From 18327be5d458f9f73c12d76e677ee5a068ec6b10 Mon Sep 17 00:00:00 2001 From: Ole Troan Date: Tue, 12 Jan 2021 21:49:38 +0100 Subject: nat: 1:1 policy NAT A NAT sub-plugin doing statically configured match/rewrite on IP4 input or output. It's stateless (no connection tracking). Currently it supports rewriting of SA, DA and TCP/UDP ports. It should be simple to add new rewrites if required. API: pnat_binding_add, pnat_binding_del, pnat_bindings_get, pnat_interfaces_get CLI: set pnat translation interface match <5-tuple> rewrite <5-tuple> {in|out} [del] show pnat translations show pnat interfaces Trying a new C based unit testing scheme. Where the graph node is tested in isolation. See pnat/pnat_test.c. Also added new cmake targets to generate coverage directly. E.g.: make test_pnat-ccov-report File '/vpp/sdnat/src/plugins/nat/pnat/pnat.c': Name Regions Miss Cover Lines Miss Cover ------------------------------------------------------------------------------------ pnat_interface_by_sw_if_index 39 8 79.49% 13 0 100.00% pnat_instructions_from_mask 9 0 100.00% 13 0 100.00% pnat_binding_add 64 8 87.50% 31 2 93.55% pnat_flow_lookup 4 4 0.00% 10 10 0.00% pnat_binding_attach 104 75 27.88% 33 6 81.82% pnat_binding_detach 30 5 83.33% 23 2 91.30% pnat_binding_del 97 33 65.98% 17 3 82.35% pnat.c:pnat_calc_key_from_5tuple 9 1 88.89% 14 1 92.86% pnat.c:pnat_interface_check_mask 10 2 80.00% 11 2 81.82% pnat.c:pnat_enable 5 0 100.00% 11 0 100.00% pnat.c:pnat_enable_interface 107 26 75.70% 60 15 75.00% pnat.c:pnat_disable_interface 91 30 67.03% 32 7 78.12% pnat.c:pnat_disable 7 2 71.43% 13 7 46.15% ------------------------------------------------------------------------------------ TOTAL 576 194 66.32% 281 55 80.43% File '/vpp/sdnat/src/plugins/nat/pnat/pnat_node.h': Name Regions Miss Cover Lines Miss Cover ------------------------------------------------------------------------------------ pnat_test.c:pnat_node_inline 67 11 83.58% 115 1 99.13% pnat_test.c:pnat_calc_key 9 2 77.78% 14 2 85.71% pnat_test.c:pnat_rewrite_ip4 55 11 80.00% 60 12 80.00% pnat_test.c:format_pnat_trace 1 1 0.00% 12 12 0.00% pnat_node.c:pnat_node_inline 63 63 0.00% 115 115 0.00% pnat_node.c:pnat_calc_key 9 9 0.00% 14 14 0.00% pnat_node.c:pnat_rewrite_ip4 55 55 0.00% 60 60 0.00% pnat_node.c:format_pnat_trace 5 5 0.00% 12 12 0.00% ------------------------------------------------------------------------------------ TOTAL 264 157 40.53% 402 228 43.28% Type: feature Change-Id: I9c897f833603054a8303e7369ebff6512517c9e0 Signed-off-by: Ole Troan --- src/plugins/nat/pnat/pnat_cli.c | 274 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 274 insertions(+) create mode 100644 src/plugins/nat/pnat/pnat_cli.c (limited to 'src/plugins/nat/pnat/pnat_cli.c') diff --git a/src/plugins/nat/pnat/pnat_cli.c b/src/plugins/nat/pnat/pnat_cli.c new file mode 100644 index 00000000000..2d389013c08 --- /dev/null +++ b/src/plugins/nat/pnat/pnat_cli.c @@ -0,0 +1,274 @@ +/* + * Copyright (c) 2021 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "pnat.h" + +/* + * This file contains the handlers for the (unsupported) VPP debug CLI. + */ +u8 *format_pnat_5tuple(u8 *s, va_list *args) { + pnat_5tuple_t *t = va_arg(*args, pnat_5tuple_t *); + s = format(s, "{"); + if (t->mask & PNAT_SA) + s = format(s, "%U", format_ip4_address, &t->src); + else + s = format(s, "*"); + if (t->mask & PNAT_SPORT) + s = format(s, ":%u,", t->sport); + else + s = format(s, ":*,"); + if (t->proto > 0) + s = format(s, "%U,", format_ip_protocol, t->proto); + else + s = format(s, "*,"); + if (t->mask & PNAT_DA) + s = format(s, "%U", format_ip4_address, &t->dst); + else + s = format(s, "*"); + if (t->mask & PNAT_DPORT) + s = format(s, ":%u", t->dport); + else + s = format(s, ":*"); + s = format(s, "}"); + return s; +} + +u8 *format_pnat_translation(u8 *s, va_list *args) { + u32 index = va_arg(*args, u32); + pnat_translation_t *t = va_arg(*args, pnat_translation_t *); + s = format(s, "[%d] match: %U rewrite: %U", index, format_pnat_5tuple, + &t->match, format_pnat_5tuple, &t->rewrite); + return s; +} + +static u8 *format_pnat_mask(u8 *s, va_list *args) { + pnat_mask_t t = va_arg(*args, pnat_mask_t); + if (t & PNAT_SA) + s = format(s, "SA "); + if (t & PNAT_SPORT) + s = format(s, "SP "); + if (t & PNAT_DA) + s = format(s, "DA "); + if (t & PNAT_DPORT) + s = format(s, "DP"); + return s; +} + +static u8 *format_pnat_interface(u8 *s, va_list *args) { + pnat_interface_t *interface = va_arg(*args, pnat_interface_t *); + s = format(s, "sw_if_index: %d", interface->sw_if_index); + if (interface->enabled[PNAT_IP4_INPUT]) { + s = format(s, " input mask: %U", format_pnat_mask, + interface->lookup_mask[PNAT_IP4_INPUT]); + } + if (interface->enabled[PNAT_IP4_OUTPUT]) { + s = format(s, " output mask: %U", format_pnat_mask, + interface->lookup_mask[PNAT_IP4_OUTPUT]); + } + return s; +} + +uword unformat_pnat_5tuple(unformat_input_t *input, va_list *args) { + pnat_5tuple_t *t = va_arg(*args, pnat_5tuple_t *); + u32 dport, sport; + while (1) { + if (unformat(input, "src %U", unformat_ip4_address, &t->src)) + t->mask |= PNAT_SA; + else if (unformat(input, "dst %U", unformat_ip4_address, &t->dst)) + t->mask |= PNAT_DA; + else if (unformat(input, "sport %d", &sport)) { + if (sport < 0 || sport > 65535) + return 0; + t->mask |= PNAT_SPORT; + t->sport = sport; + } else if (unformat(input, "dport %d", &dport)) { + if (dport < 0 || dport > 65535) + return 0; + t->mask |= PNAT_DPORT; + t->dport = dport; + } else if (unformat(input, "proto %U", unformat_ip_protocol, &t->proto)) + ; + else + break; + } + return 1; +} + +static clib_error_t *set_pnat_translation_command_fn(vlib_main_t *vm, + unformat_input_t *input, + vlib_cli_command_t *cmd) { + unformat_input_t _line_input, *line_input = &_line_input; + clib_error_t *error = 0; + bool in = false, out = false; + bool match_set = false, rewrite_set = false; + bool add = true; + u32 sw_if_index = ~0; + pnat_5tuple_t match = {0}; + pnat_5tuple_t rewrite = {0}; + + /* Get a line of input. */ + if (!unformat_user(input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input(line_input) != UNFORMAT_END_OF_INPUT) { + if (unformat(line_input, "match %U", unformat_pnat_5tuple, &match)) + match_set = true; + else if (unformat(line_input, "rewrite %U", unformat_pnat_5tuple, + &rewrite)) + rewrite_set = true; + else if (unformat(line_input, "interface %U", + unformat_vnet_sw_interface, vnet_get_main(), + &sw_if_index)) + ; + else if (unformat(line_input, "in")) { + in = true; + } else if (unformat(line_input, "out")) { + out = true; + } else if (unformat(line_input, "del")) { + add = false; + } else { + error = clib_error_return(0, "unknown input `%U'", + format_unformat_error, line_input); + goto done; + } + } + if (sw_if_index == ~0) { + error = clib_error_return(0, "interface is required `%U'", + format_unformat_error, line_input); + goto done; + } + if ((in && out) || (!in && !out)) { + error = clib_error_return(0, "in or out is required `%U'", + format_unformat_error, line_input); + goto done; + } + if (!match_set) { + error = clib_error_return(0, "missing parameter: match `%U'", + format_unformat_error, line_input); + goto done; + } + if (!rewrite_set) { + error = clib_error_return(0, "missing parameter: rewrite `%U'", + format_unformat_error, line_input); + goto done; + } + + if ((match.dport || match.sport) && + (match.proto != 17 && match.proto != 6)) { + error = clib_error_return(0, "missing protocol (TCP|UDP): match `%U'", + format_unformat_error, line_input); + goto done; + } + pnat_attachment_point_t attachment = in ? PNAT_IP4_INPUT : PNAT_IP4_OUTPUT; + + if (add) { + u32 binding_index; + int rv = pnat_binding_add(&match, &rewrite, &binding_index); + if (rv) { + error = clib_error_return(0, "Adding binding failed %d", rv); + goto done; + } + rv = pnat_binding_attach(sw_if_index, attachment, binding_index); + if (rv) { + pnat_binding_del(binding_index); + error = clib_error_return( + 0, "Attaching binding to interface failed %d", rv); + goto done; + } + } else { + /* Lookup binding and lookup interface if both exists proceed with + * delete */ + u32 binding_index = pnat_flow_lookup(sw_if_index, attachment, &match); + if (binding_index == ~0) { + error = clib_error_return(0, "Binding does not exist"); + goto done; + } + pnat_attachment_point_t attachment = + in ? PNAT_IP4_INPUT : PNAT_IP4_OUTPUT; + int rv = pnat_binding_detach(sw_if_index, attachment, binding_index); + if (rv) { + error = clib_error_return(0, "Detaching binding failed %d %d", + binding_index, rv); + goto done; + } + rv = pnat_binding_del(binding_index); + if (rv) { + error = clib_error_return(0, "Deleting translation failed %d %d", + binding_index, rv); + goto done; + } + } + +done: + unformat_free(line_input); + + return error; +} + +VLIB_CLI_COMMAND(set_pnat_translation_command, static) = { + .path = "set pnat translation", + .short_help = "set pnat translation interface match <5-tuple> " + "rewrite <5-tuple> {in|out} [del]", + .function = set_pnat_translation_command_fn, +}; + +static clib_error_t * +show_pnat_translations_command_fn(vlib_main_t *vm, unformat_input_t *input, + vlib_cli_command_t *cmd) { + pnat_main_t *pm = &pnat_main; + pnat_translation_t *s; + clib_error_t *error = 0; + + /* Get a line of input. */ + pool_foreach(s, pm->translations) { + vlib_cli_output(vm, "%U", format_pnat_translation, s - pm->translations, + s); + } + return error; +} + +VLIB_CLI_COMMAND(show_pnat_translations_command, static) = { + .path = "show pnat translations", + .short_help = "show pnat translations", + .function = show_pnat_translations_command_fn, +}; + +static clib_error_t *show_pnat_interfaces_command_fn(vlib_main_t *vm, + unformat_input_t *input, + vlib_cli_command_t *cmd) { + pnat_main_t *pm = &pnat_main; + pnat_interface_t *interface; + clib_error_t *error = 0; + + /* Get a line of input. */ + pool_foreach(interface, pm->interfaces) { + vlib_cli_output(vm, "%U", format_pnat_interface, interface); + } + return error; +} + +VLIB_CLI_COMMAND(show_pnat_interfaces_command, static) = { + .path = "show pnat interfaces", + .short_help = "show pnat interfaces", + .function = show_pnat_interfaces_command_fn, +}; -- cgit 1.2.3-korg