FD.io VPP  v20.05.1-6-gf53edbc3b
Vector Packet Processing
nat_det_out2in.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief Deterministic/CGN NAT44 outside to inside network translation
18  */
19 
20 #include <vlib/vlib.h>
21 #include <vnet/vnet.h>
22 #include <vnet/ip/ip.h>
23 #include <vnet/fib/ip4_fib.h>
24 #include <vppinfra/error.h>
25 #include <vppinfra/elog.h>
26 #include <nat/nat.h>
27 #include <nat/nat_det.h>
28 #include <nat/nat_inlines.h>
29 
30 typedef enum
31 {
37 
38 typedef struct
39 {
44 
45 #define foreach_nat_det_out2in_error \
46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
47 _(NO_TRANSLATION, "No translation") \
48 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
49 _(OUT2IN_PACKETS, "Good out2in packets processed")
50 
51 typedef enum
52 {
53 #define _(sym,str) NAT_DET_OUT2IN_ERROR_##sym,
55 #undef _
58 
59 static char *nat_det_out2in_error_strings[] = {
60 #define _(sym,string) string,
62 #undef _
63 };
64 
65 static u8 *
66 format_nat_det_out2in_trace (u8 * s, va_list * args)
67 {
68  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
69  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
70  nat_det_out2in_trace_t *t = va_arg (*args, nat_det_out2in_trace_t *);
71 
72  s =
73  format (s,
74  "NAT_DET_OUT2IN: sw_if_index %d, next index %d, session index %d",
76  return s;
77 }
78 
79 #ifndef CLIB_MARCH_VARIANT
80 /**
81  * Get address and port values to be used for ICMP packet translation
82  * and create session if needed
83  *
84  * @param[in,out] sm NAT main
85  * @param[in,out] node NAT node runtime
86  * @param[in] thread_index thread index
87  * @param[in,out] b0 buffer containing packet to be translated
88  * @param[in,out] ip0 ip header
89  * @param[out] p_proto protocol used for matching
90  * @param[out] p_value address and port after NAT translation
91  * @param[out] p_dont_translate if packet should not be translated
92  * @param d optional parameter
93  * @param e optional parameter
94  */
95 u32
97  u32 thread_index, vlib_buffer_t * b0,
98  ip4_header_t * ip0, u8 * p_proto,
99  snat_session_key_t * p_value,
100  u8 * p_dont_translate, void *d, void *e)
101 {
102  icmp46_header_t *icmp0;
103  u32 sw_if_index0;
104  u8 protocol;
105  snat_det_out_key_t key0;
106  u8 dont_translate = 0;
107  u32 next0 = ~0;
108  icmp_echo_header_t *echo0, *inner_echo0 = 0;
109  ip4_header_t *inner_ip0;
110  void *l4_header = 0;
111  icmp46_header_t *inner_icmp0;
112  snat_det_map_t *dm0 = 0;
113  ip4_address_t new_addr0 = { {0} };
114  snat_det_session_t *ses0 = 0;
115  ip4_address_t out_addr;
116 
117  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
118  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
119  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
120 
122  (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
123  {
124  protocol = NAT_PROTOCOL_ICMP;
125  key0.ext_host_addr = ip0->src_address;
126  key0.ext_host_port = 0;
127  key0.out_port = vnet_buffer (b0)->ip.reass.l4_src_port;
128  out_addr = ip0->dst_address;
129  }
130  else
131  {
132  /* if error message, then it's not fragmented and we can access it */
133  inner_ip0 = (ip4_header_t *) (echo0 + 1);
134  l4_header = ip4_next_header (inner_ip0);
135  protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
136  key0.ext_host_addr = inner_ip0->dst_address;
137  out_addr = inner_ip0->src_address;
138  switch (protocol)
139  {
140  case NAT_PROTOCOL_ICMP:
141  inner_icmp0 = (icmp46_header_t *) l4_header;
142  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
143  key0.ext_host_port = 0;
144  key0.out_port = inner_echo0->identifier;
145  break;
146  case NAT_PROTOCOL_UDP:
147  case NAT_PROTOCOL_TCP:
148  key0.ext_host_port = ((tcp_udp_header_t *) l4_header)->dst_port;
149  key0.out_port = ((tcp_udp_header_t *) l4_header)->src_port;
150  break;
151  default:
152  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
153  next0 = NAT_DET_OUT2IN_NEXT_DROP;
154  goto out;
155  }
156  }
157 
158  dm0 = snat_det_map_by_out (sm, &out_addr);
159  if (PREDICT_FALSE (!dm0))
160  {
161  /* Don't NAT packet aimed at the intfc address */
162  if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0,
163  ip0->dst_address.as_u32)))
164  {
165  dont_translate = 1;
166  goto out;
167  }
168  nat_log_info ("unknown dst address: %U",
170  goto out;
171  }
172 
173  snat_det_reverse (dm0, &ip0->dst_address,
174  clib_net_to_host_u16 (key0.out_port), &new_addr0);
175 
176  ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
177  if (PREDICT_FALSE (!ses0))
178  {
179  /* Don't NAT packet aimed at the intfc address */
180  if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0,
181  ip0->dst_address.as_u32)))
182  {
183  dont_translate = 1;
184  goto out;
185  }
186  nat_log_info ("no match src %U:%d dst %U:%d for user %U",
188  clib_net_to_host_u16 (key0.ext_host_port),
189  format_ip4_address, &out_addr,
190  clib_net_to_host_u16 (key0.out_port),
191  format_ip4_address, &new_addr0);
192  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
193  next0 = NAT_DET_OUT2IN_NEXT_DROP;
194  goto out;
195  }
196 
197  if (PREDICT_FALSE
198  (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_reply
200  reass.icmp_type_or_tcp_flags)))
201  {
202  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_BAD_ICMP_TYPE];
203  next0 = NAT_DET_OUT2IN_NEXT_DROP;
204  goto out;
205  }
206 
207  goto out;
208 
209 out:
210  *p_proto = protocol;
211  if (ses0)
212  {
213  p_value->addr = new_addr0;
214  p_value->fib_index = sm->inside_fib_index;
215  p_value->port = ses0->in_port;
216  }
217  *p_dont_translate = dont_translate;
218  if (d)
219  *(snat_det_session_t **) d = ses0;
220  if (e)
221  *(snat_det_map_t **) e = dm0;
222  return next0;
223 }
224 #endif
225 
229 {
230  u32 n_left_from, *from, *to_next;
231  nat_det_out2in_next_t next_index;
232  u32 pkts_processed = 0;
233  snat_main_t *sm = &snat_main;
234  u32 thread_index = vm->thread_index;
235 
236  from = vlib_frame_vector_args (frame);
237  n_left_from = frame->n_vectors;
238  next_index = node->cached_next_index;
239 
240  while (n_left_from > 0)
241  {
242  u32 n_left_to_next;
243 
244  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
245 
246  while (n_left_from >= 4 && n_left_to_next >= 2)
247  {
248  u32 bi0, bi1;
249  vlib_buffer_t *b0, *b1;
252  u32 sw_if_index0, sw_if_index1;
253  ip4_header_t *ip0, *ip1;
254  ip_csum_t sum0, sum1;
255  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
256  u16 new_port0, old_port0, old_port1, new_port1;
257  udp_header_t *udp0, *udp1;
258  tcp_header_t *tcp0, *tcp1;
259  u32 proto0, proto1;
260  snat_det_out_key_t key0, key1;
261  snat_det_map_t *dm0, *dm1;
262  snat_det_session_t *ses0 = 0, *ses1 = 0;
263  u32 rx_fib_index0, rx_fib_index1;
264  icmp46_header_t *icmp0, *icmp1;
265 
266  /* Prefetch next iteration. */
267  {
268  vlib_buffer_t *p2, *p3;
269 
270  p2 = vlib_get_buffer (vm, from[2]);
271  p3 = vlib_get_buffer (vm, from[3]);
272 
273  vlib_prefetch_buffer_header (p2, LOAD);
274  vlib_prefetch_buffer_header (p3, LOAD);
275 
278  }
279 
280  /* speculatively enqueue b0 and b1 to the current next frame */
281  to_next[0] = bi0 = from[0];
282  to_next[1] = bi1 = from[1];
283  from += 2;
284  to_next += 2;
285  n_left_from -= 2;
286  n_left_to_next -= 2;
287 
288  b0 = vlib_get_buffer (vm, bi0);
289  b1 = vlib_get_buffer (vm, bi1);
290 
291  ip0 = vlib_buffer_get_current (b0);
292  udp0 = ip4_next_header (ip0);
293  tcp0 = (tcp_header_t *) udp0;
294 
295  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
296 
297  if (PREDICT_FALSE (ip0->ttl == 1))
298  {
299  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
300  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
301  ICMP4_time_exceeded_ttl_exceeded_in_transit,
302  0);
304  goto trace0;
305  }
306 
307  proto0 = ip_proto_to_nat_proto (ip0->protocol);
308 
309  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
310  {
311  rx_fib_index0 =
313  icmp0 = (icmp46_header_t *) udp0;
314 
315  next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
316  rx_fib_index0, node, next0, thread_index,
317  &ses0, &dm0);
318  goto trace0;
319  }
320 
321  key0.ext_host_addr = ip0->src_address;
322  key0.ext_host_port = tcp0->src;
323  key0.out_port = tcp0->dst;
324 
325  dm0 = snat_det_map_by_out (sm, &ip0->dst_address);
326  if (PREDICT_FALSE (!dm0))
327  {
328  nat_log_info ("unknown dst address: %U",
330  next0 = NAT_DET_OUT2IN_NEXT_DROP;
331  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
332  goto trace0;
333  }
334 
335  snat_det_reverse (dm0, &ip0->dst_address,
336  clib_net_to_host_u16 (tcp0->dst), &new_addr0);
337 
338  ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
339  if (PREDICT_FALSE (!ses0))
340  {
341  nat_log_info ("no match src %U:%d dst %U:%d for user %U",
343  clib_net_to_host_u16 (tcp0->src),
345  clib_net_to_host_u16 (tcp0->dst),
346  format_ip4_address, &new_addr0);
347  next0 = NAT_DET_OUT2IN_NEXT_DROP;
348  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
349  goto trace0;
350  }
351  old_port0 = udp0->dst_port;
352  udp0->dst_port = new_port0 = ses0->in_port;
353 
354  old_addr0 = ip0->dst_address;
355  ip0->dst_address = new_addr0;
356  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
357 
358  sum0 = ip0->checksum;
359  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
360  ip4_header_t,
361  dst_address /* changed member */ );
362  ip0->checksum = ip_csum_fold (sum0);
363 
364  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
365  {
366  if (tcp0->flags & TCP_FLAG_FIN
367  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
368  ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT;
369  else if (tcp0->flags & TCP_FLAG_ACK
370  && ses0->state == SNAT_SESSION_TCP_LAST_ACK)
371  snat_det_ses_close (dm0, ses0);
372 
373  sum0 = tcp0->checksum;
374  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
375  ip4_header_t,
376  dst_address /* changed member */ );
377  sum0 = ip_csum_update (sum0, old_port0, new_port0,
378  ip4_header_t /* cheat */ ,
379  length /* changed member */ );
380  tcp0->checksum = ip_csum_fold (sum0);
381  }
382  else if (udp0->checksum)
383  {
384  sum0 = udp0->checksum;
385  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
386  ip4_header_t,
387  dst_address /* changed member */ );
388  sum0 = ip_csum_update (sum0, old_port0, new_port0,
389  ip4_header_t /* cheat */ ,
390  length /* changed member */ );
391  udp0->checksum = ip_csum_fold (sum0);
392  }
393 
394  trace0:
395 
396  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
397  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
398  {
400  vlib_add_trace (vm, node, b0, sizeof (*t));
401  t->sw_if_index = sw_if_index0;
402  t->next_index = next0;
403  t->session_index = ~0;
404  if (ses0)
405  t->session_index = ses0 - dm0->sessions;
406  }
407 
408  pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP;
409 
410  b1 = vlib_get_buffer (vm, bi1);
411 
412  ip1 = vlib_buffer_get_current (b1);
413  udp1 = ip4_next_header (ip1);
414  tcp1 = (tcp_header_t *) udp1;
415 
416  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
417 
418  if (PREDICT_FALSE (ip1->ttl == 1))
419  {
420  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
421  icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
422  ICMP4_time_exceeded_ttl_exceeded_in_transit,
423  0);
425  goto trace1;
426  }
427 
428  proto1 = ip_proto_to_nat_proto (ip1->protocol);
429 
430  if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
431  {
432  rx_fib_index1 =
434  icmp1 = (icmp46_header_t *) udp1;
435 
436  next1 = icmp_out2in (sm, b1, ip1, icmp1, sw_if_index1,
437  rx_fib_index1, node, next1, thread_index,
438  &ses1, &dm1);
439  goto trace1;
440  }
441 
442  key1.ext_host_addr = ip1->src_address;
443  key1.ext_host_port = tcp1->src;
444  key1.out_port = tcp1->dst;
445 
446  dm1 = snat_det_map_by_out (sm, &ip1->dst_address);
447  if (PREDICT_FALSE (!dm1))
448  {
449  nat_log_info ("unknown dst address: %U",
451  next1 = NAT_DET_OUT2IN_NEXT_DROP;
452  b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
453  goto trace1;
454  }
455 
456  snat_det_reverse (dm1, &ip1->dst_address,
457  clib_net_to_host_u16 (tcp1->dst), &new_addr1);
458 
459  ses1 = snat_det_get_ses_by_out (dm1, &new_addr1, key1.as_u64);
460  if (PREDICT_FALSE (!ses1))
461  {
462  nat_log_info ("no match src %U:%d dst %U:%d for user %U",
464  clib_net_to_host_u16 (tcp1->src),
466  clib_net_to_host_u16 (tcp1->dst),
467  format_ip4_address, &new_addr1);
468  next1 = NAT_DET_OUT2IN_NEXT_DROP;
469  b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
470  goto trace1;
471  }
472  old_port1 = udp1->dst_port;
473  udp1->dst_port = new_port1 = ses1->in_port;
474 
475  old_addr1 = ip1->dst_address;
476  ip1->dst_address = new_addr1;
477  vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
478 
479  sum1 = ip1->checksum;
480  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
481  ip4_header_t,
482  dst_address /* changed member */ );
483  ip1->checksum = ip_csum_fold (sum1);
484 
485  if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
486  {
487  if (tcp1->flags & TCP_FLAG_FIN
488  && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
489  ses1->state = SNAT_SESSION_TCP_CLOSE_WAIT;
490  else if (tcp1->flags & TCP_FLAG_ACK
491  && ses1->state == SNAT_SESSION_TCP_LAST_ACK)
492  snat_det_ses_close (dm1, ses1);
493 
494  sum1 = tcp1->checksum;
495  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
496  ip4_header_t,
497  dst_address /* changed member */ );
498  sum1 = ip_csum_update (sum1, old_port1, new_port1,
499  ip4_header_t /* cheat */ ,
500  length /* changed member */ );
501  tcp1->checksum = ip_csum_fold (sum1);
502  }
503  else if (udp1->checksum)
504  {
505  sum1 = udp1->checksum;
506  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
507  ip4_header_t,
508  dst_address /* changed member */ );
509  sum1 = ip_csum_update (sum1, old_port1, new_port1,
510  ip4_header_t /* cheat */ ,
511  length /* changed member */ );
512  udp1->checksum = ip_csum_fold (sum1);
513  }
514 
515  trace1:
516 
517  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
518  && (b1->flags & VLIB_BUFFER_IS_TRACED)))
519  {
521  vlib_add_trace (vm, node, b1, sizeof (*t));
522  t->sw_if_index = sw_if_index1;
523  t->next_index = next1;
524  t->session_index = ~0;
525  if (ses1)
526  t->session_index = ses1 - dm1->sessions;
527  }
528 
529  pkts_processed += next1 != NAT_DET_OUT2IN_NEXT_DROP;
530 
531  /* verify speculative enqueues, maybe switch current next frame */
532  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
533  to_next, n_left_to_next,
534  bi0, bi1, next0, next1);
535  }
536 
537  while (n_left_from > 0 && n_left_to_next > 0)
538  {
539  u32 bi0;
540  vlib_buffer_t *b0;
542  u32 sw_if_index0;
543  ip4_header_t *ip0;
544  ip_csum_t sum0;
545  ip4_address_t new_addr0, old_addr0;
546  u16 new_port0, old_port0;
547  udp_header_t *udp0;
548  tcp_header_t *tcp0;
549  u32 proto0;
550  snat_det_out_key_t key0;
551  snat_det_map_t *dm0;
552  snat_det_session_t *ses0 = 0;
553  u32 rx_fib_index0;
554  icmp46_header_t *icmp0;
555 
556  /* speculatively enqueue b0 to the current next frame */
557  bi0 = from[0];
558  to_next[0] = bi0;
559  from += 1;
560  to_next += 1;
561  n_left_from -= 1;
562  n_left_to_next -= 1;
563 
564  b0 = vlib_get_buffer (vm, bi0);
565 
566  ip0 = vlib_buffer_get_current (b0);
567  udp0 = ip4_next_header (ip0);
568  tcp0 = (tcp_header_t *) udp0;
569 
570  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
571 
572  if (PREDICT_FALSE (ip0->ttl == 1))
573  {
574  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
575  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
576  ICMP4_time_exceeded_ttl_exceeded_in_transit,
577  0);
579  goto trace00;
580  }
581 
582  proto0 = ip_proto_to_nat_proto (ip0->protocol);
583 
584  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
585  {
586  rx_fib_index0 =
588  icmp0 = (icmp46_header_t *) udp0;
589 
590  next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
591  rx_fib_index0, node, next0, thread_index,
592  &ses0, &dm0);
593  goto trace00;
594  }
595 
596  key0.ext_host_addr = ip0->src_address;
597  key0.ext_host_port = tcp0->src;
598  key0.out_port = tcp0->dst;
599 
600  dm0 = snat_det_map_by_out (sm, &ip0->dst_address);
601  if (PREDICT_FALSE (!dm0))
602  {
603  nat_log_info ("unknown dst address: %U",
605  next0 = NAT_DET_OUT2IN_NEXT_DROP;
606  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
607  goto trace00;
608  }
609 
610  snat_det_reverse (dm0, &ip0->dst_address,
611  clib_net_to_host_u16 (tcp0->dst), &new_addr0);
612 
613  ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
614  if (PREDICT_FALSE (!ses0))
615  {
616  nat_log_info ("no match src %U:%d dst %U:%d for user %U",
618  clib_net_to_host_u16 (tcp0->src),
620  clib_net_to_host_u16 (tcp0->dst),
621  format_ip4_address, &new_addr0);
622  next0 = NAT_DET_OUT2IN_NEXT_DROP;
623  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
624  goto trace00;
625  }
626  old_port0 = udp0->dst_port;
627  udp0->dst_port = new_port0 = ses0->in_port;
628 
629  old_addr0 = ip0->dst_address;
630  ip0->dst_address = new_addr0;
631  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
632 
633  sum0 = ip0->checksum;
634  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
635  ip4_header_t,
636  dst_address /* changed member */ );
637  ip0->checksum = ip_csum_fold (sum0);
638 
639  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
640  {
641  if (tcp0->flags & TCP_FLAG_FIN
642  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
643  ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT;
644  else if (tcp0->flags & TCP_FLAG_ACK
645  && ses0->state == SNAT_SESSION_TCP_LAST_ACK)
646  snat_det_ses_close (dm0, ses0);
647 
648  sum0 = tcp0->checksum;
649  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
650  ip4_header_t,
651  dst_address /* changed member */ );
652  sum0 = ip_csum_update (sum0, old_port0, new_port0,
653  ip4_header_t /* cheat */ ,
654  length /* changed member */ );
655  tcp0->checksum = ip_csum_fold (sum0);
656  }
657  else if (udp0->checksum)
658  {
659  sum0 = udp0->checksum;
660  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
661  ip4_header_t,
662  dst_address /* changed member */ );
663  sum0 = ip_csum_update (sum0, old_port0, new_port0,
664  ip4_header_t /* cheat */ ,
665  length /* changed member */ );
666  udp0->checksum = ip_csum_fold (sum0);
667  }
668 
669  trace00:
670 
671  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
672  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
673  {
675  vlib_add_trace (vm, node, b0, sizeof (*t));
676  t->sw_if_index = sw_if_index0;
677  t->next_index = next0;
678  t->session_index = ~0;
679  if (ses0)
680  t->session_index = ses0 - dm0->sessions;
681  }
682 
683  pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP;
684 
685  /* verify speculative enqueue, maybe switch current next frame */
686  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
687  to_next, n_left_to_next,
688  bi0, next0);
689  }
690 
691  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
692  }
693 
695  NAT_DET_OUT2IN_ERROR_OUT2IN_PACKETS,
696  pkts_processed);
697  return frame->n_vectors;
698 }
699 
700 /* *INDENT-OFF* */
702  .name = "nat44-det-out2in",
703  .vector_size = sizeof (u32),
704  .format_trace = format_nat_det_out2in_trace,
707  .error_strings = nat_det_out2in_error_strings,
708  .runtime_data_bytes = sizeof (snat_runtime_t),
709  .n_next_nodes = NAT_DET_OUT2IN_N_NEXT,
710  /* edit / add dispositions here */
711  .next_nodes = {
712  [NAT_DET_OUT2IN_NEXT_DROP] = "error-drop",
713  [NAT_DET_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
714  [NAT_DET_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
715  },
716 };
717 /* *INDENT-ON* */
718 
719 /*
720  * fd.io coding-style-patch-verification: ON
721  *
722  * Local Variables:
723  * eval: (c-set-style "gnu")
724  * End:
725  */
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
#define nat_log_info(...)
Definition: nat.h:825
vlib_node_registration_t snat_det_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_det_out2in_node)
#define CLIB_UNUSED(x)
Definition: clib.h:86
u16 ext_host_port
Definition: nat.h:94
u32 icmp_out2in(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: out2in.c:525
u16 out_port
Definition: nat.h:95
ip4_address_t src_address
Definition: ip4_packet.h:170
#define PREDICT_TRUE(x)
Definition: clib.h:119
u32 thread_index
Definition: main.h:218
static void snat_det_ses_close(snat_det_map_t *dm, snat_det_session_t *ses)
Definition: nat_det.h:182
uword ip_csum_t
Definition: ip_packet.h:244
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
#define VLIB_NODE_FN(node)
Definition: node.h:202
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:472
struct _tcp_header tcp_header_t
static void snat_det_reverse(snat_det_map_t *dm, ip4_address_t *out_addr, u16 out_port, ip4_address_t *in_addr)
Definition: nat_det.h:90
unsigned char u8
Definition: types.h:56
vl_api_ip_proto_t protocol
Definition: lb_types.api:71
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
Definition: ip4_fib.c:230
format_function_t format_ip4_address
Definition: format.h:73
static nat_protocol_t ip_proto_to_nat_proto(u8 ip_proto)
Common NAT inline functions.
Definition: inlines.h:22
ip4_address_t ext_host_addr
Definition: nat.h:93
ip4_address_t dst_address
Definition: ip4_packet.h:170
#define TCP_FLAG_ACK
Definition: fa_node.h:16
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:203
static_always_inline u8 icmp_type_is_error_message(u8 icmp_type)
Definition: inlines.h:53
static void * ip4_next_header(ip4_header_t *i)
Definition: ip4_packet.h:241
unsigned int u32
Definition: types.h:88
static char * nat_det_out2in_error_strings[]
vl_api_fib_path_type_t type
Definition: fib_types.api:123
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
snat_det_session_t * sessions
Definition: nat.h:359
static snat_det_map_t * snat_det_map_by_out(snat_main_t *sm, ip4_address_t *out_addr)
Definition: nat_det.h:60
unsigned short u16
Definition: types.h:57
u32 inside_fib_index
Definition: nat.h:645
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
#define PREDICT_FALSE(x)
Definition: clib.h:118
#define TCP_FLAG_FIN
Definition: fa_node.h:12
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
Definition: buffer_node.h:70
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:224
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:338
vlib_main_t * vm
Definition: in2out_ed.c:1599
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
snat_main_t snat_main
Definition: nat.c:41
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
static u8 * format_nat_det_out2in_trace(u8 *s, va_list *args)
deterministic NAT definitions
nat_det_out2in_next_t
u8 data[]
Packet data.
Definition: buffer.h:181
#define ARRAY_LEN(x)
Definition: clib.h:66
ip4_address_t addr
Definition: nat.h:78
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:483
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1599
u32 det_out2in_node_index
Definition: nat.h:610
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
#define foreach_nat_det_out2in_error
Definition: defs.h:47
vl_api_address_t ip
Definition: l2.api:501
VLIB buffer representation.
Definition: buffer.h:102
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
#define ip_csum_update(sum, old, new, type, field)
Definition: ip_packet.h:294
static u8 is_interface_addr(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, u32 ip4_addr)
Definition: nat_inlines.h:150
static snat_det_session_t * snat_det_get_ses_by_out(snat_det_map_t *dm, ip4_address_t *in_addr, u64 out_key)
Definition: nat_det.h:112
#define vnet_buffer(b)
Definition: buffer.h:417
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: in2out_ed.c:1600
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:304
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
static_always_inline void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
Definition: icmp4.h:51
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:300
Definition: defs.h:46
u16 fib_index
Definition: nat.h:80
nat_det_out2in_error_t