diff options
Diffstat (limited to 'src/plugins')
| -rwxr-xr-x | src/plugins/nat/in2out.c | 711 | ||||
| -rwxr-xr-x | src/plugins/nat/nat.c | 265 | ||||
| -rw-r--r-- | src/plugins/nat/nat_inlines.h | 3 | ||||
| -rwxr-xr-x | src/plugins/nat/nat_reass.c | 49 | ||||
| -rw-r--r-- | src/plugins/nat/nat_reass.h | 10 | ||||
| -rwxr-xr-x | src/plugins/nat/out2in.c | 405 |
6 files changed, 1296 insertions, 147 deletions
diff --git a/src/plugins/nat/in2out.c b/src/plugins/nat/in2out.c index 661d8c1bef9..335bd85c298 100755 --- a/src/plugins/nat/in2out.c +++ b/src/plugins/nat/in2out.c @@ -123,6 +123,7 @@ vlib_node_registration_t nat44_ed_in2out_output_slowpath_node; vlib_node_registration_t nat44_ed_hairpin_dst_node; vlib_node_registration_t nat44_ed_hairpin_src_node; vlib_node_registration_t nat44_ed_hairpinning_node; +vlib_node_registration_t nat44_ed_in2out_reass_node; #define foreach_snat_in2out_error \ _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ @@ -711,6 +712,13 @@ out2: return next0; } +static inline u32 +snat_icmp_hairpinning (snat_main_t *sm, + vlib_buffer_t * b0, + ip4_header_t * ip0, + icmp46_header_t * icmp0, + int is_ed); + static inline u32 icmp_in2out (snat_main_t *sm, vlib_buffer_t * b0, ip4_header_t * ip0, @@ -732,6 +740,7 @@ static inline u32 icmp_in2out (snat_main_t *sm, u8 dont_translate; u32 new_addr0, old_addr0; u16 old_id0, new_id0; + u16 old_checksum0, new_checksum0; ip_csum_t sum0; u16 checksum0; u32 next0_tmp; @@ -745,19 +754,20 @@ static inline u32 icmp_in2out (snat_main_t *sm, if (next0 == SNAT_IN2OUT_NEXT_DROP || dont_translate) goto out; - sum0 = ip_incremental_checksum (0, icmp0, - ntohs(ip0->length) - ip4_header_bytes (ip0)); - checksum0 = ~ip_csum_fold (sum0); - if (PREDICT_FALSE(checksum0 != 0 && checksum0 != 0xffff)) + if (PREDICT_TRUE (!ip4_is_fragment (ip0))) { - next0 = SNAT_IN2OUT_NEXT_DROP; - goto out; + sum0 = ip_incremental_checksum (0, icmp0, + ntohs(ip0->length) - ip4_header_bytes (ip0)); + checksum0 = ~ip_csum_fold (sum0); + if (PREDICT_FALSE(checksum0 != 0 && checksum0 != 0xffff)) + { + next0 = SNAT_IN2OUT_NEXT_DROP; + goto out; + } } old_addr0 = ip0->src_address.as_u32; new_addr0 = ip0->src_address.as_u32 = sm0.addr.as_u32; - if (vnet_buffer(b0)->sw_if_index[VLIB_TX] == ~0) - vnet_buffer(b0)->sw_if_index[VLIB_TX] = sm0.fib_index; sum0 = ip0->checksum; sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, @@ -793,15 +803,27 @@ static inline u32 icmp_in2out (snat_main_t *sm, goto out; } + /* update inner destination IP address */ old_addr0 = inner_ip0->dst_address.as_u32; inner_ip0->dst_address = sm0.addr; new_addr0 = inner_ip0->dst_address.as_u32; - sum0 = icmp0->checksum; sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, dst_address /* changed member */); icmp0->checksum = ip_csum_fold (sum0); + /* update inner IP header checksum */ + old_checksum0 = inner_ip0->checksum; + sum0 = inner_ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + dst_address /* changed member */); + inner_ip0->checksum = ip_csum_fold (sum0); + new_checksum0 = inner_ip0->checksum; + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_checksum0, new_checksum0, ip4_header_t, + checksum); + icmp0->checksum = ip_csum_fold (sum0); + switch (protocol) { case SNAT_PROTOCOL_ICMP: @@ -833,6 +855,14 @@ static inline u32 icmp_in2out (snat_main_t *sm, } } + if (vnet_buffer(b0)->sw_if_index[VLIB_TX] == ~0) + { + if (sm->deterministic || + 0 != snat_icmp_hairpinning(sm, b0, ip0, icmp0, + sm->endpoint_dependent)) + vnet_buffer(b0)->sw_if_index[VLIB_TX] = sm0.fib_index; + } + out: return next0; } @@ -958,84 +988,153 @@ snat_hairpinning (snat_main_t *sm, return 0; } -static inline void +static inline u32 snat_icmp_hairpinning (snat_main_t *sm, vlib_buffer_t * b0, ip4_header_t * ip0, icmp46_header_t * icmp0, int is_ed) { - snat_session_key_t key0, sm0; + snat_session_key_t key0; clib_bihash_kv_8_8_t kv0, value0; - u32 new_dst_addr0 = 0, old_dst_addr0, si, ti = 0; + u32 old_dst_addr0, new_dst_addr0; + u32 old_addr0, new_addr0; + u16 old_port0, new_port0; + u16 old_checksum0, new_checksum0; + u32 si, ti = 0; ip_csum_t sum0; snat_session_t *s0; - int rv; + snat_static_mapping_t *m0; - if (!icmp_is_error_message (icmp0)) + if (icmp_is_error_message (icmp0)) { - icmp_echo_header_t *echo0 = (icmp_echo_header_t *)(icmp0+1); - u16 icmp_id0 = echo0->identifier; - key0.addr = ip0->dst_address; - key0.port = icmp_id0; - key0.protocol = SNAT_PROTOCOL_ICMP; - key0.fib_index = sm->outside_fib_index; - kv0.key = key0.as_u64; + ip4_header_t *inner_ip0 = 0; + tcp_udp_header_t *l4_header = 0; - if (sm->num_workers > 1) - ti = (clib_net_to_host_u16 (icmp_id0) - 1024) / sm->port_per_thread; - else - ti = sm->num_workers; + inner_ip0 = (ip4_header_t *)((icmp_echo_header_t *)(icmp0+1)+1); + l4_header = ip4_next_header (inner_ip0); + u32 protocol = ip_proto_to_snat_proto (inner_ip0->protocol); + + if (protocol != SNAT_PROTOCOL_TCP && protocol != SNAT_PROTOCOL_UDP) + return 1; - /* Check if destination is in active sessions */ if (is_ed) { clib_bihash_kv_16_8_t ed_kv, ed_value; make_ed_kv (&ed_kv, &ip0->dst_address, &ip0->src_address, - IP_PROTOCOL_ICMP, sm->outside_fib_index, icmp_id0, 0); - rv = clib_bihash_search_16_8 (&sm->per_thread_data[ti].out2in_ed, - &ed_kv, &ed_value); + inner_ip0->protocol, sm->outside_fib_index, + l4_header->src_port, l4_header->dst_port); + if (clib_bihash_search_16_8 (&sm->per_thread_data[ti].out2in_ed, + &ed_kv, &ed_value)) + return 1; si = ed_value.value; } else { - rv = clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0, - &value0); + key0.addr = ip0->dst_address; + key0.port = l4_header->src_port; + key0.protocol = protocol; + key0.fib_index = sm->outside_fib_index; + kv0.key = key0.as_u64; + if (clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0, + &value0)) + return 1; si = value0.value; } - if (rv) + s0 = pool_elt_at_index (sm->per_thread_data[ti].sessions, si); + new_dst_addr0 = s0->in2out.addr.as_u32; + vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index; + + /* update inner source IP address */ + old_addr0 = inner_ip0->src_address.as_u32; + inner_ip0->src_address.as_u32 = new_dst_addr0; + new_addr0 = inner_ip0->src_address.as_u32; + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + src_address); + icmp0->checksum = ip_csum_fold (sum0); + + /* update inner IP header checksum */ + old_checksum0 = inner_ip0->checksum; + sum0 = inner_ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t, + src_address); + inner_ip0->checksum = ip_csum_fold (sum0); + new_checksum0 = inner_ip0->checksum; + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_checksum0, new_checksum0, ip4_header_t, + checksum); + icmp0->checksum = ip_csum_fold (sum0); + + /* update inner source port */ + old_port0 = l4_header->src_port; + l4_header->src_port = s0->in2out.port; + new_port0 = l4_header->src_port; + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, old_port0, new_port0, tcp_udp_header_t, + src_port); + icmp0->checksum = ip_csum_fold (sum0); + } + else + { + if (!is_ed) { - /* or static mappings */ - if (!snat_static_mapping_match(sm, key0, &sm0, 1, 0, 0, 0, 0)) + icmp_echo_header_t *echo0 = (icmp_echo_header_t *)(icmp0+1); + u16 icmp_id0 = echo0->identifier; + key0.addr = ip0->dst_address; + key0.port = icmp_id0; + key0.protocol = SNAT_PROTOCOL_ICMP; + key0.fib_index = sm->outside_fib_index; + kv0.key = key0.as_u64; + if (sm->num_workers > 1) + ti = (clib_net_to_host_u16 (icmp_id0) - 1024) / sm->port_per_thread; + else + ti = sm->num_workers; + int rv = clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0, + &value0); + if (!rv) { - new_dst_addr0 = sm0.addr.as_u32; - vnet_buffer(b0)->sw_if_index[VLIB_TX] = sm0.fib_index; + si = value0.value; + s0 = pool_elt_at_index (sm->per_thread_data[ti].sessions, si); + new_dst_addr0 = s0->in2out.addr.as_u32; + vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index; + echo0->identifier = s0->in2out.port; + sum0 = icmp0->checksum; + sum0 = ip_csum_update (sum0, icmp_id0, s0->in2out.port, + icmp_echo_header_t, identifier); + icmp0->checksum = ip_csum_fold (sum0); + goto change_addr; } - } - else - { - s0 = pool_elt_at_index (sm->per_thread_data[ti].sessions, si); - new_dst_addr0 = s0->in2out.addr.as_u32; - vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index; - echo0->identifier = s0->in2out.port; - sum0 = icmp0->checksum; - sum0 = ip_csum_update (sum0, icmp_id0, s0->in2out.port, - icmp_echo_header_t, identifier); - icmp0->checksum = ip_csum_fold (sum0); + ti = 0; } - /* Destination is behind the same NAT, use internal address and port */ - if (new_dst_addr0) - { - old_dst_addr0 = ip0->dst_address.as_u32; - ip0->dst_address.as_u32 = new_dst_addr0; - sum0 = ip0->checksum; - sum0 = ip_csum_update (sum0, old_dst_addr0, new_dst_addr0, - ip4_header_t, dst_address); - ip0->checksum = ip_csum_fold (sum0); - } - } + key0.addr = ip0->dst_address; + key0.port = 0; + key0.protocol = 0; + key0.fib_index = sm->outside_fib_index; + kv0.key = key0.as_u64; + + if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0)) + return 1; + + m0 = pool_elt_at_index (sm->static_mappings, value0.value); + new_dst_addr0 = m0->local_addr.as_u32; + if (vnet_buffer(b0)->sw_if_index[VLIB_TX] == ~0) + vnet_buffer(b0)->sw_if_index[VLIB_TX] = m0->fib_index; + } +change_addr: + /* Destination is behind the same NAT, use internal address and port */ + if (new_dst_addr0) + { + old_dst_addr0 = ip0->dst_address.as_u32; + ip0->dst_address.as_u32 = new_dst_addr0; + sum0 = ip0->checksum; + sum0 = ip_csum_update (sum0, old_dst_addr0, new_dst_addr0, + ip4_header_t, dst_address); + ip0->checksum = ip_csum_fold (sum0); + } + return 0; } static inline u32 icmp_in2out_slow_path (snat_main_t *sm, @@ -1055,9 +1154,6 @@ static inline u32 icmp_in2out_slow_path (snat_main_t *sm, snat_session_t * s0 = *p_s0; if (PREDICT_TRUE(next0 != SNAT_IN2OUT_NEXT_DROP && s0)) { - /* Hairpinning */ - if (vnet_buffer(b0)->sw_if_index[VLIB_TX] == 0) - snat_icmp_hairpinning(sm, b0, ip0, icmp0, sm->endpoint_dependent); /* Accounting */ nat44_session_update_counters (s0, now, vlib_buffer_length_in_chain (sm->vlib_main, b0)); @@ -2014,7 +2110,8 @@ nat44_reass_hairpinning (snat_main_t *sm, ip4_header_t * ip0, u16 sport, u16 dport, - u32 proto0) + u32 proto0, + int is_ed) { snat_session_key_t key0, sm0; snat_session_t * s0; @@ -2024,6 +2121,7 @@ nat44_reass_hairpinning (snat_main_t *sm, u16 new_dst_port0, old_dst_port0; udp_header_t * udp0; tcp_header_t * tcp0; + int rv; key0.addr = ip0->dst_address; key0.port = dport; @@ -2048,9 +2146,24 @@ nat44_reass_hairpinning (snat_main_t *sm, else ti = sm->num_workers; - if (!clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0, &value0)) + if (is_ed) { + clib_bihash_kv_16_8_t ed_kv, ed_value; + make_ed_kv (&ed_kv, &ip0->dst_address, &ip0->src_address, + ip0->protocol, sm->outside_fib_index, udp0->dst_port, + udp0->src_port); + rv = clib_bihash_search_16_8 (&sm->per_thread_data[ti].out2in_ed, + &ed_kv, &ed_value); + si = ed_value.value; + } + else + { + rv = clib_bihash_search_8_8 (&sm->per_thread_data[ti].out2in, &kv0, + &value0); si = value0.value; + } + if (!rv) + { s0 = pool_elt_at_index (sm->per_thread_data[ti].sessions, si); new_dst_addr0 = s0->in2out.addr.as_u32; new_dst_port0 = s0->in2out.port; @@ -2273,7 +2386,7 @@ nat44_in2out_reass_node_fn (vlib_main_t * vm, /* Hairpinning */ nat44_reass_hairpinning (sm, b0, ip0, s0->out2in.port, - s0->ext_host_port, proto0); + s0->ext_host_port, proto0, 0); /* Accounting */ nat44_session_update_counters (s0, now, @@ -3259,6 +3372,18 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm, } else { + if (PREDICT_FALSE (proto0 == ~0)) + { + next0 = SNAT_IN2OUT_NEXT_SLOW_PATH; + goto trace00; + } + + if (ip4_is_fragment (ip0)) + { + next0 = SNAT_IN2OUT_NEXT_REASS; + goto trace00; + } + if (is_output_feature) { if (PREDICT_FALSE(nat_not_translate_output_feature_fwd( @@ -3266,18 +3391,11 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm, goto trace00; } - if (PREDICT_FALSE (proto0 == ~0 || proto0 == SNAT_PROTOCOL_ICMP)) - { - next0 = SNAT_IN2OUT_NEXT_SLOW_PATH; - goto trace00; - } - - if (ip4_is_fragment (ip0)) - { - b0->error = node->errors[SNAT_IN2OUT_ERROR_DROP_FRAGMENT]; - next0 = SNAT_IN2OUT_NEXT_DROP; - goto trace00; - } + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP)) + { + next0 = SNAT_IN2OUT_NEXT_SLOW_PATH; + goto trace00; + } } make_ed_kv (&kv0, &ip0->src_address, &ip0->dst_address, ip0->protocol, @@ -3444,6 +3562,18 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm, } else { + if (PREDICT_FALSE (proto1 == ~0)) + { + next1 = SNAT_IN2OUT_NEXT_SLOW_PATH; + goto trace01; + } + + if (ip4_is_fragment (ip1)) + { + next1 = SNAT_IN2OUT_NEXT_REASS; + goto trace01; + } + if (is_output_feature) { if (PREDICT_FALSE(nat_not_translate_output_feature_fwd( @@ -3451,18 +3581,11 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm, goto trace01; } - if (PREDICT_FALSE (proto1 == ~0 || proto1 == SNAT_PROTOCOL_ICMP)) - { - next1 = SNAT_IN2OUT_NEXT_SLOW_PATH; - goto trace01; - } - - if (ip4_is_fragment (ip1)) - { - b1->error = node->errors[SNAT_IN2OUT_ERROR_DROP_FRAGMENT]; - next1 = SNAT_IN2OUT_NEXT_DROP; - goto trace01; - } + if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP)) + { + next1 = SNAT_IN2OUT_NEXT_SLOW_PATH; + goto trace01; + } } make_ed_kv (&kv1, &ip1->src_address, &ip1->dst_address, ip1->protocol, @@ -3658,23 +3781,28 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm, } else { - if (is_output_feature) + if (PREDICT_FALSE (proto0 == ~0)) { - if (PREDICT_FALSE(nat_not_translate_output_feature_fwd( - sm, ip0, thread_index, now, vm, b0))) - goto trace0; + next0 = SNAT_IN2OUT_NEXT_SLOW_PATH; + goto trace0; } - if (PREDICT_FALSE (proto0 == ~0 || proto0 == SNAT_PROTOCOL_ICMP)) + if (ip4_is_fragment (ip0)) { - next0 = SNAT_IN2OUT_NEXT_SLOW_PATH; + next0 = SNAT_IN2OUT_NEXT_REASS; goto trace0; } - if (ip4_is_fragment (ip0)) + if (is_output_feature) + { + if (PREDICT_FALSE(nat_not_translate_output_feature_fwd( + sm, ip0, thread_index, now, vm, b0))) + goto trace0; + } + + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP)) { - b0->error = node->errors[SNAT_IN2OUT_ERROR_DROP_FRAGMENT]; - next0 = SNAT_IN2OUT_NEXT_DROP; + next0 = SNAT_IN2OUT_NEXT_SLOW_PATH; goto trace0; } } @@ -3835,7 +3963,7 @@ VLIB_REGISTER_NODE (nat44_ed_in2out_node) = { [SNAT_IN2OUT_NEXT_LOOKUP] = "ip4-lookup", [SNAT_IN2OUT_NEXT_SLOW_PATH] = "nat44-ed-in2out-slowpath", [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", - [SNAT_IN2OUT_NEXT_REASS] = "nat44-in2out-reass", + [SNAT_IN2OUT_NEXT_REASS] = "nat44-ed-in2out-reass", }, }; @@ -3869,7 +3997,7 @@ VLIB_REGISTER_NODE (nat44_ed_in2out_output_node) = { [SNAT_IN2OUT_NEXT_LOOKUP] = "interface-output", [SNAT_IN2OUT_NEXT_SLOW_PATH] = "nat44-ed-in2out-output-slowpath", [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", - [SNAT_IN2OUT_NEXT_REASS] = "nat44-in2out-reass", + [SNAT_IN2OUT_NEXT_REASS] = "nat44-ed-in2out-reass-output", }, }; @@ -3904,7 +4032,7 @@ VLIB_REGISTER_NODE (nat44_ed_in2out_slowpath_node) = { [SNAT_IN2OUT_NEXT_LOOKUP] = "ip4-lookup", [SNAT_IN2OUT_NEXT_SLOW_PATH] = "nat44-ed-in2out-slowpath", [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", - [SNAT_IN2OUT_NEXT_REASS] = "nat44-in2out-reass", + [SNAT_IN2OUT_NEXT_REASS] = "nat44-ed-in2out-reass", }, }; @@ -3939,13 +4067,394 @@ VLIB_REGISTER_NODE (nat44_ed_in2out_output_slowpath_node) = { [SNAT_IN2OUT_NEXT_LOOKUP] = "interface-output", [SNAT_IN2OUT_NEXT_SLOW_PATH] = "nat44-ed-in2out-output-slowpath", [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", - [SNAT_IN2OUT_NEXT_REASS] = "nat44-in2out-reass", + [SNAT_IN2OUT_NEXT_REASS] = "nat44-ed-in2out-reass", }, }; VLIB_NODE_FUNCTION_MULTIARCH (nat44_ed_in2out_output_slowpath_node, nat44_ed_in2out_output_slow_path_fn); +static inline uword +nat44_ed_in2out_reass_node_fn_inline (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame, + int is_output_feature) +{ + u32 n_left_from, *from, *to_next; + snat_in2out_next_t next_index; + u32 pkts_processed = 0; + snat_main_t *sm = &snat_main; + f64 now = vlib_time_now (vm); + u32 thread_index = vm->thread_index; + snat_main_per_thread_data_t *per_thread_data = + &sm->per_thread_data[thread_index]; + u32 *fragments_to_drop = 0; + u32 *fragments_to_loopback = 0; + + from = vlib_frame_vector_args (frame); + n_left_from = frame->n_vectors; + next_index = node->cached_next_index; + + while (n_left_from > 0) + { + u32 n_left_to_next; + + vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); + + while (n_left_from > 0 && n_left_to_next > 0) + { + u32 bi0, sw_if_index0, proto0, rx_fib_index0, new_addr0, old_addr0; + u32 iph_offset0 = 0; + vlib_buffer_t *b0; + u32 next0; + u8 cached0 = 0; + ip4_header_t *ip0 = 0; + nat_reass_ip4_t *reass0; + udp_header_t * udp0; + tcp_header_t * tcp0; + icmp46_header_t * icmp0; + clib_bihash_kv_16_8_t kv0, value0; + snat_session_t * s0 = 0; + u16 old_port0, new_port0; + ip_csum_t sum0; + + /* speculatively enqueue b0 to the current next frame */ + bi0 = from[0]; + to_next[0] = bi0; + from += 1; + to_next += 1; + n_left_from -= 1; + n_left_to_next -= 1; + + b0 = vlib_get_buffer (vm, bi0); + + next0 = SNAT_IN2OUT_NEXT_LOOKUP; + + sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX]; + rx_fib_index0 = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, + sw_if_index0); + + if (PREDICT_FALSE (nat_reass_is_drop_frag(0))) + { + next0 = SNAT_IN2OUT_NEXT_DROP; + b0->error = node->errors[SNAT_IN2OUT_ERROR_DROP_FRAGMENT]; + goto trace0; + } + + if (is_output_feature) + iph_offset0 = vnet_buffer (b0)->ip.save_rewrite_length; + + ip0 = (ip4_header_t *) ((u8 *) vlib_buffer_get_current (b0) + + iph_offset0); + + udp0 = ip4_next_header (ip0); + tcp0 = (tcp_header_t *) udp0; + icmp0 = (icmp46_header_t *) udp0; + proto0 = ip_proto_to_snat_proto (ip0->protocol); + + reass0 = nat_ip4_reass_find_or_create (ip0->src_address, + ip0->dst_address, + ip0->fragment_id, + ip0->protocol, + 1, + &fragments_to_drop); + + if (PREDICT_FALSE (!reass0)) + { + next0 = SNAT_IN2OUT_NEXT_DROP; + b0->error = node->errors[SNAT_IN2OUT_ERROR_MAX_REASS]; + nat_log_notice ("maximum reassemblies exceeded"); + goto trace0; + } + + if (PREDICT_FALSE (ip4_is_first_fragment (ip0))) + { + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP)) + { + if (is_output_feature) + { + if (PREDICT_FALSE(nat_not_translate_output_feature_fwd( + sm, ip0, thread_index, now, vm, b0))) + reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE; + goto trace0; + } + + next0 = icmp_in2out_slow_path + (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node, + next0, now, thread_index, &s0); + + if (PREDICT_TRUE(next0 != SNAT_IN2OUT_NEXT_DROP)) + { + if (s0) + reass0->sess_index = s0 - per_thread_data->sessions; + else + reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE; + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + } + + goto trace0; + } + + make_ed_kv (&kv0, &ip0->src_address, &ip0->dst_address, ip0->protocol, + rx_fib_index0, udp0->src_port, udp0->dst_port); + + if (clib_bihash_search_16_8 (&per_thread_data->in2out_ed, &kv0, &value0)) + { + if (is_output_feature) + { + if (PREDICT_FALSE(nat44_ed_not_translate_output_feature( + sm, ip0, ip0->protocol, udp0->src_port, + udp0->dst_port, thread_index, sw_if_index0, + vnet_buffer(b0)->sw_if_index[VLIB_TX]))) + { + reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE; + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + goto trace0; + } + } + else + { + if (PREDICT_FALSE(nat44_ed_not_translate(sm, node, + sw_if_index0, ip0, proto0, rx_fib_index0, + thread_index))) + { + reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE; + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + goto trace0; + } + } + + next0 = slow_path_ed (sm, b0, rx_fib_index0, &kv0, + &s0, node, next0, thread_index, now); + + if (PREDICT_FALSE (next0 == SNAT_IN2OUT_NEXT_DROP)) + goto trace0; + + reass0->sess_index = s0 - per_thread_data->sessions; + } + else + { + s0 = pool_elt_at_index (per_thread_data->sessions, + value0.value); + reass0->sess_index = value0.value; + } + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + } + else + { + if (reass0->flags & NAT_REASS_FLAG_ED_DONT_TRANSLATE) + goto trace0; + if (PREDICT_FALSE (reass0->sess_index == (u32) ~0)) + { + if (nat_ip4_reass_add_fragment (reass0, bi0, &fragments_to_drop)) + { + b0->error = node->errors[SNAT_IN2OUT_ERROR_MAX_FRAG]; + nat_log_notice ("maximum fragments per reassembly exceeded"); + next0 = SNAT_IN2OUT_NEXT_DROP; + goto trace0; + } + cached0 = 1; + goto trace0; + } + s0 = pool_elt_at_index (per_thread_data->sessions, + reass0->sess_index); + } + + old_addr0 = ip0->src_address.as_u32; + ip0->src_address = s0->out2in.addr; + new_addr0 = ip0->src_address.as_u32; + if (!is_output_feature) + vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->out2in.fib_index; + + sum0 = ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, + ip4_header_t, + src_address /* changed member */); + if (PREDICT_FALSE (is_twice_nat_session (s0))) + sum0 = ip_csum_update (sum0, ip0->dst_address.as_u32, + s0->ext_host_addr.as_u32, ip4_header_t, + dst_address); + ip0->checksum = ip_csum_fold (sum0); + + if (PREDICT_FALSE (ip4_is_first_fragment (ip0))) + { + if (PREDICT_TRUE(proto0 == SNAT_PROTOCOL_TCP)) + { + old_port0 = tcp0->src_port; + tcp0->src_port = s0->out2in.port; + new_port0 = tcp0->src_port; + + sum0 = tcp0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, + ip4_header_t, + dst_address /* changed member */); + sum0 = ip_csum_update (sum0, old_port0, new_port0, + ip4_header_t /* cheat */, + length /* changed member */); + if (PREDICT_FALSE (is_twice_nat_session (s0))) + { + sum0 = ip_csum_update (sum0, ip0->dst_address.as_u32, + s0->ext_host_addr.as_u32, + ip4_header_t, dst_address); + sum0 = ip_csum_update (sum0, tcp0->dst_port, + s0->ext_host_port, ip4_header_t, + length); + tcp0->dst_port = s0->ext_host_port; + ip0->dst_address.as_u32 = s0->ext_host_addr.as_u32; + } + tcp0->checksum = ip_csum_fold(sum0); + } + else + { + old_port0 = udp0->src_port; + udp0->src_port = s0->out2in.port; + udp0->checksum = 0; + if (PREDICT_FALSE (is_twice_nat_session (s0))) + { + udp0->dst_port = s0->ext_host_port; + ip0->dst_address.as_u32 = s0->ext_host_addr.as_u32; + } + } + } + + /* Hairpinning */ + if (PREDICT_TRUE(proto0 != SNAT_PROTOCOL_ICMP)) + nat44_reass_hairpinning (sm, b0, ip0, s0->out2in.port, + s0->ext_host_port, proto0, 1); + else + snat_icmp_hairpinning(sm, b0, ip0, icmp0, 1); + + /* Accounting */ + nat44_session_update_counters (s0, now, + vlib_buffer_length_in_chain (vm, b0)); + /* Per-user LRU list maintenance */ + nat44_session_update_lru (sm, s0, thread_index); + + trace0: + if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE) + && (b0->flags & VLIB_BUFFER_IS_TRACED))) + { + nat44_in2out_reass_trace_t *t = + vlib_add_trace (vm, node, b0, sizeof (*t)); + t->cached = cached0; + t->sw_if_index = sw_if_index0; + t->next_index = next0; + } + + if (cached0) + { + n_left_to_next++; + to_next--; + } + else + { + pkts_processed += next0 != SNAT_IN2OUT_NEXT_DROP; + + /* verify speculative enqueue, maybe switch current next frame */ + vlib_validate_buffer_enqueue_x1 (vm, node, next_index, + to_next, n_left_to_next, + bi0, next0); + } + + if (n_left_from == 0 && vec_len (fragments_to_loopback)) + { + from = vlib_frame_vector_args (frame); + u32 len = vec_len (fragments_to_loopback); + if (len <= VLIB_FRAME_SIZE) + { + clib_memcpy (from, fragments_to_loopback, sizeof (u32) * len); + n_left_from = len; + vec_reset_length (fragments_to_loopback); + } + else + { + clib_memcpy (from, + fragments_to_loopback + (len - VLIB_FRAME_SIZE), + sizeof (u32) * VLIB_FRAME_SIZE); + n_left_from = VLIB_FRAME_SIZE; + _vec_len (fragments_to_loopback) = len - VLIB_FRAME_SIZE; + } + } + } + + vlib_put_next_frame (vm, node, next_index, n_left_to_next); + } + + vlib_node_increment_counter (vm, nat44_in2out_reass_node.index, + SNAT_IN2OUT_ERROR_IN2OUT_PACKETS, + pkts_processed); + + nat_send_all_to_node (vm, fragments_to_drop, node, + &node->errors[SNAT_IN2OUT_ERROR_DROP_FRAGMENT], + SNAT_IN2OUT_NEXT_DROP); + + vec_free (fragments_to_drop); + vec_free (fragments_to_loopback); + return frame->n_vectors; +} + +static uword +nat44_ed_in2out_reass_node_fn (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return nat44_ed_in2out_reass_node_fn_inline (vm, node, frame, 0); +} + +VLIB_REGISTER_NODE (nat44_ed_in2out_reass_node) = { + .function = nat44_ed_in2out_reass_node_fn, + .name = "nat44-ed-in2out-reass", + .vector_size = sizeof (u32), + .format_trace = format_nat44_in2out_reass_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_errors = ARRAY_LEN(snat_in2out_error_strings), + .error_strings = snat_in2out_error_strings, + + .n_next_nodes = SNAT_IN2OUT_N_NEXT, + .next_nodes = { + [SNAT_IN2OUT_NEXT_DROP] = "error-drop", + [SNAT_IN2OUT_NEXT_LOOKUP] = "ip4-lookup", + [SNAT_IN2OUT_NEXT_SLOW_PATH] = "nat44-in2out-slowpath", + [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", + [SNAT_IN2OUT_NEXT_REASS] = "nat44-ed-in2out-reass", + }, +}; + +VLIB_NODE_FUNCTION_MULTIARCH (nat44_ed_in2out_reass_node, + nat44_ed_in2out_reass_node_fn); + +static uword +nat44_ed_in2out_reass_output_node_fn (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return nat44_ed_in2out_reass_node_fn_inline (vm, node, frame, 1); +} + +VLIB_REGISTER_NODE (nat44_ed_in2out_reass_output_node) = { + .function = nat44_ed_in2out_reass_output_node_fn, + .name = "nat44-ed-in2out-reass-output", + .vector_size = sizeof (u32), + .format_trace = format_nat44_in2out_reass_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_errors = ARRAY_LEN(snat_in2out_error_strings), + .error_strings = snat_in2out_error_strings, + + .n_next_nodes = SNAT_IN2OUT_N_NEXT, + .next_nodes = { + [SNAT_IN2OUT_NEXT_DROP] = "error-drop", + [SNAT_IN2OUT_NEXT_LOOKUP] = "interface-output", + [SNAT_IN2OUT_NEXT_SLOW_PATH] = "nat44-in2out-slowpath", + [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error", + [SNAT_IN2OUT_NEXT_REASS] = "nat44-ed-in2out-reass", + }, +}; + +VLIB_NODE_FUNCTION_MULTIARCH (nat44_ed_in2out_reass_output_node, + nat44_ed_in2out_reass_output_node_fn); + /**************************/ /*** deterministic mode ***/ /**************************/ diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c index c3583cabc21..d4c266a2b16 100755 --- a/src/plugins/nat/nat.c +++ b/src/plugins/nat/nat.c @@ -178,9 +178,27 @@ vlib_node_registration_t nat44_ed_classify_node; vlib_node_registration_t nat44_det_classify_node; vlib_node_registration_t nat44_handoff_classify_node; +#define foreach_nat44_classify_error \ +_(MAX_REASS, "Maximum reassemblies exceeded") \ +_(MAX_FRAG, "Maximum fragments per reassembly exceeded") + +typedef enum { +#define _(sym,str) NAT44_CLASSIFY_ERROR_##sym, + foreach_nat44_classify_error +#undef _ + NAT44_CLASSIFY_N_ERROR, +} nat44_classify_error_t; + +static char * nat44_classify_error_strings[] = { +#define _(sym,string) string, + foreach_nat44_classify_error +#undef _ +}; + typedef enum { NAT44_CLASSIFY_NEXT_IN2OUT, NAT44_CLASSIFY_NEXT_OUT2IN, + NAT44_CLASSIFY_NEXT_DROP, NAT44_CLASSIFY_N_NEXT, } nat44_classify_next_t; @@ -438,6 +456,7 @@ nat_ed_session_alloc (snat_main_t *sm, snat_user_t *u, u32 thread_index) typedef struct { u8 next_in2out; + u8 cached; } nat44_classify_trace_t; static u8 * format_nat44_classify_trace (u8 * s, va_list * args) @@ -447,9 +466,13 @@ static u8 * format_nat44_classify_trace (u8 * s, va_list * args) nat44_classify_trace_t *t = va_arg (*args, nat44_classify_trace_t *); char *next; - next = t->next_in2out ? "nat44-in2out" : "nat44-out2in"; - - s = format (s, "nat44-classify: next %s", next); + if (t->cached) + s = format (s, "nat44-classify: fragment cached"); + else + { + next = t->next_in2out ? "nat44-in2out" : "nat44-out2in"; + s = format (s, "nat44-classify: next %s", next); + } return s; } @@ -466,6 +489,8 @@ nat44_classify_node_fn_inline (vlib_main_t * vm, snat_static_mapping_t *m; u32 thread_index = vm->thread_index; snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index]; + u32 *fragments_to_drop = 0; + u32 *fragments_to_loopback = 0; from = vlib_frame_vector_args (frame); n_left_from = frame->n_vectors; @@ -489,6 +514,8 @@ nat44_classify_node_fn_inline (vlib_main_t * vm, clib_bihash_kv_8_8_t kv0, value0; clib_bihash_kv_16_8_t ed_kv0, ed_value0; udp_header_t *udp0; + nat_reass_ip4_t *reass0; + u8 cached0 = 0; /* speculatively enqueue b0 to the current next frame */ bi0 = from[0]; @@ -502,17 +529,102 @@ nat44_classify_node_fn_inline (vlib_main_t * vm, ip0 = vlib_buffer_get_current (b0); udp0 = ip4_next_header (ip0); - if (is_ed) + if (is_ed && ip0->protocol != IP_PROTOCOL_ICMP) { - sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX]; - rx_fib_index0 = - fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, - sw_if_index0); - make_ed_kv (&ed_kv0, &ip0->src_address, &ip0->dst_address, - ip0->protocol, rx_fib_index0, udp0->src_port, - udp0->dst_port); - if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &ed_kv0, &ed_value0)) - goto enqueue0; + if (!ip4_is_fragment (ip0) || ip4_is_first_fragment (ip0)) + { + /* process leading fragment/whole packet (with L4 header) */ + sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX]; + rx_fib_index0 = + fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, + sw_if_index0); + make_ed_kv (&ed_kv0, &ip0->src_address, &ip0->dst_address, + ip0->protocol, rx_fib_index0, udp0->src_port, + udp0->dst_port); + if (ip4_is_fragment (ip0)) + { + reass0 = nat_ip4_reass_find_or_create (ip0->src_address, + ip0->dst_address, + ip0->fragment_id, + ip0->protocol, + 1, + &fragments_to_drop); + if (PREDICT_FALSE (!reass0)) + { + next0 = NAT44_CLASSIFY_NEXT_DROP; + b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS]; + nat_log_notice ("maximum reassemblies exceeded"); + goto enqueue0; + } + if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &ed_kv0, + &ed_value0)) + { + /* session exists so classify as IN2OUT, + * save this information for future fragments and set + * past fragments to be looped over and reprocessed */ + reass0->sess_index = ed_value0.value; + reass0->classify_next = NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT; + nat_ip4_reass_get_frags (reass0, + &fragments_to_loopback); + goto enqueue0; + } + else + { + /* session doesn't exist so continue in the code, + * save this information for future fragments and set + * past fragments to be looped over and reprocessed */ + reass0->flags |= NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE; + nat_ip4_reass_get_frags (reass0, + &fragments_to_loopback); + } + } + else + { + /* process whole packet */ + if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &ed_kv0, + &ed_value0)) + goto enqueue0; + /* session doesn't exist so continue in code */ + } + } + else + { + /* process non-first fragment */ + reass0 = nat_ip4_reass_find_or_create (ip0->src_address, + ip0->dst_address, + ip0->fragment_id, + ip0->protocol, + 1, + &fragments_to_drop); + if (PREDICT_FALSE (!reass0)) + { + next0 = NAT44_CLASSIFY_NEXT_DROP; + b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS]; + nat_log_notice ("maximum reassemblies exceeded"); + goto enqueue0; + } + /* check if first fragment has arrived */ + if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NONE && + !(reass0->flags & NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE)) + { + /* first fragment still hasn't arrived, cache this fragment */ + if (nat_ip4_reass_add_fragment (reass0, bi0, + &fragments_to_drop)) + { + b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_FRAG]; + nat_log_notice ("maximum fragments per reassembly exceeded"); + next0 = NAT44_CLASSIFY_NEXT_DROP; + goto enqueue0; + } + cached0 = 1; + goto enqueue0; + } + if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT) + goto enqueue0; + /* flag NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE is set + * so keep the default next0 and continue in code to + * potentially find other classification for this packet */ + } } vec_foreach (ap, sm->addresses) @@ -531,21 +643,86 @@ nat44_classify_node_fn_inline (vlib_main_t * vm, m_key0.protocol = 0; m_key0.fib_index = 0; kv0.key = m_key0.as_u64; - if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0)) + /* try to classify the fragment based on IP header alone */ + if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, + &kv0, &value0)) { m = pool_elt_at_index (sm->static_mappings, value0.value); if (m->local_addr.as_u32 != m->external_addr.as_u32) next0 = NAT44_CLASSIFY_NEXT_OUT2IN; goto enqueue0; } - m_key0.port = clib_net_to_host_u16 (udp0->dst_port); - m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol); - kv0.key = m_key0.as_u64; - if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0)) + if (!ip4_is_fragment (ip0) || ip4_is_first_fragment (ip0)) { - m = pool_elt_at_index (sm->static_mappings, value0.value); - if (m->local_addr.as_u32 != m->external_addr.as_u32) + /* process leading fragment/whole packet (with L4 header) */ + m_key0.port = clib_net_to_host_u16 (udp0->dst_port); + m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol); + kv0.key = m_key0.as_u64; + if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, + &kv0, &value0)) + { + m = pool_elt_at_index (sm->static_mappings, value0.value); + if (m->local_addr.as_u32 != m->external_addr.as_u32) + next0 = NAT44_CLASSIFY_NEXT_OUT2IN; + } + if (ip4_is_fragment (ip0)) + { + reass0 = nat_ip4_reass_find_or_create (ip0->src_address, + ip0->dst_address, + ip0->fragment_id, + ip0->protocol, + 1, + &fragments_to_drop); + if (PREDICT_FALSE (!reass0)) + { + next0 = NAT44_CLASSIFY_NEXT_DROP; + b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS]; + nat_log_notice ("maximum reassemblies exceeded"); + goto enqueue0; + } + /* save classification for future fragments and set past + * fragments to be looped over and reprocessed */ + if (next0 == NAT44_CLASSIFY_NEXT_OUT2IN) + reass0->classify_next = NAT_REASS_IP4_CLASSIFY_NEXT_OUT2IN; + else + reass0->classify_next = NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT; + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + } + } + else + { + /* process non-first fragment */ + reass0 = nat_ip4_reass_find_or_create (ip0->src_address, + ip0->dst_address, + ip0->fragment_id, + ip0->protocol, + 1, + &fragments_to_drop); + if (PREDICT_FALSE (!reass0)) + { + next0 = NAT44_CLASSIFY_NEXT_DROP; + b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS]; + nat_log_notice ("maximum reassemblies exceeded"); + goto enqueue0; + } + if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NONE) + /* first fragment still hasn't arrived */ + { + if (nat_ip4_reass_add_fragment (reass0, bi0, + &fragments_to_drop)) + { + b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_FRAG]; + nat_log_notice ("maximum fragments per reassembly exceeded"); + next0 = NAT44_CLASSIFY_NEXT_DROP; + goto enqueue0; + } + cached0 = 1; + goto enqueue0; + } + else if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NEXT_OUT2IN) next0 = NAT44_CLASSIFY_NEXT_OUT2IN; + else if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT) + next0 = NAT44_CLASSIFY_NEXT_IN2OUT; } } @@ -555,18 +732,50 @@ nat44_classify_node_fn_inline (vlib_main_t * vm, { nat44_classify_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); - t->next_in2out = next0 == NAT44_CLASSIFY_NEXT_IN2OUT ? 1 : 0; + t->cached = cached0; + if (!cached0) + t->next_in2out = next0 == NAT44_CLASSIFY_NEXT_IN2OUT ? 1 : 0; } - /* verify speculative enqueue, maybe switch current next frame */ - vlib_validate_buffer_enqueue_x1 (vm, node, next_index, - to_next, n_left_to_next, - bi0, next0); + if (cached0) + { + n_left_to_next++; + to_next--; + } + else + /* verify speculative enqueue, maybe switch current next frame */ + vlib_validate_buffer_enqueue_x1 (vm, node, next_index, + to_next, n_left_to_next, + bi0, next0); + + if (n_left_from == 0 && vec_len (fragments_to_loopback)) + { + from = vlib_frame_vector_args (frame); + u32 len = vec_len (fragments_to_loopback); + if (len <= VLIB_FRAME_SIZE) + { + clib_memcpy (from, fragments_to_loopback, sizeof (u32) * len); + n_left_from = len; + vec_reset_length (fragments_to_loopback); + } + else + { + clib_memcpy (from, + fragments_to_loopback + (len - VLIB_FRAME_SIZE), + sizeof (u32) * VLIB_FRAME_SIZE); + n_left_from = VLIB_FRAME_SIZE; + _vec_len (fragments_to_loopback) = len - VLIB_FRAME_SIZE; + } + } } vlib_put_next_frame (vm, node, next_index, n_left_to_next); } + nat_send_all_to_node (vm, fragments_to_drop, node, 0, NAT44_CLASSIFY_NEXT_DROP); + + vec_free (fragments_to_drop); + return frame->n_vectors; } @@ -584,10 +793,13 @@ VLIB_REGISTER_NODE (nat44_classify_node) = { .vector_size = sizeof (u32), .format_trace = format_nat44_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, + .n_errors = ARRAY_LEN(nat44_classify_error_strings), + .error_strings = nat44_classify_error_strings, .n_next_nodes = NAT44_CLASSIFY_N_NEXT, .next_nodes = { [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out", [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in", + [NAT44_CLASSIFY_NEXT_DROP] = "error-drop", }, }; @@ -611,6 +823,7 @@ VLIB_REGISTER_NODE (nat44_ed_classify_node) = { .next_nodes = { [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-ed-in2out", [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-ed-out2in", + [NAT44_CLASSIFY_NEXT_DROP] = "error-drop", }, }; @@ -635,6 +848,7 @@ VLIB_REGISTER_NODE (nat44_det_classify_node) = { .next_nodes = { [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out", [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in", + [NAT44_CLASSIFY_NEXT_DROP] = "error-drop", }, }; @@ -659,6 +873,7 @@ VLIB_REGISTER_NODE (nat44_handoff_classify_node) = { .next_nodes = { [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out-worker-handoff", [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in-worker-handoff", + [NAT44_CLASSIFY_NEXT_DROP] = "error-drop", }, }; diff --git a/src/plugins/nat/nat_inlines.h b/src/plugins/nat/nat_inlines.h index 8922c05c393..4c79fd4124c 100644 --- a/src/plugins/nat/nat_inlines.h +++ b/src/plugins/nat/nat_inlines.h @@ -120,7 +120,8 @@ nat_send_all_to_node (vlib_main_t * vm, u32 * bi_vector, to_next += 1; n_left_to_next -= 1; vlib_buffer_t *p0 = vlib_get_buffer (vm, bi0); - p0->error = *error; + if (error) + p0->error = *error; vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, n_left_to_next, bi0, next); } diff --git a/src/plugins/nat/nat_reass.c b/src/plugins/nat/nat_reass.c index 8fd370de2fc..1a5aeebdf7c 100755 --- a/src/plugins/nat/nat_reass.c +++ b/src/plugins/nat/nat_reass.c @@ -250,7 +250,7 @@ nat_ip4_reass_find_or_create (ip4_address_t src, ip4_address_t dst, reass->lru_list_index); } - if (reass->flags && NAT_REASS_FLAG_MAX_FRAG_DROP) + if (reass->flags & NAT_REASS_FLAG_MAX_FRAG_DROP) { reass = 0; goto unlock; @@ -320,6 +320,8 @@ nat_ip4_reass_find_or_create (ip4_address_t src, ip4_address_t dst, reass->thread_index = (u32) ~ 0; reass->last_heard = now; reass->frag_n = 0; + reass->flags = 0; + reass->classify_next = NAT_REASS_IP4_CLASSIFY_NONE; if (clib_bihash_add_del_16_8 (&srm->ip4_reass_hash, &kv, 1)) { @@ -457,7 +459,7 @@ nat_ip6_reass_find_or_create (ip6_address_t src, ip6_address_t dst, reass->lru_list_index); } - if (reass->flags && NAT_REASS_FLAG_MAX_FRAG_DROP) + if (reass->flags & NAT_REASS_FLAG_MAX_FRAG_DROP) { reass = 0; goto unlock; @@ -724,12 +726,51 @@ static int nat_ip4_reass_walk_cli (nat_reass_ip4_t * reass, void *ctx) { vlib_main_t *vm = ctx; + u8 *flags_str = 0; + const char *classify_next_str; - vlib_cli_output (vm, " src %U dst %U proto %u id 0x%04x cached %u", + if (reass->flags & NAT_REASS_FLAG_MAX_FRAG_DROP) + flags_str = format (flags_str, "MAX_FRAG_DROP"); + if (reass->flags & NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE) + { + if (flags_str) + flags_str = format (flags_str, " | "); + flags_str = format (flags_str, "CLASSIFY_ED_CONTINUE"); + } + if (reass->flags & NAT_REASS_FLAG_ED_DONT_TRANSLATE) + { + if (flags_str) + flags_str = format (flags_str, " | "); + flags_str = format (flags_str, "CLASSIFY_ED_DONT_TRANSLATE"); + } + if (!flags_str) + flags_str = format (flags_str, "0"); + flags_str = format (flags_str, "%c", 0); + + switch (reass->classify_next) + { + case NAT_REASS_IP4_CLASSIFY_NONE: + classify_next_str = "NONE"; + break; + case NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT: + classify_next_str = "IN2OUT"; + break; + case NAT_REASS_IP4_CLASSIFY_NEXT_OUT2IN: + classify_next_str = "OUT2IN"; + break; + default: + classify_next_str = "invalid value"; + } + + vlib_cli_output (vm, " src %U dst %U proto %u id 0x%04x cached %u " + "flags %s classify_next %s", format_ip4_address, &reass->key.src, format_ip4_address, &reass->key.dst, reass->key.proto, - clib_net_to_host_u16 (reass->key.frag_id), reass->frag_n); + clib_net_to_host_u16 (reass->key.frag_id), reass->frag_n, + flags_str, classify_next_str); + + vec_free (flags_str); return 0; } diff --git a/src/plugins/nat/nat_reass.h b/src/plugins/nat/nat_reass.h index 5b18d1bd7b9..579961d72c9 100644 --- a/src/plugins/nat/nat_reass.h +++ b/src/plugins/nat/nat_reass.h @@ -31,6 +31,8 @@ #define NAT_REASS_HT_LOAD_FACTOR (0.75) #define NAT_REASS_FLAG_MAX_FRAG_DROP 1 +#define NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE 2 +#define NAT_REASS_FLAG_ED_DONT_TRANSLATE 4 typedef struct { @@ -49,6 +51,13 @@ typedef struct }; } nat_reass_ip4_key_t; +enum +{ + NAT_REASS_IP4_CLASSIFY_NONE, + NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT, + NAT_REASS_IP4_CLASSIFY_NEXT_OUT2IN +}; + /* *INDENT-OFF* */ typedef CLIB_PACKED(struct { @@ -60,6 +69,7 @@ typedef CLIB_PACKED(struct u32 frags_per_reass_list_head_index; u8 frag_n; u8 flags; + u8 classify_next; }) nat_reass_ip4_t; /* *INDENT-ON* */ diff --git a/src/plugins/nat/out2in.c b/src/plugins/nat/out2in.c index 3d4e9228e67..ba343ad72a5 100755 --- a/src/plugins/nat/out2in.c +++ b/src/plugins/nat/out2in.c @@ -106,6 +106,7 @@ vlib_node_registration_t snat_det_out2in_node; vlib_node_registration_t nat44_out2in_reass_node; vlib_node_registration_t nat44_ed_out2in_node; vlib_node_registration_t nat44_ed_out2in_slowpath_node; +vlib_node_registration_t nat44_ed_out2in_reass_node; #define foreach_snat_out2in_error \ _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ @@ -539,13 +540,16 @@ static inline u32 icmp_out2in (snat_main_t *sm, if (next0 == SNAT_OUT2IN_NEXT_DROP || dont_translate) goto out; - sum0 = ip_incremental_checksum (0, icmp0, - ntohs(ip0->length) - ip4_header_bytes (ip0)); - checksum0 = ~ip_csum_fold (sum0); - if (checksum0 != 0 && checksum0 != 0xffff) + if (PREDICT_TRUE (!ip4_is_fragment (ip0))) { - next0 = SNAT_OUT2IN_NEXT_DROP; - goto out; + sum0 = ip_incremental_checksum (0, icmp0, + ntohs(ip0->length) - ip4_header_bytes (ip0)); + checksum0 = ~ip_csum_fold (sum0); + if (checksum0 != 0 && checksum0 != 0xffff) + { + next0 = SNAT_OUT2IN_NEXT_DROP; + goto out; + } } old_addr0 = ip0->dst_address.as_u32; @@ -1582,6 +1586,7 @@ typedef enum { NAT44_ED_OUT2IN_NEXT_ICMP_ERROR, NAT44_ED_OUT2IN_NEXT_IN2OUT, NAT44_ED_OUT2IN_NEXT_SLOW_PATH, + NAT44_ED_OUT2IN_NEXT_REASS, NAT44_ED_OUT2IN_N_NEXT, } nat44_ed_out2in_next_t; @@ -2298,7 +2303,7 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, } else { - if (PREDICT_FALSE (proto0 == ~0 || proto0 == SNAT_PROTOCOL_ICMP)) + if (PREDICT_FALSE (proto0 == ~0)) { next0 = NAT44_ED_OUT2IN_NEXT_SLOW_PATH; goto trace00; @@ -2306,8 +2311,13 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, if (ip4_is_fragment (ip0)) { - b0->error = node->errors[SNAT_OUT2IN_ERROR_DROP_FRAGMENT]; - next0 = NAT44_ED_OUT2IN_NEXT_DROP; + next0 = NAT44_ED_OUT2IN_NEXT_REASS; + goto trace00; + } + + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP)) + { + next0 = NAT44_ED_OUT2IN_NEXT_SLOW_PATH; goto trace00; } } @@ -2501,7 +2511,7 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, } else { - if (PREDICT_FALSE (proto1 == ~0 || proto1 == SNAT_PROTOCOL_ICMP)) + if (PREDICT_FALSE (proto1 == ~0)) { next1 = NAT44_ED_OUT2IN_NEXT_SLOW_PATH; goto trace01; @@ -2509,8 +2519,13 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, if (ip4_is_fragment (ip1)) { - b1->error = node->errors[SNAT_OUT2IN_ERROR_DROP_FRAGMENT]; - next1 = NAT44_ED_OUT2IN_NEXT_DROP; + next1 = NAT44_ED_OUT2IN_NEXT_REASS; + goto trace01; + } + + if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP)) + { + next1 = NAT44_ED_OUT2IN_NEXT_SLOW_PATH; goto trace01; } } @@ -2736,7 +2751,7 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, } else { - if (PREDICT_FALSE (proto0 == ~0 || proto0 == SNAT_PROTOCOL_ICMP)) + if (PREDICT_FALSE (proto0 == ~0)) { next0 = NAT44_ED_OUT2IN_NEXT_SLOW_PATH; goto trace0; @@ -2744,8 +2759,13 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, if (ip4_is_fragment (ip0)) { - b0->error = node->errors[SNAT_OUT2IN_ERROR_DROP_FRAGMENT]; - next0 = NAT44_ED_OUT2IN_NEXT_DROP; + next0 = NAT44_ED_OUT2IN_NEXT_REASS; + goto trace0; + } + + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP)) + { + next0 = NAT44_ED_OUT2IN_NEXT_SLOW_PATH; goto trace0; } } @@ -2891,7 +2911,6 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm, } pkts_processed += next0 != NAT44_ED_OUT2IN_NEXT_DROP; - /* verify speculative enqueue, maybe switch current next frame */ vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, n_left_to_next, @@ -2936,6 +2955,7 @@ VLIB_REGISTER_NODE (nat44_ed_out2in_node) = { [NAT44_ED_OUT2IN_NEXT_SLOW_PATH] = "nat44-ed-out2in-slowpath", [NAT44_ED_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error", [NAT44_ED_OUT2IN_NEXT_IN2OUT] = "nat44-ed-in2out", + [NAT44_ED_OUT2IN_NEXT_REASS] = "nat44-ed-out2in-reass", }, }; @@ -2970,12 +2990,365 @@ VLIB_REGISTER_NODE (nat44_ed_out2in_slowpath_node) = { [NAT44_ED_OUT2IN_NEXT_SLOW_PATH] = "nat44-ed-out2in-slowpath", [NAT44_ED_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error", [NAT44_ED_OUT2IN_NEXT_IN2OUT] = "nat44-ed-in2out", + [NAT44_ED_OUT2IN_NEXT_REASS] = "nat44-ed-out2in-reass", }, }; VLIB_NODE_FUNCTION_MULTIARCH (nat44_ed_out2in_slowpath_node, nat44_ed_out2in_slow_path_fn); +static uword +nat44_ed_out2in_reass_node_fn (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + u32 n_left_from, *from, *to_next; + snat_out2in_next_t next_index; + u32 pkts_processed = 0; + snat_main_t *sm = &snat_main; + f64 now = vlib_time_now (vm); + u32 thread_index = vm->thread_index; + snat_main_per_thread_data_t *per_thread_data = + &sm->per_thread_data[thread_index]; + u32 *fragments_to_drop = 0; + u32 *fragments_to_loopback = 0; + + from = vlib_frame_vector_args (frame); + n_left_from = frame->n_vectors; + next_index = node->cached_next_index; + + while (n_left_from > 0) + { + u32 n_left_to_next; + + vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); + + while (n_left_from > 0 && n_left_to_next > 0) + { + u32 bi0, sw_if_index0, proto0, rx_fib_index0, new_addr0, old_addr0; + vlib_buffer_t *b0; + u32 next0; + u8 cached0 = 0; + ip4_header_t *ip0; + nat_reass_ip4_t *reass0; + udp_header_t * udp0; + tcp_header_t * tcp0; + icmp46_header_t * icmp0; + clib_bihash_kv_16_8_t kv0, value0; + snat_session_t * s0 = 0; + u16 old_port0, new_port0; + ip_csum_t sum0; + snat_session_key_t e_key0, l_key0; + lb_nat_type_t lb0; + twice_nat_type_t twice_nat0; + + /* speculatively enqueue b0 to the current next frame */ + bi0 = from[0]; + to_next[0] = bi0; + from += 1; + to_next += 1; + n_left_from -= 1; + n_left_to_next -= 1; + + b0 = vlib_get_buffer (vm, bi0); + next0 = NAT44_ED_OUT2IN_NEXT_LOOKUP; + + sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX]; + rx_fib_index0 = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, + sw_if_index0); + + if (PREDICT_FALSE (nat_reass_is_drop_frag(0))) + { + next0 = NAT44_ED_OUT2IN_NEXT_DROP; + b0->error = node->errors[SNAT_OUT2IN_ERROR_DROP_FRAGMENT]; + goto trace0; + } + + ip0 = (ip4_header_t *) vlib_buffer_get_current (b0); + udp0 = ip4_next_header (ip0); + tcp0 = (tcp_header_t *) udp0; + icmp0 = (icmp46_header_t *) udp0; + proto0 = ip_proto_to_snat_proto (ip0->protocol); + + reass0 = nat_ip4_reass_find_or_create (ip0->src_address, + ip0->dst_address, + ip0->fragment_id, + ip0->protocol, + 1, + &fragments_to_drop); + + if (PREDICT_FALSE (!reass0)) + { + next0 = NAT44_ED_OUT2IN_NEXT_DROP; + b0->error = node->errors[SNAT_OUT2IN_ERROR_MAX_REASS]; + nat_log_notice ("maximum reassemblies exceeded"); + goto trace0; + } + + if (PREDICT_FALSE (ip4_is_first_fragment (ip0))) + { + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP)) + { + next0 = icmp_out2in_slow_path + (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node, + next0, now, thread_index, &s0); + + if (PREDICT_TRUE(next0 != NAT44_ED_OUT2IN_NEXT_DROP)) + { + if (s0) + reass0->sess_index = s0 - per_thread_data->sessions; + else + reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE; + reass0->thread_index = thread_index; + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + } + + goto trace0; + } + + make_ed_kv (&kv0, &ip0->dst_address, &ip0->src_address, ip0->protocol, + rx_fib_index0, udp0->dst_port, udp0->src_port); + + if (clib_bihash_search_16_8 (&per_thread_data->out2in_ed, &kv0, &value0)) + { + /* Try to match static mapping by external address and port, + destination address and port in packet */ + e_key0.addr = ip0->dst_address; + e_key0.port = udp0->dst_port; + e_key0.protocol = proto0; + e_key0.fib_index = rx_fib_index0; + if (snat_static_mapping_match(sm, e_key0, &l_key0, 1, 0, + &twice_nat0, &lb0, 0)) + { + /* + * Send DHCP packets to the ipv4 stack, or we won't + * be able to use dhcp client on the outside interface + */ + if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_UDP + && (udp0->dst_port + == clib_host_to_net_u16(UDP_DST_PORT_dhcp_to_client)))) + { + vnet_feature_next(&next0, b0); + goto trace0; + } + + if (!sm->forwarding_enabled) + { + b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION]; + next0 = NAT44_ED_OUT2IN_NEXT_DROP; + } + else + { + if (next_src_nat(sm, ip0, ip0->protocol, + udp0->src_port, udp0->dst_port, + thread_index, rx_fib_index0)) + { + next0 = NAT44_ED_OUT2IN_NEXT_IN2OUT; + goto trace0; + } + create_bypass_for_fwd(sm, ip0, rx_fib_index0, + thread_index); + reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE; + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + } + goto trace0; + } + + /* Create session initiated by host from external network */ + s0 = create_session_for_static_mapping_ed(sm, b0, l_key0, + e_key0, node, + thread_index, + twice_nat0, lb0, + now); + if (!s0) + { + b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION]; + next0 = NAT44_ED_OUT2IN_NEXT_DROP; + goto trace0; + } + reass0->sess_index = s0 - per_thread_data->sessions; + reass0->thread_index = thread_index; + } + else + { + s0 = pool_elt_at_index (per_thread_data->sessions, + value0.value); + reass0->sess_index = value0.value; + } + nat_ip4_reass_get_frags (reass0, &fragments_to_loopback); + } + else + { + if (reass0->flags & NAT_REASS_FLAG_ED_DONT_TRANSLATE) + goto trace0; + if (PREDICT_FALSE (reass0->sess_index == (u32) ~0)) + { + if (nat_ip4_reass_add_fragment (reass0, bi0, &fragments_to_drop)) + { + b0->error = node->errors[SNAT_OUT2IN_ERROR_MAX_FRAG]; + nat_log_notice ("maximum fragments per reassembly exceeded"); + next0 = NAT44_ED_OUT2IN_NEXT_DROP; + goto trace0; + } + cached0 = 1; + goto trace0; + } + s0 = pool_elt_at_index (per_thread_data->sessions, + reass0->sess_index); + } + + old_addr0 = ip0->dst_address.as_u32; + ip0->dst_address = s0->in2out.addr; + new_addr0 = ip0->dst_address.as_u32; + vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index; + + sum0 = ip0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, + ip4_header_t, + dst_address /* changed member */); + if (PREDICT_FALSE (is_twice_nat_session (s0))) + sum0 = ip_csum_update (sum0, ip0->src_address.as_u32, + s0->ext_host_nat_addr.as_u32, ip4_header_t, + src_address); + ip0->checksum = ip_csum_fold (sum0); + + if (PREDICT_FALSE (ip4_is_first_fragment (ip0))) + { + if (PREDICT_TRUE(proto0 == SNAT_PROTOCOL_TCP)) + { + old_port0 = tcp0->dst_port; + tcp0->dst_port = s0->in2out.port; + new_port0 = tcp0->dst_port; + + sum0 = tcp0->checksum; + sum0 = ip_csum_update (sum0, old_addr0, new_addr0, + ip4_header_t, + dst_address /* changed member */); + + sum0 = ip_csum_update (sum0, old_port0, new_port0, + ip4_header_t /* cheat */, + length /* changed member */); + if (is_twice_nat_session (s0)) + { + sum0 = ip_csum_update (sum0, ip0->src_address.as_u32, + s0->ext_host_nat_addr.as_u32, + ip4_header_t, dst_address); + sum0 = ip_csum_update (sum0, tcp0->src_port, + s0->ext_host_nat_port, ip4_header_t, + length); + tcp0->src_port = s0->ext_host_nat_port; + ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32; + } + tcp0->checksum = ip_csum_fold(sum0); + } + else + { + old_port0 = udp0->dst_port; + udp0->dst_port = s0->in2out.port; + if (is_twice_nat_session (s0)) + { + udp0->src_port = s0->ext_host_nat_port; + ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32; + } + udp0->checksum = 0; + } + } + + /* Accounting */ + nat44_session_update_counters (s0, now, + vlib_buffer_length_in_chain (vm, b0)); + /* Per-user LRU list maintenance */ + nat44_session_update_lru (sm, s0, thread_index); + + trace0: + if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE) + && (b0->flags & VLIB_BUFFER_IS_TRACED))) + { + nat44_out2in_reass_trace_t *t = + vlib_add_trace (vm, node, b0, sizeof (*t)); + t->cached = cached0; + t->sw_if_index = sw_if_index0; + t->next_index = next0; + } + + if (cached0) + { + n_left_to_next++; + to_next--; + } + else + { + pkts_processed += next0 != NAT44_ED_OUT2IN_NEXT_DROP; + + /* verify speculative enqueue, maybe switch current next frame */ + vlib_validate_buffer_enqueue_x1 (vm, node, next_index, + to_next, n_left_to_next, + bi0, next0); + } + + if (n_left_from == 0 && vec_len (fragments_to_loopback)) + { + from = vlib_frame_vector_args (frame); + u32 len = vec_len (fragments_to_loopback); + if (len <= VLIB_FRAME_SIZE) + { + clib_memcpy (from, fragments_to_loopback, sizeof (u32) * len); + n_left_from = len; + vec_reset_length (fragments_to_loopback); + } + else + { + clib_memcpy (from, + fragments_to_loopback + (len - VLIB_FRAME_SIZE), + sizeof (u32) * VLIB_FRAME_SIZE); + n_left_from = VLIB_FRAME_SIZE; + _vec_len (fragments_to_loopback) = len - VLIB_FRAME_SIZE; + } + } + } + + vlib_put_next_frame (vm, node, next_index, n_left_to_next); + } + + vlib_node_increment_counter (vm, nat44_out2in_reass_node.index, + SNAT_OUT2IN_ERROR_OUT2IN_PACKETS, + pkts_processed); + + nat_send_all_to_node (vm, fragments_to_drop, node, + &node->errors[SNAT_OUT2IN_ERROR_DROP_FRAGMENT], + SNAT_OUT2IN_NEXT_DROP); + + vec_free (fragments_to_drop); + vec_free (fragments_to_loopback); + return frame->n_vectors; +} + +VLIB_REGISTER_NODE (nat44_ed_out2in_reass_node) = { + .function = nat44_ed_out2in_reass_node_fn, + .name = "nat44-ed-out2in-reass", + .vector_size = sizeof (u32), + .format_trace = format_nat44_out2in_reass_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_errors = ARRAY_LEN(snat_out2in_error_strings), + .error_strings = snat_out2in_error_strings, + + .n_next_nodes = NAT44_ED_OUT2IN_N_NEXT, + + /* edit / add dispositions here */ + .next_nodes = { + [NAT44_ED_OUT2IN_NEXT_DROP] = "error-drop", + [NAT44_ED_OUT2IN_NEXT_LOOKUP] = "ip4-lookup", + [NAT44_ED_OUT2IN_NEXT_SLOW_PATH] = "nat44-ed-out2in-slowpath", + [NAT44_ED_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error", + [NAT44_ED_OUT2IN_NEXT_IN2OUT] = "nat44-ed-in2out", + [NAT44_ED_OUT2IN_NEXT_REASS] = "nat44-ed-out2in-reass", + }, +}; + +VLIB_NODE_FUNCTION_MULTIARCH (nat44_ed_out2in_reass_node, + nat44_ed_out2in_reass_node_fn); + /**************************/ /*** deterministic mode ***/ /**************************/ |