FD.io VPP  v19.04.4-rc0-5-ge88582fac
Vector Packet Processing
nat_det_in2out.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief Deterministic/CGN NAT44 inside to outside network translation
18  */
19 
20 #include <vlib/vlib.h>
21 #include <vnet/vnet.h>
22 #include <vnet/ip/ip.h>
23 #include <vnet/fib/ip4_fib.h>
24 #include <vppinfra/error.h>
25 #include <vppinfra/elog.h>
26 #include <nat/nat.h>
27 #include <nat/nat_det.h>
28 #include <nat/nat_inlines.h>
29 
30 typedef struct
31 {
36 
37 typedef enum
38 {
44 
45 #define foreach_nat_det_in2out_error \
46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
47 _(NO_TRANSLATION, "No translation") \
48 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
49 _(OUT_OF_PORTS, "Out of ports") \
50 _(IN2OUT_PACKETS, "Good in2out packets processed")
51 
52 typedef enum
53 {
54 #define _(sym,str) NAT_DET_IN2OUT_ERROR_##sym,
56 #undef _
59 
60 static char *nat_det_in2out_error_strings[] = {
61 #define _(sym,string) string,
63 #undef _
64 };
65 
66 static u8 *
67 format_nat_det_in2out_trace (u8 * s, va_list * args)
68 {
69  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
70  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
71  nat_det_in2out_trace_t *t = va_arg (*args, nat_det_in2out_trace_t *);
72 
73  s = format (s, "NAT_DET_IN2OUT: sw_if_index %d, next index %d, session %d",
75 
76  return s;
77 }
78 
79 #ifndef CLIB_MARCH_VARIANT
80 /**
81  * Get address and port values to be used for ICMP packet translation
82  * and create session if needed
83  *
84  * @param[in,out] sm NAT main
85  * @param[in,out] node NAT node runtime
86  * @param[in] thread_index thread index
87  * @param[in,out] b0 buffer containing packet to be translated
88  * @param[out] p_proto protocol used for matching
89  * @param[out] p_value address and port after NAT translation
90  * @param[out] p_dont_translate if packet should not be translated
91  * @param d optional parameter
92  * @param e optional parameter
93  */
94 u32
96  u32 thread_index, vlib_buffer_t * b0,
97  ip4_header_t * ip0, u8 * p_proto,
98  snat_session_key_t * p_value,
99  u8 * p_dont_translate, void *d, void *e)
100 {
101  icmp46_header_t *icmp0;
102  u32 sw_if_index0;
103  u32 rx_fib_index0;
104  u8 protocol;
105  snat_det_out_key_t key0;
106  u8 dont_translate = 0;
107  u32 next0 = ~0;
108  icmp_echo_header_t *echo0, *inner_echo0 = 0;
109  ip4_header_t *inner_ip0;
110  void *l4_header = 0;
111  icmp46_header_t *inner_icmp0;
112  snat_det_map_t *dm0 = 0;
113  ip4_address_t new_addr0;
114  u16 lo_port0, i0;
115  snat_det_session_t *ses0 = 0;
116  ip4_address_t in_addr;
117  u16 in_port;
118 
119  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
120  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
121  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
122  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
123 
124  if (!icmp_is_error_message (icmp0))
125  {
126  protocol = SNAT_PROTOCOL_ICMP;
127  in_addr = ip0->src_address;
128  in_port = echo0->identifier;
129  }
130  else
131  {
132  inner_ip0 = (ip4_header_t *) (echo0 + 1);
133  l4_header = ip4_next_header (inner_ip0);
134  protocol = ip_proto_to_snat_proto (inner_ip0->protocol);
135  in_addr = inner_ip0->dst_address;
136  switch (protocol)
137  {
138  case SNAT_PROTOCOL_ICMP:
139  inner_icmp0 = (icmp46_header_t *) l4_header;
140  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
141  in_port = inner_echo0->identifier;
142  break;
143  case SNAT_PROTOCOL_UDP:
144  case SNAT_PROTOCOL_TCP:
145  in_port = ((tcp_udp_header_t *) l4_header)->dst_port;
146  break;
147  default:
148  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
149  next0 = NAT_DET_IN2OUT_NEXT_DROP;
150  goto out;
151  }
152  }
153 
154  dm0 = snat_det_map_by_user (sm, &in_addr);
155  if (PREDICT_FALSE (!dm0))
156  {
157  nat_log_info ("no match for internal host %U",
158  format_ip4_address, &in_addr);
159  if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
160  IP_PROTOCOL_ICMP,
161  rx_fib_index0)))
162  {
163  dont_translate = 1;
164  goto out;
165  }
166  next0 = NAT_DET_IN2OUT_NEXT_DROP;
167  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
168  goto out;
169  }
170 
171  snat_det_forward (dm0, &in_addr, &new_addr0, &lo_port0);
172 
173  key0.ext_host_addr = ip0->dst_address;
174  key0.ext_host_port = 0;
175 
176  ses0 = snat_det_find_ses_by_in (dm0, &in_addr, in_port, key0);
177  if (PREDICT_FALSE (!ses0))
178  {
179  if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
180  IP_PROTOCOL_ICMP,
181  rx_fib_index0)))
182  {
183  dont_translate = 1;
184  goto out;
185  }
186  if (icmp0->type != ICMP4_echo_request)
187  {
188  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
189  next0 = NAT_DET_IN2OUT_NEXT_DROP;
190  goto out;
191  }
192  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
193  {
194  key0.out_port = clib_host_to_net_u16 (lo_port0 +
195  ((i0 +
196  clib_net_to_host_u16
197  (echo0->identifier)) %
198  dm0->ports_per_host));
199 
200  if (snat_det_get_ses_by_out (dm0, &in_addr, key0.as_u64))
201  continue;
202 
203  ses0 =
204  snat_det_ses_create (thread_index, dm0,
205  &in_addr, echo0->identifier, &key0);
206  break;
207  }
208  if (PREDICT_FALSE (!ses0))
209  {
210  next0 = NAT_DET_IN2OUT_NEXT_DROP;
211  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_OUT_OF_PORTS];
212  goto out;
213  }
214  }
215 
216  if (PREDICT_FALSE (icmp0->type != ICMP4_echo_request &&
217  !icmp_is_error_message (icmp0)))
218  {
219  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
220  next0 = NAT_DET_IN2OUT_NEXT_DROP;
221  goto out;
222  }
223 
224  u32 now = (u32) vlib_time_now (sm->vlib_main);
225 
226  ses0->state = SNAT_SESSION_ICMP_ACTIVE;
227  ses0->expire = now + sm->icmp_timeout;
228 
229 out:
230  *p_proto = protocol;
231  if (ses0)
232  {
233  p_value->addr = new_addr0;
234  p_value->fib_index = sm->outside_fib_index;
235  p_value->port = ses0->out.out_port;
236  }
237  *p_dont_translate = dont_translate;
238  if (d)
239  *(snat_det_session_t **) d = ses0;
240  if (e)
241  *(snat_det_map_t **) e = dm0;
242  return next0;
243 }
244 #endif
245 
247  vlib_node_runtime_t * node,
248  vlib_frame_t * frame)
249 {
250  u32 n_left_from, *from, *to_next;
251  nat_det_in2out_next_t next_index;
252  u32 pkts_processed = 0;
253  snat_main_t *sm = &snat_main;
254  u32 now = (u32) vlib_time_now (vm);
255  u32 thread_index = vm->thread_index;
256 
257  from = vlib_frame_vector_args (frame);
258  n_left_from = frame->n_vectors;
259  next_index = node->cached_next_index;
260 
261  while (n_left_from > 0)
262  {
263  u32 n_left_to_next;
264 
265  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
266 
267  while (n_left_from >= 4 && n_left_to_next >= 2)
268  {
269  u32 bi0, bi1;
270  vlib_buffer_t *b0, *b1;
271  u32 next0, next1;
272  u32 sw_if_index0, sw_if_index1;
273  ip4_header_t *ip0, *ip1;
274  ip_csum_t sum0, sum1;
275  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
276  u16 old_port0, new_port0, lo_port0, i0;
277  u16 old_port1, new_port1, lo_port1, i1;
278  udp_header_t *udp0, *udp1;
279  tcp_header_t *tcp0, *tcp1;
280  u32 proto0, proto1;
281  snat_det_out_key_t key0, key1;
282  snat_det_map_t *dm0, *dm1;
283  snat_det_session_t *ses0 = 0, *ses1 = 0;
284  u32 rx_fib_index0, rx_fib_index1;
285  icmp46_header_t *icmp0, *icmp1;
286 
287  /* Prefetch next iteration. */
288  {
289  vlib_buffer_t *p2, *p3;
290 
291  p2 = vlib_get_buffer (vm, from[2]);
292  p3 = vlib_get_buffer (vm, from[3]);
293 
294  vlib_prefetch_buffer_header (p2, LOAD);
295  vlib_prefetch_buffer_header (p3, LOAD);
296 
299  }
300 
301  /* speculatively enqueue b0 and b1 to the current next frame */
302  to_next[0] = bi0 = from[0];
303  to_next[1] = bi1 = from[1];
304  from += 2;
305  to_next += 2;
306  n_left_from -= 2;
307  n_left_to_next -= 2;
308 
309  b0 = vlib_get_buffer (vm, bi0);
310  b1 = vlib_get_buffer (vm, bi1);
311 
314 
315  ip0 = vlib_buffer_get_current (b0);
316  udp0 = ip4_next_header (ip0);
317  tcp0 = (tcp_header_t *) udp0;
318 
319  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
320 
321  if (PREDICT_FALSE (ip0->ttl == 1))
322  {
323  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
324  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
325  ICMP4_time_exceeded_ttl_exceeded_in_transit,
326  0);
328  goto trace0;
329  }
330 
331  proto0 = ip_proto_to_snat_proto (ip0->protocol);
332 
333  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
334  {
335  rx_fib_index0 =
337  icmp0 = (icmp46_header_t *) udp0;
338 
339  next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
340  rx_fib_index0, node, next0, thread_index,
341  &ses0, &dm0);
342  goto trace0;
343  }
344 
345  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
346  if (PREDICT_FALSE (!dm0))
347  {
348  nat_log_info ("no match for internal host %U",
350  next0 = NAT_DET_IN2OUT_NEXT_DROP;
351  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
352  goto trace0;
353  }
354 
355  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
356 
357  key0.ext_host_addr = ip0->dst_address;
358  key0.ext_host_port = tcp0->dst;
359 
360  ses0 =
361  snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
362  if (PREDICT_FALSE (!ses0))
363  {
364  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
365  {
366  key0.out_port = clib_host_to_net_u16 (lo_port0 +
367  ((i0 +
368  clib_net_to_host_u16
369  (tcp0->src)) %
370  dm0->
371  ports_per_host));
372 
374  (dm0, &ip0->src_address, key0.as_u64))
375  continue;
376 
377  ses0 =
378  snat_det_ses_create (thread_index, dm0, &ip0->src_address,
379  tcp0->src, &key0);
380  break;
381  }
382  if (PREDICT_FALSE (!ses0))
383  {
384  /* too many sessions for user, send ICMP error packet */
385  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
387  ICMP4_destination_unreachable,
388  ICMP4_destination_unreachable_destination_unreachable_host,
389  0);
391  goto trace0;
392  }
393  }
394 
395  new_port0 = ses0->out.out_port;
396 
397  old_addr0.as_u32 = ip0->src_address.as_u32;
398  ip0->src_address.as_u32 = new_addr0.as_u32;
399  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
400 
401  sum0 = ip0->checksum;
402  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
403  ip4_header_t,
404  src_address /* changed member */ );
405  ip0->checksum = ip_csum_fold (sum0);
406 
407  if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
408  {
409  if (tcp0->flags & TCP_FLAG_SYN)
410  ses0->state = SNAT_SESSION_TCP_SYN_SENT;
411  else if (tcp0->flags & TCP_FLAG_ACK
412  && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
413  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
414  else if (tcp0->flags & TCP_FLAG_FIN
415  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
416  ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
417  else if (tcp0->flags & TCP_FLAG_ACK
418  && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
419  snat_det_ses_close (dm0, ses0);
420  else if (tcp0->flags & TCP_FLAG_FIN
421  && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
422  ses0->state = SNAT_SESSION_TCP_LAST_ACK;
423  else if (tcp0->flags == 0
424  && ses0->state == SNAT_SESSION_UNKNOWN)
425  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
426 
427  old_port0 = tcp0->src;
428  tcp0->src = new_port0;
429 
430  sum0 = tcp0->checksum;
431  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
432  ip4_header_t,
433  dst_address /* changed member */ );
434  sum0 = ip_csum_update (sum0, old_port0, new_port0,
435  ip4_header_t /* cheat */ ,
436  length /* changed member */ );
437  mss_clamping (sm, tcp0, &sum0);
438  tcp0->checksum = ip_csum_fold (sum0);
439  }
440  else
441  {
442  ses0->state = SNAT_SESSION_UDP_ACTIVE;
443  old_port0 = udp0->src_port;
444  udp0->src_port = new_port0;
445  udp0->checksum = 0;
446  }
447 
448  switch (ses0->state)
449  {
450  case SNAT_SESSION_UDP_ACTIVE:
451  ses0->expire = now + sm->udp_timeout;
452  break;
453  case SNAT_SESSION_TCP_SYN_SENT:
454  case SNAT_SESSION_TCP_FIN_WAIT:
455  case SNAT_SESSION_TCP_CLOSE_WAIT:
456  case SNAT_SESSION_TCP_LAST_ACK:
457  ses0->expire = now + sm->tcp_transitory_timeout;
458  break;
459  case SNAT_SESSION_TCP_ESTABLISHED:
460  ses0->expire = now + sm->tcp_established_timeout;
461  break;
462  }
463 
464  trace0:
465  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
466  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
467  {
469  vlib_add_trace (vm, node, b0, sizeof (*t));
470  t->sw_if_index = sw_if_index0;
471  t->next_index = next0;
472  t->session_index = ~0;
473  if (ses0)
474  t->session_index = ses0 - dm0->sessions;
475  }
476 
477  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
478 
479  ip1 = vlib_buffer_get_current (b1);
480  udp1 = ip4_next_header (ip1);
481  tcp1 = (tcp_header_t *) udp1;
482 
483  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
484 
485  if (PREDICT_FALSE (ip1->ttl == 1))
486  {
487  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
488  icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
489  ICMP4_time_exceeded_ttl_exceeded_in_transit,
490  0);
492  goto trace1;
493  }
494 
495  proto1 = ip_proto_to_snat_proto (ip1->protocol);
496 
497  if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
498  {
499  rx_fib_index1 =
501  icmp1 = (icmp46_header_t *) udp1;
502 
503  next1 = icmp_in2out (sm, b1, ip1, icmp1, sw_if_index1,
504  rx_fib_index1, node, next1, thread_index,
505  &ses1, &dm1);
506  goto trace1;
507  }
508 
509  dm1 = snat_det_map_by_user (sm, &ip1->src_address);
510  if (PREDICT_FALSE (!dm1))
511  {
512  nat_log_info ("no match for internal host %U",
514  next1 = NAT_DET_IN2OUT_NEXT_DROP;
515  b1->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
516  goto trace1;
517  }
518 
519  snat_det_forward (dm1, &ip1->src_address, &new_addr1, &lo_port1);
520 
521  key1.ext_host_addr = ip1->dst_address;
522  key1.ext_host_port = tcp1->dst;
523 
524  ses1 =
525  snat_det_find_ses_by_in (dm1, &ip1->src_address, tcp1->src, key1);
526  if (PREDICT_FALSE (!ses1))
527  {
528  for (i1 = 0; i1 < dm1->ports_per_host; i1++)
529  {
530  key1.out_port = clib_host_to_net_u16 (lo_port1 +
531  ((i1 +
532  clib_net_to_host_u16
533  (tcp1->src)) %
534  dm1->
535  ports_per_host));
536 
538  (dm1, &ip1->src_address, key1.as_u64))
539  continue;
540 
541  ses1 =
542  snat_det_ses_create (thread_index, dm1, &ip1->src_address,
543  tcp1->src, &key1);
544  break;
545  }
546  if (PREDICT_FALSE (!ses1))
547  {
548  /* too many sessions for user, send ICMP error packet */
549  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
551  ICMP4_destination_unreachable,
552  ICMP4_destination_unreachable_destination_unreachable_host,
553  0);
555  goto trace1;
556  }
557  }
558 
559  new_port1 = ses1->out.out_port;
560 
561  old_addr1.as_u32 = ip1->src_address.as_u32;
562  ip1->src_address.as_u32 = new_addr1.as_u32;
563  vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
564 
565  sum1 = ip1->checksum;
566  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
567  ip4_header_t,
568  src_address /* changed member */ );
569  ip1->checksum = ip_csum_fold (sum1);
570 
571  if (PREDICT_TRUE (proto1 == SNAT_PROTOCOL_TCP))
572  {
573  if (tcp1->flags & TCP_FLAG_SYN)
574  ses1->state = SNAT_SESSION_TCP_SYN_SENT;
575  else if (tcp1->flags & TCP_FLAG_ACK
576  && ses1->state == SNAT_SESSION_TCP_SYN_SENT)
577  ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
578  else if (tcp1->flags & TCP_FLAG_FIN
579  && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
580  ses1->state = SNAT_SESSION_TCP_FIN_WAIT;
581  else if (tcp1->flags & TCP_FLAG_ACK
582  && ses1->state == SNAT_SESSION_TCP_FIN_WAIT)
583  snat_det_ses_close (dm1, ses1);
584  else if (tcp1->flags & TCP_FLAG_FIN
585  && ses1->state == SNAT_SESSION_TCP_CLOSE_WAIT)
586  ses1->state = SNAT_SESSION_TCP_LAST_ACK;
587  else if (tcp1->flags == 0
588  && ses1->state == SNAT_SESSION_UNKNOWN)
589  ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
590 
591  old_port1 = tcp1->src;
592  tcp1->src = new_port1;
593 
594  sum1 = tcp1->checksum;
595  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
596  ip4_header_t,
597  dst_address /* changed member */ );
598  sum1 = ip_csum_update (sum1, old_port1, new_port1,
599  ip4_header_t /* cheat */ ,
600  length /* changed member */ );
601  mss_clamping (sm, tcp1, &sum1);
602  tcp1->checksum = ip_csum_fold (sum1);
603  }
604  else
605  {
606  ses1->state = SNAT_SESSION_UDP_ACTIVE;
607  old_port1 = udp1->src_port;
608  udp1->src_port = new_port1;
609  udp1->checksum = 0;
610  }
611 
612  switch (ses1->state)
613  {
614  case SNAT_SESSION_UDP_ACTIVE:
615  ses1->expire = now + sm->udp_timeout;
616  break;
617  case SNAT_SESSION_TCP_SYN_SENT:
618  case SNAT_SESSION_TCP_FIN_WAIT:
619  case SNAT_SESSION_TCP_CLOSE_WAIT:
620  case SNAT_SESSION_TCP_LAST_ACK:
621  ses1->expire = now + sm->tcp_transitory_timeout;
622  break;
623  case SNAT_SESSION_TCP_ESTABLISHED:
624  ses1->expire = now + sm->tcp_established_timeout;
625  break;
626  }
627 
628  trace1:
629  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
630  && (b1->flags & VLIB_BUFFER_IS_TRACED)))
631  {
633  vlib_add_trace (vm, node, b1, sizeof (*t));
634  t->sw_if_index = sw_if_index1;
635  t->next_index = next1;
636  t->session_index = ~0;
637  if (ses1)
638  t->session_index = ses1 - dm1->sessions;
639  }
640 
641  pkts_processed += next1 != NAT_DET_IN2OUT_NEXT_DROP;
642 
643  /* verify speculative enqueues, maybe switch current next frame */
644  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
645  to_next, n_left_to_next,
646  bi0, bi1, next0, next1);
647  }
648 
649  while (n_left_from > 0 && n_left_to_next > 0)
650  {
651  u32 bi0;
652  vlib_buffer_t *b0;
653  u32 next0;
654  u32 sw_if_index0;
655  ip4_header_t *ip0;
656  ip_csum_t sum0;
657  ip4_address_t new_addr0, old_addr0;
658  u16 old_port0, new_port0, lo_port0, i0;
659  udp_header_t *udp0;
660  tcp_header_t *tcp0;
661  u32 proto0;
662  snat_det_out_key_t key0;
663  snat_det_map_t *dm0;
664  snat_det_session_t *ses0 = 0;
665  u32 rx_fib_index0;
666  icmp46_header_t *icmp0;
667 
668  /* speculatively enqueue b0 to the current next frame */
669  bi0 = from[0];
670  to_next[0] = bi0;
671  from += 1;
672  to_next += 1;
673  n_left_from -= 1;
674  n_left_to_next -= 1;
675 
676  b0 = vlib_get_buffer (vm, bi0);
678 
679  ip0 = vlib_buffer_get_current (b0);
680  udp0 = ip4_next_header (ip0);
681  tcp0 = (tcp_header_t *) udp0;
682 
683  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
684 
685  if (PREDICT_FALSE (ip0->ttl == 1))
686  {
687  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
688  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
689  ICMP4_time_exceeded_ttl_exceeded_in_transit,
690  0);
692  goto trace00;
693  }
694 
695  proto0 = ip_proto_to_snat_proto (ip0->protocol);
696 
697  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
698  {
699  rx_fib_index0 =
701  icmp0 = (icmp46_header_t *) udp0;
702 
703  next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
704  rx_fib_index0, node, next0, thread_index,
705  &ses0, &dm0);
706  goto trace00;
707  }
708 
709  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
710  if (PREDICT_FALSE (!dm0))
711  {
712  nat_log_info ("no match for internal host %U",
714  next0 = NAT_DET_IN2OUT_NEXT_DROP;
715  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
716  goto trace00;
717  }
718 
719  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
720 
721  key0.ext_host_addr = ip0->dst_address;
722  key0.ext_host_port = tcp0->dst;
723 
724  ses0 =
725  snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
726  if (PREDICT_FALSE (!ses0))
727  {
728  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
729  {
730  key0.out_port = clib_host_to_net_u16 (lo_port0 +
731  ((i0 +
732  clib_net_to_host_u16
733  (tcp0->src)) %
734  dm0->
735  ports_per_host));
736 
738  (dm0, &ip0->src_address, key0.as_u64))
739  continue;
740 
741  ses0 =
742  snat_det_ses_create (thread_index, dm0, &ip0->src_address,
743  tcp0->src, &key0);
744  break;
745  }
746  if (PREDICT_FALSE (!ses0))
747  {
748  /* too many sessions for user, send ICMP error packet */
749  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
751  ICMP4_destination_unreachable,
752  ICMP4_destination_unreachable_destination_unreachable_host,
753  0);
755  goto trace00;
756  }
757  }
758 
759  new_port0 = ses0->out.out_port;
760 
761  old_addr0.as_u32 = ip0->src_address.as_u32;
762  ip0->src_address.as_u32 = new_addr0.as_u32;
763  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
764 
765  sum0 = ip0->checksum;
766  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
767  ip4_header_t,
768  src_address /* changed member */ );
769  ip0->checksum = ip_csum_fold (sum0);
770 
771  if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
772  {
773  if (tcp0->flags & TCP_FLAG_SYN)
774  ses0->state = SNAT_SESSION_TCP_SYN_SENT;
775  else if (tcp0->flags & TCP_FLAG_ACK
776  && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
777  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
778  else if (tcp0->flags & TCP_FLAG_FIN
779  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
780  ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
781  else if (tcp0->flags & TCP_FLAG_ACK
782  && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
783  snat_det_ses_close (dm0, ses0);
784  else if (tcp0->flags & TCP_FLAG_FIN
785  && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
786  ses0->state = SNAT_SESSION_TCP_LAST_ACK;
787  else if (tcp0->flags == 0
788  && ses0->state == SNAT_SESSION_UNKNOWN)
789  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
790 
791  old_port0 = tcp0->src;
792  tcp0->src = new_port0;
793 
794  sum0 = tcp0->checksum;
795  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
796  ip4_header_t,
797  dst_address /* changed member */ );
798  sum0 = ip_csum_update (sum0, old_port0, new_port0,
799  ip4_header_t /* cheat */ ,
800  length /* changed member */ );
801  mss_clamping (sm, tcp0, &sum0);
802  tcp0->checksum = ip_csum_fold (sum0);
803  }
804  else
805  {
806  ses0->state = SNAT_SESSION_UDP_ACTIVE;
807  old_port0 = udp0->src_port;
808  udp0->src_port = new_port0;
809  udp0->checksum = 0;
810  }
811 
812  switch (ses0->state)
813  {
814  case SNAT_SESSION_UDP_ACTIVE:
815  ses0->expire = now + sm->udp_timeout;
816  break;
817  case SNAT_SESSION_TCP_SYN_SENT:
818  case SNAT_SESSION_TCP_FIN_WAIT:
819  case SNAT_SESSION_TCP_CLOSE_WAIT:
820  case SNAT_SESSION_TCP_LAST_ACK:
821  ses0->expire = now + sm->tcp_transitory_timeout;
822  break;
823  case SNAT_SESSION_TCP_ESTABLISHED:
824  ses0->expire = now + sm->tcp_established_timeout;
825  break;
826  }
827 
828  trace00:
829  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
830  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
831  {
833  vlib_add_trace (vm, node, b0, sizeof (*t));
834  t->sw_if_index = sw_if_index0;
835  t->next_index = next0;
836  t->session_index = ~0;
837  if (ses0)
838  t->session_index = ses0 - dm0->sessions;
839  }
840 
841  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
842 
843  /* verify speculative enqueue, maybe switch current next frame */
844  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
845  to_next, n_left_to_next,
846  bi0, next0);
847  }
848 
849  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
850  }
851 
853  NAT_DET_IN2OUT_ERROR_IN2OUT_PACKETS,
854  pkts_processed);
855  return frame->n_vectors;
856 }
857 
858 /* *INDENT-OFF* */
860  .name = "nat44-det-in2out",
861  .vector_size = sizeof (u32),
862  .format_trace = format_nat_det_in2out_trace,
863  .type = VLIB_NODE_TYPE_INTERNAL,
865  .error_strings = nat_det_in2out_error_strings,
866  .n_next_nodes = NAT_DET_IN2OUT_N_NEXT,
867  /* edit / add dispositions here */
868  .next_nodes = {
869  [NAT_DET_IN2OUT_NEXT_DROP] = "error-drop",
870  [NAT_DET_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
871  [NAT_DET_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
872  },
873 };
874 /* *INDENT-ON* */
875 
876 /*
877  * fd.io coding-style-patch-verification: ON
878  *
879  * Local Variables:
880  * eval: (c-set-style "gnu")
881  * End:
882  */
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
#define nat_log_info(...)
Definition: nat.h:724
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
#define CLIB_UNUSED(x)
Definition: clib.h:82
u16 ext_host_port
Definition: nat.h:85
u16 out_port
Definition: nat.h:86
u32 icmp_timeout
Definition: nat.h:555
ip4_address_t src_address
Definition: ip4_packet.h:170
#define TCP_FLAG_SYN
Definition: fa_node.h:13
#define PREDICT_TRUE(x)
Definition: clib.h:112
static_always_inline u8 icmp_is_error_message(icmp46_header_t *icmp)
Definition: nat_inlines.h:54
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:255
u32 thread_index
Definition: main.h:197
u8 data[0]
Packet data.
Definition: buffer.h:181
static void snat_det_ses_close(snat_det_map_t *dm, snat_det_session_t *ses)
Definition: nat_det.h:182
static snat_det_session_t * snat_det_find_ses_by_in(snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t out_key)
Definition: nat_det.h:129
static void snat_det_forward(snat_det_map_t *dm, ip4_address_t *in_addr, ip4_address_t *out_addr, u16 *lo_port)
Definition: nat_det.h:75
uword ip_csum_t
Definition: ip_packet.h:181
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
#define VLIB_NODE_FN(node)
Definition: node.h:201
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:468
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
struct _tcp_header tcp_header_t
unsigned char u8
Definition: types.h:56
static char * nat_det_in2out_error_strings[]
static int snat_not_translate_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, ip4_header_t *ip0, u32 proto0, u32 rx_fib_index0)
Check if packet should be translated.
Definition: nat_inlines.h:416
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
Definition: ip4_fib.c:224
format_function_t format_ip4_address
Definition: format.h:75
ip4_address_t ext_host_addr
Definition: nat.h:84
ip4_address_t dst_address
Definition: ip4_packet.h:170
u32 det_in2out_node_index
Definition: nat.h:517
#define TCP_FLAG_ACK
Definition: fa_node.h:16
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:203
u32 icmp_in2out(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: in2out.c:648
static void * ip4_next_header(ip4_header_t *i)
Definition: ip4_packet.h:241
unsigned int u32
Definition: types.h:88
nat_det_in2out_error_t
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
static void mss_clamping(snat_main_t *sm, tcp_header_t *tcp, ip_csum_t *sum)
Definition: nat_inlines.h:353
snat_det_session_t * sessions
Definition: nat.h:291
vlib_main_t * vlib_main
Definition: nat.h:572
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
u32 udp_timeout
Definition: nat.h:552
#define PREDICT_FALSE(x)
Definition: clib.h:111
#define TCP_FLAG_FIN
Definition: fa_node.h:12
vl_api_address_union_t src_address
Definition: ip_types.api:44
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
Definition: buffer_node.h:70
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:338
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
snat_main_t snat_main
Definition: nat.c:39
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
static snat_det_session_t * snat_det_ses_create(u32 thread_index, snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t *out)
Definition: nat_det.h:150
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
vlib_main_t * vm
Definition: buffer.c:312
void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
Definition: icmp4.c:431
deterministic NAT definitions
#define foreach_nat_det_in2out_error
u32 outside_fib_index
Definition: nat.h:547
#define ARRAY_LEN(x)
Definition: clib.h:62
ip4_address_t addr
Definition: nat.h:52
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:458
u32 tcp_transitory_timeout
Definition: nat.h:554
static snat_det_map_t * snat_det_map_by_user(snat_main_t *sm, ip4_address_t *user_addr)
Definition: nat_det.h:45
nat_det_in2out_next_t
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
Definition: defs.h:47
static u32 ip_proto_to_snat_proto(u8 ip_proto)
The NAT inline functions.
Definition: nat_inlines.h:27
u16 ports_per_host
Definition: nat.h:287
VLIB buffer representation.
Definition: buffer.h:102
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
#define ip_csum_update(sum, old, new, type, field)
Definition: ip_packet.h:231
snat_det_out_key_t out
Definition: nat.h:269
static snat_det_session_t * snat_det_get_ses_by_out(snat_det_map_t *dm, ip4_address_t *in_addr, u64 out_key)
Definition: nat_det.h:112
#define vnet_buffer(b)
Definition: buffer.h:369
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:301
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:237
Definition: defs.h:46
u16 fib_index
Definition: nat.h:54
u8 protocol
Definition: ipsec.api:96
static u8 * format_nat_det_in2out_trace(u8 *s, va_list *args)
u32 tcp_established_timeout
Definition: nat.h:553