From 18327be5d458f9f73c12d76e677ee5a068ec6b10 Mon Sep 17 00:00:00 2001 From: Ole Troan Date: Tue, 12 Jan 2021 21:49:38 +0100 Subject: nat: 1:1 policy NAT A NAT sub-plugin doing statically configured match/rewrite on IP4 input or output. It's stateless (no connection tracking). Currently it supports rewriting of SA, DA and TCP/UDP ports. It should be simple to add new rewrites if required. API: pnat_binding_add, pnat_binding_del, pnat_bindings_get, pnat_interfaces_get CLI: set pnat translation interface match <5-tuple> rewrite <5-tuple> {in|out} [del] show pnat translations show pnat interfaces Trying a new C based unit testing scheme. Where the graph node is tested in isolation. See pnat/pnat_test.c. Also added new cmake targets to generate coverage directly. E.g.: make test_pnat-ccov-report File '/vpp/sdnat/src/plugins/nat/pnat/pnat.c': Name Regions Miss Cover Lines Miss Cover ------------------------------------------------------------------------------------ pnat_interface_by_sw_if_index 39 8 79.49% 13 0 100.00% pnat_instructions_from_mask 9 0 100.00% 13 0 100.00% pnat_binding_add 64 8 87.50% 31 2 93.55% pnat_flow_lookup 4 4 0.00% 10 10 0.00% pnat_binding_attach 104 75 27.88% 33 6 81.82% pnat_binding_detach 30 5 83.33% 23 2 91.30% pnat_binding_del 97 33 65.98% 17 3 82.35% pnat.c:pnat_calc_key_from_5tuple 9 1 88.89% 14 1 92.86% pnat.c:pnat_interface_check_mask 10 2 80.00% 11 2 81.82% pnat.c:pnat_enable 5 0 100.00% 11 0 100.00% pnat.c:pnat_enable_interface 107 26 75.70% 60 15 75.00% pnat.c:pnat_disable_interface 91 30 67.03% 32 7 78.12% pnat.c:pnat_disable 7 2 71.43% 13 7 46.15% ------------------------------------------------------------------------------------ TOTAL 576 194 66.32% 281 55 80.43% File '/vpp/sdnat/src/plugins/nat/pnat/pnat_node.h': Name Regions Miss Cover Lines Miss Cover ------------------------------------------------------------------------------------ pnat_test.c:pnat_node_inline 67 11 83.58% 115 1 99.13% pnat_test.c:pnat_calc_key 9 2 77.78% 14 2 85.71% pnat_test.c:pnat_rewrite_ip4 55 11 80.00% 60 12 80.00% pnat_test.c:format_pnat_trace 1 1 0.00% 12 12 0.00% pnat_node.c:pnat_node_inline 63 63 0.00% 115 115 0.00% pnat_node.c:pnat_calc_key 9 9 0.00% 14 14 0.00% pnat_node.c:pnat_rewrite_ip4 55 55 0.00% 60 60 0.00% pnat_node.c:format_pnat_trace 5 5 0.00% 12 12 0.00% ------------------------------------------------------------------------------------ TOTAL 264 157 40.53% 402 228 43.28% Type: feature Change-Id: I9c897f833603054a8303e7369ebff6512517c9e0 Signed-off-by: Ole Troan --- src/plugins/nat/pnat/pnat_node.c | 83 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 src/plugins/nat/pnat/pnat_node.c (limited to 'src/plugins/nat/pnat/pnat_node.c') diff --git a/src/plugins/nat/pnat/pnat_node.c b/src/plugins/nat/pnat/pnat_node.c new file mode 100644 index 00000000000..0209b49b0aa --- /dev/null +++ b/src/plugins/nat/pnat/pnat_node.c @@ -0,0 +1,83 @@ +/* + * Copyright (c) 2021 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + * Policy NAT. + * Match packet against rule in a hash and translate according to given + * instructions. Rules are kept in a flow-cache bihash. Instructions in a pool + * of translation entries. + * + * All rules for a given interface/direction must use the same lookup pattern. + * E.g. SA+SP. + * + * A dynamic NAT would punt to slow path on a miss in the flow cache, in this + * case the miss behaviour is configurable. Default behaviour is pass packet + * along unchanged. + * + * The data structures are shared and assuming that updates to the tables are + * rare. Data-structures are protected depending on the API/CLI barriers. + */ + +#include +#include +#include /* For error counters */ +#include "pnat_node.h" /* Graph nodes */ + +VLIB_NODE_FN(pnat_input_node) +(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) { + return pnat_node_inline(vm, node, frame, PNAT_IP4_INPUT, VLIB_RX); +} +VLIB_NODE_FN(pnat_output_node) +(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) { + return pnat_node_inline(vm, node, frame, PNAT_IP4_OUTPUT, VLIB_TX); +} + +VLIB_REGISTER_NODE(pnat_input_node) = { + .name = "pnat-input", + .vector_size = sizeof(u32), + .format_trace = format_pnat_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + .n_errors = PNAT_N_ERROR, + .error_counters = pnat_error_counters, + .n_next_nodes = PNAT_N_NEXT, + .next_nodes = + { + [PNAT_NEXT_DROP] = "error-drop", + }, +}; + +VLIB_REGISTER_NODE(pnat_output_node) = { + .name = "pnat-output", + .vector_size = sizeof(u32), + .format_trace = format_pnat_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + .n_errors = PNAT_N_ERROR, + .error_counters = pnat_error_counters, + .sibling_of = "pnat-input", +}; + +/* Hook up features */ +VNET_FEATURE_INIT(pnat_input, static) = { + .arc_name = "ip4-unicast", + .node_name = "pnat-input", + .runs_after = VNET_FEATURES("acl-plugin-in-ip4-fa", + "ip4-sv-reassembly-feature"), +}; +VNET_FEATURE_INIT(pnat_output, static) = { + .arc_name = "ip4-output", + .node_name = "pnat-output", + .runs_after = VNET_FEATURES("acl-plugin-out-ip4-fa", + "ip4-sv-reassembly-output-feature"), +}; -- cgit 1.2.3-korg