37 #include <vpp/app/version.h> 45 .arc_name =
"ip4-unicast",
46 .node_name =
"nat44-in2out",
50 .arc_name =
"ip4-unicast",
51 .node_name =
"nat44-out2in",
53 "ip4-dhcp-client-detect"),
56 .arc_name =
"ip4-unicast",
57 .node_name =
"nat44-classify",
61 .arc_name =
"ip4-unicast",
62 .node_name =
"nat44-det-in2out",
66 .arc_name =
"ip4-unicast",
67 .node_name =
"nat44-det-out2in",
69 "ip4-dhcp-client-detect"),
72 .arc_name =
"ip4-unicast",
73 .node_name =
"nat44-det-classify",
77 .arc_name =
"ip4-unicast",
78 .node_name =
"nat44-ed-in2out",
82 .arc_name =
"ip4-unicast",
83 .node_name =
"nat44-ed-out2in",
85 "ip4-dhcp-client-detect"),
88 .arc_name =
"ip4-unicast",
89 .node_name =
"nat44-ed-classify",
93 .arc_name =
"ip4-unicast",
94 .node_name =
"nat44-in2out-worker-handoff",
98 .arc_name =
"ip4-unicast",
99 .node_name =
"nat44-out2in-worker-handoff",
101 "ip4-dhcp-client-detect"),
104 .arc_name =
"ip4-unicast",
105 .node_name =
"nat44-handoff-classify",
109 .arc_name =
"ip4-unicast",
110 .node_name =
"nat44-in2out-fast",
114 .arc_name =
"ip4-unicast",
115 .node_name =
"nat44-out2in-fast",
117 "ip4-dhcp-client-detect"),
120 .arc_name =
"ip4-unicast",
121 .node_name =
"nat44-hairpin-dst",
125 .arc_name =
"ip4-unicast",
126 .node_name =
"nat44-ed-hairpin-dst",
132 .arc_name =
"ip4-output",
133 .node_name =
"nat44-in2out-output",
137 .arc_name =
"ip4-output",
138 .node_name =
"nat44-in2out-output-worker-handoff",
142 .arc_name =
"ip4-output",
143 .node_name =
"nat44-hairpin-src",
147 .arc_name =
"ip4-output",
148 .node_name =
"nat44-ed-in2out-output",
152 .arc_name =
"ip4-output",
153 .node_name =
"nat44-ed-hairpin-src",
160 .arc_name =
"ip4-local",
161 .node_name =
"nat44-hairpinning",
166 .arc_name =
"ip4-local",
167 .node_name =
"nat44-ed-hairpinning",
173 .version = VPP_BUILD_VER,
174 .description =
"Network Address Translation (NAT)",
193 ed_key.
proto = s->in2out.port;
200 ed_key.
l_port = s->in2out.port;
201 ed_key.
r_port = s->ext_host_port;
203 ed_key.
l_addr = s->in2out.addr;
204 ed_key.
r_addr = s->ext_host_addr;
208 if (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &ed_kv, 0))
218 s->in2out.protocol, s->out2in.port);
219 ed_key.
l_addr = s->out2in.addr;
220 ed_key.
r_addr = s->ext_host_addr;
224 ed_key.
proto = s->in2out.port;
231 ed_key.
l_port = s->out2in.port;
232 ed_key.
r_port = s->ext_host_port;
236 if (clib_bihash_add_del_16_8 (&tsm->
out2in_ed, &ed_kv, 0))
238 ed_key.
l_addr = s->in2out.addr;
241 ed_key.
l_port = s->in2out.port;
244 ed_key.
r_addr = s->ext_host_nat_addr;
245 ed_key.
r_port = s->ext_host_nat_port;
249 if (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &ed_kv, 0))
254 &s->in2out.addr, s->in2out.port,
255 &s->ext_host_nat_addr, s->ext_host_nat_port,
256 &s->out2in.addr, s->out2in.port,
257 &s->ext_host_addr, s->ext_host_port,
262 kv.
key = s->in2out.as_u64;
263 if (clib_bihash_add_del_8_8 (&tsm->
in2out, &kv, 0))
265 kv.
key = s->out2in.as_u64;
266 if (clib_bihash_add_del_8_8 (&tsm->
out2in, &kv, 0))
271 &s->in2out.addr, s->in2out.port,
272 &s->out2in.addr, s->out2in.port,
283 s->in2out.addr.as_u32,
284 s->out2in.addr.as_u32,
288 s->in2out.fib_index);
290 nat_ha_sdel (&s->out2in.addr, s->out2in.port, &s->ext_host_addr,
291 s->ext_host_port, s->out2in.protocol, s->out2in.fib_index,
299 key.
port = s->ext_host_nat_port;
300 key.
addr.
as_u32 = s->ext_host_nat_addr.as_u32;
327 if (clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
345 if (clib_bihash_add_del_8_8 (&tsm->
user_hash, &kv, 1))
361 u32 thread_index,
f64 now)
365 u32 oldest_per_user_translation_list_index, session_index;
372 oldest_per_user_translation_list_index =
376 ASSERT (oldest_per_user_translation_list_index != ~0);
381 oldest_per_user_translation_list_index);
383 oldest_per_user_translation_list_elt =
385 oldest_per_user_translation_list_index);
388 session_index = oldest_per_user_translation_list_elt->
value;
401 s->ext_host_addr.as_u32 = 0;
402 s->ext_host_port = 0;
403 s->ext_host_nat_addr.as_u32 = 0;
404 s->ext_host_nat_port = 0;
414 per_user_translation_list_elt - tsm->
list_pool);
417 s->per_user_index = per_user_translation_list_elt - tsm->
list_pool;
421 s->per_user_list_head_index,
422 per_user_translation_list_elt - tsm->
list_pool);
424 s->user_index = u - tsm->
users;
429 s->ha_last_refreshed = now;
440 dlist_elt_t *per_user_translation_list_elt, *oldest_elt;
442 u64 sess_timeout_time;
453 if (now >= sess_timeout_time)
466 s->ext_host_addr.as_u32 = 0;
467 s->ext_host_port = 0;
468 s->ext_host_nat_addr.as_u32 = 0;
469 s->ext_host_nat_port = 0;
478 nat_elog_addr (SNAT_LOG_WARNING,
"[warn] max translations per user",
493 per_user_translation_list_elt - tsm->
list_pool);
496 s->per_user_index = per_user_translation_list_elt - tsm->
list_pool;
500 s->per_user_list_head_index,
501 per_user_translation_list_elt - tsm->
list_pool);
508 s->ha_last_refreshed = now;
521 .ip4.as_u32 = addr->
as_u32,
550 return VNET_API_ERROR_FEATURE_DISABLED;
557 return VNET_API_ERROR_VALUE_EXIST;
573 #define _(N, i, n, s) \ 574 clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \ 575 ap->busy_##n##_ports = 0; \ 576 ap->busy_##n##_ports_per_thread = 0;\ 577 vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0); 587 if (nat_interface_is_inside(i) || sm->out2in_dpo)
590 snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
595 if (nat_interface_is_inside(i) || sm->out2in_dpo)
598 snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
613 if (is_addr_only_static_mapping (m) ||
614 is_out2in_only_static_mapping (m) ||
615 is_identity_static_mapping (m))
617 if (m->external_addr.as_u32 == addr.as_u32)
630 v = clib_net_to_host_u32 (a->
as_u32) + 1;
631 a->
as_u32 = clib_host_to_net_u32 (v);
642 int addr_only,
int is_add,
u8 * tag,
643 int twice_nat,
int out2in_only,
679 u16 l_port,
u16 e_port,
u32 vrf_id,
int addr_only,
696 u32 elt_index, head_index;
706 if (twice_nat || out2in_only)
707 return VNET_API_ERROR_FEATURE_DISABLED;
711 if (sw_if_index != ~0)
741 return VNET_API_ERROR_VALUE_EXIST;
744 (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
745 addr_only, is_add, tag, twice_nat, out2in_only, identity_nat);
748 if (first_int_addr == 0)
763 return VNET_API_ERROR_NO_SUCH_ENTRY;
780 m_key.
port = addr_only ? 0 : e_port;
798 if (local->vrf_id == vrf_id)
799 return VNET_API_ERROR_VALUE_EXIST;
817 return VNET_API_ERROR_VALUE_EXIST;
820 if (twice_nat && addr_only)
821 return VNET_API_ERROR_UNSUPPORTED;
836 if (!(out2in_only || identity_nat))
839 m_key.
port = addr_only ? 0 : l_port;
843 if (!clib_bihash_search_8_8
845 return VNET_API_ERROR_VALUE_EXIST;
860 #define _(N, j, n, s) \ 861 case SNAT_PROTOCOL_##N: \ 862 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \ 863 return VNET_API_ERROR_INVALID_VALUE; \ 864 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \ 867 a->busy_##n##_ports++; \ 868 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \ 875 return VNET_API_ERROR_INVALID_VALUE_2;
883 if (sw_if_index != ~0)
900 return VNET_API_ERROR_NO_SUCH_ENTRY;
966 if (!clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
968 user_index = value.
value;
974 elt_index = head->
next;
976 ses_index = elt->
value;
977 while (ses_index != ~0)
981 ses_index = elt->
value;
987 && (clib_net_to_host_u16 (s->in2out.port) !=
1006 if (sw_if_index != ~0)
1009 return VNET_API_ERROR_NO_SUCH_ENTRY;
1020 if (local->vrf_id == vrf_id)
1021 find = local - m->locals;
1025 return VNET_API_ERROR_NO_SUCH_ENTRY;
1044 #define _(N, j, n, s) \ 1045 case SNAT_PROTOCOL_##N: \ 1046 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \ 1047 if (e_port > 1024) \ 1049 a->busy_##n##_ports--; \ 1050 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \ 1057 return VNET_API_ERROR_INVALID_VALUE_2;
1084 if (!clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
1086 user_index = value.
value;
1092 elt_index = head->
next;
1094 ses_index = elt->
value;
1095 while (ses_index != ~0)
1099 ses_index = elt->
value;
1103 if ((s->out2in.addr.as_u32 != e_addr.
as_u32) ||
1104 (clib_net_to_host_u16 (s->out2in.port) !=
1149 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1152 snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1157 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1160 snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1173 u8 * tag,
u32 affinity)
1182 u32 elt_index, head_index, ses_index;
1191 return VNET_API_ERROR_FEATURE_DISABLED;
1193 m_key.
addr = e_addr;
1194 m_key.
port = e_port;
1206 return VNET_API_ERROR_VALUE_EXIST;
1209 return VNET_API_ERROR_INVALID_VALUE;
1223 #define _(N, j, n, s) \ 1224 case SNAT_PROTOCOL_##N: \ 1225 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \ 1226 return VNET_API_ERROR_INVALID_VALUE; \ 1227 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \ 1228 if (e_port > 1024) \ 1230 a->busy_##n##_ports++; \ 1231 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \ 1238 return VNET_API_ERROR_INVALID_VALUE_2;
1245 return VNET_API_ERROR_NO_SUCH_ENTRY;
1274 nat_elog_err (
"static_mapping_by_external key add failed");
1275 return VNET_API_ERROR_UNSPECIFIED;
1279 for (i = 0; i <
vec_len (locals); i++)
1294 locals[
i].
prefix = (i == 0) ? locals[i].probability :
1295 (locals[i - 1].
prefix + locals[i].probability);
1324 return VNET_API_ERROR_NO_SUCH_ENTRY;
1327 return VNET_API_ERROR_INVALID_VALUE;
1339 #define _(N, j, n, s) \ 1340 case SNAT_PROTOCOL_##N: \ 1341 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \ 1342 if (e_port > 1024) \ 1344 a->busy_##n##_ports--; \ 1345 a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \ 1352 return VNET_API_ERROR_INVALID_VALUE_2;
1366 nat_elog_err (
"static_mapping_by_external key del failed");
1367 return VNET_API_ERROR_UNSPECIFIED;
1373 fib_table_unlock (local->fib_index, FIB_PROTOCOL_IP4,
1374 FIB_SOURCE_PLUGIN_LOW);
1375 m_key.addr = local->addr;
1378 m_key.port = local->port;
1379 m_key.fib_index = local->fib_index;
1380 kv.key = m_key.as_u64;
1381 if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1383 nat_elog_err (
"static_mapping_by_local key del failed");
1384 return VNET_API_ERROR_UNSPECIFIED;
1391 .src_address = local->addr,
1403 if (!clib_bihash_search_8_8 (&tsm->
user_hash, &kv, &value))
1410 elt_index = head->
next;
1412 ses_index = elt->
value;
1413 while (ses_index != ~0)
1417 ses_index = elt->
value;
1422 if ((s->in2out.addr.as_u32 != local->
addr.
as_u32) ||
1423 (clib_net_to_host_u16 (s->in2out.port) != local->
port))
1449 u8 probability,
u8 is_add)
1461 u32 elt_index, head_index, ses_index, *locals = 0;
1466 return VNET_API_ERROR_FEATURE_DISABLED;
1468 m_key.
addr = e_addr;
1469 m_key.
port = e_port;
1477 return VNET_API_ERROR_NO_SUCH_ENTRY;
1480 return VNET_API_ERROR_INVALID_VALUE;
1485 if ((local->addr.as_u32 == l_addr.as_u32) && (local->port == l_port) &&
1486 (local->vrf_id == vrf_id))
1488 match_local = local;
1497 return VNET_API_ERROR_VALUE_EXIST;
1501 local->addr.as_u32 = l_addr.as_u32;
1502 local->port = l_port;
1503 local->probability = probability;
1504 local->vrf_id = vrf_id;
1511 m_key.addr = l_addr;
1512 m_key.port = l_port;
1513 m_key.fib_index = local->fib_index;
1514 kv.key = m_key.as_u64;
1515 kv.value = m - sm->static_mappings;
1516 if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1))
1517 nat_elog_err (
"static_mapping_by_local key add failed");
1523 return VNET_API_ERROR_NO_SUCH_ENTRY;
1526 return VNET_API_ERROR_UNSPECIFIED;
1533 m_key.addr = l_addr;
1534 m_key.port = l_port;
1535 m_key.fib_index = match_local->fib_index;
1536 kv.key = m_key.as_u64;
1537 if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0))
1538 nat_elog_err (
"static_mapping_by_local key del failed");
1541 if (sm->num_workers > 1)
1547 sm->worker_in2out_cb (&ip, m->fib_index,
1554 u_key.addr = match_local->addr;
1555 u_key.fib_index = match_local->fib_index;
1556 kv.key = u_key.as_u64;
1557 if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &
value))
1560 if (u->nstaticsessions)
1562 head_index = u->sessions_per_user_list_head_index;
1564 elt_index = head->next;
1566 ses_index = elt->value;
1567 while (ses_index != ~0)
1571 ses_index = elt->value;
1576 if ((s->in2out.addr.as_u32 != match_local->addr.as_u32) ||
1577 (clib_net_to_host_u16 (s->in2out.port) !=
1595 vec_add1 (locals, local - m->locals);
1596 if (sm->num_workers > 1)
1599 ip.src_address.as_u32 = local->addr.as_u32,
1600 bitmap = clib_bitmap_set (bitmap,
1601 sm->worker_in2out_cb (&ip, local->fib_index, 0),
1610 local->prefix = local->probability;
1615 local->prefix = local->probability + prev_local->prefix;
1619 if (sm->num_workers > 1)
1634 snat_session_t *ses;
1635 u32 *ses_to_be_removed = 0, *ses_index;
1644 for (i = 0; i <
vec_len (addresses); i++)
1653 return VNET_API_ERROR_NO_SUCH_ENTRY;
1660 if (m->external_addr.as_u32 == addr.as_u32)
1661 (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1662 m->local_port, m->external_port,
1663 m->vrf_id, is_addr_only_static_mapping(m), ~0,
1664 m->proto, 0, m->twice_nat,
1665 is_out2in_only_static_mapping(m), m->tag, is_identity_static_mapping(m));
1675 return VNET_API_ERROR_UNSPECIFIED;
1683 if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1689 if (ses->out2in.addr.as_u32 == addr.as_u32)
1691 nat_free_session_data (sm, ses, tsm - sm->per_thread_data, 0);
1692 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1707 #define _(N, i, n, s) \ 1708 clib_bitmap_free (a->busy_##n##_port_bitmap); \ 1709 vec_free (a->busy_##n##_ports_per_thread); 1724 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1727 snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1730 pool_foreach (interface, sm->output_feature_interfaces,
1732 if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1735 snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1748 const char *feature_name, *del_feature_name;
1757 return VNET_API_ERROR_UNSUPPORTED;
1762 if (i->sw_if_index == sw_if_index)
1763 return VNET_API_ERROR_VALUE_EXIST;
1768 feature_name = is_inside ?
"nat44-in2out-fast" :
"nat44-out2in-fast";
1773 is_inside ?
"nat44-in2out-worker-handoff" :
1774 "nat44-out2in-worker-handoff";
1776 feature_name = is_inside ?
"nat44-det-in2out" :
"nat44-det-out2in";
1778 feature_name = is_inside ?
"nat44-ed-in2out" :
"nat44-ed-out2in";
1780 feature_name = is_inside ?
"nat44-in2out" :
"nat44-out2in";
1796 if (outside_fib->
fib_index == fib_index)
1821 if (i->sw_if_index == sw_if_index)
1825 if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1828 i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1830 i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1832 if (sm->num_workers > 1 && !sm->deterministic)
1834 del_feature_name =
"nat44-handoff-classify";
1835 feature_name = !is_inside ?
"nat44-in2out-worker-handoff" :
1836 "nat44-out2in-worker-handoff";
1838 else if (sm->deterministic)
1840 del_feature_name =
"nat44-det-classify";
1841 feature_name = !is_inside ?
"nat44-det-in2out" :
1844 else if (sm->endpoint_dependent)
1846 del_feature_name =
"nat44-ed-classify";
1847 feature_name = !is_inside ?
"nat44-ed-in2out" :
1852 del_feature_name =
"nat44-classify";
1853 feature_name = !is_inside ?
"nat44-in2out" :
"nat44-out2in";
1856 vnet_feature_enable_disable (
"ip4-unicast", del_feature_name,
1857 sw_if_index, 0, 0, 0);
1858 vnet_feature_enable_disable (
"ip4-unicast", feature_name,
1859 sw_if_index, 1, 0, 0);
1862 if (sm->endpoint_dependent)
1863 vnet_feature_enable_disable (
"ip4-local",
1864 "nat44-ed-hairpinning",
1865 sw_if_index, 1, 0, 0);
1866 else if (!sm->deterministic)
1867 vnet_feature_enable_disable (
"ip4-local",
1868 "nat44-hairpinning",
1869 sw_if_index, 1, 0, 0);
1874 vnet_feature_enable_disable (
"ip4-unicast", feature_name,
1875 sw_if_index, 0, 0, 0);
1876 pool_put (sm->interfaces, i);
1879 if (sm->endpoint_dependent)
1880 vnet_feature_enable_disable (
"ip4-local",
1881 "nat44-ed-hairpinning",
1882 sw_if_index, 0, 0, 0);
1883 else if (!sm->deterministic)
1884 vnet_feature_enable_disable (
"ip4-local",
1885 "nat44-hairpinning",
1886 sw_if_index, 0, 0, 0);
1892 if ((nat_interface_is_inside(i) && is_inside) ||
1893 (nat_interface_is_outside(i) && !is_inside))
1896 if (sm->num_workers > 1 && !sm->deterministic)
1898 del_feature_name = !is_inside ?
"nat44-in2out-worker-handoff" :
1899 "nat44-out2in-worker-handoff";
1900 feature_name =
"nat44-handoff-classify";
1902 else if (sm->deterministic)
1904 del_feature_name = !is_inside ?
"nat44-det-in2out" :
1906 feature_name =
"nat44-det-classify";
1908 else if (sm->endpoint_dependent)
1910 del_feature_name = !is_inside ?
"nat44-ed-in2out" :
1912 feature_name =
"nat44-ed-classify";
1916 del_feature_name = !is_inside ?
"nat44-in2out" :
"nat44-out2in";
1917 feature_name =
"nat44-classify";
1920 vnet_feature_enable_disable (
"ip4-unicast", del_feature_name,
1921 sw_if_index, 0, 0, 0);
1922 vnet_feature_enable_disable (
"ip4-unicast", feature_name,
1923 sw_if_index, 1, 0, 0);
1926 if (sm->endpoint_dependent)
1927 vnet_feature_enable_disable (
"ip4-local",
"nat44-ed-hairpinning",
1928 sw_if_index, 0, 0, 0);
1929 else if (!sm->deterministic)
1930 vnet_feature_enable_disable (
"ip4-local",
"nat44-hairpinning",
1931 sw_if_index, 0, 0, 0);
1942 return VNET_API_ERROR_NO_SUCH_ENTRY;
1950 if (is_inside && !sm->out2in_dpo)
1952 if (sm->endpoint_dependent)
1955 else if (!sm->deterministic)
1977 if (!(is_addr_only_static_mapping(m)) || (m->local_addr.as_u32 == m->external_addr.as_u32))
1980 snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1985 snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1994 u8 is_inside,
int is_del)
2007 return VNET_API_ERROR_UNSUPPORTED;
2012 if (i->sw_if_index == sw_if_index)
2013 return VNET_API_ERROR_VALUE_EXIST;
2022 if (outside_fib->
fib_index == fib_index)
2050 sw_if_index, !is_del, 0, 0);
2052 sw_if_index, !is_del, 0, 0);
2057 sw_if_index, !is_del, 0, 0);
2059 sw_if_index, !is_del, 0, 0);
2067 "nat44-out2in-worker-handoff",
2068 sw_if_index, !is_del, 0, 0);
2070 "nat44-in2out-output-worker-handoff",
2071 sw_if_index, !is_del, 0, 0);
2078 sw_if_index, !is_del, 0, 0);
2080 sw_if_index, !is_del, 0, 0);
2085 sw_if_index, !is_del, 0, 0);
2087 sw_if_index, !is_del, 0, 0);
2103 if (i->sw_if_index == sw_if_index)
2106 pool_put (sm->output_feature_interfaces, i);
2108 return VNET_API_ERROR_VALUE_EXIST;
2116 return VNET_API_ERROR_NO_SUCH_ENTRY;
2118 pool_get (sm->output_feature_interfaces,
i);
2137 if (!((is_addr_only_static_mapping(m))) || (m->local_addr.as_u32 == m->external_addr.as_u32))
2140 snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
2154 return VNET_API_ERROR_FEATURE_DISABLED;
2157 return VNET_API_ERROR_INVALID_WORKER;
2186 if (new_fib_index == old_fib_index)
2195 if (i->sw_if_index == sw_if_index)
2197 if (!(nat_interface_is_outside (i)))
2209 if (outside_fib->fib_index == old_fib_index)
2211 outside_fib->refcount--;
2212 if (!outside_fib->refcount)
2213 vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
2220 if (outside_fib->fib_index == new_fib_index)
2222 outside_fib->refcount++;
2230 vec_add2 (sm->outside_fibs, outside_fib, 1);
2231 outside_fib->refcount = 1;
2232 outside_fib->fib_index = new_fib_index;
2250 u32 if_address_index,
u32 is_delete);
2258 u32 if_address_index,
u32 is_delete);
2265 u16 port_per_thread,
u32 snat_thread_index);
2443 u16 port_host_byte_order = clib_net_to_host_u16 (k->
port);
2445 for (address_index = 0; address_index <
vec_len (addresses);
2452 ASSERT (address_index < vec_len (addresses));
2454 a = addresses + address_index;
2458 #define _(N, i, n, s) \ 2459 case SNAT_PROTOCOL_##N: \ 2460 ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \ 2461 port_host_byte_order) == 1); \ 2462 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \ 2463 port_host_byte_order, 0); \ 2464 a->busy_##n##_ports--; \ 2465 a->busy_##n##_ports_per_thread[thread_index]--; \ 2481 u16 port_host_byte_order = clib_net_to_host_u16 (k->
port);
2483 for (address_index = 0; address_index <
vec_len (addresses);
2489 a = addresses + address_index;
2492 #define _(N, j, n, s) \ 2493 case SNAT_PROTOCOL_##N: \ 2494 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, port_host_byte_order)) \ 2495 return VNET_API_ERROR_INSTANCE_IN_USE; \ 2496 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, port_host_byte_order, 1); \ 2497 a->busy_##n##_ports_per_thread[thread_index]++; \ 2498 a->busy_##n##_ports++; \ 2508 return VNET_API_ERROR_NO_SUCH_ENTRY;
2519 u8 * is_identity_nat)
2525 u32 rand,
lo = 0,
hi, mid, *tmp = 0,
i;
2537 m_key.
port = clib_net_to_host_u16 (match.
port);
2542 if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2548 if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2568 mapping->
port = clib_host_to_net_u16 (local->
port);
2579 local = pool_elt_at_index (m->locals, i);
2582 .src_address = local->addr,
2608 mid = ((hi -
lo) >> 1) +
lo;
2610 (rand > local->
prefix) ? (lo = mid + 1) : (hi = mid);
2613 if (!(local->
prefix >= rand))
2616 mapping->
port = clib_host_to_net_u16 (local->
port);
2642 mapping->addr = m->external_addr;
2645 : clib_host_to_net_u16 (m->external_port);
2646 mapping->fib_index = sm->outside_fib_index;
2654 *twice_nat = m->twice_nat;
2675 u16 port_per_thread,
2676 u32 snat_thread_index)
2681 port_per_thread, snat_thread_index);
2689 u16 port_per_thread,
u32 snat_thread_index)
2695 for (i = 0; i <
vec_len (addresses); i++)
2700 #define _(N, j, n, s) \ 2701 case SNAT_PROTOCOL_##N: \ 2702 if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \ 2704 if (a->fib_index == fib_index) \ 2708 portnum = (port_per_thread * \ 2709 snat_thread_index) + \ 2710 snat_random_port(1, port_per_thread) + 1024; \ 2711 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \ 2713 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \ 2714 a->busy_##n##_ports_per_thread[thread_index]++; \ 2715 a->busy_##n##_ports++; \ 2716 k->addr = a->addr; \ 2717 k->port = clib_host_to_net_u16(portnum); \ 2721 else if (a->fib_index == ~0) \ 2741 #define _(N, j, n, s) \ 2742 case SNAT_PROTOCOL_##N: \ 2745 portnum = (port_per_thread * \ 2746 snat_thread_index) + \ 2747 snat_random_port(1, port_per_thread) + 1024; \ 2748 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \ 2750 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \ 2751 a->busy_##n##_ports_per_thread[thread_index]++; \ 2752 a->busy_##n##_ports++; \ 2753 k->addr = a->addr; \ 2754 k->port = clib_host_to_net_u16(portnum); \ 2776 u16 port_per_thread,
u32 snat_thread_index)
2780 u16 m, ports, portnum,
A, j;
2789 #define _(N, i, n, s) \ 2790 case SNAT_PROTOCOL_##N: \ 2791 if (a->busy_##n##_ports < ports) \ 2795 A = snat_random_port(1, pow2_mask(sm->psid_offset)); \ 2796 j = snat_random_port(0, pow2_mask(m)); \ 2797 portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \ 2798 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \ 2800 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \ 2801 a->busy_##n##_ports++; \ 2802 k->addr = a->addr; \ 2803 k->port = clib_host_to_net_u16 (portnum); \ 2826 u16 port_per_thread,
u32 snat_thread_index)
2839 #define _(N, i, n, s) \ 2840 case SNAT_PROTOCOL_##N: \ 2841 if (a->busy_##n##_ports < ports) \ 2845 portnum = snat_random_port(sm->start_port, sm->end_port); \ 2846 if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \ 2848 clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \ 2849 a->busy_##n##_ports++; \ 2850 k->addr = a->addr; \ 2851 k->port = clib_host_to_net_u16 (portnum); \ 2876 .fp_addr.ip4.as_u32 = addr.
as_u32,
2913 s =
format (s,
"%U static-mapping-index %llu",
2943 format (s,
"local %U:%d remote %U:%d proto %U fib %d session-index %llu",
2956 u32 next_worker_index = 0;
2964 next_worker_index += sm->
workers[hash & (_vec_len (sm->
workers) - 1)];
2968 return next_worker_index;
2982 u32 next_worker_index = 0;
2992 if (!clib_bihash_search_8_8
3009 nat_reass_ip4_t *reass;
3013 if (reass && (reass->thread_index != (
u32) ~ 0))
3014 return reass->thread_index;
3027 m_key.
port = clib_net_to_host_u16 (port);
3031 if (!clib_bihash_search_8_8
3035 reass->thread_index = m->
workers[0];
3036 return reass->thread_index;
3040 reass->thread_index +=
3041 sm->
workers[(clib_net_to_host_u16 (port) - 1024) /
3043 return reass->thread_index;
3059 icmp46_header_t *icmp = (icmp46_header_t *) udp;
3070 case SNAT_PROTOCOL_ICMP:
3071 icmp = (icmp46_header_t *) l4_header;
3075 case SNAT_PROTOCOL_UDP:
3076 case SNAT_PROTOCOL_TCP:
3088 m_key.addr = ip0->dst_address;
3089 m_key.port = clib_net_to_host_u16 (
port);
3090 m_key.protocol =
proto;
3091 m_key.fib_index = rx_fib_index0;
3092 kv.key = m_key.as_u64;
3093 if (!clib_bihash_search_8_8
3094 (&sm->static_mapping_by_external, &kv, &
value))
3097 return m->workers[0];
3102 next_worker_index = sm->first_worker_index;
3103 next_worker_index +=
3104 sm->workers[(clib_net_to_host_u16 (
port) - 1024) / sm->port_per_thread];
3105 return next_worker_index;
3174 "HANDOFF IN2OUT-OUTPUT-FEATURE (session)",
3175 next_worker_index, fib_index,
3179 return next_worker_index;
3189 next_worker_index += sm->
workers[hash & (_vec_len (sm->
workers) - 1)];
3196 next_worker_index, rx_fib_index,
3203 next_worker_index, rx_fib_index,
3208 return next_worker_index;
3228 if (
PREDICT_TRUE (proto == SNAT_PROTOCOL_UDP || proto == SNAT_PROTOCOL_TCP))
3243 next_worker_index, rx_fib_index,
3246 return next_worker_index;
3251 else if (proto == SNAT_PROTOCOL_ICMP)
3271 next_worker_index, rx_fib_index,
3274 return next_worker_index;
3285 if (!clib_bihash_search_8_8
3289 next_worker_index = m->
workers[0];
3307 icmp46_header_t *icmp = (icmp46_header_t *) udp;
3318 case SNAT_PROTOCOL_ICMP:
3319 icmp = (icmp46_header_t *) l4_header;
3323 case SNAT_PROTOCOL_UDP:
3324 case SNAT_PROTOCOL_TCP:
3338 clib_net_to_host_u16 (
port));
3339 if (!clib_bihash_search_8_8
3340 (&sm->static_mapping_by_external, &kv, &
value))
3345 next_worker_index = m->workers[0];
3354 m->workers[hash & (_vec_len (m->workers) - 1)];
3356 next_worker_index = m->workers[hash % _vec_len (m->workers)];
3362 next_worker_index = sm->first_worker_index;
3363 next_worker_index +=
3364 sm->workers[(clib_net_to_host_u16 (
port) - 1024) / sm->port_per_thread];
3370 return next_worker_index;
3393 .ip4.as_u32 = eh_addr->
as_u32,
3400 key.
port = out_port;
3418 s->last_heard = now;
3420 s->ext_host_addr.as_u32 = eh_addr->
as_u32;
3421 s->ext_host_port = eh_port;
3451 if (clib_bihash_add_del_8_8 (&tsm->
out2in, &kv, 1))
3459 if (clib_bihash_add_del_8_8 (&tsm->
in2out, &kv, 1))
3478 (sm->
workers[(clib_net_to_host_u16 (out_port) -
3485 key.
port = out_port;
3489 if (clib_bihash_search_8_8 (&tsm->
out2in, &kv, &value))
3500 u32 total_pkts,
u64 total_bytes,
u32 thread_index)
3511 key.
port = out_port;
3515 if (clib_bihash_search_8_8 (&tsm->
out2in, &kv, &value))
3519 s->total_pkts = total_pkts;
3520 s->total_bytes = total_bytes;
3543 .ip4.as_u32 = eh_addr->
as_u32,
3550 key.
port = out_port;
3561 key.
port = ehn_port;
3577 s->last_heard = now;
3579 s->ext_host_nat_addr.as_u32 = s->ext_host_addr.as_u32 = eh_addr->
as_u32;
3580 s->ext_host_nat_port = s->ext_host_port = eh_port;
3583 s->ext_host_nat_addr.as_u32 = ehn_addr->
as_u32;
3584 s->ext_host_nat_port = ehn_port;
3613 key.
port = out_port;
3622 make_ed_kv (&kv, in_addr, &s->ext_host_nat_addr,
3624 s->ext_host_nat_port);
3625 if (clib_bihash_add_del_16_8 (&tsm->
in2out_ed, &kv, 1))
3629 s->out2in.fib_index, out_port, eh_port);
3630 if (clib_bihash_add_del_16_8 (&tsm->
out2in_ed, &kv, 1))
3649 (sm->
workers[(clib_net_to_host_u16 (out_port) -
3663 if (clib_bihash_search_16_8 (&tsm->
out2in_ed, &kv, &value))
3674 u32 fib_index,
u32 total_pkts,
u64 total_bytes,
3693 if (clib_bihash_search_16_8 (&tsm->
out2in_ed, &kv, &value))
3697 s->total_pkts = total_pkts;
3698 s->total_bytes = total_bytes;
3706 u32 translation_buckets = 1024;
3707 u32 translation_memory_size = 128 << 20;
3708 u32 user_buckets = 128;
3709 u32 user_memory_size = 64 << 20;
3710 u32 max_translations_per_user = 100;
3711 u32 outside_vrf_id = 0;
3712 u32 outside_ip6_vrf_id = 0;
3713 u32 inside_vrf_id = 0;
3714 u32 static_mapping_buckets = 1024;
3715 u32 static_mapping_memory_size = 64 << 20;
3716 u32 nat64_bib_buckets = 1024;
3717 u32 nat64_bib_memory_size = 128 << 20;
3718 u32 nat64_st_buckets = 2048;
3719 u32 nat64_st_memory_size = 256 << 20;
3720 u8 static_mapping_only = 0;
3721 u8 static_mapping_connection_tracking = 0;
3732 (input,
"translation hash buckets %d", &translation_buckets))
3734 else if (
unformat (input,
"translation hash memory %d",
3735 &translation_memory_size));
3736 else if (
unformat (input,
"user hash buckets %d", &user_buckets))
3738 else if (
unformat (input,
"user hash memory %d", &user_memory_size))
3740 else if (
unformat (input,
"max translations per user %d",
3741 &max_translations_per_user))
3743 else if (
unformat (input,
"outside VRF id %d", &outside_vrf_id))
3745 else if (
unformat (input,
"outside ip6 VRF id %d", &outside_ip6_vrf_id))
3747 else if (
unformat (input,
"inside VRF id %d", &inside_vrf_id))
3749 else if (
unformat (input,
"static mapping only"))
3751 static_mapping_only = 1;
3752 if (
unformat (input,
"connection tracking"))
3753 static_mapping_connection_tracking = 1;
3755 else if (
unformat (input,
"deterministic"))
3757 else if (
unformat (input,
"nat64 bib hash buckets %d",
3758 &nat64_bib_buckets))
3760 else if (
unformat (input,
"nat64 bib hash memory %d",
3761 &nat64_bib_memory_size))
3764 if (
unformat (input,
"nat64 st hash buckets %d", &nat64_st_buckets))
3766 else if (
unformat (input,
"nat64 st hash memory %d",
3767 &nat64_st_memory_size))
3769 else if (
unformat (input,
"out2in dpo"))
3771 else if (
unformat (input,
"dslite ce"))
3773 else if (
unformat (input,
"endpoint-dependent"))
3782 "deterministic and endpoint-dependent modes are mutually exclusive");
3786 "static mapping only mode available only for simple nat");
3790 "out2in dpo mode available only for simple nat");
3815 nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
3816 nat64_st_memory_size);
3852 if (!static_mapping_only ||
3853 (static_mapping_only && static_mapping_connection_tracking))
3860 clib_bihash_init_16_8 (&tsm->
in2out_ed,
"in2out-ed",
3861 translation_buckets,
3862 translation_memory_size);
3863 clib_bihash_set_kvp_format_fn_16_8 (&tsm->
in2out_ed,
3866 clib_bihash_init_16_8 (&tsm->
out2in_ed,
"out2in-ed",
3867 translation_buckets,
3868 translation_memory_size);
3869 clib_bihash_set_kvp_format_fn_16_8 (&tsm->
out2in_ed,
3874 clib_bihash_init_8_8 (&tsm->
in2out,
"in2out",
3875 translation_buckets,
3876 translation_memory_size);
3877 clib_bihash_set_kvp_format_fn_8_8 (&tsm->
in2out,
3880 clib_bihash_init_8_8 (&tsm->
out2in,
"out2in",
3881 translation_buckets,
3882 translation_memory_size);
3883 clib_bihash_set_kvp_format_fn_8_8 (&tsm->
out2in,
3887 clib_bihash_init_8_8 (&tsm->
user_hash,
"users", user_buckets,
3889 clib_bihash_set_kvp_format_fn_8_8 (&tsm->
user_hash,
3901 "static_mapping_by_local", static_mapping_buckets,
3902 static_mapping_memory_size);
3907 "static_mapping_by_external",
3908 static_mapping_buckets,
3909 static_mapping_memory_size);
3925 u32 if_address_index,
u32 is_delete)
3993 u32 if_address_index,
u32 is_delete)
4023 for (j = 0; j <
vec_len (addresses); j++)
4024 if (addresses[j].
addr.as_u32 == address->
as_u32)
4076 u32 *indices_to_delete = 0;
4078 u32 *auto_add_sw_if_indices =
4085 for (i = 0; i <
vec_len (auto_add_sw_if_indices); i++)
4087 if (auto_add_sw_if_indices[i] == sw_if_index)
4102 if (vec_len (indices_to_delete))
4104 for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
4115 return VNET_API_ERROR_VALUE_EXIST;
4122 return VNET_API_ERROR_NO_SUCH_ENTRY;
4147 clib_bihash_8_8_t *t;
4150 return VNET_API_ERROR_UNSUPPORTED;
4161 key.
port = clib_host_to_net_u16 (port);
4165 t = is_in ? &tsm->in2out : &tsm->out2in;
4166 if (!clib_bihash_search_8_8 (t, &kv, &value))
4169 return VNET_API_ERROR_UNSPECIFIED;
4177 return VNET_API_ERROR_NO_SUCH_ENTRY;
4183 u32 vrf_id,
int is_in)
4186 clib_bihash_16_8_t *t;
4194 return VNET_API_ERROR_FEATURE_DISABLED;
4204 t = is_in ? &tsm->in2out_ed : &tsm->out2in_ed;
4207 key.
l_port = clib_host_to_net_u16 (port);
4208 key.
r_port = clib_host_to_net_u16 (eh_port);
4213 if (clib_bihash_search_16_8 (t, &kv, &value))
4214 return VNET_API_ERROR_NO_SUCH_ENTRY;
4217 return VNET_API_ERROR_UNSPECIFIED;
ip4_address_t external_addr
vlib_log_class_t vlib_log_register_class(char *class, char *subclass)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
clib_error_t * snat_api_init(vlib_main_t *vm, snat_main_t *sm)
void dslite_set_ce(dslite_main_t *dm, u8 set)
fib_protocol_t fp_proto
protocol type
static void snat_update_outside_fib(u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
nat_outside_fib_t * outside_fibs
void snat_ipfix_logging_max_entries_per_user(u32 thread_index, u32 limit, u32 src_ip)
Generate maximum entries per user exceeded event.
#define snat_is_session_static(s)
Check if SNAT session is created from static mapping.
u32 sessions_per_user_list_head_index
vlib_node_registration_t nat44_ed_in2out_output_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_output_node)
#define nat_elog_debug_handoff(_str, _tid, _fib, _src, _dst)
ip4_table_bind_function_t * function
int nat_affinity_create_and_lock(ip4_address_t client_addr, ip4_address_t service_addr, u8 proto, u16 service_port, u8 backend_index, u32 sticky_time, u32 affinity_per_service_list_head_index)
Create affinity record and take reference counting lock.
int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat)
Delete external address from NAT44 pool.
u32 hairpin_dst_node_index
void dslite_init(vlib_main_t *vm)
ip4_add_del_interface_address_callback_t * add_del_interface_address_callbacks
Functions to call when interface address changes.
u32 ed_hairpinning_node_index
static void clib_dlist_init(dlist_elt_t *pool, u32 index)
vnet_main_t * vnet_get_main(void)
#define nat_elog_info(nat_elog_str)
static void snat_add_static_mapping_when_resolved(snat_main_t *sm, ip4_address_t l_addr, u16 l_port, u32 sw_if_index, u16 e_port, u32 vrf_id, snat_protocol_t proto, int addr_only, int is_add, u8 *tag, int twice_nat, int out2in_only, int identity_nat)
static u32 nat44_session_get_timeout(snat_main_t *sm, snat_session_t *s)
u32 fq_in2out_output_index
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
clib_error_t * nat_reass_init(vlib_main_t *vm)
Initialize NAT virtual fragmentation reassembly.
#define nat_elog_notice(nat_elog_str)
static int nat_alloc_addr_and_port_range(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
#define SNAT_TCP_ESTABLISHED_TIMEOUT
#define is_ed_session(s)
Check if NAT session is endpoint dependent.
static_always_inline u8 icmp_is_error_message(icmp46_header_t *icmp)
ip4_address_t * ip4_interface_first_address(ip4_main_t *im, u32 sw_if_index, ip_interface_address_t **result_ia)
static f64 vlib_time_now(vlib_main_t *vm)
u32 fib_table_get_index_for_sw_if_index(fib_protocol_t proto, u32 sw_if_index)
Get the index of the FIB bound to the interface.
static void make_sm_kv(clib_bihash_kv_8_8_t *kv, ip4_address_t *addr, u8 proto, u32 fib_index, u16 port)
u32 vlib_frame_queue_main_init(u32 node_index, u32 frame_queue_nelts)
nat_reass_ip4_t * nat_ip4_reass_find(ip4_address_t src, ip4_address_t dst, u16 frag_id, u8 proto)
Find reassembly.
void nat_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 session data (lookup keys, external addrres port)
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
u32 ed_in2out_reass_node_index
void nat_ha_sref_ed_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 total_pkts, u64 total_bytes, u32 thread_index)
u32 ed_out2in_slowpath_node_index
u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
#define vec_add2(V, P, N)
Add N elements to end of vector V, return pointer to new elements in P.
#define NAT_INTERFACE_FLAG_IS_OUTSIDE
static uword * clib_bitmap_set(uword *ai, uword i, uword value)
Sets the ith bit of a bitmap to new_value Removes trailing zeros from the bitmap. ...
u8 * format_user_kvp(u8 *s, va_list *args)
void nat_syslog_nat44_sdel(u32 ssubix, u32 sfibix, ip4_address_t *isaddr, u16 isport, ip4_address_t *idaddr, u16 idport, ip4_address_t *xsaddr, u16 xsport, ip4_address_t *xdaddr, u16 xdport, snat_protocol_t proto, u8 is_twicenat)
clib_memset(h->entries, 0, sizeof(h->entries[0])*entries)
ip_lookup_main_t lookup_main
#define nat_elog_warn(nat_elog_str)
vlib_node_registration_t snat_det_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_det_out2in_node)
void nat64_set_hash(u32 bib_buckets, u32 bib_memory_size, u32 st_buckets, u32 st_memory_size)
Set NAT64 hash tables configuration.
int nat44_del_ed_session(snat_main_t *sm, ip4_address_t *addr, u16 port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 vrf_id, int is_in)
Delete NAT44 endpoint-dependent session.
format_function_t format_snat_key
void snat_add_del_addr_to_fib(ip4_address_t *addr, u8 p_len, u32 sw_if_index, int is_add)
Add/del NAT address to FIB.
#define nat_elog_addr(_level, _str, _addr)
nat_alloc_out_addr_and_port_function_t * alloc_addr_and_port
static void snat_ip4_add_del_interface_address_cb(ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address, u32 address_length, u32 if_address_index, u32 is_delete)
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
#define snat_is_unk_proto_session(s)
Check if SNAT session for unknown protocol.
static int nat_alloc_addr_and_port_mape(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
static int nat_alloc_addr_and_port_default(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
u32 icmp_match_in2out_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation.
int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 feature on the interface.
u32 icmp_match_out2in_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
nat44_lb_addr_port_t * locals
static u32 snat_get_worker_out2in_cb(ip4_header_t *ip0, u32 rx_fib_index0, u8 is_output)
clib_bihash_8_8_t user_hash
static int ip4_is_fragment(const ip4_header_t *i)
int nat44_add_del_lb_static_mapping(ip4_address_t e_addr, u16 e_port, snat_protocol_t proto, nat44_lb_addr_port_t *locals, u8 is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u32 affinity)
Add/delete static mapping with load-balancing (multiple backends)
snat_session_t * nat_session_alloc_or_recycle(snat_main_t *sm, snat_user_t *u, u32 thread_index, f64 now)
Allocate new NAT session or recycle last used.
#define NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY
fib_node_index_t fib_table_entry_update_one_path(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source, fib_entry_flag_t flags, dpo_proto_t next_hop_proto, const ip46_address_t *next_hop, u32 next_hop_sw_if_index, u32 next_hop_fib_index, u32 next_hop_weight, fib_mpls_label_t *next_hop_labels, fib_route_path_flags_t path_flags)
Update the entry to have just one path.
u32 max_translations_per_user
u32 in2out_reass_node_index
void nat_ha_sadd_cb(ip4_address_t *in_addr, u16 in_port, ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, ip4_address_t *ehn_addr, u16 ehn_port, u8 proto, u32 fib_index, u16 flags, u32 thread_index)
u32 in2out_output_node_index
u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index)
#define static_always_inline
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
static_always_inline int get_icmp_o2i_ed_key(ip4_header_t *ip0, nat_ed_ses_key_t *p_key0)
vl_api_interface_index_t sw_if_index
#define VLIB_INIT_FUNCTION(x)
vlib_node_registration_t snat_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_node)
void fib_table_entry_special_remove(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source)
Remove a 'special' entry from the FIB.
u8 * format_static_mapping_kvp(u8 *s, va_list *args)
void nat_ha_sadd_ed_cb(ip4_address_t *in_addr, u16 in_port, ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, ip4_address_t *ehn_addr, u16 ehn_port, u8 proto, u32 fib_index, u16 flags, u32 thread_index)
u32 det_in2out_node_index
int snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
Add external address to NAT44 pool.
u8 * format_ed_session_kvp(u8 *s, va_list *args)
A high priority source a plugin can use.
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
Aggregrate type for a prefix.
#define clib_error_return(e, args...)
#define is_fwd_bypass_session(s)
Check if NAT session is forwarding bypass.
static u32 snat_get_worker_in2out_cb(ip4_header_t *ip0, u32 rx_fib_index0, u8 is_output)
void snat_ipfix_logging_init(vlib_main_t *vm)
Initialize NAT plugin IPFIX logging.
static void * ip4_next_header(ip4_header_t *i)
void snat_ipfix_logging_addresses_exhausted(u32 thread_index, u32 pool_id)
Generate NAT addresses exhausted event.
u32 fib_table_find(fib_protocol_t proto, u32 table_id)
Get the index of the FIB for a Table-ID.
void nat_ha_sdel_ed_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 ti)
fib_node_index_t fib_table_lookup(u32 fib_index, const fib_prefix_t *prefix)
Perfom a longest prefix match in the non-forwarding table.
static void nat_ip4_add_del_addr_only_sm_cb(ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address, u32 address_length, u32 if_address_index, u32 is_delete)
void nat_affinity_unlock(ip4_address_t client_addr, ip4_address_t service_addr, u8 proto, u16 service_port)
Release a reference counting lock for affinity.
int snat_static_mapping_match(snat_main_t *sm, snat_session_key_t match, snat_session_key_t *mapping, u8 by_external, u8 *is_addr_only, twice_nat_type_t *twice_nat, lb_nat_type_t *lb, ip4_address_t *ext_host_addr, u8 *is_identity_nat)
Match NAT44 static mapping.
void snat_free_outside_address_and_port(snat_address_t *addresses, u32 thread_index, snat_session_key_t *k)
Free outside address and port pair.
u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
static void nat44_delete_session(snat_main_t *sm, snat_session_t *ses, u32 thread_index)
char * name
The counter collection's name.
twice_nat_type_t twice_nat
VNET_FEATURE_INIT(ip4_snat_in2out, static)
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
u32 * auto_add_sw_if_indices_twice_nat
void nat66_init(vlib_main_t *vm)
vlib_node_registration_t nat44_ed_out2in_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_out2in_node)
int snat_alloc_outside_address_and_port(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
Alloc outside address and port.
snat_user_t * nat_user_get_or_create(snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index)
Find or create NAT user.
#define clib_bitmap_foreach(i, ai, body)
Macro to iterate across set bits in a bitmap.
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
void nat_dpo_module_init(void)
nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg
clib_bihash_16_8_t out2in_ed
static uword clib_bitmap_last_set(uword *ai)
Return the higest numbered set bit in a bitmap.
void nat_ha_sdel_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 ti)
void nat_ha_sref_cb(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 total_pkts, u64 total_bytes, u32 thread_index)
static void clib_dlist_addtail(dlist_elt_t *pool, u32 head_index, u32 new_index)
snat_session_t * nat_ed_session_alloc(snat_main_t *sm, snat_user_t *u, u32 thread_index, f64 now)
Allocate NAT endpoint-dependent session.
snat_static_mapping_t * static_mappings
#define pool_put(P, E)
Free an object E in pool P.
#define vec_dup(V)
Return copy of vector (no header, no alignment)
#define VLIB_CONFIG_FUNCTION(x, n,...)
#define vec_del1(v, i)
Delete the element at index I.
u32 hairpin_src_node_index
clib_bihash_8_8_t static_mapping_by_external
u32 in2out_slowpath_output_node_index
static void vlib_set_simple_counter(vlib_simple_counter_main_t *cm, u32 thread_index, u32 index, u64 value)
Set a simple counter.
void nat_set_alloc_addr_and_port_default(void)
Set address and port assignment algorithm to default/standard.
void fib_table_unlock(u32 fib_index, fib_protocol_t proto, fib_source_t source)
Take a reference counting lock on the table.
#define is_lb_session(s)
Check if NAT session is load-balancing.
u32 fib_entry_get_resolving_interface(fib_node_index_t entry_index)
snat_interface_t * output_feature_interfaces
u32 ed_hairpin_src_node_index
#define pool_free(p)
Free a pool.
void snat_ipfix_logging_nat44_ses_delete(u32 thread_index, u32 src_ip, u32 nat_src_ip, snat_protocol_t snat_proto, u16 src_port, u16 nat_src_port, u32 vrf_id)
Generate NAT44 session delete event.
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
#define is_affinity_sessions(s)
Check if NAT session has affinity record.
u32 ed_out2in_reass_node_index
static u8 snat_proto_to_ip_proto(snat_protocol_t snat_proto)
#define NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT
u32 nat_affinity_get_per_service_list_head_index(void)
Get new affinity per service list head index.
static void clib_dlist_addhead(dlist_elt_t *pool, u32 head_index, u32 new_index)
static u32 random_u32_max(void)
Maximum value returned by random_u32()
static_always_inline uword vlib_get_thread_index(void)
u8 nat_reass_is_drop_frag(u8 is_ip6)
Get status of virtual fragmentation reassembly.
void nat44_add_del_address_dpo(ip4_address_t addr, u8 is_add)
Add/delete external address to FIB DPO (out2in DPO mode)
vlib_node_registration_t snat_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_node)
u8 static_mapping_connection_tracking
snat_get_worker_function_t * worker_in2out_cb
#define vec_free(V)
Free vector's memory (no header).
void fib_table_entry_delete(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source)
Delete a FIB entry.
ip4_add_del_interface_address_function_t * function
deterministic NAT definitions
int nat_affinity_find_and_lock(ip4_address_t client_addr, ip4_address_t service_addr, u8 proto, u16 service_port, u8 *backend_index)
Find service backend index for client-IP and take a reference counting lock.
u32 ed_in2out_slowpath_node_index
int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 output feature on the interface (postrouting NAT)
#define nat_elog_notice_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
dslite_main_t dslite_main
static void snat_ip4_table_bind(ip4_main_t *im, uword opaque, u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
u8 * format_session_kvp(u8 *s, va_list *args)
u32 fib_node_index_t
A typedef of a node index.
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
8 octet key, 8 octet key value pair
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
u32 ed_hairpin_dst_node_index
static void make_ed_kv(clib_bihash_kv_16_8_t *kv, ip4_address_t *l_addr, ip4_address_t *r_addr, u8 proto, u32 fib_index, u16 l_port, u16 r_port)
u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
u32 tcp_transitory_timeout
int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, snat_protocol_t proto, int is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u8 identity_nat)
Add/delete NAT44 static mapping.
void fib_table_lock(u32 fib_index, fib_protocol_t proto, fib_source_t source)
Release a reference counting lock on the table.
u32 * auto_add_sw_if_indices
u32 in2out_fast_node_index
fib_node_index_t fib_table_entry_special_dpo_add(u32 fib_index, const fib_prefix_t *prefix, fib_source_t source, fib_entry_flag_t flags, const dpo_id_t *dpo)
Add a 'special' entry to the FIB that links to the DPO passed A special entry is an entry that the FI...
void vlib_validate_simple_counter(vlib_simple_counter_main_t *cm, u32 index)
validate a simple counter
static_always_inline u16 snat_random_port(u16 min, u16 max)
#define NAT_INTERFACE_FLAG_IS_INSIDE
#define is_addr_only_static_mapping(sm)
Check if NAT static mapping is address only (1:1NAT).
#define is_identity_static_mapping(sm)
Check if NAT static mapping is identity NAT.
u32 det_out2in_node_index
snat_get_worker_function_t * worker_out2in_cb
clib_error_t * nat_affinity_init(vlib_main_t *vm)
Initialize NAT client-IP based affinity.
u32 in2out_slowpath_node_index
snat_icmp_match_function_t * icmp_match_out2in_cb
vlib_log_class_t log_class
#define SNAT_SESSION_FLAG_TWICE_NAT
void nat_set_alloc_addr_and_port_range(u16 start_port, u16 end_port)
Set address and port assignment algorithm for port range.
u32 fib_table_find_or_create_and_lock(fib_protocol_t proto, u32 table_id, fib_source_t src)
Get the index of the FIB for a Table-ID.
#define clib_bitmap_free(v)
Free a bitmap.
static void vlib_zero_simple_counter(vlib_simple_counter_main_t *cm, u32 index)
Clear a simple counter Clears the set of per-thread u16 counters, and the u64 counter.
uword * thread_registrations_by_name
vlib_node_registration_t nat44_ed_in2out_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_node)
int nat44_del_session(snat_main_t *sm, ip4_address_t *addr, u16 port, snat_protocol_t proto, u32 vrf_id, int is_in)
Delete NAT44 session.
snat_address_t * twice_nat_addresses
#define VNET_FEATURES(...)
void nat_syslog_nat44_apmdel(u32 ssubix, u32 sfibix, ip4_address_t *isaddr, u16 isport, ip4_address_t *xsaddr, u16 xsport, snat_protocol_t proto)
static clib_error_t * snat_init(vlib_main_t *vm)
void nat_ha_sdel(ip4_address_t *out_addr, u16 out_port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 fib_index, u32 thread_index)
Create session delete HA event.
static uword is_pow2(uword x)
u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation.
ip4_table_bind_callback_t * table_bind_callbacks
Functions to call when interface to table biding changes.
clib_error_t * nat64_init(vlib_main_t *vm)
Initialize NAT64.
u32 out2in_reass_node_index
NAT64 global declarations.
#define is_lb_static_mapping(sm)
Check if NAT static mapping is load-balancing.
void increment_v4_address(ip4_address_t *a)
Increment IPv4 address.
char * stat_segment_name
Name in stat segment directory.
vlib_simple_counter_main_t total_users
static int ip4_is_first_fragment(const ip4_header_t *i)
#define nat_elog_err(nat_elog_str)
static u32 ip_proto_to_snat_proto(u8 ip_proto)
The NAT inline functions.
#define FIB_NODE_INDEX_INVALID
format_function_t format_static_mapping_key
static void user_session_increment(snat_main_t *sm, snat_user_t *u, u8 is_static)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
u32 hairpinning_node_index
#define is_out2in_only_static_mapping(sm)
Check if NAT static mapping match only out2in direction.
snat_main_per_thread_data_t * per_thread_data
static u32 nat44_ed_get_worker_out2in_cb(ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
void nat_affinity_flush_service(u32 affinity_per_service_list_head_index)
Flush all service affinity data.
#define DPO_INVALID
An initialiser for DPOs declared on the stack.
u32 affinity_per_service_list_head_index
snat_address_t * addresses
void nat_dpo_create(dpo_proto_t dproto, u32 aftr_index, dpo_id_t *dpo)
int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, u8 twice_nat)
Add/delete NAT44 pool address from specific interfce.
u32 out2in_fast_node_index
#define hash_get_mem(h, key)
#define SNAT_ICMP_TIMEOUT
snat_static_map_resolve_t * to_resolve
static u32 random_u32(u32 *seed)
32-bit random number generator
#define SNAT_SESSION_FLAG_STATIC_MAPPING
ip4_main_t ip4_main
Global ip4 main structure.
static vlib_thread_main_t * vlib_get_thread_main()
static u32 get_thread_idx_by_port(u16 e_port)
u32 translation_memory_size
void dpo_reset(dpo_id_t *dpo)
reset a DPO ID The DPO will be unlocked.
#define vec_foreach(var, vec)
Vector iterator.
vlib_node_registration_t snat_in2out_output_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_node)
int snat_set_workers(uword *bitmap)
Set NAT plugin workers.
u32 icmp_match_in2out_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b, ip4_header_t *ip, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
#define is_twice_nat_session(s)
Check if NAT session is twice NAT.
clib_bihash_16_8_t in2out_ed
static clib_error_t * snat_config(vlib_main_t *vm, unformat_input_t *input)
static u32 nat44_ed_get_worker_in2out_cb(ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
#define pool_foreach_index(i, v, body)
Iterate pool by index.
NAT plugin virtual fragmentation reassembly.
void nat_set_alloc_addr_and_port_mape(u16 psid, u16 psid_offset, u16 psid_length)
Set address and port assignment algorithm for MAP-E CE.
NAT66 global declarations.
NAT plugin client-IP based session affinity for load-balancing.
vlib_simple_counter_main_t total_sessions
#define SNAT_TCP_TRANSITORY_TIMEOUT
ip_lookup_main_t * ip4_lookup_main
#define NAT_STATIC_MAPPING_FLAG_LB
static int is_snat_address_used_in_static_mapping(snat_main_t *sm, ip4_address_t addr)
#define NAT_STATIC_MAPPING_FLAG_ADDR_ONLY
snat_session_t * sessions
A low (below routing) priority source a plugin can use.
snat_icmp_match_function_t * icmp_match_in2out_cb
clib_bihash_8_8_t static_mapping_by_local
int nat44_lb_static_mapping_add_del_local(ip4_address_t e_addr, u16 e_port, ip4_address_t l_addr, u16 l_port, snat_protocol_t proto, u32 vrf_id, u8 probability, u8 is_add)
snat_interface_t * interfaces
void nat_ha_init(vlib_main_t *vm, nat_ha_sadd_cb_t sadd_cb, nat_ha_sdel_cb_t sdel_cb, nat_ha_sref_cb_t sref_cb)
Initialize NAT HA.
vl_api_fib_path_nh_proto_t proto
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
nat_reass_ip4_t * nat_ip4_reass_create(ip4_address_t src, ip4_address_t dst, u16 frag_id, u8 proto)
Create reassembly.
static u32 clib_dlist_remove_head(dlist_elt_t *pool, u32 head_index)
static int nat_set_outside_address_and_port(snat_address_t *addresses, u32 thread_index, snat_session_key_t *k)
u32 tcp_established_timeout
static uword pool_elts(void *v)
Number of active elements in a pool.