summaryrefslogtreecommitdiffstats
path: root/src/plugins/nat/pnat/pnat_node.h
diff options
context:
space:
mode:
Diffstat (limited to 'src/plugins/nat/pnat/pnat_node.h')
-rw-r--r--src/plugins/nat/pnat/pnat_node.h196
1 files changed, 196 insertions, 0 deletions
diff --git a/src/plugins/nat/pnat/pnat_node.h b/src/plugins/nat/pnat/pnat_node.h
new file mode 100644
index 00000000000..3f2235509fa
--- /dev/null
+++ b/src/plugins/nat/pnat/pnat_node.h
@@ -0,0 +1,196 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_pnat_node_h
+#define included_pnat_node_h
+
+#include "pnat.h"
+#include <pnat/pnat.api_enum.h>
+#include <vnet/feature/feature.h>
+#include <vnet/udp/udp_packet.h>
+#include <vnet/ip/format.h>
+
+/* PNAT next-nodes */
+typedef enum { PNAT_NEXT_DROP, PNAT_N_NEXT } pnat_next_t;
+
+// u8 *format_pnat_key(u8 *s, va_list *args);
+u8 *format_pnat_5tuple(u8 *s, va_list *args);
+static inline u8 *format_pnat_trace(u8 *s, va_list *args) {
+ CLIB_UNUSED(vlib_main_t * vm) = va_arg(*args, vlib_main_t *);
+ CLIB_UNUSED(vlib_node_t * node) = va_arg(*args, vlib_node_t *);
+ pnat_trace_t *t = va_arg(*args, pnat_trace_t *);
+
+ s = format(s, "pnat: index %d\n", t->pool_index);
+ if (t->pool_index != ~0) {
+ s = format(s, " match: %U\n", format_pnat_5tuple, &t->match);
+ s = format(s, " rewrite: %U", format_pnat_5tuple, &t->rewrite);
+ }
+ return s;
+}
+
+/*
+ * Given a packet and rewrite instructions from a translation modify packet.
+ */
+static u32 pnat_rewrite_ip4(u32 pool_index, ip4_header_t *ip) {
+ pnat_main_t *pm = &pnat_main;
+ if (pool_is_free_index(pm->translations, pool_index))
+ return PNAT_ERROR_REWRITE;
+ pnat_translation_t *t = pool_elt_at_index(pm->translations, pool_index);
+
+ ip_csum_t csumd = 0;
+
+ if (t->instructions & PNAT_INSTR_DESTINATION_ADDRESS) {
+ csumd = ip_csum_sub_even(csumd, ip->dst_address.as_u32);
+ csumd = ip_csum_add_even(csumd, t->post_da.as_u32);
+ ip->dst_address = t->post_da;
+ }
+ if (t->instructions & PNAT_INSTR_SOURCE_ADDRESS) {
+ csumd = ip_csum_sub_even(csumd, ip->src_address.as_u32);
+ csumd = ip_csum_add_even(csumd, t->post_sa.as_u32);
+ ip->src_address = t->post_sa;
+ }
+
+ ip_csum_t csum = ip->checksum;
+ csum = ip_csum_sub_even(csum, csumd);
+ ip->checksum = ip_csum_fold(csum);
+ ASSERT(ip->checksum == ip4_header_checksum(ip));
+
+ /* L4 ports */
+ if (ip->protocol == IP_PROTOCOL_TCP) {
+ tcp_header_t *tcp = ip4_next_header(ip);
+ ip_csum_t l4csum = tcp->checksum;
+ if (t->instructions & PNAT_INSTR_DESTINATION_PORT) {
+ l4csum = ip_csum_sub_even(l4csum, tcp->dst_port);
+ l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_dp));
+ tcp->dst_port = clib_net_to_host_u16(t->post_dp);
+ }
+ if (t->instructions & PNAT_INSTR_SOURCE_PORT) {
+ l4csum = ip_csum_sub_even(l4csum, tcp->src_port);
+ l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_sp));
+ tcp->src_port = clib_net_to_host_u16(t->post_sp);
+ }
+ l4csum = ip_csum_sub_even(l4csum, csumd);
+ tcp->checksum = ip_csum_fold(l4csum);
+ } else if (ip->protocol == IP_PROTOCOL_UDP) {
+ udp_header_t *udp = ip4_next_header(ip);
+ ip_csum_t l4csum = udp->checksum;
+ if (t->instructions & PNAT_INSTR_DESTINATION_PORT) {
+ l4csum = ip_csum_sub_even(l4csum, udp->dst_port);
+ l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_dp));
+ udp->dst_port = clib_net_to_host_u16(t->post_dp);
+ }
+ if (t->instructions & PNAT_INSTR_SOURCE_PORT) {
+ l4csum = ip_csum_sub_even(l4csum, udp->src_port);
+ l4csum = ip_csum_add_even(l4csum, clib_net_to_host_u16(t->post_sp));
+ udp->src_port = clib_net_to_host_u16(t->post_sp);
+ }
+ if (udp->checksum) {
+ l4csum = ip_csum_sub_even(l4csum, csumd);
+ udp->checksum = ip_csum_fold(l4csum);
+ }
+ }
+ return PNAT_ERROR_NONE;
+}
+
+/*
+ * Lookup the packet tuple in the flow cache, given the lookup mask.
+ * If a binding is found, rewrite the packet according to instructions,
+ * otherwise follow configured default action (forward, punt or drop)
+ */
+static_always_inline uword pnat_node_inline(vlib_main_t *vm,
+ vlib_node_runtime_t *node,
+ vlib_frame_t *frame,
+ pnat_attachment_point_t attachment,
+ int dir) {
+ pnat_main_t *pm = &pnat_main;
+ u32 n_left_from, *from;
+ u16 nexts[VLIB_FRAME_SIZE] = {0}, *next = nexts;
+ u32 pool_indicies[VLIB_FRAME_SIZE], *pi = pool_indicies;
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
+ clib_bihash_kv_16_8_t kv, value;
+ ip4_header_t *ip0;
+
+ from = vlib_frame_vector_args(frame);
+ n_left_from = frame->n_vectors;
+ vlib_get_buffers(vm, from, b, n_left_from);
+ pnat_interface_t *interface;
+
+ /* Stage 1: build vector of flow hash (based on lookup mask) */
+ while (n_left_from > 0) {
+ u32 sw_if_index0 = vnet_buffer(b[0])->sw_if_index[dir];
+ u16 sport0 = vnet_buffer(b[0])->ip.reass.l4_src_port;
+ u16 dport0 = vnet_buffer(b[0])->ip.reass.l4_dst_port;
+ u32 iph_offset = vnet_buffer(b[0])->ip.reass.save_rewrite_length;
+ ip0 = (ip4_header_t *)(vlib_buffer_get_current(b[0]) + iph_offset);
+ interface = pnat_interface_by_sw_if_index(sw_if_index0);
+ ASSERT(interface);
+ pnat_mask_fast_t mask = interface->lookup_mask_fast[attachment];
+ pnat_calc_key(sw_if_index0, attachment, ip0->src_address,
+ ip0->dst_address, ip0->protocol, sport0, dport0, mask,
+ &kv);
+ /* By default pass packet to next node in the feature chain */
+ vnet_feature_next_u16(next, b[0]);
+
+ if (clib_bihash_search_16_8(&pm->flowhash, &kv, &value) == 0) {
+ /* Cache hit */
+ *pi = value.value;
+ u32 iph_offset = vnet_buffer(b[0])->ip.reass.save_rewrite_length;
+ ip0 = (ip4_header_t *)(vlib_buffer_get_current(b[0]) + iph_offset);
+ u32 errno0 = pnat_rewrite_ip4(value.value, ip0);
+ if (PREDICT_FALSE(errno0)) {
+ next[0] = PNAT_NEXT_DROP;
+ b[0]->error = node->errors[errno0];
+ }
+ } else {
+ /* Cache miss */
+ *pi = ~0;
+ }
+ next += 1;
+
+ /*next: */
+ n_left_from -= 1;
+ b += 1;
+ pi += 1;
+ }
+
+ /* Packet trace */
+ if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE))) {
+ u32 i;
+ b = bufs;
+ pi = pool_indicies;
+ for (i = 0; i < frame->n_vectors; i++) {
+ if (b[0]->flags & VLIB_BUFFER_IS_TRACED) {
+ pnat_trace_t *t = vlib_add_trace(vm, node, b[0], sizeof(*t));
+ if (*pi != ~0) {
+ if (!pool_is_free_index(pm->translations, *pi)) {
+ pnat_translation_t *tr =
+ pool_elt_at_index(pm->translations, *pi);
+ t->match = tr->match;
+ t->rewrite = tr->rewrite;
+ }
+ }
+ t->pool_index = *pi;
+ b += 1;
+ pi += 1;
+ } else
+ break;
+ }
+ }
+
+ vlib_buffer_enqueue_to_next(vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
+}
+#endif