FD.io VPP  v17.07.01-10-g3be13f0
Vector Packet Processing
nat64_out2in.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2017 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief NAT64 IPv4 to IPv6 translation (otside to inside network)
18  */
19 
20 #include <snat/nat64.h>
21 #include <vnet/ip/ip4_to_ip6.h>
22 #include <vnet/fib/ip4_fib.h>
23 
24 typedef struct
25 {
29 
30 static u8 *
31 format_nat64_out2in_trace (u8 * s, va_list * args)
32 {
33  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
34  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
35  nat64_out2in_trace_t *t = va_arg (*args, nat64_out2in_trace_t *);
36 
37  s =
38  format (s, "NAT64-out2in: sw_if_index %d, next index %d", t->sw_if_index,
39  t->next_index);
40 
41  return s;
42 }
43 
45 
46 #define foreach_nat64_out2in_error \
47 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
48 _(OUT2IN_PACKETS, "Good out2in packets processed") \
49 _(NO_TRANSLATION, "No translation") \
50 _(UNKNOWN, "unknown")
51 
52 typedef enum
53 {
54 #define _(sym,str) NAT64_OUT2IN_ERROR_##sym,
56 #undef _
59 
60 static char *nat64_out2in_error_strings[] = {
61 #define _(sym,string) string,
63 #undef _
64 };
65 
66 typedef enum
67 {
72 
74 {
78 
79 static int
81  void *arg)
82 {
83  nat64_main_t *nm = &nat64_main;
84  nat64_out2in_set_ctx_t *ctx = arg;
85  nat64_db_bib_entry_t *bibe;
86  nat64_db_st_entry_t *ste;
87  ip46_address_t saddr, daddr;
88  ip6_address_t ip6_saddr;
89  udp_header_t *udp = ip4_next_header (ip4);
90  tcp_header_t *tcp = ip4_next_header (ip4);
92  u16 dport = udp->dst_port;
93  u16 sport = udp->src_port;
94  u32 sw_if_index, fib_index;
95  u16 *checksum;
96  ip_csum_t csum;
97 
98  sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
99  fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
100 
101  memset (&saddr, 0, sizeof (saddr));
102  saddr.ip4.as_u32 = ip4->src_address.as_u32;
103  memset (&daddr, 0, sizeof (daddr));
104  daddr.ip4.as_u32 = ip4->dst_address.as_u32;
105 
106  ste =
107  nat64_db_st_entry_find (&nm->db, &daddr, &saddr, dport, sport, proto,
108  fib_index, 0);
109  if (ste)
110  {
111  bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
112  if (!bibe)
113  return -1;
114  }
115  else
116  {
117  bibe =
118  nat64_db_bib_entry_find (&nm->db, &daddr, dport, proto, fib_index, 0);
119 
120  if (!bibe)
121  return -1;
122 
123  nat64_compose_ip6 (&ip6_saddr, &ip4->src_address, bibe->fib_index);
124  ste =
125  nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4,
126  sport);
127  }
128 
129  nat64_session_reset_timeout (ste, ctx->vm);
130 
131  ip6->src_address.as_u64[0] = ste->in_r_addr.as_u64[0];
132  ip6->src_address.as_u64[1] = ste->in_r_addr.as_u64[1];
133 
134  ip6->dst_address.as_u64[0] = bibe->in_addr.as_u64[0];
135  ip6->dst_address.as_u64[1] = bibe->in_addr.as_u64[1];
136  udp->dst_port = bibe->in_port;
137 
138  if (proto == SNAT_PROTOCOL_UDP)
139  checksum = &udp->checksum;
140  else
141  checksum = &tcp->checksum;
142  csum = ip_csum_sub_even (*checksum, dport);
143  csum = ip_csum_add_even (csum, udp->dst_port);
144  *checksum = ip_csum_fold (csum);
145 
146  vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
147 
148  return 0;
149 }
150 
151 static int
153 {
154  nat64_main_t *nm = &nat64_main;
155  nat64_out2in_set_ctx_t *ctx = arg;
156  nat64_db_bib_entry_t *bibe;
157  nat64_db_st_entry_t *ste;
158  ip46_address_t saddr, daddr;
159  ip6_address_t ip6_saddr;
160  u32 sw_if_index, fib_index;
161  icmp46_header_t *icmp = ip4_next_header (ip4);
162 
163  sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
164  fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
165 
166  memset (&saddr, 0, sizeof (saddr));
167  saddr.ip4.as_u32 = ip4->src_address.as_u32;
168  memset (&daddr, 0, sizeof (daddr));
169  daddr.ip4.as_u32 = ip4->dst_address.as_u32;
170 
171  if (icmp->type == ICMP6_echo_request || icmp->type == ICMP6_echo_reply)
172  {
173  u16 out_id = ((u16 *) (icmp))[2];
174  ste =
175  nat64_db_st_entry_find (&nm->db, &daddr, &saddr, out_id, 0,
176  SNAT_PROTOCOL_ICMP, fib_index, 0);
177 
178  if (ste)
179  {
180  bibe =
181  nat64_db_bib_entry_by_index (&nm->db, SNAT_PROTOCOL_ICMP,
182  ste->bibe_index);
183  if (!bibe)
184  return -1;
185  }
186  else
187  {
188  bibe =
189  nat64_db_bib_entry_find (&nm->db, &daddr, out_id,
190  SNAT_PROTOCOL_ICMP, fib_index, 0);
191  if (!bibe)
192  return -1;
193 
194  nat64_compose_ip6 (&ip6_saddr, &ip4->src_address, bibe->fib_index);
195  ste =
196  nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4,
197  0);
198  }
199 
200  nat64_session_reset_timeout (ste, ctx->vm);
201 
202  ip6->src_address.as_u64[0] = ste->in_r_addr.as_u64[0];
203  ip6->src_address.as_u64[1] = ste->in_r_addr.as_u64[1];
204 
205  ip6->dst_address.as_u64[0] = bibe->in_addr.as_u64[0];
206  ip6->dst_address.as_u64[1] = bibe->in_addr.as_u64[1];
207  ((u16 *) (icmp))[2] = bibe->in_port;
208 
209  vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
210  }
211  else
212  {
213  ip6_header_t *inner_ip6 = (ip6_header_t *) u8_ptr_add (icmp, 8);
214 
216  vnet_buffer (ctx->b)->sw_if_index[VLIB_TX]);
217  ip6->dst_address.as_u64[0] = inner_ip6->src_address.as_u64[0];
218  ip6->dst_address.as_u64[1] = inner_ip6->src_address.as_u64[1];
219  }
220 
221  return 0;
222 }
223 
224 static int
226  void *arg)
227 {
228  nat64_main_t *nm = &nat64_main;
229  nat64_out2in_set_ctx_t *ctx = arg;
230  nat64_db_bib_entry_t *bibe;
231  nat64_db_st_entry_t *ste;
232  ip46_address_t saddr, daddr;
233  u32 sw_if_index, fib_index;
235 
236  sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
237  fib_index =
239 
240  memset (&saddr, 0, sizeof (saddr));
241  saddr.ip4.as_u32 = ip4->src_address.as_u32;
242  memset (&daddr, 0, sizeof (daddr));
243  daddr.ip4.as_u32 = ip4->dst_address.as_u32;
244 
245  if (proto == SNAT_PROTOCOL_ICMP)
246  {
247  icmp46_header_t *icmp = ip4_next_header (ip4);
248  u16 out_id = ((u16 *) (icmp))[2];
249 
250  if (!
251  (icmp->type == ICMP6_echo_request
252  || icmp->type == ICMP6_echo_reply))
253  return -1;
254 
255  ste =
256  nat64_db_st_entry_find (&nm->db, &saddr, &daddr, out_id, 0, proto,
257  fib_index, 0);
258  if (!ste)
259  return -1;
260 
261  bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
262  if (!bibe)
263  return -1;
264 
265  ip6->dst_address.as_u64[0] = ste->in_r_addr.as_u64[0];
266  ip6->dst_address.as_u64[1] = ste->in_r_addr.as_u64[1];
267  ip6->src_address.as_u64[0] = bibe->in_addr.as_u64[0];
268  ip6->src_address.as_u64[1] = bibe->in_addr.as_u64[1];
269  ((u16 *) (icmp))[2] = bibe->in_port;
270 
271  vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
272  }
273  else
274  {
275  udp_header_t *udp = ip4_next_header (ip4);
276  tcp_header_t *tcp = ip4_next_header (ip4);
277  u16 dport = udp->dst_port;
278  u16 sport = udp->src_port;
279  u16 *checksum;
280  ip_csum_t csum;
281 
282  ste =
283  nat64_db_st_entry_find (&nm->db, &saddr, &daddr, sport, dport, proto,
284  fib_index, 0);
285  if (!ste)
286  return -1;
287 
288  bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
289  if (!bibe)
290  return -1;
291 
292  nat64_compose_ip6 (&ip6->dst_address, &daddr.ip4, bibe->fib_index);
293  ip6->src_address.as_u64[0] = bibe->in_addr.as_u64[0];
294  ip6->src_address.as_u64[1] = bibe->in_addr.as_u64[1];
295  udp->src_port = bibe->in_port;
296 
297  if (proto == SNAT_PROTOCOL_UDP)
298  checksum = &udp->checksum;
299  else
300  checksum = &tcp->checksum;
301  if (*checksum)
302  {
303  csum = ip_csum_sub_even (*checksum, sport);
304  csum = ip_csum_add_even (csum, udp->src_port);
305  *checksum = ip_csum_fold (csum);
306  }
307 
308  vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
309  }
310 
311  return 0;
312 }
313 
314 static uword
316  vlib_frame_t * frame)
317 {
318  u32 n_left_from, *from, *to_next;
319  nat64_out2in_next_t next_index;
320  u32 pkts_processed = 0;
321 
322  from = vlib_frame_vector_args (frame);
323  n_left_from = frame->n_vectors;
324  next_index = node->cached_next_index;
325  while (n_left_from > 0)
326  {
327  u32 n_left_to_next;
328 
329  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
330 
331  while (n_left_from > 0 && n_left_to_next > 0)
332  {
333  u32 bi0;
334  vlib_buffer_t *b0;
335  u32 next0;
336  ip4_header_t *ip40;
337  u32 proto0;
339 
340  /* speculatively enqueue b0 to the current next frame */
341  bi0 = from[0];
342  to_next[0] = bi0;
343  from += 1;
344  to_next += 1;
345  n_left_from -= 1;
346  n_left_to_next -= 1;
347 
348  b0 = vlib_get_buffer (vm, bi0);
349  ip40 = vlib_buffer_get_current (b0);
350 
351  ctx0.b = b0;
352  ctx0.vm = vm;
353 
354  next0 = NAT64_OUT2IN_NEXT_LOOKUP;
355 
356  proto0 = ip_proto_to_snat_proto (ip40->protocol);
357  if (PREDICT_FALSE (proto0 == ~0))
358  {
359  next0 = NAT64_OUT2IN_NEXT_DROP;
360  b0->error =
361  node->errors[NAT64_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
362  goto trace0;
363  }
364 
365  if (proto0 == SNAT_PROTOCOL_ICMP)
366  {
367  if (icmp_to_icmp6
368  (b0, nat64_out2in_icmp_set_cb, &ctx0,
370  {
371  next0 = NAT64_OUT2IN_NEXT_DROP;
372  b0->error = node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
373  goto trace0;
374  }
375  }
376  else
377  {
379  {
380  next0 = NAT64_OUT2IN_NEXT_DROP;
381  b0->error = node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
382  goto trace0;
383  }
384  }
385 
386  trace0:
388  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
389  {
391  vlib_add_trace (vm, node, b0, sizeof (*t));
392  t->sw_if_index = vnet_buffer (b0)->sw_if_index[VLIB_RX];
393  t->next_index = next0;
394  }
395 
396  pkts_processed += next0 != NAT64_OUT2IN_NEXT_DROP;
397 
398  /* verify speculative enqueue, maybe switch current next frame */
399  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
400  n_left_to_next, bi0, next0);
401  }
402  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
403  }
405  NAT64_OUT2IN_ERROR_OUT2IN_PACKETS,
406  pkts_processed);
407  return frame->n_vectors;
408 }
409 
410 /* *INDENT-OFF* */
412  .function = nat64_out2in_node_fn,
413  .name = "nat64-out2in",
414  .vector_size = sizeof (u32),
415  .format_trace = format_nat64_out2in_trace,
416  .type = VLIB_NODE_TYPE_INTERNAL,
418  .error_strings = nat64_out2in_error_strings,.n_next_nodes = 2,
419  /* edit / add dispositions here */
420  .next_nodes = {
421  [NAT64_OUT2IN_NEXT_DROP] = "error-drop",
422  [NAT64_OUT2IN_NEXT_LOOKUP] = "ip6-lookup",
423  },
424 };
425 /* *INDENT-ON* */
426 
428 
429 /*
430  * fd.io coding-style-patch-verification: ON
431  *
432  * Local Variables:
433  * eval: (c-set-style "gnu")
434  * End:
435  */
#define CLIB_UNUSED(x)
Definition: clib.h:79
static char * nat64_out2in_error_strings[]
Definition: nat64_out2in.c:60
ip4_address_t src_address
Definition: ip4_packet.h:164
u64 as_u64[2]
Definition: ip6_packet.h:51
vlib_buffer_t * b
Definition: nat64_out2in.c:75
nat64_db_st_entry_t * nat64_db_st_entry_create(nat64_db_t *db, nat64_db_bib_entry_t *bibe, ip6_address_t *in_r_addr, ip4_address_t *out_r_addr, u16 r_port)
Create new NAT64 session table entry.
Definition: nat64_db.c:297
u32 fib_table_get_index_for_sw_if_index(fib_protocol_t proto, u32 sw_if_index)
Get the index of the FIB bound to the interface.
Definition: fib_table.c:929
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:459
nat64_out2in_error_t
Definition: nat64_out2in.c:52
struct _vlib_node_registration vlib_node_registration_t
nat64_out2in_next_t
Definition: nat64_out2in.c:66
uword ip_csum_t
Definition: ip_packet.h:90
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static int nat64_out2in_tcp_udp_set_cb(ip4_header_t *ip4, ip6_header_t *ip6, void *arg)
Definition: nat64_out2in.c:80
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:419
struct _tcp_header tcp_header_t
ip6_address_t src_address
Definition: ip6_packet.h:341
struct nat64_out2in_set_ctx_t_ nat64_out2in_set_ctx_t
IPv4 to IPv6 translation.
nat64_db_st_entry_t * nat64_db_st_entry_find(nat64_db_t *db, ip46_address_t *l_addr, ip46_address_t *r_addr, u16 l_port, u16 r_port, snat_protocol_t proto, u32 fib_index, u8 is_ip6)
Find NAT64 session table entry.
Definition: nat64_db.c:439
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
Definition: ip4_fib.c:221
nat64_db_bib_entry_t * nat64_db_bib_entry_find(nat64_db_t *db, ip46_address_t *addr, u16 port, snat_protocol_t proto, u32 fib_index, u8 is_ip6)
Find NAT64 BIB entry.
Definition: nat64_db.c:171
ip4_address_t dst_address
Definition: ip4_packet.h:164
static void * ip4_next_header(ip4_header_t *i)
Definition: ip4_packet.h:233
nat64_db_t db
BIB and session DB.
Definition: nat64.h:62
void nat64_session_reset_timeout(nat64_db_st_entry_t *ste, vlib_main_t *vm)
Reset NAT64 session timeout.
Definition: nat64.c:506
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:188
static int nat64_out2in_icmp_set_cb(ip4_header_t *ip4, ip6_header_t *ip6, void *arg)
Definition: nat64_out2in.c:152
static u8 * format_nat64_out2in_trace(u8 *s, va_list *args)
Definition: nat64_out2in.c:31
#define PREDICT_FALSE(x)
Definition: clib.h:97
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:216
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:366
void nat64_compose_ip6(ip6_address_t *ip6, ip4_address_t *ip4, u32 fib_index)
Compose IPv4-embedded IPv6 addresses.
Definition: nat64.c:673
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:113
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1131
u16 n_vectors
Definition: node.h:345
nat64_db_bib_entry_t * nat64_db_bib_entry_by_index(nat64_db_t *db, snat_protocol_t proto, u32 bibe_index)
Get BIB entry by index and protocol.
Definition: nat64_db.c:243
static int ip4_to_ip6_tcp_udp(vlib_buffer_t *p, ip4_to_ip6_set_fn_t fn, void *ctx)
Translate IPv4 UDP/TCP packet to IPv6.
Definition: ip4_to_ip6.h:501
#define VLIB_BUFFER_IS_TRACED
Definition: buffer.h:85
#define ARRAY_LEN(x)
Definition: clib.h:59
static int nat64_out2in_inner_icmp_set_cb(ip4_header_t *ip4, ip6_header_t *ip6, void *arg)
Definition: nat64_out2in.c:225
nat64_main_t nat64_main
Definition: nat64.c:25
static uword nat64_out2in_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: nat64_out2in.c:315
snat_protocol_t
Definition: snat.h:98
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
Definition: node.h:460
#define u8_ptr_add(ptr, index)
Definition: map.h:513
unsigned int u32
Definition: types.h:88
VLIB_NODE_FUNCTION_MULTIARCH(nat64_out2in_node, nat64_out2in_node_fn)
static ip_csum_t ip_csum_sub_even(ip_csum_t c, ip_csum_t x)
Definition: ip_packet.h:117
static int icmp_to_icmp6(vlib_buffer_t *p, ip4_to_ip6_set_fn_t fn, void *ctx, ip4_to_ip6_set_fn_t inner_fn, void *inner_ctx)
Translate ICMP4 packet to ICMP6.
Definition: ip4_to_ip6.h:220
vlib_node_registration_t nat64_out2in_node
(constructor) VLIB_REGISTER_NODE (nat64_out2in_node)
Definition: nat64_out2in.c:44
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:260
u64 uword
Definition: types.h:112
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
NAT64 global declarations.
Definition: defs.h:47
unsigned short u16
Definition: types.h:57
unsigned char u8
Definition: types.h:56
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:269
static u32 ip_proto_to_snat_proto(u8 ip_proto)
Definition: snat.h:389
#define vnet_buffer(b)
Definition: buffer.h:304
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:144
u16 flags
Copy of main node flags.
Definition: node.h:454
u32 flags
buffer flags: VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:74
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:57
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:145
Definition: defs.h:46
#define foreach_nat64_out2in_error
Definition: nat64_out2in.c:46
static ip_csum_t ip_csum_add_even(ip_csum_t c, ip_csum_t x)
Definition: ip_packet.h:101
ip6_address_t dst_address
Definition: ip6_packet.h:341