugins/nat/det44/det44_inlines.h b/src/plugins/nat/det44/det44_inlines.h new file mode 100644 index 00000000000..e4be469562c --- /dev/null +++ b/src/plugins/nat/det44/det44_inlines.h @@ -0,0 +1,130 @@ +/* + * det44.h - deterministic NAT definitions + * + * Copyright (c) 2020 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * @file + * @brief Deterministic NAT (CGN) inlines + */ + +#ifndef __included_det44_inlines_h__ +#define __included_det44_inlines_h__ + +static_always_inline int +det44_is_interface_addr (vlib_node_runtime_t * node, + u32 sw_if_index0, u32 ip4_addr) +{ + det44_runtime_t *rt = (det44_runtime_t *) node->runtime_data; + det44_main_t *dm = &det44_main; + ip4_address_t *first_int_addr; + + if (PREDICT_FALSE (rt->cached_sw_if_index != sw_if_index0)) + { + first_int_addr = ip4_interface_first_address (dm->ip4_main, + sw_if_index0, 0); + rt->cached_sw_if_index = sw_if_index0; + if (first_int_addr) + rt->cached_ip4_address = first_int_addr->as_u32; + else + rt->cached_ip4_address = 0; + } + if (PREDICT_FALSE (rt->cached_ip4_address == ip4_addr)) + return 0; + return 1; +} + +/** + * @brief Check if packet should be translated + * + * Packets aimed at outside interface and external address with active session + * should be translated. + * + * @param node NAT runtime data + * @param sw_if_index0 index of the inside interface + * @param ip0 IPv4 header + * @param proto0 NAT protocol + * @param rx_fib_index0 RX FIB index + * + * @returns 0 if packet should be translated otherwise 1 + */ +static_always_inline int +det44_translate (vlib_node_runtime_t * node, u32 sw_if_index0, + ip4_header_t * ip0, u32 proto0, u32 rx_fib_index0) +{ + det44_main_t *dm = &det44_main; + fib_node_index_t fei = FIB_NODE_INDEX_INVALID; + det44_fib_t *outside_fib; + fib_prefix_t pfx = { + .fp_proto = FIB_PROTOCOL_IP4, + .fp_len = 32, + .fp_addr = { + .ip4.as_u32 = ip0->dst_address.as_u32, + } + , + }; + + /* Don't NAT packet aimed at the interface address */ + if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0, + ip0->dst_address.as_u32))) + { + return 1; + } + + /* find out if there is outside feature enabled for this destination */ + fei = fib_table_lookup (rx_fib_index0, &pfx); + if (FIB_NODE_INDEX_INVALID != fei) + { + u32 sw_if_index = fib_entry_get_resolving_interface (fei); + if (sw_if_index == ~0) + { + // TODO: go over use cases + /* *INDENT-OFF* */ + vec_foreach (outside_fib, dm->outside_fibs) + { + fei = fib_table_lookup (outside_fib->fib_index, &pfx); + if (FIB_NODE_INDEX_INVALID != fei) + { + sw_if_index = fib_entry_get_resolving_interface (fei); + if (sw_if_index != ~0) + break; + } + } + /* *INDENT-ON* */ + } + if (sw_if_index != ~0) + { + det44_interface_t *i; + /* *INDENT-OFF* */ + pool_foreach (i, dm->interfaces, ({ + /* NAT packet aimed at outside interface */ + if ((det44_interface_is_outside (i)) && (sw_if_index == i->sw_if_index)) + return 0; + })); + /* *INDENT-ON* */ + } + } + return 1; +} + +#endif /* __included_det44_inlines_h__ */ + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/nat/nat_det_out2in.c b/src/plugins/nat/det44/det44_out2in.c index 6a133bcb47a..5ee28777b84 100644 --- a/src/plugins/nat/nat_det_out2in.c +++ b/src/plugins/nat/det44/det44_out2in.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2018 Cisco and/or its affiliates. + * Copyright (c) 2020 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: @@ -12,9 +12,10 @@ * See the License for the specific language governing permissions and * limitations under the License. */ + /** * @file - * @brief Deterministic/CGN NAT44 outside to inside network translation + * @brief Deterministic NAT (CGN) outside to inside translation */ #include <vlib/vlib.h> @@ -23,55 +24,59 @@ #include <vnet/fib/ip4_fib.h> #include <vppinfra/error.h> #include <vppinfra/elog.h> -#include <nat/nat.h> -#include <nat/nat_det.h> -#include <nat/nat_inlines.h> + +#include <nat/det44/det44.h> +#include <nat/det44/det44_inlines.h> + +#include <nat/lib/lib.h> +#include <nat/lib/inlines.h> +#include <nat/lib/nat_inlines.h> typedef enum { - NAT_DET_OUT2IN_NEXT_DROP, - NAT_DET_OUT2IN_NEXT_LOOKUP, - NAT_DET_OUT2IN_NEXT_ICMP_ERROR, - NAT_DET_OUT2IN_N_NEXT, -} nat_det_out2in_next_t; + DET44_OUT2IN_NEXT_DROP, + DET44_OUT2IN_NEXT_LOOKUP, + DET44_OUT2IN_NEXT_ICMP_ERROR, + DET44_OUT2IN_N_NEXT, +} det44_out2in_next_t; typedef struct { u32 sw_if_index; u32 next_index; u32 session_index; -} nat_det_out2in_trace_t; +} det44_out2in_trace_t; -#define foreach_nat_det_out2in_error \ -_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ -_(NO_TRANSLATION, "No translation") \ -_(BAD_ICMP_TYPE, "unsupported ICMP type") \ +#define foreach_det44_out2in_error \ +_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ +_(NO_TRANSLATION, "No translation") \ +_(BAD_ICMP_TYPE, "unsupported ICMP type") \ _(OUT2IN_PACKETS, "Good out2in packets processed") typedef enum { -#define _(sym,str) NAT_DET_OUT2IN_ERROR_##sym, - foreach_nat_det_out2in_error +#define _(sym,str) DET44_OUT2IN_ERROR_##sym, + foreach_det44_out2in_error #undef _ - SNAT_OUT2IN_N_ERROR, -} nat_det_out2in_error_t; + DET44_OUT2IN_N_ERROR, +} det44_out2in_error_t; -static char *nat_det_out2in_error_strings[] = { +static char *det44_out2in_error_strings[] = { #define _(sym,string) string, - foreach_nat_det_out2in_error + foreach_det44_out2in_error #undef _ }; static u8 * -format_nat_det_out2in_trace (u8 * s, va_list * args) +format_det44_out2in_trace (u8 * s, va_list * args) { CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); - nat_det_out2in_trace_t *t = va_arg (*args, nat_det_out2in_trace_t *); + det44_out2in_trace_t *t = va_arg (*args, det44_out2in_trace_t *); s = format (s, - "NAT_DET_OUT2IN: sw_if_index %d, next index %d, session index %d", + "DET44_OUT2IN: sw_if_index %d, next index %d, session index %d", t->sw_if_index, t->next_index, t->session_index); return s; } @@ -81,7 +86,6 @@ format_nat_det_out2in_trace (u8 * s, va_list * args) * Get address and port values to be used for ICMP packet translation * and create session if needed * - * @param[in,out] sm NAT main * @param[in,out] node NAT node runtime * @param[in] thread_index thread index * @param[in,out] b0 buffer containing packet to be translated @@ -93,13 +97,14 @@ format_nat_det_out2in_trace (u8 * s, va_list * args) * @param e optional parameter */ u32 -icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node, +icmp_match_out2in_det (vlib_node_runtime_t * node, u32 thread_index, vlib_buffer_t * b0, ip4_header_t * ip0, ip4_address_t * addr, u16 * port, u32 * fib_index, nat_protocol_t * proto, void *d, void *e, u8 * dont_translate) { + det44_main_t *dm = &det44_main; icmp46_header_t *icmp0; u32 sw_if_index0; u8 protocol; @@ -109,7 +114,7 @@ icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node, ip4_header_t *inner_ip0; void *l4_header = 0; icmp46_header_t *inner_icmp0; - snat_det_map_t *dm0 = 0; + snat_det_map_t *mp0 = 0; ip4_address_t new_addr0 = { {0} }; snat_det_session_t *ses0 = 0; ip4_address_t out_addr; @@ -150,48 +155,48 @@ icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node, key0.out_port = ((tcp_udp_header_t *) l4_header)->src_port; break; default: - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL]; - next0 = NAT_DET_OUT2IN_NEXT_DROP; + b0->error = node->errors[DET44_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL]; + next0 = DET44_OUT2IN_NEXT_DROP; goto out; } } - dm0 = snat_det_map_by_out (sm, &out_addr); - if (PREDICT_FALSE (!dm0)) + mp0 = snat_det_map_by_out (&out_addr); + if (PREDICT_FALSE (!mp0)) { /* Don't NAT packet aimed at the intfc address */ - if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0, - ip0->dst_address.as_u32))) + if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0, + ip0->dst_address.as_u32))) { *dont_translate = 1; goto out; } - nat_log_info ("unknown dst address: %U", - format_ip4_address, &ip0->dst_address); + det44_log_info ("unknown dst address: %U", + format_ip4_address, &ip0->dst_address); goto out; } - snat_det_reverse (dm0, &ip0->dst_address, + snat_det_reverse (mp0, &ip0->dst_address, clib_net_to_host_u16 (key0.out_port), &new_addr0); - ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64); + ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64); if (PREDICT_FALSE (!ses0)) { /* Don't NAT packet aimed at the intfc address */ - if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0, - ip0->dst_address.as_u32))) + if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0, + ip0->dst_address.as_u32))) { *dont_translate = 1; goto out; } - nat_log_info ("no match src %U:%d dst %U:%d for user %U", - format_ip4_address, &key0.ext_host_addr, - clib_net_to_host_u16 (key0.ext_host_port), - format_ip4_address, &out_addr, - clib_net_to_host_u16 (key0.out_port), - format_ip4_address, &new_addr0); - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; - next0 = NAT_DET_OUT2IN_NEXT_DROP; + det44_log_info ("no match src %U:%d dst %U:%d for user %U", + format_ip4_address, &key0.ext_host_addr, + clib_net_to_host_u16 (key0.ext_host_port), + format_ip4_address, &out_addr, + clib_net_to_host_u16 (key0.out_port), + format_ip4_address, &new_addr0); + b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; + next0 = DET44_OUT2IN_NEXT_DROP; goto out; } @@ -200,8 +205,8 @@ icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node, && !icmp_type_is_error_message (vnet_buffer (b0)->ip. reass.icmp_type_or_tcp_flags))) { - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_BAD_ICMP_TYPE]; - next0 = NAT_DET_OUT2IN_NEXT_DROP; + b0->error = node->errors[DET44_OUT2IN_ERROR_BAD_ICMP_TYPE]; + next0 = DET44_OUT2IN_NEXT_DROP; goto out; } @@ -212,25 +217,161 @@ out: if (ses0) { *addr = new_addr0; - *fib_index = sm->inside_fib_index; + *fib_index = dm->inside_fib_index; *port = ses0->in_port; } if (d) *(snat_det_session_t **) d = ses0; if (e) - *(snat_det_map_t **) e = dm0; + *(snat_det_map_t **) e = mp0; + return next0; +} +#endif + +#ifndef CLIB_MARCH_VARIANT +u32 +det44_icmp_out2in (vlib_buffer_t * b0, + ip4_header_t * ip0, + icmp46_header_t * icmp0, + u32 sw_if_index0, + u32 rx_fib_index0, + vlib_node_runtime_t * node, + u32 next0, u32 thread_index, void *d, void *e) +{ + vlib_main_t *vm = vlib_get_main (); + u32 new_addr0, old_addr0, next0_tmp, fib_index; + u16 old_id0, new_id0, port, checksum0; + icmp_echo_header_t *echo0, *inner_echo0; + icmp46_header_t *inner_icmp0; + ip4_header_t *inner_ip0; + ip4_address_t addr; + void *l4_header; + u8 dont_translate; + ip_csum_t sum0; + nat_protocol_t proto; + + echo0 = (icmp_echo_header_t *) (icmp0 + 1); + next0_tmp = icmp_match_out2in_det (node, thread_index, b0, ip0, + &addr, &port, &fib_index, &proto, + d, e, &dont_translate); + if (next0_tmp != ~0) + next0 = next0_tmp; + if (next0 == DET44_OUT2IN_NEXT_DROP || dont_translate) + goto out; + + if (PREDICT_TRUE (!ip4_is_fragment (ip0))) + { + sum0 = + ip_incremental_checksum_buffer (vm, b0, + (u8 *) icmp0 - + (u8 *) vlib_buffer_get_current (b0), + ntohs (ip0->length) - + ip4_header_bytes (ip0), 0); + checksum0 = ~ip_csum_fold (sum0); + if (checksum0 != 0 && checksum0 != 0xffff) + { + next0 = DET44_OUT2IN_NEXT_DROP; + goto out; + } + } + + old_addr0 = ip0->dst_address.as_u32; + new_addr0 = ip0->dst_address.as_u32 = addr.as_u32; + vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index; + + sum0 = ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + dst_address /* changed member */ ); + ip0->checksum = ip_csum_fold (sum0); + + + if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment) + { + if (icmp0->checksum == 0) + icmp0->checksum = 0xffff; + + if (!icmp_type_is_error_message (icmp0->type)) + { + new_id0 = port; + if (PREDICT_FALSE (new_id0 != echo0->identifier)) + { + old_id0 = echo0->identifier; + new_id0 = port; + echo0->identifier = new_id0; + + sum0 = icmp0->checksum; + sum0 = + ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t, + identifier /* changed member */ ); + icmp0->checksum = ip_csum_fold (sum0); + } + } + else + { + inner_ip0 = (ip4_header_t *) (echo0 + 1); + l4_header = ip4_next_header (inner_ip0); + + if (!ip4_header_checksum_is_valid (inner_ip0)) + { + next0 = DET44_OUT2IN_NEXT_DROP; + goto out; + } + + old_addr0 = inner_ip0->src_address.as_u32; + inner_ip0->src_address = addr; + new_addr0 = inner_ip0->src_address.as_u32; + + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + src_address /* changed member */ ); + icmp0->checksum = ip_csum_fold (sum0); + + switch (proto) + { + case NAT_PROTOCOL_ICMP: + inner_icmp0 = (icmp46_header_t *) l4_header; + inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1); + + old_id0 = inner_echo0->identifier; + new_id0 = port; + inner_echo0->identifier = new_id0; + + sum0 = icmp0->checksum; + sum0 = + ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t, + identifier); + icmp0->checksum = ip_csum_fold (sum0); + break; + case NAT_PROTOCOL_UDP: + case NAT_PROTOCOL_TCP: + old_id0 = ((tcp_udp_header_t *) l4_header)->src_port; + new_id0 = port; + ((tcp_udp_header_t *) l4_header)->src_port = new_id0; + + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t, + src_port); + icmp0->checksum = ip_csum_fold (sum0); + break; + default: + ASSERT (0); + } + } + } + +out: return next0; } #endif -VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) +VLIB_NODE_FN (det44_out2in_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) { u32 n_left_from, *from, *to_next; - nat_det_out2in_next_t next_index; + det44_out2in_next_t next_index; u32 pkts_processed = 0; - snat_main_t *sm = &snat_main; + det44_main_t *dm = &det44_main; u32 thread_index = vm->thread_index; from = vlib_frame_vector_args (frame); @@ -247,8 +388,8 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, { u32 bi0, bi1; vlib_buffer_t *b0, *b1; - u32 next0 = NAT_DET_OUT2IN_NEXT_LOOKUP; - u32 next1 = NAT_DET_OUT2IN_NEXT_LOOKUP; + u32 next0 = DET44_OUT2IN_NEXT_LOOKUP; + u32 next1 = DET44_OUT2IN_NEXT_LOOKUP; u32 sw_if_index0, sw_if_index1; ip4_header_t *ip0, *ip1; ip_csum_t sum0, sum1; @@ -258,7 +399,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, tcp_header_t *tcp0, *tcp1; u32 proto0, proto1; snat_det_out_key_t key0, key1; - snat_det_map_t *dm0, *dm1; + snat_det_map_t *mp0, *mp1; snat_det_session_t *ses0 = 0, *ses1 = 0; u32 rx_fib_index0, rx_fib_index1; icmp46_header_t *icmp0, *icmp1; @@ -300,7 +441,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded, ICMP4_time_exceeded_ttl_exceeded_in_transit, 0); - next0 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR; + next0 = DET44_OUT2IN_NEXT_ICMP_ERROR; goto trace0; } @@ -312,9 +453,9 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, ip4_fib_table_get_index_for_sw_if_index (sw_if_index0); icmp0 = (icmp46_header_t *) udp0; - next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0, - rx_fib_index0, node, next0, thread_index, - &ses0, &dm0); + next0 = det44_icmp_out2in (b0, ip0, icmp0, sw_if_index0, + rx_fib_index0, node, next0, + thread_index, &ses0, &mp0); goto trace0; } @@ -322,30 +463,30 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, key0.ext_host_port = tcp0->src; key0.out_port = tcp0->dst; - dm0 = snat_det_map_by_out (sm, &ip0->dst_address); - if (PREDICT_FALSE (!dm0)) + mp0 = snat_det_map_by_out (&ip0->dst_address); + if (PREDICT_FALSE (!mp0)) { - nat_log_info ("unknown dst address: %U", - format_ip4_address, &ip0->dst_address); - next0 = NAT_DET_OUT2IN_NEXT_DROP; - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; + det44_log_info ("unknown dst address: %U", + format_ip4_address, &ip0->dst_address); + next0 = DET44_OUT2IN_NEXT_DROP; + b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; goto trace0; } - snat_det_reverse (dm0, &ip0->dst_address, + snat_det_reverse (mp0, &ip0->dst_address, clib_net_to_host_u16 (tcp0->dst), &new_addr0); - ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64); + ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64); if (PREDICT_FALSE (!ses0)) { - nat_log_info ("no match src %U:%d dst %U:%d for user %U", - format_ip4_address, &ip0->src_address, - clib_net_to_host_u16 (tcp0->src), - format_ip4_address, &ip0->dst_address, - clib_net_to_host_u16 (tcp0->dst), - format_ip4_address, &new_addr0); - next0 = NAT_DET_OUT2IN_NEXT_DROP; - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; + det44_log_info ("no match src %U:%d dst %U:%d for user %U", + format_ip4_address, &ip0->src_address, + clib_net_to_host_u16 (tcp0->src), + format_ip4_address, &ip0->dst_address, + clib_net_to_host_u16 (tcp0->dst), + format_ip4_address, &new_addr0); + next0 = DET44_OUT2IN_NEXT_DROP; + b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; goto trace0; } old_port0 = udp0->dst_port; @@ -353,7 +494,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, old_addr0 = ip0->dst_address; ip0->dst_address = new_addr0; - vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index; + vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->inside_fib_index; sum0 = ip0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -364,11 +505,11 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP)) { if (tcp0->flags & TCP_FLAG_FIN - && ses0->state == SNAT_SESSION_TCP_ESTABLISHED) - ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT; + && ses0->state == DET44_SESSION_TCP_ESTABLISHED) + ses0->state = DET44_SESSION_TCP_CLOSE_WAIT; else if (tcp0->flags & TCP_FLAG_ACK - && ses0->state == SNAT_SESSION_TCP_LAST_ACK) - snat_det_ses_close (dm0, ses0); + && ses0->state == DET44_SESSION_TCP_LAST_ACK) + snat_det_ses_close (mp0, ses0); sum0 = tcp0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -396,16 +537,16 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b0->flags & VLIB_BUFFER_IS_TRACED))) { - nat_det_out2in_trace_t *t = + det44_out2in_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); t->sw_if_index = sw_if_index0; t->next_index = next0; t->session_index = ~0; if (ses0) - t->session_index = ses0 - dm0->sessions; + t->session_index = ses0 - mp0->sessions; } - pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP; + pkts_processed += next0 != DET44_OUT2IN_NEXT_DROP; b1 = vlib_get_buffer (vm, bi1); @@ -421,7 +562,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded, ICMP4_time_exceeded_ttl_exceeded_in_transit, 0); - next1 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR; + next1 = DET44_OUT2IN_NEXT_ICMP_ERROR; goto trace1; } @@ -433,9 +574,9 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, ip4_fib_table_get_index_for_sw_if_index (sw_if_index1); icmp1 = (icmp46_header_t *) udp1; - next1 = icmp_out2in (sm, b1, ip1, icmp1, sw_if_index1, - rx_fib_index1, node, next1, thread_index, - &ses1, &dm1); + next1 = det44_icmp_out2in (b1, ip1, icmp1, sw_if_index1, + rx_fib_index1, node, next1, + thread_index, &ses1, &mp1); goto trace1; } @@ -443,30 +584,30 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, key1.ext_host_port = tcp1->src; key1.out_port = tcp1->dst; - dm1 = snat_det_map_by_out (sm, &ip1->dst_address); - if (PREDICT_FALSE (!dm1)) + mp1 = snat_det_map_by_out (&ip1->dst_address); + if (PREDICT_FALSE (!mp1)) { - nat_log_info ("unknown dst address: %U", - format_ip4_address, &ip1->dst_address); - next1 = NAT_DET_OUT2IN_NEXT_DROP; - b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; + det44_log_info ("unknown dst address: %U", + format_ip4_address, &ip1->dst_address); + next1 = DET44_OUT2IN_NEXT_DROP; + b1->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; goto trace1; } - snat_det_reverse (dm1, &ip1->dst_address, + snat_det_reverse (mp1, &ip1->dst_address, clib_net_to_host_u16 (tcp1->dst), &new_addr1); - ses1 = snat_det_get_ses_by_out (dm1, &new_addr1, key1.as_u64); + ses1 = snat_det_get_ses_by_out (mp1, &new_addr1, key1.as_u64); if (PREDICT_FALSE (!ses1)) { - nat_log_info ("no match src %U:%d dst %U:%d for user %U", - format_ip4_address, &ip1->src_address, - clib_net_to_host_u16 (tcp1->src), - format_ip4_address, &ip1->dst_address, - clib_net_to_host_u16 (tcp1->dst), - format_ip4_address, &new_addr1); - next1 = NAT_DET_OUT2IN_NEXT_DROP; - b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; + det44_log_info ("no match src %U:%d dst %U:%d for user %U", + format_ip4_address, &ip1->src_address, + clib_net_to_host_u16 (tcp1->src), + format_ip4_address, &ip1->dst_address, + clib_net_to_host_u16 (tcp1->dst), + format_ip4_address, &new_addr1); + next1 = DET44_OUT2IN_NEXT_DROP; + b1->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; goto trace1; } old_port1 = udp1->dst_port; @@ -474,7 +615,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, old_addr1 = ip1->dst_address; ip1->dst_address = new_addr1; - vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->inside_fib_index; + vnet_buffer (b1)->sw_if_index[VLIB_TX] = dm->inside_fib_index; sum1 = ip1->checksum; sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32, @@ -485,11 +626,11 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP)) { if (tcp1->flags & TCP_FLAG_FIN - && ses1->state == SNAT_SESSION_TCP_ESTABLISHED) - ses1->state = SNAT_SESSION_TCP_CLOSE_WAIT; + && ses1->state == DET44_SESSION_TCP_ESTABLISHED) + ses1->state = DET44_SESSION_TCP_CLOSE_WAIT; else if (tcp1->flags & TCP_FLAG_ACK - && ses1->state == SNAT_SESSION_TCP_LAST_ACK) - snat_det_ses_close (dm1, ses1); + && ses1->state == DET44_SESSION_TCP_LAST_ACK) + snat_det_ses_close (mp1, ses1); sum1 = tcp1->checksum; sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32, @@ -517,16 +658,16 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b1->flags & VLIB_BUFFER_IS_TRACED))) { - nat_det_out2in_trace_t *t = + det44_out2in_trace_t *t = vlib_add_trace (vm, node, b1, sizeof (*t)); t->sw_if_index = sw_if_index1; t->next_index = next1; t->session_index = ~0; if (ses1) - t->session_index = ses1 - dm1->sessions; + t->session_index = ses1 - mp1->sessions; } - pkts_processed += next1 != NAT_DET_OUT2IN_NEXT_DROP; + pkts_processed += next1 != DET44_OUT2IN_NEXT_DROP; /* verify speculative enqueues, maybe switch current next frame */ vlib_validate_buffer_enqueue_x2 (vm, node, next_index, @@ -538,7 +679,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, { u32 bi0; vlib_buffer_t *b0; - u32 next0 = NAT_DET_OUT2IN_NEXT_LOOKUP; + u32 next0 = DET44_OUT2IN_NEXT_LOOKUP; u32 sw_if_index0; ip4_header_t *ip0; ip_csum_t sum0; @@ -548,7 +689,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, tcp_header_t *tcp0; u32 proto0; snat_det_out_key_t key0; - snat_det_map_t *dm0; + snat_det_map_t *mp0; snat_det_session_t *ses0 = 0; u32 rx_fib_index0; icmp46_header_t *icmp0; @@ -575,7 +716,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded, ICMP4_time_exceeded_ttl_exceeded_in_transit, 0); - next0 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR; + next0 = DET44_OUT2IN_NEXT_ICMP_ERROR; goto trace00; } @@ -587,9 +728,9 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, ip4_fib_table_get_index_for_sw_if_index (sw_if_index0); icmp0 = (icmp46_header_t *) udp0; - next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0, - rx_fib_index0, node, next0, thread_index, - &ses0, &dm0); + next0 = det44_icmp_out2in (b0, ip0, icmp0, sw_if_index0, + rx_fib_index0, node, next0, + thread_index, &ses0, &mp0); goto trace00; } @@ -597,30 +738,30 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, key0.ext_host_port = tcp0->src; key0.out_port = tcp0->dst; - dm0 = snat_det_map_by_out (sm, &ip0->dst_address); - if (PREDICT_FALSE (!dm0)) + mp0 = snat_det_map_by_out (&ip0->dst_address); + if (PREDICT_FALSE (!mp0)) { - nat_log_info ("unknown dst address: %U", - format_ip4_address, &ip0->dst_address); - next0 = NAT_DET_OUT2IN_NEXT_DROP; - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; + det44_log_info ("unknown dst address: %U", + format_ip4_address, &ip0->dst_address); + next0 = DET44_OUT2IN_NEXT_DROP; + b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; goto trace00; } - snat_det_reverse (dm0, &ip0->dst_address, + snat_det_reverse (mp0, &ip0->dst_address, clib_net_to_host_u16 (tcp0->dst), &new_addr0); - ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64); + ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64); if (PREDICT_FALSE (!ses0)) { - nat_log_info ("no match src %U:%d dst %U:%d for user %U", - format_ip4_address, &ip0->src_address, - clib_net_to_host_u16 (tcp0->src), - format_ip4_address, &ip0->dst_address, - clib_net_to_host_u16 (tcp0->dst), - format_ip4_address, &new_addr0); - next0 = NAT_DET_OUT2IN_NEXT_DROP; - b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION]; + det44_log_info ("no match src %U:%d dst %U:%d for user %U", + format_ip4_address, &ip0->src_address, + clib_net_to_host_u16 (tcp0->src), + format_ip4_address, &ip0->dst_address, + clib_net_to_host_u16 (tcp0->dst), + format_ip4_address, &new_addr0); + next0 = DET44_OUT2IN_NEXT_DROP; + b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION]; goto trace00; } old_port0 = udp0->dst_port; @@ -628,7 +769,7 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, old_addr0 = ip0->dst_address; ip0->dst_address = new_addr0; - vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index; + vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->inside_fib_index; sum0 = ip0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -639,11 +780,11 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP)) { if (tcp0->flags & TCP_FLAG_FIN - && ses0->state == SNAT_SESSION_TCP_ESTABLISHED) - ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT; + && ses0->state == DET44_SESSION_TCP_ESTABLISHED) + ses0->state = DET44_SESSION_TCP_CLOSE_WAIT; else if (tcp0->flags & TCP_FLAG_ACK - && ses0->state == SNAT_SESSION_TCP_LAST_ACK) - snat_det_ses_close (dm0, ses0); + && ses0->state == DET44_SESSION_TCP_LAST_ACK) + snat_det_ses_close (mp0, ses0); sum0 = tcp0->checksum; sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32, @@ -671,16 +812,16 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b0->flags & VLIB_BUFFER_IS_TRACED))) { - nat_det_out2in_trace_t *t = + det44_out2in_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); t->sw_if_index = sw_if_index0; t->next_index = next0; t->session_index = ~0; if (ses0) - t->session_index = ses0 - dm0->sessions; + t->session_index = ses0 - mp0->sessions; } - pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP; + pkts_processed += next0 != DET44_OUT2IN_NEXT_DROP; /* verify speculative enqueue, maybe switch current next frame */ vlib_validate_buffer_enqueue_x1 (vm, node, next_index, @@ -691,27 +832,27 @@ VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm, vlib_put_next_frame (vm, node, next_index, n_left_to_next); } - vlib_node_increment_counter (vm, sm->det_out2in_node_index, - NAT_DET_OUT2IN_ERROR_OUT2IN_PACKETS, + vlib_node_increment_counter (vm, dm->out2in_node_index, + DET44_OUT2IN_ERROR_OUT2IN_PACKETS, pkts_processed); return frame->n_vectors; } /* *INDENT-OFF* */ -VLIB_REGISTER_NODE (snat_det_out2in_node) = { - .name = "nat44-det-out2in", +VLIB_REGISTER_NODE (det44_out2in_node) = { + .name = "det44-out2in", .vector_size = sizeof (u32), - .format_trace = format_nat_det_out2in_trace, + .format_trace = format_det44_out2in_trace, .type = VLIB_NODE_TYPE_INTERNAL, - .n_errors = ARRAY_LEN(nat_det_out2in_error_strings), - .error_strings = nat_det_out2in_error_strings, - .runtime_data_bytes = sizeof (snat_runtime_t), - .n_next_nodes = NAT_DET_OUT2IN_N_NEXT, + .n_errors = ARRAY_LEN(det44_out2in_error_strings), + .error_strings = det44_out2in_error_strings, + .runtime_data_bytes = sizeof (det44_runtime_t), + .n_next_nodes = DET44_OUT2IN_N_NEXT, /* edit / add dispositions here */ .next_nodes = { - [NAT_DET_OUT2IN_NEXT_DROP] = "error-drop", - [NAT_DET_OUT2IN_NEXT_LOOKUP] = "ip4-lookup", - [NAT_DET_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error", + [DET44_OUT2IN_NEXT_DROP] = "error-drop", + [DET44_OUT2IN_NEXT_LOOKUP] = "ip4-lookup", + [DET44_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error", }, }; /* *INDENT-ON* */ diff --git a/src/plugins/nat/dslite/dslite.api b/src/plugins/nat/dslite/dslite.api index b5f8c5ba833..29c21002ace 100644 --- a/src/plugins/nat/dslite/dslite.api +++ b/src/plugins/nat/dslite/dslite.api @@ -18,7 +18,7 @@ import "vnet/ip/ip_types.api"; import "vnet/interface_types.api"; /** - * @file nat.api + * @file dslite.api * @brief VPP control-plane API messages. * * This file defines VPP control-plane API messages which are generally diff --git a/src/plugins/nat/dslite/dslite.c b/src/plugins/nat/dslite/dslite.c index ebf8afac9f3..4ca24a4bfff 100644 --- a/src/plugins/nat/dslite/dslite.c +++ b/src/plugins/nat/dslite/dslite.c @@ -267,9 +267,13 @@ format_dslite_ce_trace (u8 * s, va_list * args) VLIB_INIT_FUNCTION (dslite_init); +/* *INDENT-OFF* */ VLIB_PLUGIN_REGISTER () = { -.version = VPP_BUILD_VER,.description = "Dual-Stack Lite",}; + .version = VPP_BUILD_VER, + .description = "Dual-Stack Lite", +}; +/* *INDENT-ON* */ /* * fd.io coding-style-patch-verification: ON diff --git a/src/plugins/nat/in2out.c b/src/plugins/nat/in2out.c index fe81b022899..39957259c69 100644 --- a/src/plugins/nat/in2out.c +++ b/src/plugins/nat/in2out.c @@ -789,8 +789,7 @@ icmp_in2out (snat_main_t * sm, if (vnet_buffer (b0)->sw_if_index[VLIB_TX] == ~0) { - if (sm->deterministic || - 0 != snat_icmp_hairpinning (sm, b0, ip0, icmp0, + if (0 != snat_icmp_hairpinning (sm, b0, ip0, icmp0, sm->endpoint_dependent)) vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index; } diff --git a/src/plugins/nat/nat.api b/src/plugins/nat/nat.api index cd50c19963c..7e6f35968c5 100644 --- a/src/plugins/nat/nat.api +++ b/src/plugins/nat/nat.api @@ -989,174 +989,6 @@ define nat44_forwarding_is_enabled_reply { bool enabled; }; - -/* - * Deterministic NAT (CGN) APIs - */ - -/** \brief Add/delete NAT deterministic mapping - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param is_add - true if add, false if delete - @param in_addr - inside IPv4 address - @param in_plen - inside IPv4 address prefix length - @param out_addr - outside IPv4 address - @param out_plen - outside IPv4 address prefix length -*/ -autoreply define nat_det_add_del_map { - u32 client_index; - u32 context; - bool is_add; - vl_api_ip4_address_t in_addr; - u8 in_plen; - vl_api_ip4_address_t out_addr; - u8 out_plen; -}; - -/** \brief Get outside address and port range from inside address - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param in_addr - inside IP address -*/ -define nat_det_forward { - u32 client_index; - u32 context; - vl_api_ip4_address_t in_addr; -}; - -/** \brief Get outside address and port range from inside address - @param context - sender context, to match reply w/ request - @param retval - return code - @param out_port_lo - outside port range start - @param out_port_hi - outside port range end - @param out_addr - outside IPv4 address -*/ -define nat_det_forward_reply { - u32 context; - i32 retval; - u16 out_port_lo; - u16 out_port_hi; - vl_api_ip4_address_t out_addr; -}; - -/** \brief Get inside address from outside address and port - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param out_port - outside port - @param out_addr - outside IPv4 address -*/ -define nat_det_reverse { - u32 client_index; - u32 context; - u16 out_port; - vl_api_ip4_address_t out_addr; -}; - -/** \brief Get inside address from outside address and port reply - @param context - sender context, to match reply w/ request - @param retval - return code - @param in_addr - inside IP address -*/ -define nat_det_reverse_reply { - u32 context; - i32 retval; - vl_api_ip4_address_t in_addr; -}; - -/** \brief Dump NAT deterministic mappings - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request -*/ -define nat_det_map_dump { - u32 client_index; - u32 context; -}; - -/** \brief NAT users response - @param context - sender context, to match reply w/ request - @param in_addr - inside IPv4 address - @param in_plen - inside IPv4 address prefix length - @param out_addr - outside IPv4 address - @param out_plen - outside IPv4 address prefix length - @param sharing_ratio - outside to inside address sharing ratio - @param ports_per_host - number of ports available to a host - @param ses_num - number of sessions belonging to this mapping -*/ -define nat_det_map_details { - u32 context; - vl_api_ip4_address_t in_addr; - u8 in_plen; - vl_api_ip4_address_t out_addr; - u8 out_plen; - u32 sharing_ratio; - u16 ports_per_host; - u32 ses_num; -}; - -/** \brief Close deterministic NAT session by outside address and port - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param out_addr - outside IPv4 address - @param out_port - outside port - @param ext_addr - external host IPv4 address - @param ext_port - external host port -*/ -autoreply define nat_det_close_session_out { - u32 client_index; - u32 context; - vl_api_ip4_address_t out_addr; - u16 out_port; - vl_api_ip4_address_t ext_addr; - u16 ext_port; -}; - -/** \brief Close deterministic NAT session by inside address and port - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param in_addr - inside IP address - @param in_port - inside port - @param ext_addr - external host IP address - @param ext_port - external host port -*/ -autoreply define nat_det_close_session_in { - u32 client_index; - u32 context; - vl_api_ip4_address_t in_addr; - u16 in_port; - vl_api_ip4_address_t ext_addr; - u16 ext_port; -}; - -/** \brief Dump determinstic NAT sessions - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param user_addr - address of an inside user whose sessions to dump -*/ -define nat_det_session_dump { - u32 client_index; - u32 context; - vl_api_ip4_address_t user_addr; -}; - -/** \brief Deterministic NAT sessions reply - @param context - sender context, to match reply w/ request - @param in_port - inside port - @param ext_addr - external host IPv4 address - @param ext_port - external host port - @param out_port - outside NAT port - @param state - session state - @param expire - session expiration timestamp -*/ -define nat_det_session_details { - u32 context; - u16 in_port; - vl_api_ip4_address_t ext_addr; - u16 ext_port; - u16 out_port; - u8 state; - u32 expire; -}; - /* * NAT64 APIs */ diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c index a0c1de25b6e..ea1add6abd0 100644 --- a/src/plugins/nat/nat.c +++ b/src/plugins/nat/nat.c @@ -22,7 +22,6 @@ #include <nat/nat.h> #include <nat/nat_dpo.h> #include <nat/nat_ipfix_logging.h> -#include <nat/nat_det.h> #include <nat/nat64.h> #include <nat/nat_inlines.h> #include <nat/nat44/inlines.h> @@ -84,22 +83,6 @@ VNET_FEATURE_INIT (ip4_nat_classify, static) = { .node_name = "nat44-classify", .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature"), }; -VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = { - .arc_name = "ip4-unicast", - .node_name = "nat44-det-in2out", - .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature"), -}; -VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = { - .arc_name = "ip4-unicast", - .node_name = "nat44-det-out2in", - .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature", - "ip4-dhcp-client-detect"), -}; -VNET_FEATURE_INIT (ip4_nat_det_classify, static) = { - .arc_name = "ip4-unicast", - .node_name = "nat44-det-classify", - .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature"), -}; VNET_FEATURE_INIT (ip4_nat44_ed_in2out, static) = { .arc_name = "ip4-unicast", .node_name = "nat44-ed-in2out", @@ -1839,7 +1822,6 @@ snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del) const char *feature_name, *del_feature_name; snat_address_t *ap; snat_static_mapping_t *m; - snat_det_map_t *dm; nat_outside_fib_t *outside_fib; u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index); @@ -1859,12 +1841,10 @@ snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del) feature_name = is_inside ? "nat44-in2out-fast" : "nat44-out2in-fast"; else { - if (sm->num_workers > 1 && !sm->deterministic) + if (sm->num_workers > 1) feature_name = is_inside ? "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff"; - else if (sm->deterministic) - feature_name = is_inside ? "nat44-det-in2out" : "nat44-det-out2in"; else if (sm->endpoint_dependent) { feature_name = is_inside ? "nat-pre-in2out" : "nat-pre-out2in"; @@ -1873,11 +1853,11 @@ snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del) feature_name = is_inside ? "nat44-in2out" : "nat44-out2in"; } - if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1) + if (sm->fq_in2out_index == ~0 && sm->num_workers > 1) sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, NAT_FQ_NELTS); - if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1) + if (sm->fq_out2in_index == ~0 && sm->num_workers > 1) sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, NAT_FQ_NELTS); @@ -1922,18 +1902,12 @@ feature_set: else i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE; - if (sm->num_workers > 1 && !sm->deterministic) + if (sm->num_workers > 1) { del_feature_name = "nat44-handoff-classify"; feature_name = !is_inside ? "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff"; } - else if (sm->deterministic) - { - del_feature_name = "nat44-det-classify"; - feature_name = !is_inside ? "nat44-det-in2out" : - "nat44-det-out2in"; - } else if (sm->endpoint_dependent) { del_feature_name = "nat44-ed-classify"; @@ -1959,7 +1933,7 @@ feature_set: vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning", sw_if_index, 1, 0, 0); - else if (!sm->deterministic) + else vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning", sw_if_index, 1, 0, 0); @@ -1979,7 +1953,7 @@ feature_set: vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning", sw_if_index, 0, 0, 0); - else if (!sm->deterministic) + else vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning", sw_if_index, 0, 0, 0); @@ -1992,18 +1966,12 @@ feature_set: (nat_interface_is_outside(i) && !is_inside)) return 0; - if (sm->num_workers > 1 && !sm->deterministic) + if (sm->num_workers > 1) { del_feature_name = !is_inside ? "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff"; feature_name = "nat44-handoff-classify"; } - else if (sm->deterministic) - { - del_feature_name = !is_inside ? "nat44-det-in2out" : - "nat44-det-out2in"; - feature_name = "nat44-det-classify"; - } else if (sm->endpoint_dependent) { del_feature_name = !is_inside ? "nat-pre-in2out" : @@ -2029,7 +1997,7 @@ feature_set: if (sm->endpoint_dependent) vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning", sw_if_index, 0, 0, 0); - else if (!sm->deterministic) + else vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning", sw_if_index, 0, 0, 0); } @@ -2061,7 +2029,7 @@ feature_set: if (sm->endpoint_dependent) vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning", sw_if_index, 1, 0, 0); - else if (!sm->deterministic) + else vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning", sw_if_index, 1, 0, 0); } @@ -2088,11 +2056,6 @@ fib: snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del); })); - - pool_foreach (dm, sm->det_maps, - ({ - snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del); - })); /* *INDENT-ON* */ return 0; @@ -2111,8 +2074,7 @@ snat_interface_add_del_output_feature (u32 sw_if_index, sw_if_index); - if (sm->deterministic || - (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))) + if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)) return VNET_API_ERROR_UNSUPPORTED; /* *INDENT-OFF* */ @@ -2551,11 +2513,6 @@ snat_init (vlib_main_t * vm) node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-out2in-slowpath"); sm->ed_out2in_slowpath_node_index = node->index; - node = vlib_get_node_by_name (vm, (u8 *) "nat44-det-in2out"); - sm->det_in2out_node_index = node->index; - node = vlib_get_node_by_name (vm, (u8 *) "nat44-det-out2in"); - sm->det_out2in_node_index = node->index; - node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpinning"); sm->hairpinning_node_index = node->index; node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpin-dst"); @@ -4006,7 +3963,6 @@ snat_config (vlib_main_t * vm, unformat_input_t * input) u32 tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT; u32 tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT; - sm->deterministic = 0; sm->out2in_dpo = 0; sm->endpoint_dependent = 0; @@ -4047,8 +4003,6 @@ snat_config (vlib_main_t * vm, unformat_input_t * input) if (unformat (input, "connection tracking")) static_mapping_connection_tracking = 1; } - else if (unformat (input, "deterministic")) - sm->deterministic = 1; else if (unformat (input, "nat64 bib hash buckets %d", &nat64_bib_buckets)) ; @@ -4070,15 +4024,11 @@ snat_config (vlib_main_t * vm, unformat_input_t * input) format_unformat_error, input); } - if (sm->deterministic && sm->endpoint_dependent) - return clib_error_return (0, - "deterministic and endpoint-dependent modes are mutually exclusive"); - - if (static_mapping_only && (sm->deterministic || sm->endpoint_dependent)) + if (static_mapping_only && (sm->endpoint_dependent)) return clib_error_return (0, "static mapping only mode available only for simple nat"); - if (sm->out2in_dpo && (sm->deterministic || sm->endpoint_dependent)) + if (sm->out2in_dpo && (sm->endpoint_dependent)) return clib_error_return (0, "out2in dpo mode available only for simple nat"); if (sm->endpoint_dependent && max_users_per_thread > 0) @@ -4148,79 +4098,67 @@ snat_config (vlib_main_t * vm, unformat_input_t * input) nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets, nat64_st_memory_size); - if (sm->deterministic) + if (sm->endpoint_dependent) { - sm->in2out_node_index = snat_det_in2out_node.index; - sm->in2out_output_node_index = ~0; - sm->out2in_node_index = snat_det_out2in_node.index; - sm->icmp_match_in2out_cb = icmp_match_in2out_det; - sm->icmp_match_out2in_cb = icmp_match_out2in_det; + sm->worker_in2out_cb = nat44_ed_get_worker_in2out_cb; + sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb; + + sm->in2out_node_index = nat44_ed_in2out_node.index; + sm->in2out_output_node_index = nat44_ed_in2out_output_node.index; + sm->out2in_node_index = nat44_ed_out2in_node.index; + + sm->icmp_match_in2out_cb = icmp_match_in2out_ed; + sm->icmp_match_out2in_cb = icmp_match_out2in_ed; + nat_affinity_init (vm); + nat_ha_init (vm, nat_ha_sadd_ed_cb, nat_ha_sdel_ed_cb, + nat_ha_sref_ed_cb); + clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed", + clib_max (1, sm->num_workers) * + sm->translation_buckets, + clib_max (1, sm->num_workers) * + sm->translation_memory_size); + clib_bihash_set_kvp_format_fn_16_8 (&sm->out2in_ed, + format_ed_session_kvp); } else { - if (sm->endpoint_dependent) - { - sm->worker_in2out_cb = nat44_ed_get_worker_in2out_cb; - sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb; - - sm->in2out_node_index = nat44_ed_in2out_node.index; - sm->in2out_output_node_index = nat44_ed_in2out_output_node.index; - sm->out2in_node_index = nat44_ed_out2in_node.index; - - sm->icmp_match_in2out_cb = icmp_match_in2out_ed; - sm->icmp_match_out2in_cb = icmp_match_out2in_ed; - nat_affinity_init (vm); - nat_ha_init (vm, nat_ha_sadd_ed_cb, nat_ha_sdel_ed_cb, - nat_ha_sref_ed_cb); - clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed", - clib_max (1, sm->num_workers) * - sm->translation_buckets, - clib_max (1, sm->num_workers) * - sm->translation_memory_size); - clib_bihash_set_kvp_format_fn_16_8 (&sm->out2in_ed, - format_ed_session_kvp); - } - else - { - sm->worker_in2out_cb = snat_get_worker_in2out_cb; - sm->worker_out2in_cb = snat_get_worker_out2in_cb; + sm->worker_in2out_cb = snat_get_worker_in2out_cb; + sm->worker_out2in_cb = snat_get_worker_out2in_cb; - sm->in2out_node_index = snat_in2out_node.index; - sm->in2out_output_node_index = snat_in2out_output_node.index; - sm->out2in_node_index = snat_out2in_node.index; + sm->in2out_node_index = snat_in2out_node.index; + sm->in2out_output_node_index = snat_in2out_output_node.index; + sm->out2in_node_index = snat_out2in_node.index; - sm->icmp_match_in2out_cb = icmp_match_in2out_slow; - sm->icmp_match_out2in_cb = icmp_match_out2in_slow; - nat_ha_init (vm, nat_ha_sadd_cb, nat_ha_sdel_cb, nat_ha_sref_cb); - } - if (!static_mapping_only || - (static_mapping_only && static_mapping_connection_tracking)) - { + sm->icmp_match_in2out_cb = icmp_match_in2out_slow; + sm->icmp_match_out2in_cb = icmp_match_out2in_slow; + nat_ha_init (vm, nat_ha_sadd_cb, nat_ha_sdel_cb, nat_ha_sref_cb); + } + if (!static_mapping_only || + (static_mapping_only && static_mapping_connection_tracking)) + { /* *INDENT-OFF* */ vec_foreach (tsm, sm->per_thread_data) { nat44_db_init (tsm); } /* *INDENT-ON* */ - } - else - { - sm->icmp_match_in2out_cb = icmp_match_in2out_fast; - sm->icmp_match_out2in_cb = icmp_match_out2in_fast; - } - clib_bihash_init_8_8 (&sm->static_mapping_by_local, - "static_mapping_by_local", static_mapping_buckets, - static_mapping_memory_size); - clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local, - format_static_mapping_kvp); - - clib_bihash_init_8_8 (&sm->static_mapping_by_external, - "static_mapping_by_external", - static_mapping_buckets, - static_mapping_memory_size); - clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external, - format_static_mapping_kvp); } + else + { + sm->icmp_match_in2out_cb = icmp_match_in2out_fast; + sm->icmp_match_out2in_cb = icmp_match_out2in_fast; + } + clib_bihash_init_8_8 (&sm->static_mapping_by_local, + "static_mapping_by_local", static_mapping_buckets, + static_mapping_memory_size); + clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local, + format_static_mapping_kvp); + + clib_bihash_init_8_8 (&sm->static_mapping_by_external, + "static_mapping_by_external", + static_mapping_buckets, static_mapping_memory_size); + clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external, + format_static_mapping_kvp); return 0; } diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h index 324dc2608c0..ddcf4c970b0 100644 --- a/src/plugins/nat/nat.h +++ b/src/plugins/nat/nat.h @@ -68,21 +68,6 @@ typedef struct u32 arc_next_index; } nat_pre_trace_t; -/* deterministic session outside key */ -typedef struct -{ - union - { - struct - { - ip4_address_t ext_host_addr; - u16 ext_host_port; - u16 out_port; - }; - u64 as_u64; - }; -} snat_det_out_key_t; - /* user (internal host) key */ typedef struct { @@ -308,36 +293,6 @@ typedef struct typedef struct { - /* Inside network port */ - u16 in_port; - /* Outside network address and port */ - snat_det_out_key_t out; - /* Session state */ - u8 state; - /* Expire timeout */ - u32 expire; -} snat_det_session_t; - -typedef struct -{ - /* inside IP address range */ - ip4_address_t in_addr; - u8 in_plen; - /* outside IP address range */ - ip4_address_t out_addr; - u8 out_plen; - /* inside IP addresses / outside IP addresses */ - u32 sharing_ratio; - /* number of ports available to internal host */ - u16 ports_per_host; - /* session counter */ - u32 ses_num; - /* vector of sessions */ - snat_det_session_t *sessions; -} snat_det_map_t; - -typedef struct -{ /* backend IP address */ ip4_address_t addr; /* backend port number */ @@ -590,8 +545,6 @@ typedef struct snat_main_s u32 out2in_fast_node_index; u32 ed_out2in_node_index; u32 ed_out2in_slowpath_node_index; - u32 det_in2out_node_index; - u32 det_out2in_node_index; u32 hairpinning_node_index; u32 hairpin_dst_node_index; @@ -600,17 +553,12 @@ typedef struct snat_main_s u32 ed_hairpin_dst_node_index; u32 ed_hairpin_src_node_index; - - /* Deterministic NAT mappings */ - snat_det_map_t *det_maps; - /* If forwarding is enabled */ u8 forwarding_enabled; /* Config parameters */ u8 static_mapping_only; u8 static_mapping_connection_tracking; - u8 deterministic; u8 out2in_dpo; u8 endpoint_dependent; @@ -736,8 +684,6 @@ extern vlib_node_registration_t snat_out2in_node; extern vlib_node_registration_t snat_in2out_worker_handoff_node; extern vlib_node_registration_t snat_in2out_output_worker_handoff_node; extern vlib_node_registration_t snat_out2in_worker_handoff_node; -extern vlib_node_registration_t snat_det_in2out_node; -extern vlib_node_registration_t snat_det_out2in_node; extern vlib_node_registration_t nat44_ed_in2out_node; extern vlib_node_registration_t nat44_ed_in2out_output_node; extern vlib_node_registration_t nat44_ed_out2in_node; @@ -750,7 +696,6 @@ format_function_t format_snat_user; format_function_t format_snat_static_mapping; format_function_t format_snat_static_map_to_resolve; format_function_t format_snat_session; -format_function_t format_det_map_ses; format_function_t format_snat_key; format_function_t format_static_mapping_key; format_function_t format_nat_protocol; @@ -1068,20 +1013,6 @@ u32 icmp_match_out2in_slow (snat_main_t * sm, vlib_node_runtime_t * node, nat_protocol_t * proto, void *d, void *e, u8 * dont_translate); -/* ICMP deterministic NAT session match functions */ -u32 icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node, - u32 thread_index, vlib_buffer_t * b0, - ip4_header_t * ip0, ip4_address_t * addr, - u16 * port, u32 * fib_index, - nat_protocol_t * proto, void *d, void *e, - u8 * dont_translate); -u32 icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node, - u32 thread_index, vlib_buffer_t * b0, - ip4_header_t * ip0, ip4_address_t * addr, - u16 * port, u32 * fib_index, - nat_protocol_t * proto, void *d, void *e, - u8 * dont_translate); - /* ICMP endpoint-dependent session match functions */ u32 icmp_match_out2in_ed (snat_main_t * sm, vlib_node_runtime_t * node, u32 thread_index, vlib_buffer_t * b0, diff --git a/src/plugins/nat/nat44/inlines.h b/src/plugins/nat/nat44/inlines.h index 8bfc74012e8..459badac8e1 100644 --- a/src/plugins/nat/nat44/inlines.h +++ b/src/plugins/nat/nat44/inlines.h @@ -100,7 +100,7 @@ nat44_user_del (ip4_address_t * addr, u32 fib_index) snat_user_key_t user_key; clib_bihash_kv_8_8_t kv, value; - if (sm->deterministic || sm->endpoint_dependent) + if (sm->endpoint_dependent) return rv; user_key.addr.as_u32 = addr->as_u32; diff --git a/src/plugins/nat/nat44_classify.c b/src/plugins/nat/nat44_classify.c index a239c67c553..6cdb57721aa 100644 --- a/src/plugins/nat/nat44_classify.c +++ b/src/plugins/nat/nat44_classify.c @@ -458,28 +458,6 @@ VLIB_REGISTER_NODE (nat44_ed_classify_node) = { }; /* *INDENT-ON* */ -VLIB_NODE_FN (nat44_det_classify_node) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) -{ - return nat44_classify_node_fn_inline (vm, node, frame); -} - -/* *INDENT-OFF* */ -VLIB_REGISTER_NODE (nat44_det_classify_node) = { - .name = "nat44-det-classify", - .vector_size = sizeof (u32), - .format_trace = format_nat44_classify_trace, - .type = VLIB_NODE_TYPE_INTERNAL, - .n_next_nodes = NAT44_CLASSIFY_N_NEXT, - .next_nodes = { - [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out", - [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in", - [NAT44_CLASSIFY_NEXT_DROP] = "error-drop", - }, -}; -/* *INDENT-ON* */ - VLIB_NODE_FN (nat44_handoff_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) diff --git a/src/plugins/nat/nat44_cli.c b/src/plugins/nat/nat44_cli.c index 7d74f36c754..64529af1d4b 100644 --- a/src/plugins/nat/nat44_cli.c +++ b/src/plugins/nat/nat44_cli.c @@ -19,7 +19,6 @@ #include <nat/nat.h> #include <nat/nat_ipfix_logging.h> -#include <nat/nat_det.h> #include <nat/nat64.h> #include <nat/nat_inlines.h> #include <nat/nat44/inlines.h> @@ -27,31 +26,20 @@ #include <vnet/fib/fib_table.h> #include <nat/nat_ha.h> - -#define UNSUPPORTED_IN_DET_OR_ED_MODE_STR \ - "This command is unsupported in deterministic or endpoint dependent mode" -#define UNSUPPORTED_IN_DET_OR_NON_ED_MODE_STR \ - "This command is unsupported in deterministic or non endpoint dependent mode" -#define UNSUPPORTED_IN_DET_MODE_STR \ - "This command is unsupported in deterministic mode" +#define UNSUPPORTED_IN_ED_MODE_STR \ + "This command is unsupported in endpoint dependent mode" #define SUPPORTED_ONLY_IN_ED_MODE_STR \ "This command is supported only in endpoint dependent mode" -#define SUPPORTED_ONLY_IN_DET_MODE_STR \ - "This command is supported only in deterministic mode" static clib_error_t * set_workers_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - snat_main_t *sm = &snat_main; uword *bitmap = 0; int rv = 0; clib_error_t *error = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -104,9 +92,6 @@ nat_show_workers_commnad_fn (vlib_main_t * vm, unformat_input_t * input, snat_main_t *sm = &snat_main; u32 *worker; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - if (sm->num_workers > 1) { vlib_cli_output (vm, "%d workers", vec_len (sm->workers)); @@ -272,13 +257,9 @@ nat44_set_alloc_addr_and_port_alg_command_fn (vlib_main_t * vm, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - snat_main_t *sm = &snat_main; clib_error_t *error = 0; u32 psid, psid_offset, psid_length, port_start, port_end; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -328,9 +309,6 @@ nat44_show_alloc_addr_and_port_alg_command_fn (vlib_main_t * vm, { snat_main_t *sm = &snat_main; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - vlib_cli_output (vm, "NAT address and port: %U", format_nat_addr_and_port_alloc_alg, sm->addr_and_port_alloc_alg); @@ -550,9 +528,6 @@ add_address_command_fn (vlib_main_t * vm, clib_error_t *error = 0; u8 twice_nat = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -651,8 +626,8 @@ nat44_show_summary_command_fn (vlib_main_t * vm, unformat_input_t * input, snat_main_t *sm = &snat_main; snat_session_t *s; - if (sm->deterministic || !sm->endpoint_dependent) - return clib_error_return (0, UNSUPPORTED_IN_DET_OR_NON_ED_MODE_STR); + if (!sm->endpoint_dependent) + return clib_error_return (0, SUPPORTED_ONLY_IN_ED_MODE_STR); vlib_cli_output (vm, "max translations per thread: %u", sm->max_translations_per_thread); @@ -813,9 +788,6 @@ nat44_show_addresses_command_fn (vlib_main_t * vm, unformat_input_t * input, snat_main_t *sm = &snat_main; snat_address_t *ap; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - vlib_cli_output (vm, "NAT44 pool addresses:"); /* *INDENT-OFF* */ vec_foreach (ap, sm->addresses) @@ -998,7 +970,6 @@ add_static_mapping_command_fn (vlib_main_t * vm, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - snat_main_t *sm = &snat_main; clib_error_t *error = 0; ip4_address_t l_addr, e_addr; u32 l_port = 0, e_port = 0, vrf_id = ~0; @@ -1012,9 +983,6 @@ add_static_mapping_command_fn (vlib_main_t * vm, twice_nat_type_t twice_nat = TWICE_NAT_DISABLED; u8 out2in_only = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -1126,7 +1094,6 @@ add_identity_mapping_command_fn (vlib_main_t * vm, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - snat_main_t *sm = &snat_main; clib_error_t *error = 0; ip4_address_t addr; u32 port = 0, vrf_id = ~0; @@ -1137,9 +1104,6 @@ add_identity_mapping_command_fn (vlib_main_t * vm, int rv; nat_protocol_t proto; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - addr.as_u32 = 0; /* Get a line of input. */ @@ -1206,7 +1170,6 @@ add_lb_static_mapping_command_fn (vlib_main_t * vm, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - snat_main_t *sm = &snat_main; clib_error_t *error = 0; ip4_address_t l_addr, e_addr; u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0, affinity = 0; @@ -1218,9 +1181,6 @@ add_lb_static_mapping_command_fn (vlib_main_t * vm, twice_nat_type_t twice_nat = TWICE_NAT_DISABLED; u8 out2in_only = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -1321,7 +1281,6 @@ add_lb_backend_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - snat_main_t *sm = &snat_main; clib_error_t *error = 0; ip4_address_t l_addr, e_addr; u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0; @@ -1330,9 +1289,6 @@ add_lb_backend_command_fn (vlib_main_t * vm, nat_protocol_t proto; u8 proto_set = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -1417,9 +1373,6 @@ nat44_show_static_mappings_command_fn (vlib_main_t * vm, snat_static_mapping_t *m; snat_static_map_resolve_t *rp; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - vlib_cli_output (vm, "NAT44 static mappings:"); /* *INDENT-OFF* */ pool_foreach (m, sm->static_mappings, @@ -1446,9 +1399,6 @@ snat_add_interface_address_command_fn (vlib_main_t * vm, clib_error_t *error = 0; u8 twice_nat = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -1498,9 +1448,6 @@ nat44_show_interface_address_command_fn (vlib_main_t * vm, vnet_main_t *vnm = vnet_get_main (); u32 *sw_if_index; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* *INDENT-OFF* */ vlib_cli_output (vm, "NAT44 pool address interfaces:"); vec_foreach (sw_if_index, sm->auto_add_sw_if_indices) @@ -1532,9 +1479,6 @@ nat44_show_sessions_command_fn (vlib_main_t * vm, unformat_input_t * input, int detail = 0; int i = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - if (!unformat_user (input, unformat_line_input, line_input)) goto print; @@ -1592,15 +1536,11 @@ nat44_set_session_limit_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { - snat_main_t *sm = &snat_main; unformat_input_t _line_input, *line_input = &_line_input; clib_error_t *error = 0; u32 session_limit = 0, vrf_id = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -1641,8 +1581,8 @@ nat44_del_user_command_fn (vlib_main_t * vm, u32 fib_index = 0; int rv; - if (sm->deterministic || sm->endpoint_dependent) - return clib_error_return (0, UNSUPPORTED_IN_DET_OR_ED_MODE_STR); + if (sm->endpoint_dependent) + return clib_error_return (0, UNSUPPORTED_IN_ED_MODE_STR); /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) @@ -1680,12 +1620,7 @@ nat44_clear_sessions_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { - snat_main_t *sm = &snat_main; clib_error_t *error = 0; - - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - nat44_sessions_clear (); return error; } @@ -1704,9 +1639,6 @@ nat44_del_session_command_fn (vlib_main_t * vm, nat_protocol_t proto; int rv; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -1779,9 +1711,6 @@ snat_forwarding_set_command_fn (vlib_main_t * vm, u8 forwarding_enable_set = 0; clib_error_t *error = 0; - if (sm->deterministic) - return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR); - /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return clib_error_return (0, "'enable' or 'disable' expected"); @@ -1821,193 +1750,6 @@ done: } static clib_error_t * -snat_det_map_command_fn (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - unformat_input_t _line_input, *line_input = &_line_input; - ip4_address_t in_addr, out_addr; - u32 in_plen, out_plen; - int is_add = 1, rv; - clib_error_t *error = 0; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat - (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen)) - ; - else - if (unformat - (line_input, "out %U/%u", unformat_ip4_address, &out_addr, - &out_plen)) - ; - else if (unformat (line_input, "del")) - is_add = 0; - else - { - error = clib_error_return (0, "unknown input '%U'", - format_unformat_error, line_input); - goto done; - } - } - - if (in_plen > 32 || out_plen > 32) - { - error = clib_error_return (0, "network prefix length must be <= 32"); - goto done; - } - - rv = snat_det_add_map (sm, &in_addr, in_plen, &out_addr, out_plen, is_add); - - if (rv) - { - error = clib_error_return (0, "snat_det_add_map return %d", rv); - goto done; - } - -done: - unformat_free (line_input); - - return error; -} - -static clib_error_t * -nat44_det_show_mappings_command_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - snat_det_map_t *dm; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - vlib_cli_output (vm, "NAT44 deterministic mappings:"); - /* *INDENT-OFF* */ - pool_foreach (dm, sm->det_maps, - ({ - vlib_cli_output (vm, " in %U/%d out %U/%d\n", - format_ip4_address, &dm->in_addr, dm->in_plen, - format_ip4_address, &dm->out_addr, dm->out_plen); - vlib_cli_output (vm, " outside address sharing ratio: %d\n", - dm->sharing_ratio); - vlib_cli_output (vm, " number of ports per inside host: %d\n", - dm->ports_per_host); - vlib_cli_output (vm, " sessions number: %d\n", dm->ses_num); - })); - /* *INDENT-ON* */ - - return 0; -} - -static clib_error_t * -snat_det_forward_command_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - unformat_input_t _line_input, *line_input = &_line_input; - ip4_address_t in_addr, out_addr; - u16 lo_port; - snat_det_map_t *dm; - clib_error_t *error = 0; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "%U", unformat_ip4_address, &in_addr)) - ; - else - { - error = clib_error_return (0, "unknown input '%U'", - format_unformat_error, line_input); - goto done; - } - } - - dm = snat_det_map_by_user (sm, &in_addr); - if (!dm) - vlib_cli_output (vm, "no match"); - else - { - snat_det_forward (dm, &in_addr, &out_addr, &lo_port); - vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr, - lo_port, lo_port + dm->ports_per_host - 1); - } - -done: - unformat_free (line_input); - - return error; -} - -static clib_error_t * -snat_det_reverse_command_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - unformat_input_t _line_input, *line_input = &_line_input; - ip4_address_t in_addr, out_addr; - u32 out_port; - snat_det_map_t *dm; - clib_error_t *error = 0; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat - (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port)) - ; - else - { - error = clib_error_return (0, "unknown input '%U'", - format_unformat_error, line_input); - goto done; - } - } - - if (out_port < 1024 || out_port > 65535) - { - error = clib_error_return (0, "wrong port, must be <1024-65535>"); - goto done; - } - - dm = snat_det_map_by_out (sm, &out_addr); - if (!dm) - vlib_cli_output (vm, "no match"); - else - { - snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr); - vlib_cli_output (vm, "%U", format_ip4_address, &in_addr); - } - -done: - unformat_free (line_input); - - return error; -} - -static clib_error_t * set_timeout_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { @@ -2100,150 +1842,6 @@ nat_show_timeouts_command_fn (vlib_main_t * vm, return 0; } -static clib_error_t * -nat44_det_show_sessions_command_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - snat_det_map_t *dm; - snat_det_session_t *ses; - int i; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - vlib_cli_output (vm, "NAT44 deterministic sessions:"); - /* *INDENT-OFF* */ - pool_foreach (dm, sm->det_maps, - ({ - vec_foreach_index (i, dm->sessions) - { - ses = vec_elt_at_index (dm->sessions, i); - if (ses->in_port) - vlib_cli_output (vm, " %U", format_det_map_ses, dm, ses, &i); - } - })); - /* *INDENT-ON* */ - return 0; -} - -static clib_error_t * -snat_det_close_session_out_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - unformat_input_t _line_input, *line_input = &_line_input; - ip4_address_t out_addr, ext_addr, in_addr; - u32 out_port, ext_port; - snat_det_map_t *dm; - snat_det_session_t *ses; - snat_det_out_key_t key; - clib_error_t *error = 0; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "%U:%d %U:%d", - unformat_ip4_address, &out_addr, &out_port, - unformat_ip4_address, &ext_addr, &ext_port)) - ; - else - { - error = clib_error_return (0, "unknown input '%U'", - format_unformat_error, line_input); - goto done; - } - } - - unformat_free (line_input); - - dm = snat_det_map_by_out (sm, &out_addr); - if (!dm) - vlib_cli_output (vm, "no match"); - else - { - snat_det_reverse (dm, &ext_addr, (u16) out_port, &in_addr); - key.ext_host_addr = out_addr; - key.ext_host_port = ntohs ((u16) ext_port); - key.out_port = ntohs ((u16) out_port); - ses = snat_det_get_ses_by_out (dm, &out_addr, key.as_u64); - if (!ses) - vlib_cli_output (vm, "no match"); - else - snat_det_ses_close (dm, ses); - } - -done: - unformat_free (line_input); - - return error; -} - -static clib_error_t * -snat_det_close_session_in_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - snat_main_t *sm = &snat_main; - unformat_input_t _line_input, *line_input = &_line_input; - ip4_address_t in_addr, ext_addr; - u32 in_port, ext_port; - snat_det_map_t *dm; - snat_det_session_t *ses; - snat_det_out_key_t key; - clib_error_t *error = 0; - - if (!sm->deterministic) - return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR); - - /* Get a line of input. */ - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "%U:%d %U:%d", - unformat_ip4_address, &in_addr, &in_port, - unformat_ip4_address, &ext_addr, &ext_port)) - ; - else - { - error = clib_error_return (0, "unknown input '%U'", - format_unformat_error, line_input); - goto done; - } - } - - unformat_free (line_input); - - dm = snat_det_map_by_user (sm, &in_addr); - if (!dm) - vlib_cli_output (vm, "no match"); - else - { - key.ext_host_addr = ext_addr; - key.ext_host_port = ntohs ((u16) ext_port); - ses = - snat_det_find_ses_by_in (dm, &in_addr, ntohs ((u16) in_port), key); - if (!ses) - vlib_cli_output (vm, "no match"); - else - snat_det_ses_close (dm, ses); - } - -done: - unformat_free (line_input); - - return error; -} /* *INDENT-OFF* */ /*? @@ -2281,7 +1879,7 @@ VLIB_CLI_COMMAND (nat_show_workers_command, static) = { * Set values of timeouts for NAT sessions (in seconds), use: * vpp# set nat timeout udp 120 tcp-established 7500 tcp-transitory 250 icmp 90 * To reset default values use: - * vpp# set nat44 deterministic timeout reset + * vpp# set nat timeout reset * @cliexend ?*/ VLIB_CLI_COMMAND (set_timeout_command, static) = { @@ -2780,119 +2378,6 @@ VLIB_CLI_COMMAND (snat_forwarding_set_command, static) = { .function = snat_forwarding_set_command_fn, }; -/*? - * @cliexpar - * @cliexstart{nat44 deterministic add} - * Create bijective mapping of inside address to outside address and port range - * pairs, with the purpose of enabling deterministic NAT to reduce logging in - * CGN deployments. - * To create deterministic mapping between inside network 10.0.0.0/18 and - * outside network 1.1.1.0/30 use: - * # vpp# nat44 deterministic add in 10.0.0.0/18 out 1.1.1.0/30 - * @cliexend -?*/ -VLIB_CLI_COMMAND (snat_det_map_command, static) = { - .path = "nat44 deterministic add", - .short_help = "nat44 deterministic add in <addr>/<plen> out <addr>/<plen> [del]", - .function = snat_det_map_command_fn, -}; - -/*? - * @cliexpar - * @cliexpstart{show nat44 deterministic mappings} - * Show NAT44 deterministic mappings - * vpp# show nat44 deterministic mappings - * NAT44 deterministic mappings: - * in 10.0.0.0/24 out 1.1.1.1/32 - * outside address sharing ratio: 256 - * number of ports per inside host: 252 - * sessions number: 0 - * @cliexend -?*/ -VLIB_CLI_COMMAND (nat44_det_show_mappings_command, static) = { - .path = "show nat44 deterministic mappings", - .short_help = "show nat44 deterministic mappings", - .function = nat44_det_show_mappings_command_fn, -}; - -/*? - * @cliexpar - * @cliexstart{nat44 deterministic forward} - * Return outside address and port range from inside address for deterministic - * NAT. - * To obtain outside address and port of inside host use: - * vpp# nat44 deterministic forward 10.0.0.2 - * 1.1.1.0:<1054-1068> - * @cliexend -?*/ -VLIB_CLI_COMMAND (snat_det_forward_command, static) = { - .path = "nat44 deterministic forward", - .short_help = "nat44 deterministic forward <addr>", - .function = snat_det_forward_command_fn, -}; - -/*? - * @cliexpar - * @cliexstart{nat44 deterministic reverse} - * Return inside address from outside address and port for deterministic NAT. - * To obtain inside host address from outside address and port use: - * #vpp nat44 deterministic reverse 1.1.1.1:1276 - * 10.0.16.16 - * @cliexend -?*/ -VLIB_CLI_COMMAND (snat_det_reverse_command, static) = { - .path = "nat44 deterministic reverse", - .short_help = "nat44 deterministic reverse <addr>:<port>", - .function = snat_det_reverse_command_fn, -}; - -/*? - * @cliexpar - * @cliexstart{show nat44 deterministic sessions} - * Show NAT44 deterministic sessions. - * vpp# show nat44 deterministic sessions - * NAT44 deterministic sessions: - * in 10.0.0.3:3005 out 1.1.1.2:1146 external host 172.16.1.2:3006 state: udp-active expire: 306 - * in 10.0.0.3:3000 out 1.1.1.2:1141 external host 172.16.1.2:3001 state: udp-active expire: 306 - * in 10.0.0.4:3005 out 1.1.1.2:1177 external host 172.16.1.2:3006 state: udp-active expire: 306 - * @cliexend -?*/ -VLIB_CLI_COMMAND (nat44_det_show_sessions_command, static) = { - .path = "show nat44 deterministic sessions", - .short_help = "show nat44 deterministic sessions", - .function = nat44_det_show_sessions_command_fn, -}; - -/*? - * @cliexpar - * @cliexstart{nat44 deterministic close session out} - * Close session using outside ip address and port - * and external ip address and port, use: - * vpp# nat44 deterministic close session out 1.1.1.1:1276 2.2.2.2:2387 - * @cliexend -?*/ -VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = { - .path = "nat44 deterministic close session out", - .short_help = "nat44 deterministic close session out " - "<out_addr>:<out_port> <ext_addr>:<ext_port>", - .function = snat_det_close_session_out_fn, -}; - -/*? - * @cliexpar - * @cliexstart{nat44 deterministic close session in} - * Close session using inside ip address and port - * and external ip address and port, use: - * vpp# nat44 deterministic close session in 3.3.3.3:3487 2.2.2.2:2387 - * @cliexend -?*/ -VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = { - .path = "nat44 deterministic close session in", - .short_help = "nat44 deterministic close session in " - "<in_addr>:<in_port> <ext_addr>:<ext_port>", - .function = snat_det_close_session_in_fn, -}; - /* *INDENT-ON* */ /* diff --git a/src/plugins/nat/nat_api.c b/src/plugins/nat/nat_api.c index b447395fd57..503143288f8 100644 --- a/src/plugins/nat/nat_api.c +++ b/src/plugins/nat/nat_api.c @@ -19,7 +19,6 @@ */ #include <nat/nat.h> -#include <nat/nat_det.h> #include <nat/nat64.h> #include <nat/nat_inlines.h> #include <nat/nat44/inlines.h> @@ -31,6 +30,7 @@ #include <vnet/fib/fib_table.h> #include <vnet/ip/ip_types_api.h> #include <nat/nat44/ed_inlines.h> +#include <nat/nat_ipfix_logging.h> #define vl_api_nat44_add_del_lb_static_mapping_t_endian vl_noop_handler #define vl_api_nat44_nat44_lb_static_mapping_details_t_endian vl_noop_handler @@ -113,7 +113,7 @@ vl_api_nat_show_config_t_handler (vl_api_nat_show_config_t * mp) rmp->static_mapping_only = sm->static_mapping_only; rmp->static_mapping_connection_tracking = sm->static_mapping_connection_tracking; - rmp->deterministic = sm->deterministic; + rmp->deterministic = 0; rmp->endpoint_dependent = sm->endpoint_dependent; rmp->out2in_dpo = sm->out2in_dpo; //rmp->dslite_ce = dm->is_ce; @@ -144,12 +144,6 @@ vl_api_nat_set_workers_t_handler (vl_api_nat_set_workers_t * mp) uword *bitmap = 0; u64 mask; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - mask = clib_net_to_host_u64 (mp->worker_mask); if (sm->num_workers < 2) @@ -218,9 +212,6 @@ vl_api_nat_worker_dump_t_handler (vl_api_nat_worker_dump_t * mp) snat_main_t *sm = &snat_main; u32 *worker_index; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -406,12 +397,6 @@ static void int rv = 0; u16 port_start, port_end; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - switch (mp->alg) { case NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT: @@ -776,12 +761,6 @@ static void int rv = 0; u32 *tmp; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - if (sm->static_mapping_only) { rv = VNET_API_ERROR_FEATURE_DISABLED; @@ -875,9 +854,6 @@ vl_api_nat44_address_dump_t_handler (vl_api_nat44_address_dump_t * mp) snat_main_t *sm = &snat_main; snat_address_t *a; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -999,12 +975,6 @@ static void u32 sw_if_index = ntohl (mp->sw_if_index); int rv = 0; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - VALIDATE_SW_IF_INDEX (mp); rv = snat_interface_add_del_output_feature (sw_if_index, @@ -1012,7 +982,6 @@ static void !mp->is_add); BAD_SW_IF_INDEX_LABEL; -send_reply: REPLY_MACRO (VL_API_NAT44_INTERFACE_ADD_DEL_OUTPUT_FEATURE_REPLY); } @@ -1059,9 +1028,6 @@ static void snat_main_t *sm = &snat_main; snat_interface_t *i; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -1098,12 +1064,6 @@ static void nat_protocol_t proto; u8 *tag = 0; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - memcpy (&local_addr.as_u8, mp->local_ip_address, 4); memcpy (&external_addr.as_u8, mp->external_ip_address, 4); @@ -1133,7 +1093,6 @@ static void mp->flags & NAT_API_IS_OUT2IN_ONLY, tag, 0); vec_free (tag); -send_reply: REPLY_MACRO (VL_API_NAT44_ADD_DEL_STATIC_MAPPING_REPLY); } @@ -1256,9 +1215,6 @@ vl_api_nat44_static_mapping_dump_t_handler (vl_api_nat44_static_mapping_dump_t snat_static_map_resolve_t *rp; int j; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -1303,12 +1259,6 @@ static void nat_protocol_t proto = NAT_PROTOCOL_OTHER; u8 *tag = 0; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - if (!(mp->flags & NAT_API_IS_ADDR_ONLY)) { port = mp->port; @@ -1330,7 +1280,6 @@ static void proto, mp->is_add, 0, 0, tag, 1); vec_free (tag); -send_reply: REPLY_MACRO (VL_API_NAT44_ADD_DEL_IDENTITY_MAPPING_REPLY); } @@ -1421,9 +1370,6 @@ static void snat_static_map_resolve_t *rp; int j; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -1469,12 +1415,6 @@ static void int rv = 0; u8 is_del; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - is_del = !mp->is_add; VALIDATE_SW_IF_INDEX (mp); @@ -1483,7 +1423,6 @@ static void mp->flags & NAT_API_IS_TWICE_NAT); BAD_SW_IF_INDEX_LABEL; -send_reply: REPLY_MACRO (VL_API_NAT44_ADD_DEL_INTERFACE_ADDR_REPLY); } @@ -1529,9 +1468,6 @@ vl_api_nat44_interface_addr_dump_t_handler (vl_api_nat44_interface_addr_dump_t snat_main_t *sm = &snat_main; u32 *i; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -1645,9 +1581,6 @@ vl_api_nat44_user_dump_t_handler (vl_api_nat44_user_dump_t * mp) snat_main_per_thread_data_t *tsm; snat_user_t *u; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -1749,9 +1682,6 @@ vl_api_nat44_user_session_dump_t_handler (vl_api_nat44_user_session_dump_t * dlist_elt_t *head, *elt; ip4_header_t ip; - if (sm->deterministic) - return; - reg = vl_api_client_index_to_registration (mp->client_index); if (!reg) return; @@ -2043,12 +1973,6 @@ vl_api_nat44_del_session_t_handler (vl_api_nat44_del_session_t * mp) u8 is_in; nat_protocol_t proto; - if (sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - memcpy (&addr.as_u8, mp->address, 4); port = mp->port; vrf_id = clib_net_to_host_u32 (mp->vrf_id); @@ -2065,7 +1989,6 @@ vl_api_nat44_del_session_t_handler (vl_api_nat44_del_session_t * mp) else rv = nat44_del_session (sm, &addr, port, proto, vrf_id, is_in); -send_reply: REPLY_MACRO (VL_API_NAT44_DEL_SESSION_REPLY); } @@ -2181,375 +2104,6 @@ static void *vl_api_nat44_forwarding_is_enabled_t_print FINISH; } -/*******************************/ -/*** Deterministic NAT (CGN) ***/ -/*******************************/ - -static void -vl_api_nat_det_add_del_map_t_handler (vl_api_nat_det_add_del_map_t * mp) -{ - snat_main_t *sm = &snat_main; - vl_api_nat_det_add_del_map_reply_t *rmp; - int rv = 0; - ip4_address_t in_addr, out_addr; - - if (!sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - - clib_memcpy (&in_addr, mp->in_addr, 4); - clib_memcpy (&out_addr, mp->out_addr, 4); - rv = snat_det_add_map (sm, &in_addr, mp->in_plen, &out_addr, - mp->out_plen, mp->is_add); - -send_reply: - REPLY_MACRO (VL_API_NAT_DET_ADD_DEL_MAP_REPLY); -} - -static void * -vl_api_nat_det_add_del_map_t_print (vl_api_nat_det_add_del_map_t * mp, - void *handle) -{ - u8 *s; - - s = format (0, "SCRIPT: nat_det_add_del_map "); - s = format (s, "inside address %U/%d outside address %U/%d\n", - format_ip4_address, mp->in_addr, mp->in_plen, - format_ip4_address, mp->out_addr, mp->out_plen); - - FINISH; -} - -static void -vl_api_nat_det_forward_t_handler (vl_api_nat_det_forward_t * mp) -{ - snat_main_t *sm = &snat_main; - vl_api_nat_det_forward_reply_t *rmp; - int rv = 0; - u16 lo_port = 0, hi_port = 0; - snat_det_map_t *dm; - ip4_address_t in_addr, out_addr; - - if (!sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - REPLY_MACRO (VL_API_NAT_DET_FORWARD_REPLY); - return; - } - - out_addr.as_u32 = 0; - clib_memcpy (&in_addr, mp->in_addr, 4); - dm = snat_det_map_by_user (sm, &in_addr); - if (!dm) - { - rv = VNET_API_ERROR_NO_SUCH_ENTRY; - goto send_reply; - } - - snat_det_forward (dm, &in_addr, &out_addr, &lo_port); - hi_port = lo_port + dm->ports_per_host - 1; - -send_reply: - /* *INDENT-OFF* */ - REPLY_MACRO2 (VL_API_NAT_DET_FORWARD_REPLY, - ({ - rmp->out_port_lo = ntohs (lo_port); - rmp->out_port_hi = ntohs (hi_port); - clib_memcpy (rmp->out_addr, &out_addr, 4); - })) - /* *INDENT-ON* */ -} - -static void * -vl_api_nat_det_forward_t_print (vl_api_nat_det_forward_t * mp, void *handle) -{ - u8 *s; - - s = format (0, "SCRIPT: nat_det_forward"); - s = format (s, "inside ip address %U\n", format_ip4_address, mp->in_addr); - - FINISH; -} - -static void -vl_api_nat_det_reverse_t_handler (vl_api_nat_det_reverse_t * mp) -{ - snat_main_t *sm = &snat_main; - vl_api_nat_det_reverse_reply_t *rmp; - int rv = 0; - ip4_address_t out_addr, in_addr; - snat_det_map_t *dm; - - if (!sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - REPLY_MACRO (VL_API_NAT_DET_REVERSE_REPLY); - return; - } - - in_addr.as_u32 = 0; - clib_memcpy (&out_addr, mp->out_addr, 4); - dm = snat_det_map_by_out (sm, &out_addr); - if (!dm) - { - rv = VNET_API_ERROR_NO_SUCH_ENTRY; - goto send_reply; - } - - snat_det_reverse (dm, &out_addr, htons (mp->out_port), &in_addr); - -send_reply: - /* *INDENT-OFF* */ - REPLY_MACRO2 (VL_API_NAT_DET_REVERSE_REPLY, - ({ - clib_memcpy (rmp->in_addr, &in_addr, 4); - })) - /* *INDENT-ON* */ -} - -static void * -vl_api_nat_det_reverse_t_print (vl_api_nat_det_reverse_t * mp, void *handle) -{ - u8 *s; - - s = format (0, "SCRIPT: nat_det_reverse"); - s = format (s, "outside ip address %U outside port %d", - format_ip4_address, mp->out_addr, ntohs (mp->out_port)); - - FINISH; -} - -static void -sent_nat_det_map_details (snat_det_map_t * m, vl_api_registration_t * reg, - u32 context) -{ - vl_api_nat_det_map_details_t *rmp; - snat_main_t *sm = &snat_main; - - rmp = vl_msg_api_alloc (sizeof (*rmp)); - clib_memset (rmp, 0, sizeof (*rmp)); - rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_MAP_DETAILS + sm->msg_id_base); - clib_memcpy (rmp->in_addr, &m->in_addr, 4); - rmp->in_plen = m->in_plen; - clib_memcpy (rmp->out_addr, &m->out_addr, 4); - rmp->out_plen = m->out_plen; - rmp->sharing_ratio = htonl (m->sharing_ratio); - rmp->ports_per_host = htons (m->ports_per_host); - rmp->ses_num = htonl (m->ses_num); - rmp->context = context; - - vl_api_send_msg (reg, (u8 *) rmp); -} - -static void -vl_api_nat_det_map_dump_t_handler (vl_api_nat_det_map_dump_t * mp) -{ - vl_api_registration_t *reg; - snat_main_t *sm = &snat_main; - snat_det_map_t *m; - - if (!sm->deterministic) - return; - - reg = vl_api_client_index_to_registration (mp->client_index); - if (!reg) - return; - - /* *INDENT-OFF* */ - vec_foreach(m, sm->det_maps) - sent_nat_det_map_details(m, reg, mp->context); - /* *INDENT-ON* */ -} - -static void * -vl_api_nat_det_map_dump_t_print (vl_api_nat_det_map_dump_t * mp, void *handle) -{ - u8 *s; - - s = format (0, "SCRIPT: nat_det_map_dump "); - - FINISH; -} - -static void -vl_api_nat_det_close_session_out_t_handler (vl_api_nat_det_close_session_out_t - * mp) -{ - snat_main_t *sm = &snat_main; - vl_api_nat_det_close_session_out_reply_t *rmp; - ip4_address_t out_addr, ext_addr, in_addr; - snat_det_out_key_t key; - snat_det_map_t *dm; - snat_det_session_t *ses; - int rv = 0; - - if (!sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - - clib_memcpy (&out_addr, mp->out_addr, 4); - clib_memcpy (&ext_addr, mp->ext_addr, 4); - - dm = snat_det_map_by_out (sm, &out_addr); - if (!dm) - { - rv = VNET_API_ERROR_NO_SUCH_ENTRY; - goto send_reply; - } - snat_det_reverse (dm, &ext_addr, ntohs (mp->out_port), &in_addr); - key.ext_host_addr = ext_addr; - key.ext_host_port = mp->ext_port; - key.out_port = mp->out_port; - ses = snat_det_get_ses_by_out (dm, &in_addr, key.as_u64); - if (!ses) - { - rv = VNET_API_ERROR_NO_SUCH_ENTRY; - goto send_reply; - } - snat_det_ses_close (dm, ses); - -send_reply: - REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY); -} - -static void * -vl_api_nat_det_close_session_out_t_print (vl_api_nat_det_close_session_out_t * - mp, void *handle) -{ - u8 *s; - - s = format (0, "SCRIPT: nat_det_close_session_out "); - s = format (s, "out_addr %U out_port %d " - "ext_addr %U ext_port %d\n", - format_ip4_address, mp->out_addr, ntohs (mp->out_port), - format_ip4_address, mp->ext_addr, ntohs (mp->ext_port)); - - FINISH; -} - -static void -vl_api_nat_det_close_session_in_t_handler (vl_api_nat_det_close_session_in_t * - mp) -{ - snat_main_t *sm = &snat_main; - vl_api_nat_det_close_session_in_reply_t *rmp; - ip4_address_t in_addr, ext_addr; - snat_det_out_key_t key; - snat_det_map_t *dm; - snat_det_session_t *ses; - int rv = 0; - - if (!sm->deterministic) - { - rv = VNET_API_ERROR_UNSUPPORTED; - goto send_reply; - } - - clib_memcpy (&in_addr, mp->in_addr, 4); - clib_memcpy (&ext_addr, mp->ext_addr, 4); - - dm = snat_det_map_by_user (sm, &in_addr); - if (!dm) - { - rv = VNET_API_ERROR_NO_SUCH_ENTRY; - goto send_reply; - } - key.ext_host_addr = ext_addr; - key.ext_host_port = mp->ext_port; - ses = snat_det_find_ses_by_in (dm, &in_addr, mp->in_port, key); - if (!ses) - { - rv = VNET_API_ERROR_NO_SUCH_ENTRY; - goto send_reply; - } - snat_det_ses_close (dm, ses); - -send_reply: - REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY); -} - -static void * -vl_api_nat_det_close_session_in_t_print (vl_api_nat_det_close_session_in_t * - mp, void *handle) -{ - u8 *s; - s = format (0, "SCRIPT: nat_det_close_session_in "); - s = format (s, "in_addr %U in_port %d ext_addr %U ext_port %d\n", - format_ip4_address, mp->in_addr, ntohs (mp->in_port), - format_ip4_address, mp->ext_addr, ntohs (mp->ext_port)); - - FINISH; -} - -static void -send_nat_det_session_details (snat_det_session_t * s, - vl_api_registration_t * reg, u32 context) -{ - vl_api_nat_det_session_details_t *rmp; - snat_main_t *sm = &snat_main; - - rmp = vl_msg_api_alloc (sizeof (*rmp)); - clib_memset (rmp, 0, sizeof (*rmp)); - rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_SESSION_DETAILS + sm->msg_id_base); - rmp->in_port = s->in_port; - clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4); - rmp->ext_port = s->out.ext_host_port; - rmp->out_port = s->out.out_port; - rmp->state = s->state; - rmp->expire = ntohl (s->expire); - rmp->context = context; - - vl_api_send_msg (reg, (u8 *) rmp); -} - -static void -vl_api_nat_det_session_dump_t_handler (vl_api_nat_det_session_dump_t * mp) -{ - vl_api_registration_t *reg; - snat_main_t *sm = &snat_main; - ip4_address_t user_addr; - snat_det_map_t *dm; - snat_det_session_t *s, empty_ses; - u16 i; - - if (!sm->deterministic) - return; - - reg = vl_api_client_index_to_registration (mp->client_index); - if (!reg) - return; - - clib_memset (&empty_ses, 0, sizeof (empty_ses)); - clib_memcpy (&user_addr, mp->user_addr, 4); - dm = snat_det_map_by_user (sm, &user_addr); - if (!dm) - return; - - s = dm->sessions + snat_det_user_ses_offset (&user_addr, dm->in_plen); - for (i = 0; i < SNAT_DET_SES_PER_USER; i++) - { - if (s->out.as_u64) - send_nat_det_session_details (s, reg, mp->context); - s++; - } -} - -static void * -vl_api_nat_det_session_dump_t_print (vl_api_nat_det_session_dump_t * mp, - void *handle) -{ - u8 *s; - - s = format (0, "SCRIPT: nat_det_session_dump "); - s = format (s, "user_addr %U\n", format_ip4_address, mp->user_addr); - - FINISH; -} - /*************/ /*** NAT64 ***/ /*************/ @@ -3079,13 +2633,6 @@ _(NAT44_LB_STATIC_MAPPING_DUMP, nat44_lb_static_mapping_dump) \ _(NAT44_DEL_SESSION, nat44_del_session) \ _(NAT44_FORWARDING_ENABLE_DISABLE, nat44_forwarding_enable_disable) \ _(NAT44_FORWARDING_IS_ENABLED, nat44_forwarding_is_enabled) \ -_(NAT_DET_ADD_DEL_MAP, nat_det_add_del_map) \ -_(NAT_DET_FORWARD, nat_det_forward) \ -_(NAT_DET_REVERSE, nat_det_reverse) \ -_(NAT_DET_MAP_DUMP, nat_det_map_dump) \ -_(NAT_DET_CLOSE_SESSION_OUT, nat_det_close_session_out) \ -_(NAT_DET_CLOSE_SESSION_IN, nat_det_close_session_in) \ -_(NAT_DET_SESSION_DUMP, nat_det_session_dump) \ _(NAT64_ADD_DEL_POOL_ADDR_RANGE, nat64_add_del_pool_addr_range) \ _(NAT64_POOL_ADDR_DUMP, nat64_pool_addr_dump) \ _(NAT64_ADD_DEL_INTERFACE, nat64_add_del_interface) \ diff --git a/src/plugins/nat/nat_det.c b/src/plugins/nat/nat_det.c deleted file mode 100644 index 65a669bceb9..00000000000 --- a/src/plugins/nat/nat_det.c +++ /dev/null @@ -1,175 +0,0 @@ -/* - * snat_det.c - deterministic NAT - * - * Copyright (c) 2017 Cisco and/or its affiliates. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -/** - * @file - * @brief deterministic NAT - */ - -#include <nat/nat_det.h> - - -/** - * @brief Add/delete deterministic NAT mapping. - * - * Create bijective mapping of inside address to outside address and port range - * pairs, with the purpose of enabling deterministic NAT to reduce logging in - * CGN deployments. - * - * @param sm SNAT main. - * @param in_addr Inside network address. - * @param in_plen Inside network prefix length. - * @param out_addr Outside network address. - * @param out_plen Outside network prefix length. - * @param is_add If 0 delete, otherwise add. - */ -int -snat_det_add_map (snat_main_t * sm, ip4_address_t * in_addr, u8 in_plen, - ip4_address_t * out_addr, u8 out_plen, int is_add) -{ - snat_det_map_t *det_map; - static snat_det_session_t empty_snat_det_session = { 0 }; - snat_interface_t *i; - ip4_address_t in_cmp, out_cmp; - u8 found = 0; - - in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen]; - out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen]; - vec_foreach (det_map, sm->det_maps) - { - /* Checking for overlapping addresses to be added here */ - if (det_map->in_addr.as_u32 == in_cmp.as_u32 && - det_map->in_plen == in_plen && - det_map->out_addr.as_u32 == out_cmp.as_u32 && - det_map->out_plen == out_plen) - { - found = 1; - break; - } - } - - /* If found, don't add again */ - if (found && is_add) - return VNET_API_ERROR_VALUE_EXIST; - - /* If not found, don't delete */ - if (!found && !is_add) - return VNET_API_ERROR_NO_SUCH_ENTRY; - - if (is_add) - { - u32 num_sessions = (1 << (32 - in_plen)); - if (num_sessions > UINT32_MAX / 1000) - { - // don't let it overflow - return VNET_API_ERROR_INVALID_VALUE; - } - else - { - num_sessions = num_sessions * 1000 - 1; - } - - u32 sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen)); - if (!sharing_ratio) - { - // avoid division by zero - return VNET_API_ERROR_INVALID_VALUE; - } - - pool_get (sm->det_maps, det_map); - clib_memset (det_map, 0, sizeof (*det_map)); - det_map->in_addr.as_u32 = in_cmp.as_u32; - det_map->in_plen = in_plen; - det_map->out_addr.as_u32 = out_cmp.as_u32; - det_map->out_plen = out_plen; - det_map->sharing_ratio = sharing_ratio; - det_map->ports_per_host = (65535 - 1023) / det_map->sharing_ratio; - - vec_validate_init_empty (det_map->sessions, num_sessions, - empty_snat_det_session); - } - else - { - vec_free (det_map->sessions); - vec_del1 (sm->det_maps, det_map - sm->det_maps); - } - - /* Add/del external address range to FIB */ - /* *INDENT-OFF* */ - pool_foreach (i, sm->interfaces, - ({ - if (nat_interface_is_inside(i)) - continue; - - snat_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add); - break; - })); - /* *INDENT-ON* */ - return 0; -} - -/** - * @brief The 'nat-det-expire-walk' process's main loop. - * - * Check expire time for active sessions. - */ -static uword -snat_det_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, - vlib_frame_t * f) -{ - snat_main_t *sm = &snat_main; - snat_det_map_t *dm; - snat_det_session_t *ses; - - while (sm->deterministic) - { - vlib_process_wait_for_event_or_clock (vm, 10.0); - vlib_process_get_events (vm, NULL); - u32 now = (u32) vlib_time_now (vm); - /* *INDENT-OFF* */ - pool_foreach (dm, sm->det_maps, - ({ - vec_foreach(ses, dm->sessions) - { - /* Delete if session expired */ - if (ses->in_port && (ses->expire < now)) - snat_det_ses_close (dm, ses); - } - })); - /* *INDENT-ON* */ - } - - return 0; -} - -static vlib_node_registration_t snat_det_expire_walk_node; - -/* *INDENT-OFF* */ -VLIB_REGISTER_NODE (snat_det_expire_walk_node, static) = { - .function = snat_det_expire_walk_fn, - .type = VLIB_NODE_TYPE_PROCESS, - .name = - "nat-det-expire-walk", -}; -/* *INDENT-ON* */ - -/* - * fd.io coding-style-patch-verification: ON - * - * Local Variables: - * eval: (c-set-style "gnu") - * End: - */ diff --git a/src/plugins/nat/nat_det.h b/src/plugins/nat/nat_det.h deleted file mode 100644 index d2966356d8a..00000000000 --- a/src/plugins/nat/nat_det.h +++ /dev/null @@ -1,199 +0,0 @@ -/* - * snat_det.h - deterministic NAT definitions - * - * Copyright (c) 2017 Cisco and/or its affiliates. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -/** - * @file - * @brief deterministic NAT definitions - */ - -#ifndef __included_nat_det_h__ -#define __included_nat_det_h__ - -#include <vnet/ip/ip.h> -#include <nat/nat.h> -#include <nat/nat_ipfix_logging.h> - - -#define SNAT_DET_SES_PER_USER 1000 - - -int snat_det_add_map (snat_main_t * sm, ip4_address_t * in_addr, u8 in_plen, - ip4_address_t * out_addr, u8 out_plen, int is_add); - -always_inline int -is_addr_in_net (ip4_address_t * addr, ip4_address_t * net, u8 plen) -{ - if (net->as_u32 == (addr->as_u32 & ip4_main.fib_masks[plen])) - return 1; - return 0; -} - -always_inline snat_det_map_t * -snat_det_map_by_user (snat_main_t * sm, ip4_address_t * user_addr) -{ - snat_det_map_t *dm; - - /* *INDENT-OFF* */ - pool_foreach (dm, sm->det_maps, - ({ - if (is_addr_in_net(user_addr, &dm->in_addr, dm->in_plen)) - return dm; - })); - /* *INDENT-ON* */ - return 0; -} - -always_inline snat_det_map_t * -snat_det_map_by_out (snat_main_t * sm, ip4_address_t * out_addr) -{ - snat_det_map_t *dm; - - /* *INDENT-OFF* */ - pool_foreach (dm, sm->det_maps, - ({ - if (is_addr_in_net(out_addr, &dm->out_addr, dm->out_plen)) - return dm; - })); - /* *INDENT-ON* */ - return 0; -} - -always_inline void -snat_det_forward (snat_det_map_t * dm, ip4_address_t * in_addr, - ip4_address_t * out_addr, u16 * lo_port) -{ - u32 in_offset, out_offset; - - in_offset = clib_net_to_host_u32 (in_addr->as_u32) - - clib_net_to_host_u32 (dm->in_addr.as_u32); - out_offset = in_offset / dm->sharing_ratio; - out_addr->as_u32 = - clib_host_to_net_u32 (clib_net_to_host_u32 (dm->out_addr.as_u32) + - out_offset); - *lo_port = 1024 + dm->ports_per_host * (in_offset % dm->sharing_ratio); -} - -always_inline void -snat_det_reverse (snat_det_map_t * dm, ip4_address_t * out_addr, u16 out_port, - ip4_address_t * in_addr) -{ - u32 in_offset1, in_offset2, out_offset; - - out_offset = clib_net_to_host_u32 (out_addr->as_u32) - - clib_net_to_host_u32 (dm->out_addr.as_u32); - in_offset1 = out_offset * dm->sharing_ratio; - in_offset2 = (out_port - 1024) / dm->ports_per_host; - in_addr->as_u32 = - clib_host_to_net_u32 (clib_net_to_host_u32 (dm->in_addr.as_u32) + - in_offset1 + in_offset2); -} - -always_inline u32 -snat_det_user_ses_offset (ip4_address_t * addr, u8 plen) -{ - return (clib_net_to_host_u32 (addr->as_u32) & pow2_mask (32 - plen)) * - SNAT_DET_SES_PER_USER; -} - -always_inline snat_det_session_t * -snat_det_get_ses_by_out (snat_det_map_t * dm, ip4_address_t * in_addr, - u64 out_key) -{ - u32 user_offset; - u16 i; - - user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen); - for (i = 0; i < SNAT_DET_SES_PER_USER; i++) - { - if (dm->sessions[i + user_offset].out.as_u64 == out_key) - return &dm->sessions[i + user_offset]; - } - - return 0; -} - -always_inline snat_det_session_t * -snat_det_find_ses_by_in (snat_det_map_t * dm, ip4_address_t * in_addr, - u16 in_port, snat_det_out_key_t out_key) -{ - snat_det_session_t *ses; - u32 user_offset; - u16 i; - - user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen); - for (i = 0; i < SNAT_DET_SES_PER_USER; i++) - { - ses = &dm->sessions[i + user_offset]; - if (ses->in_port == in_port && - ses->out.ext_host_addr.as_u32 == out_key.ext_host_addr.as_u32 && - ses->out.ext_host_port == out_key.ext_host_port) - return &dm->sessions[i + user_offset]; - } - - return 0; -} - -always_inline snat_det_session_t * -snat_det_ses_create (u32 thread_index, snat_det_map_t * dm, - ip4_address_t * in_addr, u16 in_port, - snat_det_out_key_t * out) -{ - u32 user_offset; - u16 i; - - user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen); - - for (i = 0; i < SNAT_DET_SES_PER_USER; i++) - { - if (!dm->sessions[i + user_offset].in_port) - { - if (clib_atomic_bool_cmp_and_swap - (&dm->sessions[i + user_offset].in_port, 0, in_port)) - { - dm->sessions[i + user_offset].out.as_u64 = out->as_u64; - dm->sessions[i + user_offset].state = SNAT_SESSION_UNKNOWN; - dm->sessions[i + user_offset].expire = 0; - clib_atomic_add_fetch (&dm->ses_num, 1); - return &dm->sessions[i + user_offset]; - } - } - } - - snat_ipfix_logging_max_entries_per_user (thread_index, - SNAT_DET_SES_PER_USER, - in_addr->as_u32); - return 0; -} - -always_inline void -snat_det_ses_close (snat_det_map_t * dm, snat_det_session_t * ses) -{ - if (clib_atomic_bool_cmp_and_swap (&ses->in_port, ses->in_port, 0)) - { - ses->out.as_u64 = 0; - clib_atomic_add_fetch (&dm->ses_num, -1); - } -} - -#endif /* __included_nat_det_h__ */ - -/* - * fd.io coding-style-patch-verification: ON - * - * Local Variables: - * eval: (c-set-style "gnu") - * End: - */ diff --git a/src/plugins/nat/nat_format.c b/src/plugins/nat/nat_format.c index 8287968e029..e47ba69b167 100644 --- a/src/plugins/nat/nat_format.c +++ b/src/plugins/nat/nat_format.c @@ -19,7 +19,6 @@ #include <nat/nat.h> #include <nat/nat_inlines.h> -#include <nat/nat_det.h> uword unformat_nat_protocol (unformat_input_t * input, va_list * args) @@ -297,39 +296,6 @@ format_snat_static_map_to_resolve (u8 * s, va_list * args) return s; } -u8 * -format_det_map_ses (u8 * s, va_list * args) -{ - snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *); - ip4_address_t in_addr, out_addr; - u32 in_offset, out_offset; - snat_det_session_t *ses = va_arg (*args, snat_det_session_t *); - u32 *i = va_arg (*args, u32 *); - - u32 user_index = *i / SNAT_DET_SES_PER_USER; - in_addr.as_u32 = - clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) + - user_index); - in_offset = - clib_net_to_host_u32 (in_addr.as_u32) - - clib_net_to_host_u32 (det_map->in_addr.as_u32); - out_offset = in_offset / det_map->sharing_ratio; - out_addr.as_u32 = - clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) + - out_offset); - s = - format (s, - "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n", - format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port), - format_ip4_address, &out_addr, - clib_net_to_host_u16 (ses->out.out_port), format_ip4_address, - &ses->out.ext_host_addr, - clib_net_to_host_u16 (ses->out.ext_host_port), - format_snat_session_state, ses->state, ses->expire); - - return s; -} - /* * fd.io coding-style-patch-verification: ON * diff --git a/src/plugins/nat/nat_ipfix_logging.c b/src/plugins/nat/nat_ipfix_logging.c index 59387e19858..3b75260148f 100644 --- a/src/plugins/nat/nat_ipfix_logging.c +++ b/src/plugins/nat/nat_ipfix_logging.c @@ -1528,83 +1528,78 @@ snat_ipfix_logging_enable_disable (int enable, u32 domain_id, u16 src_port) a.src_port = src_port ? src_port : UDP_DST_PORT_ipfix; a.flow_data_callback = data_callback; - if (sm->deterministic) + /* TODO: ipfix needs to be separated from NAT base plugin + a.rewrite_callback = snat_template_rewrite_max_entries_per_usr; + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) { - a.rewrite_callback = snat_template_rewrite_max_entries_per_usr; - - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; } - else + */ + a.rewrite_callback = snat_template_rewrite_nat44_session; + + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) { - a.rewrite_callback = snat_template_rewrite_nat44_session; + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; + } - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + a.rewrite_callback = snat_template_rewrite_addr_exhausted; - a.rewrite_callback = snat_template_rewrite_addr_exhausted; + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) + { + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; + } - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + a.rewrite_callback = nat_template_rewrite_max_sessions; - a.rewrite_callback = nat_template_rewrite_max_sessions; + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) + { + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; + } - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + a.rewrite_callback = nat_template_rewrite_max_bibs; - a.rewrite_callback = nat_template_rewrite_max_bibs; + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) + { + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; + } - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + a.rewrite_callback = nat_template_rewrite_nat64_bib; - a.rewrite_callback = nat_template_rewrite_nat64_bib; + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) + { + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; + } - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + a.rewrite_callback = nat_template_rewrite_nat64_session; - a.rewrite_callback = nat_template_rewrite_nat64_session; + rv = vnet_flow_report_add_del (frm, &a, NULL); + if (rv) + { + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; + } + + if (sm->endpoint_dependent) + { + a.rewrite_callback = snat_template_rewrite_max_entries_per_usr; rv = vnet_flow_report_add_del (frm, &a, NULL); if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } - - if (sm->endpoint_dependent) { - a.rewrite_callback = snat_template_rewrite_max_entries_per_usr; - - rv = vnet_flow_report_add_del (frm, &a, NULL); - if (rv) - { - nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); - return -1; - } + nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv); + return -1; } } diff --git a/src/plugins/nat/nat_test.c b/src/plugins/nat/nat_test.c index 46fbfc7c0cd..0cc34f0b3f1 100644 --- a/src/plugins/nat/nat_test.c +++ b/src/plugins/nat/nat_test.c @@ -1,4 +1,3 @@ - /* * nat.c - skeleton vpp-api-test plug-in * @@ -69,16 +68,13 @@ _(nat44_add_del_static_mapping_reply) \ _(nat_set_workers_reply) \ _(nat44_add_del_interface_addr_reply) \ _(nat_ipfix_enable_disable_reply) \ -_(nat_det_add_del_map_reply) \ -_(nat_set_timeouts_reply) \ -_(nat_det_close_session_out_reply) \ -_(nat_det_close_session_in_reply) +_(nat_set_timeouts_reply) #define _(n) \ static void vl_api_##n##_t_handler \ (vl_api_##n##_t * mp) \ { \ - vat_main_t * vam = snat_test_main.vat_main; \ + vat_main_t * vam = snat_test_main.vat_main; \ i32 retval = ntohl(mp->retval); \ if (vam->async_mode) { \ vam->async_errors += (retval < 0); \ @@ -117,17 +113,8 @@ _(NAT_IPFIX_ENABLE_DISABLE_REPLY, \ nat_ipfix_enable_disable_reply) \ _(NAT44_USER_DETAILS, nat44_user_details) \ _(NAT44_USER_SESSION_DETAILS, nat44_user_session_details) \ -_(NAT_DET_ADD_DEL_MAP_REPLY, nat_det_add_del_map_reply) \ -_(NAT_DET_FORWARD_REPLY, nat_det_forward_reply) \ -_(NAT_DET_REVERSE_REPLY, nat_det_reverse_reply) \ -_(NAT_DET_MAP_DETAILS, nat_det_map_details) \ _(NAT_SET_TIMEOUTS_REPLY, nat_set_timeouts_reply) \ -_(NAT_GET_TIMEOUTS_REPLY, nat_get_timeouts_reply) \ -_(NAT_DET_CLOSE_SESSION_OUT_REPLY, \ - nat_det_close_session_out_reply) \ -_(NAT_DET_CLOSE_SESSION_IN_REPLY, \ - nat_det_close_session_in_reply) \ -_(NAT_DET_SESSION_DETAILS, nat_det_session_details) +_(NAT_GET_TIMEOUTS_REPLY, nat_get_timeouts_reply) static int api_nat44_add_del_address_range (vat_main_t * vam) { @@ -827,159 +814,6 @@ static int api_nat44_user_dump(vat_main_t * vam) return ret; } -static int api_nat_det_add_del_map (vat_main_t * vam) -{ - unformat_input_t * i = vam->input; - vl_api_nat_det_add_del_map_t * mp; - ip4_address_t in_addr, out_addr; - u32 in_plen, out_plen; - u8 is_add = 1; - int ret; - - if (unformat (i, "in %U/%d out %U/%d", - unformat_ip4_address, &in_addr, &in_plen, - unformat_ip4_address, &out_addr, &out_plen)) - ; - else if (unformat (i, "del")) - is_add = 0; - else - { - clib_warning("unknown input '%U'", format_unformat_error, i); - return -99; - } - - M(NAT_DET_ADD_DEL_MAP, mp); - clib_memcpy(mp->in_addr, &in_addr, 4); - mp->in_plen = in_plen; - clib_memcpy(mp->out_addr, &out_addr, 4); - mp->out_plen = out_plen; - mp->is_add = is_add; - - S(mp); - W (ret); - return ret; -} - -static void vl_api_nat_det_forward_reply_t_handler - (vl_api_nat_det_forward_reply_t *mp) -{ - snat_test_main_t * sm = &snat_test_main; - vat_main_t *vam = sm->vat_main; - i32 retval = ntohl(mp->retval); - - if (retval >= 0) - { - fformat (vam->ofp, "outside address %U", format_ip4_address, &mp->out_addr); - fformat (vam->ofp, " outside port range start %d", ntohs(mp->out_port_lo)); - fformat (vam->ofp, " outside port range end %d\n", ntohs(mp->out_port_hi)); - } - - vam->retval = retval; - vam->result_ready = 1; -} - -static int api_nat_det_forward (vat_main_t * vam) -{ - unformat_input_t * i = vam->input; - vl_api_nat_det_forward_t * mp; - ip4_address_t in_addr; - int ret; - - if (unformat (i, "%U", unformat_ip4_address, &in_addr)) - ; - else - { - clib_warning("unknown input '%U'", format_unformat_error, i); - return -99; - } - - M(NAT_DET_FORWARD, mp); - clib_memcpy(mp->in_addr, &in_addr, 4); - - S(mp); - W(ret); - return ret; -} - -static void vl_api_nat_det_reverse_reply_t_handler - (vl_api_nat_det_reverse_reply_t *mp) -{ - snat_test_main_t * sm = &snat_test_main; - vat_main_t *vam = sm->vat_main; - i32 retval = ntohl(mp->retval); - - if (retval >= 0) - { - fformat (vam->ofp, "inside address %U\n", format_ip4_address, &mp->in_addr); - } - - vam->retval = retval; - vam->result_ready = 1; -} - -static int api_nat_det_reverse (vat_main_t * vam) -{ - unformat_input_t * i = vam->input; - vl_api_nat_det_reverse_t * mp; - ip4_address_t out_addr; - u32 out_port; - int ret; - - if (unformat (i, "%U %d", unformat_ip4_address, &out_addr, &out_port)) - ; - else - { - clib_warning("unknown input '%U'", format_unformat_error, i); - return -99; - } - - M(NAT_DET_REVERSE, mp); - clib_memcpy(mp->out_addr, &out_addr, 4); - mp->out_port = htons((u16)out_port); - - S(mp); - W(ret); - return ret; -} - -static void vl_api_nat_det_map_details_t_handler - (vl_api_nat_det_map_details_t *mp) -{ - snat_test_main_t * sm = &snat_test_main; - vat_main_t *vam = sm->vat_main; - - fformat (vam->ofp, "Deterministic S-NAT mapping in %U/%d out %U/%d " - "ports per host %d sharing ratio %d " - "number of sessions %d", - format_ip4_address, mp->in_addr, mp->in_plen, - format_ip4_address, mp->out_addr, mp->out_plen, - ntohs(mp->ports_per_host), ntohl(mp->sharing_ratio), - ntohl(mp->ses_num)); -} - -static int api_nat_det_map_dump(vat_main_t * vam) -{ - vl_api_nat_det_map_dump_t * mp; - vl_api_nat_control_ping_t *mp_ping; - int ret; - - if (vam->json_output) - { - clib_warning ("JSON output not supported for nat_det_map_dump"); - return -99; - } - - M(NAT_DET_MAP_DUMP, mp); - S(mp); - - /* Use a control ping for synchronization */ - M(NAT_CONTROL_PING, mp_ping); - S(mp_ping); - - W (ret); - return ret; -} - static int api_nat_set_timeouts (vat_main_t * vam) { unformat_input_t * i = vam->input; @@ -1052,110 +886,6 @@ static int api_nat_get_timeouts(vat_main_t * vam) return ret; } -static int api_nat_det_close_session_out (vat_main_t * vam) -{ - unformat_input_t * i = vam->input; - vl_api_nat_det_close_session_out_t * mp; - ip4_address_t out_addr, ext_addr; - u32 out_port, ext_port; - int ret; - - if (unformat (i, "%U:%d %U:%d", - unformat_ip4_address, &out_addr, &out_port, - unformat_ip4_address, &ext_addr, &ext_port)) - ; - else - { - clib_warning("unknown input '%U'", format_unformat_error, i); - return -99; - } - - M(NAT_DET_CLOSE_SESSION_OUT, mp); - clib_memcpy(mp->out_addr, &out_addr, 4); - mp->out_port = ntohs((u16)out_port); - clib_memcpy(mp->ext_addr, &ext_addr, 4); - mp->ext_port = ntohs((u16)ext_port); - - S(mp); - W (ret); - return ret; -} - -static int api_nat_det_close_session_in (vat_main_t * vam) -{ - unformat_input_t * i = vam->input; - vl_api_nat_det_close_session_in_t * mp; - ip4_address_t in_addr, ext_addr; - u32 in_port, ext_port; - int ret; - - if (unformat (i, "%U:%d %U:%d", - unformat_ip4_address, &in_addr, &in_port, - unformat_ip4_address, &ext_addr, &ext_port)) - ; - else - { - clib_warning("unknown input '%U'", format_unformat_error, i); - return -99; - } - - M(NAT_DET_CLOSE_SESSION_IN, mp); - clib_memcpy(mp->in_addr, &in_addr, 4); - mp->in_port = ntohs((u16)in_port); - clib_memcpy(mp->ext_addr, &ext_addr, 4); - mp->ext_port = ntohs((u16)ext_port); - - S(mp); - W (ret); - return ret; -} - -static void vl_api_nat_det_session_details_t_handler - (vl_api_nat_det_session_details_t *mp) -{ - snat_test_main_t * sm = &snat_test_main; - vat_main_t *vam = sm->vat_main; - - fformat(vam->ofp, "deterministic session, external host address %U, " - "external host port %d, outer port %d, inside port %d", - format_ip4_address, mp->ext_addr, mp->ext_port, - mp->out_port, mp->in_port); -} - -static int api_nat_det_session_dump(vat_main_t * vam) -{ - unformat_input_t* i = vam->input; - vl_api_nat_det_session_dump_t * mp; - vl_api_nat_control_ping_t *mp_ping; - ip4_address_t user_addr; - int ret; - - if (vam->json_output) - { - clib_warning ("JSON output not supported for nat_det_session_dump"); - return -99; - } - - if (unformat (i, "user_addr %U", unformat_ip4_address, &user_addr)) - ; - else - { - clib_warning ("unknown input '%U'", format_unformat_error, i); - return -99; - } - - M(NAT_DET_SESSION_DUMP, mp); - clib_memcpy (&mp->user_addr, &user_addr, 4); - S(mp); - - /* Use a control ping for synchronization */ - M(NAT_CONTROL_PING, mp_ping); - S(mp_ping); - - W (ret); - return ret; -} - /* * List of messages that the api test plugin sends, * and that the data plane plugin processes @@ -1184,19 +914,9 @@ _(nat_ipfix_enable_disable, "[domain <id>] [src_port <n>] " \ "[disable]") \ _(nat44_user_dump, "") \ _(nat44_user_session_dump, "ip_address <ip> vrf_id <table-id>") \ -_(nat_det_add_del_map, "in <in_addr>/<in_plen> out " \ - "<out_addr>/<out_plen> [del]") \ -_(nat_det_forward, "<in_addr>") \ -_(nat_det_reverse, "<out_addr> <out_port>") \ -_(nat_det_map_dump, "") \ _(nat_set_timeouts, "[udp <sec> | tcp_established <sec> | " \ "tcp_transitory <sec> | icmp <sec>]") \ -_(nat_get_timeouts, "") \ -_(nat_det_close_session_out, "<out_addr>:<out_port> " \ - "<ext_addr>:<ext_port>") \ -_(nat_det_close_session_in, "<in_addr>:<in_port> " \ - "<out_addr>:<out_port>") \ -_(nat_det_session_dump, "ip_address <user_addr>") +_(nat_get_timeouts, "") static void snat_vat_api_hookup (vat_main_t *vam) diff --git a/src/plugins/nat/test/test_det44.py b/src/plugins/nat/test/test_det44.py new file mode 100644 index 00000000000..ced77468959 --- /dev/null +++ b/src/plugins/nat/test/test_det44.py @@ -0,0 +1,682 @@ +#!/usr/bin/env python3 + +import socket +import struct +import unittest +import scapy.compat +from time import sleep +from framework import VppTestCase, running_extended_tests +from ipfix import IPFIX, Set, Template, Data, IPFIXDecoder +from scapy.layers.inet import IP, TCP, UDP, ICMP +from scapy.layers.inet import IPerror, UDPerror +from scapy.layers.l2 import Ether +from util import ppp + + +class TestDET44(VppTestCase): + """ Deterministic NAT Test Cases """ + + @classmethod + def setUpClass(cls): + super(TestDET44, cls).setUpClass() + cls.vapi.cli("set log class det44 level debug") + + cls.tcp_port_in = 6303 + cls.tcp_external_port = 6303 + cls.udp_port_in = 6304 + cls.udp_external_port = 6304 + cls.icmp_id_in = 6305 + cls.nat_addr = '10.0.0.3' + + cls.create_pg_interfaces(range(3)) + cls.interfaces = list(cls.pg_interfaces) + + for i in cls.interfaces: + i.admin_up() + i.config_ip4() + i.resolve_arp() + + cls.pg0.generate_remote_hosts(2) + cls.pg0.configure_ipv4_neighbors() + + @classmethod + def tearDownClass(cls): + super(TestDET44, cls).tearDownClass() + + def setUp(self): + super(TestDET44, self).setUp() + self.vapi.det44_plugin_enable_disable(enable=1) + + def tearDown(self): + super(TestDET44, self).tearDown() + if not self.vpp_dead: + self.vapi.det44_plugin_enable_disable(enable=0) + + def show_commands_at_teardown(self): + self.logger.info(self.vapi.cli("show det44 interfaces")) + self.logger.info(self.vapi.cli("show det44 timeouts")) + self.logger.info(self.vapi.cli("show det44 mappings")) + self.logger.info(self.vapi.cli("show det44 sessions")) + + def verify_capture_in(self, capture, in_if): + """ + Verify captured packets on inside network + + :param capture: Captured packets + :param in_if: Inside interface + """ + fired = False + for packet in capture: + try: + self.assert_packet_checksums_valid(packet) + self.assertEqual(packet[IP].dst, in_if.remote_ip4) + if packet.haslayer(TCP): + self.assertEqual(packet[TCP].dport, self.tcp_port_in) + elif packet.haslayer(UDP): + self.assertEqual(packet[UDP].dport, self.udp_port_in) + else: + self.assertEqual(packet[ICMP].id, self.icmp_id_in) + except: + fired = True + self.logger.error(ppp("Unexpected or invalid packet " + "(inside network):", packet)) + if fired: + raise + + def verify_ipfix_max_entries_per_user(self, data, limit, src_addr): + """ + Verify IPFIX maximum entries per user exceeded event + + :param data: Decoded IPFIX data records + :param limit: Number of maximum entries per user + :param src_addr: IPv4 source address + """ + self.assertEqual(1, len(data)) + record = data[0] + # natEvent + self.assertEqual(scapy.compat.orb(record[230]), 13) + # natQuotaExceededEvent + self.assertEqual(struct.pack("I", 3), record[466]) + # maxEntriesPerUser + self.assertEqual(struct.pack("I", limit), record[473]) + # sourceIPv4Address + self.assertEqual(socket.inet_pton(socket.AF_INET, src_addr), record[8]) + + def initiate_tcp_session(self, in_if, out_if): + """ + Initiates TCP session 3 WAY HAND SHAKE + + :param in_if: Inside interface + :param out_if: Outside interface + """ + + # SYN packet in->out + p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) / + IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, + flags="S")) + in_if.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = out_if.get_capture(1) + p = capture[0] + self.tcp_port_out = p[TCP].sport + + # SYN + ACK packet out->in + p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) / + IP(src=out_if.remote_ip4, dst=self.nat_addr) / + TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, + flags="SA")) + out_if.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + in_if.get_capture(1) + + # ACK packet in->out + p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) / + IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, + flags="A")) + in_if.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + out_if.get_capture(1) + + def create_stream_in(self, in_if, out_if, ttl=64): + """ + Create packet stream for inside network + + :param in_if: Inside interface + :param out_if: Outside interface + :param ttl: TTL of generated packets + """ + pkts = [] + # TCP + p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) / + IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port)) + pkts.append(p) + + # UDP + p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) / + IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) / + UDP(sport=self.udp_port_in, dport=self.udp_external_port)) + pkts.append(p) + + # ICMP + p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) / + IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) / + ICMP(id=self.icmp_id_in, type='echo-request')) + pkts.append(p) + + return pkts + + def create_stream_out(self, out_if, dst_ip=None, ttl=64): + """ + Create packet stream for outside network + + :param out_if: Outside interface + :param dst_ip: Destination IP address (Default use global NAT address) + :param ttl: TTL of generated packets + """ + if dst_ip is None: + dst_ip = self.nat_addr + pkts = [] + # TCP + p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) / + IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) / + TCP(dport=self.tcp_port_out, sport=self.tcp_external_port)) + pkts.append(p) + + # UDP + p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) / + IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) / + UDP(dport=self.udp_port_out, sport=self.udp_external_port)) + pkts.append(p) + + # ICMP + p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) / + IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) / + ICMP(id=self.icmp_external_id, type='echo-reply')) + pkts.append(p) + + return pkts + + def verify_capture_out(self, capture, nat_ip=None): + """ + Verify captured packets on outside network + + :param capture: Captured packets + :param nat_ip: Translated IP address (Default use global NAT address) + :param same_port: Source port number is not translated (Default False) + """ + if nat_ip is None: + nat_ip = self.nat_addr + for packet in capture: + try: + self.assertEqual(packet[IP].src, nat_ip) + if packet.haslayer(TCP): + self.tcp_port_out = packet[TCP].sport + elif packet.haslayer(UDP): + self.udp_port_out = packet[UDP].sport + else: + self.icmp_external_id = packet[ICMP].id + except: + self.logger.error(ppp("Unexpected or invalid packet " + "(outside network):", packet)) + raise + + def test_deterministic_mode(self): + """ NAT plugin run deterministic mode """ + in_addr = '172.16.255.0' + out_addr = '172.17.255.50' + in_addr_t = '172.16.255.20' + in_plen = 24 + out_plen = 32 + + self.vapi.det44_add_del_map(is_add=1, in_addr=in_addr, + in_plen=in_plen, out_addr=out_addr, + out_plen=out_plen) + + rep1 = self.vapi.det44_forward(in_addr_t) + self.assertEqual(str(rep1.out_addr), out_addr) + rep2 = self.vapi.det44_reverse(rep1.out_port_hi, out_addr) + + self.assertEqual(str(rep2.in_addr), in_addr_t) + + deterministic_mappings = self.vapi.det44_map_dump() + self.assertEqual(len(deterministic_mappings), 1) + dsm = deterministic_mappings[0] + self.assertEqual(in_addr, str(dsm.in_addr)) + self.assertEqual(in_plen, dsm.in_plen) + self.assertEqual(out_addr, str(dsm.out_addr)) + self.assertEqual(out_plen, dsm.out_plen) + + def test_set_timeouts(self): + """ Set deterministic NAT timeouts """ + timeouts_before = self.vapi.det44_get_timeouts() + + self.vapi.det44_set_timeouts( + udp=timeouts_before.udp + 10, + tcp_established=timeouts_before.tcp_established + 10, + tcp_transitory=timeouts_before.tcp_transitory + 10, + icmp=timeouts_before.icmp + 10) + + timeouts_after = self.vapi.det44_get_timeouts() + + self.assertNotEqual(timeouts_before.udp, timeouts_after.udp) + self.assertNotEqual(timeouts_before.icmp, timeouts_after.icmp) + self.assertNotEqual(timeouts_before.tcp_established, + timeouts_after.tcp_established) + self.assertNotEqual(timeouts_before.tcp_transitory, + timeouts_after.tcp_transitory) + + def test_in(self): + """ DET44 translation test (TCP, UDP, ICMP) """ + + nat_ip = "10.0.0.10" + + self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, + in_plen=32, + out_addr=socket.inet_aton(nat_ip), + out_plen=32) + + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, is_inside=1) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1, is_inside=0) + + # in2out + pkts = self.create_stream_in(self.pg0, self.pg1) + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg1.get_capture(len(pkts)) + self.verify_capture_out(capture, nat_ip) + + # out2in + pkts = self.create_stream_out(self.pg1, nat_ip) + self.pg1.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg0.get_capture(len(pkts)) + self.verify_capture_in(capture, self.pg0) + + # session dump test + sessions = self.vapi.det44_session_dump(self.pg0.remote_ip4) + self.assertEqual(len(sessions), 3) + + # TCP session + s = sessions[0] + self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4) + self.assertEqual(s.in_port, self.tcp_port_in) + self.assertEqual(s.out_port, self.tcp_port_out) + self.assertEqual(s.ext_port, self.tcp_external_port) + + # UDP session + s = sessions[1] + self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4) + self.assertEqual(s.in_port, self.udp_port_in) + self.assertEqual(s.out_port, self.udp_port_out) + self.assertEqual(s.ext_port, self.udp_external_port) + + # ICMP session + s = sessions[2] + self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4) + self.assertEqual(s.in_port, self.icmp_id_in) + self.assertEqual(s.out_port, self.icmp_external_id) + + def test_multiple_users(self): + """ Deterministic NAT multiple users """ + + nat_ip = "10.0.0.10" + port_in = 80 + external_port = 6303 + + host0 = self.pg0.remote_hosts[0] + host1 = self.pg0.remote_hosts[1] + + self.vapi.det44_add_del_map(is_add=1, in_addr=host0.ip4, in_plen=24, + out_addr=socket.inet_aton(nat_ip), + out_plen=32) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, is_inside=1) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1, is_inside=0) + + # host0 to out + p = (Ether(src=host0.mac, dst=self.pg0.local_mac) / + IP(src=host0.ip4, dst=self.pg1.remote_ip4) / + TCP(sport=port_in, dport=external_port)) + self.pg0.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg1.get_capture(1) + p = capture[0] + try: + ip = p[IP] + tcp = p[TCP] + self.assertEqual(ip.src, nat_ip) + self.assertEqual(ip.dst, self.pg1.remote_ip4) + self.assertEqual(tcp.dport, external_port) + port_out0 = tcp.sport + except: + self.logger.error(ppp("Unexpected or invalid packet:", p)) + raise + + # host1 to out + p = (Ether(src=host1.mac, dst=self.pg0.local_mac) / + IP(src=host1.ip4, dst=self.pg1.remote_ip4) / + TCP(sport=port_in, dport=external_port)) + self.pg0.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg1.get_capture(1) + p = capture[0] + try: + ip = p[IP] + tcp = p[TCP] + self.assertEqual(ip.src, nat_ip) + self.assertEqual(ip.dst, self.pg1.remote_ip4) + self.assertEqual(tcp.dport, external_port) + port_out1 = tcp.sport + except: + self.logger.error(ppp("Unexpected or invalid packet:", p)) + raise + + dms = self.vapi.det44_map_dump() + self.assertEqual(1, len(dms)) + self.assertEqual(2, dms[0].ses_num) + + # out to host0 + p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=nat_ip) / + TCP(sport=external_port, dport=port_out0)) + self.pg1.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg0.get_capture(1) + p = capture[0] + try: + ip = p[IP] + tcp = p[TCP] + self.assertEqual(ip.src, self.pg1.remote_ip4) + self.assertEqual(ip.dst, host0.ip4) + self.assertEqual(tcp.dport, port_in) + self.assertEqual(tcp.sport, external_port) + except: + self.logger.error(ppp("Unexpected or invalid packet:", p)) + raise + + # out to host1 + p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=nat_ip) / + TCP(sport=external_port, dport=port_out1)) + self.pg1.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg0.get_capture(1) + p = capture[0] + try: + ip = p[IP] + tcp = p[TCP] + self.assertEqual(ip.src, self.pg1.remote_ip4) + self.assertEqual(ip.dst, host1.ip4) + self.assertEqual(tcp.dport, port_in) + self.assertEqual(tcp.sport, external_port) + except: + self.logger.error(ppp("Unexpected or invalid packet", p)) + raise + + # session close api test + self.vapi.det44_close_session_out(socket.inet_aton(nat_ip), + port_out1, + self.pg1.remote_ip4, + external_port) + dms = self.vapi.det44_map_dump() + self.assertEqual(dms[0].ses_num, 1) + + self.vapi.det44_close_session_in(host0.ip4, + port_in, + self.pg1.remote_ip4, + external_port) + dms = self.vapi.det44_map_dump() + self.assertEqual(dms[0].ses_num, 0) + + def test_tcp_session_close_detection_in(self): + """ DET44 TCP session close from inside network """ + self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, + in_plen=32, + out_addr=socket.inet_aton(self.nat_addr), + out_plen=32) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, is_inside=1) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1, is_inside=0) + + self.initiate_tcp_session(self.pg0, self.pg1) + + # close the session from inside + try: + # FIN packet in -> out + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, + flags="F")) + self.pg0.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg1.get_capture(1) + + pkts = [] + + # ACK packet out -> in + p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / + TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, + flags="A")) + pkts.append(p) + + # FIN packet out -> in + p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / + TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, + flags="F")) + pkts.append(p) + + self.pg1.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg0.get_capture(2) + + # ACK packet in -> out + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, + flags="A")) + self.pg0.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg1.get_capture(1) + + # Check if deterministic NAT44 closed the session + dms = self.vapi.det44_map_dump() + self.assertEqual(0, dms[0].ses_num) + except: + self.logger.error("TCP session termination failed") + raise + + def test_tcp_session_close_detection_out(self): + """ Deterministic NAT TCP session close from outside network """ + self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, + in_plen=32, + out_addr=socket.inet_aton(self.nat_addr), + out_plen=32) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, is_inside=1) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1, is_inside=0) + + self.initiate_tcp_session(self.pg0, self.pg1) + + # close the session from outside + try: + # FIN packet out -> in + p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / + TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, + flags="F")) + self.pg1.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg0.get_capture(1) + + pkts = [] + + # ACK packet in -> out + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, + flags="A")) + pkts.append(p) + + # ACK packet in -> out + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, + flags="F")) + pkts.append(p) + + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg1.get_capture(2) + + # ACK packet out -> in + p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / + TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, + flags="A")) + self.pg1.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg0.get_capture(1) + + # Check if deterministic NAT44 closed the session + dms = self.vapi.det44_map_dump() + self.assertEqual(0, dms[0].ses_num) + except: + self.logger.error("TCP session termination failed") + raise + + @unittest.skipUnless(running_extended_tests, "part of extended tests") + def test_session_timeout(self): + """ Deterministic NAT session timeouts """ + self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, + in_plen=32, + out_addr=socket.inet_aton(self.nat_addr), + out_plen=32) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, is_inside=1) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1, is_inside=0) + + self.initiate_tcp_session(self.pg0, self.pg1) + self.vapi.det44_set_timeouts(udp=5, tcp_established=5, + tcp_transitory=5, icmp=5) + pkts = self.create_stream_in(self.pg0, self.pg1) + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg1.get_capture(len(pkts)) + sleep(15) + + dms = self.vapi.det44_map_dump() + self.assertEqual(0, dms[0].ses_num) + + # TODO: ipfix needs to be separated from NAT base plugin + @unittest.skipUnless(running_extended_tests, "part of extended tests") + def test_session_limit_per_user(self): + """ Deterministic NAT maximum sessions per user limit """ + self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, + in_plen=32, + out_addr=socket.inet_aton(self.nat_addr), + out_plen=32) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, is_inside=1) + self.vapi.det44_interface_add_del_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1, is_inside=0) + self.vapi.set_ipfix_exporter(collector_address=self.pg2.remote_ip4, + src_address=self.pg2.local_ip4, + path_mtu=512, + template_interval=10) + self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739, + enable=1) + + pkts = [] + for port in range(1025, 2025): + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + UDP(sport=port, dport=port)) + pkts.append(p) + + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg1.get_capture(len(pkts)) + + p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + UDP(sport=3001, dport=3002)) + self.pg0.add_stream(p) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + self.pg1.assert_nothing_captured() + + # verify ICMP error packet + capture = self.pg0.get_capture(1) + p = capture[0] + self.assertTrue(p.haslayer(ICMP)) + icmp = p[ICMP] + self.assertEqual(icmp.type, 3) + self.assertEqual(icmp.code, 1) + self.assertTrue(icmp.haslayer(IPerror)) + inner_ip = icmp[IPerror] + self.assertEqual(inner_ip[UDPerror].sport, 3001) + self.assertEqual(inner_ip[UDPerror].dport, 3002) + + dms = self.vapi.det44_map_dump() + + self.assertEqual(1000, dms[0].ses_num) + + # verify IPFIX logging + self.vapi.ipfix_flush() + sleep(1) + capture = self.pg2.get_capture(2) + ipfix = IPFIXDecoder() + # first load template + for p in capture: + self.assertTrue(p.haslayer(IPFIX)) + if p.haslayer(Template): + ipfix.add_template(p.getlayer(Template)) + # verify events in data set + for p in capture: + if p.haslayer(Data): + data = ipfix.decode_data_set(p.getlayer(Set)) + self.verify_ipfix_max_entries_per_user(data, + 1000, + self.pg0.remote_ip4) + self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739, + enable=0) diff --git a/src/plugins/nat/test/test_nat.py b/src/plugins/nat/test/test_nat.py index 16ffcfde941..09bf8a2d41e 100644 --- a/src/plugins/nat/test/test_nat.py +++ b/src/plugins/nat/test/test_nat.py @@ -7462,625 +7462,6 @@ class TestNAT44Out2InDPO(MethodHolder): self.verify_capture_in(capture, self.pg0) -class TestDeterministicNAT(MethodHolder): - """ Deterministic NAT Test Cases """ - - @classmethod - def setUpConstants(cls): - super(TestDeterministicNAT, cls).setUpConstants() - cls.vpp_cmdline.extend(["nat", "{", "deterministic", "}"]) - - @classmethod - def setUpClass(cls): - super(TestDeterministicNAT, cls).setUpClass() - cls.vapi.cli("set log class nat level debug") - - cls.tcp_port_in = 6303 - cls.tcp_external_port = 6303 - cls.udp_port_in = 6304 - cls.udp_external_port = 6304 - cls.icmp_id_in = 6305 - cls.nat_addr = '10.0.0.3' - - cls.create_pg_interfaces(range(3)) - cls.interfaces = list(cls.pg_interfaces) - - for i in cls.interfaces: - i.admin_up() - i.config_ip4() - i.resolve_arp() - - cls.pg0.generate_remote_hosts(2) - cls.pg0.configure_ipv4_neighbors() - - @classmethod - def tearDownClass(cls): - super(TestDeterministicNAT, cls).tearDownClass() - - def create_stream_in(self, in_if, out_if, ttl=64): - """ - Create packet stream for inside network - - :param in_if: Inside interface - :param out_if: Outside interface - :param ttl: TTL of generated packets - """ - pkts = [] - # TCP - p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) / - IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) / - TCP(sport=self.tcp_port_in, dport=self.tcp_external_port)) - pkts.append(p) - - # UDP - p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) / - IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) / - UDP(sport=self.udp_port_in, dport=self.udp_external_port)) - pkts.append(p) - - # ICMP - p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) / - IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) / - ICMP(id=self.icmp_id_in, type='echo-request')) - pkts.append(p) - - return pkts - - def create_stream_out(self, out_if, dst_ip=None, ttl=64): - """ - Create packet stream for outside network - - :param out_if: Outside interface - :param dst_ip: Destination IP address (Default use global NAT address) - :param ttl: TTL of generated packets - """ - if dst_ip is None: - dst_ip = self.nat_addr - pkts = [] - # TCP - p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) / - IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) / - TCP(dport=self.tcp_port_out, sport=self.tcp_external_port)) - pkts.append(p) - - # UDP - p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) / - IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) / - UDP(dport=self.udp_port_out, sport=self.udp_external_port)) - pkts.append(p) - - # ICMP - p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) / - IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) / - ICMP(id=self.icmp_external_id, type='echo-reply')) - pkts.append(p) - - return pkts - - def verify_capture_out(self, capture, nat_ip=None): - """ - Verify captured packets on outside network - - :param capture: Captured packets - :param nat_ip: Translated IP address (Default use global NAT address) - :param same_port: Source port number is not translated (Default False) - """ - if nat_ip is None: - nat_ip = self.nat_addr - for packet in capture: - try: - self.assertEqual(packet[IP].src, nat_ip) - if packet.haslayer(TCP): - self.tcp_port_out = packet[TCP].sport - elif packet.haslayer(UDP): - self.udp_port_out = packet[UDP].sport - else: - self.icmp_external_id = packet[ICMP].id - except: - self.logger.error(ppp("Unexpected or invalid packet " - "(outside network):", packet)) - raise - - def test_deterministic_mode(self): - """ NAT plugin run deterministic mode """ - in_addr = '172.16.255.0' - out_addr = '172.17.255.50' - in_addr_t = '172.16.255.20' - in_plen = 24 - out_plen = 32 - - nat_config = self.vapi.nat_show_config() - self.assertEqual(1, nat_config.deterministic) - - self.vapi.nat_det_add_del_map(is_add=1, in_addr=in_addr, - in_plen=in_plen, out_addr=out_addr, - out_plen=out_plen) - - rep1 = self.vapi.nat_det_forward(in_addr_t) - self.assertEqual(str(rep1.out_addr), out_addr) - rep2 = self.vapi.nat_det_reverse(rep1.out_port_hi, out_addr) - - self.assertEqual(str(rep2.in_addr), in_addr_t) - - deterministic_mappings = self.vapi.nat_det_map_dump() - self.assertEqual(len(deterministic_mappings), 1) - dsm = deterministic_mappings[0] - self.assertEqual(in_addr, str(dsm.in_addr)) - self.assertEqual(in_plen, dsm.in_plen) - self.assertEqual(out_addr, str(dsm.out_addr)) - self.assertEqual(out_plen, dsm.out_plen) - - self.clear_nat_det() - deterministic_mappings = self.vapi.nat_det_map_dump() - self.assertEqual(len(deterministic_mappings), 0) - - def test_set_timeouts(self): - """ Set deterministic NAT timeouts """ - timeouts_before = self.vapi.nat_get_timeouts() - - self.vapi.nat_set_timeouts( - udp=timeouts_before.udp + 10, - tcp_established=timeouts_before.tcp_established + 10, - tcp_transitory=timeouts_before.tcp_transitory + 10, - icmp=timeouts_before.icmp + 10) - - timeouts_after = self.vapi.nat_get_timeouts() - - self.assertNotEqual(timeouts_before.udp, timeouts_after.udp) - self.assertNotEqual(timeouts_before.icmp, timeouts_after.icmp) - self.assertNotEqual(timeouts_before.tcp_established, - timeouts_after.tcp_established) - self.assertNotEqual(timeouts_before.tcp_transitory, - timeouts_after.tcp_transitory) - - def test_det_in(self): - """ Deterministic NAT translation test (TCP, UDP, ICMP) """ - - nat_ip = "10.0.0.10" - - self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, - in_plen=32, - out_addr=socket.inet_aton(nat_ip), - out_plen=32) - - flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) - - # in2out - pkts = self.create_stream_in(self.pg0, self.pg1) - self.pg0.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg1.get_capture(len(pkts)) - self.verify_capture_out(capture, nat_ip) - - # out2in - pkts = self.create_stream_out(self.pg1, nat_ip) - self.pg1.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg0.get_capture(len(pkts)) - self.verify_capture_in(capture, self.pg0) - - # session dump test - sessions = self.vapi.nat_det_session_dump(self.pg0.remote_ip4) - self.assertEqual(len(sessions), 3) - - # TCP session - s = sessions[0] - self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4) - self.assertEqual(s.in_port, self.tcp_port_in) - self.assertEqual(s.out_port, self.tcp_port_out) - self.assertEqual(s.ext_port, self.tcp_external_port) - - # UDP session - s = sessions[1] - self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4) - self.assertEqual(s.in_port, self.udp_port_in) - self.assertEqual(s.out_port, self.udp_port_out) - self.assertEqual(s.ext_port, self.udp_external_port) - - # ICMP session - s = sessions[2] - self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4) - self.assertEqual(s.in_port, self.icmp_id_in) - self.assertEqual(s.out_port, self.icmp_external_id) - - def test_multiple_users(self): - """ Deterministic NAT multiple users """ - - nat_ip = "10.0.0.10" - port_in = 80 - external_port = 6303 - - host0 = self.pg0.remote_hosts[0] - host1 = self.pg0.remote_hosts[1] - - self.vapi.nat_det_add_del_map(is_add=1, in_addr=host0.ip4, in_plen=24, - out_addr=socket.inet_aton(nat_ip), - out_plen=32) - flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) - - # host0 to out - p = (Ether(src=host0.mac, dst=self.pg0.local_mac) / - IP(src=host0.ip4, dst=self.pg1.remote_ip4) / - TCP(sport=port_in, dport=external_port)) - self.pg0.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg1.get_capture(1) - p = capture[0] - try: - ip = p[IP] - tcp = p[TCP] - self.assertEqual(ip.src, nat_ip) - self.assertEqual(ip.dst, self.pg1.remote_ip4) - self.assertEqual(tcp.dport, external_port) - port_out0 = tcp.sport - except: - self.logger.error(ppp("Unexpected or invalid packet:", p)) - raise - - # host1 to out - p = (Ether(src=host1.mac, dst=self.pg0.local_mac) / - IP(src=host1.ip4, dst=self.pg1.remote_ip4) / - TCP(sport=port_in, dport=external_port)) - self.pg0.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg1.get_capture(1) - p = capture[0] - try: - ip = p[IP] - tcp = p[TCP] - self.assertEqual(ip.src, nat_ip) - self.assertEqual(ip.dst, self.pg1.remote_ip4) - self.assertEqual(tcp.dport, external_port) - port_out1 = tcp.sport - except: - self.logger.error(ppp("Unexpected or invalid packet:", p)) - raise - - dms = self.vapi.nat_det_map_dump() - self.assertEqual(1, len(dms)) - self.assertEqual(2, dms[0].ses_num) - - # out to host0 - p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / - IP(src=self.pg1.remote_ip4, dst=nat_ip) / - TCP(sport=external_port, dport=port_out0)) - self.pg1.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg0.get_capture(1) - p = capture[0] - try: - ip = p[IP] - tcp = p[TCP] - self.assertEqual(ip.src, self.pg1.remote_ip4) - self.assertEqual(ip.dst, host0.ip4) - self.assertEqual(tcp.dport, port_in) - self.assertEqual(tcp.sport, external_port) - except: - self.logger.error(ppp("Unexpected or invalid packet:", p)) - raise - - # out to host1 - p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / - IP(src=self.pg1.remote_ip4, dst=nat_ip) / - TCP(sport=external_port, dport=port_out1)) - self.pg1.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg0.get_capture(1) - p = capture[0] - try: - ip = p[IP] - tcp = p[TCP] - self.assertEqual(ip.src, self.pg1.remote_ip4) - self.assertEqual(ip.dst, host1.ip4) - self.assertEqual(tcp.dport, port_in) - self.assertEqual(tcp.sport, external_port) - except: - self.logger.error(ppp("Unexpected or invalid packet", p)) - raise - - # session close api test - self.vapi.nat_det_close_session_out(socket.inet_aton(nat_ip), - port_out1, - self.pg1.remote_ip4, - external_port) - dms = self.vapi.nat_det_map_dump() - self.assertEqual(dms[0].ses_num, 1) - - self.vapi.nat_det_close_session_in(host0.ip4, - port_in, - self.pg1.remote_ip4, - external_port) - dms = self.vapi.nat_det_map_dump() - self.assertEqual(dms[0].ses_num, 0) - - def test_tcp_session_close_detection_in(self): - """ Deterministic NAT TCP session close from inside network """ - self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, - in_plen=32, - out_addr=socket.inet_aton(self.nat_addr), - out_plen=32) - flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) - - self.initiate_tcp_session(self.pg0, self.pg1) - - # close the session from inside - try: - # FIN packet in -> out - p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / - IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / - TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, - flags="F")) - self.pg0.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - self.pg1.get_capture(1) - - pkts = [] - - # ACK packet out -> in - p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / - IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / - TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, - flags="A")) - pkts.append(p) - - # FIN packet out -> in - p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / - IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / - TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, - flags="F")) - pkts.append(p) - - self.pg1.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - self.pg0.get_capture(2) - - # ACK packet in -> out - p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / - IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / - TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, - flags="A")) - self.pg0.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - self.pg1.get_capture(1) - - # Check if deterministic NAT44 closed the session - dms = self.vapi.nat_det_map_dump() - self.assertEqual(0, dms[0].ses_num) - except: - self.logger.error("TCP session termination failed") - raise - - def test_tcp_session_close_detection_out(self): - """ Deterministic NAT TCP session close from outside network """ - self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, - in_plen=32, - out_addr=socket.inet_aton(self.nat_addr), - out_plen=32) - flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) - - self.initiate_tcp_session(self.pg0, self.pg1) - - # close the session from outside - try: - # FIN packet out -> in - p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / - IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / - TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, - flags="F")) - self.pg1.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - self.pg0.get_capture(1) - - pkts = [] - - # ACK packet in -> out - p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / - IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / - TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, - flags="A")) - pkts.append(p) - - # ACK packet in -> out - p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / - IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / - TCP(sport=self.tcp_port_in, dport=self.tcp_external_port, - flags="F")) - pkts.append(p) - - self.pg0.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - self.pg1.get_capture(2) - - # ACK packet out -> in - p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / - IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / - TCP(sport=self.tcp_external_port, dport=self.tcp_port_out, - flags="A")) - self.pg1.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - self.pg0.get_capture(1) - - # Check if deterministic NAT44 closed the session - dms = self.vapi.nat_det_map_dump() - self.assertEqual(0, dms[0].ses_num) - except: - self.logger.error("TCP session termination failed") - raise - - @unittest.skipUnless(running_extended_tests, "part of extended tests") - def test_session_timeout(self): - """ Deterministic NAT session timeouts """ - self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, - in_plen=32, - out_addr=socket.inet_aton(self.nat_addr), - out_plen=32) - flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) - - self.initiate_tcp_session(self.pg0, self.pg1) - self.vapi.nat_set_timeouts(udp=5, tcp_established=5, tcp_transitory=5, - icmp=5) - pkts = self.create_stream_in(self.pg0, self.pg1) - self.pg0.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg1.get_capture(len(pkts)) - sleep(15) - - dms = self.vapi.nat_det_map_dump() - self.assertEqual(0, dms[0].ses_num) - - @unittest.skipUnless(running_extended_tests, "part of extended tests") - def test_session_limit_per_user(self): - """ Deterministic NAT maximum sessions per user limit """ - self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4, - in_plen=32, - out_addr=socket.inet_aton(self.nat_addr), - out_plen=32) - flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) - self.vapi.set_ipfix_exporter(collector_address=self.pg2.remote_ip4, - src_address=self.pg2.local_ip4, - path_mtu=512, - template_interval=10) - self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739, - enable=1) - - pkts = [] - for port in range(1025, 2025): - p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / - IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / - UDP(sport=port, dport=port)) - pkts.append(p) - - self.pg0.add_stream(pkts) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg1.get_capture(len(pkts)) - - p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / - IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / - UDP(sport=3001, dport=3002)) - self.pg0.add_stream(p) - self.pg_enable_capture(self.pg_interfaces) - self.pg_start() - capture = self.pg1.assert_nothing_captured() - - # verify ICMP error packet - capture = self.pg0.get_capture(1) - p = capture[0] - self.assertTrue(p.haslayer(ICMP)) - icmp = p[ICMP] - self.assertEqual(icmp.type, 3) - self.assertEqual(icmp.code, 1) - self.assertTrue(icmp.haslayer(IPerror)) - inner_ip = icmp[IPerror] - self.assertEqual(inner_ip[UDPerror].sport, 3001) - self.assertEqual(inner_ip[UDPerror].dport, 3002) - - dms = self.vapi.nat_det_map_dump() - - self.assertEqual(1000, dms[0].ses_num) - - # verify IPFIX logging - self.vapi.ipfix_flush() - sleep(1) - capture = self.pg2.get_capture(2) - ipfix = IPFIXDecoder() - # first load template - for p in capture: - self.assertTrue(p.haslayer(IPFIX)) - if p.haslayer(Template): - ipfix.add_template(p.getlayer(Template)) - # verify events in data set - for p in capture: - if p.haslayer(Data): - data = ipfix.decode_data_set(p.getlayer(Set)) - self.verify_ipfix_max_entries_per_user(data, - 1000, - self.pg0.remote_ip4) - - def clear_nat_det(self): - """ - Clear deterministic NAT configuration. - """ - self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739, - enable=0) - self.vapi.nat_set_timeouts(udp=300, tcp_established=7440, - tcp_transitory=240, icmp=60) - deterministic_mappings = self.vapi.nat_det_map_dump() - for dsm in deterministic_mappings: - self.vapi.nat_det_add_del_map(is_add=0, in_addr=dsm.in_addr, - in_plen=dsm.in_plen, - out_addr=dsm.out_addr, - out_plen=dsm.out_plen) - - interfaces = self.vapi.nat44_interface_dump() - for intf in interfaces: - self.vapi.nat44_interface_add_del_feature( - sw_if_index=intf.sw_if_index, - flags=intf.flags) - - def tearDown(self): - super(TestDeterministicNAT, self).tearDown() - if not self.vpp_dead: - self.clear_nat_det() - - def show_commands_at_teardown(self): - self.logger.info(self.vapi.cli("show nat44 interfaces")) - self.logger.info(self.vapi.cli("show nat timeouts")) - self.logger.info( - self.vapi.cli("show nat44 deterministic mappings")) - self.logger.info( - self.vapi.cli("show nat44 deterministic sessions")) - - class TestNAT64(MethodHolder): """ NAT64 Test Cases """ |