summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/plugins/nat/in2out_ed.c45
-rw-r--r--src/plugins/nat/nat.h7
-rw-r--r--src/plugins/nat/nat_inlines.h3
-rw-r--r--src/plugins/nat/out2in_ed.c31
4 files changed, 82 insertions, 4 deletions
diff --git a/src/plugins/nat/in2out_ed.c b/src/plugins/nat/in2out_ed.c
index e32e1386d8d..f3999f00129 100644
--- a/src/plugins/nat/in2out_ed.c
+++ b/src/plugins/nat/in2out_ed.c
@@ -37,7 +37,8 @@ _(BAD_ICMP_TYPE, "unsupported ICMP type") \
_(MAX_SESSIONS_EXCEEDED, "Maximum sessions exceeded") \
_(DROP_FRAGMENT, "Drop fragment") \
_(MAX_REASS, "Maximum reassemblies exceeded") \
-_(MAX_FRAG, "Maximum fragments per reassembly exceeded")
+_(MAX_FRAG, "Maximum fragments per reassembly exceeded")\
+_(NON_SYN, "non-SYN packet try to create session")
typedef enum
{
@@ -513,7 +514,19 @@ nat44_ed_not_translate_output_feature (snat_main_t * sm, ip4_header_t * ip,
make_ed_kv (&kv, &ip->src_address, &ip->dst_address, proto, tx_fib_index,
src_port, dst_port);
if (!clib_bihash_search_16_8 (&tsm->out2in_ed, &kv, &value))
- return 1;
+ {
+ s = pool_elt_at_index (tsm->sessions, value.value);
+ if (nat44_is_ses_closed (s))
+ {
+ nat_log_debug ("TCP close connection %U", format_snat_session,
+ &sm->per_thread_data[thread_index], s);
+ nat_free_session_data (sm, s, thread_index);
+ nat44_delete_session (sm, s, thread_index);
+ }
+ else
+ s->flags |= SNAT_SESSION_FLAG_OUTPUT_FEATURE;
+ return 1;
+ }
/* dst NAT check */
make_ed_kv (&kv, &ip->dst_address, &ip->src_address, proto, rx_fib_index,
@@ -1021,6 +1034,13 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm,
goto trace00;
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace00;
+ }
+
next0 =
slow_path_ed (sm, b0, rx_fib_index0, &kv0, &s0, node,
next0, thread_index, now);
@@ -1225,6 +1245,13 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm,
goto trace01;
}
+ if ((proto1 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp1))
+ {
+ b1->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next1 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace01;
+ }
+
next1 =
slow_path_ed (sm, b1, rx_fib_index1, &kv1, &s1, node,
next1, thread_index, now);
@@ -1458,6 +1485,13 @@ nat44_ed_in2out_node_fn_inline (vlib_main_t * vm,
goto trace0;
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace0;
+ }
+
next0 =
slow_path_ed (sm, b0, rx_fib_index0, &kv0, &s0, node,
next0, thread_index, now);
@@ -1858,6 +1892,13 @@ nat44_ed_in2out_reass_node_fn_inline (vlib_main_t * vm,
}
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace0;
+ }
+
next0 = slow_path_ed (sm, b0, rx_fib_index0, &kv0,
&s0, node, next0, thread_index, now);
diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h
index 13467203917..02d4aaef9f6 100644
--- a/src/plugins/nat/nat.h
+++ b/src/plugins/nat/nat.h
@@ -174,6 +174,7 @@ typedef enum
#define SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT 16
#define SNAT_SESSION_FLAG_FWD_BYPASS 32
#define SNAT_SESSION_FLAG_AFFINITY 64
+#define SNAT_SESSION_FLAG_OUTPUT_FEATURE 128
/* NAT interface flags */
#define NAT_INTERFACE_FLAG_IS_INSIDE 1
@@ -673,6 +674,12 @@ unformat_function_t unformat_snat_protocol;
*/
#define is_lb_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_LB)
+/** \brief Check if client initiating TCP connection (received SYN from client)
+ @param t TCP header
+ @return 1 if client initiating TCP connection
+*/
+#define tcp_is_init(t) ((t->flags & TCP_FLAG_SYN) && !(t->flags & TCP_FLAG_ACK))
+
/* logging */
#define nat_log_err(...) \
vlib_log(VLIB_LOG_LEVEL_ERR, snat_main.log_class, __VA_ARGS__)
diff --git a/src/plugins/nat/nat_inlines.h b/src/plugins/nat/nat_inlines.h
index c0f16721173..0b4f8108c7e 100644
--- a/src/plugins/nat/nat_inlines.h
+++ b/src/plugins/nat/nat_inlines.h
@@ -215,7 +215,8 @@ nat44_set_tcp_session_state_i2o (snat_main_t * sm, snat_session_t * ses,
if (clib_net_to_host_u32 (tcp->ack_number) > ses->o2i_fin_seq)
ses->state |= NAT44_SES_O2I_FIN_ACK;
}
- if (nat44_is_ses_closed (ses))
+ if (nat44_is_ses_closed (ses)
+ && !(ses->flags & SNAT_SESSION_FLAG_OUTPUT_FEATURE))
{
nat_log_debug ("TCP close connection %U", format_snat_session,
&sm->per_thread_data[thread_index], ses);
diff --git a/src/plugins/nat/out2in_ed.c b/src/plugins/nat/out2in_ed.c
index 55b34f5c2e8..aa7f7e40117 100644
--- a/src/plugins/nat/out2in_ed.c
+++ b/src/plugins/nat/out2in_ed.c
@@ -39,7 +39,8 @@ _(NO_TRANSLATION, "No translation") \
_(MAX_SESSIONS_EXCEEDED, "Maximum sessions exceeded") \
_(DROP_FRAGMENT, "Drop fragment") \
_(MAX_REASS, "Maximum reassemblies exceeded") \
-_(MAX_FRAG, "Maximum fragments per reassembly exceeded")
+_(MAX_FRAG, "Maximum fragments per reassembly exceeded")\
+_(NON_SYN, "non-SYN packet try to create session")
typedef enum
{
@@ -875,6 +876,13 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm,
if (PREDICT_FALSE (identity_nat0))
goto trace00;
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
+ next0 = NAT44_ED_OUT2IN_NEXT_DROP;
+ goto trace00;
+ }
+
/* Create session initiated by host from external network */
s0 = create_session_for_static_mapping_ed (sm, b0, l_key0,
e_key0, node,
@@ -1097,6 +1105,13 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm,
if (PREDICT_FALSE (identity_nat1))
goto trace01;
+ if ((proto1 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp1))
+ {
+ b1->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
+ next1 = NAT44_ED_OUT2IN_NEXT_DROP;
+ goto trace01;
+ }
+
/* Create session initiated by host from external network */
s1 = create_session_for_static_mapping_ed (sm, b1, l_key1,
e_key1, node,
@@ -1353,6 +1368,13 @@ nat44_ed_out2in_node_fn_inline (vlib_main_t * vm,
if (PREDICT_FALSE (identity_nat0))
goto trace0;
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
+ next0 = NAT44_ED_OUT2IN_NEXT_DROP;
+ goto trace0;
+ }
+
/* Create session initiated by host from external network */
s0 = create_session_for_static_mapping_ed (sm, b0, l_key0,
e_key0, node,
@@ -1702,6 +1724,13 @@ nat44_ed_out2in_reass_node_fn (vlib_main_t * vm,
goto trace0;
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
+ next0 = NAT44_ED_OUT2IN_NEXT_DROP;
+ goto trace0;
+ }
+
/* Create session initiated by host from external network */
s0 = create_session_for_static_mapping_ed (sm, b0, l_key0,
e_key0, node,