45 #define foreach_nat_det_in2out_error \ 46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \ 47 _(NO_TRANSLATION, "No translation") \ 48 _(BAD_ICMP_TYPE, "unsupported ICMP type") \ 49 _(OUT_OF_PORTS, "Out of ports") \ 50 _(IN2OUT_PACKETS, "Good in2out packets processed") 54 #define _(sym,str) NAT_DET_IN2OUT_ERROR_##sym, 61 #define _(sym,string) string, 73 s =
format (s,
"NAT_DET_IN2OUT: sw_if_index %d, next index %d, session %d",
79 #ifndef CLIB_MARCH_VARIANT 99 u8 * p_dont_translate,
void *d,
void *e)
101 icmp46_header_t *icmp0;
106 u8 dont_translate = 0;
111 icmp46_header_t *inner_icmp0;
127 protocol = SNAT_PROTOCOL_ICMP;
140 case SNAT_PROTOCOL_ICMP:
141 inner_icmp0 = (icmp46_header_t *) l4_header;
145 case SNAT_PROTOCOL_UDP:
146 case SNAT_PROTOCOL_TCP:
150 b0->
error = node->
errors[NAT_DET_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
169 b0->
error = node->
errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
188 if (icmp0->type != ICMP4_echo_request)
190 b0->
error = node->
errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
196 key0.
out_port = clib_host_to_net_u16 (lo_port0 +
213 b0->
error = node->
errors[NAT_DET_IN2OUT_ERROR_OUT_OF_PORTS];
219 (
vnet_buffer (b0)->
ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_request
221 reass.icmp_type_or_tcp_flags)))
223 b0->
error = node->
errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
230 ses0->
state = SNAT_SESSION_ICMP_ACTIVE;
237 p_value->
addr = new_addr0;
241 *p_dont_translate = dont_translate;
254 u32 n_left_from, *from, *to_next;
256 u32 pkts_processed = 0;
262 n_left_from =
frame->n_vectors;
263 next_index =
node->cached_next_index;
265 while (n_left_from > 0)
271 while (n_left_from >= 4 && n_left_to_next >= 2)
276 u32 sw_if_index0, sw_if_index1;
280 u16 old_port0, new_port0, lo_port0, i0;
281 u16 old_port1, new_port1, lo_port1, i1;
288 u32 rx_fib_index0, rx_fib_index1;
289 icmp46_header_t *icmp0, *icmp1;
306 to_next[0] = bi0 = from[0];
307 to_next[1] = bi1 = from[1];
329 ICMP4_time_exceeded_ttl_exceeded_in_transit,
341 icmp0 = (icmp46_header_t *) udp0;
343 next0 =
icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
344 rx_fib_index0,
node, next0, thread_index,
355 b0->
error =
node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
370 key0.
out_port = clib_host_to_net_u16 (lo_port0 +
391 ICMP4_destination_unreachable,
392 ICMP4_destination_unreachable_destination_unreachable_host,
415 ses0->
state = SNAT_SESSION_TCP_SYN_SENT;
417 && ses0->
state == SNAT_SESSION_TCP_SYN_SENT)
418 ses0->
state = SNAT_SESSION_TCP_ESTABLISHED;
420 && ses0->
state == SNAT_SESSION_TCP_ESTABLISHED)
421 ses0->
state = SNAT_SESSION_TCP_FIN_WAIT;
423 && ses0->
state == SNAT_SESSION_TCP_FIN_WAIT)
426 && ses0->
state == SNAT_SESSION_TCP_CLOSE_WAIT)
427 ses0->
state = SNAT_SESSION_TCP_LAST_ACK;
428 else if (tcp0->flags == 0
429 && ses0->
state == SNAT_SESSION_UNKNOWN)
430 ses0->
state = SNAT_SESSION_TCP_ESTABLISHED;
432 sum0 = tcp0->checksum;
444 ses0->
state = SNAT_SESSION_UDP_ACTIVE;
463 case SNAT_SESSION_UDP_ACTIVE:
466 case SNAT_SESSION_TCP_SYN_SENT:
467 case SNAT_SESSION_TCP_FIN_WAIT:
468 case SNAT_SESSION_TCP_CLOSE_WAIT:
469 case SNAT_SESSION_TCP_LAST_ACK:
472 case SNAT_SESSION_TCP_ESTABLISHED:
479 && (b0->
flags & VLIB_BUFFER_IS_TRACED)))
502 ICMP4_time_exceeded_ttl_exceeded_in_transit,
514 icmp1 = (icmp46_header_t *) udp1;
516 next1 =
icmp_in2out (sm, b1, ip1, icmp1, sw_if_index1,
517 rx_fib_index1,
node, next1, thread_index,
528 b1->
error =
node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
543 key1.
out_port = clib_host_to_net_u16 (lo_port1 +
564 ICMP4_destination_unreachable,
565 ICMP4_destination_unreachable_destination_unreachable_host,
573 udp1->
src_port = new_port1 = ses1->out.out_port;
588 ses1->state = SNAT_SESSION_TCP_SYN_SENT;
590 && ses1->state == SNAT_SESSION_TCP_SYN_SENT)
591 ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
593 && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
594 ses1->state = SNAT_SESSION_TCP_FIN_WAIT;
596 && ses1->state == SNAT_SESSION_TCP_FIN_WAIT)
599 && ses1->state == SNAT_SESSION_TCP_CLOSE_WAIT)
600 ses1->state = SNAT_SESSION_TCP_LAST_ACK;
601 else if (tcp1->flags == 0
602 && ses1->state == SNAT_SESSION_UNKNOWN)
603 ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
605 sum1 = tcp1->checksum;
617 ses1->state = SNAT_SESSION_UDP_ACTIVE;
636 case SNAT_SESSION_UDP_ACTIVE:
639 case SNAT_SESSION_TCP_SYN_SENT:
640 case SNAT_SESSION_TCP_FIN_WAIT:
641 case SNAT_SESSION_TCP_CLOSE_WAIT:
642 case SNAT_SESSION_TCP_LAST_ACK:
645 case SNAT_SESSION_TCP_ESTABLISHED:
652 && (b1->
flags & VLIB_BUFFER_IS_TRACED)))
667 to_next, n_left_to_next,
668 bi0, bi1, next0, next1);
671 while (n_left_from > 0 && n_left_to_next > 0)
680 u16 old_port0, new_port0, lo_port0, i0;
688 icmp46_header_t *icmp0;
711 ICMP4_time_exceeded_ttl_exceeded_in_transit,
723 icmp0 = (icmp46_header_t *) udp0;
725 next0 =
icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
726 rx_fib_index0,
node, next0, thread_index,
737 b0->
error =
node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
752 key0.
out_port = clib_host_to_net_u16 (lo_port0 +
773 ICMP4_destination_unreachable,
774 ICMP4_destination_unreachable_destination_unreachable_host,
797 ses0->
state = SNAT_SESSION_TCP_SYN_SENT;
799 && ses0->
state == SNAT_SESSION_TCP_SYN_SENT)
800 ses0->
state = SNAT_SESSION_TCP_ESTABLISHED;
802 && ses0->
state == SNAT_SESSION_TCP_ESTABLISHED)
803 ses0->
state = SNAT_SESSION_TCP_FIN_WAIT;
805 && ses0->
state == SNAT_SESSION_TCP_FIN_WAIT)
808 && ses0->
state == SNAT_SESSION_TCP_CLOSE_WAIT)
809 ses0->
state = SNAT_SESSION_TCP_LAST_ACK;
810 else if (tcp0->flags == 0
811 && ses0->
state == SNAT_SESSION_UNKNOWN)
812 ses0->
state = SNAT_SESSION_TCP_ESTABLISHED;
814 sum0 = tcp0->checksum;
826 ses0->
state = SNAT_SESSION_UDP_ACTIVE;
845 case SNAT_SESSION_UDP_ACTIVE:
848 case SNAT_SESSION_TCP_SYN_SENT:
849 case SNAT_SESSION_TCP_FIN_WAIT:
850 case SNAT_SESSION_TCP_CLOSE_WAIT:
851 case SNAT_SESSION_TCP_LAST_ACK:
854 case SNAT_SESSION_TCP_ESTABLISHED:
861 && (b0->
flags & VLIB_BUFFER_IS_TRACED)))
876 to_next, n_left_to_next,
884 NAT_DET_IN2OUT_ERROR_IN2OUT_PACKETS,
886 return frame->n_vectors;
891 .name =
"nat44-det-in2out",
892 .vector_size =
sizeof (
u32),
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
#define nat_log_info(...)
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
static f64 vlib_time_now(vlib_main_t *vm)
static void snat_det_ses_close(snat_det_map_t *dm, snat_det_session_t *ses)
static snat_det_session_t * snat_det_find_ses_by_in(snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t out_key)
static void snat_det_forward(snat_det_map_t *dm, ip4_address_t *in_addr, ip4_address_t *out_addr, u16 *lo_port)
#define VLIB_NODE_FN(node)
vlib_error_t * errors
Vector of errors for this node.
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
struct _tcp_header tcp_header_t
static char * nat_det_in2out_error_strings[]
static int snat_not_translate_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, ip4_header_t *ip0, u32 proto0, u32 rx_fib_index0)
Check if packet should be translated.
vl_api_ip_proto_t protocol
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
ip4_address_t ext_host_addr
u32 det_in2out_node_index
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
u32 icmp_in2out(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
static void * ip4_next_header(ip4_header_t *i)
vl_api_fib_path_type_t type
vlib_error_t error
Error code for buffers to be enqueued to error handler.
static void mss_clamping(snat_main_t *sm, tcp_header_t *tcp, ip_csum_t *sum)
static_always_inline u8 icmp_type_is_error_message(u8 icmp_type)
snat_det_session_t * sessions
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
vl_api_address_union_t src_address
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
static snat_det_session_t * snat_det_ses_create(u32 thread_index, snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t *out)
#define VLIB_REGISTER_NODE(x,...)
#define CLIB_PREFETCH(addr, size, type)
deterministic NAT definitions
#define foreach_nat_det_in2out_error
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
vlib_main_t vlib_node_runtime_t * node
u32 tcp_transitory_timeout
static snat_det_map_t * snat_det_map_by_user(snat_main_t *sm, ip4_address_t *user_addr)
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
static u32 ip_proto_to_snat_proto(u8 ip_proto)
VLIB buffer representation.
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
#define ip_csum_update(sum, old, new, type, field)
static snat_det_session_t * snat_det_get_ses_by_out(snat_det_map_t *dm, ip4_address_t *in_addr, u64 out_key)
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
#define VLIB_NODE_FLAG_TRACE
#define CLIB_CACHE_LINE_BYTES
static_always_inline void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
static u16 ip_csum_fold(ip_csum_t c)
static u8 * format_nat_det_in2out_trace(u8 *s, va_list *args)
u32 tcp_established_timeout