18 #ifndef __included_nat_h__ 19 #define __included_nat_h__ 33 #define SNAT_UDP_TIMEOUT 300 34 #define SNAT_UDP_TIMEOUT_MIN 120 35 #define SNAT_TCP_TRANSITORY_TIMEOUT 240 36 #define SNAT_TCP_ESTABLISHED_TIMEOUT 7440 37 #define SNAT_TCP_INCOMING_SYN 6 38 #define SNAT_ICMP_TIMEOUT 60 40 #define SNAT_FLAG_HAIRPINNING (1 << 0) 99 #define foreach_snat_protocol \ 100 _(UDP, 0, udp, "udp") \ 101 _(TCP, 1, tcp, "tcp") \ 102 _(ICMP, 2, icmp, "icmp") 105 #define _(N, i, n, s) SNAT_PROTOCOL_##N = i, 111 #define foreach_snat_session_state \ 112 _(0, UNKNOWN, "unknown") \ 113 _(1, UDP_ACTIVE, "udp-active") \ 114 _(2, TCP_SYN_SENT, "tcp-syn-sent") \ 115 _(3, TCP_ESTABLISHED, "tcp-established") \ 116 _(4, TCP_FIN_WAIT, "tcp-fin-wait") \ 117 _(5, TCP_CLOSE_WAIT, "tcp-close-wait") \ 118 _(6, TCP_LAST_ACK, "tcp-last-ack") \ 119 _(7, ICMP_ACTIVE, "icmp-active") 122 #define _(v, N, s) SNAT_SESSION_##N = v, 128 #define SNAT_SESSION_FLAG_STATIC_MAPPING 1 129 #define SNAT_SESSION_FLAG_UNKNOWN_PROTO 2 130 #define SNAT_SESSION_FLAG_LOAD_BALANCING 4 131 #define SNAT_SESSION_FLAG_TWICE_NAT 8 133 #define NAT_INTERFACE_FLAG_IS_INSIDE 1 134 #define NAT_INTERFACE_FLAG_IS_OUTSIDE 2 146 u32 per_user_list_head_index;
156 u32 outside_address_index;
164 u16 ext_host_nat_port;
179 #define _(N, i, n, s) \ 180 u16 busy_##n##_ports; \ 181 u16 * busy_##n##_ports_per_thread; \ 182 uword * busy_##n##_port_bitmap; 276 u8 *p_dont_translate,
286 u32 * address_indexp,
288 u32 snat_thread_index);
415 u32 * address_indexp,
417 u32 snat_thread_index);
445 #define snat_is_session_static(s) (s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING) 451 #define snat_is_unk_proto_session(s) (s->flags & SNAT_SESSION_FLAG_UNKNOWN_PROTO) 457 #define is_twice_nat_session(s) (s->flags & SNAT_SESSION_FLAG_TWICE_NAT) 463 #define is_lb_session(s) (s->flags & SNAT_SESSION_FLAG_LOAD_BALANCING) 469 #define is_ed_session(s) (snat_is_unk_proto_session (s) || is_twice_nat_session (s) || is_lb_session (s)) 471 #define nat_interface_is_inside(i) i->flags & NAT_INTERFACE_FLAG_IS_INSIDE 472 #define nat_interface_is_outside(i) i->flags & NAT_INTERFACE_FLAG_IS_OUTSIDE 490 snat_proto = (ip_proto == IP_PROTOCOL_UDP) ? SNAT_PROTOCOL_UDP : snat_proto;
491 snat_proto = (ip_proto == IP_PROTOCOL_TCP) ? SNAT_PROTOCOL_TCP : snat_proto;
492 snat_proto = (ip_proto == IP_PROTOCOL_ICMP) ? SNAT_PROTOCOL_ICMP : snat_proto;
493 snat_proto = (ip_proto == IP_PROTOCOL_ICMP6) ? SNAT_PROTOCOL_ICMP : snat_proto;
503 ip_proto = (snat_proto == SNAT_PROTOCOL_UDP) ? IP_PROTOCOL_UDP : ip_proto;
504 ip_proto = (snat_proto == SNAT_PROTOCOL_TCP) ? IP_PROTOCOL_TCP : ip_proto;
505 ip_proto = (snat_proto == SNAT_PROTOCOL_ICMP) ? IP_PROTOCOL_ICMP : ip_proto;
518 u8 *p_dont_translate,
void *d,
void *e);
523 u8 *p_dont_translate,
void *d,
void *e);
528 u8 *p_dont_translate,
void *d,
void *e);
533 u8 *p_dont_translate,
void *d,
void *e);
538 u8 *p_dont_translate,
void *d,
void *e);
543 u8 *p_dont_translate,
void *d,
void *e);
551 u16 l_port,
u16 e_port,
u32 vrf_id,
int addr_only,
552 u32 sw_if_index, snat_protocol_t proto,
int is_add,
553 u8 twice_nat,
u8 out2in_only,
u8 *tag);
564 snat_protocol_t proto,
u32 vrf_id,
566 u8 twice_nat,
u8 out2in_only,
u8 *tag);
568 snat_protocol_t proto,
u32 vrf_id,
int is_in);
572 u32 fib_index,
u32 thread_index);
584 case ICMP4_destination_unreachable:
585 case ICMP4_time_exceeded:
586 case ICMP4_parameter_problem:
587 case ICMP4_source_quench:
589 case ICMP4_alternate_host_address:
633 u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
636 n_left_from =
vec_len(bi_vector);
638 while (n_left_from > 0) {
640 while (n_left_from > 0 && n_left_to_next > 0) {
641 u32 bi0 = to_next[0] = from[0];
649 n_left_to_next, bi0, next);
ip4_address_t external_addr
int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat)
clib_error_t * snat_api_init(vlib_main_t *vm, snat_main_t *sm)
vlib_node_registration_t snat_hairpin_src_node
(constructor) VLIB_REGISTER_NODE (snat_hairpin_src_node)
void nat_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index)
u32 sessions_per_user_list_head_index
clib_bihash_16_8_t out2in_ed
int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del)
u8 runtime_data[0]
Function dependent node-runtime data.
int snat_static_mapping_match(snat_main_t *sm, snat_session_key_t match, snat_session_key_t *mapping, u8 by_external, u8 *is_addr_only, u8 *twice_nat)
Match NAT44 static mapping.
u32 fq_in2out_output_index
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
#define foreach_snat_session_state
int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, u8 twice_nat)
ip4_address_t * ip4_interface_first_address(ip4_main_t *im, u32 sw_if_index, ip_interface_address_t **result_ia)
u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
format_function_t format_det_map_ses
vlib_node_registration_t snat_det_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_det_out2in_node)
clib_bihash_16_8_t in2out_ed
format_function_t format_snat_static_mapping
snat_det_map_t * det_maps
nat_alloc_out_addr_and_port_function_t * alloc_addr_and_port
#define foreach_snat_protocol
nat44_lb_addr_port_t * locals
int snat_set_workers(uword *bitmap)
clib_bihash_8_8_t user_hash
u32 snat_icmp_match_function_t(struct snat_main_s *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
void nat_set_alloc_addr_and_port_mape(u16 psid, u16 psid_offset, u16 psid_length)
u32 max_translations_per_user
u32( snat_get_worker_function_t)(ip4_header_t *ip, u32 rx_fib_index)
static void user_session_increment(snat_main_t *sm, snat_user_t *u, u8 is_static)
u32 in2out_output_node_index
#define static_always_inline
vlib_node_registration_t snat_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_node)
ip4_address_t ext_host_addr
int nat_alloc_out_addr_and_port_function_t(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u32 *address_indexp, u16 port_per_thread, u32 snat_thread_index)
int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, snat_protocol_t proto, int is_add, u8 twice_nat, u8 out2in_only, u8 *tag)
Add static mapping.
vlib_node_registration_t snat_in2out_output_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_node)
vlib_node_registration_t snat_in2out_output_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_worker_handoff_node)
uword unformat_snat_protocol(unformat_input_t *input, va_list *args)
u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
vlib_node_registration_t snat_out2in_fast_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_fast_node)
u32 * auto_add_sw_if_indices_twice_nat
vlib_node_registration_t snat_hairpin_dst_node
(constructor) VLIB_REGISTER_NODE (snat_hairpin_dst_node)
void snat_free_outside_address_and_port(snat_address_t *addresses, u32 thread_index, snat_session_key_t *k, u32 address_index)
snat_det_session_t * sessions
int snat_alloc_outside_address_and_port(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u32 *address_indexp, u16 port_per_thread, u32 snat_thread_index)
snat_static_mapping_t * static_mappings
void nat_set_alloc_addr_and_port_default(void)
void snat_add_del_addr_to_fib(ip4_address_t *addr, u8 p_len, u32 sw_if_index, int is_add)
Add/del NAT address to FIB.
clib_bihash_8_8_t static_mapping_by_external
struct snat_main_s snat_main_t
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
snat_session_t * nat_session_alloc_or_recycle(snat_main_t *sm, snat_user_t *u, u32 thread_index)
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
typedef CLIB_PACKED(struct{snat_session_key_t out2in;snat_session_key_t in2out;u32 flags;u32 per_user_index;u32 per_user_list_head_index;f64 last_heard;u64 total_bytes;u32 total_pkts;u32 outside_address_index;ip4_address_t ext_host_addr;u16 ext_host_port;ip4_address_t ext_host_nat_addr;u16 ext_host_nat_port;}) snat_session_t
vlib_error_t error
Error code for buffers to be enqueued to error handler.
API main structure, used by both vpp and binary API clients.
snat_interface_t * output_feature_interfaces
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
u8 static_mapping_connection_tracking
snat_get_worker_function_t * worker_in2out_cb
format_function_t format_snat_static_map_to_resolve
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
snat_user_t * nat_user_get_or_create(snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index)
void increment_v4_address(ip4_address_t *a)
u32 tcp_transitory_timeout
int nat44_add_del_lb_static_mapping(ip4_address_t e_addr, u16 e_port, snat_protocol_t proto, u32 vrf_id, nat44_lb_addr_port_t *locals, u8 is_add, u8 twice_nat, u8 out2in_only, u8 *tag)
u32 * auto_add_sw_if_indices
void nat44_add_del_address_dpo(ip4_address_t addr, u8 is_add)
u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
snat_get_worker_function_t * worker_out2in_cb
static u32 ip_proto_to_snat_proto(u8 ip_proto)
snat_icmp_match_function_t * icmp_match_out2in_cb
vlib_node_registration_t snat_out2in_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_worker_handoff_node)
snat_address_t * twice_nat_addresses
u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation.
struct _vlib_node_registration vlib_node_registration_t
void snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
static_always_inline u8 is_interface_addr(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, u32 ip4_addr)
snat_main_per_thread_data_t * per_thread_data
snat_address_t * addresses
format_function_t format_snat_user
snat_static_map_resolve_t * to_resolve
vlib_node_registration_t snat_in2out_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_worker_handoff_node)
vlib_node_registration_t snat_in2out_fast_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_fast_node)
u32 translation_memory_size
int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del)
static_always_inline void nat_send_all_to_node(vlib_main_t *vm, u32 *bi_vector, vlib_node_runtime_t *node, vlib_error_t *error, u32 next)
vlib_node_registration_t snat_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_node)
u8 * format_snat_protocol(u8 *s, va_list *args)
ip_lookup_main_t * ip4_lookup_main
u32 icmp_match_in2out_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation.
static u8 maximum_sessions_exceeded(snat_main_t *sm, u32 thread_index)
snat_session_t * sessions
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
snat_icmp_match_function_t * icmp_match_in2out_cb
clib_bihash_8_8_t static_mapping_by_local
int nat44_del_session(snat_main_t *sm, ip4_address_t *addr, u16 port, snat_protocol_t proto, u32 vrf_id, int is_in)
snat_interface_t * interfaces
static_always_inline u8 icmp_is_error_message(icmp46_header_t *icmp)
static u8 snat_proto_to_ip_proto(snat_protocol_t snat_proto)
u32 tcp_established_timeout
static uword pool_elts(void *v)
Number of active elements in a pool.