FD.io VPP  v20.05.1-6-gf53edbc3b
Vector Packet Processing
nat_det_in2out.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief Deterministic/CGN NAT44 inside to outside network translation
18  */
19 
20 #include <vlib/vlib.h>
21 #include <vnet/vnet.h>
22 #include <vnet/ip/ip.h>
23 #include <vnet/fib/ip4_fib.h>
24 #include <vppinfra/error.h>
25 #include <vppinfra/elog.h>
26 #include <nat/nat.h>
27 #include <nat/nat_det.h>
28 #include <nat/nat_inlines.h>
29 
30 typedef struct
31 {
36 
37 typedef enum
38 {
44 
45 #define foreach_nat_det_in2out_error \
46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
47 _(NO_TRANSLATION, "No translation") \
48 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
49 _(OUT_OF_PORTS, "Out of ports") \
50 _(IN2OUT_PACKETS, "Good in2out packets processed")
51 
52 typedef enum
53 {
54 #define _(sym,str) NAT_DET_IN2OUT_ERROR_##sym,
56 #undef _
59 
60 static char *nat_det_in2out_error_strings[] = {
61 #define _(sym,string) string,
63 #undef _
64 };
65 
66 static u8 *
67 format_nat_det_in2out_trace (u8 * s, va_list * args)
68 {
69  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
70  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
71  nat_det_in2out_trace_t *t = va_arg (*args, nat_det_in2out_trace_t *);
72 
73  s = format (s, "NAT_DET_IN2OUT: sw_if_index %d, next index %d, session %d",
75 
76  return s;
77 }
78 
79 #ifndef CLIB_MARCH_VARIANT
80 /**
81  * Get address and port values to be used for ICMP packet translation
82  * and create session if needed
83  *
84  * @param[in,out] sm NAT main
85  * @param[in,out] node NAT node runtime
86  * @param[in] thread_index thread index
87  * @param[in,out] b0 buffer containing packet to be translated
88  * @param[in,out] ip0 ip header
89  * @param[out] p_proto protocol used for matching
90  * @param[out] p_value address and port after NAT translation
91  * @param[out] p_dont_translate if packet should not be translated
92  * @param d optional parameter
93  * @param e optional parameter
94  */
95 u32
97  u32 thread_index, vlib_buffer_t * b0,
98  ip4_header_t * ip0, u8 * p_proto,
99  snat_session_key_t * p_value, u8 * p_dont_translate,
100  void *d, void *e)
101 {
102  vlib_main_t *vm = vlib_get_main ();
103  icmp46_header_t *icmp0;
104  u32 sw_if_index0;
105  u32 rx_fib_index0;
106  u8 protocol;
107  snat_det_out_key_t key0;
108  u8 dont_translate = 0;
109  u32 next0 = ~0;
110  icmp_echo_header_t *echo0, *inner_echo0 = 0;
111  ip4_header_t *inner_ip0;
112  void *l4_header = 0;
113  icmp46_header_t *inner_icmp0;
114  snat_det_map_t *dm0 = 0;
115  ip4_address_t new_addr0;
116  u16 lo_port0, i0;
117  snat_det_session_t *ses0 = 0;
118  ip4_address_t in_addr;
119  u16 in_port;
120 
121  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
122  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
123  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
124  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
125 
127  (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
128  {
129  protocol = NAT_PROTOCOL_ICMP;
130  in_addr = ip0->src_address;
131  in_port = vnet_buffer (b0)->ip.reass.l4_src_port;
132  }
133  else
134  {
135  /* if error message, then it's not fragmented and we can access it */
136  inner_ip0 = (ip4_header_t *) (echo0 + 1);
137  l4_header = ip4_next_header (inner_ip0);
138  protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
139  in_addr = inner_ip0->dst_address;
140  switch (protocol)
141  {
142  case NAT_PROTOCOL_ICMP:
143  inner_icmp0 = (icmp46_header_t *) l4_header;
144  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
145  in_port = inner_echo0->identifier;
146  break;
147  case NAT_PROTOCOL_UDP:
148  case NAT_PROTOCOL_TCP:
149  in_port = ((tcp_udp_header_t *) l4_header)->dst_port;
150  break;
151  default:
152  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
153  next0 = NAT_DET_IN2OUT_NEXT_DROP;
154  goto out;
155  }
156  }
157 
158  dm0 = snat_det_map_by_user (sm, &in_addr);
159  if (PREDICT_FALSE (!dm0))
160  {
161  nat_log_info ("no match for internal host %U",
162  format_ip4_address, &in_addr);
163  if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
164  IP_PROTOCOL_ICMP,
165  rx_fib_index0)))
166  {
167  dont_translate = 1;
168  goto out;
169  }
170  next0 = NAT_DET_IN2OUT_NEXT_DROP;
171  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
172  goto out;
173  }
174 
175  snat_det_forward (dm0, &in_addr, &new_addr0, &lo_port0);
176 
177  key0.ext_host_addr = ip0->dst_address;
178  key0.ext_host_port = 0;
179 
180  ses0 = snat_det_find_ses_by_in (dm0, &in_addr, in_port, key0);
181  if (PREDICT_FALSE (!ses0))
182  {
183  if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
184  IP_PROTOCOL_ICMP,
185  rx_fib_index0)))
186  {
187  dont_translate = 1;
188  goto out;
189  }
190  if (icmp0->type != ICMP4_echo_request)
191  {
192  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
193  next0 = NAT_DET_IN2OUT_NEXT_DROP;
194  goto out;
195  }
196  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
197  {
198  key0.out_port = clib_host_to_net_u16 (lo_port0 +
199  ((i0 +
200  clib_net_to_host_u16
201  (echo0->identifier)) %
202  dm0->ports_per_host));
203 
204  if (snat_det_get_ses_by_out (dm0, &in_addr, key0.as_u64))
205  continue;
206 
207  ses0 =
208  snat_det_ses_create (thread_index, dm0,
209  &in_addr, echo0->identifier, &key0);
210  break;
211  }
212  if (PREDICT_FALSE (!ses0))
213  {
214  next0 = NAT_DET_IN2OUT_NEXT_DROP;
215  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_OUT_OF_PORTS];
216  goto out;
217  }
218  }
219 
220  if (PREDICT_FALSE
221  (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_request
223  reass.icmp_type_or_tcp_flags)))
224  {
225  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
226  next0 = NAT_DET_IN2OUT_NEXT_DROP;
227  goto out;
228  }
229 
230  u32 now = (u32) vlib_time_now (vm);
231 
232  ses0->state = SNAT_SESSION_ICMP_ACTIVE;
233  ses0->expire = now + sm->icmp_timeout;
234 
235 out:
236  *p_proto = protocol;
237  if (ses0)
238  {
239  p_value->addr = new_addr0;
240  p_value->fib_index = sm->outside_fib_index;
241  p_value->port = ses0->out.out_port;
242  }
243  *p_dont_translate = dont_translate;
244  if (d)
245  *(snat_det_session_t **) d = ses0;
246  if (e)
247  *(snat_det_map_t **) e = dm0;
248  return next0;
249 }
250 #endif
251 
255 {
256  u32 n_left_from, *from, *to_next;
257  nat_det_in2out_next_t next_index;
258  u32 pkts_processed = 0;
259  snat_main_t *sm = &snat_main;
260  u32 now = (u32) vlib_time_now (vm);
261  u32 thread_index = vm->thread_index;
262 
263  from = vlib_frame_vector_args (frame);
264  n_left_from = frame->n_vectors;
265  next_index = node->cached_next_index;
266 
267  while (n_left_from > 0)
268  {
269  u32 n_left_to_next;
270 
271  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
272 
273  while (n_left_from >= 4 && n_left_to_next >= 2)
274  {
275  u32 bi0, bi1;
276  vlib_buffer_t *b0, *b1;
277  u32 next0, next1;
278  u32 sw_if_index0, sw_if_index1;
279  ip4_header_t *ip0, *ip1;
280  ip_csum_t sum0, sum1;
281  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
282  u16 old_port0, new_port0, lo_port0, i0;
283  u16 old_port1, new_port1, lo_port1, i1;
284  udp_header_t *udp0, *udp1;
285  tcp_header_t *tcp0, *tcp1;
286  u32 proto0, proto1;
287  snat_det_out_key_t key0, key1;
288  snat_det_map_t *dm0, *dm1;
289  snat_det_session_t *ses0 = 0, *ses1 = 0;
290  u32 rx_fib_index0, rx_fib_index1;
291  icmp46_header_t *icmp0, *icmp1;
292 
293  /* Prefetch next iteration. */
294  {
295  vlib_buffer_t *p2, *p3;
296 
297  p2 = vlib_get_buffer (vm, from[2]);
298  p3 = vlib_get_buffer (vm, from[3]);
299 
300  vlib_prefetch_buffer_header (p2, LOAD);
301  vlib_prefetch_buffer_header (p3, LOAD);
302 
305  }
306 
307  /* speculatively enqueue b0 and b1 to the current next frame */
308  to_next[0] = bi0 = from[0];
309  to_next[1] = bi1 = from[1];
310  from += 2;
311  to_next += 2;
312  n_left_from -= 2;
313  n_left_to_next -= 2;
314 
315  b0 = vlib_get_buffer (vm, bi0);
316  b1 = vlib_get_buffer (vm, bi1);
317 
320 
321  ip0 = vlib_buffer_get_current (b0);
322  udp0 = ip4_next_header (ip0);
323  tcp0 = (tcp_header_t *) udp0;
324 
325  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
326 
327  if (PREDICT_FALSE (ip0->ttl == 1))
328  {
329  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
330  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
331  ICMP4_time_exceeded_ttl_exceeded_in_transit,
332  0);
334  goto trace0;
335  }
336 
337  proto0 = ip_proto_to_nat_proto (ip0->protocol);
338 
339  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
340  {
341  rx_fib_index0 =
343  icmp0 = (icmp46_header_t *) udp0;
344 
345  next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
346  rx_fib_index0, node, next0, thread_index,
347  &ses0, &dm0);
348  goto trace0;
349  }
350 
351  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
352  if (PREDICT_FALSE (!dm0))
353  {
354  nat_log_info ("no match for internal host %U",
356  next0 = NAT_DET_IN2OUT_NEXT_DROP;
357  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
358  goto trace0;
359  }
360 
361  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
362 
363  key0.ext_host_addr = ip0->dst_address;
364  key0.ext_host_port = tcp0->dst;
365 
366  ses0 =
367  snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
368  if (PREDICT_FALSE (!ses0))
369  {
370  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
371  {
372  key0.out_port = clib_host_to_net_u16 (lo_port0 +
373  ((i0 +
374  clib_net_to_host_u16
375  (tcp0->src)) %
376  dm0->
377  ports_per_host));
378 
380  (dm0, &ip0->src_address, key0.as_u64))
381  continue;
382 
383  ses0 =
384  snat_det_ses_create (thread_index, dm0, &ip0->src_address,
385  tcp0->src, &key0);
386  break;
387  }
388  if (PREDICT_FALSE (!ses0))
389  {
390  /* too many sessions for user, send ICMP error packet */
391  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
393  ICMP4_destination_unreachable,
394  ICMP4_destination_unreachable_destination_unreachable_host,
395  0);
397  goto trace0;
398  }
399  }
400 
401  old_port0 = udp0->src_port;
402  udp0->src_port = new_port0 = ses0->out.out_port;
403 
404  old_addr0.as_u32 = ip0->src_address.as_u32;
405  ip0->src_address.as_u32 = new_addr0.as_u32;
406  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
407 
408  sum0 = ip0->checksum;
409  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
410  ip4_header_t,
411  src_address /* changed member */ );
412  ip0->checksum = ip_csum_fold (sum0);
413 
414  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
415  {
416  if (tcp0->flags & TCP_FLAG_SYN)
417  ses0->state = SNAT_SESSION_TCP_SYN_SENT;
418  else if (tcp0->flags & TCP_FLAG_ACK
419  && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
420  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
421  else if (tcp0->flags & TCP_FLAG_FIN
422  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
423  ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
424  else if (tcp0->flags & TCP_FLAG_ACK
425  && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
426  snat_det_ses_close (dm0, ses0);
427  else if (tcp0->flags & TCP_FLAG_FIN
428  && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
429  ses0->state = SNAT_SESSION_TCP_LAST_ACK;
430  else if (tcp0->flags == 0
431  && ses0->state == SNAT_SESSION_UNKNOWN)
432  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
433 
434  sum0 = tcp0->checksum;
435  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
436  ip4_header_t,
437  dst_address /* changed member */ );
438  sum0 = ip_csum_update (sum0, old_port0, new_port0,
439  ip4_header_t /* cheat */ ,
440  length /* changed member */ );
441  mss_clamping (sm, tcp0, &sum0);
442  tcp0->checksum = ip_csum_fold (sum0);
443  }
444  else
445  {
446  ses0->state = SNAT_SESSION_UDP_ACTIVE;
447 
448  if (PREDICT_FALSE (udp0->checksum))
449  {
450  sum0 = udp0->checksum;
451  sum0 =
452  ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
453  ip4_header_t,
454  dst_address /* changed member */ );
455  sum0 =
456  ip_csum_update (sum0, old_port0, new_port0,
457  ip4_header_t /* cheat */ ,
458  length /* changed member */ );
459  udp0->checksum = ip_csum_fold (sum0);
460  }
461  }
462 
463  switch (ses0->state)
464  {
465  case SNAT_SESSION_UDP_ACTIVE:
466  ses0->expire = now + sm->udp_timeout;
467  break;
468  case SNAT_SESSION_TCP_SYN_SENT:
469  case SNAT_SESSION_TCP_FIN_WAIT:
470  case SNAT_SESSION_TCP_CLOSE_WAIT:
471  case SNAT_SESSION_TCP_LAST_ACK:
472  ses0->expire = now + sm->tcp_transitory_timeout;
473  break;
474  case SNAT_SESSION_TCP_ESTABLISHED:
475  ses0->expire = now + sm->tcp_established_timeout;
476  break;
477  }
478 
479  trace0:
480  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
481  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
482  {
484  vlib_add_trace (vm, node, b0, sizeof (*t));
485  t->sw_if_index = sw_if_index0;
486  t->next_index = next0;
487  t->session_index = ~0;
488  if (ses0)
489  t->session_index = ses0 - dm0->sessions;
490  }
491 
492  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
493 
494  ip1 = vlib_buffer_get_current (b1);
495  udp1 = ip4_next_header (ip1);
496  tcp1 = (tcp_header_t *) udp1;
497 
498  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
499 
500  if (PREDICT_FALSE (ip1->ttl == 1))
501  {
502  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
503  icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
504  ICMP4_time_exceeded_ttl_exceeded_in_transit,
505  0);
507  goto trace1;
508  }
509 
510  proto1 = ip_proto_to_nat_proto (ip1->protocol);
511 
512  if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
513  {
514  rx_fib_index1 =
516  icmp1 = (icmp46_header_t *) udp1;
517 
518  next1 = icmp_in2out (sm, b1, ip1, icmp1, sw_if_index1,
519  rx_fib_index1, node, next1, thread_index,
520  &ses1, &dm1);
521  goto trace1;
522  }
523 
524  dm1 = snat_det_map_by_user (sm, &ip1->src_address);
525  if (PREDICT_FALSE (!dm1))
526  {
527  nat_log_info ("no match for internal host %U",
529  next1 = NAT_DET_IN2OUT_NEXT_DROP;
530  b1->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
531  goto trace1;
532  }
533 
534  snat_det_forward (dm1, &ip1->src_address, &new_addr1, &lo_port1);
535 
536  key1.ext_host_addr = ip1->dst_address;
537  key1.ext_host_port = tcp1->dst;
538 
539  ses1 =
540  snat_det_find_ses_by_in (dm1, &ip1->src_address, tcp1->src, key1);
541  if (PREDICT_FALSE (!ses1))
542  {
543  for (i1 = 0; i1 < dm1->ports_per_host; i1++)
544  {
545  key1.out_port = clib_host_to_net_u16 (lo_port1 +
546  ((i1 +
547  clib_net_to_host_u16
548  (tcp1->src)) %
549  dm1->
550  ports_per_host));
551 
553  (dm1, &ip1->src_address, key1.as_u64))
554  continue;
555 
556  ses1 =
557  snat_det_ses_create (thread_index, dm1, &ip1->src_address,
558  tcp1->src, &key1);
559  break;
560  }
561  if (PREDICT_FALSE (!ses1))
562  {
563  /* too many sessions for user, send ICMP error packet */
564  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
566  ICMP4_destination_unreachable,
567  ICMP4_destination_unreachable_destination_unreachable_host,
568  0);
570  goto trace1;
571  }
572  }
573 
574  old_port1 = udp1->src_port;
575  udp1->src_port = new_port1 = ses1->out.out_port;
576 
577  old_addr1.as_u32 = ip1->src_address.as_u32;
578  ip1->src_address.as_u32 = new_addr1.as_u32;
579  vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
580 
581  sum1 = ip1->checksum;
582  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
583  ip4_header_t,
584  src_address /* changed member */ );
585  ip1->checksum = ip_csum_fold (sum1);
586 
587  if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
588  {
589  if (tcp1->flags & TCP_FLAG_SYN)
590  ses1->state = SNAT_SESSION_TCP_SYN_SENT;
591  else if (tcp1->flags & TCP_FLAG_ACK
592  && ses1->state == SNAT_SESSION_TCP_SYN_SENT)
593  ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
594  else if (tcp1->flags & TCP_FLAG_FIN
595  && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
596  ses1->state = SNAT_SESSION_TCP_FIN_WAIT;
597  else if (tcp1->flags & TCP_FLAG_ACK
598  && ses1->state == SNAT_SESSION_TCP_FIN_WAIT)
599  snat_det_ses_close (dm1, ses1);
600  else if (tcp1->flags & TCP_FLAG_FIN
601  && ses1->state == SNAT_SESSION_TCP_CLOSE_WAIT)
602  ses1->state = SNAT_SESSION_TCP_LAST_ACK;
603  else if (tcp1->flags == 0
604  && ses1->state == SNAT_SESSION_UNKNOWN)
605  ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
606 
607  sum1 = tcp1->checksum;
608  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
609  ip4_header_t,
610  dst_address /* changed member */ );
611  sum1 = ip_csum_update (sum1, old_port1, new_port1,
612  ip4_header_t /* cheat */ ,
613  length /* changed member */ );
614  mss_clamping (sm, tcp1, &sum1);
615  tcp1->checksum = ip_csum_fold (sum1);
616  }
617  else
618  {
619  ses1->state = SNAT_SESSION_UDP_ACTIVE;
620 
621  if (PREDICT_FALSE (udp1->checksum))
622  {
623  sum1 = udp1->checksum;
624  sum1 =
625  ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
626  ip4_header_t,
627  dst_address /* changed member */ );
628  sum1 =
629  ip_csum_update (sum1, old_port1, new_port1,
630  ip4_header_t /* cheat */ ,
631  length /* changed member */ );
632  udp1->checksum = ip_csum_fold (sum1);
633  }
634  }
635 
636  switch (ses1->state)
637  {
638  case SNAT_SESSION_UDP_ACTIVE:
639  ses1->expire = now + sm->udp_timeout;
640  break;
641  case SNAT_SESSION_TCP_SYN_SENT:
642  case SNAT_SESSION_TCP_FIN_WAIT:
643  case SNAT_SESSION_TCP_CLOSE_WAIT:
644  case SNAT_SESSION_TCP_LAST_ACK:
645  ses1->expire = now + sm->tcp_transitory_timeout;
646  break;
647  case SNAT_SESSION_TCP_ESTABLISHED:
648  ses1->expire = now + sm->tcp_established_timeout;
649  break;
650  }
651 
652  trace1:
653  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
654  && (b1->flags & VLIB_BUFFER_IS_TRACED)))
655  {
657  vlib_add_trace (vm, node, b1, sizeof (*t));
658  t->sw_if_index = sw_if_index1;
659  t->next_index = next1;
660  t->session_index = ~0;
661  if (ses1)
662  t->session_index = ses1 - dm1->sessions;
663  }
664 
665  pkts_processed += next1 != NAT_DET_IN2OUT_NEXT_DROP;
666 
667  /* verify speculative enqueues, maybe switch current next frame */
668  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
669  to_next, n_left_to_next,
670  bi0, bi1, next0, next1);
671  }
672 
673  while (n_left_from > 0 && n_left_to_next > 0)
674  {
675  u32 bi0;
676  vlib_buffer_t *b0;
677  u32 next0;
678  u32 sw_if_index0;
679  ip4_header_t *ip0;
680  ip_csum_t sum0;
681  ip4_address_t new_addr0, old_addr0;
682  u16 old_port0, new_port0, lo_port0, i0;
683  udp_header_t *udp0;
684  tcp_header_t *tcp0;
685  u32 proto0;
686  snat_det_out_key_t key0;
687  snat_det_map_t *dm0;
688  snat_det_session_t *ses0 = 0;
689  u32 rx_fib_index0;
690  icmp46_header_t *icmp0;
691 
692  /* speculatively enqueue b0 to the current next frame */
693  bi0 = from[0];
694  to_next[0] = bi0;
695  from += 1;
696  to_next += 1;
697  n_left_from -= 1;
698  n_left_to_next -= 1;
699 
700  b0 = vlib_get_buffer (vm, bi0);
702 
703  ip0 = vlib_buffer_get_current (b0);
704  udp0 = ip4_next_header (ip0);
705  tcp0 = (tcp_header_t *) udp0;
706 
707  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
708 
709  if (PREDICT_FALSE (ip0->ttl == 1))
710  {
711  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
712  icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
713  ICMP4_time_exceeded_ttl_exceeded_in_transit,
714  0);
716  goto trace00;
717  }
718 
719  proto0 = ip_proto_to_nat_proto (ip0->protocol);
720 
721  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
722  {
723  rx_fib_index0 =
725  icmp0 = (icmp46_header_t *) udp0;
726 
727  next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
728  rx_fib_index0, node, next0, thread_index,
729  &ses0, &dm0);
730  goto trace00;
731  }
732 
733  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
734  if (PREDICT_FALSE (!dm0))
735  {
736  nat_log_info ("no match for internal host %U",
738  next0 = NAT_DET_IN2OUT_NEXT_DROP;
739  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
740  goto trace00;
741  }
742 
743  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
744 
745  key0.ext_host_addr = ip0->dst_address;
746  key0.ext_host_port = tcp0->dst;
747 
748  ses0 =
749  snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
750  if (PREDICT_FALSE (!ses0))
751  {
752  for (i0 = 0; i0 < dm0->ports_per_host; i0++)
753  {
754  key0.out_port = clib_host_to_net_u16 (lo_port0 +
755  ((i0 +
756  clib_net_to_host_u16
757  (tcp0->src)) %
758  dm0->
759  ports_per_host));
760 
762  (dm0, &ip0->src_address, key0.as_u64))
763  continue;
764 
765  ses0 =
766  snat_det_ses_create (thread_index, dm0, &ip0->src_address,
767  tcp0->src, &key0);
768  break;
769  }
770  if (PREDICT_FALSE (!ses0))
771  {
772  /* too many sessions for user, send ICMP error packet */
773  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
775  ICMP4_destination_unreachable,
776  ICMP4_destination_unreachable_destination_unreachable_host,
777  0);
779  goto trace00;
780  }
781  }
782 
783  old_port0 = udp0->src_port;
784  udp0->src_port = new_port0 = ses0->out.out_port;
785 
786  old_addr0.as_u32 = ip0->src_address.as_u32;
787  ip0->src_address.as_u32 = new_addr0.as_u32;
788  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
789 
790  sum0 = ip0->checksum;
791  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
792  ip4_header_t,
793  src_address /* changed member */ );
794  ip0->checksum = ip_csum_fold (sum0);
795 
796  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
797  {
798  if (tcp0->flags & TCP_FLAG_SYN)
799  ses0->state = SNAT_SESSION_TCP_SYN_SENT;
800  else if (tcp0->flags & TCP_FLAG_ACK
801  && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
802  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
803  else if (tcp0->flags & TCP_FLAG_FIN
804  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
805  ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
806  else if (tcp0->flags & TCP_FLAG_ACK
807  && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
808  snat_det_ses_close (dm0, ses0);
809  else if (tcp0->flags & TCP_FLAG_FIN
810  && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
811  ses0->state = SNAT_SESSION_TCP_LAST_ACK;
812  else if (tcp0->flags == 0
813  && ses0->state == SNAT_SESSION_UNKNOWN)
814  ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
815 
816  sum0 = tcp0->checksum;
817  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
818  ip4_header_t,
819  dst_address /* changed member */ );
820  sum0 = ip_csum_update (sum0, old_port0, new_port0,
821  ip4_header_t /* cheat */ ,
822  length /* changed member */ );
823  mss_clamping (sm, tcp0, &sum0);
824  tcp0->checksum = ip_csum_fold (sum0);
825  }
826  else
827  {
828  ses0->state = SNAT_SESSION_UDP_ACTIVE;
829 
830  if (PREDICT_FALSE (udp0->checksum))
831  {
832  sum0 = udp0->checksum;
833  sum0 =
834  ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
835  ip4_header_t,
836  dst_address /* changed member */ );
837  sum0 =
838  ip_csum_update (sum0, old_port0, new_port0,
839  ip4_header_t /* cheat */ ,
840  length /* changed member */ );
841  udp0->checksum = ip_csum_fold (sum0);
842  }
843  }
844 
845  switch (ses0->state)
846  {
847  case SNAT_SESSION_UDP_ACTIVE:
848  ses0->expire = now + sm->udp_timeout;
849  break;
850  case SNAT_SESSION_TCP_SYN_SENT:
851  case SNAT_SESSION_TCP_FIN_WAIT:
852  case SNAT_SESSION_TCP_CLOSE_WAIT:
853  case SNAT_SESSION_TCP_LAST_ACK:
854  ses0->expire = now + sm->tcp_transitory_timeout;
855  break;
856  case SNAT_SESSION_TCP_ESTABLISHED:
857  ses0->expire = now + sm->tcp_established_timeout;
858  break;
859  }
860 
861  trace00:
862  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
863  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
864  {
866  vlib_add_trace (vm, node, b0, sizeof (*t));
867  t->sw_if_index = sw_if_index0;
868  t->next_index = next0;
869  t->session_index = ~0;
870  if (ses0)
871  t->session_index = ses0 - dm0->sessions;
872  }
873 
874  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
875 
876  /* verify speculative enqueue, maybe switch current next frame */
877  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
878  to_next, n_left_to_next,
879  bi0, next0);
880  }
881 
882  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
883  }
884 
886  NAT_DET_IN2OUT_ERROR_IN2OUT_PACKETS,
887  pkts_processed);
888  return frame->n_vectors;
889 }
890 
891 /* *INDENT-OFF* */
893  .name = "nat44-det-in2out",
894  .vector_size = sizeof (u32),
895  .format_trace = format_nat_det_in2out_trace,
898  .error_strings = nat_det_in2out_error_strings,
899  .n_next_nodes = NAT_DET_IN2OUT_N_NEXT,
900  /* edit / add dispositions here */
901  .next_nodes = {
902  [NAT_DET_IN2OUT_NEXT_DROP] = "error-drop",
903  [NAT_DET_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
904  [NAT_DET_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
905  },
906 };
907 /* *INDENT-ON* */
908 
909 /*
910  * fd.io coding-style-patch-verification: ON
911  *
912  * Local Variables:
913  * eval: (c-set-style "gnu")
914  * End:
915  */
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
#define nat_log_info(...)
Definition: nat.h:825
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
#define CLIB_UNUSED(x)
Definition: clib.h:86
u16 ext_host_port
Definition: nat.h:94
u16 out_port
Definition: nat.h:95
u32 icmp_timeout
Definition: nat.h:652
ip4_address_t src_address
Definition: ip4_packet.h:170
#define TCP_FLAG_SYN
Definition: fa_node.h:13
#define PREDICT_TRUE(x)
Definition: clib.h:119
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:291
u32 thread_index
Definition: main.h:218
static void snat_det_ses_close(snat_det_map_t *dm, snat_det_session_t *ses)
Definition: nat_det.h:182
static snat_det_session_t * snat_det_find_ses_by_in(snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t out_key)
Definition: nat_det.h:129
static void snat_det_forward(snat_det_map_t *dm, ip4_address_t *in_addr, ip4_address_t *out_addr, u16 *lo_port)
Definition: nat_det.h:75
uword ip_csum_t
Definition: ip_packet.h:244
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
#define VLIB_NODE_FN(node)
Definition: node.h:202
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:472
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
struct _tcp_header tcp_header_t
unsigned char u8
Definition: types.h:56
static char * nat_det_in2out_error_strings[]
static int snat_not_translate_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, ip4_header_t *ip0, u32 proto0, u32 rx_fib_index0)
Check if packet should be translated.
Definition: nat_inlines.h:698
vl_api_ip_proto_t protocol
Definition: lb_types.api:71
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
Definition: ip4_fib.c:230
format_function_t format_ip4_address
Definition: format.h:73
static nat_protocol_t ip_proto_to_nat_proto(u8 ip_proto)
Common NAT inline functions.
Definition: inlines.h:22
ip4_address_t ext_host_addr
Definition: nat.h:93
ip4_address_t dst_address
Definition: ip4_packet.h:170
u32 det_in2out_node_index
Definition: nat.h:609
#define TCP_FLAG_ACK
Definition: fa_node.h:16
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:203
static_always_inline u8 icmp_type_is_error_message(u8 icmp_type)
Definition: inlines.h:53
u32 icmp_in2out(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: in2out.c:654
static void * ip4_next_header(ip4_header_t *i)
Definition: ip4_packet.h:241
unsigned int u32
Definition: types.h:88
nat_det_in2out_error_t
vl_api_fib_path_type_t type
Definition: fib_types.api:123
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
static void mss_clamping(snat_main_t *sm, tcp_header_t *tcp, ip_csum_t *sum)
Definition: nat_inlines.h:635
snat_det_session_t * sessions
Definition: nat.h:359
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
u32 udp_timeout
Definition: nat.h:649
#define PREDICT_FALSE(x)
Definition: clib.h:118
#define TCP_FLAG_FIN
Definition: fa_node.h:12
vl_api_address_union_t src_address
Definition: ip_types.api:99
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
Definition: buffer_node.h:70
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:224
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:338
vlib_main_t * vm
Definition: in2out_ed.c:1599
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
snat_main_t snat_main
Definition: nat.c:41
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
static snat_det_session_t * snat_det_ses_create(u32 thread_index, snat_det_map_t *dm, ip4_address_t *in_addr, u16 in_port, snat_det_out_key_t *out)
Definition: nat_det.h:150
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
deterministic NAT definitions
u8 data[]
Packet data.
Definition: buffer.h:181
#define foreach_nat_det_in2out_error
u32 outside_fib_index
Definition: nat.h:643
#define ARRAY_LEN(x)
Definition: clib.h:66
ip4_address_t addr
Definition: nat.h:78
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:483
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1599
u32 tcp_transitory_timeout
Definition: nat.h:650
static snat_det_map_t * snat_det_map_by_user(snat_main_t *sm, ip4_address_t *user_addr)
Definition: nat_det.h:45
nat_det_in2out_next_t
static vlib_main_t * vlib_get_main(void)
Definition: global_funcs.h:23
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
Definition: defs.h:47
vl_api_address_t ip
Definition: l2.api:501
u16 ports_per_host
Definition: nat.h:355
VLIB buffer representation.
Definition: buffer.h:102
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
#define ip_csum_update(sum, old, new, type, field)
Definition: ip_packet.h:294
snat_det_out_key_t out
Definition: nat.h:337
static snat_det_session_t * snat_det_get_ses_by_out(snat_det_map_t *dm, ip4_address_t *in_addr, u64 out_key)
Definition: nat_det.h:112
#define vnet_buffer(b)
Definition: buffer.h:417
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: in2out_ed.c:1600
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:304
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
static_always_inline void icmp4_error_set_vnet_buffer(vlib_buffer_t *b, u8 type, u8 code, u32 data)
Definition: icmp4.h:51
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:300
Definition: defs.h:46
u16 fib_index
Definition: nat.h:80
static u8 * format_nat_det_in2out_trace(u8 *s, va_list *args)
u32 tcp_established_timeout
Definition: nat.h:651