aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/snat
AgeCommit message (Expand)AuthorFilesLines
2017-07-11SNAT: fixed bug in fallback to 3-tuple key for non TCP/UDP sessionsMatus Fabian1-0/+4
2017-07-07SNAT: Fallback to 3-tuple key for non TCP/UDP sessions (VPP-884)Matus Fabian5-79/+578
2017-06-22NAT64: documentationMatus Fabian2-0/+211
2017-06-21NAT64: custom prefixMatus Fabian6-65/+494
2017-06-20SNAT: unknow protocol hairpinning fixMatus Fabian1-1/+1
2017-06-19NAT64: change not supported multi threading behaviourMatus Fabian5-6/+104
2017-06-19SNAT: NAT packet with unknown L4 protocol if match 1:1 NATMatus Fabian2-6/+104
2017-06-19NAT64: Hairpinning (VPP-699)Matus Fabian5-24/+428
2017-06-13SNAT: fix 1:1 NAT without port hairpinning TCP checksum updateMatus Fabian1-0/+10
2017-06-12NAT64: bug fixMatus Fabian1-1/+20
2017-06-12NAT64: coverity fixMatus Fabian1-2/+14
2017-06-09NAT64: ICMP error supportMatus Fabian5-15/+202
2017-06-08NAT64: Add NAT64 support for snat plugin (VPP-699)Matus Fabian11-10/+3670
2017-06-05SNAT: fix ICMP hairpinningMatus Fabian1-1/+67
2017-06-05More GCC-7 errorsMarco Varlese1-0/+2
2017-05-30Flowprobe: Stateful flows and IPv6, L4 recordingOle Troan1-3/+3
2017-05-24SNAT: fix IPFIX data src and dst portMatus Fabian1-2/+2
2017-05-10completelly deprecate os_get_cpu_number, replace new occurencesDamjan Marion2-2/+2
2017-05-10SNAT: move API code to separate fileMatus Fabian3-1256/+1311
2017-04-27CGN: Send ICMP error packet if user is out of sessions availableMartin Gálik1-6/+21
2017-04-26CGN: Session dump, test naming for ports fixedMartin Gálik3-3/+153
2017-04-26CGNAT: close session API and CLI commands.Martin Gálik3-4/+351
2017-04-25"autoreply" flag: autogenerate standard xxx_reply_t messagesDave Barach1-80/+8
2017-04-21CGN: IPFIX loggingMatus Fabian3-18/+215
2017-04-19Support ping from outside network in 1:1 NAT (VPP-695)Juraj Sloboda4-45/+59
2017-04-12Handle multiple flows with the same client port in deterministic NATJuraj Sloboda2-15/+23
2017-04-12CGN: configurable timeoutsMatus Fabian5-15/+290
2017-04-12Support ICMP session timeout in deterministic NATJuraj Sloboda2-1/+8
2017-04-11Add ICMP support for deterministic NATJuraj Sloboda4-26/+414
2017-04-10Refactor SNAT codeJuraj Sloboda3-119/+132
2017-04-10Handle ICMP echo with TTL=1 in deterministic and fast SNAT nodesJuraj Sloboda2-3/+85
2017-04-10Make fixes in SNAT codeJuraj Sloboda2-52/+56
2017-04-06Use thread local storage for thread indexDamjan Marion3-111/+111
2017-03-22vlib: add description field in plugin registrationDamjan Marion1-0/+1
2017-03-22SNAT: added actual delete to snat_det_mapMartin1-12/+45
2017-03-16API:replaced all REPLY_MACRO's with api_helper_macros.hEyal Bari1-1/+1
2017-03-15API: define optional base_id for REPLY_MACRO'sEyal Bari1-102/+3
2017-03-13Refactor SNAT ICMP codeJuraj Sloboda4-314/+558
2017-03-08SNAT: deterministic map dumpMartin3-3/+125
2017-03-08SNAT: fix coverity warnings (VPP-608)Matus Fabian1-2/+3
2017-03-08SNAT: user_session_dump is_ip4 and vat unformating addedMartin3-0/+20
2017-03-08CGN: fix outside port calculation and set buffer error (VPP-623)Matus Fabian2-18/+33
2017-03-07CGN: Deterministic NAT (VPP-623)Matus Fabian8-163/+2148
2017-03-07Add setting of tenant VRF id for SNAT addresses (VPP-641)Juraj Sloboda4-8/+42
2017-03-07silence -Wmaybe-uninitialized warningGabriel Ganne1-1/+1
2017-03-06SNAT: session dump last heard type fixMartin2-3/+3
2017-03-04Fix duplicate binary API registration messages / bugsDave Barach1-2/+1
2017-03-02SNAT: user's dump and session dump of a certain snat user.magalik6-3/+288
2017-03-01VPP-598: tcp stack initial commitDave Barach2-25/+25
2017-02-22VPP-635: CLI Memory leak with invalid parameterBilly McFall1-43/+96
">; error_node = vlib_node_get_runtime (vm, ip4_input_node.index); } else { tid = INPUT_ACL_TABLE_IP6; error_node = vlib_node_get_runtime (vm, ip6_input_node.index); } from = vlib_frame_vector_args (frame); n_left_from = frame->n_vectors; /* First pass: compute hashes */ while (n_left_from > 2) { vlib_buffer_t *b0, *b1; u32 bi0, bi1; u8 *h0, *h1; u32 sw_if_index0, sw_if_index1; u32 table_index0, table_index1; vnet_classify_table_t *t0, *t1; /* prefetch next iteration */ { vlib_buffer_t *p1, *p2; p1 = vlib_get_buffer (vm, from[1]); p2 = vlib_get_buffer (vm, from[2]); vlib_prefetch_buffer_header (p1, STORE); CLIB_PREFETCH (p1->data, CLIB_CACHE_LINE_BYTES, STORE); vlib_prefetch_buffer_header (p2, STORE); CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE); } bi0 = from[0]; b0 = vlib_get_buffer (vm, bi0); bi1 = from[1]; b1 = vlib_get_buffer (vm, bi1); sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX]; table_index0 = am->classify_table_index_by_sw_if_index[tid][sw_if_index0]; sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX]; table_index1 = am->classify_table_index_by_sw_if_index[tid][sw_if_index1]; t0 = pool_elt_at_index (vcm->tables, table_index0); t1 = pool_elt_at_index (vcm->tables, table_index1); if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA) h0 = (void *) vlib_buffer_get_current (b0) + t0->current_data_offset; else h0 = b0->data; vnet_buffer (b0)->l2_classify.hash = vnet_classify_hash_packet (t0, (u8 *) h0); vnet_classify_prefetch_bucket (t0, vnet_buffer (b0)->l2_classify.hash); if (t1->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA) h1 = (void *) vlib_buffer_get_current (b1) + t1->current_data_offset; else h1 = b1->data; vnet_buffer (b1)->l2_classify.hash = vnet_classify_hash_packet (t1, (u8 *) h1); vnet_classify_prefetch_bucket (t1, vnet_buffer (b1)->l2_classify.hash); vnet_buffer (b0)->l2_classify.table_index = table_index0; vnet_buffer (b1)->l2_classify.table_index = table_index1; from += 2; n_left_from -= 2; } while (n_left_from > 0) { vlib_buffer_t *b0; u32 bi0; u8 *h0; u32 sw_if_index0; u32 table_index0; vnet_classify_table_t *t0; bi0 = from[0]; b0 = vlib_get_buffer (vm, bi0); sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX]; table_index0 = am->classify_table_index_by_sw_if_index[tid][sw_if_index0]; t0 = pool_elt_at_index (vcm->tables, table_index0); if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA) h0 = (void *) vlib_buffer_get_current (b0) + t0->current_data_offset; else h0 = b0->data; vnet_buffer (b0)->l2_classify.hash = vnet_classify_hash_packet (t0, (u8 *) h0); vnet_buffer (b0)->l2_classify.table_index = table_index0; vnet_classify_prefetch_bucket (t0, vnet_buffer (b0)->l2_classify.hash); from++; n_left_from--; } next_index = node->cached_next_index; from = vlib_frame_vector_args (frame); n_left_from = frame->n_vectors; while (n_left_from > 0) { u32 n_left_to_next; vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); /* Not enough load/store slots to dual loop... */ while (n_left_from > 0 && n_left_to_next > 0) { u32 bi0; vlib_buffer_t *b0; u32 next0 = ACL_NEXT_INDEX_DENY; u32 table_index0; vnet_classify_table_t *t0; vnet_classify_entry_t *e0; u64 hash0; u8 *h0; u8 error0; /* Stride 3 seems to work best */ if (PREDICT_TRUE (n_left_from > 3)) { vlib_buffer_t *p1 = vlib_get_buffer (vm, from[3]); vnet_classify_table_t *tp1; u32 table_index1; u64 phash1; table_index1 = vnet_buffer (p1)->l2_classify.table_index; if (PREDICT_TRUE (table_index1 != ~0)) { tp1 = pool_elt_at_index (vcm->tables, table_index1); phash1 = vnet_buffer (p1)->l2_classify.hash; vnet_classify_prefetch_entry (tp1, phash1); } } /* speculatively enqueue b0 to the current next frame */ bi0 = from[0]; to_next[0] = bi0; from += 1; to_next += 1; n_left_from -= 1; n_left_to_next -= 1; b0 = vlib_get_buffer (vm, bi0); table_index0 = vnet_buffer (b0)->l2_classify.table_index; e0 = 0; t0 = 0; vnet_get_config_data (am->vnet_config_main[tid], &b0->current_config_index, &next0, /* # bytes of config data */ 0); vnet_buffer (b0)->l2_classify.opaque_index = ~0; if (PREDICT_TRUE (table_index0 != ~0)) { hash0 = vnet_buffer (b0)->l2_classify.hash; t0 = pool_elt_at_index (vcm->tables, table_index0); if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA) h0 = (void *) vlib_buffer_get_current (b0) + t0->current_data_offset; else h0 = b0->data; e0 = vnet_classify_find_entry (t0, (u8 *) h0, hash0, now); if (e0) { vnet_buffer (b0)->l2_classify.opaque_index = e0->opaque_index; vlib_buffer_advance (b0, e0->advance); next0 = (e0->next_index < n_next_nodes) ? e0->next_index : next0; hits++; if (is_ip4) error0 = (next0 == ACL_NEXT_INDEX_DENY) ? IP4_ERROR_INACL_SESSION_DENY : IP4_ERROR_NONE; else error0 = (next0 == ACL_NEXT_INDEX_DENY) ? IP6_ERROR_INACL_SESSION_DENY : IP6_ERROR_NONE; b0->error = error_node->errors[error0]; if (e0->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX || e0->action == CLASSIFY_ACTION_SET_IP6_FIB_INDEX) vnet_buffer (b0)->sw_if_index[VLIB_TX] = e0->metadata; else if (e0->action == CLASSIFY_ACTION_SET_METADATA) vnet_buffer (b0)->ip.adj_index[VLIB_TX] = e0->metadata; } else { while (1) { if (PREDICT_TRUE (t0->next_table_index != ~0)) t0 = pool_elt_at_index (vcm->tables, t0->next_table_index); else { next0 = (t0->miss_next_index < n_next_nodes) ? t0->miss_next_index : next0; misses++; if (is_ip4) error0 = (next0 == ACL_NEXT_INDEX_DENY) ? IP4_ERROR_INACL_TABLE_MISS : IP4_ERROR_NONE; else error0 = (next0 == ACL_NEXT_INDEX_DENY) ? IP6_ERROR_INACL_TABLE_MISS : IP6_ERROR_NONE; b0->error = error_node->errors[error0]; break; } if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA) h0 = (void *) vlib_buffer_get_current (b0) + t0->current_data_offset; else h0 = b0->data; hash0 = vnet_classify_hash_packet (t0, (u8 *) h0); e0 = vnet_classify_find_entry (t0, (u8 *) h0, hash0, now); if (e0) { vnet_buffer (b0)->l2_classify.opaque_index = e0->opaque_index; vlib_buffer_advance (b0, e0->advance); next0 = (e0->next_index < n_next_nodes) ? e0->next_index : next0; hits++; chain_hits++; if (is_ip4) error0 = (next0 == ACL_NEXT_INDEX_DENY) ? IP4_ERROR_INACL_SESSION_DENY : IP4_ERROR_NONE; else error0 = (next0 == ACL_NEXT_INDEX_DENY) ? IP6_ERROR_INACL_SESSION_DENY : IP6_ERROR_NONE; b0->error = error_node->errors[error0]; if (e0->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX || e0->action == CLASSIFY_ACTION_SET_IP6_FIB_INDEX) vnet_buffer (b0)->sw_if_index[VLIB_TX] = e0->metadata; break; } } } } if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b0->flags & VLIB_BUFFER_IS_TRACED))) { ip_inacl_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); t->sw_if_index = vnet_buffer (b0)->sw_if_index[VLIB_RX]; t->next_index = next0; t->table_index = t0 ? t0 - vcm->tables : ~0; t->offset = (e0 && t0) ? vnet_classify_get_offset (t0, e0) : ~0; } /* verify speculative enqueue, maybe switch current next frame */ vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, n_left_to_next, bi0, next0); } vlib_put_next_frame (vm, node, next_index, n_left_to_next); } vlib_node_increment_counter (vm, node->node_index, IP_INACL_ERROR_MISS, misses); vlib_node_increment_counter (vm, node->node_index, IP_INACL_ERROR_HIT, hits); vlib_node_increment_counter (vm, node->node_index, IP_INACL_ERROR_CHAIN_HIT, chain_hits); return frame->n_vectors; } static uword ip4_inacl (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { return ip_inacl_inline (vm, node, frame, 1 /* is_ip4 */ ); } /* *INDENT-OFF* */ VLIB_REGISTER_NODE (ip4_inacl_node) = { .function = ip4_inacl, .name = "ip4-inacl", .vector_size = sizeof (u32), .format_trace = format_ip_inacl_trace, .n_errors = ARRAY_LEN(ip_inacl_error_strings), .error_strings = ip_inacl_error_strings, .n_next_nodes = ACL_NEXT_INDEX_N_NEXT, .next_nodes = { [ACL_NEXT_INDEX_DENY] = "error-drop", }, }; /* *INDENT-ON* */ VLIB_NODE_FUNCTION_MULTIARCH (ip4_inacl_node, ip4_inacl); static uword ip6_inacl (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { return ip_inacl_inline (vm, node, frame, 0 /* is_ip4 */ ); } /* *INDENT-OFF* */ VLIB_REGISTER_NODE (ip6_inacl_node) = { .function = ip6_inacl, .name = "ip6-inacl", .vector_size = sizeof (u32), .format_trace = format_ip_inacl_trace, .n_errors = ARRAY_LEN(ip_inacl_error_strings), .error_strings = ip_inacl_error_strings, .n_next_nodes = ACL_NEXT_INDEX_N_NEXT, .next_nodes = { [ACL_NEXT_INDEX_DENY] = "error-drop", }, }; /* *INDENT-ON* */ VLIB_NODE_FUNCTION_MULTIARCH (ip6_inacl_node, ip6_inacl); static clib_error_t * ip_inacl_init (vlib_main_t * vm) { return 0; } VLIB_INIT_FUNCTION (ip_inacl_init); /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */