2 * Copyright (c) 2020 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/fib/fib_table.h>
17 #include <vnet/dpo/drop_dpo.h>
19 #include <cnat/cnat_client.h>
20 #include <cnat/cnat_translation.h>
22 cnat_client_t *cnat_client_pool;
23 cnat_client_db_t cnat_client_db;
24 dpo_type_t cnat_client_dpo;
25 fib_source_t cnat_fib_source;
27 static_always_inline u8
28 cnat_client_is_clone (cnat_client_t * cc)
30 return (FIB_NODE_INDEX_INVALID == cc->cc_fei);
34 cnat_client_db_remove (cnat_client_t * cc)
36 clib_bihash_kv_16_8_t bkey;
37 if (ip_addr_version (&cc->cc_ip) == AF_IP4)
39 bkey.key[0] = ip_addr_v4 (&cc->cc_ip).as_u32;
44 bkey.key[0] = ip_addr_v6 (&cc->cc_ip).as_u64[0];
45 bkey.key[1] = ip_addr_v6 (&cc->cc_ip).as_u64[1];
48 clib_bihash_add_del_16_8 (&cnat_client_db.cc_ip_id_hash, &bkey, 0 /* del */);
52 cnat_client_db_add (cnat_client_t *cc)
56 cci = cc - cnat_client_pool;
58 clib_bihash_kv_16_8_t bkey;
60 if (ip_addr_version (&cc->cc_ip) == AF_IP4)
62 bkey.key[0] = ip_addr_v4 (&cc->cc_ip).as_u32;
67 bkey.key[0] = ip_addr_v6 (&cc->cc_ip).as_u64[0];
68 bkey.key[1] = ip_addr_v6 (&cc->cc_ip).as_u64[1];
71 clib_bihash_add_del_16_8 (&cnat_client_db.cc_ip_id_hash, &bkey, 1 /* add */);
75 cnat_client_destroy (cnat_client_t * cc)
77 ASSERT (!cnat_client_is_clone (cc));
79 ASSERT (fib_entry_is_sourced (cc->cc_fei, cnat_fib_source));
80 fib_table_entry_delete_index (cc->cc_fei, cnat_fib_source);
82 cnat_client_db_remove (cc);
83 dpo_reset (&cc->cc_parent);
84 pool_put (cnat_client_pool, cc);
88 cnat_client_free_by_ip (ip46_address_t * ip, u8 af)
92 cnat_client_ip4_find (&ip->ip4) : cnat_client_ip6_find (&ip->ip6));
95 if (0 == cnat_client_uncnt_session (cc) && 0 == cc->tr_refcnt)
96 cnat_client_destroy (cc);
100 cnat_client_throttle_pool_process ()
102 /* This processes ips stored in the throttle pool
103 to update session refcounts
104 and should be called before cnat_client_free_by_ip */
106 ip_address_t *addr, *del_vec = NULL;
109 vec_reset_length (del_vec);
110 clib_spinlock_lock (&cnat_client_db.throttle_lock);
111 hash_foreach_mem (addr, refcnt, cnat_client_db.throttle_mem, {
112 cc = (AF_IP4 == addr->version ? cnat_client_ip4_find (&ip_addr_v4 (addr)) :
113 cnat_client_ip6_find (&ip_addr_v6 (addr)));
114 /* Client might not already be created */
117 cnat_client_t *ccp = cnat_client_get (cc->parent_cci);
118 clib_atomic_add_fetch (&ccp->session_refcnt, refcnt);
119 vec_add1 (del_vec, *addr);
122 vec_foreach (addr, del_vec)
123 hash_unset_mem_free (&cnat_client_db.throttle_mem, addr);
124 clib_spinlock_unlock (&cnat_client_db.throttle_lock);
128 cnat_client_translation_added (index_t cci)
131 if (INDEX_INVALID == cci)
134 cc = cnat_client_get (cci);
139 cnat_client_translation_deleted (index_t cci)
142 if (INDEX_INVALID == cci)
145 cc = cnat_client_get (cci);
148 if (0 == cc->tr_refcnt && 0 == cc->session_refcnt)
149 cnat_client_destroy (cc);
153 cnat_client_add (const ip_address_t * ip, u8 flags)
156 dpo_id_t tmp = DPO_INVALID;
157 fib_node_index_t fei;
163 /* check again if we need this client */
164 cc = (AF_IP4 == ip->version ?
165 cnat_client_ip4_find (&ip->ip.ip4) :
166 cnat_client_ip6_find (&ip->ip.ip6));
169 return (cc - cnat_client_pool);
172 pool_get_aligned (cnat_client_pool, cc, CLIB_CACHE_LINE_BYTES);
174 cci = cc - cnat_client_pool;
175 cc->parent_cci = cci;
178 cc->session_refcnt = 0;
180 ip_address_copy (&cc->cc_ip, ip);
181 cnat_client_db_add (cc);
183 ip_address_to_fib_prefix (&cc->cc_ip, &pfx);
185 dproto = fib_proto_to_dpo (pfx.fp_proto);
186 dpo_set (&tmp, cnat_client_dpo, dproto, cci);
187 dpo_stack (cnat_client_dpo, dproto, &cc->cc_parent, drop_dpo_get (dproto));
189 fib_flags = FIB_ENTRY_FLAG_LOOSE_URPF_EXEMPT;
190 fib_flags |= (flags & CNAT_FLAG_EXCLUSIVE) ?
191 FIB_ENTRY_FLAG_EXCLUSIVE : FIB_ENTRY_FLAG_INTERPOSE;
193 fei = fib_table_entry_special_dpo_add (CNAT_FIB_TABLE,
194 &pfx, cnat_fib_source, fib_flags,
197 cc = pool_elt_at_index (cnat_client_pool, cci);
204 cnat_client_learn (const ip_address_t *addr)
206 /* RPC call to add a client from the dataplane */
209 cci = cnat_client_add (addr, 0 /* flags */);
210 cc = pool_elt_at_index (cnat_client_pool, cci);
211 cnat_client_cnt_session (cc);
212 /* Process throttled calls if any */
213 cnat_client_throttle_pool_process ();
217 * Interpose a policy DPO
220 cnat_client_dpo_interpose (const dpo_id_t * original,
221 const dpo_id_t * parent, dpo_id_t * clone)
223 cnat_client_t *cc, *cc_clone;
225 pool_get_zero (cnat_client_pool, cc_clone);
226 cc = cnat_client_get (original->dpoi_index);
228 cc_clone->cc_fei = FIB_NODE_INDEX_INVALID;
229 cc_clone->parent_cci = cc->parent_cci;
230 cc_clone->flags = cc->flags;
231 ip_address_copy (&cc_clone->cc_ip, &cc->cc_ip);
233 /* stack the clone on the FIB provided parent */
234 dpo_stack (cnat_client_dpo, original->dpoi_proto, &cc_clone->cc_parent,
237 /* return the clone */
240 original->dpoi_proto, cc_clone - cnat_client_pool);
244 cnat_client_purge (void)
247 if ((rv = pool_elts (cnat_client_pool)))
248 clib_warning ("len(cnat_client_pool) isnt 0 but %d", rv);
250 if ((rv = hash_elts (cnat_client_db.throttle_mem)))
251 clib_warning ("len(throttle_mem) isnt 0 but %d", rv);
257 format_cnat_client (u8 * s, va_list * args)
259 index_t cci = va_arg (*args, index_t);
260 u32 indent = va_arg (*args, u32);
262 cnat_client_t *cc = pool_elt_at_index (cnat_client_pool, cci);
264 s = format (s, "[%d] cnat-client:[%U] tr:%d sess:%d locks:%u", cci,
265 format_ip_address, &cc->cc_ip, cc->tr_refcnt, cc->session_refcnt,
268 if (cc->flags & CNAT_FLAG_EXCLUSIVE)
269 s = format (s, " exclusive");
271 if (cnat_client_is_clone (cc))
272 s = format (s, "\n%Uclone of [%d]\n%U%U",
273 format_white_space, indent + 2, cc->parent_cci,
274 format_white_space, indent + 2,
275 format_dpo_id, &cc->cc_parent, indent + 4);
281 static clib_error_t *
282 cnat_client_show (vlib_main_t * vm,
283 unformat_input_t * input, vlib_cli_command_t * cmd)
289 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
291 if (unformat (input, "%d", &cci))
294 return (clib_error_return (0, "unknown input '%U'",
295 format_unformat_error, input));
298 if (INDEX_INVALID == cci)
300 pool_foreach_index (cci, cnat_client_pool)
301 vlib_cli_output(vm, "%U", format_cnat_client, cci, 0);
303 vlib_cli_output (vm, "%d clients", pool_elts (cnat_client_pool));
307 vlib_cli_output (vm, "Invalid policy ID:%d", cci);
313 VLIB_CLI_COMMAND (cnat_client_show_cmd_node, static) = {
314 .path = "show cnat client",
315 .function = cnat_client_show,
316 .short_help = "show cnat client",
320 const static char *const cnat_client_dpo_ip4_nodes[] = {
325 const static char *const cnat_client_dpo_ip6_nodes[] = {
330 const static char *const *const cnat_client_dpo_nodes[DPO_PROTO_NUM] = {
331 [DPO_PROTO_IP4] = cnat_client_dpo_ip4_nodes,
332 [DPO_PROTO_IP6] = cnat_client_dpo_ip6_nodes,
336 cnat_client_dpo_lock (dpo_id_t * dpo)
340 cc = cnat_client_get (dpo->dpoi_index);
346 cnat_client_dpo_unlock (dpo_id_t * dpo)
350 cc = cnat_client_get (dpo->dpoi_index);
354 if (0 == cc->cc_locks)
356 ASSERT (cnat_client_is_clone (cc));
357 dpo_reset (&cc->cc_parent);
358 pool_put (cnat_client_pool, cc);
363 format_cnat_client_dpo (u8 * s, va_list * ap)
365 index_t cci = va_arg (*ap, index_t);
366 u32 indent = va_arg (*ap, u32);
368 s = format (s, "%U", format_cnat_client, cci, indent);
373 const static dpo_vft_t cnat_client_dpo_vft = {
374 .dv_lock = cnat_client_dpo_lock,
375 .dv_unlock = cnat_client_dpo_unlock,
376 .dv_format = format_cnat_client_dpo,
377 .dv_mk_interpose = cnat_client_dpo_interpose,
380 static clib_error_t *
381 cnat_client_init (vlib_main_t * vm)
383 cnat_main_t *cm = &cnat_main;
384 cnat_client_dpo = dpo_register_new_type (&cnat_client_dpo_vft,
385 cnat_client_dpo_nodes);
387 clib_bihash_init_16_8 (&cnat_client_db.cc_ip_id_hash, "CNat client DB",
388 cm->client_hash_buckets, cm->client_hash_memory);
390 cnat_fib_source = fib_source_allocate ("cnat", CNAT_FIB_SOURCE_PRIORITY,
391 FIB_SOURCE_BH_SIMPLE);
393 clib_spinlock_init (&cnat_client_db.throttle_lock);
394 cnat_client_db.throttle_mem =
395 hash_create_mem (0, sizeof (ip_address_t), sizeof (uword));
400 VLIB_INIT_FUNCTION (cnat_client_init);
403 * fd.io coding-style-patch-verification: ON
406 * eval: (c-set-style "gnu")