/* * Copyright (c) 2017 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /** * @file * @brief NAT64 IPv4 to IPv6 translation (otside to inside network) */ #include #include #include #include #include typedef struct { u32 sw_if_index; u32 next_index; } nat64_out2in_trace_t; static u8 * format_nat64_out2in_trace (u8 * s, va_list * args) { CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); nat64_out2in_trace_t *t = va_arg (*args, nat64_out2in_trace_t *); s = format (s, "NAT64-out2in: sw_if_index %d, next index %d", t->sw_if_index, t->next_index); return s; } #define foreach_nat64_out2in_error \ _(UNSUPPORTED_PROTOCOL, "unsupported protocol") \ _(OUT2IN_PACKETS, "good out2in packets processed") \ _(NO_TRANSLATION, "no translation") \ _(UNKNOWN, "unknown") \ _(DROP_FRAGMENT, "drop fragment") \ _(TCP_PACKETS, "TCP packets") \ _(UDP_PACKETS, "UDP packets") \ _(ICMP_PACKETS, "ICMP packets") \ _(OTHER_PACKETS, "other protocol packets") \ _(FRAGMENTS, "fragments") \ _(CACHED_FRAGMENTS, "cached fragments") \ _(PROCESSED_FRAGMENTS, "processed fragments") typedef enum { #define _(sym,str) NAT64_OUT2IN_ERROR_##sym, foreach_nat64_out2in_error #undef _ NAT64_OUT2IN_N_ERROR, } nat64_out2in_error_t; static char *nat64_out2in_error_strings[] = { #define _(sym,string) string, foreach_nat64_out2in_error #undef _ }; typedef enum { NAT64_OUT2IN_NEXT_IP6_LOOKUP, NAT64_OUT2IN_NEXT_IP4_LOOKUP, NAT64_OUT2IN_NEXT_DROP, NAT64_OUT2IN_N_NEXT, } nat64_out2in_next_t; typedef struct nat64_out2in_set_ctx_t_ { vlib_buffer_t *b; vlib_main_t *vm; u32 thread_index; } nat64_out2in_set_ctx_t; static int nat64_out2in_tcp_udp (vlib_main_t * vm, vlib_buffer_t * b, nat64_out2in_set_ctx_t * ctx) { ip4_header_t *ip4; ip6_header_t *ip6; ip_csum_t csum; u16 *checksum = NULL; ip6_frag_hdr_t *frag; u32 frag_id; ip4_address_t old_src, old_dst; nat64_main_t *nm = &nat64_main; nat64_db_bib_entry_t *bibe; nat64_db_st_entry_t *ste; ip46_address_t saddr; ip46_address_t daddr; ip6_address_t ip6_saddr; u8 proto = vnet_buffer (b)->ip.reass.ip_proto; u16 dport = vnet_buffer (b)->ip.reass.l4_dst_port; u16 sport = vnet_buffer (b)->ip.reass.l4_src_port; u32 sw_if_index, fib_index; nat64_db_t *db = &nm->db[ctx->thread_index]; ip4 = vlib_buffer_get_current (b); udp_header_t *udp = ip4_next_header (ip4); tcp_header_t *tcp = ip4_next_header (ip4); if (!vnet_buffer (b)->ip.reass.is_non_first_fragment) { if (ip4->protocol == IP_PROTOCOL_UDP) { checksum = &udp->checksum; //UDP checksum is optional over IPv4 but mandatory for IPv6 //We do not check udp->length sanity but use our safe computed value instead if (PREDICT_FALSE (!*checksum)) { u16 udp_len = clib_host_to_net_u16 (ip4->length) - sizeof (*ip4); csum = ip_incremental_checksum (0, udp, udp_len); csum = ip_csum_with_carry (csum, clib_host_to_net_u16 (udp_len)); csum = ip_csum_with_carry (csum, clib_host_to_net_u16 (IP_PROTOCOL_UDP)); csum = ip_csum_with_carry (csum, *((u64 *) (&ip4->src_address))); *checksum = ~ip_csum_fold (csum); } } else { checksum = &tcp->checksum; } } old_src.as_u32 = ip4->src_address.as_u32; old_dst.as_u32 = ip4->dst_address.as_u32; // Deal with fragmented packets u16 frag_offset = ip4_get_fragment_offset (ip4); if (PREDICT_FALSE (ip4_get_fragment_more (ip4) || frag_offset)) { ip6 = (ip6_header_t *) u8_ptr_add (ip4, sizeof (*ip4) - sizeof (*ip6) - sizeof (*frag)); frag = (ip6_frag_hdr_t *) u8_ptr_add (ip4, sizeof (*ip4) - sizeof (*frag)); frag_id = frag_id_4to6 (ip4->fragment_id); vlib_buffer_advance (b, sizeof (*ip4) - sizeof (*ip6) - sizeof (*frag)); } else { ip6 = (ip6_header_t *) (((u8 *) ip4) + sizeof (*ip4) - sizeof (*ip6)); vlib_buffer_advance (b, sizeof (*ip4) - sizeof (*ip6)); frag = NULL; } ip6->ip_version_traffic_class_and_flow_label = clib_host_to_net_u32 ((6 << 28) + (ip4->tos << 20)); ip6->payload_length = u16_net_add (ip4->length, -sizeof (*ip4)); ip6->hop_limit = ip4->ttl; ip6->protocol = ip4->protocol; sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX]; fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index); clib_memset (&saddr, 0, sizeof (saddr)); saddr.ip4.as_u32 = ip4->src_address.as_u32; clib_memset (&daddr, 0, sizeof (daddr)); daddr.ip4.as_u32 = ip4->dst_address.as_u32; ste = nat64_db_st_entry_find (db, &daddr, &saddr, dport, sport, proto, fib_index, 0); if (ste) { bibe = nat64_db_bib_entry_by_index (db, proto, ste->bibe_index); if (!bibe) return -1; } else { bibe = nat64_db_bib_entry_find (db, &daddr, dport, proto, fib_index, 0); if (!bibe) return -1; nat64_compose_ip6 (&ip6_saddr, &old_src, bibe->fib_index); ste = nat64_db_st_entry_create (ctx->thread_index, db, bibe, &ip6_saddr, &saddr.ip4, sport); if (!ste) return -1; vlib_set_simple_counter (&nm->total_sessions, ctx->thread_index, 0, db->st.st_entries_num); } ip6->src_address.as_u64[0] = ste->in_r_addr.as_u64[0]; ip6->src_address.as_u64[1] = ste->in_r_addr.as_u64[1]; ip6->dst_address.as_u64[0] = bibe->in_addr.as_u64[0]; ip6->dst_address.as_u64[1] = bibe->in_addr.as_u64[1]; vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index; nat64_session_reset_timeout (ste, ctx->vm); if (PREDICT_FALSE (frag != NULL)) { frag->next_hdr = ip6->protocol; frag->identification = frag_id; frag->rsv = 0; frag->fragment_offset_and_more = ip6_frag_hdr_offset_and_more (frag_offset, 1); ip6->protocol = IP_PROTOCOL_IPV6_FRAGMENTATION; ip6->payload_length = u16_net_add (ip6->payload_length, sizeof (*frag)); } if (!vnet_buffer (b)->ip.reass.is_non_first_fragment) { udp->dst_port = bibe->in_port; if (proto == IP_PROTOCOL_TCP) { nat64_tcp_session_set_state (ste, tcp, 0); } csum = ip_csum_sub_even (*checksum, dport); csum = ip_csum_add_even (csum, udp->dst_port); csum = ip_csum_sub_even (csum, old_src.as_u32); csum = ip_csum_sub_even (csum, old_dst.as_u32); csum = ip_csum_add_even (csum, ip6->src_address.as_u64[0]); csum = ip_csum_add_even (csum, ip6->src_address.as_u64[1]); csum = ip_csum_add_even (csum, ip6->dst_address.as_u64[0]); csum = ip_csum_add_even (csum, ip6->dst_address.as_u64[1]); *checksum = ip_csum_fold (csum); } return 0; } static int nat64_out2in_icmp_set_cb (vlib_buffer_t * b, ip4_header_t * ip4, ip6_header_t * ip6, void *arg) { nat64_main_t *nm = &nat64_main; nat64_out2in_set_ctx_t *ctx = arg; nat64_db_bib_entry_t *bibe; nat64_db_st_entry_t *ste; ip46_address_t saddr, daddr; ip6_address_t ip6_saddr; u32 sw_if_index, fib_index; icmp46_header_t *icmp = ip4_next_header (ip4); nat64_db_t *db = &nm->db[ctx->thread_index]; sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX]; fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index); clib_memset (&saddr, 0, sizeof (saddr)); saddr.ip4.as_u32 = ip4->src_address.as_u32; clib_memset (&daddr, 0, sizeof (daddr)); daddr.ip4.as_u32 = ip4->dst_address.as_u32; if (icmp->type == ICMP6_echo_request || icmp->type == ICMP6_echo_reply) { u16 out_id = ((u16 *) (icmp))[2]; ste = nat64_db_st_entry_find (db, &daddr, &saddr, out_id, 0, IP_PROTOCOL_ICMP, fib_index, 0); if (ste) { bibe = nat64_db_bib_entry_by_index (db, IP_PROTOCOL_ICMP, ste->bibe_index); if (!bibe) return -1; } else { bibe = nat64_db_bib_entry_find (db, &daddr, out_id, IP_PROTOCOL_ICMP, fib_index, 0); if (!bibe) return -1; nat64_compose_ip6 (&ip6_saddr, &ip4->src_address, bibe->fib_index); ste = nat64_db_st_entry_create (ctx->thread_index, db, bibe, &ip6_saddr, &saddr.ip4, 0); if (!ste) return -1; vlib_set_simple_counter (&nm->total_sessions, ctx->thread_index, 0, db->st.st_entries_num); } nat64_session_reset_timeout (ste, ctx->vm); ip6->src_address.as_u64[0] = ste->in_r_addr.as_u64[0]; ip6->src_address.as_u64[1] = ste->in_r_addr.as_u64[1]; ip6->dst_address.as_u64[0] = bibe->in_addr.as_u64[0]; ip6->dst_address.as_u64[1] = bibe->in_addr.as_u64[1]; ((u16 *) (icmp))[2] = bibe->in_port; vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index; } else { ip6_header_t *inner_ip6 = (ip6_header_t *) u8_ptr_add (icmp, 8); nat64_compose_ip6 (&ip6->src_address, &ip4->src_address, vnet_buffer (ctx->b)->sw_if_index[VLIB_TX]); ip6->dst_address.as_u64[0] = inner_ip6->src_address.as_u64[0]; ip6->dst_address.as_u64[1] = inner_ip6->src_address.as_u64[1]; } return 0; } static int nat64_out2in_inner_icmp_set_cb (vlib_buffer_t * b, ip4_header_t * ip4, ip6_header_t * ip6, void *arg) { nat64_main_t *nm = &nat64_main; nat64_out2in_set_ctx_t *ctx = arg; nat64_db_bib_entry_t *bibe; nat64_db_st_entry_t *ste; ip46_address_t saddr, daddr; u32 sw_if_index, fib_index; u8 proto = ip4->protocol; nat64_db_t *db = &nm->db[ctx->thread_index]; sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX]; fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP6, sw_if_index); clib_memset (&saddr, 0, sizeof (saddr)); saddr.ip4.as_u32 = ip4-
/*
 * Copyright (c) 2017-2019 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <vppinfra/socket.h>
#include <vnet/vnet.h>
#include <vnet/session/session_table.h>

#ifndef SRC_VNET_SESSION_APPLICATION_NAMESPACE_H_
#define SRC_VNET_SESSION_APPLICATION_NAMESPACE_H_

typedef struct _app_namespace
{
  /**
   * Local sw_if_index that supports transport connections for this namespace
   */
  u32 sw_if_index;

  /**
   * Network namespace (e.g., fib_index associated to the sw_if_index)
   * wherein connections are to be established. Since v4 and v6 fibs are
   * separate, we actually need to keep pointers to both.
   */
  u32 ip4_fib_index;
  u32 ip6_fib_index;

  /**
   * Local session table associated to ns
   */
  u32 local_table_index;

  /**
   * Secret apps need to provide to authorize attachment to the namespace
   */
  u64 ns_secret;

  /**
   * Application namespace id
   */
  u8 *ns_id;

  /**
   * Linux netns if one was provided
   */
  u8 *netns;

  /**
   * Name of socket applications can use to attach to session layer
   */
  u8 *sock_name;

  /**
   * Pool of active application sockets
   */
  clib_socket_t *app_sockets;
} app_namespace_t;

typedef struct _vnet_app_namespace_add_del_args
{