45 #define foreach_nat_det_out2in_error \ 46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ 47 _(NO_TRANSLATION, "No translation") \ 48 _(BAD_ICMP_TYPE, "unsupported ICMP type") \ 49 _(OUT2IN_PACKETS, "Good out2in packets processed") 53 #define _(sym,str) NAT_DET_OUT2IN_ERROR_##sym, 60 #define _(sym,string) string, 76 "NAT_DET_OUT2IN: sw_if_index %d, next index %d, session index %d",
100 u8 * p_dont_translate,
void *d,
void *e)
102 icmp46_header_t *icmp0;
106 u8 dont_translate = 0;
111 icmp46_header_t *inner_icmp0;
123 protocol = SNAT_PROTOCOL_ICMP;
138 case SNAT_PROTOCOL_ICMP:
139 inner_icmp0 = (icmp46_header_t *) l4_header;
144 case SNAT_PROTOCOL_UDP:
145 case SNAT_PROTOCOL_TCP:
150 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
172 clib_net_to_host_u16 (key0.
out_port), &new_addr0);
184 nat_log_info (
"no match src %U:%d dst %U:%d for user %U",
188 clib_net_to_host_u16 (key0.
out_port),
190 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
198 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_BAD_ICMP_TYPE];
209 p_value->
addr = new_addr0;
213 *p_dont_translate = dont_translate;
225 u32 n_left_from, *from, *to_next;
227 u32 pkts_processed = 0;
235 while (n_left_from > 0)
241 while (n_left_from >= 4 && n_left_to_next >= 2)
247 u32 sw_if_index0, sw_if_index1;
251 u16 new_port0, old_port0, old_port1, new_port1;
258 u32 rx_fib_index0, rx_fib_index1;
259 icmp46_header_t *icmp0, *icmp1;
276 to_next[0] = bi0 = from[0];
277 to_next[1] = bi1 = from[1];
296 ICMP4_time_exceeded_ttl_exceeded_in_transit,
308 icmp0 = (icmp46_header_t *) udp0;
310 next0 =
icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
311 rx_fib_index0, node, next0, thread_index,
326 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
331 clib_net_to_host_u16 (tcp0->dst), &new_addr0);
336 nat_log_info (
"no match src %U:%d dst %U:%d for user %U",
338 clib_net_to_host_u16 (tcp0->src),
340 clib_net_to_host_u16 (tcp0->dst),
343 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
361 && ses0->
state == SNAT_SESSION_TCP_ESTABLISHED)
362 ses0->
state = SNAT_SESSION_TCP_CLOSE_WAIT;
364 && ses0->
state == SNAT_SESSION_TCP_LAST_ACK)
367 old_port0 = tcp0->dst;
368 tcp0->dst = new_port0;
370 sum0 = tcp0->checksum;
390 && (b0->
flags & VLIB_BUFFER_IS_TRACED)))
415 ICMP4_time_exceeded_ttl_exceeded_in_transit,
427 icmp1 = (icmp46_header_t *) udp1;
429 next1 =
icmp_out2in (sm, b1, ip1, icmp1, sw_if_index1,
430 rx_fib_index1, node, next1, thread_index,
445 b1->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
450 clib_net_to_host_u16 (tcp1->dst), &new_addr1);
455 nat_log_info (
"no match src %U:%d dst %U:%d for user %U",
457 clib_net_to_host_u16 (tcp1->src),
459 clib_net_to_host_u16 (tcp1->dst),
462 b1->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
465 new_port1 = ses1->in_port;
480 && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
481 ses1->state = SNAT_SESSION_TCP_CLOSE_WAIT;
483 && ses1->state == SNAT_SESSION_TCP_LAST_ACK)
486 old_port1 = tcp1->dst;
487 tcp1->dst = new_port1;
489 sum1 = tcp1->checksum;
509 && (b1->
flags & VLIB_BUFFER_IS_TRACED)))
524 to_next, n_left_to_next,
525 bi0, bi1, next0, next1);
528 while (n_left_from > 0 && n_left_to_next > 0)
537 u16 new_port0, old_port0;
545 icmp46_header_t *icmp0;
567 ICMP4_time_exceeded_ttl_exceeded_in_transit,
579 icmp0 = (icmp46_header_t *) udp0;
581 next0 =
icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
582 rx_fib_index0, node, next0, thread_index,
597 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
602 clib_net_to_host_u16 (tcp0->dst), &new_addr0);
607 nat_log_info (
"no match src %U:%d dst %U:%d for user %U",
609 clib_net_to_host_u16 (tcp0->src),
611 clib_net_to_host_u16 (tcp0->dst),
614 b0->
error = node->
errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
632 && ses0->
state == SNAT_SESSION_TCP_ESTABLISHED)
633 ses0->
state = SNAT_SESSION_TCP_CLOSE_WAIT;
635 && ses0->
state == SNAT_SESSION_TCP_LAST_ACK)
638 old_port0 = tcp0->dst;
639 tcp0->dst = new_port0;
641 sum0 = tcp0->checksum;
661 && (b0->
flags & VLIB_BUFFER_IS_TRACED)))
676 to_next, n_left_to_next,
684 NAT_DET_OUT2IN_ERROR_OUT2IN_PACKETS,
692 .name =
"nat44-det-out2in",
693 .vector_size =
sizeof (
u32),
u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
#define nat_log_info(...)
vlib_node_registration_t snat_det_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_det_out2in_node)
u32 icmp_out2in(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
static_always_inline u8 icmp_is_error_message(icmp46_header_t *icmp)
static void snat_det_ses_close(snat_det_map_t *dm, snat_det_session_t *ses)
vlib_error_t * errors
Vector of errors for this node.
struct _tcp_header tcp_header_t
static void snat_det_reverse(snat_det_map_t *dm, ip4_address_t *out_addr, u16 out_port, ip4_address_t *in_addr)
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
ip4_address_t ext_host_addr
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
static void * ip4_next_header(ip4_header_t *i)
static char * nat_det_out2in_error_strings[]
snat_det_session_t * sessions
static snat_det_map_t * snat_det_map_by_out(snat_main_t *sm, ip4_address_t *out_addr)
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
vlib_error_t error
Error code for buffers to be enqueued to error handler.
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
#define VLIB_REGISTER_NODE(x,...)
#define CLIB_PREFETCH(addr, size, type)
static u8 * format_nat_det_out2in_trace(u8 *s, va_list *args)
VLIB_NODE_FUNCTION_MULTIARCH(snat_det_out2in_node, snat_det_out2in_node_fn)
void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
deterministic NAT definitions
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
#define foreach_nat_det_out2in_error
struct _vlib_node_registration vlib_node_registration_t
static u32 ip_proto_to_snat_proto(u8 ip_proto)
The NAT inline functions.
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
#define ip_csum_update(sum, old, new, type, field)
static u8 is_interface_addr(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, u32 ip4_addr)
static snat_det_session_t * snat_det_get_ses_by_out(snat_det_map_t *dm, ip4_address_t *in_addr, u64 out_key)
u16 flags
Copy of main node flags.
static uword snat_det_out2in_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
#define VLIB_NODE_FLAG_TRACE
#define CLIB_CACHE_LINE_BYTES
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
static u16 ip_csum_fold(ip_csum_t c)