FD.io VPP  v19.04.4-rc0-5-ge88582fac
Vector Packet Processing
nat_det.c
Go to the documentation of this file.
1 /*
2  * snat_det.c - deterministic NAT
3  *
4  * Copyright (c) 2017 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 /**
18  * @file
19  * @brief deterministic NAT
20  */
21 
22 #include <nat/nat_det.h>
23 
24 
25 /**
26  * @brief Add/delete deterministic NAT mapping.
27  *
28  * Create bijective mapping of inside address to outside address and port range
29  * pairs, with the purpose of enabling deterministic NAT to reduce logging in
30  * CGN deployments.
31  *
32  * @param sm SNAT main.
33  * @param in_addr Inside network address.
34  * @param in_plen Inside network prefix length.
35  * @param out_addr Outside network address.
36  * @param out_plen Outside network prefix length.
37  * @param is_add If 0 delete, otherwise add.
38  */
39 int
40 snat_det_add_map (snat_main_t * sm, ip4_address_t * in_addr, u8 in_plen,
41  ip4_address_t * out_addr, u8 out_plen, int is_add)
42 {
43  snat_det_map_t *det_map;
44  static snat_det_session_t empty_snat_det_session = { 0 };
46  ip4_address_t in_cmp, out_cmp;
47  u8 found = 0;
48 
49  in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
50  out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
51  vec_foreach (det_map, sm->det_maps)
52  {
53  /* Checking for overlapping addresses to be added here */
54  if (det_map->in_addr.as_u32 == in_cmp.as_u32 &&
55  det_map->in_plen == in_plen &&
56  det_map->out_addr.as_u32 == out_cmp.as_u32 &&
57  det_map->out_plen == out_plen)
58  {
59  found = 1;
60  break;
61  }
62  }
63 
64  /* If found, don't add again */
65  if (found && is_add)
66  return VNET_API_ERROR_VALUE_EXIST;
67 
68  /* If not found, don't delete */
69  if (!found && !is_add)
70  return VNET_API_ERROR_NO_SUCH_ENTRY;
71 
72  if (is_add)
73  {
74  pool_get (sm->det_maps, det_map);
75  clib_memset (det_map, 0, sizeof (*det_map));
76  det_map->in_addr.as_u32 = in_cmp.as_u32;
77  det_map->in_plen = in_plen;
78  det_map->out_addr.as_u32 = out_cmp.as_u32;
79  det_map->out_plen = out_plen;
80  det_map->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
81  det_map->ports_per_host = (65535 - 1023) / det_map->sharing_ratio;
82 
84  SNAT_DET_SES_PER_USER * (1 << (32 - in_plen)) -
85  1, empty_snat_det_session);
86  }
87  else
88  {
89  vec_free (det_map->sessions);
90  vec_del1 (sm->det_maps, det_map - sm->det_maps);
91  }
92 
93  /* Add/del external address range to FIB */
94  /* *INDENT-OFF* */
95  pool_foreach (i, sm->interfaces,
96  ({
97  if (nat_interface_is_inside(i))
98  continue;
99 
100  snat_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
101  break;
102  }));
103  /* *INDENT-ON* */
104  return 0;
105 }
106 
107 /**
108  * @brief The 'nat-det-expire-walk' process's main loop.
109  *
110  * Check expire time for active sessions.
111  */
112 static uword
114  vlib_frame_t * f)
115 {
116  snat_main_t *sm = &snat_main;
117  snat_det_map_t *dm;
118  snat_det_session_t *ses;
119 
120  while (sm->deterministic)
121  {
124  u32 now = (u32) vlib_time_now (vm);
125  /* *INDENT-OFF* */
126  pool_foreach (dm, sm->det_maps,
127  ({
128  vec_foreach(ses, dm->sessions)
129  {
130  /* Delete if session expired */
131  if (ses->in_port && (ses->expire < now))
132  snat_det_ses_close (dm, ses);
133  }
134  }));
135  /* *INDENT-ON* */
136  }
137 
138  return 0;
139 }
140 
142 
143 /* *INDENT-OFF* */
145  .function = snat_det_expire_walk_fn,
146  .type = VLIB_NODE_TYPE_PROCESS,
147  .name =
148  "nat-det-expire-walk",
149 };
150 /* *INDENT-ON* */
151 
152 /*
153  * fd.io coding-style-patch-verification: ON
154  *
155  * Local Variables:
156  * eval: (c-set-style "gnu")
157  * End:
158  */
static f64 vlib_process_wait_for_event_or_clock(vlib_main_t *vm, f64 dt)
Suspend a cooperative multi-tasking thread Waits for an event, or for the indicated number of seconds...
Definition: node_funcs.h:673
#define NULL
Definition: clib.h:58
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:255
static vlib_node_registration_t snat_det_expire_walk_node
(constructor) VLIB_REGISTER_NODE (snat_det_expire_walk_node)
Definition: nat_det.c:141
int i
snat_det_map_t * det_maps
Definition: nat.h:529
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:236
u8 in_plen
Definition: nat.h:280
unsigned char u8
Definition: types.h:56
u8 deterministic
Definition: nat.h:537
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:493
static uword vlib_process_get_events(vlib_main_t *vm, uword **data_vector)
Return the first event type which has occurred and a vector of per-event data of that type...
Definition: node_funcs.h:516
#define SNAT_DET_SES_PER_USER
Definition: nat_det.h:30
unsigned int u32
Definition: types.h:88
snat_det_session_t * sessions
Definition: nat.h:291
#define vec_del1(v, i)
Delete the element at index I.
Definition: vec.h:804
u8 out_plen
Definition: nat.h:283
snat_main_t snat_main
Definition: nat.c:39
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
vlib_main_t * vm
Definition: buffer.c:312
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:341
deterministic NAT definitions
u32 sharing_ratio
Definition: nat.h:285
ip4_address_t out_addr
Definition: nat.h:282
int snat_det_add_map(snat_main_t *sm, ip4_address_t *in_addr, u8 in_plen, ip4_address_t *out_addr, u8 out_plen, int is_add)
Add/delete deterministic NAT mapping.
Definition: nat_det.c:40
u8 is_add
Definition: ipsec_gre.api:36
ip4_address_t in_addr
Definition: nat.h:279
struct _vlib_node_registration vlib_node_registration_t
u16 ports_per_host
Definition: nat.h:287
u64 uword
Definition: types.h:112
ip4_main_t ip4_main
Global ip4 main structure.
Definition: ip4_forward.c:905
#define vec_foreach(var, vec)
Vector iterator.
static uword snat_det_expire_walk_fn(vlib_main_t *vm, vlib_node_runtime_t *rt, vlib_frame_t *f)
The &#39;nat-det-expire-walk&#39; process&#39;s main loop.
Definition: nat_det.c:113
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Definition: vec.h:486
snat_interface_t * interfaces
Definition: nat.h:461
u32 fib_masks[33]
Definition: ip4.h:109