summaryrefslogtreecommitdiffstats
path: root/src/plugins/nat/nat44-ed
AgeCommit message (Collapse)AuthorFilesLines
2022-02-21nat: make tcp/udp/icmp packet counters consistentKlement Sekera2-4/+12
TCP/UDP packets which are dropped are not counted towards TCP/UDP counters. Apply same behaviour to ICMP packets. Type: improvement Signed-off-by: Klement Sekera <klement.sekera@gmail.com> Change-Id: I487fa7135ac8e49431a621fac213638d2dab31c8
2022-02-01nat: memory leak on nat44_plugin_disableSteven Luong1-0/+2
We invoke nat_affinity_enable for nat44_plugin_enable. We need to invoke nat_affinity_disable for nat44_plugin_disable to free the memory for bihash. Type: fix Fixes: I2743f7b1104b627bcc5ef937e3a50655313a26ea Signed-off-by: Steven Luong <sluong@cisco.com> Change-Id: I9adeb3225136e3fff853c2d5b8f9a30e98ddcf4c
2022-01-24nat: TCP state tracking based on RFC 7857/RFC 6146Klement Sekera9-318/+588
Implement proper state machine based on above RFCs. ACKs to SYNs/FINs are no longer required/tracked. This is more friendly to peers and accounts for lost packets and retransmits. This change also means that all traffic is translated and forwarded while in transitory timeout, which helps delivering e.g. retransmitted FINs, FINACKs and other messages. Also support reopening a session in transitory timeout after seeing both FINs by seeing both SYNs again. This helps quick connection reestablishment if the peers want to. Type: improvement Signed-off-by: Klement Sekera <ksekera@cisco.com> Signed-off-by: Miklos Tirpak <miklos.tirpak@gmail.com> Change-Id: Ibf521c79463472db97e593bfa02b32b4a06dfd2a
2022-01-04nat: remove nat44-ed relation between SM and addrFilip Varga6-555/+436
Change [1] put static mappings in flow hash. This change also broke relationship between nat pool addresses and static mappings. Port and address are no longer reserved in nat pool address records for a new static mapping. Because of this change both nat objects and their configuration can function independently. This change also removed already broken logic of having static-mapping-only configuration. In this patch i have cleaned up and removed unnecessary logic for static mapping configuration functions, address configuration functions, interface configuraiton functions and all callback functions used for resolving interface address bound records. No more viable configuration option static-mapping-only is also removed because there is no more option to run traffic through vpp for static mappings without having flow hash table allocated. Instead user is now able to create static mapping records without using nat pool addresses. Fixed and improved management of required fib entries (ensuring VPP will reply to ARP for all external addresses on outside interfaces) through holding a refcount for their creation and removal. [1] https://gerrit.fd.io/r/c/vpp/+/34077 Type: improvement Change-Id: Ic16deefbede833d574c2a5972155c9afa5bc62ce Signed-off-by: Filip Varga <fivarga@cisco.com>
2022-01-04nat: nat44-ed pool address allocation improvementFilip Varga4-58/+289
This patch improves algorithm responsible for choosing nat pool address during dynamic session creation. Patch synchronizes nat pool address attributes with vpp interfaces doing so gives nat option to determine correct nat pool address when creating dynamic session. Improvements: * match dst address subnet and src fib with nat pool address * for output-feature also fallback match of tx_sw_if_index with nat pool address Type: improvement Change-Id: I594638bc76fc1153f582add376838b4b72ff573a Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-11-26api: add helper macros for native endianMohsin Kazmi1-5/+1
Type: improvement Change-Id: Ifa074dfd337f9cd68858468d34abf641fe7f247f Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
2021-11-11nat: nat44-ei/ed nat objects cleanup improvementsFilip Varga1-135/+249
Improvements: * Changed plugin disable call behavior from freeing data types to calling appropriate nat plugin object delete calls for pool addresses, mappings and interfaces. * Added wrapper nat44_ei/ed_add_del_static_mapping function to handle switch bound static mappings. This would also fix ip assignment callback add/del bound static mapping issue preventing creation of the mapping. Fixes: * Fixed lingering object issue: some nat intertwined objects would not free each other if not correctly deleted in proper order. * Fixed incorect order of FIB unlocks for pool addresses causing syslog messages to use deleted FIBs in multiple VRF configuration. * Fixed incorrect value testing of flags instead of vrf_id for multiple vrf configuration static mapping. Type: improvement Change-Id: I2743f7b1104b627bcc5ef937e3a50655313a26ea Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-11-10nat: api autoendian fixFilip Varga1-8/+9
Fixed bad use of macros for autoendian API calls and updated tests for the new API. Removed sw_if_index check macro because of ntol conversion. Changed REPLY_MACRO to REPLY_MACRO_END to fix ntohl conversions. Type: fix Change-Id: I878a07b3f80fe03179feab60f0abc662f408a2c8 Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-10-31interface: handoff refactor and optimizationsFlorin Coras1-1/+0
- move existing ethernet hash functions to hash infra (no l4 awareness) - refactor code to use hash infra and add apis to request l4 aware hashing functions - hashing functions per interface - code cleanup Type: improvement Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Ia9f44db98d83f0f027aeb37718585a2e10ffd2c6
2021-10-20nat: NAT44-ED api fix and improvementFilip Varga4-16/+14
This patch fixes issue with NAT_API_IS_TWICE_NAT and NAT_API_IS_ADDR_ONLY flags. Because of control plane code change - move from boolean parameters to flags in https://gerrit.fd.io/r/c/vpp/+/32796 patch these api flags weren't correctly set. Type: fix Change-Id: Ieec5fe6bdcca314da027f2d23e3a24f174391a6f Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-10-14nat: static mappings in flow hashKlement Sekera10-1213/+878
Put static mappings in flow hash, drop existing hash tables used for static mappings. Drop refcount variables and use hash table as a single point of truth. Allow creating a static mapping conflicting with dynamic mapping, which will take precedence after dynamic mapping is freed, so that the existing flow can finish transferring data. Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: Idfde8efabc09971be38921d4b0ca5ccf4e9fe412
2021-10-13nat: fix coverity warningKlement Sekera1-1/+1
Fix coverity warning by initialising proto variable to a dummy value. This value is never used because consuming function uses this parameter value only if is_addr_only flag is not set and this flag is always set if proto value is not provided by user. Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: I9b5e8c08346bea1e2b460bb09e962c4b8d3b6947
2021-10-13nat: fix static mapping segvJoshua Roys1-1/+1
Adding a nat44 static mapping during startup on a DHCP interface leads to a segv via this path: - dhcp_client_acquire_address - ip4_add_del_interface_address - ip4_add_del_interface_address_internal - nat44_ed_add_del_interface_address_cb - nat44_ed_add_static_mapping - ip4_interface_first_address Type: fix Signed-off-by: Joshua Roys <roysjosh@gmail.com> Change-Id: I38dac8a096b052550f2b87b4e13a950d2cd868b0
2021-10-12Revert "nat: static mappings in flow hash"Ole Troan10-850/+1195
This reverts commit 69b7599e4b061a8996205f0304232ede84cb70d4. Type: fix Signed-off-by: Ole Troan <ot@cisco.com> Change-Id: If531b122ae5a9f91c2fe6eaa0da69922a91f16d3
2021-10-12nat: static mappings in flow hashKlement Sekera10-1195/+850
Put static mappings in flow hash, drop existing hash tables used for static mappings. Drop refcount variables and use hash table as a single point of truth. Allow creating a static mapping conflicting with dynamic mapping, which will take precedence after dynamic mapping is freed, so that the existing flow can finish transferring data. Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: Ieeba691d83a83887d0a0baccd5f3832f66126096
2021-10-05nat: NAT44 ED api fix and improvementFilip Varga3-14/+178
Backward compatibility fix returns erroneous behavior that lets user add internally unused inside interface for the purpose of complying with the old add/dump/details API behavior. Change introduced in https://gerrit.fd.io/r/c/vpp/+/32951 removed extra inside interface that wasn't required or any how used by the output feature. This patch also changed outside interface flags to inside & outside. This fix returns the old behavior by imitating the old behavior through dummy registratoin data. Added new API calls nat44_ed_add_del_output_interface and nat44_ed_output_interface_get/details as a replacement of old API's. New API introduces simplified and cleaner way of configuring outside feature without requirement of config flags. Type: improvement Signed-off-by: Filip Varga <fivarga@cisco.com> Change-Id: I7a170f7325727c04da5e2e3ffbe3f02179531284
2021-09-30nat: doc nitfixesNathan Skrzypczak2-4/+4
Type: improvement Change-Id: I9a4303030b9657c28bbd73168def72c7daa13483 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-09-29nat: nat44-ed add session timing out indicator in api (2)Alexander Chernavin2-1/+146
Type: improvement Currently, NAT44-ED users sessions details are returned for both active and timed out NAT sessions. It may confuse users that expect to see only active sessions in the response and make them think that timeouts for NAT sessions do not work. With this change, introduce an indicator of timing out for NAT sessions returned in NAT44-ED user session details. Signed-off-by: Alexander Chernavin <achernavin@netgate.com> Change-Id: Ib4d689f77cec4b0b0cc8484019e13733cc8bdc0d
2021-09-28nat: NAT44 ED & EI session filtering CLIJúlius Milan1-14/+95
Improving session filtering capabilities of show nat44 sessions CLI command for EI and ED NAT plugins. Adding filtering options: saddr, sport, daddr, dport, proto for both i2o and o2i flows. Type: improvement Change-Id: I70bc94a2e922cddf9451eb7dcbf4a7be21ebf0df Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-09-09nat: Revert "nat: nat44-ed add session timing out indicator in api"Andrew Yourtchenko2-150/+1
This reverts commit f059a3452c285ec57a75c7b1ede5052244be4e5d, which broke the build. https://s3-logs.fd.io/logs/production/vex-yul-rot-jenkins-1/vpp-merge-master-debian10-x86_64/1344/console.log.gz Change-Id: I16fece8128fa9973495c587d105a8db57738e8f2 Type: fix Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2021-09-09nat: nat44-ed add session timing out indicator in apiAlexander Chernavin2-1/+150
Type: improvement Currently, NAT44-ED users sessions details are returned for both active and timed out NAT sessions. It may confuse users that expect to see only active sessions in the response and make them think that timeouts for NAT sessions do not work. With this change, introduce an indicator of timing out for NAT sessions returned in NAT44-ED user session details. Signed-off-by: Alexander Chernavin <achernavin@netgate.com> Change-Id: Ib81ed90369d4b495117538f521e5112e289cf7e6
2021-09-08nat: remove unusued parameters and use correct parameter typesKlement Sekera2-20/+15
Type: improvement Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: I4f7b3d5354a7658d7271c28444f2f4641f05b28b
2021-09-02nat: NAT44 ED improvements and fixesFilip Varga8-392/+353
Fixed FIB entry per interface, pool and static mapping registrations in NAT control plane. Improved FIB configuration handling in NAT - added functions to generalize handling of FIB & NAT, cleaned up interface callback functions. Changed "is_" macros to inline functions for easier debugging. Type: improvement Change-Id: I68a17761a975dd819139ae94e52a8a85d3f27ffc Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-08-19nat: handle ED in2out ICMP errors with workersMatthew Smith1-0/+22
Type: fix With endpoint dependent NAT44, When there are multiple workers we look for a flow which matches the packet in order to figure out which worker should handle the packet. If the packet is an ICMP error, it may be associated with an existing flow by inspecting the L3/L4 headers that are included in the message payload. This was not being done for in2out packets in nat44_ed_get_in2out_worker_index(), so some packets which were related to an open session were not being associated with that session and were being passed to a different thread than the one where the session was created. Later on, when the packet was processed by the fast path in2out node, the L3/L4 headers in the payload are inspected and the fast path node finds the existing session. Since that session is owned by a different thread than the one the packet is being processed by, the in2out fast path node can potentially access the wrong session and/or memory adjacent to the session pool. This can cause a SEGV. Make nat44_ed_get_in2out_worker_index() look at the inner headers when processing an ICMP error. THis is already done in nat44_ed_get_out2in_worker_index() and in the fast path in2out node. Change-Id: Icdc1abebcbce452ee7be7cb23fc563e09bf575f2 Signed-off-by: Matthew Smith <mgsmith@netgate.com>
2021-08-17nat: fix counters increment for output featureAlexander Chernavin1-25/+34
Type: fix The NAT plugin stores packet counters and a counter represents a vector indexed by interface index. When an interface is assigned a NAT role, the counters are validated to be long enough for the given interface index. When a packet traverses NAT in2out and output feature is disabled, the appropriate counters are updated by the RX interface index. In this case, translation happens on the inside interface and its index was ensured to be valid in all of the counters during NAT role assignment. When a packet traverses NAT in2out and output feature is enabled, the appropriate counters are updated by the RX interface index too. In this case, translation happens on the outside interface and the packet could be received on any interface, even with no NAT role assigned. If that's the case and its index is greater than the greatest index validated in the counters, a new counter value will be written to memory that does not belong to the counter. As a result, a crash will occur at some point. With this change, use TX interface index to update the counters when output feature is enabled. TX interface is an actual interface where translation happens and its index is always valid in the counters. Signed-off-by: Alexander Chernavin <achernavin@netgate.com> Change-Id: I53a52af949fe96419e1b5fef4134ab4062198f51
2021-08-12nat: NAT44ED configuration refactorFilip Varga4-378/+365
Refactoring and cleaning up address allocation functions & ip table update callbacks. Type: refactor Change-Id: I9a11700a5f335b64d0d84e04d8e16d040624e01b Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-08-05nat: nat44-ed disable protection for api/cliFilip Varga4-60/+67
Return unsupported error if user calls one of the configuration functions that can run only after nat44-ed plugin is enabled via appropriate api/cli call. Type: fix Change-Id: I0d4ab0684ba5ae23fc2ecc668554a34537c2904a Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-07-29nat: fix ICMP checksum validationKlement Sekera1-9/+9
Handle case where extra data is present in buffer which is not part of IP/ICMP headers. Type: fix Fixes: 05b5a5b3b4b04823776feed6403b5a99b2e06d76 Change-Id: Icfef811470056d38c60fc45cc302139ed7594385 Signed-off-by: Klement Sekera <ksekera@cisco.com>
2021-07-22nat: nat44-ed configuration refactor & cleanupFilip Varga9-896/+1195
Refactoring static mapping configuration functions based on feature type. Type: refactor Signed-off-by: Filip Varga <fivarga@cisco.com> Change-Id: I007d9b0e9717ced613fbcef2b11b6853f479be1e
2021-07-19nat: harden ICMP handlingKlement Sekera4-49/+110
Verify that headers are not truncated and that checksums are valid. Correct checksum computation in translation code. Type: fix Change-Id: I6acfcec4661411f83c86b15aafac90cd4538c0b5 Signed-off-by: Klement Sekera <ksekera@cisco.com>
2021-07-15misc: replace CLIB_PREFETCH with clib_prefetch_{load,store}Damjan Marion4-8/+8
Type: refactor Change-Id: Id10cbf52e8f2dd809080a228d8fa282308be84ac Signed-off-by: Damjan Marion <damarion@cisco.com>
2021-07-15nat: nat44-ed sm fixFilip Varga1-15/+13
Fixing nat44-ed identity map in2out communication. TCP packets would get dropped because of the order of testing TCP state. Type: fix Change-Id: Ib11e7e75c66945224fecc0bb311733672e315c7d Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-07-14nat: refactoring NAT44ED cfg functionsFilip Varga4-344/+500
Refactored & fixed NAT44ED configuration functions used for handling interfaces and nodes. Type: refactor Signed-off-by: Filip Varga <fivarga@cisco.com> Change-Id: I6fbbb7f0fe35d572675997745d53290152987424
2021-06-23nat: ICMP handling fixesKlement Sekera4-24/+110
If ICMP comes from a router on path, source address must not be rewritten in o2i path to avoid getting wrong checksum. Fix ICMP checksum computations. Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: I035debccf966d7dbd63c364cb1e43380d641f708
2021-06-22nat: don't drop packet with ttl=1 if output featureKlement Sekera1-2/+2
TTL was already decremented in ip4-rewrite so it's okay if it's 1. Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: I587dc343737c15247eb62837a06d5e44c0d11acc
2021-06-16nat: test all intf addrs in is_interface_addr()Alexander Chernavin2-10/+21
Type: fix Currently, is_interface_addr() tests if a given IPv4 address belongs to an interface by a given sw_if_index. However, there are several issues: * only the first found address on the interface is actually tested, * sw_if_index is always cached even if the interface hasn't been assigned any addresses yet. With this change, is_interface_addr() tests all IPv4 addresses on an interface by a given sw_if_index and caches sw_if_index only if there are addresses present. Signed-off-by: Alexander Chernavin <achernavin@netgate.com> Change-Id: If1acc4a534647a5f0ce8e9b565b867c92a016dc3
2021-06-16nat: fix crash when translate unknown proto packetsAlexander Chernavin2-4/+5
Type: fix Currently, there might be a crash in NAT ED mode: * if a session for an unknown proto packet cannot be created in2out, * if a session for an unknown proto packet cannot be found out2in. With this change, translate packets only if a session is given in NAT ED mode. Signed-off-by: Alexander Chernavin <achernavin@netgate.com> Change-Id: Iafb332db1ae9a3e76435964ad636037d1b8a51e8
2021-05-31nat: fix broken nat44-ed cliRuslan Babayev2-10/+1
snat_set_frame_queue_nelts has been replaced with nat44_ed_set_frame_queue_nelts. Type: fix Signed-off-by: Ruslan Babayev <ruslan@babayev.com> Change-Id: I8d970be71376fdbb2bfd383d4d5824a8def93bb3
2021-05-26nat: add thread index assertionsKlement Sekera4-0/+11
Add extra assertions to debug build. Type: improvement Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: Ib20130365e8f9dbb556fcbb4321dd184c7eff603
2021-05-21nat: add maximum configured sessions to stat segmentOle Troan2-0/+11
Add /nat44-ed/max-cfg-sessions gauge. Reflects the configured value for configured sessions (per thread). Type: improvement Signed-off-by: Ole Troan <ot@cisco.com> Change-Id: I618c8aa0daab0981399cfe9273d191fa1990ef60 Signed-off-by: Ole Troan <ot@cisco.com>
2021-05-14vlib: pass node runtime to vlib_buffer_enqueue_to_thread()Damjan Marion1-2/+2
Mechanical change for patch following this one... Type: improvement Change-Id: Iee12f3a8851f35569e6c039494a94fc36e83d20f Signed-off-by: Damjan Marion <damarion@cisco.com>
2021-05-05nat: cli commands parsing fixFilip Varga1-114/+101
Newline get's ignored when parsing configuration file. Type: fix Signed-off-by: Filip Varga <fivarga@cisco.com> Change-Id: Ib4f86177150dfe3bc085231a9268cf730490ea81
2021-04-28nat: fix byte order on ipfix message fieldsMatthew Smith1-1/+1
Type: fix The code for quota exceeded events is a u32 and was being copied into ipfix packets in host byte order. Same for the limit field. Swap the order before copying into packet buffer. This change was applied once before but had to be reverted. This was because between the time the change was uploaded/reviewed and the time it was merged, a different patch was merged which activated a NAT ipfix unit test that had formerly only been run as part of the extended tests. The test was expecting the values to be in host byte order so it failed with this patch applied. This time around, that test has also been updated to expect network byte order. Change-Id: If5413b1f806d664f6786e56ba13c3eee573c26d2 Signed-off-by: Matthew Smith <mgsmith@netgate.com>
2021-04-23nat: correct detection of icmp bypass presenceKlement Sekera1-2/+2
Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: Iead167e7497e0779c440f7fb243014a06ae2b452
2021-04-21nat: fix multi worker scenariosKlement Sekera2-28/+56
Properly select worker from hash table in out2in direction, increase number of worker threads in MW test to 4 to test these cases. Type: fix Change-Id: I76eda5761ff497b85b031dd913a64b7fcb53b33a Signed-off-by: Klement Sekera <ksekera@cisco.com>
2021-04-20nat: fixing cli bug for nat44-ei and nat44-edFilip Varga1-1/+1
Removing obsolete optional parameters. Type: fix Change-Id: I135eb4767979ab81636da16e91752a2ad80e0a45 Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-04-20nat: nat44-ed i2o & o2i trace fixFilip Varga2-8/+10
If cache used than we don't print in trace session index. Type: fix Change-Id: Ib965cd8632b5217f8b2dd8b6cc6af3286c747582 Signed-off-by: Filip Varga <fivarga@cisco.com>
2021-04-01nat: fix ordering of feature nodesKlement Sekera1-2/+4
Fix ordering of feature nodes so that ACL runs after NAT in in2out direction so it can properly track stuff like ports after NAT rewrite. Type: fix Change-Id: I2c689b64765628e9bc77108914f74c6c801d8ce2 Signed-off-by: Klement Sekera <ksekera@cisco.com>
2021-03-31nat: avoid creating negative zero checksumKlement Sekera1-1/+3
Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: Ibbb72e77c751b7e775620cfb160b52ceff2da86b
2021-03-31nat: NAT44-ED unused value removalFilip Varga1-4/+1
Type: fix Coverity scan issue fix. Change-Id: I9036fade15fd381da9c1e6b575f250fdcb21f876 Signed-off-by: Filip Varga <fivarga@cisco.com>