FD.io VPP  v20.05-21-gb1500e9ff
Vector Packet Processing
nat.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file nat.c
17  * NAT plugin global declarations
18  */
19 #ifndef __included_nat_h__
20 #define __included_nat_h__
21 
22 #include <vnet/vnet.h>
23 #include <vnet/ip/ip.h>
24 #include <vnet/ethernet/ethernet.h>
25 #include <vnet/ip/icmp46_packet.h>
26 #include <vnet/api_errno.h>
27 #include <vnet/fib/fib_source.h>
28 #include <vppinfra/elog.h>
29 #include <vppinfra/bihash_8_8.h>
30 #include <vppinfra/bihash_16_8.h>
31 #include <vppinfra/dlist.h>
32 #include <vppinfra/error.h>
33 #include <vlibapi/api.h>
34 #include <vlib/log.h>
35 #include <vppinfra/bihash_16_8.h>
36 #include <nat/lib/lib.h>
37 #include <nat/lib/inlines.h>
38 
39 /* default session timeouts */
40 #define SNAT_UDP_TIMEOUT 300
41 #define SNAT_TCP_TRANSITORY_TIMEOUT 240
42 #define SNAT_TCP_ESTABLISHED_TIMEOUT 7440
43 #define SNAT_ICMP_TIMEOUT 60
44 
45 /* number of worker handoff frame queue elements */
46 #define NAT_FQ_NELTS 64
47 
48 /* NAT buffer flags */
49 #define SNAT_FLAG_HAIRPINNING (1 << 0)
50 
51 typedef enum
52 {
63 } nat_next_t;
64 
65 typedef struct
66 {
70 
71 /* session key (4-tuple) */
72 typedef struct
73 {
74  union
75  {
76  struct
77  {
80  u16 protocol:3, fib_index:13;
81  };
83  };
85 
86 /* deterministic session outside key */
87 typedef struct
88 {
89  union
90  {
91  struct
92  {
96  };
98  };
100 
101 /* user (internal host) key */
102 typedef struct
103 {
104  union
105  {
106  struct
107  {
110  };
112  };
114 
115 /* NAT API Configuration flags */
116 #define foreach_nat_config_flag \
117  _(0x01, IS_TWICE_NAT) \
118  _(0x02, IS_SELF_TWICE_NAT) \
119  _(0x04, IS_OUT2IN_ONLY) \
120  _(0x08, IS_ADDR_ONLY) \
121  _(0x10, IS_OUTSIDE) \
122  _(0x20, IS_INSIDE) \
123  _(0x40, IS_STATIC) \
124  _(0x80, IS_EXT_HOST_VALID) \
125 
127 {
128 #define _(n,f) NAT_API_##f = n,
130 #undef _
132 
133 /* External address and port allocation modes */
134 #define foreach_nat_addr_and_port_alloc_alg \
135  _(0, DEFAULT, "default") \
136  _(1, MAPE, "map-e") \
137  _(2, RANGE, "port-range")
138 
139 typedef enum
140 {
141 #define _(v, N, s) NAT_ADDR_AND_PORT_ALLOC_ALG_##N = v,
143 #undef _
145 
146 /* Session state */
147 #define foreach_snat_session_state \
148  _(0, UNKNOWN, "unknown") \
149  _(1, UDP_ACTIVE, "udp-active") \
150  _(2, TCP_SYN_SENT, "tcp-syn-sent") \
151  _(3, TCP_ESTABLISHED, "tcp-established") \
152  _(4, TCP_FIN_WAIT, "tcp-fin-wait") \
153  _(5, TCP_CLOSE_WAIT, "tcp-close-wait") \
154  _(6, TCP_CLOSING, "tcp-closing") \
155  _(7, TCP_LAST_ACK, "tcp-last-ack") \
156  _(8, TCP_CLOSED, "tcp-closed") \
157  _(9, ICMP_ACTIVE, "icmp-active")
158 
159 typedef enum
160 {
161 #define _(v, N, s) SNAT_SESSION_##N = v,
163 #undef _
165 
166 #define foreach_nat_in2out_ed_error \
167 _(UNSUPPORTED_PROTOCOL, "unsupported protocol") \
168 _(IN2OUT_PACKETS, "good in2out packets processed") \
169 _(OUT_OF_PORTS, "out of ports") \
170 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
171 _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \
172 _(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \
173 _(DROP_FRAGMENT, "drop fragment") \
174 _(CANNOT_CREATE_USER, "cannot create NAT user") \
175 _(NON_SYN, "non-SYN packet try to create session") \
176 _(TCP_PACKETS, "TCP packets") \
177 _(TCP_CLOSED, "drops due to TCP in transitory timeout") \
178 _(UDP_PACKETS, "UDP packets") \
179 _(ICMP_PACKETS, "ICMP packets") \
180 _(OTHER_PACKETS, "other protocol packets") \
181 _(FRAGMENTS, "fragments") \
182 _(CACHED_FRAGMENTS, "cached fragments") \
183 _(PROCESSED_FRAGMENTS, "processed fragments")
184 
185 typedef enum
186 {
187 #define _(sym,str) NAT_IN2OUT_ED_ERROR_##sym,
189 #undef _
192 
193 #define foreach_nat_out2in_ed_error \
194 _(UNSUPPORTED_PROTOCOL, "unsupported protocol") \
195 _(OUT2IN_PACKETS, "good out2in packets processed") \
196 _(OUT_OF_PORTS, "out of ports") \
197 _(BAD_ICMP_TYPE, "unsupported ICMP type") \
198 _(NO_TRANSLATION, "no translation") \
199 _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \
200 _(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \
201 _(DROP_FRAGMENT, "drop fragment") \
202 _(CANNOT_CREATE_USER, "cannot create NAT user") \
203 _(NON_SYN, "non-SYN packet try to create session") \
204 _(TCP_PACKETS, "TCP packets") \
205 _(TCP_CLOSED, "drops due to TCP in transitory timeout") \
206 _(UDP_PACKETS, "UDP packets") \
207 _(ICMP_PACKETS, "ICMP packets") \
208 _(OTHER_PACKETS, "other protocol packets") \
209 _(FRAGMENTS, "fragments") \
210 _(CACHED_FRAGMENTS, "cached fragments") \
211 _(PROCESSED_FRAGMENTS, "processed fragments")
212 
213 typedef enum
214 {
215 #define _(sym,str) NAT_OUT2IN_ED_ERROR_##sym,
217 #undef _
220 
221 
222 /* Endpoint dependent TCP session state */
223 #define NAT44_SES_I2O_FIN 1
224 #define NAT44_SES_O2I_FIN 2
225 #define NAT44_SES_I2O_FIN_ACK 4
226 #define NAT44_SES_O2I_FIN_ACK 8
227 #define NAT44_SES_I2O_SYN 16
228 #define NAT44_SES_O2I_SYN 32
229 #define NAT44_SES_RST 64
230 
231 /* Session flags */
232 #define SNAT_SESSION_FLAG_STATIC_MAPPING 1
233 #define SNAT_SESSION_FLAG_UNKNOWN_PROTO 2
234 #define SNAT_SESSION_FLAG_LOAD_BALANCING 4
235 #define SNAT_SESSION_FLAG_TWICE_NAT 8
236 #define SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT 16
237 #define SNAT_SESSION_FLAG_FWD_BYPASS 32
238 #define SNAT_SESSION_FLAG_AFFINITY 64
239 #define SNAT_SESSION_FLAG_OUTPUT_FEATURE 128
240 
241 /* NAT interface flags */
242 #define NAT_INTERFACE_FLAG_IS_INSIDE 1
243 #define NAT_INTERFACE_FLAG_IS_OUTSIDE 2
244 
245 /* Static mapping flags */
246 #define NAT_STATIC_MAPPING_FLAG_ADDR_ONLY 1
247 #define NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY 2
248 #define NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT 4
249 #define NAT_STATIC_MAPPING_FLAG_LB 8
250 
251 /* *INDENT-OFF* */
252 typedef CLIB_PACKED(struct
253 {
254  /* Outside network key */
255  snat_session_key_t out2in;
256 
257  /* Inside network key */
258  snat_session_key_t in2out;
259 
260  /* Flags */
261  u32 flags;
262 
263  /* Per-user translations */
264  u32 per_user_index;
265  u32 per_user_list_head_index;
266 
267  /* head of LRU list in which this session is tracked */
268  u32 lru_head_index;
269  /* index in global LRU list */
270  u32 lru_index;
271  f64 last_lru_update;
272 
273  /* Last heard timer */
274  f64 last_heard;
275 
276  /* Last HA refresh */
277  f64 ha_last_refreshed;
278 
279  /* Counters */
280  u64 total_bytes;
281  u32 total_pkts;
282 
283  /* External host address and port */
284  ip4_address_t ext_host_addr;
285  u16 ext_host_port;
286 
287  /* External host address and port after translation */
288  ip4_address_t ext_host_nat_addr;
289  u16 ext_host_nat_port;
290 
291  /* TCP session state */
292  u8 state;
293  u32 i2o_fin_seq;
294  u32 o2i_fin_seq;
295  u64 tcp_closed_timestamp;
296 
297  /* user index */
298  u32 user_index;
299 }) snat_session_t;
300 /* *INDENT-ON* */
301 
302 
303 typedef struct
304 {
310 } snat_user_t;
311 
312 typedef struct
313 {
316 /* *INDENT-OFF* */
317 #define _(N, i, n, s) \
318  u16 busy_##n##_ports; \
319  u16 * busy_##n##_ports_per_thread; \
320  u32 busy_##n##_port_refcounts[65535];
322 #undef _
323 /* *INDENT-ON* */
324 } snat_address_t;
325 
326 typedef struct
327 {
331 
332 typedef struct
333 {
334  /* Inside network port */
336  /* Outside network address and port */
338  /* Session state */
340  /* Expire timeout */
343 
344 typedef struct
345 {
346  /* inside IP address range */
349  /* outside IP address range */
352  /* inside IP addresses / outside IP addresses */
354  /* number of ports available to internal host */
356  /* session counter */
358  /* vector of sessions */
361 
362 typedef struct
363 {
364  /* backend IP address */
366  /* backend port number */
368  /* probability of the backend to be randomly matched */
371  /* backend FIB table */
375 
376 typedef enum
377 {
378  /* twice-nat disabled */
380  /* twice-nat enabled */
382  /* twice-nat only when src IP equals dst IP after translation */
385 
386 typedef enum
387 {
388  /* no load-balancing */
390  /* load-balancing */
392  /* load-balancing with affinity */
394 } lb_nat_type_t;
395 
396 typedef struct
397 {
398  /* local IP address */
400  /* external IP address */
402  /* local port */
404  /* external port */
406  /* is twice-nat */
407  twice_nat_type_t twice_nat;
408  /* local FIB table */
411  /* protocol */
413  /* 0 = disabled, otherwise client IP affinity sticky time in seconds */
415  /* worker threads used by backends/local host */
417  /* opaque string tag */
418  u8 *tag;
419  /* backends for load-balancing mode */
421  /* affinity per service lis */
423  /* flags */
426 
427 typedef struct
428 {
432 
433 typedef struct
434 {
444  int is_add;
447  u8 *tag;
449 
450 typedef struct
451 {
452  /* Main lookup tables */
453  clib_bihash_8_8_t out2in;
454  clib_bihash_8_8_t in2out;
455 
456  /* Endpoint dependent sessions lookup tables */
457  clib_bihash_16_8_t out2in_ed;
458  clib_bihash_16_8_t in2out_ed;
459 
460  /* Find-a-user => src address lookup */
461  clib_bihash_8_8_t user_hash;
462 
463  /* User pool */
465 
466  /* Session pool */
467  snat_session_t *sessions;
468 
469  /* Pool of doubly-linked list elements */
471 
472  /* LRU session list - head is stale, tail is fresh */
479 
480  /* NAT thread index */
482 
483  /* real thread index */
485 
487 
488 struct snat_main_s;
489 
490 /* ICMP session match function */
493  u32 thread_index,
494  vlib_buffer_t * b0,
495  ip4_header_t * ip0, u8 * p_proto,
496  snat_session_key_t * p_value,
497  u8 * p_dont_translate, void *d,
498  void *e);
499 
500 /* Return worker thread index for given packet */
502  u32 rx_fib_index,
503  u8 is_output);
504 
506  ip4_header_t * ip,
507  u32 rx_fib_index,
508  u8 is_output);
509 
510 /* NAT address and port allocation function */
511 typedef int (nat_alloc_out_addr_and_port_function_t) (snat_address_t *
512  addresses,
513  u32 fib_index,
514  u32 thread_index,
515  snat_session_key_t * k,
517  u32 snat_thread_index);
518 
519 
520 typedef struct snat_main_s
521 {
522  /* ICMP session match functions */
525 
526  /* Thread settings */
534 
535  /* Per thread data */
537 
538  /* Find a static mapping by local */
539  clib_bihash_8_8_t static_mapping_by_local;
540 
541  /* Find a static mapping by external */
542  clib_bihash_8_8_t static_mapping_by_external;
543 
544  /* Static mapping pool */
546 
547  /* Interface pool */
550 
551  /* Vector of outside addresses */
552  snat_address_t *addresses;
553  /* Address and port allocation function */
555  /* Address and port allocation type */
556  nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg;
557  /* Port set parameters (MAP-E) */
561  /* Port range parameters */
564 
565  /* vector of outside fibs */
567 
568  /* Vector of twice NAT addresses for external hosts */
569  snat_address_t *twice_nat_addresses;
570 
571  /* sw_if_indices whose intfc addresses should be auto-added */
574 
575  /* vector of interface address static mappings to resolve. */
577 
578  /* Randomize port allocation order */
580 
581  /* Worker handoff frame-queue index */
585 
586  /* node indexes */
588 
589  /* handoff fq nodes */
593 
594  /* respect feature arc nodes */
597 
611 
618 
619 
620  /* Deterministic NAT mappings */
622 
623  /* If forwarding is enabled */
625 
626  /* Config parameters */
632 
637 
641 
646 
647  /* values of various timeouts */
648  // proto timeouts
653 
654  /* TCP MSS clamping */
657 
658  /* counters/gauges */
661 
662  /* API message ID base */
664 
665  /* log class */
667  /* logging level */
669 
670  /* convenience */
675 } snat_main_t;
676 
677 typedef struct
678 {
682 
683 typedef struct
684 {
688 
689 extern snat_main_t snat_main;
690 
691 // nat pre ed next_node feature classification
695 
707 
710 
711 /* format functions */
721 /* unformat functions */
723 
724 /** \brief Check if SNAT session is created from static mapping.
725  @param s SNAT session
726  @return 1 if SNAT session is created from static mapping otherwise 0
727 */
728 #define snat_is_session_static(s) (s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING)
729 
730 /** \brief Check if SNAT session for unknown protocol.
731  @param s SNAT session
732  @return 1 if SNAT session for unknown protocol otherwise 0
733 */
734 #define snat_is_unk_proto_session(s) (s->flags & SNAT_SESSION_FLAG_UNKNOWN_PROTO)
735 
736 /** \brief Check if NAT session is twice NAT.
737  @param s NAT session
738  @return 1 if NAT session is twice NAT
739 */
740 #define is_twice_nat_session(s) (s->flags & SNAT_SESSION_FLAG_TWICE_NAT)
741 
742 /** \brief Check if NAT session is load-balancing.
743  @param s NAT session
744  @return 1 if NAT session is load-balancing
745 */
746 #define is_lb_session(s) (s->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
747 
748 /** \brief Check if NAT session is forwarding bypass.
749  @param s NAT session
750  @return 1 if NAT session is load-balancing
751 */
752 #define is_fwd_bypass_session(s) (s->flags & SNAT_SESSION_FLAG_FWD_BYPASS)
753 
754 /** \brief Check if NAT session is endpoint dependent.
755  @param s NAT session
756  @return 1 if NAT session is endpoint dependent
757 */
758 #define is_ed_session(s) (s->flags & SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT)
759 
760 /** \brief Check if NAT session has affinity record.
761  @param s NAT session
762  @return 1 if NAT session has affinity record
763 */
764 #define is_affinity_sessions(s) (s->flags & SNAT_SESSION_FLAG_AFFINITY)
765 
766 /** \brief Check if NAT interface is inside.
767  @param i NAT interface
768  @return 1 if inside interface
769 */
770 #define nat_interface_is_inside(i) i->flags & NAT_INTERFACE_FLAG_IS_INSIDE
771 
772 /** \brief Check if NAT interface is outside.
773  @param i NAT interface
774  @return 1 if outside interface
775 */
776 #define nat_interface_is_outside(i) i->flags & NAT_INTERFACE_FLAG_IS_OUTSIDE
777 
778 /** \brief Check if NAT44 endpoint-dependent TCP session is closed.
779  @param s NAT session
780  @return 1 if session is closed
781 */
782 #define nat44_is_ses_closed(s) s->state == 0xf
783 
784 /** \brief Check if NAT static mapping is address only (1:1NAT).
785  @param sm NAT static mapping
786  @return 1 if 1:1NAT, 0 if 1:1NAPT
787 */
788 #define is_addr_only_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_ADDR_ONLY)
789 
790 /** \brief Check if NAT static mapping match only out2in direction.
791  @param sm NAT static mapping
792  @return 1 if rule match only out2in direction
793 */
794 #define is_out2in_only_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY)
795 
796 /** \brief Check if NAT static mapping is identity NAT.
797  @param sm NAT static mapping
798  @return 1 if identity NAT
799 */
800 #define is_identity_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT)
801 
802 /** \brief Check if NAT static mapping is load-balancing.
803  @param sm NAT static mapping
804  @return 1 if load-balancing
805 */
806 #define is_lb_static_mapping(sm) (sm->flags & NAT_STATIC_MAPPING_FLAG_LB)
807 
808 /** \brief Check if client initiating TCP connection (received SYN from client)
809  @param t TCP header
810  @return 1 if client initiating TCP connection
811 */
812 always_inline bool
814 {
815  return (f & TCP_FLAG_SYN) && !(f & TCP_FLAG_ACK);
816 }
817 
818 /* logging */
819 #define nat_log_err(...) \
820  vlib_log(VLIB_LOG_LEVEL_ERR, snat_main.log_class, __VA_ARGS__)
821 #define nat_log_warn(...) \
822  vlib_log(VLIB_LOG_LEVEL_WARNING, snat_main.log_class, __VA_ARGS__)
823 #define nat_log_notice(...) \
824  vlib_log(VLIB_LOG_LEVEL_NOTICE, snat_main.log_class, __VA_ARGS__)
825 #define nat_log_info(...) \
826  vlib_log(VLIB_LOG_LEVEL_INFO, snat_main.log_class, __VA_ARGS__)
827 #define nat_log_debug(...)\
828  vlib_log(VLIB_LOG_LEVEL_DEBUG, snat_main.log_class, __VA_ARGS__)
829 
830 /* NAT API Logging Levels */
831 #define foreach_nat_log_level \
832  _(0x00, LOG_NONE) \
833  _(0x01, LOG_ERROR) \
834  _(0x02, LOG_WARNING) \
835  _(0x03, LOG_NOTICE) \
836  _(0x04, LOG_INFO) \
837  _(0x05, LOG_DEBUG)
838 
839 typedef enum nat_log_level_t_
840 {
841 #define _(n,f) SNAT_##f = n,
843 #undef _
845 
846 #define nat_elog(_level, _str) \
847 do \
848  { \
849  snat_main_t *sm = &snat_main; \
850  if (PREDICT_FALSE (sm->log_level >= _level)) \
851  { \
852  ELOG_TYPE_DECLARE (e) = \
853  { \
854  .format = "nat-msg " _str, \
855  .format_args = "", \
856  }; \
857  ELOG_DATA (&vlib_global_main.elog_main, e); \
858  } \
859  } while (0);
860 
861 #define nat_elog_addr(_level, _str, _addr) \
862 do \
863  { \
864  if (PREDICT_FALSE (sm->log_level >= _level)) \
865  { \
866  ELOG_TYPE_DECLARE (e) = \
867  { \
868  .format = "nat-msg " _str " %d.%d.%d.%d", \
869  .format_args = "i1i1i1i1", \
870  }; \
871  CLIB_PACKED(struct \
872  { \
873  u8 oct1; \
874  u8 oct2; \
875  u8 oct3; \
876  u8 oct4; \
877  }) *ed; \
878  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
879  ed->oct4 = _addr >> 24; \
880  ed->oct3 = _addr >> 16; \
881  ed->oct2 = _addr >> 8; \
882  ed->oct1 = _addr; \
883  } \
884  } while (0);
885 
886 #define nat_elog_debug_handoff(_str, _tid, _fib, _src, _dst) \
887 do \
888  { \
889  if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG)) \
890  { \
891  ELOG_TYPE_DECLARE (e) = \
892  { \
893  .format = "nat-msg " _str " ip src: %d.%d.%d.%d dst: %d.%d.%d.%d" \
894  " tid from: %d to: %d fib: %d", \
895  .format_args = "i1i1i1i1i1i1i1i1i4i4i4", \
896  }; \
897  CLIB_PACKED(struct \
898  { \
899  u8 src_oct1; \
900  u8 src_oct2; \
901  u8 src_oct3; \
902  u8 src_oct4; \
903  u8 dst_oct1; \
904  u8 dst_oct2; \
905  u8 dst_oct3; \
906  u8 dst_oct4; \
907  u32 ftid; \
908  u32 ttid; \
909  u32 fib; \
910  }) *ed; \
911  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
912  ed->src_oct1 = _src >> 24; \
913  ed->src_oct2 = _src >> 16; \
914  ed->src_oct3 = _src >> 8; \
915  ed->src_oct4 = _src; \
916  ed->dst_oct1 = _dst >> 24; \
917  ed->dst_oct2 = _dst >> 16; \
918  ed->dst_oct3 = _dst >> 8; \
919  ed->dst_oct4 = _dst; \
920  ed->ftid = vlib_get_thread_index (); \
921  ed->ttid = _tid; \
922  ed->fib = _fib; \
923  } \
924  } while (0);
925 
926 #define nat_elog_debug_handoff_v2(_str, _prt, _fib, _src, _dst) \
927 do \
928  { \
929  if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG)) \
930  { \
931  ELOG_TYPE_DECLARE (e) = \
932  { \
933  .format = "nat-msg " _str " ip_src:%d.%d.%d.%d ip_dst:%d.%d.%d.%d" \
934  " tid:%d prt:%d fib:%d", \
935  .format_args = "i1i1i1i1i1i1i1i1i4i4i4", \
936  }; \
937  CLIB_PACKED(struct \
938  { \
939  u8 src_oct1; \
940  u8 src_oct2; \
941  u8 src_oct3; \
942  u8 src_oct4; \
943  u8 dst_oct1; \
944  u8 dst_oct2; \
945  u8 dst_oct3; \
946  u8 dst_oct4; \
947  u32 tid; \
948  u32 prt; \
949  u32 fib; \
950  }) *ed; \
951  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
952  ed->src_oct1 = _src >> 24; \
953  ed->src_oct2 = _src >> 16; \
954  ed->src_oct3 = _src >> 8; \
955  ed->src_oct4 = _src; \
956  ed->dst_oct1 = _dst >> 24; \
957  ed->dst_oct2 = _dst >> 16; \
958  ed->dst_oct3 = _dst >> 8; \
959  ed->dst_oct4 = _dst; \
960  ed->tid = vlib_get_thread_index (); \
961  ed->prt = _prt; \
962  ed->fib = _fib; \
963  } \
964  } while (0);
965 
966 #define nat_elog_X1(_level, _fmt, _arg, _val1) \
967 do \
968  { \
969  snat_main_t *sm = &snat_main; \
970  if (PREDICT_FALSE (sm->log_level >= _level)) \
971  { \
972  ELOG_TYPE_DECLARE (e) = \
973  { \
974  .format = "nat-msg " _fmt, \
975  .format_args = _arg, \
976  }; \
977  CLIB_PACKED(struct \
978  { \
979  typeof (_val1) val1; \
980  }) *ed; \
981  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
982  ed->val1 = _val1; \
983  } \
984  } while (0);
985 
986 #define nat_elog_notice(nat_elog_str) \
987  nat_elog(SNAT_LOG_INFO, "[notice] " nat_elog_str)
988 #define nat_elog_warn(nat_elog_str) \
989  nat_elog(SNAT_LOG_WARNING, "[warning] " nat_elog_str)
990 #define nat_elog_err(nat_elog_str) \
991  nat_elog(SNAT_LOG_ERROR, "[error] " nat_elog_str)
992 #define nat_elog_debug(nat_elog_str) \
993  nat_elog(SNAT_LOG_DEBUG, "[debug] " nat_elog_str)
994 #define nat_elog_info(nat_elog_str) \
995  nat_elog(SNAT_LOG_INFO, "[info] " nat_elog_str)
996 
997 #define nat_elog_notice_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
998  nat_elog_X1(SNAT_LOG_NOTICE, "[notice] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
999 #define nat_elog_warn_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1000  nat_elog_X1(SNAT_LOG_WARNING, "[warning] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1001 #define nat_elog_err_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1002  nat_elog_X1(SNAT_LOG_ERROR, "[error] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1003 #define nat_elog_debug_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1004  nat_elog_X1(SNAT_LOG_DEBUG, "[debug] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1005 #define nat_elog_info_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
1006  nat_elog_X1(SNAT_LOG_INFO, "[info] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
1007 
1008 /* ICMP session match functions */
1010  u32 thread_index, vlib_buffer_t * b0,
1011  ip4_header_t * ip0, u8 * p_proto,
1012  snat_session_key_t * p_value,
1013  u8 * p_dont_translate, void *d, void *e);
1015  u32 thread_index, vlib_buffer_t * b0,
1016  ip4_header_t * ip0, u8 * p_proto,
1017  snat_session_key_t * p_value,
1018  u8 * p_dont_translate, void *d, void *e);
1020  u32 thread_index, vlib_buffer_t * b0,
1021  ip4_header_t * ip0, u8 * p_proto,
1022  snat_session_key_t * p_value,
1023  u8 * p_dont_translate, void *d, void *e);
1025  u32 thread_index, vlib_buffer_t * b0,
1026  ip4_header_t * ip0, u8 * p_proto,
1027  snat_session_key_t * p_value,
1028  u8 * p_dont_translate, void *d, void *e);
1029 
1030 /* ICMP deterministic NAT session match functions */
1032  u32 thread_index, vlib_buffer_t * b0,
1033  ip4_header_t * ip0, u8 * p_proto,
1034  snat_session_key_t * p_value,
1035  u8 * p_dont_translate, void *d, void *e);
1037  u32 thread_index, vlib_buffer_t * b0,
1038  ip4_header_t * ip0, u8 * p_proto,
1039  snat_session_key_t * p_value,
1040  u8 * p_dont_translate, void *d, void *e);
1041 
1042 /* ICMP endpoint-dependent session match functions */
1044  u32 thread_index, vlib_buffer_t * b0,
1045  ip4_header_t * ip0, u8 * p_proto,
1046  snat_session_key_t * p_value,
1047  u8 * p_dont_translate, void *d, void *e);
1049  u32 thread_index, vlib_buffer_t * b0,
1050  ip4_header_t * ip0, u8 * p_proto,
1051  snat_session_key_t * p_value,
1052  u8 * p_dont_translate, void *d, void *e);
1053 
1055  icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
1056  vlib_node_runtime_t * node, u32 next0, u32 thread_index,
1057  void *d, void *e);
1058 
1060  icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
1061  vlib_node_runtime_t * node, u32 next0, u32 thread_index,
1062  void *d, void *e);
1063 
1064 /* hairpinning functions */
1066  ip4_header_t * ip0, icmp46_header_t * icmp0,
1067  int is_ed);
1069  ip4_header_t * ip);
1071  ip4_header_t * ip);
1073  ip4_header_t * ip0, udp_header_t * udp0,
1074  tcp_header_t * tcp0, u32 proto0, int is_ed);
1075 
1076 /* Call back functions for clib_bihash_add_or_overwrite_stale */
1081 
1082 /**
1083  * @brief Add external address to NAT44 pool
1084  *
1085  * @param sm snat global configuration data
1086  * @param addr IPv4 address
1087  * @param vrf_id VRF id of tenant, ~0 means independent of VRF
1088  * @param twice_nat 1 if twice NAT address
1089  *
1090  * @return 0 on success, non-zero value otherwise
1091  */
1093  u8 twice_nat);
1094 
1095 /**
1096  * @brief Delete external address from NAT44 pool
1097  *
1098  * @param sm snat global configuration data
1099  * @param addr IPv4 address
1100  * @param delete_sm 1 if delete static mapping using address
1101  * @param twice_nat 1 if twice NAT address
1102  *
1103  * @return 0 on success, non-zero value otherwise
1104  */
1105 int snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
1106  u8 twice_nat);
1107 
1108 /**
1109  * @brief Add/delete external address to FIB DPO (out2in DPO mode)
1110  *
1111  * @param addr IPv4 address
1112  * @param is_add 1 = add, 0 = delete
1113  *
1114  * @return 0 on success, non-zero value otherwise
1115  */
1117 
1118 /**
1119  * @brief Add/delete NAT44 static mapping
1120  *
1121  * @param l_addr local IPv4 address
1122  * @param e_addr external IPv4 address
1123  * @param l_port local port number
1124  * @param e_port external port number
1125  * @param vrf_id local VRF ID
1126  * @param addr_only 1 = 1:1NAT, 0 = 1:1NAPT
1127  * @param sw_if_index use interface address as external IPv4 address
1128  * @param proto L4 protocol
1129  * @param is_add 1 = add, 0 = delete
1130  * @param twice_nat twice-nat mode
1131  * @param out2in_only if 1 rule match only out2in direction
1132  * @param tag opaque string tag
1133  * @param identity_nat identity NAT
1134  *
1135  * @return 0 on success, non-zero value otherwise
1136  */
1138  u16 l_port, u16 e_port, u32 vrf_id,
1139  int addr_only, u32 sw_if_index,
1140  nat_protocol_t proto, int is_add,
1141  twice_nat_type_t twice_nat, u8 out2in_only,
1142  u8 * tag, u8 identity_nat);
1143 
1144 /**
1145  * @brief Add/delete static mapping with load-balancing (multiple backends)
1146  *
1147  * @param e_addr external IPv4 address
1148  * @param e_port external port number
1149  * @param proto L4 protocol
1150  * @param locals list of local backends
1151  * @param is_add 1 = add, 0 = delete
1152  * @param twice_nat twice-nat mode
1153  * @param out2in_only if 1 rule match only out2in direction
1154  * @param tag opaque string tag
1155  * @param affinity 0 = disabled, otherwise client IP affinity sticky time
1156  *
1157  * @return 0 on success, non-zero value otherwise
1158  */
1161  nat44_lb_addr_port_t * locals, u8 is_add,
1162  twice_nat_type_t twice_nat,
1163  u8 out2in_only, u8 * tag, u32 affinity);
1164 
1166  ip4_address_t l_addr, u16 l_port,
1168  u8 probability, u8 is_add);
1169 
1171 
1172 /**
1173  * @brief Set NAT plugin workers
1174  *
1175  * @param bitmap NAT workers bitmap
1176  *
1177  * @return 0 on success, non-zero value otherwise
1178  */
1179 int snat_set_workers (uword * bitmap);
1180 
1181 /**
1182  * @brief Enable/disable NAT44 feature on the interface
1183  *
1184  * @param sw_if_index software index of the interface
1185  * @param is_inside 1 = inside, 0 = outside
1186  * @param is_del 1 = delete, 0 = add
1187  *
1188  * @return 0 on success, non-zero value otherwise
1189  */
1190 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del);
1191 
1192 /**
1193  * @brief Enable/disable NAT44 output feature on the interface (postrouting NAT)
1194  *
1195  * @param sw_if_index software index of the interface
1196  * @param is_inside 1 = inside, 0 = outside
1197  * @param is_del 1 = delete, 0 = add
1198  *
1199  * @return 0 on success, non-zero value otherwise
1200  */
1202  int is_del);
1203 
1204 /**
1205  * @brief Add/delete NAT44 pool address from specific interface
1206  *
1207  * @param sw_if_index software index of the interface
1208  * @param is_del 1 = delete, 0 = add
1209  * @param twice_nat 1 = twice NAT address for external hosts
1210  *
1211  * @return 0 on success, non-zero value otherwise
1212  */
1213 int snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
1214  u8 twice_nat);
1215 
1216 /**
1217  * @brief Delete NAT44 session
1218  *
1219  * @param addr IPv4 address
1220  * @param port L4 port number
1221  * @param proto L4 protocol
1222  * @param vrf_id VRF ID
1223  * @param is_in 1 = inside network address and port pair, 0 = outside
1224  *
1225  * @return 0 on success, non-zero value otherwise
1226  */
1228  nat_protocol_t proto, u32 vrf_id, int is_in);
1229 
1230 /**
1231  * @brief Delete NAT44 endpoint-dependent session
1232  *
1233  * @param sm snat global configuration data
1234  * @param addr IPv4 address
1235  * @param port L4 port number
1236  * @param proto L4 protocol
1237  * @param vrf_id VRF ID
1238  * @param is_in 1 = inside network address and port pair, 0 = outside
1239  *
1240  * @return 0 on success, non-zero value otherwise
1241  */
1243  ip4_address_t * eh_addr, u16 eh_port, u8 proto,
1244  u32 vrf_id, int is_in);
1245 
1246 /**
1247  * @brief Free NAT44 session data (lookup keys, external address port)
1248  *
1249  * @param sm snat global configuration data
1250  * @param s NAT session
1251  * @param thread_index thread index
1252  * @param is_ha is HA event
1253  */
1254 void nat_free_session_data (snat_main_t * sm, snat_session_t * s,
1255  u32 thread_index, u8 is_ha);
1256 
1257 /**
1258  * @brief Set NAT44 session limit (session limit, vrf id)
1259  *
1260  * @param session_limit Session limit
1261  * @param vrf_id VRF id
1262  * @return 0 on success, non-zero value otherwise
1263  */
1264 int nat44_set_session_limit (u32 session_limit, u32 vrf_id);
1265 
1266 /**
1267  * @brief Free NAT44 ED session data (lookup keys, external address port)
1268  *
1269  * @param s NAT session
1270  * @param thread_index thread index
1271  * @param is_ha is HA event
1272  */
1273 void
1274 nat44_free_session_data (snat_main_t * sm, snat_session_t * s,
1275  u32 thread_index, u8 is_ha);
1276 
1277 /**
1278  * @brief Initialize NAT44 data
1279  *
1280  * @param tsm per thread data
1281  */
1283 
1284 /**
1285  * @brief Free NAT44 data
1286  *
1287  * @param tsm per thread data
1288  */
1290 
1291 /**
1292  * @brief Find or create NAT user
1293  *
1294  * @param sm snat global configuration data
1295  * @param addr IPv4 address
1296  * @param fib_index FIB table index
1297  * @param thread_index thread index
1298  *
1299  * @return NAT user data structure on success otherwise zero value
1300  */
1302  ip4_address_t * addr, u32 fib_index,
1303  u32 thread_index);
1304 
1305 /**
1306  * @brief Allocate new NAT session or recycle last used
1307  *
1308  * @param sm snat global configuration data
1309  * @param u NAT user
1310  * @param thread_index thread index
1311  * @param now time now
1312  *
1313  * @return session data structure on success otherwise zero value
1314  */
1315 snat_session_t *nat_session_alloc_or_recycle (snat_main_t * sm,
1316  snat_user_t * u,
1317  u32 thread_index, f64 now);
1318 
1319 /**
1320  * @brief Set address and port assignment algorithm for MAP-E CE
1321  *
1322  * @param psid Port Set Identifier value
1323  * @param psid_offset number of offset bits
1324  * @param psid_length length of PSID
1325  */
1327  u16 psid_length);
1328 
1329 /**
1330  * @brief Set address and port assignment algorithm for port range
1331  *
1332  * @param start_port beginning of the port range
1333  * @param end_port end of the port range
1334  */
1336 
1337 /**
1338  * @brief Set address and port assignment algorithm to default/standard
1339  */
1341 
1342 /**
1343  * @brief Free outside address and port pair
1344  *
1345  * @param addresses vector of outside addresses
1346  * @param thread_index thread index
1347  * @param k address, port and protocol
1348  */
1349 void snat_free_outside_address_and_port (snat_address_t * addresses,
1350  u32 thread_index,
1351  snat_session_key_t * k);
1352 
1353 /**
1354  * @brief Alloc outside address and port
1355  *
1356  * @param addresses vector of outside addresses
1357  * @param fib_index FIB table index
1358  * @param thread_index thread index
1359  * @param k allocated address and port pair
1360  * @param port_per_thread number of ports per thread
1361  * @param snat_thread_index NAT thread index
1362  *
1363  * @return 0 on success, non-zero value otherwise
1364  */
1365 int snat_alloc_outside_address_and_port (snat_address_t * addresses,
1366  u32 fib_index,
1367  u32 thread_index,
1368  snat_session_key_t * k,
1369  u16 port_per_thread,
1370  u32 snat_thread_index);
1371 
1372 /**
1373  * @brief Match NAT44 static mapping.
1374  *
1375  * @param match address and port to match
1376  * @param mapping external/local address and port of the matched mapping
1377  * @param by_external if 0 match by local address otherwise match by external
1378  * address
1379  * @param is_addr_only 1 if matched mapping is address only
1380  * @param twice_nat matched mapping is twice NAT type
1381  * @param lb 1 if matched mapping is load-balanced
1382  * @param ext_host_addr external host address
1383  *
1384  * @returns 0 if match found otherwise 1.
1385  */
1387  snat_session_key_t match,
1388  snat_session_key_t * mapping,
1389  u8 by_external,
1390  u8 * is_addr_only,
1391  twice_nat_type_t * twice_nat,
1392  lb_nat_type_t * lb,
1393  ip4_address_t * ext_host_addr,
1394  u8 * is_identity_nat);
1395 
1396 /**
1397  * @brief Add/del NAT address to FIB.
1398  *
1399  * Add the external NAT address to the FIB as receive entries. This ensures
1400  * that VPP will reply to ARP for this address and we don't need to enable
1401  * proxy ARP on the outside interface.
1402  *
1403  * @param addr IPv4 address
1404  * @param plen address prefix length
1405  * @param sw_if_index software index of the outside interface
1406  * @param is_add 0 = delete, 1 = add.
1407  */
1409  u8 p_len, u32 sw_if_index, int is_add);
1410 
1411 /*
1412  * Why is this here? Because we don't need to touch this layer to
1413  * simply reply to an icmp. We need to change id to a unique
1414  * value to NAT an echo request/reply.
1415  */
1416 
1417 typedef struct
1418 {
1422 
1423 typedef struct
1424 {
1427 
1428 #endif /* __included_nat_h__ */
1429 /*
1430  * fd.io coding-style-patch-verification: ON
1431  *
1432  * Local Variables:
1433  * eval: (c-set-style "gnu")
1434  * End:
1435  */
ip4_address_t external_addr
Definition: nat.h:401
int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat)
Delete external address from NAT44 pool.
Definition: nat.c:1740
clib_error_t * snat_api_init(vlib_main_t *vm, snat_main_t *sm)
Definition: nat_api.c:3275
#define foreach_nat_addr_and_port_alloc_alg
Definition: nat.h:134
nat_outside_fib_t * outside_fibs
Definition: nat.h:566
vlib_node_registration_t nat_default_node
(constructor) VLIB_REGISTER_NODE (nat_default_node)
Definition: nat.c:4513
enum fib_source_t_ fib_source_t
The different sources that can create a route.
uword translation_memory_size
Definition: nat.h:634
u32 * max_translations_per_fib
Definition: nat.h:636
nat_addr_and_port_alloc_alg_t
Definition: nat.h:139
dlist_elt_t * lru_pool
Definition: nat.h:473
u32 sessions_per_user_list_head_index
Definition: nat.h:307
int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 feature on the interface.
Definition: nat.c:1861
u16 ext_host_port
Definition: nat.h:94
u32 icmp_out2in(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: out2in.c:525
u32 hairpin_dst_node_index
Definition: nat.h:613
u16 out_port
Definition: nat.h:95
u32 arc_next_index
Definition: nat.h:68
u32 ed_hairpinning_node_index
Definition: nat.h:615
u32 icmp_timeout
Definition: nat.h:652
int nat44_add_del_lb_static_mapping(ip4_address_t e_addr, u16 e_port, nat_protocol_t proto, nat44_lb_addr_port_t *locals, u8 is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u32 affinity)
Add/delete static mapping with load-balancing (multiple backends)
Definition: nat.c:1325
u32 fq_in2out_output_index
Definition: nat.h:583
u16 start_port
Definition: nat.h:562
u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
#define TCP_FLAG_SYN
Definition: fa_node.h:13
u32 ed_out2in_node_index
Definition: nat.h:607
snat_session_t * nat_session_alloc_or_recycle(snat_main_t *sm, snat_user_t *u, u32 thread_index, f64 now)
Allocate new NAT session or recycle last used.
Definition: nat.c:533
u32 nsessions
Definition: nat.h:308
#define foreach_snat_session_state
Definition: nat.h:147
unsigned long u64
Definition: types.h:89
ip4_address_t addr
Definition: nat.h:365
int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, u8 twice_nat)
Add/delete NAT44 pool address from specific interface.
Definition: nat.c:4324
enum nat_log_level_t_ nat_log_level_t
int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, nat_protocol_t proto, int is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u8 identity_nat)
Add/delete NAT44 static mapping.
Definition: nat.c:862
u16 port_per_thread
Definition: nat.h:532
format_function_t format_nat_protocol
Definition: nat.h:719
u32 nstaticsessions
Definition: nat.h:309
u32 ed_out2in_slowpath_node_index
Definition: nat.h:608
u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
Definition: out2in.c:326
vlib_node_registration_t nat44_ed_in2out_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_node)
Definition: in2out_ed.c:1515
format_function_t format_det_map_ses
Definition: nat.h:716
#define foreach_nat_in2out_ed_error
Definition: nat.h:166
nat_protocol_t proto
Definition: nat.h:412
vlib_node_registration_t snat_det_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_det_out2in_node)
int nat44_i2o_ed_is_idle_session_cb(clib_bihash_kv_16_8_t *kv, void *arg)
Definition: in2out_ed.c:70
u32 fib_index
Definition: nat.h:306
format_function_t format_snat_static_mapping
Definition: nat.h:713
format_function_t format_snat_key
Definition: nat.h:717
nat_protocol_t
Definition: lib.h:41
snat_det_map_t * det_maps
Definition: nat.h:621
nat_log_level_t_
Definition: nat.h:839
nat_alloc_out_addr_and_port_function_t * alloc_addr_and_port
Definition: nat.h:554
u32 num_snat_thread
Definition: nat.h:533
NAT port/address allocation lib.
dlist_elt_t * list_pool
Definition: nat.h:470
u8 in_plen
Definition: nat.h:348
struct _tcp_header tcp_header_t
int snat_hairpinning(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, udp_header_t *udp0, tcp_header_t *tcp0, u32 proto0, int is_ed)
vhost_vring_addr_t addr
Definition: vhost_user.h:254
unsigned char u8
Definition: types.h:56
u8 deterministic
Definition: nat.h:629
u32 icmp_match_out2in_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Definition: out2in_ed.c:430
u32 handoff_in2out_index
Definition: nat.h:591
nat44_lb_addr_port_t * locals
Definition: nat.h:420
int snat_set_workers(uword *bitmap)
Set NAT plugin workers.
Definition: nat.c:2324
u32 user_buckets
Definition: nat.h:638
double f64
Definition: types.h:142
clib_bihash_8_8_t user_hash
Definition: nat.h:461
u32 cached_sw_if_index
Definition: nat.h:685
u32 next_index
Definition: nat.h:67
void nat_set_alloc_addr_and_port_mape(u16 psid, u16 psid_offset, u16 psid_length)
Set address and port assignment algorithm for MAP-E CE.
Definition: nat.c:4474
u8 *() format_function_t(u8 *s, va_list *args)
Definition: format.h:48
u32 max_translations_per_user
Definition: nat.h:640
clib_bihash_8_8_t in2out
Definition: nat.h:454
Definition: nat.h:62
u32 in2out_output_node_index
Definition: nat.h:599
u32 ed_in2out_node_index
Definition: nat.h:603
u32 vlib_log_class_t
Definition: vlib.h:51
snat_get_worker_out2in_function_t * worker_out2in_cb
Definition: nat.h:531
vl_api_interface_index_t sw_if_index
Definition: gre.api:53
vlib_node_registration_t snat_out2in_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_node)
Definition: out2in.c:1386
ip4_address_t ext_host_addr
Definition: nat.h:93
u32 det_in2out_node_index
Definition: nat.h:609
#define TCP_FLAG_ACK
Definition: fa_node.h:16
int nat44_set_session_limit(u32 session_limit, u32 vrf_id)
Set NAT44 session limit (session limit, vrf id)
Definition: nat.c:333
fib_source_t nat_fib_src_hi
Definition: dslite.c:22
u32 translation_buckets
Definition: nat.h:633
lb_nat_type_t
Definition: nat.h:386
ip4_address_t addr
Definition: nat.h:305
u8 probability
Definition: nat.api:855
void nat44_db_free(snat_main_per_thread_data_t *tsm)
Free NAT44 data.
Definition: nat.c:3931
int snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
Add external address to NAT44 pool.
Definition: nat.c:636
ip4_main_t * ip4_main
Definition: nat.h:672
unsigned int u32
Definition: types.h:88
A collection of simple counters.
Definition: counter.h:57
vlib_node_registration_t snat_in2out_output_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_node)
Definition: in2out.c:1682
ip4_address_t local_addr
Definition: nat.h:399
vlib_node_registration_t snat_in2out_output_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_output_worker_handoff_node)
fib_source_t nat_fib_src_low
Definition: nat.c:44
u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
u32() snat_get_worker_out2in_function_t(vlib_buffer_t *b, ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
Definition: nat.h:505
twice_nat_type_t twice_nat
Definition: nat.h:407
u32 max_translations
Definition: nat.h:635
u32 * auto_add_sw_if_indices_twice_nat
Definition: nat.h:573
vlib_node_registration_t nat44_ed_out2in_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_out2in_node)
Definition: out2in_ed.c:1263
uword user_memory_size
Definition: nat.h:639
u32 fib_index
Definition: nat.h:328
u16 mss_value_net
Definition: nat.h:656
u32 handoff_in2out_output_index
Definition: nat.h:592
nat_addr_and_port_alloc_alg_t addr_and_port_alloc_alg
Definition: nat.h:556
#define foreach_nat_out2in_ed_error
Definition: nat.h:193
clib_bihash_16_8_t out2in_ed
Definition: nat.h:457
snat_det_session_t * sessions
Definition: nat.h:359
vl_api_ip_proto_t proto
Definition: acl_types.api:50
u16 mss_clamping
Definition: nat.h:655
unsigned short u16
Definition: types.h:57
u32 pre_in2out_node_index
Definition: nat.h:596
u16 protocol
Definition: nat.h:80
u8 out2in_dpo
Definition: nat.h:630
snat_static_mapping_t * static_mappings
Definition: nat.h:545
u32 inside_fib_index
Definition: nat.h:645
u32 udp_timeout
Definition: nat.h:649
u8 static_mapping_only
Definition: nat.h:627
int nat44_del_ed_session(snat_main_t *sm, ip4_address_t *addr, u16 port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 vrf_id, int is_in)
Delete NAT44 endpoint-dependent session.
Definition: nat.c:4435
nat_next_t
Definition: nat.h:51
void nat_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 session data (lookup keys, external address port)
Definition: nat.c:198
void nat_set_alloc_addr_and_port_default(void)
Set address and port assignment algorithm to default/standard.
Definition: nat.c:4497
#define always_inline
Definition: ipsec.h:28
void snat_add_del_addr_to_fib(ip4_address_t *addr, u8 p_len, u32 sw_if_index, int is_add)
Add/del NAT address to FIB.
Definition: nat.c:608
u32 hairpin_src_node_index
Definition: nat.h:614
clib_bihash_8_8_t static_mapping_by_external
Definition: nat.h:542
u32 in2out_slowpath_output_node_index
Definition: nat.h:602
u8 psid_offset
Definition: nat.h:558
struct snat_main_s snat_main_t
uword() unformat_function_t(unformat_input_t *input, va_list *args)
Definition: format.h:233
u32 handoff_out2in_index
Definition: nat.h:590
api_main_t * api_main
Definition: nat.h:674
vlib_main_t * vm
Definition: in2out_ed.c:1599
u8 out_plen
Definition: nat.h:351
u8 psid_length
Definition: nat.h:559
u32 refcount
Definition: nat.h:329
vnet_main_t * vnet_main
Definition: nat.h:671
u32 inside_vrf_id
Definition: nat.h:644
Definition: nat.h:391
u32 snat_icmp_hairpinning(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, int is_ed)
u8 log_level
Definition: nat.h:668
u32 fq_out2in_index
Definition: nat.h:584
API main structure, used by both vpp and binary API clients.
Definition: api_common.h:226
int nat44_o2i_is_idle_session_cb(clib_bihash_kv_8_8_t *kv, void *arg)
Definition: out2in.c:115
snat_interface_t * output_feature_interfaces
Definition: nat.h:549
u16 src_port
Definition: nat.h:1425
u32 pre_out2in_node_index
Definition: nat.h:595
u32 ed_hairpin_src_node_index
Definition: nat.h:617
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
snat_main_t snat_main
Definition: nat.c:41
vlib_node_registration_t snat_det_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_det_in2out_node)
snat_session_state_t
Definition: nat.h:159
snat_user_t * users
Definition: nat.h:464
u32 random_seed
Definition: nat.h:579
u32 flags
Definition: vhost_user.h:248
clib_bihash_8_8_t out2in
Definition: nat.h:453
int nat44_o2i_ed_is_idle_session_cb(clib_bihash_kv_16_8_t *kv, void *arg)
Definition: out2in_ed.c:94
u32 outside_vrf_id
Definition: nat.h:642
u8 static_mapping_connection_tracking
Definition: nat.h:628
u16 end_port
Definition: nat.h:563
format_function_t format_snat_static_map_to_resolve
Definition: nat.h:714
u32 ed_in2out_slowpath_node_index
Definition: nat.h:604
u32 error_node_index
Definition: nat.h:587
u32 sharing_ratio
Definition: nat.h:353
ip4_address_t out_addr
Definition: nat.h:350
u16 psid
Definition: nat.h:560
int nat44_lb_static_mapping_add_del_local(ip4_address_t e_addr, u16 e_port, ip4_address_t l_addr, u16 l_port, nat_protocol_t proto, u32 vrf_id, u8 probability, u8 is_add)
Definition: nat.c:1578
u32 outside_fib_index
Definition: nat.h:643
format_function_t format_nat_addr_and_port_alloc_alg
Definition: nat.h:720
void nat44_db_init(snat_main_per_thread_data_t *tsm)
Initialize NAT44 data.
Definition: nat.c:3869
int snat_static_mapping_match(snat_main_t *sm, snat_session_key_t match, snat_session_key_t *mapping, u8 by_external, u8 *is_addr_only, twice_nat_type_t *twice_nat, lb_nat_type_t *lb, ip4_address_t *ext_host_addr, u8 *is_identity_nat)
Match NAT44 static mapping.
Definition: nat.c:2741
8 octet key, 8 octet key value pair
Definition: bihash_8_8.h:39
ip4_address_t addr
Definition: nat.h:78
u32 ed_hairpin_dst_node_index
Definition: nat.h:616
u32 sw_if_index
Definition: nat.h:429
#define foreach_nat_config_flag
Definition: nat.h:116
snat_user_t * nat_user_get_or_create(snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index)
Find or create NAT user.
Definition: nat.c:481
u32() snat_get_worker_in2out_function_t(ip4_header_t *ip, u32 rx_fib_index, u8 is_output)
Definition: nat.h:501
nat_out2in_ed_error_t
Definition: nat.h:213
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1599
u32 tcp_transitory_timeout
Definition: nat.h:650
u32 * auto_add_sw_if_indices
Definition: nat.h:572
u32 in2out_fast_node_index
Definition: nat.h:600
void nat44_add_del_address_dpo(ip4_address_t addr, u8 is_add)
Add/delete external address to FIB DPO (out2in DPO mode)
Definition: nat.c:3099
u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation and create session if needed...
Definition: in2out.c:457
unformat_function_t unformat_nat_protocol
Definition: nat.h:722
u32 num_workers
Definition: nat.h:527
Definition: nat.h:381
u32 first_worker_index
Definition: nat.h:528
u32 det_out2in_node_index
Definition: nat.h:610
void snat_free_outside_address_and_port(snat_address_t *addresses, u32 thread_index, snat_session_key_t *k)
Free outside address and port pair.
Definition: nat.c:2669
ip4_address_t l_addr
Definition: nat.h:435
u32 in2out_slowpath_node_index
Definition: nat.h:601
snat_icmp_match_function_t * icmp_match_out2in_cb
Definition: nat.h:524
IPv4 main type.
Definition: ip4.h:106
vlib_log_class_t log_class
Definition: nat.h:666
u64 as_u64
Definition: nat.h:111
vlib_node_registration_t snat_out2in_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_out2in_worker_handoff_node)
ip4_address_t addr
Definition: nat.h:108
ip4_address_t in_addr
Definition: nat.h:347
u32 fq_in2out_index
Definition: nat.h:582
u32 out2in_node_index
Definition: nat.h:605
ip4_address_t addr
Definition: nat.h:314
snat_address_t * twice_nat_addresses
Definition: nat.h:569
u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation.
Definition: out2in.c:461
format_function_t format_snat_session
Definition: nat.h:715
struct _vlib_node_registration vlib_node_registration_t
Definition: nat.h:389
vlib_simple_counter_main_t total_users
Definition: nat.h:659
int nat44_del_session(snat_main_t *sm, ip4_address_t *addr, u16 port, nat_protocol_t proto, u32 vrf_id, int is_in)
Delete NAT44 session.
Definition: nat.c:4392
void nat_hairpinning_sm_unknown_proto(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip)
vl_api_address_t ip
Definition: l2.api:501
format_function_t format_static_mapping_key
Definition: nat.h:718
twice_nat_type_t
Definition: nat.h:376
u32 hairpinning_node_index
Definition: nat.h:612
u16 msg_id_base
Definition: nat.h:663
vlib_node_registration_t nat_pre_in2out_node
(constructor) VLIB_REGISTER_NODE (nat_pre_in2out_node)
Definition: in2out_ed.c:1606
u16 ports_per_host
Definition: nat.h:355
typedef CLIB_PACKED(struct { snat_session_key_t out2in;snat_session_key_t in2out;u32 flags;u32 per_user_index;u32 per_user_list_head_index;u32 lru_head_index;u32 lru_index;f64 last_lru_update;f64 last_heard;f64 ha_last_refreshed;u64 total_bytes;u32 total_pkts;ip4_address_t ext_host_addr;u16 ext_host_port;ip4_address_t ext_host_nat_addr;u16 ext_host_nat_port;u8 state;u32 i2o_fin_seq;u32 o2i_fin_seq;u64 tcp_closed_timestamp;u32 user_index;}) snat_session_t
VLIB buffer representation.
Definition: buffer.h:102
u32 * workers
Definition: nat.h:529
u64 uword
Definition: types.h:112
snat_main_per_thread_data_t * per_thread_data
Definition: nat.h:536
int nat44_i2o_is_idle_session_cb(clib_bihash_kv_8_8_t *kv, void *arg)
Definition: in2out.c:195
u32 icmp_match_in2out_ed(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Definition: in2out_ed.c:636
snat_det_out_key_t out
Definition: nat.h:337
u32 affinity_per_service_list_head_index
Definition: nat.h:422
u32 fib_index
Definition: nat.h:109
snat_address_t * addresses
Definition: nat.h:552
u16 port
Definition: lb_types.api:72
u32 out2in_fast_node_index
Definition: nat.h:606
void nat_set_alloc_addr_and_port_range(u16 start_port, u16 end_port)
Set address and port assignment algorithm for port range.
Definition: nat.c:4486
u32 in2out_node_index
Definition: nat.h:598
format_function_t format_snat_user
Definition: nat.h:712
snat_get_worker_in2out_function_t * worker_in2out_cb
Definition: nat.h:530
snat_static_map_resolve_t * to_resolve
Definition: nat.h:576
void nat44_ed_hairpinning_unknown_proto(snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip)
vl_api_dhcp_client_state_t state
Definition: dhcp.api:201
vlib_node_registration_t snat_in2out_worker_handoff_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_worker_handoff_node)
nat_config_flags_t_
Definition: nat.h:126
u8 forwarding_enabled
Definition: nat.h:624
int snat_alloc_outside_address_and_port(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
Alloc outside address and port.
Definition: nat.c:2900
int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 output feature on the interface (postrouting NAT)
Definition: nat.c:2126
nat_protocol_t proto
Definition: nat.h:440
u32 ses_num
Definition: nat.h:357
u32 icmp_in2out(snat_main_t *sm, vlib_buffer_t *b0, ip4_header_t *ip0, icmp46_header_t *icmp0, u32 sw_if_index0, u32 rx_fib_index0, vlib_node_runtime_t *node, u32 next0, u32 thread_index, void *d, void *e)
Definition: in2out.c:654
enum nat_config_flags_t_ nat_config_flags_t
clib_bihash_16_8_t in2out_ed
Definition: nat.h:458
u32 vrf_id
Definition: nat.api:856
u8 endpoint_dependent
Definition: nat.h:631
u16 dst_port
Definition: udp.api:42
vlib_node_registration_t snat_in2out_node
(constructor) VLIB_REGISTER_NODE (snat_in2out_node)
Definition: in2out.c:1650
vlib_node_registration_t nat44_ed_in2out_output_node
(constructor) VLIB_REGISTER_NODE (nat44_ed_in2out_output_node)
Definition: in2out_ed.c:1535
vlib_simple_counter_main_t total_sessions
Definition: nat.h:660
ip_lookup_main_t * ip4_lookup_main
Definition: nat.h:673
u32 icmp_match_in2out_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Get address and port values to be used for ICMP packet translation.
Definition: in2out.c:581
void nat44_free_session_data(snat_main_t *sm, snat_session_t *s, u32 thread_index, u8 is_ha)
Free NAT44 ED session data (lookup keys, external address port)
Definition: nat.c:352
snat_session_t * sessions
Definition: nat.h:467
u32 cached_ip4_address
Definition: nat.h:686
snat_icmp_match_function_t * icmp_match_in2out_cb
Definition: nat.h:523
#define foreach_nat_log_level
Definition: nat.h:831
u32() snat_icmp_match_function_t(struct snat_main_s *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e)
Definition: nat.h:491
clib_bihash_8_8_t static_mapping_by_local
Definition: nat.h:539
u32 fib_index
Definition: nat.h:315
nat_in2out_ed_error_t
Definition: nat.h:185
snat_interface_t * interfaces
Definition: nat.h:548
vlib_node_registration_t nat_pre_out2in_node
(constructor) VLIB_REGISTER_NODE (nat_pre_out2in_node)
Definition: out2in_ed.c:1314
u32 tcp_established_timeout
Definition: nat.h:651
static bool tcp_flags_is_init(u8 f)
Check if client initiating TCP connection (received SYN from client)
Definition: nat.h:813
int() nat_alloc_out_addr_and_port_function_t(snat_address_t *addresses, u32 fib_index, u32 thread_index, snat_session_key_t *k, u16 port_per_thread, u32 snat_thread_index)
Definition: nat.h:511