FD.io VPP  v19.08.3-2-gbabecb413
Vector Packet Processing
nat_det_in2out.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief Deterministic/CGN NAT44 inside to outside network translation
18  */
19 
20 #include <vlib/vlib.h>
21 #include <vnet/vnet.h>
22 #include <vnet/ip/ip.h>
23 #include <vnet/fib/ip4_fib.h>
24 #include <vppinfra/error.h>
25 #include <vppinfra/elog.h>
26 #include <nat/nat.h>
27 #include <nat/nat_det.h>
28 #include <nat/nat_inlines.h>
29 
30 typedef struct
31 {
36 
37 typedef enum
38 {
44 
45 #define foreach_nat_det_in2out_error \
46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
47 _(NO_TRANSLATION, "No translation") \
48 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
49 _(OUT_OF_PORTS, "Out of ports") \
50 _(IN2OUT_PACKETS, "Good in2out packets processed")
51 
52 typedef enum
53 {
54 #define _(sym,str) NAT_DET_IN2OUT_ERROR_##sym,
56 #undef _
59 
60 static char *nat_det_in2out_error_strings[] = {
61 #define _(sym,string) string,
63 #undef _
64 };
65 
66 static u8 *
67 format_nat_det_in2out_trace (u8 * s, va_list * args)
68 {
69  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
70  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
71  nat_det_in2out_trace_t *t = va_arg (*args, nat_det_in2out_trace_t *);
72 
73  s = format (s, "NAT_DET_IN2OUT: sw_if_index %d, next index %d, session %d",
75 
76  return s;
77 }
78 
79 #ifndef CLIB_MARCH_VARIANT
80 /**
81  * Get address and port values to be used for ICMP packet translation
82  * and create session if needed
83  *
84  * @param[in,out] sm NAT main
85  * @param[in,out] node NAT node runtime
86  * @param[in] thread_index thread index
87  * @param[in,out] b0 buffer containing packet to be translated
88  * @param[out] p_proto protocol used for matching
89  * @param[out] p_value address and port after NAT translation
90  * @param[out] p_dont_translate if packet should not be translated
91  * @param d optional parameter
92  * @param e optional parameter
93  */
94 u32
96  u32 thread_index, vlib_buffer_t * b0,
97  ip4_header_t * ip0, u8 * p_proto,
98  snat_session_key_t * p_value,
99  u8 * p_dont_translate, void *d, void *e)
100 {
101  icmp46_header_t *icmp0;
102  u32 sw_if_index0;
103  u32 rx_fib_index0;
104  u8 protocol;
105  snat_det_out_key_t key0;
106  u8 dont_translate = 0;
107  u32 next0 = ~0;
108  icmp_echo_header_t *echo0, *inner_echo0 = 0;
109  ip4_header_t *inner_ip0;
110  void *l4_header = 0;
111  icmp46_header_t *inner_icmp0;
112  snat_det_map_t *dm0 = 0;
113  ip4_address_t new_addr0;
114  u16 lo_port0, i0;
115  snat_det_session_t *ses0 = 0;
116  ip4_address_t in_addr;
117  u16 in_port;
118 
119  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
120  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
121  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
122  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
123 
124  if (!icmp_is_error_message (icmp0))
125  {
126  protocol = SNAT_PROTOCOL_ICMP;
127  in_addr = ip0->src_address;
128  in_port = echo0->identifier;
129  }
130  else
131  {
132  inner_ip0 = (ip4_header_t *) (echo0 + 1);
133  l4_header = ip4_next_header (inner_ip0);
134  protocol = ip_proto_to_snat_proto (inner_ip0->protocol);
135  in_addr = inner_ip0->dst_address;
136  switch (protocol)
137  {
138  case SNAT_PROTOCOL_ICMP:
139  inner_icmp0 = (icmp46_header_t *) l4_header;
140  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
141  in_port = inner_echo0->identifier;
142  break;
143  case SNAT_PROTOCOL_UDP:
144  case SNAT_PROTOCOL_TCP:
145  in_port = ((tcp_udp_header_t *) l4_header)->dst_port;
146  break;
147  default:
148  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
149  next0 = NAT_DET_IN2OUT_NEXT_DROP;
150  goto out;
151  }
152  }
153 
154  dm0 = snat_det_map_by_user (sm, &in_addr);
155  if (PREDICT_FALSE (!dm0))
156  {
157  nat_log_info ("no match for internal host %U",
158  format_ip4_address, &in_addr);
159  if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
160  IP_PROTOCOL_ICMP,
161  rx_fib_index0)))
162  {
163  dont_translate = 1;
164  goto out;
165  }
166  next0 = NAT_DET_IN2OUT_NEXT_DROP;
167  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
168  goto out;
169  }
170 
171  snat_det_forward (dm0, &in_addr, &new_addr0, &lo_port0);
172 
173  key0.ext_host_addr = ip0->dst_address;
174  key0.ext_host_port = 0;
175 
176  ses0 = snat_det_find_ses_by_in (dm0, &in_addr, in_port, key0);
177  if (PREDICT_FALSE (!ses0))
178  {
179  if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
180  IP_PROTOCOL_ICMP,
181  rx_fib_index0)))
182  {
183  dont_translate = 1;
184  goto out;
185  }
186  if (icmp0->type != ICMP4_echo_request)
187  {
188  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
189  next0 = NAT_DET_IN2OUT_NEXT_DROP;
190  goto out;
191  }
192  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
193  {
194  key0.out_port = clib_host_to_net_u16 (lo_port0 +
195  ((i0 +
196  clib_net_to_host_u16
197  (echo0->identifier)) %
198  dm0->ports_per_host));
199 
200  if (snat_det_get_ses_by_out (dm0, &in_addr, key0.as_u64))
201  continue;
202 
203  ses0 =
204  snat_det_ses_create (thread_index, dm0,
205  &in_addr, echo0->identifier, &key0);
206  break;
207  }
208  if (PREDICT_FALSE (!ses0))
209  {
210  next0 = NAT_DET_IN2OUT_NEXT_DROP;
211  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_OUT_OF_PORTS];
212  goto out;
213  }
214  }
215 
216  if (PREDICT_FALSE (icmp0->type != ICMP4_echo_request &&
217  !icmp_is_error_message (icmp0)))
218  {
219  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
220  next0 = NAT_DET_IN2OUT_NEXT_DROP;
221  goto out;
222  }
223 
224  u32 now = (u32) vlib_time_now (sm->vlib_main);
225 
226  ses0->state = SNAT_SESSION_ICMP_ACTIVE;
227  ses0->expire = now + sm->icmp_timeout;
228 
229 out:
230  *p_proto = protocol;
231  if (ses0)
232  {
233  p_value->addr = new_addr0;
234  p_value->fib_index = sm->outside_fib_index;
235  p_value->port = ses0->out.out_port;
236  }
237  *p_dont_translate = dont_translate;
238  if (d)
239  *(snat_det_session_t **) d = ses0;
240  if (e)
241  *(snat_det_map_t **) e = dm0;
242  return next0;
243 }
244 #endif
245 
247  vlib_node_runtime_t * node,
248  vlib_frame_t * frame)
249 {
250  u32 n_left_from, *from, *to_next;
251  nat_det_in2out_next_t next_index;
252  u32 pkts_processed = 0;
253  snat_main_t *sm = &snat_main;
254  u32 now = (u32) vlib_time_now (vm);
255  u32 thread_index = vm->thread_index;
256 
257  from = vlib_frame_vector_args (frame);
258  n_left_from = frame->n_vectors;
259  next_index = node->cached_next_index;
260 
261  while (n_left_from > 0)
262  {
263  u32 n_left_to_next;
264 
265  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
266 
267  while (n_left_from >= 4 && n_left_to_next >= 2)
268  {
269  u32 bi0, bi1;
270  vlib_buffer_t *b0, *b1;
271  u32 next0, next1;
272  u32 sw_if_index0, sw_if_index1;
273  ip4_header_t *ip0, *ip1;
274  ip_csum_t sum0, sum1;
275  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
276  u16 old_port0, new_port0, lo_port0, i0;
277  u16 old_port1, new_port1, lo_port1, i1;
278  udp_header_t *udp0, *udp1;
279  tcp_header_t *tcp0, *tcp1;
280  u32 proto0, proto1;
281  snat_det_out_key_t key0, key1;
282  snat_det_map_t *dm0, *dm1;
283  snat_det_session_t *ses0 = 0, *ses1 = 0;
284  u32 rx_fib_index0, rx_fib_index1;
285  icmp46_header_t *icmp0, *icmp1;
286 
287  /* Prefetch next iteration. */
288  {
289  vlib_buffer_t *p2, *p3;
290 
291  p2 = vlib_get_buffer (vm, from[2]);
292  p3 = vlib_get_buffer (vm, from[3]);
293 
294  vlib_prefetch_buffer_header (p2, LOAD);
295  vlib_prefetch_buffer_header (p3, LOAD);
296 
299  }
300 
301  /* speculatively enqueue b0 and b1 to the current next frame */
302  to_next[0] = bi0 = from[0];
303  to_next[1] = bi1 = from[1];
304  from += 2;
305  to_next += 2;
306  n_left_from -= 2;
307  n_left_to_next -= 2;
308 
309  b0 = vlib_get_buffer (vm, bi0);
310  b1 = vlib_get_buffer (vm, bi1);
311 
314 
315  ip0 = vlib_buffer_get_current (b0);
316  udp0 = ip4_next_header (ip0);
317  tcp0 = (tcp_header_t *) udp0;
318 
319  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
320 
321  if (PREDICT_FALSE (ip0->ttl == 1))
322  {
323  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
324  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
325  ICMP4_time_exceeded_ttl_exceeded_in_transit,
326  0);
328  goto trace0;
329  }
330 
331  proto0 = ip_proto_to_snat_proto (ip0->protocol);
332 
333  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
334  {
335  rx_fib_index0 =
337  icmp0 = (icmp46_header_t *) udp0;
338 
339  next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
340  rx_fib_index0, node, next0, thread_index,
341  &ses0, &dm0);
342  goto trace0;
343  }
344 
345  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
346  if (PREDICT_FALSE (!dm0))
347  {
348  nat_log_info ("no match for internal host %U",
350  next0 = NAT_DET_IN2OUT_NEXT_DROP;
351  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
352  goto trace0;
353  }
354 
355  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
356 
357  key0.ext_host_addr = ip0->dst_address;
358  key0.ext_host_port = tcp0->dst;
359 
360  ses0 =
361  snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
362  if (PREDICT_FALSE (!ses0))
363  {
364  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
365  {
366  key0.out_port = clib_host_to_net_u16 (lo_port0 +
367  ((i0 +
368  clib_net_to_host_u16
369  (tcp0->src)) %
370  dm0->
371  ports_per_host));
372 
374  (dm0, &ip0->src_address, key0.as_u64))
375  continue;
376 
377  ses0 =
378  snat_det_ses_create (thread_index, dm0, &ip0->src_address,
379  tcp0->src, &key0);
380  break;
381  }
382  if (PREDICT_FALSE (!ses0))
383  {
384  /* too many sessions for user, send ICMP error packet */
385  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
387  ICMP4_destination_unreachable,
388  ICMP4_destination_unreachable_destination_unreachable_host,
389  0);
391  goto trace0;
392  }
393  }
394 
395  old_port0 = udp0->src_port;
396  udp0->src_port = new_port0 = ses0->out.out_port;
397 
398  old_addr0.as_u32 = ip0->src_address.as_u32;
399  ip0->src_address.as_u32 = new_addr0.as_u32;
400  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
401 
402  sum0 = ip0->checksum;
403  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
404  ip4_header_t,
405  src_address /* changed member */ );
406  ip0->checksum = ip_csum_fold (sum0);
407 
408  if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
409  {
410  if (tcp0->flags & TCP_FLAG_SYN)
411  ses0->state = SNAT_SESSION_TCP_SYN_SENT;
412  else if (tcp0->flags & TCP_FLAG_ACK
413  && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
414  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
415  else if (tcp0->flags & TCP_FLAG_FIN
416  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
417  ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
418  else if (tcp0->flags & TCP_FLAG_ACK
419  && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
420  snat_det_ses_close (dm0, ses0);
421  else if (tcp0->flags & TCP_FLAG_FIN
422  && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
423  ses0->state = SNAT_SESSION_TCP_LAST_ACK;
424  else if (tcp0->flags == 0
425  && ses0->state == SNAT_SESSION_UNKNOWN)
426  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
427 
428  sum0 = tcp0->checksum;
429  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
430  ip4_header_t,
431  dst_address /* changed member */ );
432  sum0 = ip_csum_update (sum0, old_port0, new_port0,
433  ip4_header_t /* cheat */ ,
434  length /* changed member */ );
435  mss_clamping (sm, tcp0, &sum0);
436  tcp0->checksum = ip_csum_fold (sum0);
437  }
438  else
439  {
440  ses0->state = SNAT_SESSION_UDP_ACTIVE;
441 
442  if (PREDICT_FALSE (udp0->checksum))
443  {
444  sum0 = udp0->checksum;
445  sum0 =
446  ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
447  ip4_header_t,
448  dst_address /* changed member */ );
449  sum0 =
450  ip_csum_update (sum0, old_port0, new_port0,
451  ip4_header_t /* cheat */ ,
452  length /* changed member */ );
453  udp0->checksum = ip_csum_fold (sum0);
454  }
455  }
456 
457  switch (ses0->state)
458  {
459  case SNAT_SESSION_UDP_ACTIVE:
460  ses0->expire = now + sm->udp_timeout;
461  break;
462  case SNAT_SESSION_TCP_SYN_SENT:
463  case SNAT_SESSION_TCP_FIN_WAIT:
464  case SNAT_SESSION_TCP_CLOSE_WAIT:
465  case SNAT_SESSION_TCP_LAST_ACK:
466  ses0->expire = now + sm->tcp_transitory_timeout;
467  break;
468  case SNAT_SESSION_TCP_ESTABLISHED:
469  ses0->expire = now + sm->tcp_established_timeout;
470  break;
471  }
472 
473  trace0:
474  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
475  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
476  {
478  vlib_add_trace (vm, node, b0, sizeof (*t));
479  t->sw_if_index = sw_if_index0;
480  t->next_index = next0;
481  t->session_index = ~0;
482  if (ses0)
483  t->session_index = ses0 - dm0->sessions;
484  }
485 
486  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
487 
488  ip1 = vlib_buffer_get_current (b1);
489  udp1 = ip4_next_header (ip1);
490  tcp1 = (tcp_header_t *) udp1;
491 
492  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
493 
494  if (PREDICT_FALSE (ip1->ttl == 1))
495  {
496  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
497  icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
498  ICMP4_time_exceeded_ttl_exceeded_in_transit,
499  0);
501  goto trace1;
502  }
503 
504  proto1 = ip_proto_to_snat_proto (ip1->protocol);
505 
506  if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
507  {
508  rx_fib_index1 =
510  icmp1 = (icmp46_header_t *) udp1;
511 
512  next1 = icmp_in2out (sm, b1, ip1, icmp1, sw_if_index1,
513  rx_fib_index1, node, next1, thread_index,
514  &ses1, &dm1);
515  goto trace1;
516  }
517 
518  dm1 = snat_det_map_by_user (sm, &ip1->src_address);
519  if (PREDICT_FALSE (!dm1))
520  {
521  nat_log_info ("no match for internal host %U",
523  next1 = NAT_DET_IN2OUT_NEXT_DROP;
524  b1->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
525  goto trace1;
526  }
527 
528  snat_det_forward (dm1, &ip1->src_address, &new_addr1, &lo_port1);
529 
530  key1.ext_host_addr = ip1->dst_address;
531  key1.ext_host_port = tcp1->dst;
532 
533  ses1 =
534  snat_det_find_ses_by_in (dm1, &ip1->src_address, tcp1->src, key1);
535  if (PREDICT_FALSE (!ses1))
536  {
537  for (i1 = 0; i1 < dm1->ports_per_host; i1++)
538  {
539  key1.out_port = clib_host_to_net_u16 (lo_port1 +
540  ((i1 +
541  clib_net_to_host_u16
542  (tcp1->src)) %
543  dm1->
544  ports_per_host));
545 
547  (dm1, &ip1->src_address, key1.as_u64))
548  continue;
549 
550  ses1 =
551  snat_det_ses_create (thread_index, dm1, &ip1->src_address,
552  tcp1->src, &key1);
553  break;
554  }
555  if (PREDICT_FALSE (!ses1))
556  {
557  /* too many sessions for user, send ICMP error packet */
558  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
560  ICMP4_destination_unreachable,
561  ICMP4_destination_unreachable_destination_unreachable_host,
562  0);
564  goto trace1;
565  }
566  }
567 
568  old_port1 = udp1->src_port;
569  udp1->src_port = new_port1 = ses1->out.out_port;
570 
571  old_addr1.as_u32 = ip1->src_address.as_u32;
572  ip1->src_address.as_u32 = new_addr1.as_u32;
573  vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
574 
575  sum1 = ip1->checksum;
576  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
577  ip4_header_t,
578  src_address /* changed member */ );
579  ip1->checksum = ip_csum_fold (sum1);
580 
581  if (PREDICT_TRUE (proto1 == SNAT_PROTOCOL_TCP))
582  {
583  if (tcp1->flags & TCP_FLAG_SYN)
584  ses1->state = SNAT_SESSION_TCP_SYN_SENT;
585  else if (tcp1->flags & TCP_FLAG_ACK
586  && ses1->state == SNAT_SESSION_TCP_SYN_SENT)
587  ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
588  else if (tcp1->flags & TCP_FLAG_FIN
589  && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
590  ses1->state = SNAT_SESSION_TCP_FIN_WAIT;
591  else if (tcp1->flags & TCP_FLAG_ACK
592  && ses1->state == SNAT_SESSION_TCP_FIN_WAIT)
593  snat_det_ses_close (dm1, ses1);
594  else if (tcp1->flags & TCP_FLAG_FIN
595  && ses1->state == SNAT_SESSION_TCP_CLOSE_WAIT)
596  ses1->state = SNAT_SESSION_TCP_LAST_ACK;
597  else if (tcp1->flags == 0
598  && ses1->state == SNAT_SESSION_UNKNOWN)
599  ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
600 
601  sum1 = tcp1->checksum;
602  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
603  ip4_header_t,
604  dst_address /* changed member */ );
605  sum1 = ip_csum_update (sum1, old_port1, new_port1,
606  ip4_header_t /* cheat */ ,
607  length /* changed member */ );
608  mss_clamping (sm, tcp1, &sum1);
609  tcp1->checksum = ip_csum_fold (sum1);
610  }
611  else
612  {
613  ses1->state = SNAT_SESSION_UDP_ACTIVE;
614 
615  if (PREDICT_FALSE (udp1->checksum))
616  {
617  sum1 = udp1->checksum;
618  sum1 =
619  ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
620  ip4_header_t,
621  dst_address /* changed member */ );
622  sum1 =
623  ip_csum_update (sum1, old_port1, new_port1,
624  ip4_header_t /* cheat */ ,
625  length /* changed member */ );
626  udp1->checksum = ip_csum_fold (sum1);
627  }
628  }
629 
630  switch (ses1->state)
631  {
632  case SNAT_SESSION_UDP_ACTIVE:
633  ses1->expire = now + sm->udp_timeout;
634  break;
635  case SNAT_SESSION_TCP_SYN_SENT:
636  case SNAT_SESSION_TCP_FIN_WAIT:
637  case SNAT_SESSION_TCP_CLOSE_WAIT:
638  case SNAT_SESSION_TCP_LAST_ACK:
639  ses1->expire = now + sm->tcp_transitory_timeout;
640  break;
641  case SNAT_SESSION_TCP_ESTABLISHED:
642  ses1->expire = now + sm->tcp_established_timeout;
643  break;
644  }
645 
646  trace1:
647  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
648  && (b1->flags & VLIB_BUFFER_IS_TRACED)))
649  {
651  vlib_add_trace (vm, node, b1, sizeof (*t));
652  t->sw_if_index = sw_if_index1;
653  t->next_index = next1;
654  t->session_index = ~0;
655  if (ses1)
656  t->session_index = ses1 - dm1->sessions;
657  }
658 
659  pkts_processed += next1 != NAT_DET_IN2OUT_NEXT_DROP;
660 
661  /* verify speculative enqueues, maybe switch current next frame */
662  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
663  to_next, n_left_to_next,
664  bi0, bi1, next0, next1);
665  }
666 
667  while (n_left_from > 0 && n_left_to_next > 0)
668  {
669  u32 bi0;
670  vlib_buffer_t *b0;
671  u32 next0;
672  u32 sw_if_index0;
673  ip4_header_t *ip0;
674  ip_csum_t sum0;
675  ip4_address_t new_addr0, old_addr0;
676  u16 old_port0, new_port0, lo_port0, i0;
677  udp_header_t *udp0;
678  tcp_header_t *tcp0;
679  u32 proto0;
680  snat_det_out_key_t key0;
681  snat_det_map_t *dm0;
682  snat_det_session_t *ses0 = 0;
683  u32 rx_fib_index0;
684  icmp46_header_t *icmp0;
685 
686  /* speculatively enqueue b0 to the current next frame */
687  bi0 = from[0];
688  to_next[0] = bi0;
689  from += 1;
690  to_next += 1;
691  n_left_from -= 1;
692  n_left_to_next -= 1;
693 
694  b0 = vlib_get_buffer (vm, bi0);
696 
697  ip0 = vlib_buffer_get_current (b0);
698  udp0 = ip4_next_header (ip0);
699  tcp0 = (tcp_header_t *) udp0;
700 
701  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
702 
703  if (PREDICT_FALSE (ip0->ttl == 1))
704  {
705  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
706  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
707  ICMP4_time_exceeded_ttl_exceeded_in_transit,
708  0);
710  goto trace00;
711  }
712 
713  proto0 = ip_proto_to_snat_proto (ip0->protocol);
714 
715  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
716  {
717  rx_fib_index0 =
719  icmp0 = (icmp46_header_t *) udp0;
720 
721  next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
722  rx_fib_index0, node, next0, thread_index,
723  &ses0, &dm0);
724  goto trace00;
725  }
726 
727  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
728  if (PREDICT_FALSE (!dm0))
729  {
730  nat_log_info ("no match for internal host %U",
732  next0 = NAT_DET_IN2OUT_NEXT_DROP;
733  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
734  goto trace00;
735  }
736 
737  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
738 
739  key0.ext_host_addr = ip0->dst_address;
740  key0.ext_host_port = tcp0->dst;
741 
742  ses0 =
743  snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
744  if (PREDICT_FALSE (!ses0))
745  {
746  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
747  {
748  key0.out_port = clib_host_to_net_u16 (lo_port0 +
749  ((i0 +
750  clib_net_to_host_u16
751  (tcp0->src)) %
752  dm0->
753  ports_per_host));
754 
756  (dm0, &ip0->src_address, key0.as_u64))
757  continue;
758 
759  ses0 =
760  snat_det_ses_create (thread_index, dm0, &ip0->src_address,
761  tcp0->src, &key0);
762  break;
763  }
764  if (PREDICT_FALSE (!ses0))
765  {
766  /* too many sessions for user, send ICMP error packet */
767  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
769  ICMP4_destination_unreachable,
770  ICMP4_destination_unreachable_destination_unreachable_host,
771  0);
773  goto trace00;
774  }
775  }
776 
777  old_port0 = udp0->src_port;
778  udp0->src_port = new_port0 = ses0->out.out_port;
779 
780  old_addr0.as_u32 = ip0->src_address.as_u32;
781  ip0->src_address.as_u32 = new_addr0.as_u32;
782  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
783 
784  sum0 = ip0->checksum;
785  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
786  ip4_header_t,
787  src_address /* changed member */ );
788  ip0->checksum = ip_csum_fold (sum0);
789 
790  if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
791  {
792  if (tcp0->flags & TCP_FLAG_SYN)
793  ses0->state = SNAT_SESSION_TCP_SYN_SENT;
794  else if (tcp0->flags & TCP_FLAG_ACK
795  && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
796  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
797  else if (tcp0->flags & TCP_FLAG_FIN
798  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
799  ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
800  else if (tcp0->flags & TCP_FLAG_ACK
801  && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
802  snat_det_ses_close (dm0, ses0);
803  else if (tcp0->flags & TCP_FLAG_FIN
804  && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
805  ses0->state = SNAT_SESSION_TCP_LAST_ACK;
806  else if (tcp0->flags == 0
807  && ses0->state == SNAT_SESSION_UNKNOWN)
808  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
809 
810  sum0 = tcp0->checksum;
811  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
812  ip4_header_t,
813  dst_address /* changed member */ );
814  sum0 = ip_csum_update (sum0, old_port0, new_port0,
815  ip4_header_t /* cheat */ ,
816  length /* changed member */ );
817  mss_clamping (sm, tcp0, &sum0);
818  tcp0->checksum = ip_csum_fold (sum0);
819  }
820  else
821  {
822  ses0->state = SNAT_SESSION_UDP_ACTIVE;
823 
824  if (PREDICT_FALSE (udp0->checksum))
825  {
826  sum0 = udp0->checksum;
827  sum0 =
828  ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
829  ip4_header_t,
830  dst_address /* changed member */ );
831  sum0 =
832  ip_csum_update (sum0, old_port0, new_port0,
833  ip4_header_t /* cheat */ ,
834  length /* changed member */ );
835  udp0->checksum = ip_csum_fold (sum0);
836  }
837  }
838 
839  switch (ses0->state)
840  {
841  case SNAT_SESSION_UDP_ACTIVE:
842  ses0->expire = now + sm->udp_timeout;
843  break;
844  case SNAT_SESSION_TCP_SYN_SENT:
845  case SNAT_SESSION_TCP_FIN_WAIT:
846  case SNAT_SESSION_TCP_CLOSE_WAIT:
847  case SNAT_SESSION_TCP_LAST_ACK:
848  ses0->expire = now + sm->tcp_transitory_timeout;
849  break;
850  case SNAT_SESSION_TCP_ESTABLISHED:
851  ses0->expire = now + sm->tcp_established_timeout;
852  break;
853  }
854 
855  trace00:
856  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
857  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
858  {
860  vlib_add_trace (vm, node, b0, sizeof (*t));
861  t->sw_if_index = sw_if_index0;
862  t->next_index = next0;
863  t->session_index = ~0;
864  if (ses0)
865  t->session_index = ses0 - dm0->sessions;
866  }
867 
868  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
869 
870  /* verify speculative enqueue, maybe switch current next frame */
871  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
872  to_next, n_left_to_next,
873  bi0, next0);
874  }
875 
876  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
877  }
878 
880  NAT_DET_IN2OUT_ERROR_IN2OUT_PACKETS,
881  pkts_processed);
882  return frame->n_vectors;
883 }
884 
885 /* *INDENT-OFF* */
887  .name = "nat44-det-in2out",
888  .vector_size = sizeof (u32),
889  .format_trace = format_nat_det_in2out_trace,
892  .error_strings = nat_det_in2out_error_strings,
893  .n_next_nodes = NAT_DET_IN2OUT_N_NEXT,
894  /* edit / add dispositions here */
895  .next_nodes = {
896  [NAT_DET_IN2OUT_NEXT_DROP] = "error-drop",
897  [NAT_DET_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
898  [NAT_DET_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
899  },
900 };
901 /* *INDENT-ON* */
902 
903 /*
904  * fd.io coding-style-patch-verification: ON
905  *
906  * Local Variables:
907  * eval: (c-set-style "gnu")
908  * End:
909  */
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
#define nat_log_info(...)
Definition: nat.h:856
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
#define CLIB_UNUSED(x)
Definition: clib.h:83
u16 ext_host_port
Definition: nat.h:125
u32 icmp_timeout
Definition: nat.h:679
ip4_address_t src_address
Definition: ip4_packet.h:170
#define TCP_FLAG_SYN
Definition: fa_node.h:13
#define PREDICT_TRUE(x)
Definition: clib.h:113
static_always_inline u8 icmp_is_error_message(icmp46_header_t *icmp)
Definition: nat_inlines.h:174
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:279
u32 thread_index
Definition: main.h:218
static void snat_det_ses_close(snat_det_map_t *dm, snat_det_session_t *ses)
Definition: nat_det.h:182
static snat_det_session_t * snat_det_find_ses_by_in(snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t out_key)
Definition: nat_det.h:129
static void snat_det_forward(snat_det_map_t *dm, ip4_address_t *in_addr, ip4_address_t *out_addr, u16 *lo_port)
Definition: nat_det.h:75
uword ip_csum_t
Definition: ip_packet.h:219
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
#define VLIB_NODE_FN(node)
Definition: node.h:202
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:470
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
struct _tcp_header tcp_header_t
unsigned char u8
Definition: types.h:56
static char * nat_det_in2out_error_strings[]
static int snat_not_translate_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, ip4_header_t *ip0, u32 proto0, u32 rx_fib_index0)
Check if packet should be translated.
Definition: nat_inlines.h:631
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
Definition: ip4_fib.c:224
format_function_t format_ip4_address
Definition: format.h:75
ip4_address_t ext_host_addr
Definition: nat.h:124
ip4_address_t dst_address
Definition: ip4_packet.h:170
u32 det_in2out_node_index
Definition: nat.h:641
#define TCP_FLAG_ACK
Definition: fa_node.h:16
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:203
u32 icmp_in2out(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: in2out.c:648
static void * ip4_next_header(ip4_header_t *i)
Definition: ip4_packet.h:241
unsigned int u32
Definition: types.h:88
nat_det_in2out_error_t
vl_api_fib_path_type_t type
Definition: fib_types.api:123
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
static void mss_clamping(snat_main_t *sm, tcp_header_t *tcp, ip_csum_t *sum)
Definition: nat_inlines.h:568
snat_det_session_t * sessions
Definition: nat.h:403
vl_api_ip_proto_t protocol
Definition: punt.api:39
vlib_main_t * vlib_main
Definition: nat.h:698
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
u32 udp_timeout
Definition: nat.h:676
#define PREDICT_FALSE(x)
Definition: clib.h:112
#define TCP_FLAG_FIN
Definition: fa_node.h:12
vl_api_address_union_t src_address
Definition: ip_types.api:97
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
Definition: buffer_node.h:70
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:338
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
snat_main_t snat_main
Definition: nat.c:39
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
static snat_det_session_t * snat_det_ses_create(u32 thread_index, snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t *out)
Definition: nat_det.h:150
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
vlib_main_t * vm
Definition: buffer.c:323
deterministic NAT definitions
u8 data[]
Packet data.
Definition: buffer.h:181
#define foreach_nat_det_in2out_error
u32 outside_fib_index
Definition: nat.h:671
#define ARRAY_LEN(x)
Definition: clib.h:63
ip4_address_t addr
Definition: nat.h:92
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:456
u32 tcp_transitory_timeout
Definition: nat.h:678
static snat_det_map_t * snat_det_map_by_user(snat_main_t *sm, ip4_address_t *user_addr)
Definition: nat_det.h:45
nat_det_in2out_next_t
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
Definition: defs.h:47
static u32 ip_proto_to_snat_proto(u8 ip_proto)
Definition: nat_inlines.h:147
u16 ports_per_host
Definition: nat.h:399
VLIB buffer representation.
Definition: buffer.h:102
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
#define ip_csum_update(sum, old, new, type, field)
Definition: ip_packet.h:269
snat_det_out_key_t out
Definition: nat.h:381
static snat_det_session_t * snat_det_get_ses_by_out(snat_det_map_t *dm, ip4_address_t *in_addr, u64 out_key)
Definition: nat_det.h:112
#define vnet_buffer(b)
Definition: buffer.h:365
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:302
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
static_always_inline void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
Definition: icmp4.h:51
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:275
Definition: defs.h:46
u16 fib_index
Definition: nat.h:94
static u8 * format_nat_det_in2out_trace(u8 *s, va_list *args)
u32 tcp_established_timeout
Definition: nat.h:677