2 * Copyright (c) 2020 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <cnat/cnat_src_policy.h>
17 #include <cnat/cnat_inline.h>
19 #include <cnat/cnat_session.h>
20 #include <cnat/cnat_translation.h>
22 cnat_src_policy_main_t cnat_src_policy_main;
25 cnat_register_vip_src_policy (cnat_vip_source_policy_t fp)
27 cnat_src_policy_main.vip_policy = fp;
30 cnat_source_policy_errors_t
31 cnat_vip_default_source_policy (vlib_main_t * vm,
33 cnat_session_t * session,
35 const cnat_translation_t * ct,
36 cnat_node_ctx_t * ctx)
43 if (AF_IP4 == ctx->af)
45 ip4 = vlib_buffer_get_current (b);
46 iproto = ip4->protocol;
47 udp0 = (udp_header_t *) (ip4 + 1);
51 ip6 = vlib_buffer_get_current (b);
52 iproto = ip6->protocol;
53 udp0 = (udp_header_t *) (ip6 + 1);
57 if (!session->value.cs_port[VLIB_RX])
60 sport = udp0->src_port;
61 /* Allocate a port only if asked and if we actually sNATed */
62 if ((ct->flags & CNAT_TR_FLAG_ALLOCATE_PORT) &&
63 (*rsession_flags & CNAT_SESSION_FLAG_HAS_SNAT))
65 sport = 0; /* force allocation */
66 session->value.flags |= CNAT_SESSION_FLAG_ALLOC_PORT;
67 rv = cnat_allocate_port (&sport, iproto);
69 return CNAT_SOURCE_ERROR_EXHAUSTED_PORTS;
72 session->value.cs_port[VLIB_RX] = sport;
77 always_inline cnat_src_port_allocator_t *
78 cnat_get_src_port_allocator (ip_protocol_t iproto)
80 cnat_src_policy_main_t *cspm = &cnat_src_policy_main;
84 return &cspm->src_ports[CNAT_SPORT_PROTO_TCP];
86 return &cspm->src_ports[CNAT_SPORT_PROTO_UDP];
87 case IP_PROTOCOL_ICMP:
88 return &cspm->src_ports[CNAT_SPORT_PROTO_ICMP];
89 case IP_PROTOCOL_ICMP6:
90 return &cspm->src_ports[CNAT_SPORT_PROTO_ICMP6];
97 cnat_free_port (u16 port, ip_protocol_t iproto)
99 cnat_src_port_allocator_t *ca;
100 ca = cnat_get_src_port_allocator (iproto);
103 clib_spinlock_lock (&ca->lock);
104 clib_bitmap_set_no_check (ca->bmap, port, 0);
105 clib_spinlock_unlock (&ca->lock);
109 cnat_allocate_port (u16 * port, ip_protocol_t iproto)
111 *port = clib_net_to_host_u16 (*port);
113 *port = MIN_SRC_PORT;
114 cnat_src_port_allocator_t *ca;
115 ca = cnat_get_src_port_allocator (iproto);
118 clib_spinlock_lock (&ca->lock);
119 if (clib_bitmap_get_no_check (ca->bmap, *port))
121 *port = clib_bitmap_next_clear (ca->bmap, *port);
122 if (PREDICT_FALSE (*port >= UINT16_MAX))
123 *port = clib_bitmap_next_clear (ca->bmap, MIN_SRC_PORT);
124 if (PREDICT_FALSE (*port >= UINT16_MAX))
126 clib_spinlock_unlock (&ca->lock);
130 clib_bitmap_set_no_check (ca->bmap, *port, 1);
131 *port = clib_host_to_net_u16 (*port);
132 clib_spinlock_unlock (&ca->lock);
136 static clib_error_t *
137 cnat_src_policy_init (vlib_main_t * vm)
139 cnat_src_policy_main_t *cspm = &cnat_src_policy_main;
140 cspm->vip_policy = cnat_vip_default_source_policy;
141 cspm->default_policy = cnat_vip_default_source_policy;
143 vec_validate (cspm->src_ports, CNAT_N_SPORT_PROTO);
144 for (int i = 0; i < CNAT_N_SPORT_PROTO; i++)
146 clib_spinlock_init (&cspm->src_ports[i].lock);
147 clib_bitmap_validate (cspm->src_ports[i].bmap, UINT16_MAX);
149 /* Inject cleanup callback */
150 cnat_free_port_cb = cnat_free_port;
154 VLIB_INIT_FUNCTION (cnat_src_policy_init);
157 * fd.io coding-style-patch-verification: ON
160 * eval: (c-set-style "gnu")