FD.io VPP  v20.01-48-g3e0dafb74
Vector Packet Processing
out2in_ed.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief NAT44 endpoint-dependent outside to inside network translation
18  */
19 
20 #include <vlib/vlib.h>
21 #include <vnet/vnet.h>
22 #include <vnet/pg/pg.h>
23 #include <vnet/ip/ip.h>
24 #include <vnet/ethernet/ethernet.h>
25 #include <vnet/fib/ip4_fib.h>
26 #include <vnet/udp/udp.h>
27 #include <vppinfra/error.h>
28 #include <nat/nat.h>
29 #include <nat/nat_ipfix_logging.h>
30 #include <nat/nat_inlines.h>
31 #include <nat/nat44_inlines.h>
32 #include <nat/nat_syslog.h>
33 #include <nat/nat_ha.h>
34 
35 static char *nat_out2in_ed_error_strings[] = {
36 #define _(sym,string) string,
38 #undef _
39 };
40 
41 typedef struct
42 {
48 
49 static u8 *
50 format_nat44_ed_out2in_trace (u8 * s, va_list * args)
51 {
52  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
53  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
54  nat44_ed_out2in_trace_t *t = va_arg (*args, nat44_ed_out2in_trace_t *);
55  char *tag;
56 
57  tag =
58  t->is_slow_path ? "NAT44_OUT2IN_ED_SLOW_PATH" :
59  "NAT44_OUT2IN_ED_FAST_PATH";
60 
61  s = format (s, "%s: sw_if_index %d, next index %d, session %d", tag,
63 
64  return s;
65 }
66 
67 static inline u32
69  ip4_header_t * ip0, icmp46_header_t * icmp0,
70  u32 sw_if_index0, u32 rx_fib_index0,
71  vlib_node_runtime_t * node, u32 next0, f64 now,
72  u32 thread_index, snat_session_t ** p_s0)
73 {
74  next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
75  next0, thread_index, p_s0, 0);
76  snat_session_t *s0 = *p_s0;
77  if (PREDICT_TRUE (next0 != NAT_NEXT_DROP && s0))
78  {
79  /* Accounting */
82  (sm->vlib_main, b0), thread_index);
83  /* Per-user LRU list maintenance */
84  nat44_session_update_lru (sm, s0, thread_index);
85  }
86  return next0;
87 }
88 
89 #ifndef CLIB_MARCH_VARIANT
90 int
92 {
93  snat_main_t *sm = &snat_main;
95  snat_session_t *s;
96  u64 sess_timeout_time;
97  nat_ed_ses_key_t ed_key;
99  int i;
100  snat_address_t *a;
103  ctx->thread_index);
104 
105  s = pool_elt_at_index (tsm->sessions, kv->value);
106  sess_timeout_time = s->last_heard + (f64) nat44_session_get_timeout (sm, s);
107  if (ctx->now >= sess_timeout_time)
108  {
109  ed_key.l_addr = s->in2out.addr;
110  ed_key.r_addr = s->ext_host_addr;
111  ed_key.fib_index = s->in2out.fib_index;
113  {
114  ed_key.proto = s->in2out.port;
115  ed_key.r_port = 0;
116  ed_key.l_port = 0;
117  }
118  else
119  {
120  ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
121  ed_key.l_port = s->in2out.port;
122  ed_key.r_port = s->ext_host_port;
123  }
124  if (is_twice_nat_session (s))
125  {
126  ed_key.r_addr = s->ext_host_nat_addr;
127  ed_key.r_port = s->ext_host_nat_port;
128  }
129  ed_kv.key[0] = ed_key.as_u64[0];
130  ed_kv.key[1] = ed_key.as_u64[1];
131  if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
132  nat_elog_warn ("in2out_ed key del failed");
133 
135  goto delete;
136 
138  s->in2out.addr.as_u32,
139  s->out2in.addr.as_u32,
140  s->in2out.protocol,
141  s->in2out.port,
142  s->out2in.port,
143  s->in2out.fib_index);
144 
145  nat_syslog_nat44_sdel (s->user_index, s->in2out.fib_index,
146  &s->in2out.addr, s->in2out.port,
147  &s->ext_host_nat_addr, s->ext_host_nat_port,
148  &s->out2in.addr, s->out2in.port,
149  &s->ext_host_addr, s->ext_host_port,
150  s->in2out.protocol, is_twice_nat_session (s));
151 
152  nat_ha_sdel (&s->out2in.addr, s->out2in.port, &s->ext_host_addr,
153  s->ext_host_port, s->out2in.protocol, s->out2in.fib_index,
154  ctx->thread_index);
155 
156  if (is_twice_nat_session (s))
157  {
158  for (i = 0; i < vec_len (sm->twice_nat_addresses); i++)
159  {
160  key.protocol = s->in2out.protocol;
161  key.port = s->ext_host_nat_port;
162  a = sm->twice_nat_addresses + i;
163  if (a->addr.as_u32 == s->ext_host_nat_addr.as_u32)
164  {
166  ctx->thread_index,
167  &key);
168  break;
169  }
170  }
171  }
172 
173  if (snat_is_session_static (s))
174  goto delete;
175 
177  &s->out2in);
178  delete:
179  nat44_delete_session (sm, s, ctx->thread_index);
180  return 1;
181  }
182 
183  return 0;
184 }
185 #endif
186 
187 static snat_session_t *
189  vlib_buffer_t * b,
190  snat_session_key_t l_key,
191  snat_session_key_t e_key,
193  u32 thread_index,
194  twice_nat_type_t twice_nat,
195  lb_nat_type_t lb_nat, f64 now)
196 {
197  snat_session_t *s;
198  snat_user_t *u;
199  ip4_header_t *ip;
200  udp_header_t *udp;
201  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
203  snat_session_key_t eh_key;
205 
206  nat44_session_try_cleanup (&l_key.addr, l_key.fib_index, thread_index, now);
207 
208  if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
209  {
210  b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
211  nat_elog_notice ("maximum sessions exceeded");
212  return 0;
213  }
214 
215  u = nat_user_get_or_create (sm, &l_key.addr, l_key.fib_index, thread_index);
216  if (!u)
217  {
218  nat_elog_warn ("create NAT user failed");
219  return 0;
220  }
221 
222  s = nat_ed_session_alloc (sm, u, thread_index, now);
223  if (!s)
224  {
225  nat44_delete_user_with_no_session (sm, u, thread_index);
226  nat_elog_warn ("create NAT session failed");
227  return 0;
228  }
229 
230  ip = vlib_buffer_get_current (b);
231  udp = ip4_next_header (ip);
232 
233  s->ext_host_addr.as_u32 = ip->src_address.as_u32;
234  s->ext_host_port = e_key.protocol == SNAT_PROTOCOL_ICMP ? 0 : udp->src_port;
236  if (lb_nat)
238  if (lb_nat == AFFINITY_LB_NAT)
239  s->flags |= SNAT_SESSION_FLAG_AFFINITY;
241  s->out2in = e_key;
242  s->in2out = l_key;
243  s->in2out.protocol = s->out2in.protocol;
244  user_session_increment (sm, u, 1);
245 
246  /* Add to lookup tables */
247  make_ed_kv (&kv, &e_key.addr, &s->ext_host_addr, ip->protocol,
248  e_key.fib_index, e_key.port, s->ext_host_port);
249  kv.value = s - tsm->sessions;
250  ctx.now = now;
251  ctx.thread_index = thread_index;
252  if (clib_bihash_add_or_overwrite_stale_16_8 (&tsm->out2in_ed, &kv,
254  &ctx))
255  nat_elog_notice ("out2in-ed key add failed");
256 
257  if (twice_nat == TWICE_NAT || (twice_nat == TWICE_NAT_SELF &&
258  ip->src_address.as_u32 == l_key.addr.as_u32))
259  {
260  eh_key.protocol = e_key.protocol;
262  thread_index, &eh_key,
263  sm->port_per_thread,
264  tsm->snat_thread_index))
265  {
266  b->error = node->errors[NAT_OUT2IN_ED_ERROR_OUT_OF_PORTS];
267  nat44_delete_session (sm, s, thread_index);
268  if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &kv, 0))
269  nat_elog_notice ("out2in-ed key del failed");
270  return 0;
271  }
272  s->ext_host_nat_addr.as_u32 = eh_key.addr.as_u32;
273  s->ext_host_nat_port = eh_key.port;
274  s->flags |= SNAT_SESSION_FLAG_TWICE_NAT;
275  make_ed_kv (&kv, &l_key.addr, &s->ext_host_nat_addr, ip->protocol,
276  l_key.fib_index, l_key.port, s->ext_host_nat_port);
277  }
278  else
279  {
280  make_ed_kv (&kv, &l_key.addr, &s->ext_host_addr, ip->protocol,
281  l_key.fib_index, l_key.port, s->ext_host_port);
282  }
283  kv.value = s - tsm->sessions;
284  if (clib_bihash_add_or_overwrite_stale_16_8 (&tsm->in2out_ed, &kv,
286  &ctx))
287  nat_elog_notice ("in2out-ed key add failed");
288 
290  s->in2out.addr.as_u32,
291  s->out2in.addr.as_u32,
292  s->in2out.protocol,
293  s->in2out.port,
294  s->out2in.port, s->in2out.fib_index);
295 
296  nat_syslog_nat44_sadd (s->user_index, s->in2out.fib_index,
297  &s->in2out.addr, s->in2out.port,
298  &s->ext_host_nat_addr, s->ext_host_nat_port,
299  &s->out2in.addr, s->out2in.port,
300  &s->ext_host_addr, s->ext_host_port,
301  s->in2out.protocol, is_twice_nat_session (s));
302 
303  nat_ha_sadd (&s->in2out.addr, s->in2out.port, &s->out2in.addr,
304  s->out2in.port, &s->ext_host_addr, s->ext_host_port,
305  &s->ext_host_nat_addr, s->ext_host_nat_port,
306  s->in2out.protocol, s->in2out.fib_index, s->flags,
307  thread_index, 0);
308 
309  return s;
310 }
311 
312 static int
314  u16 dst_port, u32 thread_index, u32 rx_fib_index)
315 {
317  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
318 
319  make_ed_kv (&kv, &ip->src_address, &ip->dst_address, proto,
320  rx_fib_index, src_port, dst_port);
321  if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &kv, &value))
322  return 1;
323 
324  return 0;
325 }
326 
327 static void
329  u32 rx_fib_index, u32 thread_index)
330 {
333  udp_header_t *udp;
334  snat_user_t *u;
335  snat_session_t *s = 0;
336  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
337  f64 now = vlib_time_now (sm->vlib_main);
338 
339  if (ip->protocol == IP_PROTOCOL_ICMP)
340  {
341  if (get_icmp_o2i_ed_key (b, ip, &key))
342  return;
343  }
344  else if (ip->protocol == IP_PROTOCOL_UDP || ip->protocol == IP_PROTOCOL_TCP)
345  {
346  udp = ip4_next_header (ip);
347  key.r_addr = ip->src_address;
348  key.l_addr = ip->dst_address;
349  key.proto = ip->protocol;
350  key.l_port = udp->dst_port;
351  key.r_port = udp->src_port;
352  }
353  else
354  {
355  key.r_addr = ip->src_address;
356  key.l_addr = ip->dst_address;
357  key.proto = ip->protocol;
358  key.l_port = key.r_port = 0;
359  }
360  key.fib_index = 0;
361  kv.key[0] = key.as_u64[0];
362  kv.key[1] = key.as_u64[1];
363 
364  if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &kv, &value))
365  {
366  s = pool_elt_at_index (tsm->sessions, value.value);
367  }
368  else
369  {
370  u32 proto;
371 
372  if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
373  return;
374 
376  thread_index);
377  if (!u)
378  {
379  nat_elog_warn ("create NAT user failed");
380  return;
381  }
382 
383  s = nat_ed_session_alloc (sm, u, thread_index, now);
384  if (!s)
385  {
386  nat44_delete_user_with_no_session (sm, u, thread_index);
387  nat_elog_warn ("create NAT session failed");
388  return;
389  }
390 
391  proto = ip_proto_to_snat_proto (key.proto);
392 
393  s->ext_host_addr = key.r_addr;
394  s->ext_host_port = key.r_port;
395  s->flags |= SNAT_SESSION_FLAG_FWD_BYPASS;
396  s->out2in.addr = key.l_addr;
397  s->out2in.port = key.l_port;
398  s->out2in.protocol = proto;
399  if (proto == ~0)
400  {
402  s->out2in.port = ip->protocol;
403  }
404  s->out2in.fib_index = 0;
405  s->in2out = s->out2in;
406  user_session_increment (sm, u, 0);
407 
408  kv.value = s - tsm->sessions;
409  if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &kv, 1))
410  nat_elog_notice ("in2out_ed key add failed");
411  }
412 
413  if (ip->protocol == IP_PROTOCOL_TCP)
414  {
415  tcp_header_t *tcp = ip4_next_header (ip);
417  (sm, s, tcp->flags, tcp->ack_number, tcp->seq_number, thread_index))
418  return;
419  }
420 
421  /* Accounting */
422  nat44_session_update_counters (s, now, 0, thread_index);
423  /* Per-user LRU list maintenance */
424  nat44_session_update_lru (sm, s, thread_index);
425 }
426 
427 static inline void
429  ip4_header_t * ip, u32 rx_fib_index)
430 {
431  ip4_header_t ip_wkr = {
432  .src_address = ip->dst_address,
433  };
434  u32 thread_index = sm->worker_in2out_cb (&ip_wkr, rx_fib_index, 0);
435 
436  create_bypass_for_fwd (sm, b, ip, rx_fib_index, thread_index);
437 }
438 
439 #ifndef CLIB_MARCH_VARIANT
440 u32
442  u32 thread_index, vlib_buffer_t * b, ip4_header_t * ip,
443  u8 * p_proto, snat_session_key_t * p_value,
444  u8 * p_dont_translate, void *d, void *e)
445 {
446  u32 next = ~0, sw_if_index, rx_fib_index;
449  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
450  snat_session_t *s = 0;
451  u8 dont_translate = 0, is_addr_only, identity_nat;
452  snat_session_key_t e_key, l_key;
453 
454  sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_RX];
456 
457  if (get_icmp_o2i_ed_key (b, ip, &key))
458  {
459  b->error = node->errors[NAT_OUT2IN_ED_ERROR_UNSUPPORTED_PROTOCOL];
460  next = NAT_NEXT_DROP;
461  goto out;
462  }
463  key.fib_index = rx_fib_index;
464  kv.key[0] = key.as_u64[0];
465  kv.key[1] = key.as_u64[1];
466 
467  if (clib_bihash_search_16_8 (&tsm->out2in_ed, &kv, &value))
468  {
469  /* Try to match static mapping */
470  e_key.addr = ip->dst_address;
471  e_key.port = key.l_port;
472  e_key.protocol = ip_proto_to_snat_proto (key.proto);
473  e_key.fib_index = rx_fib_index;
475  (sm, e_key, &l_key, 1, &is_addr_only, 0, 0, 0, &identity_nat))
476  {
477  if (!sm->forwarding_enabled)
478  {
479  /* Don't NAT packet aimed at the intfc address */
481  ip->dst_address.as_u32)))
482  {
483  dont_translate = 1;
484  goto out;
485  }
486  b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
487  next = NAT_NEXT_DROP;
488  goto out;
489  }
490  else
491  {
492  dont_translate = 1;
493  if (next_src_nat (sm, ip, key.proto, key.l_port, key.r_port,
494  thread_index, rx_fib_index))
495  {
497  goto out;
498  }
499  if (sm->num_workers > 1)
500  create_bypass_for_fwd_worker (sm, b, ip, rx_fib_index);
501  else
502  create_bypass_for_fwd (sm, b, ip, rx_fib_index, thread_index);
503  goto out;
504  }
505  }
506 
507  if (PREDICT_FALSE
508  (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
509  ICMP4_echo_reply
510  && (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
511  ICMP4_echo_request || !is_addr_only)))
512  {
513  b->error = node->errors[NAT_OUT2IN_ED_ERROR_BAD_ICMP_TYPE];
514  next = NAT_NEXT_DROP;
515  goto out;
516  }
517 
518  if (PREDICT_FALSE (identity_nat))
519  {
520  dont_translate = 1;
521  goto out;
522  }
523 
524  /* Create session initiated by host from external network */
525  s = create_session_for_static_mapping_ed (sm, b, l_key, e_key, node,
526  thread_index, 0, 0,
528  (sm->vlib_main));
529 
530  if (!s)
531  {
532  next = NAT_NEXT_DROP;
533  goto out;
534  }
535  }
536  else
537  {
538  if (PREDICT_FALSE
539  (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
540  ICMP4_echo_reply
541  && vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
542  ICMP4_echo_request
544  reass.icmp_type_or_tcp_flags)))
545  {
546  b->error = node->errors[NAT_OUT2IN_ED_ERROR_BAD_ICMP_TYPE];
547  next = NAT_NEXT_DROP;
548  goto out;
549  }
550 
551  s = pool_elt_at_index (tsm->sessions, value.value);
552  }
553 
554  *p_proto = ip_proto_to_snat_proto (key.proto);
555 out:
556  if (s)
557  *p_value = s->in2out;
558  *p_dont_translate = dont_translate;
559  if (d)
560  *(snat_session_t **) d = s;
561  return next;
562 }
563 #endif
564 
565 static snat_session_t *
567  vlib_buffer_t * b,
568  ip4_header_t * ip,
569  u32 rx_fib_index,
570  u32 thread_index,
571  f64 now,
573 {
575  clib_bihash_kv_16_8_t s_kv, s_value;
577  u32 old_addr, new_addr;
578  ip_csum_t sum;
579  snat_session_t *s;
580  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
581  snat_user_t *u;
582 
583  old_addr = ip->dst_address.as_u32;
584 
585  make_ed_kv (&s_kv, &ip->dst_address, &ip->src_address, ip->protocol,
586  rx_fib_index, 0, 0);
587 
588  if (!clib_bihash_search_16_8 (&tsm->out2in_ed, &s_kv, &s_value))
589  {
590  s = pool_elt_at_index (tsm->sessions, s_value.value);
591  new_addr = ip->dst_address.as_u32 = s->in2out.addr.as_u32;
592  }
593  else
594  {
595  if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
596  {
597  b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
598  nat_elog_notice ("maximum sessions exceeded");
599  return 0;
600  }
601 
602  make_sm_kv (&kv, &ip->dst_address, 0, 0, 0);
603  if (clib_bihash_search_8_8
604  (&sm->static_mapping_by_external, &kv, &value))
605  {
606  b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
607  return 0;
608  }
609 
610  m = pool_elt_at_index (sm->static_mappings, value.value);
611 
612  new_addr = ip->dst_address.as_u32 = m->local_addr.as_u32;
613 
615  thread_index);
616  if (!u)
617  {
618  nat_elog_warn ("create NAT user failed");
619  return 0;
620  }
621 
622  /* Create a new session */
623  s = nat_ed_session_alloc (sm, u, thread_index, now);
624  if (!s)
625  {
626  nat44_delete_user_with_no_session (sm, u, thread_index);
627  nat_elog_warn ("create NAT session failed");
628  return 0;
629  }
630 
631  s->ext_host_addr.as_u32 = ip->src_address.as_u32;
635  s->out2in.addr.as_u32 = old_addr;
636  s->out2in.fib_index = rx_fib_index;
637  s->in2out.addr.as_u32 = new_addr;
638  s->in2out.fib_index = m->fib_index;
639  s->in2out.port = s->out2in.port = ip->protocol;
640  user_session_increment (sm, u, 1);
641 
642  /* Add to lookup tables */
643  s_kv.value = s - tsm->sessions;
644  if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &s_kv, 1))
645  nat_elog_notice ("out2in key add failed");
646 
647  make_ed_kv (&s_kv, &ip->dst_address, &ip->src_address, ip->protocol,
648  m->fib_index, 0, 0);
649  s_kv.value = s - tsm->sessions;
650  if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &s_kv, 1))
651  nat_elog_notice ("in2out key add failed");
652  }
653 
654  /* Update IP checksum */
655  sum = ip->checksum;
656  sum = ip_csum_update (sum, old_addr, new_addr, ip4_header_t, dst_address);
657  ip->checksum = ip_csum_fold (sum);
658 
659  vnet_buffer (b)->sw_if_index[VLIB_TX] = s->in2out.fib_index;
660 
661  /* Accounting */
663  thread_index);
664  /* Per-user LRU list maintenance */
665  nat44_session_update_lru (sm, s, thread_index);
666 
667  return s;
668 }
669 
670 static inline uword
673  vlib_frame_t * frame, int is_slow_path)
674 {
675  u32 n_left_from, *from, *to_next, pkts_processed = 0, stats_node_index;
676  nat_next_t next_index;
677  snat_main_t *sm = &snat_main;
678  f64 now = vlib_time_now (vm);
679  u32 thread_index = vm->thread_index;
680  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
681  u32 tcp_packets = 0, udp_packets = 0, icmp_packets = 0, other_packets =
682  0, fragments = 0;
683 
684  stats_node_index = is_slow_path ? sm->ed_out2in_slowpath_node_index :
686 
687  from = vlib_frame_vector_args (frame);
688  n_left_from = frame->n_vectors;
689  next_index = node->cached_next_index;
690 
691  while (n_left_from > 0)
692  {
693  u32 n_left_to_next;
694 
695  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
696 
697  while (n_left_from >= 4 && n_left_to_next >= 2)
698  {
699  u32 bi0, bi1;
700  vlib_buffer_t *b0, *b1;
701  u32 next0, sw_if_index0, rx_fib_index0, proto0, old_addr0,
702  new_addr0;
703  u32 next1, sw_if_index1, rx_fib_index1, proto1, old_addr1,
704  new_addr1;
705  u16 old_port0, new_port0, old_port1, new_port1;
706  ip4_header_t *ip0, *ip1;
707  udp_header_t *udp0, *udp1;
708  tcp_header_t *tcp0, *tcp1;
709  icmp46_header_t *icmp0, *icmp1;
710  snat_session_t *s0 = 0, *s1 = 0;
711  clib_bihash_kv_16_8_t kv0, value0, kv1, value1;
712  ip_csum_t sum0, sum1;
713  snat_session_key_t e_key0, l_key0, e_key1, l_key1;
714  lb_nat_type_t lb_nat0, lb_nat1;
715  twice_nat_type_t twice_nat0, twice_nat1;
716  u8 identity_nat0, identity_nat1;
717 
718  /* Prefetch next iteration. */
719  {
720  vlib_buffer_t *p2, *p3;
721 
722  p2 = vlib_get_buffer (vm, from[2]);
723  p3 = vlib_get_buffer (vm, from[3]);
724 
725  vlib_prefetch_buffer_header (p2, LOAD);
726  vlib_prefetch_buffer_header (p3, LOAD);
727 
730  }
731 
732  /* speculatively enqueue b0 and b1 to the current next frame */
733  to_next[0] = bi0 = from[0];
734  to_next[1] = bi1 = from[1];
735  from += 2;
736  to_next += 2;
737  n_left_from -= 2;
738  n_left_to_next -= 2;
739 
740  b0 = vlib_get_buffer (vm, bi0);
741  b1 = vlib_get_buffer (vm, bi1);
742 
743  next0 = nat_buffer_opaque (b0)->arc_next;
744  next1 = nat_buffer_opaque (b1)->arc_next;
745 
746  vnet_buffer (b0)->snat.flags = 0;
747  ip0 = vlib_buffer_get_current (b0);
748 
749  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
750  rx_fib_index0 =
752  sw_if_index0);
753 
754  if (PREDICT_FALSE (ip0->ttl == 1))
755  {
756  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
757  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
758  ICMP4_time_exceeded_ttl_exceeded_in_transit,
759  0);
760  next0 = NAT_NEXT_ICMP_ERROR;
761  goto trace00;
762  }
763 
764  udp0 = ip4_next_header (ip0);
765  tcp0 = (tcp_header_t *) udp0;
766  icmp0 = (icmp46_header_t *) udp0;
767  proto0 = ip_proto_to_snat_proto (ip0->protocol);
768 
769  if (is_slow_path)
770  {
771  if (PREDICT_FALSE (proto0 == ~0))
772  {
773  s0 =
774  nat44_ed_out2in_unknown_proto (sm, b0, ip0, rx_fib_index0,
775  thread_index, now, vm,
776  node);
777  other_packets++;
778  if (!sm->forwarding_enabled)
779  {
780  if (!s0)
781  next0 = NAT_NEXT_DROP;
782  goto trace00;
783  }
784  }
785 
786  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
787  {
789  (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
790  next0, now, thread_index, &s0);
791  icmp_packets++;
792  goto trace00;
793  }
794  }
795  else
796  {
797  if (PREDICT_FALSE (proto0 == ~0))
798  {
800  goto trace00;
801  }
802 
803  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
804  {
806  goto trace00;
807  }
808  }
809 
810  make_ed_kv (&kv0, &ip0->dst_address, &ip0->src_address,
811  ip0->protocol, rx_fib_index0,
812  vnet_buffer (b0)->ip.reass.l4_dst_port,
813  vnet_buffer (b0)->ip.reass.l4_src_port);
814 
815  if (clib_bihash_search_16_8 (&tsm->out2in_ed, &kv0, &value0))
816  {
817  if (is_slow_path)
818  {
819  /* Try to match static mapping by external address and port,
820  destination address and port in packet */
821  e_key0.addr = ip0->dst_address;
822  e_key0.port = vnet_buffer (b0)->ip.reass.l4_dst_port;
823  e_key0.protocol = proto0;
824  e_key0.fib_index = rx_fib_index0;
825  if (snat_static_mapping_match (sm, e_key0, &l_key0, 1, 0,
826  &twice_nat0, &lb_nat0,
827  &ip0->src_address,
828  &identity_nat0))
829  {
830  /*
831  * Send DHCP packets to the ipv4 stack, or we won't
832  * be able to use dhcp client on the outside interface
833  */
834  if (PREDICT_FALSE
835  (proto0 == SNAT_PROTOCOL_UDP
836  && (vnet_buffer (b0)->ip.reass.l4_dst_port ==
837  clib_host_to_net_u16
838  (UDP_DST_PORT_dhcp_to_client))))
839  {
840  goto trace00;
841  }
842 
843  if (!sm->forwarding_enabled)
844  {
845  b0->error =
846  node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
847  next0 = NAT_NEXT_DROP;
848  }
849  else
850  {
851  if (next_src_nat
852  (sm, ip0, ip0->protocol,
853  vnet_buffer (b0)->ip.reass.l4_src_port,
854  vnet_buffer (b0)->ip.reass.l4_dst_port,
855  thread_index, rx_fib_index0))
856  {
858  goto trace00;
859  }
860  if (sm->num_workers > 1)
861  create_bypass_for_fwd_worker (sm, b0, ip0,
862  rx_fib_index0);
863  else
864  create_bypass_for_fwd (sm, b0, ip0, rx_fib_index0,
865  thread_index);
866  }
867  goto trace00;
868  }
869 
870  if (PREDICT_FALSE (identity_nat0))
871  goto trace00;
872 
873  if ((proto0 == SNAT_PROTOCOL_TCP)
874  && !tcp_flags_is_init (vnet_buffer (b0)->ip.
875  reass.icmp_type_or_tcp_flags))
876  {
877  b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
878  next0 = NAT_NEXT_DROP;
879  goto trace00;
880  }
881 
882  /* Create session initiated by host from external network */
883  s0 = create_session_for_static_mapping_ed (sm, b0, l_key0,
884  e_key0, node,
885  thread_index,
886  twice_nat0,
887  lb_nat0, now);
888 
889  if (!s0)
890  {
891  next0 = NAT_NEXT_DROP;
892  goto trace00;
893  }
894  }
895  else
896  {
898  goto trace00;
899  }
900  }
901  else
902  {
903  s0 = pool_elt_at_index (tsm->sessions, value0.value);
904  }
905 
906  old_addr0 = ip0->dst_address.as_u32;
907  new_addr0 = ip0->dst_address.as_u32 = s0->in2out.addr.as_u32;
908  vnet_buffer (b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index;
909 
910  sum0 = ip0->checksum;
911  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
912  dst_address);
914  sum0 = ip_csum_update (sum0, ip0->src_address.as_u32,
915  s0->ext_host_nat_addr.as_u32, ip4_header_t,
916  src_address);
917  ip0->checksum = ip_csum_fold (sum0);
918 
919  old_port0 = vnet_buffer (b0)->ip.reass.l4_dst_port;
920 
921  if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
922  {
923  if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
924  {
925  new_port0 = udp0->dst_port = s0->in2out.port;
926  sum0 = tcp0->checksum;
927  sum0 =
928  ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
929  dst_address);
930  sum0 =
931  ip_csum_update (sum0, old_port0, new_port0, ip4_header_t,
932  length);
933  if (is_twice_nat_session (s0))
934  {
935  sum0 = ip_csum_update (sum0, ip0->src_address.as_u32,
936  s0->ext_host_nat_addr.as_u32,
937  ip4_header_t, dst_address);
938  sum0 =
939  ip_csum_update (sum0,
940  vnet_buffer (b0)->ip.
941  reass.l4_src_port,
942  s0->ext_host_nat_port, ip4_header_t,
943  length);
944  tcp0->src_port = s0->ext_host_nat_port;
945  ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
946  }
947  tcp0->checksum = ip_csum_fold (sum0);
948  }
949  tcp_packets++;
951  (sm, s0, vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags,
952  vnet_buffer (b0)->ip.reass.tcp_ack_number,
953  vnet_buffer (b0)->ip.reass.tcp_seq_number, thread_index))
954  goto trace00;
955  }
956  else if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment
957  && udp0->checksum)
958  {
959  new_port0 = udp0->dst_port = s0->in2out.port;
960  sum0 = udp0->checksum;
961  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
962  dst_address);
963  sum0 = ip_csum_update (sum0, old_port0, new_port0, ip4_header_t,
964  length);
966  {
967  sum0 = ip_csum_update (sum0, ip0->src_address.as_u32,
968  s0->ext_host_nat_addr.as_u32,
969  ip4_header_t, dst_address);
970  sum0 =
971  ip_csum_update (sum0,
972  vnet_buffer (b0)->ip.reass.l4_src_port,
973  s0->ext_host_nat_port, ip4_header_t,
974  length);
975  udp0->src_port = s0->ext_host_nat_port;
976  ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
977  }
978  udp0->checksum = ip_csum_fold (sum0);
979  udp_packets++;
980  }
981  else
982  {
983  if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
984  {
985  new_port0 = udp0->dst_port = s0->in2out.port;
987  {
988  udp0->dst_port = s0->in2out.port;
989  if (is_twice_nat_session (s0))
990  {
991  udp0->src_port = s0->ext_host_nat_port;
992  ip0->src_address.as_u32 =
993  s0->ext_host_nat_addr.as_u32;
994  }
995  udp0->checksum = 0;
996  }
997  }
998  udp_packets++;
999  }
1000 
1001  /* Accounting */
1003  vlib_buffer_length_in_chain (vm, b0),
1004  thread_index);
1005  /* Per-user LRU list maintenance */
1006  nat44_session_update_lru (sm, s0, thread_index);
1007 
1008  trace00:
1010  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1011  {
1013  vlib_add_trace (vm, node, b0, sizeof (*t));
1014  t->is_slow_path = is_slow_path;
1015  t->sw_if_index = sw_if_index0;
1016  t->next_index = next0;
1017  t->session_index = ~0;
1018  if (s0)
1019  t->session_index = s0 - tsm->sessions;
1020  }
1021 
1022  pkts_processed += next0 == nat_buffer_opaque (b0)->arc_next;
1023 
1024  vnet_buffer (b1)->snat.flags = 0;
1025  ip1 = vlib_buffer_get_current (b1);
1026 
1027  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
1028  rx_fib_index1 =
1030  sw_if_index1);
1031 
1032  if (PREDICT_FALSE (ip1->ttl == 1))
1033  {
1034  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
1035  icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
1036  ICMP4_time_exceeded_ttl_exceeded_in_transit,
1037  0);
1038  next1 = NAT_NEXT_ICMP_ERROR;
1039  goto trace01;
1040  }
1041 
1042  udp1 = ip4_next_header (ip1);
1043  tcp1 = (tcp_header_t *) udp1;
1044  icmp1 = (icmp46_header_t *) udp1;
1045  proto1 = ip_proto_to_snat_proto (ip1->protocol);
1046 
1047  if (is_slow_path)
1048  {
1049  if (PREDICT_FALSE (proto1 == ~0))
1050  {
1051  s1 =
1052  nat44_ed_out2in_unknown_proto (sm, b1, ip1, rx_fib_index1,
1053  thread_index, now, vm,
1054  node);
1055  other_packets++;
1056  if (!sm->forwarding_enabled)
1057  {
1058  if (!s1)
1059  next1 = NAT_NEXT_DROP;
1060  goto trace01;
1061  }
1062  }
1063 
1064  if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
1065  {
1066  next1 = icmp_out2in_ed_slow_path
1067  (sm, b1, ip1, icmp1, sw_if_index1, rx_fib_index1, node,
1068  next1, now, thread_index, &s1);
1069  icmp_packets++;
1070  goto trace01;
1071  }
1072  }
1073  else
1074  {
1075  if (PREDICT_FALSE (proto1 == ~0))
1076  {
1078  goto trace01;
1079  }
1080 
1081  if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
1082  {
1084  goto trace01;
1085  }
1086  }
1087 
1088  make_ed_kv (&kv1, &ip1->dst_address, &ip1->src_address,
1089  ip1->protocol, rx_fib_index1,
1090  vnet_buffer (b1)->ip.reass.l4_dst_port,
1091  vnet_buffer (b1)->ip.reass.l4_src_port);
1092 
1093  if (clib_bihash_search_16_8 (&tsm->out2in_ed, &kv1, &value1))
1094  {
1095  if (is_slow_path)
1096  {
1097  /* Try to match static mapping by external address and port,
1098  destination address and port in packet */
1099  e_key1.addr = ip1->dst_address;
1100  e_key1.port = vnet_buffer (b1)->ip.reass.l4_dst_port;
1101  e_key1.protocol = proto1;
1102  e_key1.fib_index = rx_fib_index1;
1103  if (snat_static_mapping_match (sm, e_key1, &l_key1, 1, 0,
1104  &twice_nat1, &lb_nat1,
1105  &ip1->src_address,
1106  &identity_nat1))
1107  {
1108  /*
1109  * Send DHCP packets to the ipv4 stack, or we won't
1110  * be able to use dhcp client on the outside interface
1111  */
1112  if (PREDICT_FALSE
1113  (proto1 == SNAT_PROTOCOL_UDP
1114  && (vnet_buffer (b1)->ip.reass.l4_dst_port ==
1115  clib_host_to_net_u16
1116  (UDP_DST_PORT_dhcp_to_client))))
1117  {
1118  goto trace01;
1119  }
1120 
1121  if (!sm->forwarding_enabled)
1122  {
1123  b1->error =
1124  node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
1125  next1 = NAT_NEXT_DROP;
1126  }
1127  else
1128  {
1129  if (next_src_nat
1130  (sm, ip1, ip1->protocol,
1131  vnet_buffer (b1)->ip.reass.l4_src_port,
1132  vnet_buffer (b1)->ip.reass.l4_dst_port,
1133  thread_index, rx_fib_index1))
1134  {
1136  goto trace01;
1137  }
1138  if (sm->num_workers > 1)
1139  create_bypass_for_fwd_worker (sm, b1, ip1,
1140  rx_fib_index1);
1141  else
1142  create_bypass_for_fwd (sm, b1, ip1, rx_fib_index1,
1143  thread_index);
1144  }
1145  goto trace01;
1146  }
1147 
1148  if (PREDICT_FALSE (identity_nat1))
1149  goto trace01;
1150 
1151  if ((proto1 == SNAT_PROTOCOL_TCP)
1152  && !tcp_flags_is_init (vnet_buffer (b1)->ip.
1153  reass.icmp_type_or_tcp_flags))
1154  {
1155  b1->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
1156  next1 = NAT_NEXT_DROP;
1157  goto trace01;
1158  }
1159 
1160  /* Create session initiated by host from external network */
1161  s1 = create_session_for_static_mapping_ed (sm, b1, l_key1,
1162  e_key1, node,
1163  thread_index,
1164  twice_nat1,
1165  lb_nat1, now);
1166 
1167  if (!s1)
1168  {
1169  next1 = NAT_NEXT_DROP;
1170  goto trace01;
1171  }
1172  }
1173  else
1174  {
1176  goto trace01;
1177  }
1178  }
1179  else
1180  {
1181  s1 = pool_elt_at_index (tsm->sessions, value1.value);
1182  }
1183 
1184  old_addr1 = ip1->dst_address.as_u32;
1185  new_addr1 = ip1->dst_address.as_u32 = s1->in2out.addr.as_u32;
1186  vnet_buffer (b1)->sw_if_index[VLIB_TX] = s1->in2out.fib_index;
1187 
1188  sum1 = ip1->checksum;
1189  sum1 = ip_csum_update (sum1, old_addr1, new_addr1, ip4_header_t,
1190  dst_address);
1192  sum1 = ip_csum_update (sum1, ip1->src_address.as_u32,
1193  s1->ext_host_nat_addr.as_u32, ip4_header_t,
1194  src_address);
1195  ip1->checksum = ip_csum_fold (sum1);
1196 
1197  old_port1 = vnet_buffer (b1)->ip.reass.l4_dst_port;
1198 
1199  if (PREDICT_TRUE (proto1 == SNAT_PROTOCOL_TCP))
1200  {
1201  if (!vnet_buffer (b1)->ip.reass.is_non_first_fragment)
1202  {
1203  new_port1 = udp1->dst_port = s1->in2out.port;
1204 
1205  sum1 = tcp1->checksum;
1206  sum1 =
1207  ip_csum_update (sum1, old_addr1, new_addr1, ip4_header_t,
1208  dst_address);
1209  sum1 =
1210  ip_csum_update (sum1, old_port1, new_port1, ip4_header_t,
1211  length);
1212  if (is_twice_nat_session (s1))
1213  {
1214  sum1 = ip_csum_update (sum1, ip1->src_address.as_u32,
1215  s1->ext_host_nat_addr.as_u32,
1216  ip4_header_t, dst_address);
1217  sum1 =
1218  ip_csum_update (sum1,
1219  vnet_buffer (b1)->ip.
1220  reass.l4_src_port,
1221  s1->ext_host_nat_port, ip4_header_t,
1222  length);
1223  tcp1->src_port = s1->ext_host_nat_port;
1224  ip1->src_address.as_u32 = s1->ext_host_nat_addr.as_u32;
1225  }
1226  tcp1->checksum = ip_csum_fold (sum1);
1227  }
1228  tcp_packets++;
1230  (sm, s1, vnet_buffer (b1)->ip.reass.icmp_type_or_tcp_flags,
1231  vnet_buffer (b1)->ip.reass.tcp_ack_number,
1232  vnet_buffer (b1)->ip.reass.tcp_seq_number, thread_index))
1233  goto trace01;
1234  }
1235  else if (!vnet_buffer (b1)->ip.reass.is_non_first_fragment
1236  && udp1->checksum)
1237  {
1238  new_port1 = udp1->dst_port = s1->in2out.port;
1239  sum1 = udp1->checksum;
1240  sum1 = ip_csum_update (sum1, old_addr1, new_addr1, ip4_header_t,
1241  dst_address);
1242  sum1 = ip_csum_update (sum1, old_port1, new_port1, ip4_header_t,
1243  length);
1245  {
1246  sum1 = ip_csum_update (sum1, ip1->src_address.as_u32,
1247  s1->ext_host_nat_addr.as_u32,
1248  ip4_header_t, dst_address);
1249  sum1 =
1250  ip_csum_update (sum1,
1251  vnet_buffer (b1)->ip.reass.l4_src_port,
1252  s1->ext_host_nat_port, ip4_header_t,
1253  length);
1254  udp1->src_port = s1->ext_host_nat_port;
1255  ip1->src_address.as_u32 = s1->ext_host_nat_addr.as_u32;
1256  }
1257  udp1->checksum = ip_csum_fold (sum1);
1258  udp_packets++;
1259  }
1260  else
1261  {
1262  if (!vnet_buffer (b1)->ip.reass.is_non_first_fragment)
1263  {
1265  {
1266  udp1->dst_port = s1->in2out.port;
1267  if (is_twice_nat_session (s1))
1268  {
1269  udp1->src_port = s1->ext_host_nat_port;
1270  ip1->src_address.as_u32 =
1271  s1->ext_host_nat_addr.as_u32;
1272  }
1273  udp1->checksum = 0;
1274  }
1275  }
1276  udp_packets++;
1277  }
1278 
1279  /* Accounting */
1281  vlib_buffer_length_in_chain (vm, b1),
1282  thread_index);
1283  /* Per-user LRU list maintenance */
1284  nat44_session_update_lru (sm, s1, thread_index);
1285 
1286  trace01:
1288  && (b1->flags & VLIB_BUFFER_IS_TRACED)))
1289  {
1291  vlib_add_trace (vm, node, b1, sizeof (*t));
1292  t->is_slow_path = is_slow_path;
1293  t->sw_if_index = sw_if_index1;
1294  t->next_index = next1;
1295  t->session_index = ~0;
1296  if (s1)
1297  t->session_index = s1 - tsm->sessions;
1298  }
1299 
1300  pkts_processed += next1 == nat_buffer_opaque (b1)->arc_next;
1301 
1302  /* verify speculative enqueues, maybe switch current next frame */
1303  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
1304  to_next, n_left_to_next,
1305  bi0, bi1, next0, next1);
1306  }
1307 
1308  while (n_left_from > 0 && n_left_to_next > 0)
1309  {
1310  u32 bi0;
1311  vlib_buffer_t *b0;
1312  u32 next0, sw_if_index0, rx_fib_index0, proto0, old_addr0,
1313  new_addr0;
1314  u16 old_port0, new_port0;
1315  ip4_header_t *ip0;
1316  udp_header_t *udp0;
1317  tcp_header_t *tcp0;
1318  icmp46_header_t *icmp0;
1319  snat_session_t *s0 = 0;
1320  clib_bihash_kv_16_8_t kv0, value0;
1321  ip_csum_t sum0;
1322  snat_session_key_t e_key0, l_key0;
1323  lb_nat_type_t lb_nat0;
1324  twice_nat_type_t twice_nat0;
1325  u8 identity_nat0;
1326 
1327  /* speculatively enqueue b0 to the current next frame */
1328  bi0 = from[0];
1329  to_next[0] = bi0;
1330  from += 1;
1331  to_next += 1;
1332  n_left_from -= 1;
1333  n_left_to_next -= 1;
1334 
1335  b0 = vlib_get_buffer (vm, bi0);
1336  next0 = nat_buffer_opaque (b0)->arc_next;
1337 
1338  vnet_buffer (b0)->snat.flags = 0;
1339  ip0 = vlib_buffer_get_current (b0);
1340 
1341  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
1342  rx_fib_index0 =
1344  sw_if_index0);
1345 
1346  if (PREDICT_FALSE (ip0->ttl == 1))
1347  {
1348  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
1349  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
1350  ICMP4_time_exceeded_ttl_exceeded_in_transit,
1351  0);
1352  next0 = NAT_NEXT_ICMP_ERROR;
1353  goto trace0;
1354  }
1355 
1356  udp0 = ip4_next_header (ip0);
1357  tcp0 = (tcp_header_t *) udp0;
1358  icmp0 = (icmp46_header_t *) udp0;
1359  proto0 = ip_proto_to_snat_proto (ip0->protocol);
1360 
1361  if (is_slow_path)
1362  {
1363  if (PREDICT_FALSE (proto0 == ~0))
1364  {
1365  s0 =
1366  nat44_ed_out2in_unknown_proto (sm, b0, ip0, rx_fib_index0,
1367  thread_index, now, vm,
1368  node);
1369  other_packets++;
1370  if (!sm->forwarding_enabled)
1371  {
1372  if (!s0)
1373  next0 = NAT_NEXT_DROP;
1374  goto trace0;
1375  }
1376  }
1377 
1378  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
1379  {
1380  next0 = icmp_out2in_ed_slow_path
1381  (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
1382  next0, now, thread_index, &s0);
1383  icmp_packets++;
1384  goto trace0;
1385  }
1386  }
1387  else
1388  {
1389  if (PREDICT_FALSE (proto0 == ~0))
1390  {
1392  goto trace0;
1393  }
1394 
1395  if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
1396  {
1398  goto trace0;
1399  }
1400  }
1401 
1402  make_ed_kv (&kv0, &ip0->dst_address, &ip0->src_address,
1403  ip0->protocol, rx_fib_index0,
1404  vnet_buffer (b0)->ip.reass.l4_dst_port,
1405  vnet_buffer (b0)->ip.reass.l4_src_port);
1406 
1407  if (clib_bihash_search_16_8 (&tsm->out2in_ed, &kv0, &value0))
1408  {
1409  if (is_slow_path)
1410  {
1411  /* Try to match static mapping by external address and port,
1412  destination address and port in packet */
1413  e_key0.addr = ip0->dst_address;
1414  e_key0.port = vnet_buffer (b0)->ip.reass.l4_dst_port;
1415  e_key0.protocol = proto0;
1416  e_key0.fib_index = rx_fib_index0;
1417  if (snat_static_mapping_match (sm, e_key0, &l_key0, 1, 0,
1418  &twice_nat0, &lb_nat0,
1419  &ip0->src_address,
1420  &identity_nat0))
1421  {
1422  /*
1423  * Send DHCP packets to the ipv4 stack, or we won't
1424  * be able to use dhcp client on the outside interface
1425  */
1426  if (PREDICT_FALSE
1427  (proto0 == SNAT_PROTOCOL_UDP
1428  && (vnet_buffer (b0)->ip.reass.l4_dst_port ==
1429  clib_host_to_net_u16
1430  (UDP_DST_PORT_dhcp_to_client))))
1431  {
1432  goto trace0;
1433  }
1434 
1435  if (!sm->forwarding_enabled)
1436  {
1437  b0->error =
1438  node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
1439  next0 = NAT_NEXT_DROP;
1440  }
1441  else
1442  {
1443  if (next_src_nat
1444  (sm, ip0, ip0->protocol,
1445  vnet_buffer (b0)->ip.reass.l4_src_port,
1446  vnet_buffer (b0)->ip.reass.l4_dst_port,
1447  thread_index, rx_fib_index0))
1448  {
1450  goto trace0;
1451  }
1452  if (sm->num_workers > 1)
1453  create_bypass_for_fwd_worker (sm, b0, ip0,
1454  rx_fib_index0);
1455  else
1456  create_bypass_for_fwd (sm, b0, ip0, rx_fib_index0,
1457  thread_index);
1458  }
1459  goto trace0;
1460  }
1461 
1462  if (PREDICT_FALSE (identity_nat0))
1463  goto trace0;
1464 
1465  if ((proto0 == SNAT_PROTOCOL_TCP)
1466  && !tcp_flags_is_init (vnet_buffer (b0)->ip.
1467  reass.icmp_type_or_tcp_flags))
1468  {
1469  b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
1470  next0 = NAT_NEXT_DROP;
1471  goto trace0;
1472  }
1473 
1474  /* Create session initiated by host from external network */
1475  s0 = create_session_for_static_mapping_ed (sm, b0, l_key0,
1476  e_key0, node,
1477  thread_index,
1478  twice_nat0,
1479  lb_nat0, now);
1480 
1481  if (!s0)
1482  {
1483  next0 = NAT_NEXT_DROP;
1484  goto trace0;
1485  }
1486  }
1487  else
1488  {
1490  goto trace0;
1491  }
1492  }
1493  else
1494  {
1495  s0 = pool_elt_at_index (tsm->sessions, value0.value);
1496  }
1497 
1498  old_addr0 = ip0->dst_address.as_u32;
1499  new_addr0 = ip0->dst_address.as_u32 = s0->in2out.addr.as_u32;
1500  vnet_buffer (b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index;
1501 
1502  sum0 = ip0->checksum;
1503  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
1504  dst_address);
1506  sum0 = ip_csum_update (sum0, ip0->src_address.as_u32,
1507  s0->ext_host_nat_addr.as_u32, ip4_header_t,
1508  src_address);
1509  ip0->checksum = ip_csum_fold (sum0);
1510 
1511  old_port0 = vnet_buffer (b0)->ip.reass.l4_dst_port;
1512 
1513  if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
1514  {
1515  if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
1516  {
1517  new_port0 = udp0->dst_port = s0->in2out.port;
1518  sum0 = tcp0->checksum;
1519  sum0 =
1520  ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
1521  dst_address);
1522  sum0 =
1523  ip_csum_update (sum0, old_port0, new_port0, ip4_header_t,
1524  length);
1525  if (is_twice_nat_session (s0))
1526  {
1527  sum0 = ip_csum_update (sum0, ip0->src_address.as_u32,
1528  s0->ext_host_nat_addr.as_u32,
1529  ip4_header_t, dst_address);
1530  sum0 =
1531  ip_csum_update (sum0,
1532  vnet_buffer (b0)->ip.
1533  reass.l4_src_port,
1534  s0->ext_host_nat_port, ip4_header_t,
1535  length);
1536  tcp0->src_port = s0->ext_host_nat_port;
1537  ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
1538  }
1539  tcp0->checksum = ip_csum_fold (sum0);
1540  }
1541  tcp_packets++;
1543  (sm, s0, vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags,
1544  vnet_buffer (b0)->ip.reass.tcp_ack_number,
1545  vnet_buffer (b0)->ip.reass.tcp_seq_number, thread_index))
1546  goto trace0;
1547  }
1548  else if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment
1549  && udp0->checksum)
1550  {
1551  new_port0 = udp0->dst_port = s0->in2out.port;
1552  sum0 = udp0->checksum;
1553  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
1554  dst_address);
1555  sum0 = ip_csum_update (sum0, old_port0, new_port0, ip4_header_t,
1556  length);
1558  {
1559  sum0 = ip_csum_update (sum0, ip0->src_address.as_u32,
1560  s0->ext_host_nat_addr.as_u32,
1561  ip4_header_t, dst_address);
1562  sum0 =
1563  ip_csum_update (sum0,
1564  vnet_buffer (b0)->ip.reass.l4_src_port,
1565  s0->ext_host_nat_port, ip4_header_t,
1566  length);
1567  udp0->src_port = s0->ext_host_nat_port;
1568  ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
1569  }
1570  udp0->checksum = ip_csum_fold (sum0);
1571  udp_packets++;
1572  }
1573  else
1574  {
1575  if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
1576  {
1577  new_port0 = udp0->dst_port = s0->in2out.port;
1579  {
1580  udp0->src_port = s0->ext_host_nat_port;
1581  ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
1582  }
1583  }
1584  udp_packets++;
1585  }
1586 
1587  /* Accounting */
1589  vlib_buffer_length_in_chain (vm, b0),
1590  thread_index);
1591  /* Per-user LRU list maintenance */
1592  nat44_session_update_lru (sm, s0, thread_index);
1593 
1594  trace0:
1596  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1597  {
1599  vlib_add_trace (vm, node, b0, sizeof (*t));
1600  t->is_slow_path = is_slow_path;
1601  t->sw_if_index = sw_if_index0;
1602  t->next_index = next0;
1603  t->session_index = ~0;
1604  if (s0)
1605  t->session_index = s0 - tsm->sessions;
1606  }
1607 
1608  pkts_processed += next0 == nat_buffer_opaque (b0)->arc_next;
1609  /* verify speculative enqueue, maybe switch current next frame */
1610  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
1611  to_next, n_left_to_next,
1612  bi0, next0);
1613  }
1614 
1615  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
1616  }
1617 
1618  vlib_node_increment_counter (vm, stats_node_index,
1619  NAT_OUT2IN_ED_ERROR_OUT2IN_PACKETS,
1620  pkts_processed);
1621  vlib_node_increment_counter (vm, stats_node_index,
1622  NAT_OUT2IN_ED_ERROR_TCP_PACKETS, tcp_packets);
1623  vlib_node_increment_counter (vm, stats_node_index,
1624  NAT_OUT2IN_ED_ERROR_UDP_PACKETS, udp_packets);
1625  vlib_node_increment_counter (vm, stats_node_index,
1626  NAT_OUT2IN_ED_ERROR_ICMP_PACKETS,
1627  icmp_packets);
1628  vlib_node_increment_counter (vm, stats_node_index,
1629  NAT_OUT2IN_ED_ERROR_OTHER_PACKETS,
1630  other_packets);
1631  vlib_node_increment_counter (vm, stats_node_index,
1632  NAT_OUT2IN_ED_ERROR_FRAGMENTS, fragments);
1633  return frame->n_vectors;
1634 }
1635 
1638  vlib_frame_t * frame)
1639 {
1640  return nat44_ed_out2in_node_fn_inline (vm, node, frame, 0);
1641 }
1642 
1643 /* *INDENT-OFF* */
1645  .name = "nat44-ed-out2in",
1646  .vector_size = sizeof (u32),
1647  .sibling_of = "nat-default",
1648  .format_trace = format_nat44_ed_out2in_trace,
1651  .error_strings = nat_out2in_ed_error_strings,
1652  .runtime_data_bytes = sizeof (snat_runtime_t),
1653 };
1654 /* *INDENT-ON* */
1655 
1658  vlib_frame_t * frame)
1659 {
1660  return nat44_ed_out2in_node_fn_inline (vm, node, frame, 1);
1661 }
1662 
1663 /* *INDENT-OFF* */
1665  .name = "nat44-ed-out2in-slowpath",
1666  .vector_size = sizeof (u32),
1667  .sibling_of = "nat-default",
1668  .format_trace = format_nat44_ed_out2in_trace,
1671  .error_strings = nat_out2in_ed_error_strings,
1672  .runtime_data_bytes = sizeof (snat_runtime_t),
1673 };
1674 /* *INDENT-ON* */
1675 
1676 static u8 *
1677 format_nat_pre_trace (u8 * s, va_list * args)
1678 {
1679  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1680  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1681  nat_pre_trace_t *t = va_arg (*args, nat_pre_trace_t *);
1682  return format (s, "out2in next_index %d", t->next_index);
1683 }
1684 
1687  vlib_frame_t * frame)
1688 {
1689  return nat_pre_node_fn_inline (vm, node, frame,
1691 }
1692 
1693 /* *INDENT-OFF* */
1695  .name = "nat-pre-out2in",
1696  .vector_size = sizeof (u32),
1697  .sibling_of = "nat-default",
1698  .format_trace = format_nat_pre_trace,
1700  .n_errors = 0,
1701  };
1702 /* *INDENT-ON* */
1703 
1704 /*
1705  * fd.io coding-style-patch-verification: ON
1706  *
1707  * Local Variables:
1708  * eval: (c-set-style "gnu")
1709  * End:
1710  */
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
#define nat_buffer_opaque(b)
Definition: nat.h:71
#define snat_is_session_static(s)
Check if SNAT session is created from static mapping.
Definition: nat.h:765
u8 proto
Definition: acl_types.api:47
#define CLIB_UNUSED(x)
Definition: clib.h:82
u32 icmp_out2in(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: out2in.c:526
static int next_src_nat(snat_main_t *sm, ip4_header_t *ip, u8 proto, u16 src_port, u16 dst_port, u32 thread_index, u32 rx_fib_index)
Definition: out2in_ed.c:313
a
Definition: bitmap.h:538
ip4_address_t src_address
Definition: ip4_packet.h:170
static u32 nat44_session_get_timeout(snat_main_t *sm, snat_session_t *s)
Definition: nat_inlines.h:394
u32 ed_out2in_node_index
Definition: nat.h:639
#define nat_elog_notice(nat_elog_str)
Definition: nat.h:1023
#define PREDICT_TRUE(x)
Definition: clib.h:112
unsigned long u64
Definition: types.h:89
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:279
u32 fib_table_get_index_for_sw_if_index(fib_protocol_t proto, u32 sw_if_index)
Get the index of the FIB bound to the interface.
Definition: fib_table.c:989
static void make_sm_kv(clib_bihash_kv_8_8_t *kv, ip4_address_t *addr, u8 proto, u32 fib_index, u16 port)
Definition: nat_inlines.h:458
u16 port_per_thread
Definition: nat.h:564
u32 thread_index
Definition: main.h:218
u8 data[0]
Packet data.
Definition: buffer.h:181
u32 ed_out2in_slowpath_node_index
Definition: nat.h:640
int i
void nat_syslog_nat44_sdel(u32 ssubix, u32 sfibix, ip4_address_t *isaddr, u16 isport, ip4_address_t *idaddr, u16 idport, ip4_address_t *xsaddr, u16 xsport, ip4_address_t *xdaddr, u16 xdport, snat_protocol_t proto, u8 is_twicenat)
Definition: nat_syslog.c:211
uword ip_csum_t
Definition: ip_packet.h:244
#define nat_elog_warn(nat_elog_str)
Definition: nat.h:1025
void nat_ha_sadd(ip4_address_t *in_addr, u16 in_port, ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, ip4_address_t *ehn_addr, u16 ehn_port, u8 proto, u32 fib_index, u16 flags, u32 thread_index, u8 is_resync)
Create session add HA event.
Definition: nat_ha.c:689
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
vlib_node_registration_t nat44_ed_out2in_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_out2in_node)
Definition: out2in_ed.c:1644
#define VLIB_NODE_FN(node)
Definition: node.h:202
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:470
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
Definition: buffer_funcs.h:366
struct _tcp_header tcp_header_t
#define snat_is_unk_proto_session(s)
Check if SNAT session for unknown protocol.
Definition: nat.h:771
unsigned char u8
Definition: types.h:56
u16 l_port
Definition: nat.h:108
double f64
Definition: types.h:142
u32 next_index
Definition: nat.h:68
u16 src_port
Definition: udp.api:41
static u32 icmp_out2in_ed_slow_path(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, f64 now, u32 thread_index, snat_session_t **p_s0)
Definition: out2in_ed.c:68
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
Definition: ip4_fib.c:230
static char * nat_out2in_ed_error_strings[]
Definition: out2in_ed.c:35
vl_api_interface_index_t sw_if_index
Definition: gre.api:59
u16 r_port
Definition: nat.h:109
ip4_address_t dst_address
Definition: ip4_packet.h:170
lb_nat_type_t
Definition: nat.h:428
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:203
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
static void * ip4_next_header(ip4_header_t *i)
Definition: ip4_packet.h:241
unsigned int u32
Definition: types.h:88
ip4_address_t local_addr
Definition: nat.h:441
u64 as_u64[2]
Definition: nat.h:111
static u8 maximum_sessions_exceeded(snat_main_t *sm, u32 thread_index)
Definition: nat_inlines.h:215
int snat_static_mapping_match(snat_main_t *sm, snat_session_key_t match, snat_session_key_t *mapping, u8 by_external, u8 *is_addr_only, twice_nat_type_t *twice_nat, lb_nat_type_t *lb, ip4_address_t *ext_host_addr, u8 *is_identity_nat)
Match NAT44 static mapping.
Definition: nat.c:2604
void snat_free_outside_address_and_port(snat_address_t *addresses, u32 thread_index, snat_session_key_t *k)
Free outside address and port pair.
Definition: nat.c:2530
static void nat44_delete_session(snat_main_t *sm, snat_session_t *ses, u32 thread_index)
Definition: nat_inlines.h:289
vl_api_fib_path_type_t type
Definition: fib_types.api:123
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
int nat44_o2i_ed_is_idle_session_cb(clib_bihash_kv_16_8_t *kv, void *arg)
Definition: out2in_ed.c:91
int snat_alloc_outside_address_and_port(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
Alloc outside address and port.
Definition: nat.c:2763
u32 fib_index
Definition: nat.h:107
snat_user_t * nat_user_get_or_create(snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index)
Find or create NAT user.
Definition: nat.c:328
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:519
#define foreach_nat_out2in_ed_error
Definition: nat.h:243
clib_bihash_16_8_t out2in_ed
Definition: nat.h:499
static_always_inline u8 icmp_type_is_error_message(u8 icmp_type)
Definition: nat_inlines.h:174
long ctx[MAX_CONNS]
Definition: main.c:144
vlib_main_t * vlib_main
Definition: nat.h:698
unsigned short u16
Definition: types.h:57
u16 protocol
Definition: nat.h:92
snat_session_t * nat_ed_session_alloc(snat_main_t *sm, snat_user_t *u, u32 thread_index, f64 now)
Allocate NAT endpoint-dependent session.
Definition: nat.c:450
snat_static_mapping_t * static_mappings
Definition: nat.h:577
u32 inside_fib_index
Definition: nat.h:673
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
void nat_syslog_nat44_sadd(u32 ssubix, u32 sfibix, ip4_address_t *isaddr, u16 isport, ip4_address_t *idaddr, u16 idport, ip4_address_t *xsaddr, u16 xsport, ip4_address_t *xdaddr, u16 xdport, snat_protocol_t proto, u8 is_twicenat)
Definition: nat_syslog.c:199
vlib_node_registration_t nat_pre_out2in_node
(constructor) VLIB_REGISTER_NODE (nat_pre_out2in_node)
Definition: out2in_ed.c:1694
nat_next_t
Definition: nat.h:52
#define PREDICT_FALSE(x)
Definition: clib.h:111
clib_bihash_8_8_t static_mapping_by_external
Definition: nat.h:574
vl_api_address_union_t src_address
Definition: ip_types.api:98
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
Definition: buffer_node.h:70
#define SNAT_SESSION_FLAG_UNKNOWN_PROTO
Definition: nat.h:282
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:338
vlib_main_t * vm
Definition: in2out_ed.c:1810
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
snat_main_t snat_main
Definition: nat.c:39
void snat_ipfix_logging_nat44_ses_delete(u32 thread_index, u32 src_ip, u32 nat_src_ip, snat_protocol_t snat_proto, u16 src_port, u16 nat_src_port, u32 vrf_id)
Generate NAT44 session delete event.
u64 value
the value
Definition: bihash_8_8.h:36
static void nat44_delete_user_with_no_session(snat_main_t *sm, snat_user_t *u, u32 thread_index)
Definition: nat_inlines.h:267
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
static u8 snat_proto_to_ip_proto(snat_protocol_t snat_proto)
Definition: nat_inlines.h:162
u16 n_vectors
Definition: node.h:397
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
ip4_address_t l_addr
Definition: nat.h:105
static void nat44_session_update_counters(snat_session_t *s, f64 now, uword bytes, u32 thread_index)
Definition: nat_inlines.h:417
static u8 * format_nat44_ed_out2in_trace(u8 *s, va_list *args)
Definition: out2in_ed.c:50
static uword nat44_ed_out2in_node_fn_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_slow_path)
Definition: out2in_ed.c:671
static u8 * format_nat_pre_trace(u8 *s, va_list *args)
Definition: out2in_ed.c:1677
8 octet key, 8 octet key value pair
Definition: bihash_8_8.h:33
#define ARRAY_LEN(x)
Definition: clib.h:62
ip4_address_t addr
Definition: nat.h:90
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:456
static int nat44_set_tcp_session_state_o2i(snat_main_t *sm, snat_session_t *ses, u8 tcp_flags, u32 tcp_ack_number, u32 tcp_seq_number, u32 thread_index)
Definition: nat_inlines.h:361
vlib_node_registration_t nat44_ed_out2in_slowpath_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_out2in_slowpath_node)
Definition: out2in_ed.c:1664
static uword nat_pre_node_fn_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, u32 def_next)
The NAT inline functions.
Definition: nat_inlines.h:27
static void make_ed_kv(clib_bihash_kv_16_8_t *kv, ip4_address_t *l_addr, ip4_address_t *r_addr, u8 proto, u32 fib_index, u16 l_port, u16 r_port)
Definition: nat_inlines.h:441
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1810
static snat_session_t * nat44_ed_out2in_unknown_proto(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip, u32 rx_fib_index, u32 thread_index, f64 now, vlib_main_t *vm, vlib_node_runtime_t *node)
Definition: out2in_ed.c:566
ip4_address_t r_addr
Definition: nat.h:106
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
Definition: node.h:515
u8 value
Definition: qos.api:54
u32 num_workers
Definition: nat.h:559
Definition: nat.h:423
#define SNAT_SESSION_FLAG_TWICE_NAT
Definition: nat.h:284
static void nat44_session_update_lru(snat_main_t *sm, snat_session_t *s, u32 thread_index)
Per-user LRU list maintenance.
Definition: nat_inlines.h:431
static snat_session_t * create_session_for_static_mapping_ed(snat_main_t *sm, vlib_buffer_t *b, snat_session_key_t l_key, snat_session_key_t e_key, vlib_node_runtime_t *node, u32 thread_index, twice_nat_type_t twice_nat, lb_nat_type_t lb_nat, f64 now)
Definition: out2in_ed.c:188
#define SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT
Definition: nat.h:285
ip4_address_t addr
Definition: nat.h:356
static_always_inline int get_icmp_o2i_ed_key(vlib_buffer_t *b, ip4_header_t *ip0, nat_ed_ses_key_t *p_key0)
Definition: nat_inlines.h:525
snat_address_t * twice_nat_addresses
Definition: nat.h:601
void nat_ha_sdel(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 thread_index)
Create session delete HA event.
Definition: nat_ha.c:715
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
typedef key
Definition: ipsec_types.api:83
Definition: defs.h:47
vl_api_address_t ip
Definition: l2.api:490
#define SNAT_SESSION_FLAG_FWD_BYPASS
Definition: nat.h:286
static u32 ip_proto_to_snat_proto(u8 ip_proto)
Definition: nat_inlines.h:147
int nat44_i2o_ed_is_idle_session_cb(clib_bihash_kv_16_8_t *kv, void *arg)
Definition: in2out_ed.c:69
static void user_session_increment(snat_main_t *sm, snat_user_t *u, u8 is_static)
Definition: nat_inlines.h:255
u32 icmp_match_out2in_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b, ip4_header_t *ip, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Definition: out2in_ed.c:441
twice_nat_type_t
Definition: nat.h:418
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
#define SNAT_SESSION_FLAG_AFFINITY
Definition: nat.h:287
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
snat_main_per_thread_data_t * per_thread_data
Definition: nat.h:568
static_always_inline void nat44_session_try_cleanup(ip4_address_t *addr, u32 fib_index, u32 thread_index, f64 now)
Definition: nat44_inlines.h:65
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
#define ip_csum_update(sum, old, new, type, field)
Definition: ip_packet.h:294
NAT syslog logging.
static u8 is_interface_addr(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, u32 ip4_addr)
Definition: nat_inlines.h:190
static void create_bypass_for_fwd(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip, u32 rx_fib_index, u32 thread_index)
Definition: out2in_ed.c:328
snat_address_t * addresses
Definition: nat.h:584
snat_get_worker_in2out_function_t * worker_in2out_cb
Definition: nat.h:562
#define vnet_buffer(b)
Definition: buffer.h:408
#define SNAT_SESSION_FLAG_STATIC_MAPPING
Definition: nat.h:281
u8 forwarding_enabled
Definition: nat.h:656
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: in2out_ed.c:1811
static void create_bypass_for_fwd_worker(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip, u32 rx_fib_index)
Definition: out2in_ed.c:428
u16 flags
Copy of main node flags.
Definition: node.h:509
#define is_twice_nat_session(s)
Check if NAT session is twice NAT.
Definition: nat.h:777
clib_bihash_16_8_t in2out_ed
Definition: nat.h:500
u16 dst_port
Definition: udp.api:42
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:302
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
snat_session_t * sessions
Definition: nat.h:509
static_always_inline void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
Definition: icmp4.h:51
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
#define SNAT_SESSION_FLAG_LOAD_BALANCING
Definition: nat.h:283
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:300
Definition: defs.h:46
NAT active-passive HA.
u16 fib_index
Definition: nat.h:92
void snat_ipfix_logging_nat44_ses_create(u32 thread_index, u32 src_ip, u32 nat_src_ip, snat_protocol_t snat_proto, u16 src_port, u16 nat_src_port, u32 vrf_id)
Generate NAT44 session create event.
static bool tcp_flags_is_init(u8 f)
Check if client initiating TCP connection (received SYN from client)
Definition: nat.h:850