FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
nat.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file nat.c
17  * NAT plugin global declarations
18  */
19 #ifndef __included_nat_h__
20 #define __included_nat_h__
21 
22 #include <vnet/vnet.h>
23 #include <vnet/ip/ip.h>
24 #include <vnet/ethernet/ethernet.h>
25 #include <vnet/ip/icmp46_packet.h>
26 #include <vnet/api_errno.h>
27 #include <vnet/fib/fib_source.h>
28 #include <vppinfra/elog.h>
29 #include <vppinfra/bihash_8_8.h>
30 #include <vppinfra/bihash_16_8.h>
31 #include <vppinfra/dlist.h>
32 #include <vppinfra/error.h>
33 #include <vlibapi/api.h>
34 #include <vlib/log.h>
35 #include <vppinfra/bihash_16_8.h>
36 #include <nat/lib/lib.h>
37 #include <nat/lib/inlines.h>
38 
39 /* default session timeouts */
40 #define SNAT_UDP_TIMEOUT 300
41 #define SNAT_TCP_TRANSITORY_TIMEOUT 240
42 #define SNAT_TCP_ESTABLISHED_TIMEOUT 7440
43 #define SNAT_ICMP_TIMEOUT 60
44 
45 /* number of worker handoff frame queue elements */
46 #define NAT_FQ_NELTS 64
47 
48 /* NAT buffer flags */
49 #define SNAT_FLAG_HAIRPINNING (1 << 0)
50 
51 typedef enum
52 {
64 } nat_next_t;
65 
66 typedef struct
67 {
71 
72 /* user (internal host) key */
73 typedef struct
74 {
75  union
76  {
77  struct
78  {
81  };
83  };
85 
86 /* NAT API Configuration flags */
87 #define foreach_nat_config_flag \
88  _(0x01, IS_TWICE_NAT) \
89  _(0x02, IS_SELF_TWICE_NAT) \
90  _(0x04, IS_OUT2IN_ONLY) \
91  _(0x08, IS_ADDR_ONLY) \
92  _(0x10, IS_OUTSIDE) \
93  _(0x20, IS_INSIDE) \
94  _(0x40, IS_STATIC) \
95  _(0x80, IS_EXT_HOST_VALID) \
96 
97 typedef enum nat_config_flags_t_
98 {
99 #define _(n,f) NAT_API_##f = n,
101 #undef _
103 
104 /* External address and port allocation modes */
105 #define foreach_nat_addr_and_port_alloc_alg \
106  _(0, DEFAULT, "default") \
107  _(1, MAPE, "map-e") \
108  _(2, RANGE, "port-range")
109 
110 typedef enum
111 {
112 #define _(v, N, s) NAT_ADDR_AND_PORT_ALLOC_ALG_##N = v,
114 #undef _
116 
117 /* Session state */
118 #define foreach_snat_session_state \
119  _(0, UNKNOWN, "unknown") \
120  _(1, UDP_ACTIVE, "udp-active") \
121  _(2, TCP_SYN_SENT, "tcp-syn-sent") \
122  _(3, TCP_ESTABLISHED, "tcp-established") \
123  _(4, TCP_FIN_WAIT, "tcp-fin-wait") \
124  _(5, TCP_CLOSE_WAIT, "tcp-close-wait") \
125  _(6, TCP_CLOSING, "tcp-closing") \
126  _(7, TCP_LAST_ACK, "tcp-last-ack") \
127  _(8, TCP_CLOSED, "tcp-closed") \
128  _(9, ICMP_ACTIVE, "icmp-active")
129 
130 typedef enum
131 {
132 #define _(v, N, s) SNAT_SESSION_##N = v,
134 #undef _
136 
137 #define foreach_nat_in2out_ed_error \
138 _(UNSUPPORTED_PROTOCOL, "unsupported protocol") \
139 _(OUT_OF_PORTS, "out of ports") \
140 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
141 _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \
142 _(NON_SYN, "non-SYN packet try to create session") \
143 _(TCP_CLOSED, "drops due to TCP in transitory timeout")
144 
145 typedef enum
146 {
147 #define _(sym,str) NAT_IN2OUT_ED_ERROR_##sym,
149 #undef _
152 
153 #define foreach_nat_out2in_ed_error \
154 _(UNSUPPORTED_PROTOCOL, "unsupported protocol") \
155 _(OUT_OF_PORTS, "out of ports") \
156 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
157 _(NO_TRANSLATION, "no translation") \
158 _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \
159 _(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \
160 _(CANNOT_CREATE_USER, "cannot create NAT user") \
161 _(NON_SYN, "non-SYN packet try to create session") \
162 _(TCP_CLOSED, "drops due to TCP in transitory timeout")
163 
164 typedef enum
165 {
166 #define _(sym,str) NAT_OUT2IN_ED_ERROR_##sym,
168 #undef _
171 
172 
173 /* Endpoint dependent TCP session state */
174 #define NAT44_SES_I2O_FIN 1
175 #define NAT44_SES_O2I_FIN 2
176 #define NAT44_SES_I2O_FIN_ACK 4
177 #define NAT44_SES_O2I_FIN_ACK 8
178 #define NAT44_SES_I2O_SYN 16
179 #define NAT44_SES_O2I_SYN 32
180 #define NAT44_SES_RST 64
181 
182 /* Session flags */
183 #define SNAT_SESSION_FLAG_STATIC_MAPPING 1
184 #define SNAT_SESSION_FLAG_UNKNOWN_PROTO 2
185 #define SNAT_SESSION_FLAG_LOAD_BALANCING 4
186 #define SNAT_SESSION_FLAG_TWICE_NAT 8
187 #define SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT 16
188 #define SNAT_SESSION_FLAG_FWD_BYPASS 32
189 #define SNAT_SESSION_FLAG_AFFINITY 64
190 #define SNAT_SESSION_FLAG_OUTPUT_FEATURE 128
191 #define SNAT_SESSION_FLAG_EXACT_ADDRESS 256
192 
193 /* NAT interface flags */
194 #define NAT_INTERFACE_FLAG_IS_INSIDE 1
195 #define NAT_INTERFACE_FLAG_IS_OUTSIDE 2
196 
197 /* Static mapping flags */
198 #define NAT_STATIC_MAPPING_FLAG_ADDR_ONLY 1
199 #define NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY 2
200 #define NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT 4
201 #define NAT_STATIC_MAPPING_FLAG_LB 8
202 #define NAT_STATIC_MAPPING_FLAG_EXACT_ADDRESS 16
203 
204 /* *INDENT-OFF* */
205 typedef CLIB_PACKED(struct
206 {
207  // number of sessions in this vrf
208  u32 ses_count;
209 
210  u32 rx_fib_index;
211  u32 tx_fib_index;
212 
213  // is this vrf expired
214  u8 expired;
215 }) per_vrf_sessions_t;
216 /* *INDENT-ON* */
217 
218 /* *INDENT-OFF* */
219 typedef CLIB_PACKED(struct
220 {
221  /* Outside network tuple */
222  struct
223  {
225  u32 fib_index;
226  u16 port;
227  } out2in;
228 
229  /* Inside network tuple */
230  struct
231  {
233  u32 fib_index;
234  u16 port;
235  } in2out;
236 
237  nat_protocol_t nat_proto;
238 
239  /* Flags */
240  u32 flags;
241 
242  /* Per-user translations */
243  u32 per_user_index;
244  u32 per_user_list_head_index;
245 
246  /* head of LRU list in which this session is tracked */
247  u32 lru_head_index;
248  /* index in global LRU list */
249  u32 lru_index;
250  f64 last_lru_update;
251 
252  /* Last heard timer */
253  f64 last_heard;
254 
255  /* Last HA refresh */
256  f64 ha_last_refreshed;
257 
258  /* Counters */
259  u64 total_bytes;
260  u32 total_pkts;
261 
262  /* External host address and port */
263  ip4_address_t ext_host_addr;
264  u16 ext_host_port;
265 
266  /* External host address and port after translation */
267  ip4_address_t ext_host_nat_addr;
268  u16 ext_host_nat_port;
269 
270  /* TCP session state */
271  u8 state;
272  u32 i2o_fin_seq;
273  u32 o2i_fin_seq;
274  u64 tcp_closed_timestamp;
275 
276  /* user index */
277  u32 user_index;
278 
279  /* per vrf sessions index */
280  u32 per_vrf_sessions_index;
281 
282 }) snat_session_t;
283 /* *INDENT-ON* */
284 
285 typedef struct
286 {
292 } snat_user_t;
293 
294 typedef struct
295 {
298 /* *INDENT-OFF* */
299 #define _(N, i, n, s) \
300  u16 busy_##n##_ports; \
301  u16 * busy_##n##_ports_per_thread; \
302  u32 busy_##n##_port_refcounts[65535];
304 #undef _
305 /* *INDENT-ON* */
306 } snat_address_t;
307 
308 typedef struct
309 {
312 } nat_fib_t;
313 
314 typedef struct
315 {
319 
320 typedef struct
321 {
322  /* backend IP address */
324  /* backend port number */
326  /* probability of the backend to be randomly matched */
329  /* backend FIB table */
333 
334 typedef enum
335 {
336  /* twice-nat disabled */
338  /* twice-nat enabled */
340  /* twice-nat only when src IP equals dst IP after translation */
343 
344 typedef enum
345 {
346  /* no load-balancing */
348  /* load-balancing */
350  /* load-balancing with affinity */
352 } lb_nat_type_t;
353 
354 typedef struct
355 {
356  /* prefered pool address */
358  /* local IP address */
360  /* external IP address */
362  /* local port */
364  /* external port */
366  /* is twice-nat */
367  twice_nat_type_t twice_nat;
368  /* local FIB table */
371  /* protocol */
373  /* 0 = disabled, otherwise client IP affinity sticky time in seconds */
375  /* worker threads used by backends/local host */
377  /* opaque string tag */
378  u8 *tag;
379  /* backends for load-balancing mode */
381  /* affinity per service lis */
383  /* flags */
386 
387 typedef struct
388 {
392 
393 typedef struct
394 {
405  int is_add;
408  int exact;
409  u8 *tag;
411 
412 typedef struct
413 {
414  /* Main lookup tables */
415  clib_bihash_8_8_t out2in;
416  clib_bihash_8_8_t in2out;
417 
418  /* Endpoint dependent sessions lookup tables */
419  clib_bihash_16_8_t in2out_ed;
420 
421  /* Find-a-user => src address lookup */
422  clib_bihash_8_8_t user_hash;
423 
424  /* User pool */
426 
427  /* Session pool */
428  snat_session_t *sessions;
429 
430  /* Pool of doubly-linked list elements */
432 
433  /* LRU session list - head is stale, tail is fresh */
440 
441  /* NAT thread index */
443 
444  /* real thread index */
446 
447  per_vrf_sessions_t *per_vrf_sessions_vec;
448 
450 
451 struct snat_main_s;
452 
453 /* ICMP session match function */
456  u32 thread_index,
457  vlib_buffer_t * b0,
458  ip4_header_t * ip0,
460  u16 * port,
461  u32 * fib_index,
463  void *d, void *e,
464  u8 * dont_translate);
465 
466 /* Return worker thread index for given packet */
468  u32 rx_fib_index,
469  u8 is_output);
470 
472  ip4_header_t * ip,
473  u32 rx_fib_index,
474  u8 is_output);
475 
476 /* NAT address and port allocation function */
477 typedef int (nat_alloc_out_addr_and_port_function_t) (snat_address_t *
478  addresses,
479  u32 fib_index,
480  u32 thread_index,
483  u16 * port,
485  u32 snat_thread_index);
486 
487 #define foreach_nat_counter _ (tcp) _ (udp) _ (icmp) _ (other) _ (drops)
488 
489 typedef struct snat_main_s
490 {
491  /* ICMP session match functions */
494 
495  /* Thread settings */
502 
503  /* Per thread data */
505 
506  /* Find a static mapping by local */
507  clib_bihash_8_8_t static_mapping_by_local;
508 
509  /* Find a static mapping by external */
510  clib_bihash_8_8_t static_mapping_by_external;
511 
512  /* Static mapping pool */
514 
515  /* Endpoint-dependent out2in mappings */
516  clib_bihash_16_8_t out2in_ed;
517 
518  /* Interface pool */
521 
522  /* Vector of outside addresses */
523  snat_address_t *addresses;
524  /* Address and port allocation function */
526  /* Address and port allocation type */
527  nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg;
528  /* Port set parameters (MAP-E) */
532  /* Port range parameters */
535 
536  /* vector of fibs */
538 
539  /* vector of outside fibs */
541 
542  /* Vector of twice NAT addresses for external hosts */
543  snat_address_t *twice_nat_addresses;
544 
545  /* sw_if_indices whose intfc addresses should be auto-added */
548 
549  /* vector of interface address static mappings to resolve. */
551 
552  /* Randomize port allocation order */
554 
555  /* Worker handoff frame-queue index */
559 
560  /* node indexes */
562 
563  /* handoff fq nodes */
567 
568  /* respect feature arc nodes */
571 
583 
590 
591  /* If forwarding is enabled */
593 
594  /* Config parameters */
599 
600  /* Is translation memory size calculated or user defined */
602 
611 
616 
617  /* values of various timeouts */
618  // proto timeouts
623 
624  /* TCP MSS clamping */
626 
627  /* counters/gauges */
631 
632 #define _(x) vlib_simple_counter_main_t x;
633  struct
634  {
635  struct
636  {
637  struct
638  {
640  } in2out;
641 
642  struct
643  {
645  } out2in;
646 
647  struct
648  {
650  } in2out_ed;
651 
652  struct
653  {
655  } out2in_ed;
656  } fastpath;
657 
658  struct
659  {
660  struct
661  {
663  } in2out;
664 
665  struct
666  {
668  } out2in;
669 
670  struct
671  {
673  } in2out_ed;
674 
675  struct
676  {
678  } out2in_ed;
679  } slowpath;
680 
682  } counters;
683 #undef _
684 
685  /* API message ID base */
687 
688  /* log class */
690  /* logging level */
692 
693  /* convenience */
698 } snat_main_t;
699 
700 typedef struct
701 {
705 
706 typedef struct
707 {
711 
712 extern snat_main_t snat_main;
713 
714 // nat pre ed next_node feature classification
718 
728 
731 
732 /* format functions */
741 /* unformat functions */
743 
744 /** \brief Check if SNAT session is created from static mapping.
745  @param s SNAT session
746  @return 1 if SNAT session is created from static mapping otherwise 0
747 */
748 #define snat_is_session_static(s) (s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING)
749 
750 /** \brief Check if SNAT session for unknown protocol.
751  @param s SNAT session
752  @return 1 if SNAT session for unknown protocol otherwise 0
753 */
754 #define snat_is_unk_proto_session(s) (s->flags & SNAT_SESSION_FLAG_UNKNOWN_PROTO)
755 
756 /** \brief Check if NAT session is twice NAT.
757  @param s NAT session
758  @return 1 if NAT session is twice NAT
759 */
760 #define is_twice_nat_session(s) (s->flags & SNAT_SESSION_FLAG_TWICE_NAT)
761 
762 /** \brief Check if NAT session is load-balancing.
763  @param s NAT session
764  @return 1 if NAT session is load-balancing
765 */
766 #define is_lb_session(s) (s->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
767 
768 /** \brief Check if NAT session is forwarding bypass.
769  @param s NAT session
770  @return 1 if NAT session is load-balancing
771 */
772 #define is_fwd_bypass_session(s) (s->flags & SNAT_SESSION_FLAG_FWD_BYPASS)
773 
774 /** \brief Check if NAT session is endpoint dependent.
775  @param s NAT session
776  @return 1 if NAT session is endpoint dependent
777 */
778 #define is_ed_session(s) (s->flags & SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT)
779 
780 /** \brief Check if NAT session has affinity record.
781  @param s NAT session
782  @return 1 if NAT session has affinity record
783 */
784 #define is_affinity_sessions(s) (s->flags & SNAT_SESSION_FLAG_AFFINITY)
785 
786 /** \brief Check if exact pool address should be used.
787  @param s SNAT session
788  @return 1 if exact pool address or 0
789 */
790 #define is_exact_address_session(s) (s->flags & SNAT_SESSION_FLAG_EXACT_ADDRESS)
791 
792 /** \brief Check if NAT interface is inside.
793  @param i NAT interface
794  @return 1 if inside interface
795 */
796 #define nat_interface_is_inside(i) i->flags & NAT_INTERFACE_FLAG_IS_INSIDE
797 
798 /** \brief Check if NAT interface is outside.
799  @param i NAT interface
800  @return 1 if outside interface
801 */
802 #define nat_interface_is_outside(i) i->flags & NAT_INTERFACE_FLAG_IS_OUTSIDE
803 
804 /** \brief Check if NAT44 endpoint-dependent TCP session is closed.
805  @param s NAT session
806  @return 1 if session is closed
807 */
808 #define nat44_is_ses_closed(s) s->state == 0xf
809 
810 /** \brief Check if NAT static mapping is address only (1:1NAT).
811  @param sm NAT static mapping
812  @return 1 if 1:1NAT, 0 if 1:1NAPT
813 */
814 #define is_addr_only_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_ADDR_ONLY)
815 
816 /** \brief Check if NAT static mapping match only out2in direction.
817  @param sm NAT static mapping
818  @return 1 if rule match only out2in direction
819 */
820 #define is_out2in_only_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY)
821 
822 /** \brief Check if NAT static mapping is identity NAT.
823  @param sm NAT static mapping
824  @return 1 if identity NAT
825 */
826 #define is_identity_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT)
827 
828 /** \brief Check if NAT static mapping is load-balancing.
829  @param sm NAT static mapping
830  @return 1 if load-balancing
831 */
832 #define is_lb_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_LB)
833 
834 /** \brief Check if exact pool address should be used.
835  @param s SNAT session
836  @return 1 if exact pool address or 0
837 */
838 #define is_exact_address(s) (s->flags & NAT_STATIC_MAPPING_FLAG_EXACT_ADDRESS)
839 
840 /** \brief Check if client initiating TCP connection (received SYN from client)
841  @param t TCP header
842  @return 1 if client initiating TCP connection
843 */
844 always_inline bool
846 {
847  return (f & TCP_FLAG_SYN) && !(f & TCP_FLAG_ACK);
848 }
849 
850 /* logging */
851 #define nat_log_err(...) \
852  vlib_log(VLIB_LOG_LEVEL_ERR, snat_main.log_class, __VA_ARGS__)
853 #define nat_log_warn(...) \
854  vlib_log(VLIB_LOG_LEVEL_WARNING, snat_main.log_class, __VA_ARGS__)
855 #define nat_log_notice(...) \
856  vlib_log(VLIB_LOG_LEVEL_NOTICE, snat_main.log_class, __VA_ARGS__)
857 #define nat_log_info(...) \
858  vlib_log(VLIB_LOG_LEVEL_INFO, snat_main.log_class, __VA_ARGS__)
859 #define nat_log_debug(...)\
860  vlib_log(VLIB_LOG_LEVEL_DEBUG, snat_main.log_class, __VA_ARGS__)
861 
862 /* NAT API Logging Levels */
863 #define foreach_nat_log_level \
864  _(0x00, LOG_NONE) \
865  _(0x01, LOG_ERROR) \
866  _(0x02, LOG_WARNING) \
867  _(0x03, LOG_NOTICE) \
868  _(0x04, LOG_INFO) \
869  _(0x05, LOG_DEBUG)
870 
871 typedef enum nat_log_level_t_
872 {
873 #define _(n,f) SNAT_##f = n,
875 #undef _
877 
878 #define nat_elog(_level, _str) \
879 do \
880  { \
881  snat_main_t *sm = &snat_main; \
882  if (PREDICT_FALSE (sm->log_level >= _level)) \
883  { \
884  ELOG_TYPE_DECLARE (e) = \
885  { \
886  .format = "nat-msg " _str, \
887  .format_args = "", \
888  }; \
889  ELOG_DATA (&vlib_global_main.elog_main, e); \
890  } \
891  } while (0);
892 
893 #define nat_elog_addr(_level, _str, _addr) \
894 do \
895  { \
896  if (PREDICT_FALSE (sm->log_level >= _level)) \
897  { \
898  ELOG_TYPE_DECLARE (e) = \
899  { \
900  .format = "nat-msg " _str " %d.%d.%d.%d", \
901  .format_args = "i1i1i1i1", \
902  }; \
903  CLIB_PACKED(struct \
904  { \
905  u8 oct1; \
906  u8 oct2; \
907  u8 oct3; \
908  u8 oct4; \
909  }) *ed; \
910  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
911  ed->oct4 = _addr >> 24; \
912  ed->oct3 = _addr >> 16; \
913  ed->oct2 = _addr >> 8; \
914  ed->oct1 = _addr; \
915  } \
916  } while (0);
917 
918 #define nat_elog_debug_handoff(_str, _tid, _fib, _src, _dst) \
919 do \
920  { \
921  if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG)) \
922  { \
923  ELOG_TYPE_DECLARE (e) = \
924  { \
925  .format = "nat-msg " _str " ip src: %d.%d.%d.%d dst: %d.%d.%d.%d" \
926  " tid from: %d to: %d fib: %d", \
927  .format_args = "i1i1i1i1i1i1i1i1i4i4i4", \
928  }; \
929  CLIB_PACKED(struct \
930  { \
931  u8 src_oct1; \
932  u8 src_oct2; \
933  u8 src_oct3; \
934  u8 src_oct4; \
935  u8 dst_oct1; \
936  u8 dst_oct2; \
937  u8 dst_oct3; \
938  u8 dst_oct4; \
939  u32 ftid; \
940  u32 ttid; \
941  u32 fib; \
942  }) *ed; \
943  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
944  ed->src_oct1 = _src >> 24; \
945  ed->src_oct2 = _src >> 16; \
946  ed->src_oct3 = _src >> 8; \
947  ed->src_oct4 = _src; \
948  ed->dst_oct1 = _dst >> 24; \
949  ed->dst_oct2 = _dst >> 16; \
950  ed->dst_oct3 = _dst >> 8; \
951  ed->dst_oct4 = _dst; \
952  ed->ftid = vlib_get_thread_index (); \
953  ed->ttid = _tid; \
954  ed->fib = _fib; \
955  } \
956  } while (0);
957 
958 #define nat_elog_debug_handoff_v2(_str, _prt, _fib, _src, _dst) \
959 do \
960  { \
961  if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG)) \
962  { \
963  ELOG_TYPE_DECLARE (e) = \
964  { \
965  .format = "nat-msg " _str " ip_src:%d.%d.%d.%d ip_dst:%d.%d.%d.%d" \
966  " tid:%d prt:%d fib:%d", \
967  .format_args = "i1i1i1i1i1i1i1i1i4i4i4", \
968  }; \
969  CLIB_PACKED(struct \
970  { \
971  u8 src_oct1; \
972  u8 src_oct2; \
973  u8 src_oct3; \
974  u8 src_oct4; \
975  u8 dst_oct1; \
976  u8 dst_oct2; \
977  u8 dst_oct3; \
978  u8 dst_oct4; \
979  u32 tid; \
980  u32 prt; \
981  u32 fib; \
982  }) *ed; \
983  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
984  ed->src_oct1 = _src >> 24; \
985  ed->src_oct2 = _src >> 16; \
986  ed->src_oct3 = _src >> 8; \
987  ed->src_oct4 = _src; \
988  ed->dst_oct1 = _dst >> 24; \
989  ed->dst_oct2 = _dst >> 16; \
990  ed->dst_oct3 = _dst >> 8; \
991  ed->dst_oct4 = _dst; \
992  ed->tid = vlib_get_thread_index (); \
993  ed->prt = _prt; \
994  ed->fib = _fib; \
995  } \
996  } while (0);
997 
998 #define nat_elog_X1(_level, _fmt, _arg, _val1) \
999 do \
1000  { \
1001  snat_main_t *sm = &snat_main; \
1002  if (PREDICT_FALSE (sm->log_level >= _level)) \
1003  { \
1004  ELOG_TYPE_DECLARE (e) = \
1005  { \
1006  .format = "nat-msg " _fmt, \
1007  .format_args = _arg, \
1008  }; \
1009  CLIB_PACKED(struct \
1010  { \
1011  typeof (_val1) val1; \
1012  }) *ed; \
1013  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
1014  ed->val1 = _val1; \
1015  } \
1016  } while (0);
1017 
1018 #define nat_elog_notice(nat_elog_str) \
1019  nat_elog(SNAT_LOG_INFO, "[notice] " nat_elog_str)
1020 #define nat_elog_warn(nat_elog_str) \
1021  nat_elog(SNAT_LOG_WARNING, "[warning] " nat_elog_str)
1022 #define nat_elog_err(nat_elog_str) \
1023  nat_elog(SNAT_LOG_ERROR, "[error] " nat_elog_str)
1024 #define nat_elog_debug(nat_elog_str) \
1025  nat_elog(SNAT_LOG_DEBUG, "[debug] " nat_elog_str)
1026 #define nat_elog_info(nat_elog_str) \
1027  nat_elog(SNAT_LOG_INFO, "[info] " nat_elog_str)
1028 
1029 #define nat_elog_notice_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1030  nat_elog_X1(SNAT_LOG_NOTICE, "[notice] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1031 #define nat_elog_warn_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1032  nat_elog_X1(SNAT_LOG_WARNING, "[warning] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1033 #define nat_elog_err_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1034  nat_elog_X1(SNAT_LOG_ERROR, "[error] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1035 #define nat_elog_debug_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1036  nat_elog_X1(SNAT_LOG_DEBUG, "[debug] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1037 #define nat_elog_info_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1038  nat_elog_X1(SNAT_LOG_INFO, "[info] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1039 
1040 /* ICMP session match functions */
1042  u32 thread_index, vlib_buffer_t * b0,
1043  ip4_header_t * ip0, ip4_address_t * addr,
1044  u16 * port, u32 * fib_index,
1045  nat_protocol_t * proto, void *d, void *e,
1046  u8 * dont_translate);
1048  u32 thread_index, vlib_buffer_t * b0,
1049  ip4_header_t * ip0, ip4_address_t * addr,
1050  u16 * port, u32 * fib_index,
1051  nat_protocol_t * proto, void *d, void *e,
1052  u8 * dont_translate);
1054  u32 thread_index, vlib_buffer_t * b0,
1055  ip4_header_t * ip0, ip4_address_t * addr,
1056  u16 * port, u32 * fib_index,
1057  nat_protocol_t * proto, void *d, void *e,
1058  u8 * dont_translate);
1060  u32 thread_index, vlib_buffer_t * b0,
1061  ip4_header_t * ip0, ip4_address_t * addr,
1062  u16 * port, u32 * fib_index,
1063  nat_protocol_t * proto, void *d, void *e,
1064  u8 * dont_translate);
1065 
1066 /* ICMP endpoint-dependent session match functions */
1068  u32 thread_index, vlib_buffer_t * b0,
1069  ip4_header_t * ip0, ip4_address_t * addr,
1070  u16 * port, u32 * fib_index, nat_protocol_t * proto,
1071  void *d, void *e, u8 * dont_translate);
1073  u32 thread_index, vlib_buffer_t * b0,
1074  ip4_header_t * ip0, ip4_address_t * addr,
1075  u16 * port, u32 * fib_index, nat_protocol_t * proto,
1076  void *d, void *e, u8 * dont_translate);
1077 
1079  icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
1080  vlib_node_runtime_t * node, u32 next0, u32 thread_index,
1081  void *d, void *e);
1082 
1084  icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
1085  vlib_node_runtime_t * node, u32 next0, u32 thread_index,
1086  void *d, void *e);
1087 
1088 /* hairpinning functions */
1090  ip4_header_t * ip0, icmp46_header_t * icmp0,
1091  int is_ed);
1093  ip4_header_t * ip);
1095  ip4_header_t * ip);
1097  snat_main_t * sm, vlib_buffer_t * b0,
1098  ip4_header_t * ip0, udp_header_t * udp0,
1099  tcp_header_t * tcp0, u32 proto0, int is_ed,
1100  int do_trace);
1101 
1102 /* Call back functions for clib_bihash_add_or_overwrite_stale */
1107 
1108 /**
1109  * @brief Add external address to NAT44 pool
1110  *
1111  * @param sm snat global configuration data
1112  * @param addr IPv4 address
1113  * @param vrf_id VRF id of tenant, ~0 means independent of VRF
1114  * @param twice_nat 1 if twice NAT address
1115  *
1116  * @return 0 on success, non-zero value otherwise
1117  */
1119  u8 twice_nat);
1120 
1121 /**
1122  * @brief Delete external address from NAT44 pool
1123  *
1124  * @param sm snat global configuration data
1125  * @param addr IPv4 address
1126  * @param delete_sm 1 if delete static mapping using address
1127  * @param twice_nat 1 if twice NAT address
1128  *
1129  * @return 0 on success, non-zero value otherwise
1130  */
1131 int snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
1132  u8 twice_nat);
1133 
1134 /**
1135  * @brief Add/delete external address to FIB DPO (out2in DPO mode)
1136  *
1137  * @param addr IPv4 address
1138  * @param is_add 1 = add, 0 = delete
1139  *
1140  * @return 0 on success, non-zero value otherwise
1141  */
1142 void nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add);
1143 
1144 /**
1145  * @brief Add/delete NAT44 static mapping
1146  *
1147  * @param l_addr local IPv4 address
1148  * @param e_addr external IPv4 address
1149  * @param l_port local port number
1150  * @param e_port external port number
1151  * @param vrf_id local VRF ID
1152  * @param addr_only 1 = 1:1NAT, 0 = 1:1NAPT
1153  * @param sw_if_index use interface address as external IPv4 address
1154  * @param proto L4 protocol
1155  * @param is_add 1 = add, 0 = delete
1156  * @param twice_nat twice-nat mode
1157  * @param out2in_only if 1 rule match only out2in direction
1158  * @param tag opaque string tag
1159  * @param identity_nat identity NAT
1160  * @param pool_addr pool IPv4 address
1161  * @param exact 1 = exact pool address
1162  *
1163  * @return 0 on success, non-zero value otherwise
1164  */
1166  u16 l_port, u16 e_port, u32 vrf_id,
1167  int addr_only, u32 sw_if_index,
1168  nat_protocol_t proto, int is_add,
1169  twice_nat_type_t twice_nat, u8 out2in_only,
1170  u8 * tag, u8 identity_nat,
1171  ip4_address_t pool_addr, int exact);
1172 
1173 /**
1174  * @brief Add/delete static mapping with load-balancing (multiple backends)
1175  *
1176  * @param e_addr external IPv4 address
1177  * @param e_port external port number
1178  * @param proto L4 protocol
1179  * @param locals list of local backends
1180  * @param is_add 1 = add, 0 = delete
1181  * @param twice_nat twice-nat mode
1182  * @param out2in_only if 1 rule match only out2in direction
1183  * @param tag opaque string tag
1184  * @param affinity 0 = disabled, otherwise client IP affinity sticky time
1185  *
1186  * @return 0 on success, non-zero value otherwise
1187  */
1189  nat_protocol_t proto,
1190  nat44_lb_addr_port_t * locals, u8 is_add,
1191  twice_nat_type_t twice_nat,
1192  u8 out2in_only, u8 * tag, u32 affinity);
1193 
1195  ip4_address_t l_addr, u16 l_port,
1196  nat_protocol_t proto, u32 vrf_id,
1197  u8 probability, u8 is_add);
1198 
1200 
1201 /**
1202  * @brief Set NAT plugin workers
1203  *
1204  * @param bitmap NAT workers bitmap
1205  *
1206  * @return 0 on success, non-zero value otherwise
1207  */
1208 int snat_set_workers (uword * bitmap);
1209 
1210 /**
1211  * @brief Enable/disable NAT44 feature on the interface
1212  *
1213  * @param sw_if_index software index of the interface
1214  * @param is_inside 1 = inside, 0 = outside
1215  * @param is_del 1 = delete, 0 = add
1216  *
1217  * @return 0 on success, non-zero value otherwise
1218  */
1219 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del);
1220 
1221 /**
1222  * @brief Enable/disable NAT44 output feature on the interface (postrouting NAT)
1223  *
1224  * @param sw_if_index software index of the interface
1225  * @param is_inside 1 = inside, 0 = outside
1226  * @param is_del 1 = delete, 0 = add
1227  *
1228  * @return 0 on success, non-zero value otherwise
1229  */
1231  int is_del);
1232 
1233 /**
1234  * @brief Add/delete NAT44 pool address from specific interface
1235  *
1236  * @param sw_if_index software index of the interface
1237  * @param is_del 1 = delete, 0 = add
1238  * @param twice_nat 1 = twice NAT address for external hosts
1239  *
1240  * @return 0 on success, non-zero value otherwise
1241  */
1242 int snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
1243  u8 twice_nat);
1244 
1245 /**
1246  * @brief Delete NAT44 session
1247  *
1248  * @param addr IPv4 address
1249  * @param port L4 port number
1250  * @param proto L4 protocol
1251  * @param vrf_id VRF ID
1252  * @param is_in 1 = inside network address and port pair, 0 = outside
1253  *
1254  * @return 0 on success, non-zero value otherwise
1255  */
1256 int nat44_del_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
1257  nat_protocol_t proto, u32 vrf_id, int is_in);
1258 
1259 /**
1260  * @brief Delete NAT44 endpoint-dependent session
1261  *
1262  * @param sm snat global configuration data
1263  * @param addr IPv4 address
1264  * @param port L4 port number
1265  * @param proto L4 protocol
1266  * @param vrf_id VRF ID
1267  * @param is_in 1 = inside network address and port pair, 0 = outside
1268  *
1269  * @return 0 on success, non-zero value otherwise
1270  */
1271 int nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
1272  ip4_address_t * eh_addr, u16 eh_port, u8 proto,
1273  u32 vrf_id, int is_in);
1274 
1275 /**
1276  * @brief Free NAT44 session data (lookup keys, external address port)
1277  *
1278  * @param sm snat global configuration data
1279  * @param s NAT session
1280  * @param thread_index thread index
1281  * @param is_ha is HA event
1282  */
1283 void nat_free_session_data (snat_main_t * sm, snat_session_t * s,
1284  u32 thread_index, u8 is_ha);
1285 
1286 /**
1287  * @brief Set NAT44 session limit (session limit, vrf id)
1288  *
1289  * @param session_limit Session limit
1290  * @param vrf_id VRF id
1291  * @return 0 on success, non-zero value otherwise
1292  */
1293 int nat44_set_session_limit (u32 session_limit, u32 vrf_id);
1294 
1295 /**
1296  * @brief Update NAT44 session limit flushing all data (session limit, vrf id)
1297  *
1298  * @param session_limit Session limit
1299  * @param vrf_id VRF id
1300  * @return 0 on success, non-zero value otherwise
1301  */
1302 int nat44_update_session_limit (u32 session_limit, u32 vrf_id);
1303 /**
1304  * @brief Free NAT44 ED session data (lookup keys, external address port)
1305  *
1306  * @param s NAT session
1307  * @param thread_index thread index
1308  * @param is_ha is HA event
1309  */
1310 void
1311 nat44_free_session_data (snat_main_t * sm, snat_session_t * s,
1312  u32 thread_index, u8 is_ha);
1313 
1314 /**
1315  * @brief Initialize NAT44 data
1316  *
1317  * @param tsm per thread data
1318  */
1320 
1321 /**
1322  * @brief Free NAT44 data
1323  *
1324  * @param tsm per thread data
1325  */
1327 
1328 void nat44_sessions_clear ();
1329 
1330 /**
1331  * @brief Find or create NAT user
1332  *
1333  * @param sm snat global configuration data
1334  * @param addr IPv4 address
1335  * @param fib_index FIB table index
1336  * @param thread_index thread index
1337  *
1338  * @return NAT user data structure on success otherwise zero value
1339  */
1341  ip4_address_t * addr, u32 fib_index,
1342  u32 thread_index);
1343 
1344 /**
1345  * @brief Allocate new NAT session or recycle last used
1346  *
1347  * @param sm snat global configuration data
1348  * @param u NAT user
1349  * @param thread_index thread index
1350  * @param now time now
1351  *
1352  * @return session data structure on success otherwise zero value
1353  */
1354 snat_session_t *nat_session_alloc_or_recycle (snat_main_t * sm,
1355  snat_user_t * u,
1356  u32 thread_index, f64 now);
1357 
1358 /**
1359  * @brief Set address and port assignment algorithm for MAP-E CE
1360  *
1361  * @param psid Port Set Identifier value
1362  * @param psid_offset number of offset bits
1363  * @param psid_length length of PSID
1364  */
1366  u16 psid_length);
1367 
1368 /**
1369  * @brief Set address and port assignment algorithm for port range
1370  *
1371  * @param start_port beginning of the port range
1372  * @param end_port end of the port range
1373  */
1375 
1376 /**
1377  * @brief Set address and port assignment algorithm to default/standard
1378  */
1380 
1381 /**
1382  * @brief Free outside address and port pair
1383  *
1384  * @param addresses vector of outside addresses
1385  * @param thread_index thread index
1386  * @param key address, port and protocol
1387  */
1388 void
1389 snat_free_outside_address_and_port (snat_address_t * addresses,
1390  u32 thread_index,
1391  ip4_address_t * addr,
1392  u16 port, nat_protocol_t protocol);
1393 
1394 /**
1395  * @brief Alloc outside address and port
1396  *
1397  * @param addresses vector of outside addresses
1398  * @param fib_index FIB table index
1399  * @param thread_index thread index
1400  * @param port_per_thread number of ports per thread
1401  * @param snat_thread_index NAT thread index
1402  *
1403  * @return 0 on success, non-zero value otherwise
1404  */
1405 int snat_alloc_outside_address_and_port (snat_address_t * addresses,
1406  u32 fib_index,
1407  u32 thread_index,
1408  nat_protocol_t proto,
1409  ip4_address_t * addr,
1410  u16 * port,
1411  u16 port_per_thread,
1412  u32 snat_thread_index);
1413 
1414 void expire_per_vrf_sessions (u32 fib_index);
1415 
1416 /**
1417  * @brief Match NAT44 static mapping.
1418  *
1419  * @param key address and port to match
1420  * @param addr external/local address of the matched mapping
1421  * @param port port of the matched mapping
1422  * @param fib_index fib index of the matched mapping
1423  * @param by_external if 0 match by local address otherwise match by external
1424  * address
1425  * @param is_addr_only 1 if matched mapping is address only
1426  * @param twice_nat matched mapping is twice NAT type
1427  * @param lb 1 if matched mapping is load-balanced
1428  * @param ext_host_addr external host address
1429  * @param is_identity_nat 1 if indentity mapping
1430  * @param out if !=0 set to pointer of the mapping structure
1431  *
1432  * @returns 0 if match found otherwise 1.
1433  */
1435  ip4_address_t match_addr,
1436  u16 match_port,
1437  u32 match_fib_index,
1438  nat_protocol_t match_protocol,
1439  ip4_address_t * mapping_addr,
1440  u16 * mapping_port,
1441  u32 * mapping_fib_index,
1442  u8 by_external,
1443  u8 * is_addr_only,
1444  twice_nat_type_t * twice_nat,
1445  lb_nat_type_t * lb,
1446  ip4_address_t * ext_host_addr,
1447  u8 * is_identity_nat,
1448  snat_static_mapping_t ** out);
1449 
1450 /**
1451  * @brief Add/del NAT address to FIB.
1452  *
1453  * Add the external NAT address to the FIB as receive entries. This ensures
1454  * that VPP will reply to ARP for this address and we don't need to enable
1455  * proxy ARP on the outside interface.
1456  *
1457  * @param addr IPv4 address
1458  * @param plen address prefix length
1459  * @param sw_if_index software index of the outside interface
1460  * @param is_add 0 = delete, 1 = add.
1461  */
1463  u8 p_len, u32 sw_if_index, int is_add);
1464 
1465 /*
1466  * Why is this here? Because we don't need to touch this layer to
1467  * simply reply to an icmp. We need to change id to a unique
1468  * value to NAT an echo request/reply.
1469  */
1470 
1471 typedef struct
1472 {
1473  u16 identifier;
1474  u16 sequence;
1476 
1477 typedef struct
1478 {
1481 
1482 u8 *format_user_kvp (u8 * s, va_list * args);
1483 
1484 #endif /* __included_nat_h__ */
1485 /*
1486  * fd.io coding-style-patch-verification: ON
1487  *
1488  * Local Variables:
1489  * eval: (c-set-style "gnu")
1490  * End:
1491  */
ip4_address_t external_addr
Definition: nat.h:361
int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat)
Delete external address from NAT44 pool.
Definition: nat.c:1666
clib_error_t * snat_api_init(vlib_main_t *vm, snat_main_t *sm)
Definition: nat_api.c:2823
int snat_static_mapping_match(snat_main_t *sm, ip4_address_t match_addr, u16 match_port, u32 match_fib_index, nat_protocol_t match_protocol, ip4_address_t *mapping_addr, u16 *mapping_port, u32 *mapping_fib_index, u8 by_external, u8 *is_addr_only, twice_nat_type_t *twice_nat, lb_nat_type_t *lb, ip4_address_t *ext_host_addr, u8 *is_identity_nat, snat_static_mapping_t **out)
Match NAT44 static mapping.
Definition: nat.c:2815
#define foreach_nat_addr_and_port_alloc_alg
Definition: nat.h:105
nat_outside_fib_t * outside_fibs
Definition: nat.h:540
vlib_node_registration_t nat_default_node
(constructor) VLIB_REGISTER_NODE (nat_default_node)
Definition: nat.c:4659
enum fib_source_t_ fib_source_t
The different sources that can create a route.
uword translation_memory_size
Definition: nat.h:604
u32 * max_translations_per_fib
Definition: nat.h:606
nat_addr_and_port_alloc_alg_t
Definition: nat.h:110
dlist_elt_t * lru_pool
Definition: nat.h:434
u32 sessions_per_user_list_head_index
Definition: nat.h:289
clib_bihash_16_8_t out2in_ed
Definition: nat.h:516
int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 feature on the interface.
Definition: nat.c:1886
u32 icmp_out2in(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: out2in.c:520
u32 hairpin_dst_node_index
Definition: nat.h:585
void snat_free_outside_address_and_port(snat_address_t *addresses, u32 thread_index, ip4_address_t *addr, u16 port, nat_protocol_t protocol)
Free outside address and port pair.
Definition: nat.c:2740
u32 arc_next_index
Definition: nat.h:69
u32 ed_hairpinning_node_index
Definition: nat.h:587
u32 icmp_match_out2in_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Definition: out2in_ed.c:526
vl_api_wireguard_peer_flags_t flags
Definition: wireguard.api:103
u32 icmp_timeout
Definition: nat.h:622
int nat44_add_del_lb_static_mapping(ip4_address_t e_addr, u16 e_port, nat_protocol_t proto, nat44_lb_addr_port_t *locals, u8 is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u32 affinity)
Add/delete static mapping with load-balancing (multiple backends)
Definition: nat.c:1281
u32 fq_in2out_output_index
Definition: nat.h:557
u16 start_port
Definition: nat.h:533
#define TCP_FLAG_SYN
Definition: fa_node.h:13
u32 ed_out2in_node_index
Definition: nat.h:581
int() nat_alloc_out_addr_and_port_function_t(snat_address_t *addresses, u32 fib_index, u32 thread_index, nat_protocol_t proto, ip4_address_t *addr, u16 *port, u16 port_per_thread, u32 snat_thread_index)
Definition: nat.h:477
snat_session_t * nat_session_alloc_or_recycle(snat_main_t *sm, snat_user_t *u, u32 thread_index, f64 now)
Allocate new NAT session or recycle last used.
Definition: nat.c:505
u32 nsessions
Definition: nat.h:290
#define foreach_snat_session_state
Definition: nat.h:118
unsigned long u64
Definition: types.h:89
vl_api_ip_port_and_mask_t dst_port
Definition: flow_types.api:92
ip4_address_t addr
Definition: nat.h:323
int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, u8 twice_nat)
Add/delete NAT44 pool address from specific interface.
Definition: nat.c:4476
enum nat_log_level_t_ nat_log_level_t
per_vrf_sessions_t * per_vrf_sessions_vec
Definition: nat.h:447
u16 port_per_thread
Definition: nat.h:501
format_function_t format_nat_protocol
Definition: nat.h:739
u32 nstaticsessions
Definition: nat.h:291
u32 icmp_match_in2out_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation.
Definition: in2out.c:573
u32 ed_out2in_slowpath_node_index
Definition: nat.h:582
vlib_node_registration_t nat44_ed_in2out_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_node)
Definition: in2out_ed.c:1498
#define foreach_nat_in2out_ed_error
Definition: nat.h:137
nat_protocol_t proto
Definition: nat.h:372
u32() snat_icmp_match_function_t(struct snat_main_s *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Definition: nat.h:454
vlib_main_t * vm
Definition: in2out_ed.c:1582
int nat44_i2o_ed_is_idle_session_cb(clib_bihash_kv_16_8_t *kv, void *arg)
Definition: in2out_ed.c:76
u32 fib_index
Definition: nat.h:288
format_function_t format_snat_static_mapping
Definition: nat.h:734
format_function_t format_snat_key
Definition: nat.h:737
nat_protocol_t
Definition: lib.h:41
nat_log_level_t_
Definition: nat.h:871
nat_alloc_out_addr_and_port_function_t * alloc_addr_and_port
Definition: nat.h:525
NAT port/address allocation lib.
dlist_elt_t * list_pool
Definition: nat.h:431
struct _tcp_header tcp_header_t
int snat_hairpinning(vlib_main_t *vm, vlib_node_runtime_t *node, snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, udp_header_t *udp0, tcp_header_t *tcp0, u32 proto0, int is_ed, int do_trace)
u32 max_translations_per_thread
Definition: nat.h:605
vhost_vring_addr_t addr
Definition: vhost_user.h:111
vlib_simple_counter_main_t hairpinning
Definition: nat.h:681
unsigned char u8
Definition: types.h:56
struct snat_main_s::@91::@92::@95 out2in
u32 handoff_in2out_index
Definition: nat.h:565
nat44_lb_addr_port_t * locals
Definition: nat.h:380
int snat_set_workers(uword *bitmap)
Set NAT plugin workers.
Definition: nat.c:2337
nat_fib_t * fibs
Definition: nat.h:537
u32 user_buckets
Definition: nat.h:608
double f64
Definition: types.h:142
clib_bihash_8_8_t user_hash
Definition: nat.h:422
u32 cached_sw_if_index
Definition: nat.h:708
u32 next_index
Definition: nat.h:68
void nat_set_alloc_addr_and_port_mape(u16 psid, u16 psid_offset, u16 psid_length)
Set address and port assignment algorithm for MAP-E CE.
Definition: nat.c:4620
u8 *() format_function_t(u8 *s, va_list *args)
Definition: format.h:48
u32 max_translations_per_user
Definition: nat.h:610
clib_bihash_8_8_t in2out
Definition: nat.h:416
Definition: nat.h:63
vl_api_ip_proto_t protocol
Definition: lb_types.api:71
u32 in2out_output_node_index
Definition: nat.h:573
u32 ed_in2out_node_index
Definition: nat.h:577
u32 vlib_log_class_t
Definition: vlib.h:51
snat_get_worker_out2in_function_t * worker_out2in_cb
Definition: nat.h:500
vlib_node_registration_t snat_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_node)
Definition: out2in.c:1375
#define TCP_FLAG_ACK
Definition: fa_node.h:16
int nat44_set_session_limit(u32 session_limit, u32 vrf_id)
Set NAT44 session limit (session limit, vrf id)
Definition: nat.c:3933
u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation and create session if needed...
Definition: in2out.c:454
fib_source_t nat_fib_src_hi
Definition: dslite.c:22
u32 translation_buckets
Definition: nat.h:603
lb_nat_type_t
Definition: nat.h:344
ip4_address_t addr
Definition: nat.h:287
u8 probability
Definition: nat.api:943
void nat44_db_free(snat_main_per_thread_data_t *tsm)
Free NAT44 data.
Definition: nat.c:4033
struct snat_main_s::@91::@92::@94 in2out
int snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
Add external address to NAT44 pool.
Definition: nat.c:608
ip4_main_t * ip4_main
Definition: nat.h:695
void nat44_sessions_clear()
Definition: nat.c:4058
unsigned int u32
Definition: types.h:88
A collection of simple counters.
Definition: counter.h:57
vlib_node_registration_t snat_in2out_output_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_node)
Definition: in2out.c:1675
ip4_address_t local_addr
Definition: nat.h:359
vlib_node_registration_t snat_in2out_output_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_worker_handoff_node)
fib_source_t nat_fib_src_low
Definition: nat.c:42
u32() snat_get_worker_out2in_function_t(vlib_buffer_t *b, ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
Definition: nat.h:471
twice_nat_type_t twice_nat
Definition: nat.h:367
u32 * auto_add_sw_if_indices_twice_nat
Definition: nat.h:547
vlib_node_registration_t nat44_ed_out2in_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_out2in_node)
Definition: out2in_ed.c:1391
uword user_memory_size
Definition: nat.h:609
u32 fib_index
Definition: nat.h:316
u32 handoff_in2out_output_index
Definition: nat.h:566
nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg
Definition: nat.h:527
#define foreach_nat_out2in_ed_error
Definition: nat.h:153
vl_api_ip_proto_t proto
Definition: acl_types.api:50
u16 mss_clamping
Definition: nat.h:625
unsigned short u16
Definition: types.h:57
u32 pre_in2out_node_index
Definition: nat.h:570
u8 out2in_dpo
Definition: nat.h:597
snat_static_mapping_t * static_mappings
Definition: nat.h:513
u32 inside_fib_index
Definition: nat.h:615
struct snat_main_s::@91 counters
u32 udp_timeout
Definition: nat.h:619
u8 static_mapping_only
Definition: nat.h:595
int nat44_del_ed_session(snat_main_t *sm, ip4_address_t *addr, u16 port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 vrf_id, int is_in)
Delete NAT44 endpoint-dependent session.
Definition: nat.c:4582
nat_next_t
Definition: nat.h:51
void nat_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 session data (lookup keys, external address port)
Definition: nat.c:186
void nat_set_alloc_addr_and_port_default(void)
Set address and port assignment algorithm to default/standard.
Definition: nat.c:4643
#define always_inline
Definition: ipsec.h:28
void snat_add_del_addr_to_fib(ip4_address_t *addr, u8 p_len, u32 sw_if_index, int is_add)
Add/del NAT address to FIB.
Definition: nat.c:580
u32 hairpin_src_node_index
Definition: nat.h:586
clib_bihash_8_8_t static_mapping_by_external
Definition: nat.h:510
u32 in2out_slowpath_output_node_index
Definition: nat.h:576
u8 psid_offset
Definition: nat.h:529
struct snat_main_s snat_main_t
struct snat_main_s::@91::@93 slowpath
uword() unformat_function_t(unformat_input_t *input, va_list *args)
Definition: format.h:233
u32 handoff_out2in_index
Definition: nat.h:564
api_main_t * api_main
Definition: nat.h:697
u8 psid_length
Definition: nat.h:530
u32 refcount
Definition: nat.h:317
vnet_main_t * vnet_main
Definition: nat.h:694
u32 inside_vrf_id
Definition: nat.h:614
Definition: nat.h:349
u32 snat_icmp_hairpinning(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, int is_ed)
u8 translation_memory_size_set
Definition: nat.h:601
u8 log_level
Definition: nat.h:691
u32 fq_out2in_index
Definition: nat.h:558
API main structure, used by both vpp and binary API clients.
Definition: api_common.h:227
int nat44_o2i_is_idle_session_cb(clib_bihash_kv_8_8_t *kv, void *arg)
Definition: out2in.c:105
snat_interface_t * output_feature_interfaces
Definition: nat.h:520
u32 pre_out2in_node_index
Definition: nat.h:569
u32 ed_hairpin_src_node_index
Definition: nat.h:589
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
snat_main_t snat_main
Definition: nat.c:39
vl_api_ip_port_and_mask_t src_port
Definition: flow_types.api:91
snat_session_state_t
Definition: nat.h:130
snat_user_t * users
Definition: nat.h:425
foreach_nat_counter
Definition: nat.h:639
u32 max_users_per_thread
Definition: nat.h:607
u32 random_seed
Definition: nat.h:553
u32 fib_index
Definition: nat.h:310
clib_bihash_8_8_t out2in
Definition: nat.h:415
int nat44_o2i_ed_is_idle_session_cb(clib_bihash_kv_16_8_t *kv, void *arg)
Definition: out2in_ed.c:94
u32 outside_vrf_id
Definition: nat.h:612
u8 static_mapping_connection_tracking
Definition: nat.h:596
u16 end_port
Definition: nat.h:534
format_function_t format_snat_static_map_to_resolve
Definition: nat.h:735
u32 ed_in2out_slowpath_node_index
Definition: nat.h:578
u32 error_node_index
Definition: nat.h:561
u16 psid
Definition: nat.h:531
int nat44_lb_static_mapping_add_del_local(ip4_address_t e_addr, u16 e_port, ip4_address_t l_addr, u16 l_port, nat_protocol_t proto, u32 vrf_id, u8 probability, u8 is_add)
Definition: nat.c:1515
u32 outside_fib_index
Definition: nat.h:613
format_function_t format_nat_addr_and_port_alloc_alg
Definition: nat.h:740
void nat44_db_init(snat_main_per_thread_data_t *tsm)
Initialize NAT44 data.
Definition: nat.c:3975
8 octet key, 8 octet key value pair
Definition: bihash_8_8.h:39
u32 ed_hairpin_dst_node_index
Definition: nat.h:588
u32 sw_if_index
Definition: nat.h:389
#define foreach_nat_config_flag
Definition: nat.h:87
snat_user_t * nat_user_get_or_create(snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index)
Find or create NAT user.
Definition: nat.c:446
u32() snat_get_worker_in2out_function_t(ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
Definition: nat.h:467
nat_out2in_ed_error_t
Definition: nat.h:164
u32 tcp_transitory_timeout
Definition: nat.h:620
typedef CLIB_PACKED(struct { u32 ses_count;u32 rx_fib_index;u32 tx_fib_index;u8 expired;}) per_vrf_sessions_t
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1582
u32 * auto_add_sw_if_indices
Definition: nat.h:546
u32 in2out_fast_node_index
Definition: nat.h:574
void nat44_add_del_address_dpo(ip4_address_t addr, u8 is_add)
Add/delete external address to FIB DPO (out2in DPO mode)
Definition: nat.c:3177
unformat_function_t unformat_nat_protocol
Definition: nat.h:742
u32 num_workers
Definition: nat.h:496
Definition: nat.h:339
u32 first_worker_index
Definition: nat.h:497
ip4_address_t l_addr
Definition: nat.h:395
u32 in2out_slowpath_node_index
Definition: nat.h:575
snat_icmp_match_function_t * icmp_match_out2in_cb
Definition: nat.h:493
IPv4 main type.
Definition: ip4.h:106
vlib_log_class_t log_class
Definition: nat.h:689
u64 as_u64
Definition: nat.h:82
vlib_node_registration_t snat_out2in_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_worker_handoff_node)
ip4_address_t addr
Definition: nat.h:79
u32 fq_in2out_index
Definition: nat.h:556
u32 icmp_match_in2out_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Definition: in2out_ed.c:648
u32 out2in_node_index
Definition: nat.h:579
ip4_address_t addr
Definition: nat.h:296
int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, nat_protocol_t proto, int is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u8 identity_nat, ip4_address_t pool_addr, int exact)
Add/delete NAT44 static mapping.
Definition: nat.c:837
snat_address_t * twice_nat_addresses
Definition: nat.h:543
Definition: nat.h:308
format_function_t format_snat_session
Definition: nat.h:736
struct _vlib_node_registration vlib_node_registration_t
Definition: nat.h:347
vlib_simple_counter_main_t total_users
Definition: nat.h:628
int nat44_del_session(snat_main_t *sm, ip4_address_t *addr, u16 port, nat_protocol_t proto, u32 vrf_id, int is_in)
Delete NAT44 session.
Definition: nat.c:4544
struct snat_main_s::@91::@92 fastpath
void nat_hairpinning_sm_unknown_proto(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip)
vl_api_address_t ip
Definition: l2.api:501
format_function_t format_static_mapping_key
Definition: nat.h:738
u32 ref_count
Definition: nat.h:311
twice_nat_type_t
Definition: nat.h:334
u32 hairpinning_node_index
Definition: nat.h:584
u16 msg_id_base
Definition: nat.h:686
vlib_node_registration_t nat_pre_in2out_node
(constructor) VLIB_REGISTER_NODE (nat_pre_in2out_node)
Definition: in2out_ed.c:1596
VLIB buffer representation.
Definition: buffer.h:102
u32 * workers
Definition: nat.h:498
u64 uword
Definition: types.h:112
snat_main_per_thread_data_t * per_thread_data
Definition: nat.h:504
void expire_per_vrf_sessions(u32 fib_index)
Definition: nat.c:1827
int nat44_update_session_limit(u32 session_limit, u32 vrf_id)
Update NAT44 session limit flushing all data (session limit, vrf id)
Definition: nat.c:3952
int nat44_i2o_is_idle_session_cb(clib_bihash_kv_8_8_t *kv, void *arg)
Definition: in2out.c:189
ip4_address_t pool_addr
Definition: nat.h:357
u32 affinity_per_service_list_head_index
Definition: nat.h:382
u32 fib_index
Definition: nat.h:80
snat_address_t * addresses
Definition: nat.h:523
u16 port
Definition: lb_types.api:72
u32 out2in_fast_node_index
Definition: nat.h:580
u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation and create session if needed...
Definition: out2in.c:319
void nat_set_alloc_addr_and_port_range(u16 start_port, u16 end_port)
Set address and port assignment algorithm for port range.
Definition: nat.c:4632
u32 in2out_node_index
Definition: nat.h:572
format_function_t format_snat_user
Definition: nat.h:733
snat_get_worker_in2out_function_t * worker_in2out_cb
Definition: nat.h:499
snat_static_map_resolve_t * to_resolve
Definition: nat.h:550
u8 * format_user_kvp(u8 *s, va_list *args)
Definition: nat.c:3221
void nat44_ed_hairpinning_unknown_proto(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip)
vl_api_dhcp_client_state_t state
Definition: dhcp.api:201
vlib_node_registration_t snat_in2out_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_worker_handoff_node)
nat_config_flags_t_
Definition: nat.h:97
u8 forwarding_enabled
Definition: nat.h:592
int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 output feature on the interface (postrouting NAT)
Definition: nat.c:2137
nat_protocol_t proto
Definition: nat.h:401
u32 icmp_in2out(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: in2out.c:643
enum nat_config_flags_t_ nat_config_flags_t
clib_bihash_16_8_t in2out_ed
Definition: nat.h:419
u32 vrf_id
Definition: nat.api:944
u8 endpoint_dependent
Definition: nat.h:598
struct snat_main_s::@91::@92::@96 in2out_ed
vlib_node_registration_t snat_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_node)
Definition: in2out.c:1643
vlib_node_registration_t nat44_ed_in2out_output_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_output_node)
Definition: in2out_ed.c:1518
u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, ip4_address_t *addr, u16 *port, u32 *fib_index, nat_protocol_t *proto, void *d, void *e, u8 *dont_translate)
Get address and port values to be used for ICMP packet translation.
Definition: out2in.c:460
vlib_simple_counter_main_t total_sessions
Definition: nat.h:629
ip_lookup_main_t * ip4_lookup_main
Definition: nat.h:696
void nat44_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 ED session data (lookup keys, external address port)
Definition: nat.c:323
snat_session_t * sessions
Definition: nat.h:428
u32 cached_ip4_address
Definition: nat.h:709
snat_icmp_match_function_t * icmp_match_in2out_cb
Definition: nat.h:492
#define foreach_nat_log_level
Definition: nat.h:863
ip4_address_t pool_addr
Definition: nat.h:396
clib_bihash_8_8_t static_mapping_by_local
Definition: nat.h:507
u32 fib_index
Definition: nat.h:297
nat_in2out_ed_error_t
Definition: nat.h:145
vl_api_interface_index_t sw_if_index
Definition: wireguard.api:33
snat_interface_t * interfaces
Definition: nat.h:519
int snat_alloc_outside_address_and_port(snat_address_t *addresses, u32 fib_index, u32 thread_index, nat_protocol_t proto, ip4_address_t *addr, u16 *port, u16 port_per_thread, u32 snat_thread_index)
Alloc outside address and port.
Definition: nat.c:2975
vlib_node_registration_t nat_pre_out2in_node
(constructor) VLIB_REGISTER_NODE (nat_pre_out2in_node)
Definition: out2in_ed.c:1442
u32 tcp_established_timeout
Definition: nat.h:621
vlib_simple_counter_main_t user_limit_reached
Definition: nat.h:630
static bool tcp_flags_is_init(u8 f)
Check if client initiating TCP connection (received SYN from client)
Definition: nat.h:845