37 #include <vpp/app/version.h> 47 .arc_name =
"ip4-unicast",
48 .node_name =
"nat-pre-in2out",
50 "ip4-sv-reassembly-feature"),
53 .arc_name =
"ip4-unicast",
54 .node_name =
"nat-pre-out2in",
56 "ip4-dhcp-client-detect",
57 "ip4-sv-reassembly-feature"),
60 .arc_name =
"ip4-unicast",
61 .node_name =
"nat44-in2out-worker-handoff",
65 .arc_name =
"ip4-unicast",
66 .node_name =
"nat44-out2in-worker-handoff",
68 "ip4-dhcp-client-detect"),
71 .arc_name =
"ip4-unicast",
72 .node_name =
"nat44-in2out",
73 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
76 .arc_name =
"ip4-unicast",
77 .node_name =
"nat44-out2in",
78 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature",
79 "ip4-dhcp-client-detect"),
82 .arc_name =
"ip4-unicast",
83 .node_name =
"nat44-classify",
84 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
87 .arc_name =
"ip4-unicast",
88 .node_name =
"nat44-ed-in2out",
89 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
92 .arc_name =
"ip4-unicast",
93 .node_name =
"nat44-ed-out2in",
94 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature",
95 "ip4-dhcp-client-detect"),
98 .arc_name =
"ip4-unicast",
99 .node_name =
"nat44-ed-classify",
100 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
103 .arc_name =
"ip4-unicast",
104 .node_name =
"nat44-handoff-classify",
105 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
108 .arc_name =
"ip4-unicast",
109 .node_name =
"nat44-in2out-fast",
110 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
113 .arc_name =
"ip4-unicast",
114 .node_name =
"nat44-out2in-fast",
115 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature",
116 "ip4-dhcp-client-detect"),
119 .arc_name =
"ip4-unicast",
120 .node_name =
"nat44-hairpin-dst",
121 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
124 .arc_name =
"ip4-unicast",
125 .node_name =
"nat44-ed-hairpin-dst",
126 .runs_after =
VNET_FEATURES (
"acl-plugin-in-ip4-fa",
"ip4-sv-reassembly-feature"),
131 .arc_name =
"ip4-output",
132 .node_name =
"nat44-in2out-output",
133 .runs_after =
VNET_FEATURES (
"acl-plugin-out-ip4-fa",
"ip4-sv-reassembly-output-feature"),
136 .arc_name =
"ip4-output",
137 .node_name =
"nat44-in2out-output-worker-handoff",
138 .runs_after =
VNET_FEATURES (
"acl-plugin-out-ip4-fa",
"ip4-sv-reassembly-output-feature"),
141 .arc_name =
"ip4-output",
142 .node_name =
"nat44-hairpin-src",
143 .runs_after =
VNET_FEATURES (
"acl-plugin-out-ip4-fa",
"ip4-sv-reassembly-output-feature"),
146 .arc_name =
"ip4-output",
147 .node_name =
"nat-pre-in2out-output",
148 .runs_after =
VNET_FEATURES (
"ip4-sv-reassembly-output-feature"),
152 .arc_name =
"ip4-output",
153 .node_name =
"nat44-ed-in2out-output",
154 .runs_after =
VNET_FEATURES (
"ip4-sv-reassembly-output-feature"),
158 .arc_name =
"ip4-output",
159 .node_name =
"nat44-ed-hairpin-src",
160 .runs_after =
VNET_FEATURES (
"ip4-sv-reassembly-output-feature"),
167 .arc_name =
"ip4-local",
168 .node_name =
"nat44-hairpinning",
173 .arc_name =
"ip4-local",
174 .node_name =
"nat44-ed-hairpinning",
180 .version = VPP_BUILD_VER,
181 .description =
"Network Address Translation (NAT)",
207 init_ed_k (&ed_kv, s->in2out.addr, 0, s->ext_host_addr, 0, 0,
212 l_port = s->in2out.port;
213 r_port = s->ext_host_port;
214 l_addr = &s->in2out.addr;
215 r_addr = &s->ext_host_addr;
217 init_ed_k (&ed_kv, *l_addr, l_port, *r_addr, r_port, fib_index,
220 if (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &ed_kv, 0))
230 s->nat_proto, s->out2in.port);
231 l_addr = &s->out2in.addr;
232 r_addr = &s->ext_host_addr;
233 fib_index = s->out2in.fib_index;
236 proto = s->in2out.port;
243 l_port = s->out2in.port;
244 r_port = s->ext_host_port;
246 init_ed_k (&ed_kv, *l_addr, l_port, *r_addr, r_port, fib_index, proto);
247 if (clib_bihash_add_del_16_8 (&sm->
out2in_ed, &ed_kv, 0))
249 l_addr = &s->in2out.addr;
250 fib_index = s->in2out.fib_index;
252 l_port = s->in2out.port;
255 r_addr = &s->ext_host_nat_addr;
256 r_port = s->ext_host_nat_port;
258 init_ed_k (&ed_kv, *l_addr, l_port, *r_addr, r_port, fib_index, proto);
259 if (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &ed_kv, 0))
264 &s->in2out.addr, s->in2out.port,
265 &s->ext_host_nat_addr, s->ext_host_nat_port,
266 &s->out2in.addr, s->out2in.port,
267 &s->ext_host_addr, s->ext_host_port,
273 if (clib_bihash_add_del_8_8 (&tsm->
in2out, &kv, 0))
276 if (clib_bihash_add_del_8_8 (&tsm->
out2in, &kv, 0))
281 &s->in2out.addr, s->in2out.port,
282 &s->out2in.addr, s->out2in.port,
293 s->in2out.addr.as_u32,
294 s->out2in.addr.as_u32,
298 s->in2out.fib_index);
300 nat_ha_sdel (&s->out2in.addr, s->out2in.port, &s->ext_host_addr,
301 s->ext_host_port, s->nat_proto, s->out2in.fib_index,
310 &s->ext_host_nat_addr,
311 s->ext_host_nat_port, s->nat_proto);
318 &s->out2in.
addr, s->out2in.port,
324 u32 thread_index,
u8 is_ha)
338 proto = s->in2out.port;
345 l_port = s->in2out.port;
346 r_port = s->ext_host_port;
349 l_addr = &s->in2out.addr;
350 r_addr = &s->ext_host_addr;
352 init_ed_k (&ed_kv, *l_addr, l_port, *r_addr, r_port, fib_index, proto);
355 (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &ed_kv, 0)))
363 s->nat_proto, s->out2in.port);
364 l_addr = &s->out2in.addr;
365 r_addr = &s->ext_host_addr;
366 fib_index = s->out2in.fib_index;
369 proto = s->in2out.port;
376 l_port = s->out2in.port;
377 r_port = s->ext_host_port;
379 init_ed_k (&ed_kv, *l_addr, l_port, *r_addr, r_port, fib_index, proto);
384 l_addr = &s->in2out.addr;
385 fib_index = s->in2out.fib_index;
388 l_port = s->in2out.port;
392 r_addr = &s->ext_host_nat_addr;
393 r_port = s->ext_host_nat_port;
395 init_ed_k (&ed_kv, *l_addr, l_port, *r_addr, r_port, fib_index, proto);
403 &s->in2out.addr, s->in2out.port,
404 &s->ext_host_nat_addr, s->ext_host_nat_port,
405 &s->out2in.addr, s->out2in.port,
406 &s->ext_host_addr, s->ext_host_port,
416 s->in2out.addr.as_u32,
417 s->out2in.addr.as_u32,
421 s->in2out.fib_index);
422 nat_ha_sdel (&s->out2in.addr, s->out2in.port, &s->ext_host_addr,
423 s->ext_host_port, s->nat_proto, s->out2in.fib_index,
432 &s->ext_host_nat_addr,
433 s->ext_host_nat_port, s->nat_proto);
440 &s->out2in.
addr, s->out2in.port,
460 if (clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
486 if (clib_bihash_add_del_8_8 (&tsm->
user_hash, &kv, 1))
506 u32 thread_index,
f64 now)
510 u32 oldest_per_user_translation_list_index, session_index;
517 oldest_per_user_translation_list_index =
521 ASSERT (oldest_per_user_translation_list_index != ~0);
526 oldest_per_user_translation_list_index);
528 oldest_per_user_translation_list_elt =
530 oldest_per_user_translation_list_index);
533 session_index = oldest_per_user_translation_list_elt->
value;
546 s->ext_host_addr.as_u32 = 0;
547 s->ext_host_port = 0;
548 s->ext_host_nat_addr.as_u32 = 0;
549 s->ext_host_nat_port = 0;
559 per_user_translation_list_elt - tsm->
list_pool);
562 s->per_user_index = per_user_translation_list_elt - tsm->
list_pool;
566 s->per_user_list_head_index,
567 per_user_translation_list_elt - tsm->
list_pool);
569 s->user_index = u - tsm->
users;
574 s->ha_last_refreshed = now;
587 .ip4.as_u32 = addr->
as_u32,
616 return VNET_API_ERROR_FEATURE_DISABLED;
623 return VNET_API_ERROR_VALUE_EXIST;
639 #define _(N, i, n, s) \ 640 clib_memset(ap->busy_##n##_port_refcounts, 0, sizeof(ap->busy_##n##_port_refcounts));\ 641 ap->busy_##n##_ports = 0; \ 642 ap->busy_##n##_ports_per_thread = 0;\ 643 vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0); 653 if (nat_interface_is_inside(i) || sm->out2in_dpo)
656 snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
661 if (nat_interface_is_inside(i) || sm->out2in_dpo)
664 snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
679 if (is_addr_only_static_mapping (m) ||
680 is_out2in_only_static_mapping (m) ||
681 is_identity_static_mapping (m))
683 if (m->external_addr.as_u32 == addr.as_u32)
699 int addr_only,
int is_add,
u8 * tag,
700 int twice_nat,
int out2in_only,
749 u32 elt_index, head_index, ses_index;
750 if (!clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
752 user_index = value.
value;
758 elt_index = head->
next;
760 ses_index = elt->
value;
761 while (ses_index != ~0)
765 ses_index = elt->
value;
769 if ((s->out2in.addr.as_u32 != e_addr.
as_u32) ||
770 (s->out2in.port != e_port))
796 u32 fib_index,
int addr_only,
800 u32 *indexes_to_free = NULL;
803 if (s->in2out.fib_index != fib_index ||
804 s->in2out.addr.as_u32 != l_addr.as_u32)
810 if ((s->out2in.addr.as_u32 != e_addr.
as_u32) ||
811 s->out2in.port != e_port ||
812 s->in2out.port != l_port ||
813 s->nat_proto != protocol)
854 u32 elt_index, head_index;
864 if (twice_nat || out2in_only)
865 return VNET_API_ERROR_FEATURE_DISABLED;
869 if (sw_if_index != ~0)
899 return VNET_API_ERROR_VALUE_EXIST;
902 (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
903 addr_only, is_add, tag, twice_nat, out2in_only,
904 identity_nat, pool_addr, exact);
907 if (first_int_addr == 0)
922 return VNET_API_ERROR_NO_SUCH_ENTRY;
938 init_nat_k (&kv, e_addr, addr_only ? 0 : e_port, 0, addr_only ? 0 : proto);
953 if (local->vrf_id == vrf_id)
954 return VNET_API_ERROR_VALUE_EXIST;
969 return VNET_API_ERROR_VALUE_EXIST;
972 if (twice_nat && addr_only)
973 return VNET_API_ERROR_UNSUPPORTED;
988 if (!(out2in_only || identity_nat))
990 init_nat_k (&kv, l_addr, addr_only ? 0 : l_port, fib_index,
991 addr_only ? 0 : proto);
992 if (!clib_bihash_search_8_8
994 return VNET_API_ERROR_VALUE_EXIST;
1009 #define _(N, j, n, s) \ 1010 case NAT_PROTOCOL_##N: \ 1011 if (a->busy_##n##_port_refcounts[e_port]) \ 1012 return VNET_API_ERROR_INVALID_VALUE; \ 1013 ++a->busy_##n##_port_refcounts[e_port]; \ 1014 if (e_port > 1024) \ 1016 a->busy_##n##_ports++; \ 1017 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \ 1024 return VNET_API_ERROR_INVALID_VALUE_2;
1032 if (sw_if_index != ~0)
1049 return VNET_API_ERROR_NO_SUCH_ENTRY;
1115 if (!clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
1117 user_index = value.
value;
1123 elt_index = head->
next;
1125 ses_index = elt->
value;
1126 while (ses_index != ~0)
1130 ses_index = elt->
value;
1135 if (!addr_only && s->in2out.port != m->
local_port)
1153 if (sw_if_index != ~0)
1156 return VNET_API_ERROR_NO_SUCH_ENTRY;
1167 if (local->vrf_id == vrf_id)
1168 find = local - m->locals;
1172 return VNET_API_ERROR_NO_SUCH_ENTRY;
1191 #define _(N, j, n, s) \ 1192 case NAT_PROTOCOL_##N: \ 1193 --a->busy_##n##_port_refcounts[e_port]; \ 1194 if (e_port > 1024) \ 1196 a->busy_##n##_ports--; \ 1197 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \ 1204 return VNET_API_ERROR_INVALID_VALUE_2;
1228 fib_index, addr_only,
1261 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1264 snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1269 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1272 snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1285 u8 * tag,
u32 affinity)
1298 return VNET_API_ERROR_FEATURE_DISABLED;
1309 return VNET_API_ERROR_VALUE_EXIST;
1312 return VNET_API_ERROR_INVALID_VALUE;
1326 #define _(N, j, n, s) \ 1327 case NAT_PROTOCOL_##N: \ 1328 if (a->busy_##n##_port_refcounts[e_port]) \ 1329 return VNET_API_ERROR_INVALID_VALUE; \ 1330 ++a->busy_##n##_port_refcounts[e_port]; \ 1331 if (e_port > 1024) \ 1333 a->busy_##n##_ports++; \ 1334 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \ 1341 return VNET_API_ERROR_INVALID_VALUE_2;
1348 return VNET_API_ERROR_NO_SUCH_ENTRY;
1373 nat_elog_err (
"static_mapping_by_external key add failed");
1374 return VNET_API_ERROR_UNSPECIFIED;
1377 for (i = 0; i <
vec_len (locals); i++)
1386 locals[i].fib_index, m->
proto,
1397 .src_address = locals[
i].
addr,
1420 return VNET_API_ERROR_NO_SUCH_ENTRY;
1423 return VNET_API_ERROR_INVALID_VALUE;
1435 #define _(N, j, n, s) \ 1436 case NAT_PROTOCOL_##N: \ 1437 --a->busy_##n##_port_refcounts[e_port]; \ 1438 if (e_port > 1024) \ 1440 a->busy_##n##_ports--; \ 1441 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \ 1448 return VNET_API_ERROR_INVALID_VALUE_2;
1458 nat_elog_err (
"static_mapping_by_external key del failed");
1459 return VNET_API_ERROR_UNSPECIFIED;
1465 fib_table_unlock (local->fib_index, FIB_PROTOCOL_IP4,
1469 init_nat_k(& kv, local->addr, local->port, local->fib_index, m->proto);
1470 if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1472 nat_elog_err (
"static_mapping_by_local key del failed");
1473 return VNET_API_ERROR_UNSPECIFIED;
1480 .src_address = local->addr,
1490 if (!(is_lb_session (s)))
1493 if ((s->in2out.addr.as_u32 != local->addr.as_u32) ||
1494 s->in2out.port != local->port)
1497 nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
1498 nat_ed_session_delete (sm, s, tsm - sm->per_thread_data, 1);
1531 return VNET_API_ERROR_FEATURE_DISABLED;
1538 return VNET_API_ERROR_NO_SUCH_ENTRY;
1541 return VNET_API_ERROR_INVALID_VALUE;
1546 if ((local->addr.as_u32 == l_addr.as_u32) && (local->port == l_port) &&
1547 (local->vrf_id == vrf_id))
1549 match_local = local;
1558 return VNET_API_ERROR_VALUE_EXIST;
1562 local->addr.as_u32 = l_addr.as_u32;
1563 local->port = l_port;
1573 m - sm->static_mappings);
1574 if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1))
1575 nat_elog_err (
"static_mapping_by_local key add failed");
1581 return VNET_API_ERROR_NO_SUCH_ENTRY;
1584 return VNET_API_ERROR_UNSPECIFIED;
1592 if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0))
1593 nat_elog_err (
"static_mapping_by_local key del failed");
1596 if (sm->num_workers > 1)
1599 .src_address = local->addr,
1602 sm->worker_in2out_cb (&ip, m->fib_index,
1611 if (!(is_lb_session (s)))
1614 if ((s->in2out.addr.as_u32 != match_local->addr.as_u32) ||
1615 s->in2out.port != match_local->port)
1618 nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
1619 nat_ed_session_delete (sm, s, tsm - sm->per_thread_data, 1);
1631 vec_add1 (locals, local - m->locals);
1632 if (sm->num_workers > 1)
1635 ip.src_address.as_u32 = local->addr.as_u32,
1636 bitmap = clib_bitmap_set (bitmap,
1637 sm->worker_in2out_cb (&ip, local->fib_index, 0),
1646 local->prefix = local->probability;
1651 local->prefix = local->probability + prev_local->prefix;
1655 if (sm->num_workers > 1)
1670 snat_session_t *ses;
1671 u32 *ses_to_be_removed = 0, *ses_index;
1680 for (i = 0; i <
vec_len (addresses); i++)
1689 return VNET_API_ERROR_NO_SUCH_ENTRY;
1697 if (m->external_addr.as_u32 == addr.as_u32)
1698 (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1699 m->local_port, m->external_port,
1701 is_addr_only_static_mapping(m), ~0,
1704 is_out2in_only_static_mapping(m),
1706 is_identity_static_mapping(m),
1717 return VNET_API_ERROR_UNSPECIFIED;
1725 if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1731 if (ses->out2in.addr.as_u32 == addr.as_u32)
1733 nat_free_session_data (sm, ses, tsm - sm->per_thread_data, 0);
1734 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1757 #define _(N, i, n, s) \ 1758 vec_free (a->busy_##n##_ports_per_thread); 1773 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1776 snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1779 pool_foreach (interface, sm->output_feature_interfaces,
1781 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1784 snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1796 vlib_validate_simple_counter (&sm->counters.fastpath.in2out.x, \ 1798 vlib_zero_simple_counter (&sm->counters.fastpath.in2out.x, sw_if_index); \ 1799 vlib_validate_simple_counter (&sm->counters.fastpath.out2in.x, \ 1801 vlib_zero_simple_counter (&sm->counters.fastpath.out2in.x, sw_if_index); \ 1802 vlib_validate_simple_counter (&sm->counters.slowpath.in2out.x, \ 1804 vlib_zero_simple_counter (&sm->counters.slowpath.in2out.x, sw_if_index); \ 1805 vlib_validate_simple_counter (&sm->counters.slowpath.out2in.x, \ 1807 vlib_zero_simple_counter (&sm->counters.slowpath.out2in.x, sw_if_index); \ 1808 vlib_validate_simple_counter (&sm->counters.fastpath.in2out_ed.x, \ 1810 vlib_zero_simple_counter (&sm->counters.fastpath.in2out_ed.x, sw_if_index); \ 1811 vlib_validate_simple_counter (&sm->counters.fastpath.out2in_ed.x, \ 1813 vlib_zero_simple_counter (&sm->counters.fastpath.out2in_ed.x, sw_if_index); \ 1814 vlib_validate_simple_counter (&sm->counters.slowpath.in2out_ed.x, \ 1816 vlib_zero_simple_counter (&sm->counters.slowpath.in2out_ed.x, sw_if_index); \ 1817 vlib_validate_simple_counter (&sm->counters.slowpath.out2in_ed.x, \ 1819 vlib_zero_simple_counter (&sm->counters.slowpath.out2in_ed.x, sw_if_index); 1829 per_vrf_sessions_t *per_vrf_sessions;
1838 if ((per_vrf_sessions->rx_fib_index == fib_index) ||
1839 (per_vrf_sessions->tx_fib_index == fib_index))
1841 per_vrf_sessions->expired = 1;
1890 const char *feature_name, *del_feature_name;
1898 return VNET_API_ERROR_UNSUPPORTED;
1903 if (i->sw_if_index == sw_if_index)
1904 return VNET_API_ERROR_VALUE_EXIST;
1909 feature_name = is_inside ?
"nat44-in2out-fast" :
"nat44-out2in-fast";
1914 is_inside ?
"nat44-in2out-worker-handoff" :
1915 "nat44-out2in-worker-handoff";
1918 feature_name = is_inside ?
"nat-pre-in2out" :
"nat-pre-out2in";
1921 feature_name = is_inside ?
"nat44-in2out" :
"nat44-out2in";
1940 if (outside_fib->
fib_index == fib_index)
1966 if (i->sw_if_index == sw_if_index)
1970 if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1973 i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1975 i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1977 if (sm->num_workers > 1)
1979 del_feature_name =
"nat44-handoff-classify";
1980 feature_name = !is_inside ?
"nat44-in2out-worker-handoff" :
1981 "nat44-out2in-worker-handoff";
1983 else if (sm->endpoint_dependent)
1985 del_feature_name =
"nat44-ed-classify";
1986 feature_name = !is_inside ?
"nat-pre-in2out" :
1991 del_feature_name =
"nat44-classify";
1992 feature_name = !is_inside ?
"nat44-in2out" :
"nat44-out2in";
1995 int rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0);
1998 vnet_feature_enable_disable (
"ip4-unicast", del_feature_name,
1999 sw_if_index, 0, 0, 0);
2000 vnet_feature_enable_disable (
"ip4-unicast", feature_name,
2001 sw_if_index, 1, 0, 0);
2004 if (sm->endpoint_dependent)
2005 vnet_feature_enable_disable (
"ip4-local",
2006 "nat44-ed-hairpinning",
2007 sw_if_index, 1, 0, 0);
2009 vnet_feature_enable_disable (
"ip4-local",
2010 "nat44-hairpinning",
2011 sw_if_index, 1, 0, 0);
2016 int rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0);
2019 vnet_feature_enable_disable (
"ip4-unicast", feature_name,
2020 sw_if_index, 0, 0, 0);
2021 pool_put (sm->interfaces, i);
2024 if (sm->endpoint_dependent)
2025 vnet_feature_enable_disable (
"ip4-local",
2026 "nat44-ed-hairpinning",
2027 sw_if_index, 0, 0, 0);
2029 vnet_feature_enable_disable (
"ip4-local",
2030 "nat44-hairpinning",
2031 sw_if_index, 0, 0, 0);
2037 if ((nat_interface_is_inside(i) && is_inside) ||
2038 (nat_interface_is_outside(i) && !is_inside))
2041 if (sm->num_workers > 1)
2043 del_feature_name = !is_inside ?
"nat44-in2out-worker-handoff" :
2044 "nat44-out2in-worker-handoff";
2045 feature_name =
"nat44-handoff-classify";
2047 else if (sm->endpoint_dependent)
2049 del_feature_name = !is_inside ?
"nat-pre-in2out" :
2052 feature_name =
"nat44-ed-classify";
2056 del_feature_name = !is_inside ?
"nat44-in2out" :
"nat44-out2in";
2057 feature_name =
"nat44-classify";
2060 int rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 1);
2063 vnet_feature_enable_disable (
"ip4-unicast", del_feature_name,
2064 sw_if_index, 0, 0, 0);
2065 vnet_feature_enable_disable (
"ip4-unicast", feature_name,
2066 sw_if_index, 1, 0, 0);
2069 if (sm->endpoint_dependent)
2070 vnet_feature_enable_disable (
"ip4-local",
"nat44-ed-hairpinning",
2071 sw_if_index, 0, 0, 0);
2073 vnet_feature_enable_disable (
"ip4-local",
"nat44-hairpinning",
2074 sw_if_index, 0, 0, 0);
2085 return VNET_API_ERROR_NO_SUCH_ENTRY;
2099 if (is_inside && !sm->out2in_dpo)
2101 if (sm->endpoint_dependent)
2126 if (!(is_addr_only_static_mapping(m)) || (m->local_addr.as_u32 == m->external_addr.as_u32))
2129 snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
2138 u8 is_inside,
int is_del)
2149 return VNET_API_ERROR_UNSUPPORTED;
2154 if (i->sw_if_index == sw_if_index)
2155 return VNET_API_ERROR_VALUE_EXIST;
2167 if (outside_fib->
fib_index == fib_index)
2204 sw_if_index, !is_del, 0, 0);
2206 sw_if_index, !is_del, 0, 0);
2220 sw_if_index, !is_del, 0, 0);
2222 sw_if_index, !is_del, 0, 0);
2237 "nat44-out2in-worker-handoff",
2238 sw_if_index, !is_del, 0, 0);
2240 "nat44-in2out-output-worker-handoff",
2241 sw_if_index, !is_del, 0, 0);
2257 sw_if_index, !is_del, 0, 0);
2259 sw_if_index, !is_del, 0, 0);
2273 sw_if_index, !is_del, 0, 0);
2275 sw_if_index, !is_del, 0, 0);
2291 if (i->sw_if_index == sw_if_index)
2294 pool_put (sm->output_feature_interfaces, i);
2296 return VNET_API_ERROR_VALUE_EXIST;
2304 return VNET_API_ERROR_NO_SUCH_ENTRY;
2306 pool_get (sm->output_feature_interfaces,
i);
2326 if (!((is_addr_only_static_mapping(m))) || (m->local_addr.as_u32 == m->external_addr.as_u32))
2329 snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
2343 return VNET_API_ERROR_FEATURE_DISABLED;
2346 return VNET_API_ERROR_INVALID_WORKER;
2374 if (new_fib_index == old_fib_index)
2383 if (i->sw_if_index == sw_if_index)
2385 if (!(nat_interface_is_outside (i)))
2393 if (i->sw_if_index == sw_if_index)
2395 if (!(nat_interface_is_outside (i)))
2407 if (outside_fib->fib_index == old_fib_index)
2409 outside_fib->refcount--;
2410 if (!outside_fib->refcount)
2411 vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
2418 if (outside_fib->fib_index == new_fib_index)
2420 outside_fib->refcount++;
2428 vec_add2 (sm->outside_fibs, outside_fib, 1);
2429 outside_fib->refcount = 1;
2430 outside_fib->fib_index = new_fib_index;
2448 u32 if_address_index,
u32 is_delete);
2456 u32 if_address_index,
u32 is_delete);
2462 u16 port_per_thread,
u32 snat_thread_index);
2468 l_addr.
as_u8[0] = 1;
2469 l_addr.
as_u8[1] = 1;
2470 l_addr.
as_u8[2] = 1;
2471 l_addr.
as_u8[3] = 1;
2473 r_addr.
as_u8[0] = 2;
2474 r_addr.
as_u8[1] = 2;
2475 r_addr.
as_u8[2] = 2;
2476 r_addr.
as_u8[3] = 2;
2480 u32 fib_index = 9000001;
2481 u32 thread_index = 3000000001;
2482 u32 session_index = 3000000221;
2484 init_ed_kv (&kv, l_addr, l_port, r_addr, r_port, fib_index, proto,
2485 thread_index, session_index);
2494 split_ed_kv (&kv, &l_addr2, &r_addr2, &proto2, &fib_index2, &l_port2,
2498 ASSERT (l_port == l_port2);
2499 ASSERT (r_port == r_port2);
2500 ASSERT (proto == proto2);
2501 ASSERT (fib_index == fib_index2);
2509 split_nat_key (key, &l_addr2, &l_port2, &fib_index2, &proto3);
2511 ASSERT (l_port == l_port2);
2512 ASSERT (proto == proto3);
2513 ASSERT (fib_index == fib_index2);
2529 if (fib_index != ~0)
2684 sm->counters.fastpath.in2out.x.name = #x; \ 2685 sm->counters.fastpath.in2out.x.stat_segment_name = \ 2686 "/nat44/in2out/fastpath/" #x; \ 2687 sm->counters.slowpath.in2out.x.name = #x; \ 2688 sm->counters.slowpath.in2out.x.stat_segment_name = \ 2689 "/nat44/in2out/slowpath/" #x; \ 2690 sm->counters.fastpath.out2in.x.name = #x; \ 2691 sm->counters.fastpath.out2in.x.stat_segment_name = \ 2692 "/nat44/out2in/fastpath/" #x; \ 2693 sm->counters.slowpath.out2in.x.name = #x; \ 2694 sm->counters.slowpath.out2in.x.stat_segment_name = \ 2695 "/nat44/out2in/slowpath/" #x; \ 2696 sm->counters.fastpath.in2out_ed.x.name = #x; \ 2697 sm->counters.fastpath.in2out_ed.x.stat_segment_name = \ 2698 "/nat44/ed/in2out/fastpath/" #x; \ 2699 sm->counters.slowpath.in2out_ed.x.name = #x; \ 2700 sm->counters.slowpath.in2out_ed.x.stat_segment_name = \ 2701 "/nat44/ed/in2out/slowpath/" #x; \ 2702 sm->counters.fastpath.out2in_ed.x.name = #x; \ 2703 sm->counters.fastpath.out2in_ed.x.stat_segment_name = \ 2704 "/nat44/ed/out2in/fastpath/" #x; \ 2705 sm->counters.slowpath.out2in_ed.x.name = #x; \ 2706 sm->counters.slowpath.out2in_ed.x.stat_segment_name = \ 2707 "/nat44/ed/out2in/slowpath/" #x; 2747 u16 port_host_byte_order = clib_net_to_host_u16 (port);
2749 for (address_index = 0; address_index <
vec_len (addresses);
2752 if (addresses[address_index].addr.
as_u32 == addr->
as_u32)
2756 ASSERT (address_index < vec_len (addresses));
2758 a = addresses + address_index;
2762 #define _(N, i, n, s) \ 2763 case NAT_PROTOCOL_##N: \ 2764 ASSERT (a->busy_##n##_port_refcounts[port_host_byte_order] >= 1); \ 2765 --a->busy_##n##_port_refcounts[port_host_byte_order]; \ 2766 a->busy_##n##_ports--; \ 2767 a->busy_##n##_ports_per_thread[thread_index]--; \ 2784 u16 port_host_byte_order = clib_net_to_host_u16 (port);
2786 for (address_index = 0; address_index <
vec_len (addresses);
2789 if (addresses[address_index].addr.
as_u32 != addr.
as_u32)
2792 a = addresses + address_index;
2795 #define _(N, j, n, s) \ 2796 case NAT_PROTOCOL_##N: \ 2797 if (a->busy_##n##_port_refcounts[port_host_byte_order]) \ 2798 return VNET_API_ERROR_INSTANCE_IN_USE; \ 2799 ++a->busy_##n##_port_refcounts[port_host_byte_order]; \ 2800 a->busy_##n##_ports_per_thread[thread_index]++; \ 2801 a->busy_##n##_ports++; \ 2811 return VNET_API_ERROR_NO_SUCH_ENTRY;
2818 u32 match_fib_index,
2822 u32 * mapping_fib_index,
2830 clib_bihash_8_8_t *mapping_hash;
2832 u32 rand,
lo = 0,
hi, mid, *tmp = 0,
i;
2839 init_nat_k (&kv, match_addr, match_port, match_fib_index,
2841 if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2844 init_nat_k (&kv, match_addr, 0, match_fib_index, 0);
2845 if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2852 init_nat_k (&kv, match_addr, match_port, 0, match_protocol);
2853 if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2857 if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2877 *mapping_addr = local->
addr;
2878 *mapping_port = local->
port;
2889 local = pool_elt_at_index (m->locals, i);
2892 .src_address = local->addr,
2918 mid = ((hi -
lo) >> 1) +
lo;
2920 (rand > local->
prefix) ? (lo = mid + 1) : (hi = mid);
2923 if (!(local->
prefix >= rand))
2925 *mapping_addr = local->
addr;
2926 *mapping_port = local->
port;
2931 match_protocol, match_port,
2951 *mapping_addr = m->external_addr;
2955 *mapping_fib_index = sm->outside_fib_index;
2963 *twice_nat = m->twice_nat;
2981 u16 port_per_thread,
2982 u32 snat_thread_index)
2987 addr, port, port_per_thread,
2998 u16 port_per_thread,
u32 snat_thread_index)
3004 for (i = 0; i <
vec_len (addresses); i++)
3009 #define _(N, j, n, s) \ 3010 case NAT_PROTOCOL_##N: \ 3011 if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \ 3013 if (a->fib_index == fib_index) \ 3017 portnum = (port_per_thread * \ 3018 snat_thread_index) + \ 3019 snat_random_port(0, port_per_thread - 1) + 1024; \ 3020 if (a->busy_##n##_port_refcounts[portnum]) \ 3022 --a->busy_##n##_port_refcounts[portnum]; \ 3023 a->busy_##n##_ports_per_thread[thread_index]++; \ 3024 a->busy_##n##_ports++; \ 3026 *port = clib_host_to_net_u16(portnum); \ 3030 else if (a->fib_index == ~0) \ 3050 #define _(N, j, n, s) \ 3051 case NAT_PROTOCOL_##N: \ 3054 portnum = (port_per_thread * \ 3055 snat_thread_index) + \ 3056 snat_random_port(0, port_per_thread - 1) + 1024; \ 3057 if (a->busy_##n##_port_refcounts[portnum]) \ 3059 ++a->busy_##n##_port_refcounts[portnum]; \ 3060 a->busy_##n##_ports_per_thread[thread_index]++; \ 3061 a->busy_##n##_ports++; \ 3063 *port = clib_host_to_net_u16(portnum); \ 3084 u16 port_per_thread,
u32 snat_thread_index)
3088 u16 m, ports, portnum,
A, j;
3097 #define _(N, i, n, s) \ 3098 case NAT_PROTOCOL_##N: \ 3099 if (a->busy_##n##_ports < ports) \ 3103 A = snat_random_port(1, pow2_mask(sm->psid_offset)); \ 3104 j = snat_random_port(0, pow2_mask(m)); \ 3105 portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \ 3106 if (a->busy_##n##_port_refcounts[portnum]) \ 3108 ++a->busy_##n##_port_refcounts[portnum]; \ 3109 a->busy_##n##_ports++; \ 3111 *port = clib_host_to_net_u16 (portnum); \ 3133 u16 port_per_thread,
u32 snat_thread_index)
3146 #define _(N, i, n, s) \ 3147 case NAT_PROTOCOL_##N: \ 3148 if (a->busy_##n##_ports < ports) \ 3152 portnum = snat_random_port(sm->start_port, sm->end_port); \ 3153 if (a->busy_##n##_port_refcounts[portnum]) \ 3155 ++a->busy_##n##_port_refcounts[portnum]; \ 3156 a->busy_##n##_ports++; \ 3158 *port = clib_host_to_net_u16 (portnum); \ 3183 .fp_addr.ip4.as_u32 = addr.
as_u32,
3214 s =
format (s,
"%U static-mapping-index %llu",
3244 split_ed_kv (v, &l_addr, &r_addr, &proto, &fib_index, &l_port, &r_port);
3247 "local %U:%d remote %U:%d proto %U fib %d thread-index %u session-index %u",
3261 u32 next_worker_index = 0;
3269 next_worker_index += sm->
workers[hash & (_vec_len (sm->
workers) - 1)];
3273 return next_worker_index;
3278 u32 rx_fib_index0,
u8 is_output)
3286 u32 next_worker_index = 0;
3292 if (!clib_bihash_search_8_8
3313 icmp46_header_t *icmp = (icmp46_header_t *) udp;
3316 (
vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags))
3326 case NAT_PROTOCOL_ICMP:
3327 icmp = (icmp46_header_t *) l4_header;
3331 case NAT_PROTOCOL_UDP:
3332 case NAT_PROTOCOL_TCP:
3345 if (!clib_bihash_search_8_8
3355 next_worker_index +=
3357 return next_worker_index;
3426 next_worker_index, fib_index,
3427 clib_net_to_host_u32 (ip->
3429 clib_net_to_host_u32 (ip->
3430 dst_address.as_u32));
3432 return next_worker_index;
3440 next_worker_index += sm->
workers[hash & (_vec_len (sm->
workers) - 1)];
3447 next_worker_index, rx_fib_index,
3454 next_worker_index, rx_fib_index,
3459 return next_worker_index;
3464 u32 rx_fib_index,
u8 is_output)
3479 if (
PREDICT_TRUE (proto == NAT_PROTOCOL_UDP || proto == NAT_PROTOCOL_TCP))
3496 next_worker_index, rx_fib_index,
3497 clib_net_to_host_u32 (ip->
3499 clib_net_to_host_u32 (ip->
3500 dst_address.as_u32));
3501 return next_worker_index;
3504 else if (proto == NAT_PROTOCOL_ICMP)
3516 next_worker_index, rx_fib_index,
3517 clib_net_to_host_u32 (ip->
3519 clib_net_to_host_u32 (ip->
3520 dst_address.as_u32));
3521 return next_worker_index;
3530 if (!clib_bihash_search_8_8
3534 next_worker_index = m->
workers[0];
3552 icmp46_header_t *icmp = (icmp46_header_t *) udp;
3555 (
vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags))
3565 case NAT_PROTOCOL_ICMP:
3566 icmp = (icmp46_header_t *) l4_header;
3570 case NAT_PROTOCOL_UDP:
3571 case NAT_PROTOCOL_TCP:
3585 if (!clib_bihash_search_8_8
3591 next_worker_index = m->
workers[0];
3609 next_worker_index +=
3616 return next_worker_index;
3639 .ip4.as_u32 = eh_addr->
as_u32,
3646 (sm->
addresses, thread_index, *out_addr, out_port, proto))
3663 s->out2in.addr.as_u32 = out_addr->
as_u32;
3664 s->out2in.port = out_port;
3665 s->nat_proto =
proto;
3666 s->last_heard = now;
3668 s->ext_host_addr.as_u32 = eh_addr->
as_u32;
3669 s->ext_host_port = eh_port;
3688 s->out2in.fib_index = outside_fib->
fib_index;
3697 if (clib_bihash_add_del_8_8 (&tsm->
out2in, &kv, 1))
3700 s->in2out.addr.as_u32 = in_addr->
as_u32;
3701 s->in2out.port = in_port;
3702 s->in2out.fib_index = fib_index;
3704 if (clib_bihash_add_del_8_8 (&tsm->
in2out, &kv, 1))
3722 (sm->
workers[(clib_net_to_host_u16 (out_port) -
3728 init_nat_k (&kv, *out_addr, out_port, fib_index, proto);
3729 if (clib_bihash_search_8_8 (&tsm->
out2in, &kv, &value))
3740 u32 total_pkts,
u64 total_bytes,
u32 thread_index)
3749 init_nat_k (&kv, *out_addr, out_port, fib_index, proto);
3750 if (clib_bihash_search_8_8 (&tsm->
out2in, &kv, &value))
3754 s->total_pkts = total_pkts;
3755 s->total_bytes = total_bytes;
3777 .ip4.as_u32 = eh_addr->
as_u32,
3785 (sm->
addresses, thread_index, *out_addr, out_port, proto))
3792 (sm->
addresses, thread_index, *ehn_addr, ehn_port, proto))
3800 s->last_heard = now;
3802 s->ext_host_nat_addr.as_u32 = s->ext_host_addr.as_u32 = eh_addr->
as_u32;
3803 s->ext_host_nat_port = s->ext_host_port = eh_port;
3806 s->ext_host_nat_addr.as_u32 = ehn_addr->
as_u32;
3807 s->ext_host_nat_port = ehn_port;
3826 s->out2in.fib_index = outside_fib->
fib_index;
3834 s->nat_proto =
proto;
3835 s->out2in.addr.as_u32 = out_addr->
as_u32;
3836 s->out2in.port = out_port;
3838 s->in2out.addr.as_u32 = in_addr->
as_u32;
3839 s->in2out.port = in_port;
3840 s->in2out.fib_index = fib_index;
3842 init_ed_kv (&kv, *in_addr, in_port, s->ext_host_nat_addr,
3845 if (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &kv, 1))
3848 init_ed_kv (&kv, *out_addr, out_port, *eh_addr, eh_port,
3851 if (clib_bihash_add_del_16_8 (&sm->
out2in_ed, &kv, 1))
3869 (sm->
workers[(clib_net_to_host_u16 (out_port) -
3875 init_ed_k (&kv, *out_addr, out_port, *eh_addr, eh_port, fib_index, proto);
3876 if (clib_bihash_search_16_8 (&sm->
out2in_ed, &kv, &value))
3887 u32 fib_index,
u32 total_pkts,
u64 total_bytes,
3897 init_ed_k (&kv, *out_addr, out_port, *eh_addr, eh_port, fib_index, proto);
3898 if (clib_bihash_search_16_8 (&sm->
out2in_ed, &kv, &value))
3902 s->total_pkts = total_pkts;
3903 s->total_bytes = total_bytes;
3909 return 1 << (
max_log2 (n_elts >> 1) + 1);
3915 return n_buckets * (8 + kv_size * 4);
3922 u32 max_limit = 0,
len = 0;
3926 if (max_limit < sm->max_translations_per_fib[
len])
3939 if (len <= fib_index)
3967 sizeof (clib_bihash_16_8_t));
4006 clib_bihash_init_16_8 (&tsm->
in2out_ed,
"in2out-ed",
4009 clib_bihash_set_kvp_format_fn_16_8 (&tsm->
in2out_ed,
4015 clib_bihash_init_8_8 (&tsm->
in2out,
"in2out",
4019 clib_bihash_init_8_8 (&tsm->
out2in,
"out2in",
4042 clib_bihash_free_16_8 (&tsm->
in2out_ed);
4047 clib_bihash_free_8_8 (&tsm->
in2out);
4048 clib_bihash_free_8_8 (&tsm->
out2in);
4066 clib_bihash_init_16_8 (&sm->
out2in_ed,
"out2in-ed",
4071 clib_bihash_set_kvp_format_fn_16_8 (&sm->
out2in_ed,
4096 u32 static_mapping_buckets = 1024;
4097 uword static_mapping_memory_size = 64 << 20;
4099 u32 nat64_bib_buckets = 1024;
4100 u32 nat64_bib_memory_size = 128 << 20;
4102 u32 nat64_st_buckets = 2048;
4103 uword nat64_st_memory_size = 256 << 20;
4105 u32 max_users_per_thread = 0;
4106 u32 user_memory_size = 0;
4107 u32 max_translations_per_thread = 0;
4108 u32 translation_memory_size = 0;
4110 u32 max_translations_per_user = ~0;
4112 u32 outside_vrf_id = 0;
4113 u32 outside_ip6_vrf_id = 0;
4114 u32 inside_vrf_id = 0;
4115 u8 static_mapping_only = 0;
4116 u8 static_mapping_connection_tracking = 0;
4129 (input,
"max translations per thread %d",
4130 &max_translations_per_thread))
4132 else if (
unformat (input,
"udp timeout %d", &udp_timeout))
4134 else if (
unformat (input,
"icmp timeout %d", &icmp_timeout))
4136 else if (
unformat (input,
"tcp transitory timeout %d",
4137 &tcp_transitory_timeout));
4138 else if (
unformat (input,
"tcp established timeout %d",
4139 &tcp_established_timeout));
4140 else if (
unformat (input,
"translation hash memory %d",
4141 &translation_memory_size));
4144 (input,
"max users per thread %d", &max_users_per_thread))
4146 else if (
unformat (input,
"user hash memory %d", &user_memory_size))
4148 else if (
unformat (input,
"max translations per user %d",
4149 &max_translations_per_user))
4151 else if (
unformat (input,
"outside VRF id %d", &outside_vrf_id))
4153 else if (
unformat (input,
"outside ip6 VRF id %d", &outside_ip6_vrf_id))
4155 else if (
unformat (input,
"inside VRF id %d", &inside_vrf_id))
4157 else if (
unformat (input,
"static mapping only"))
4159 static_mapping_only = 1;
4160 if (
unformat (input,
"connection tracking"))
4161 static_mapping_connection_tracking = 1;
4163 else if (
unformat (input,
"nat64 bib hash buckets %d",
4164 &nat64_bib_buckets))
4166 else if (
unformat (input,
"nat64 bib hash memory %d",
4167 &nat64_bib_memory_size))
4170 if (
unformat (input,
"nat64 st hash buckets %d", &nat64_st_buckets))
4172 else if (
unformat (input,
"nat64 st hash memory %d",
4173 &nat64_st_memory_size))
4175 else if (
unformat (input,
"out2in dpo"))
4177 else if (
unformat (input,
"endpoint-dependent"))
4186 "static mapping only mode available only for simple nat");
4190 "out2in dpo mode available only for simple nat");
4194 "setting 'max users' in endpoint-dependent mode is not supported");
4200 "setting 'max translations per user' in endpoint-dependent mode is not supported");
4209 if (0 == max_users_per_thread)
4211 max_users_per_thread = 1024;
4216 if (0 == max_translations_per_thread)
4220 max_translations_per_thread = 10 * 1024;
4227 if (0 == translation_memory_size)
4229 translation_memory_size =
4231 sizeof (clib_bihash_16_8_t));
4234 if (0 == user_memory_size)
4238 sizeof (clib_bihash_8_8_t));
4257 nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
4258 nat64_st_memory_size);
4274 clib_bihash_init_16_8 (&sm->
out2in_ed,
"out2in-ed",
4279 clib_bihash_set_kvp_format_fn_16_8 (&sm->
out2in_ed,
4295 if (!static_mapping_only ||
4296 (static_mapping_only && static_mapping_connection_tracking))
4311 "static_mapping_by_local", static_mapping_buckets,
4312 static_mapping_memory_size);
4317 "static_mapping_by_external",
4318 static_mapping_buckets, static_mapping_memory_size);
4333 u32 if_address_index,
u32 is_delete)
4398 u32 if_address_index,
u32 is_delete)
4428 for (j = 0; j <
vec_len (addresses); j++)
4429 if (addresses[j].
addr.as_u32 == address->
as_u32)
4482 u32 *indices_to_delete = 0;
4484 u32 *auto_add_sw_if_indices =
4491 for (i = 0; i <
vec_len (auto_add_sw_if_indices); i++)
4493 if (auto_add_sw_if_indices[i] == sw_if_index)
4508 if (vec_len (indices_to_delete))
4510 for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
4521 return VNET_API_ERROR_VALUE_EXIST;
4528 return VNET_API_ERROR_NO_SUCH_ENTRY;
4552 clib_bihash_8_8_t *t;
4555 return VNET_API_ERROR_UNSUPPORTED;
4565 init_nat_k (&kv, *addr, port, fib_index, proto);
4566 t = is_in ? &tsm->in2out : &tsm->out2in;
4567 if (!clib_bihash_search_8_8 (t, &kv, &value))
4570 return VNET_API_ERROR_UNSPECIFIED;
4578 return VNET_API_ERROR_NO_SUCH_ENTRY;
4587 clib_bihash_16_8_t *t;
4594 return VNET_API_ERROR_FEATURE_DISABLED;
4604 t = is_in ? &tsm->in2out_ed : &sm->
out2in_ed;
4605 init_ed_k (&kv, *addr, port, *eh_addr, eh_port, fib_index, proto);
4606 if (clib_bihash_search_16_8 (t, &kv, &value))
4608 return VNET_API_ERROR_NO_SUCH_ENTRY;
4612 return VNET_API_ERROR_UNSPECIFIED;
4660 .name =
"nat-default",
4661 .vector_size =
sizeof (
u32),
ip4_address_t external_addr
vlib_log_class_t vlib_log_register_class(char *class, char *subclass)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
clib_error_t * snat_api_init(vlib_main_t *vm, snat_main_t *sm)
fib_protocol_t fp_proto
protocol type
static void snat_update_outside_fib(u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
#define NAT_STATIC_MAPPING_FLAG_EXACT_ADDRESS
nat_outside_fib_t * outside_fibs
enum fib_source_t_ fib_source_t
The different sources that can create a route.
uword translation_memory_size
u32 * max_translations_per_fib
#define snat_is_session_static(s)
Check if SNAT session is created from static mapping.
u32 sessions_per_user_list_head_index
void nat44_db_init(snat_main_per_thread_data_t *tsm)
Initialize NAT44 data.
int snat_alloc_outside_address_and_port(snat_address_t *addresses, u32 fib_index, u32 thread_index, nat_protocol_t proto, ip4_address_t *addr, u16 *port, u16 port_per_thread, u32 snat_thread_index)
Alloc outside address and port.
vlib_node_registration_t nat_default_node
(constructor) VLIB_REGISTER_NODE (nat_default_node)
static u64 calc_nat_key(ip4_address_t addr, u16 port, u32 fib_index, u8 proto)
The NAT inline functions.
vlib_node_registration_t nat44_ed_in2out_output_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_output_node)
#define nat_elog_debug_handoff(_str, _tid, _fib, _src, _dst)
clib_bihash_16_8_t out2in_ed
ip4_table_bind_function_t * function
int nat_affinity_create_and_lock(ip4_address_t client_addr, ip4_address_t service_addr, u8 proto, u16 service_port, u8 backend_index, u32 sticky_time, u32 affinity_per_service_list_head_index)
Create affinity record and take reference counting lock.
int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat)
Delete external address from NAT44 pool.
u32 hairpin_dst_node_index
static void nat_validate_counters(snat_main_t *sm, u32 sw_if_index)
ip4_add_del_interface_address_callback_t * add_del_interface_address_callbacks
Functions to call when interface address changes.
u32 ed_hairpinning_node_index
u32 icmp_match_out2in_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
vl_api_wireguard_peer_flags_t flags
static void clib_dlist_init(dlist_elt_t *pool, u32 index)
int ip4_sv_reass_enable_disable_with_refcnt(u32 sw_if_index, int is_enable)
static int nat_set_outside_address_and_port(snat_address_t *addresses, u32 thread_index, ip4_address_t addr, u16 port, nat_protocol_t protocol)
int nat44_del_session(snat_main_t *sm, ip4_address_t *addr, u16 port, nat_protocol_t proto, u32 vrf_id, int is_in)
Delete NAT44 session.
vnet_main_t * vnet_get_main(void)
#define nat_elog_info(nat_elog_str)
u32 fq_in2out_output_index
#define nat_elog_notice(nat_elog_str)
#define pool_alloc(P, N)
Allocate N more free elements to pool (unspecified alignment).
#define SNAT_TCP_ESTABLISHED_TIMEOUT
static clib_error_t * nat_ip_table_add_del(vnet_main_t *vnm, u32 table_id, u32 is_add)
static void init_nat_i2o_kv(clib_bihash_kv_8_8_t *kv, snat_session_t *s, u64 value)
#define is_ed_session(s)
Check if NAT session is endpoint dependent.
static_always_inline int get_icmp_o2i_ed_key(vlib_buffer_t *b, ip4_header_t *ip0, u32 rx_fib_index, u32 thread_index, u32 session_index, nat_protocol_t *nat_proto, u16 *l_port, u16 *r_port, clib_bihash_kv_16_8_t *kv)
static u32 nat44_ed_get_worker_out2in_cb(vlib_buffer_t *b, ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
ip4_address_t * ip4_interface_first_address(ip4_main_t *im, u32 sw_if_index, ip_interface_address_t **result_ia)
static f64 vlib_time_now(vlib_main_t *vm)
u32 fib_table_get_index_for_sw_if_index(fib_protocol_t proto, u32 sw_if_index)
Get the index of the FIB bound to the interface.
per_vrf_sessions_t * per_vrf_sessions_vec
u32 vlib_frame_queue_main_init(u32 node_index, u32 frame_queue_nelts)
void nat_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 session data (lookup keys, external address port)
add paths without path extensions
int ip4_sv_reass_output_enable_disable_with_refcnt(u32 sw_if_index, int is_enable)
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
void nat_ha_sref_ed_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 total_pkts, u64 total_bytes, u32 thread_index)
u32 ed_out2in_slowpath_node_index
#define vec_add2(V, P, N)
Add N elements to end of vector V, return pointer to new elements in P.
#define NAT_INTERFACE_FLAG_IS_OUTSIDE
static uword * clib_bitmap_set(uword *ai, uword i, uword value)
Sets the ith bit of a bitmap to new_value Removes trailing zeros from the bitmap. ...
u8 * format_user_kvp(u8 *s, va_list *args)
ip_lookup_main_t lookup_main
static void init_nat_i2o_k(clib_bihash_kv_8_8_t *kv, snat_session_t *s)
void snat_static_mapping_del_sessions(snat_main_t *sm, snat_main_per_thread_data_t *tsm, snat_user_key_t u_key, int addr_only, ip4_address_t e_addr, u16 e_port)
#define nat_elog_warn(nat_elog_str)
int nat44_del_ed_session(snat_main_t *sm, ip4_address_t *addr, u16 port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 vrf_id, int is_in)
Delete NAT44 endpoint-dependent session.
static void vlib_increment_simple_counter(vlib_simple_counter_main_t *cm, u32 thread_index, u32 index, u64 increment)
Increment a simple counter.
format_function_t format_snat_key
void snat_add_del_addr_to_fib(ip4_address_t *addr, u8 p_len, u32 sw_if_index, int is_add)
Add/del NAT address to FIB.
#define VLIB_NODE_FN(node)
static void nat_ed_session_delete(snat_main_t *sm, snat_session_t *ses, u32 thread_index, int lru_delete)
static void init_ed_kv(clib_bihash_kv_16_8_t *kv, ip4_address_t l_addr, u16 l_port, ip4_address_t r_addr, u16 r_port, u32 fib_index, u8 proto, u32 thread_index, u32 session_index)
nat_alloc_out_addr_and_port_function_t * alloc_addr_and_port
static void snat_ip4_add_del_interface_address_cb(ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address, u32 address_length, u32 if_address_index, u32 is_delete)
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
#define snat_is_unk_proto_session(s)
Check if SNAT session for unknown protocol.
u32 max_translations_per_thread
void nat44_db_free(snat_main_per_thread_data_t *tsm)
Free NAT44 data.
vlib_simple_counter_main_t hairpinning
int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 feature on the interface.
VNET_FEATURE_INIT(nat_pre_in2out, static)
nat44_lb_addr_port_t * locals
static void split_nat_key(u64 key, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto)
clib_bihash_8_8_t user_hash
snat_session_t * nat_session_alloc_or_recycle(snat_main_t *sm, snat_user_t *u, u32 thread_index, f64 now)
Allocate new NAT session or recycle last used.
#define NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY
fib_node_index_t fib_table_entry_update_one_path(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source, fib_entry_flag_t flags, dpo_proto_t next_hop_proto, const ip46_address_t *next_hop, u32 next_hop_sw_if_index, u32 next_hop_fib_index, u32 next_hop_weight, fib_mpls_label_t *next_hop_labels, fib_route_path_flags_t path_flags)
Update the entry to have just one path.
u32 max_translations_per_user
void nat_ha_sadd_cb(ip4_address_t *in_addr, u16 in_port, ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, ip4_address_t *ehn_addr, u16 ehn_port, u8 proto, u32 fib_index, u16 flags, u32 thread_index)
void update_per_vrf_sessions_vec(u32 fib_index, int is_del)
u32 in2out_output_node_index
vl_api_ip_proto_t protocol
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
snat_get_worker_out2in_function_t * worker_out2in_cb
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
static nat_protocol_t ip_proto_to_nat_proto(u8 ip_proto)
Common NAT inline functions.
#define VLIB_INIT_FUNCTION(x)
vlib_node_registration_t snat_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_node)
void nat_syslog_nat44_apmdel(u32 ssubix, u32 sfibix, ip4_address_t *isaddr, u16 isport, ip4_address_t *xsaddr, u16 xsport, nat_protocol_t proto)
u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation and create session if needed...
void fib_table_entry_special_remove(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source)
Remove a 'special' entry from the FIB.
u8 * format_static_mapping_kvp(u8 *s, va_list *args)
int snat_static_mapping_match(snat_main_t *sm, ip4_address_t match_addr, u16 match_port, u32 match_fib_index, nat_protocol_t match_protocol, ip4_address_t *mapping_addr, u16 *mapping_port, u32 *mapping_fib_index, u8 by_external, u8 *is_addr_only, twice_nat_type_t *twice_nat, lb_nat_type_t *lb, ip4_address_t *ext_host_addr, u8 *is_identity_nat, snat_static_mapping_t **out)
Match NAT44 static mapping.
void nat_ha_sadd_ed_cb(ip4_address_t *in_addr, u16 in_port, ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, ip4_address_t *ehn_addr, u16 ehn_port, u8 proto, u32 fib_index, u16 flags, u32 thread_index)
int snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
Add external address to NAT44 pool.
static void init_nat_o2i_kv(clib_bihash_kv_8_8_t *kv, snat_session_t *s, u64 value)
u8 * format_ed_session_kvp(u8 *s, va_list *args)
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
Aggregate type for a prefix.
static_always_inline u8 icmp_type_is_error_message(u8 icmp_type)
#define clib_error_return(e, args...)
#define is_fwd_bypass_session(s)
Check if NAT session is forwarding bypass.
static u32 snat_get_worker_in2out_cb(ip4_header_t *ip0, u32 rx_fib_index0, u8 is_output)
static void init_nat_o2i_k(clib_bihash_kv_8_8_t *kv, snat_session_t *s)
static int nat_alloc_addr_and_port_default(snat_address_t *addresses, u32 fib_index, u32 thread_index, nat_protocol_t proto, ip4_address_t *addr, u16 *port, u16 port_per_thread, u32 snat_thread_index)
static void split_ed_kv(clib_bihash_kv_16_8_t *kv, ip4_address_t *l_addr, ip4_address_t *r_addr, u8 *proto, u32 *fib_index, u16 *l_port, u16 *r_port)
void snat_ipfix_logging_init(vlib_main_t *vm)
Initialize NAT plugin IPFIX logging.
static void * ip4_next_header(ip4_header_t *i)
void snat_ipfix_logging_addresses_exhausted(u32 thread_index, u32 pool_id)
Generate NAT addresses exhausted event.
u32 fib_table_find(fib_protocol_t proto, u32 table_id)
Get the index of the FIB for a Table-ID.
void nat_ha_sdel_ed_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 ti)
fib_node_index_t fib_table_lookup(u32 fib_index, const fib_prefix_t *prefix)
Perfom a longest prefix match in the non-forwarding table.
static void nat_ip4_add_del_addr_only_sm_cb(ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address, u32 address_length, u32 if_address_index, u32 is_delete)
void nat_affinity_unlock(ip4_address_t client_addr, ip4_address_t service_addr, u8 proto, u16 service_port)
Release a reference counting lock for affinity.
fib_source_t fib_source_allocate(const char *name, fib_source_priority_t prio, fib_source_behaviour_t bh)
static void nat44_delete_session(snat_main_t *sm, snat_session_t *ses, u32 thread_index)
char * name
The counter collection's name.
vl_api_fib_path_type_t type
int nat44_set_session_limit(u32 session_limit, u32 vrf_id)
Set NAT44 session limit (session limit, vrf id)
twice_nat_type_t twice_nat
static u32 snat_get_worker_out2in_cb(vlib_buffer_t *b, ip4_header_t *ip0, u32 rx_fib_index0, u8 is_output)
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
u32 * auto_add_sw_if_indices_twice_nat
vlib_node_registration_t nat44_ed_out2in_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_out2in_node)
snat_user_t * nat_user_get_or_create(snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index)
Find or create NAT user.
#define clib_bitmap_foreach(i, ai, body)
Macro to iterate across set bits in a bitmap.
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
void nat_dpo_module_init(void)
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg
#define FIB_SOURCE_PRIORITY_HI
Some priority values that plugins might use when they are not to concerned where in the list they'll ...
static uword clib_bitmap_last_set(uword *ai)
Return the higest numbered set bit in a bitmap.
void nat_ha_sdel_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 ti)
IPv4 shallow virtual reassembly.
void nat_ha_sref_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 total_pkts, u64 total_bytes, u32 thread_index)
u32 nat44_get_max_session_limit()
static void clib_dlist_addtail(dlist_elt_t *pool, u32 head_index, u32 new_index)
u32 pre_in2out_node_index
static u32 ed_value_get_session_index(clib_bihash_kv_16_8_t *value)
snat_static_mapping_t * static_mappings
struct snat_main_s::@91 counters
#define pool_put(P, E)
Free an object E in pool P.
#define vec_dup(V)
Return copy of vector (no header, no alignment)
#define VLIB_CONFIG_FUNCTION(x, n,...)
static void snat_add_static_mapping_when_resolved(snat_main_t *sm, ip4_address_t l_addr, u16 l_port, u32 sw_if_index, u16 e_port, u32 vrf_id, nat_protocol_t proto, int addr_only, int is_add, u8 *tag, int twice_nat, int out2in_only, int identity_nat, ip4_address_t pool_addr, int exact)
#define vec_del1(v, i)
Delete the element at index I.
u32 hairpin_src_node_index
clib_bihash_8_8_t static_mapping_by_external
u32 in2out_slowpath_output_node_index
vl_api_address_union_t src_address
static void vlib_set_simple_counter(vlib_simple_counter_main_t *cm, u32 thread_index, u32 index, u64 value)
Set a simple counter.
static_always_inline int nat_ed_lru_insert(snat_main_per_thread_data_t *tsm, snat_session_t *s, f64 now, u8 proto)
void nat_set_alloc_addr_and_port_default(void)
Set address and port assignment algorithm to default/standard.
static void init_nat_k(clib_bihash_kv_8_8_t *kv, ip4_address_t addr, u16 port, u32 fib_index, nat_protocol_t proto)
void fib_table_unlock(u32 fib_index, fib_protocol_t proto, fib_source_t source)
Take a reference counting lock on the table.
static_always_inline snat_session_t * nat_ed_session_alloc(snat_main_t *sm, u32 thread_index, f64 now, u8 proto)
#define is_lb_session(s)
Check if NAT session is load-balancing.
u8 translation_memory_size_set
u32 fib_entry_get_resolving_interface(fib_node_index_t entry_index)
snat_interface_t * output_feature_interfaces
void snat_ed_static_mapping_del_sessions(snat_main_t *sm, snat_main_per_thread_data_t *tsm, ip4_address_t l_addr, u16 l_port, u8 protocol, u32 fib_index, int addr_only, ip4_address_t e_addr, u16 e_port)
u32 pre_out2in_node_index
u32 ed_hairpin_src_node_index
void expire_per_vrf_sessions(u32 fib_index)
#define pool_free(p)
Free a pool.
void nat64_set_hash(u32 bib_buckets, uword bib_memory_size, u32 st_buckets, uword st_memory_size)
Set NAT64 hash tables configuration.
static void nat44_delete_user_with_no_session(snat_main_t *sm, snat_user_t *u, u32 thread_index)
#define is_affinity_sessions(s)
Check if NAT session has affinity record.
#define VLIB_REGISTER_NODE(x,...)
#define NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT
u32 nat_affinity_get_per_service_list_head_index(void)
Get new affinity per service list head index.
static_always_inline uword vlib_get_thread_index(void)
u32 icmp_match_in2out_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation.
fib_source_t nat_fib_src_low
void nat44_add_del_address_dpo(ip4_address_t addr, u8 is_add)
Add/delete external address to FIB DPO (out2in DPO mode)
vlib_node_registration_t snat_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_node)
sll srl srl sll sra u16x4 i
u8 static_mapping_connection_tracking
#define vec_free(V)
Free vector's memory (no header).
void fib_table_entry_delete(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source)
Delete a FIB entry.
ip4_add_del_interface_address_function_t * function
int nat_affinity_find_and_lock(ip4_address_t client_addr, ip4_address_t service_addr, u8 proto, u16 service_port, u8 *backend_index)
Find service backend index for client-IP and take a reference counting lock.
u32 ed_in2out_slowpath_node_index
int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 output feature on the interface (postrouting NAT)
#define nat_elog_notice_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
static void snat_ip4_table_bind(ip4_main_t *im, uword opaque, u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
u8 * format_session_kvp(u8 *s, va_list *args)
u32 fib_node_index_t
A typedef of a node index.
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
static u32 ip4_fib_index_from_table_id(u32 table_id)
static void init_nat_kv(clib_bihash_kv_8_8_t *kv, ip4_address_t addr, u16 port, u32 fib_index, nat_protocol_t proto, u64 value)
8 octet key, 8 octet key value pair
u32 ed_hairpin_dst_node_index
int nat44_update_session_limit(u32 session_limit, u32 vrf_id)
Update NAT44 session limit flushing all data (session limit, vrf id)
fib_source_t nat_fib_src_hi
u32 tcp_transitory_timeout
#define foreach_nat_counter
vlib_main_t vlib_node_runtime_t * node
void fib_table_lock(u32 fib_index, fib_protocol_t proto, fib_source_t source)
Release a reference counting lock on the table.
u32 * auto_add_sw_if_indices
u32 in2out_fast_node_index
void nat44_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 ED session data (lookup keys, external address port)
fib_node_index_t fib_table_entry_special_dpo_add(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source, fib_entry_flag_t flags, const dpo_id_t *dpo)
Add a 'special' entry to the FIB that links to the DPO passed A special entry is an entry that the FI...
void vlib_validate_simple_counter(vlib_simple_counter_main_t *cm, u32 index)
validate a simple counter
void nat_syslog_nat44_sdel(u32 ssubix, u32 sfibix, ip4_address_t *isaddr, u16 isport, ip4_address_t *idaddr, u16 idport, ip4_address_t *xsaddr, u16 xsport, ip4_address_t *xdaddr, u16 xdport, nat_protocol_t proto, u8 is_twicenat)
static u32 nat_calc_bihash_memory(u32 n_buckets, uword kv_size)
#define NAT_INTERFACE_FLAG_IS_INSIDE
#define is_addr_only_static_mapping(sm)
Check if NAT static mapping is address only (1:1NAT).
manual_print typedef address
#define is_identity_static_mapping(sm)
Check if NAT static mapping is identity NAT.
static int nat_alloc_addr_and_port_range(snat_address_t *addresses, u32 fib_index, u32 thread_index, nat_protocol_t proto, ip4_address_t *addr, u16 *port, u16 port_per_thread, u32 snat_thread_index)
clib_error_t * nat_affinity_init(vlib_main_t *vm)
Initialize NAT client-IP based affinity.
u32 in2out_slowpath_node_index
snat_icmp_match_function_t * icmp_match_out2in_cb
static u32 nat_calc_bihash_buckets(u32 n_elts)
vlib_log_class_t log_class
#define SNAT_SESSION_FLAG_TWICE_NAT
void nat_set_alloc_addr_and_port_range(u16 start_port, u16 end_port)
Set address and port assignment algorithm for port range.
u32 fib_table_find_or_create_and_lock(fib_protocol_t proto, u32 table_id, fib_source_t src)
Get the index of the FIB for a Table-ID.
#define clib_bitmap_free(v)
Free a bitmap.
static void vlib_zero_simple_counter(vlib_simple_counter_main_t *cm, u32 index)
Clear a simple counter Clears the set of per-thread u16 counters, and the u64 counter.
uword * thread_registrations_by_name
void snat_ipfix_logging_nat44_ses_delete(u32 thread_index, u32 src_ip, u32 nat_src_ip, nat_protocol_t nat_proto, u16 src_port, u16 nat_src_port, u32 vrf_id)
Generate NAT44 session delete event.
vlib_node_registration_t nat44_ed_in2out_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_node)
#define FIB_SOURCE_PRIORITY_LOW
snat_address_t * twice_nat_addresses
#define VNET_FEATURES(...)
static vlib_main_t * vlib_get_main(void)
static clib_error_t * snat_init(vlib_main_t *vm)
void nat_ha_sdel(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 thread_index)
Create session delete HA event.
static uword is_pow2(uword x)
ip4_table_bind_callback_t * table_bind_callbacks
Functions to call when interface to table biding changes.
clib_error_t * nat64_init(vlib_main_t *vm)
Initialize NAT64.
NAT64 global declarations.
#define is_lb_static_mapping(sm)
Check if NAT static mapping is load-balancing.
u32 unk_proto_lru_head_index
char * stat_segment_name
Name in stat segment directory.
vlib_simple_counter_main_t total_users
#define nat_elog_err(nat_elog_str)
#define FIB_NODE_INDEX_INVALID
void nat44_sessions_clear()
int nat44_lb_static_mapping_add_del_local(ip4_address_t e_addr, u16 e_port, ip4_address_t l_addr, u16 l_port, nat_protocol_t proto, u32 vrf_id, u8 probability, u8 is_add)
static void user_session_increment(snat_main_t *sm, snat_user_t *u, u8 is_static)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
u32 hairpinning_node_index
u32 tcp_trans_lru_head_index
#define is_out2in_only_static_mapping(sm)
Check if NAT static mapping match only out2in direction.
static_always_inline u8 nat_proto_to_ip_proto(nat_protocol_t nat_proto)
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
static uword max_log2(uword x)
VLIB buffer representation.
u32 tcp_estab_lru_head_index
snat_main_per_thread_data_t * per_thread_data
void nat_affinity_flush_service(u32 affinity_per_service_list_head_index)
Flush all service affinity data.
#define DPO_INVALID
An initialiser for DPOs declared on the stack.
u32 affinity_per_service_list_head_index
snat_address_t * addresses
void nat_dpo_create(dpo_proto_t dproto, u32 aftr_index, dpo_id_t *dpo)
int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, u8 twice_nat)
Add/delete NAT44 pool address from specific interface.
u32 out2in_fast_node_index
u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation and create session if needed...
#define hash_get_mem(h, key)
#define SNAT_ICMP_TIMEOUT
snat_get_worker_in2out_function_t * worker_in2out_cb
snat_static_map_resolve_t * to_resolve
static void init_ed_k(clib_bihash_kv_16_8_t *kv, ip4_address_t l_addr, u16 l_port, ip4_address_t r_addr, u16 r_port, u32 fib_index, u8 proto)
static api_main_t * vlibapi_get_main(void)
static u32 random_u32(u32 *seed)
32-bit random number generator
#define SNAT_SESSION_FLAG_STATIC_MAPPING
ip4_main_t ip4_main
Global ip4 main structure.
static vlib_thread_main_t * vlib_get_thread_main()
static u32 get_thread_idx_by_port(u16 e_port)
void dpo_reset(dpo_id_t *dpo)
reset a DPO ID The DPO will be unlocked.
#define vec_foreach(var, vec)
Vector iterator.
vlib_node_registration_t snat_in2out_output_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_node)
f64 end
end of the time range
int nat44_add_del_lb_static_mapping(ip4_address_t e_addr, u16 e_port, nat_protocol_t proto, nat44_lb_addr_port_t *locals, u8 is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u32 affinity)
Add/delete static mapping with load-balancing (multiple backends)
int snat_set_workers(uword *bitmap)
Set NAT plugin workers.
int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, nat_protocol_t proto, int is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u8 identity_nat, ip4_address_t pool_addr, int exact)
Add/delete NAT44 static mapping.
#define is_twice_nat_session(s)
Check if NAT session is twice NAT.
clib_bihash_16_8_t in2out_ed
static int nat_alloc_addr_and_port_mape(snat_address_t *addresses, u32 fib_index, u32 thread_index, nat_protocol_t proto, ip4_address_t *addr, u16 *port, u16 port_per_thread, u32 snat_thread_index)
static clib_error_t * snat_config(vlib_main_t *vm, unformat_input_t *input)
static u32 nat44_ed_get_worker_in2out_cb(ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
#define pool_foreach_index(i, v, body)
Iterate pool by index.
void nat_set_alloc_addr_and_port_mape(u16 psid, u16 psid_offset, u16 psid_length)
Set address and port assignment algorithm for MAP-E CE.
void snat_free_outside_address_and_port(snat_address_t *addresses, u32 thread_index, ip4_address_t *addr, u16 port, nat_protocol_t protocol)
Free outside address and port pair.
u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation.
NAT plugin client-IP based session affinity for load-balancing.
u32 icmp_match_in2out_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b, ip4_header_t *ip, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
vlib_simple_counter_main_t total_sessions
#define SNAT_TCP_TRANSITORY_TIMEOUT
ip_lookup_main_t * ip4_lookup_main
#define NAT_STATIC_MAPPING_FLAG_LB
static int is_snat_address_used_in_static_mapping(snat_main_t *sm, ip4_address_t addr)
#define NAT_STATIC_MAPPING_FLAG_ADDR_ONLY
snat_session_t * sessions
snat_icmp_match_function_t * icmp_match_in2out_cb
clib_bihash_8_8_t static_mapping_by_local
static u32 ed_value_get_thread_index(clib_bihash_kv_16_8_t *value)
vl_api_interface_index_t sw_if_index
snat_interface_t * interfaces
void nat_ha_init(vlib_main_t *vm, nat_ha_sadd_cb_t sadd_cb, nat_ha_sdel_cb_t sdel_cb, nat_ha_sref_cb_t sref_cb)
Initialize NAT HA.
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
static_always_inline void per_vrf_sessions_unregister_session(snat_session_t *s, u32 thread_index)
VNET_IP_TABLE_ADD_DEL_FUNCTION(nat_ip_table_add_del)
void test_key_calc_split()
static u32 clib_dlist_remove_head(dlist_elt_t *pool, u32 head_index)
u32 tcp_established_timeout
vlib_simple_counter_main_t user_limit_reached
static uword pool_elts(void *v)
Number of active elements in a pool.