2 * Copyright (c) 2020 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/fib/fib_source.h>
17 #include <vnet/fib/fib_table.h>
18 #include <vnet/fib/fib_entry_track.h>
19 #include <vnet/dpo/load_balance.h>
20 #include <vnet/dpo/drop_dpo.h>
22 #include <cnat/cnat_translation.h>
23 #include <cnat/cnat_session.h>
24 #include <cnat/cnat_client.h>
26 cnat_translation_t *cnat_translation_pool;
27 clib_bihash_8_8_t cnat_translation_db;
28 addr_resolution_t *tr_resolutions;
30 typedef void (*cnat_if_addr_add_cb_t) (addr_resolution_t * ar,
31 ip_address_t * address, u8 is_del);
32 cnat_if_addr_add_cb_t *cnat_if_addr_add_cbs;
34 static fib_node_type_t cnat_translation_fib_node_type;
36 vlib_combined_counter_main_t cnat_translation_counters = {
37 .name = "cnat-translation",
38 .stat_segment_name = "/net/cnat-translation",
42 cnat_translation_watch_addr (index_t cti, u64 opaque, cnat_endpoint_t * ep,
43 cnat_addr_resol_type_t type)
45 addr_resolution_t *ar;
47 if (INDEX_INVALID == ep->ce_sw_if_index)
50 pool_get (tr_resolutions, ar);
51 ar->af = ep->ce_ip.version;
52 ar->sw_if_index = ep->ce_sw_if_index;
59 cnat_resolve_ep_tuple (cnat_endpoint_tuple_t * path)
61 cnat_resolve_ep (&path->src_ep);
62 cnat_resolve_ep (&path->dst_ep);
66 cnat_translation_unwatch_addr (u32 cti, cnat_addr_resol_type_t type)
68 /* Delete tr resolution entries matching translation index */
69 addr_resolution_t *ar;
70 index_t *indexes = 0, *ari;
72 pool_foreach (ar, tr_resolutions, ({
73 if ((cti == INDEX_INVALID || ar->cti == cti) &&
74 (ar->type == type || CNAT_RESOLV_ADDR_ANY == type))
75 vec_add1(indexes, ar - tr_resolutions);
78 vec_foreach (ari, indexes) pool_put_index (tr_resolutions, *ari);
84 cnat_tracker_release (cnat_ep_trk_t * trk)
86 /* We only track fully resolved endpoints */
89 fib_entry_untrack (trk->ct_fei, trk->ct_sibling);
93 cnat_tracker_track (index_t cti, cnat_ep_trk_t * trk)
96 /* We only track fully resolved endpoints */
97 trk->is_active = trk->ct_ep[VLIB_TX].ce_flags & CNAT_EP_FLAG_RESOLVED
98 && trk->ct_ep[VLIB_RX].ce_flags & CNAT_EP_FLAG_RESOLVED;
102 ip_address_to_fib_prefix (&trk->ct_ep[VLIB_TX].ce_ip, &pfx);
103 trk->ct_fei = fib_entry_track (CNAT_FIB_TABLE,
105 cnat_translation_fib_node_type,
106 cti, &trk->ct_sibling);
108 fib_entry_contribute_forwarding (trk->ct_fei,
109 fib_forw_chain_type_from_fib_proto
110 (pfx.fp_proto), &trk->ct_dpo);
114 * Add a translation to the bihash
116 * @param cci the ID of the parent client (invalid if vip not resolved)
117 * @param vip the translation endpoint
118 * @param proto the translation proto
119 * @param cti the translation index to be used as value
122 cnat_add_translation_to_db (index_t cci, cnat_endpoint_t * vip,
123 ip_protocol_t proto, index_t cti)
125 clib_bihash_kv_8_8_t bkey;
127 if (INDEX_INVALID == cci)
129 key = proto << 8 | 0x80 | vip->ce_ip.version;
130 key = key << 16 | vip->ce_port;
131 key = key << 32 | (u32) vip->ce_sw_if_index;
136 key = key << 16 | vip->ce_port;
137 key = key << 32 | (u32) cci;
143 clib_bihash_add_del_8_8 (&cnat_translation_db, &bkey, 1);
147 * Remove a translation from the bihash
149 * @param cci the ID of the parent client
150 * @param vip the translation endpoint
151 * @param proto the translation proto
154 cnat_remove_translation_from_db (index_t cci, cnat_endpoint_t * vip,
157 clib_bihash_kv_8_8_t bkey;
159 if (INDEX_INVALID == cci)
161 key = proto << 8 | 0x80 | vip->ce_ip.version;
162 key = key << 16 | vip->ce_port;
163 key = key << 32 | (u32) vip->ce_sw_if_index;
168 key = key << 16 | vip->ce_port;
169 key = key << 32 | (u32) cci;
174 clib_bihash_add_del_8_8 (&cnat_translation_db, &bkey, 0);
178 cnat_translation_stack (cnat_translation_t * ct)
180 fib_protocol_t fproto;
186 fproto = ip_address_family_to_fib_proto (ct->ct_vip.ce_ip.version);
187 dproto = fib_proto_to_dpo (fproto);
189 vec_foreach (trk, ct->ct_paths) if (trk->is_active)
192 lbi = load_balance_create (ep_idx, fib_proto_to_dpo (fproto),
193 IP_FLOW_HASH_DEFAULT);
196 vec_foreach (trk, ct->ct_paths) if (trk->is_active)
197 load_balance_set_bucket (lbi, ep_idx++, &trk->ct_dpo);
199 dpo_set (&ct->ct_lb, DPO_LOAD_BALANCE, dproto, lbi);
200 dpo_stack (cnat_client_dpo, dproto, &ct->ct_lb, &ct->ct_lb);
201 ct->flags |= CNAT_TRANSLATION_STACKED;
205 cnat_translation_delete (u32 id)
207 cnat_translation_t *ct;
210 if (pool_is_free_index (cnat_translation_pool, id))
211 return (VNET_API_ERROR_NO_SUCH_ENTRY);
213 ct = pool_elt_at_index (cnat_translation_pool, id);
215 dpo_reset (&ct->ct_lb);
217 vec_foreach (trk, ct->ct_paths) cnat_tracker_release (trk);
219 cnat_remove_translation_from_db (ct->ct_cci, &ct->ct_vip, ct->ct_proto);
220 cnat_client_translation_deleted (ct->ct_cci);
221 cnat_translation_unwatch_addr (id, CNAT_RESOLV_ADDR_ANY);
222 pool_put (cnat_translation_pool, ct);
228 cnat_translation_update (cnat_endpoint_t * vip,
230 cnat_endpoint_tuple_t * paths, u8 flags)
232 cnat_endpoint_tuple_t *path;
233 const cnat_client_t *cc;
234 cnat_translation_t *ct;
239 if (cnat_resolve_ep (vip))
241 /* vip only contains a sw_if_index for now */
242 ct = cnat_find_translation (vip->ce_sw_if_index, vip->ce_port, proto);
247 /* do we know of this ep's vip */
248 cci = cnat_client_add (&vip->ce_ip, flags);
249 cc = cnat_client_get (cci);
251 ct = cnat_find_translation (cc->parent_cci, vip->ce_port, proto);
256 pool_get_zero (cnat_translation_pool, ct);
258 clib_memcpy (&ct->ct_vip, vip, sizeof (*vip));
259 ct->ct_proto = proto;
261 ct->index = ct - cnat_translation_pool;
263 cnat_add_translation_to_db (cci, vip, proto, ct->index);
264 cnat_client_translation_added (cci);
266 vlib_validate_combined_counter (&cnat_translation_counters, ct->index);
267 vlib_zero_combined_counter (&cnat_translation_counters, ct->index);
271 cnat_translation_unwatch_addr (ct->index, CNAT_RESOLV_ADDR_ANY);
272 cnat_translation_watch_addr (ct->index, 0, vip,
273 CNAT_RESOLV_ADDR_TRANSLATION);
275 vec_foreach (trk, ct->ct_paths)
277 cnat_tracker_release (trk);
280 vec_reset_length (ct->ct_paths);
281 ct->flags &= ~CNAT_TRANSLATION_STACKED;
284 vec_foreach (path, paths)
286 cnat_resolve_ep_tuple (path);
287 cnat_translation_watch_addr (ct->index,
288 path_idx << 32 | VLIB_RX, &path->src_ep,
289 CNAT_RESOLV_ADDR_BACKEND);
290 cnat_translation_watch_addr (ct->index,
291 path_idx << 32 | VLIB_TX, &path->dst_ep,
292 CNAT_RESOLV_ADDR_BACKEND);
295 vec_add2 (ct->ct_paths, trk, 1);
297 clib_memcpy (&trk->ct_ep[VLIB_TX], &path->dst_ep,
298 sizeof (trk->ct_ep[VLIB_TX]));
299 clib_memcpy (&trk->ct_ep[VLIB_RX], &path->src_ep,
300 sizeof (trk->ct_ep[VLIB_RX]));
302 cnat_tracker_track (ct->index, trk);
305 cnat_translation_stack (ct);
311 cnat_translation_walk (cnat_translation_walk_cb_t cb, void *ctx)
316 pool_foreach_index(api, cnat_translation_pool,
325 format_cnat_ep_trk (u8 * s, va_list * args)
327 cnat_ep_trk_t *ck = va_arg (*args, cnat_ep_trk_t *);
328 u32 indent = va_arg (*args, u32);
330 s = format (s, "%U->%U", format_cnat_endpoint, &ck->ct_ep[VLIB_RX],
331 format_cnat_endpoint, &ck->ct_ep[VLIB_TX]);
332 s = format (s, "\n%Ufib-entry:%d", format_white_space, indent, ck->ct_fei);
333 s = format (s, "\n%U%U",
334 format_white_space, indent, format_dpo_id, &ck->ct_dpo, 6);
340 format_cnat_translation (u8 * s, va_list * args)
342 cnat_translation_t *ct = va_arg (*args, cnat_translation_t *);
345 s = format (s, "[%d] ", ct->index);
346 s = format (s, "%U %U", format_cnat_endpoint, &ct->ct_vip,
347 format_ip_protocol, ct->ct_proto);
349 vec_foreach (ck, ct->ct_paths)
350 s = format (s, "\n%U", format_cnat_ep_trk, ck, 2);
352 /* If printing a trace, the LB object might be deleted */
353 if (!pool_is_free_index (load_balance_pool, ct->ct_lb.dpoi_index))
355 s = format (s, "\n via:");
356 s = format (s, "\n%U%U",
357 format_white_space, 2, format_dpo_id, &ct->ct_lb, 2);
363 static clib_error_t *
364 cnat_translation_show (vlib_main_t * vm,
365 unformat_input_t * input, vlib_cli_command_t * cmd)
368 cnat_translation_t *ct;
372 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
374 if (unformat (input, "%d", &cti))
377 return (clib_error_return (0, "unknown input '%U'",
378 format_unformat_error, input));
381 if (INDEX_INVALID == cti)
384 pool_foreach_index(cti, cnat_translation_pool,
386 ct = pool_elt_at_index (cnat_translation_pool, cti);
387 vlib_cli_output(vm, "%U", format_cnat_translation, ct);
393 vlib_cli_output (vm, "Invalid policy ID:%d", cti);
400 cnat_translation_purge (void)
402 /* purge all the translations */
403 index_t tri, *trp, *trs = NULL;
406 pool_foreach_index(tri, cnat_translation_pool,
412 vec_foreach (trp, trs) cnat_translation_delete (*trp);
414 ASSERT (0 == pool_elts (cnat_translation_pool));
422 VLIB_CLI_COMMAND (cnat_translation_show_cmd_node, static) = {
423 .path = "show cnat translation",
424 .function = cnat_translation_show,
425 .short_help = "show cnat translation <VIP>",
431 cnat_translation_get_node (fib_node_index_t index)
433 cnat_translation_t *ct = cnat_translation_get (index);
434 return (&(ct->ct_node));
437 static cnat_translation_t *
438 cnat_translation_get_from_node (fib_node_t * node)
440 return ((cnat_translation_t *) (((char *) node) -
441 STRUCT_OFFSET_OF (cnat_translation_t,
446 cnat_translation_last_lock_gone (fib_node_t * node)
451 * A back walk has reached this ABF policy
453 static fib_node_back_walk_rc_t
454 cnat_translation_back_walk_notify (fib_node_t * node,
455 fib_node_back_walk_ctx_t * ctx)
458 * re-stack the fmask on the n-eos of the via
460 cnat_translation_t *ct = cnat_translation_get_from_node (node);
462 /* If we have more than FIB_PATH_LIST_POPULAR paths
463 * we might get called during path tracking
464 * (cnat_tracker_track) */
465 if (!(ct->flags & CNAT_TRANSLATION_STACKED))
466 return (FIB_NODE_BACK_WALK_CONTINUE);
468 cnat_translation_stack (ct);
470 return (FIB_NODE_BACK_WALK_CONTINUE);
474 * The translation's graph node virtual function table
476 static const fib_node_vft_t cnat_translation_vft = {
477 .fnv_get = cnat_translation_get_node,
478 .fnv_last_lock = cnat_translation_last_lock_gone,
479 .fnv_back_walk = cnat_translation_back_walk_notify,
482 static clib_error_t *
483 cnat_translation_cli_add_del (vlib_main_t * vm,
484 unformat_input_t * input,
485 vlib_cli_command_t * cmd)
487 u32 del_index = INDEX_INVALID;
488 ip_protocol_t proto = IP_PROTOCOL_TCP;
490 u8 flags = CNAT_FLAG_EXCLUSIVE;
491 cnat_endpoint_tuple_t tmp, *paths = NULL, *path;
492 unformat_input_t _line_input, *line_input = &_line_input;
495 /* Get a line of input. */
496 if (!unformat_user (input, unformat_line_input, line_input))
499 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
501 if (unformat (line_input, "add"))
502 del_index = INDEX_INVALID;
503 else if (unformat (line_input, "del %d", &del_index))
506 if (unformat (line_input, "proto %U", unformat_ip_protocol, &proto))
508 else if (unformat (line_input, "vip %U", unformat_cnat_ep, &vip))
509 flags = CNAT_FLAG_EXCLUSIVE;
510 else if (unformat (line_input, "real %U", unformat_cnat_ep, &vip))
512 else if (unformat (line_input, "to %U", unformat_cnat_ep_tuple, &tmp))
514 vec_add2 (paths, path, 1);
515 clib_memcpy (path, &tmp, sizeof (cnat_endpoint_tuple_t));
519 e = clib_error_return (0, "unknown input '%U'",
520 format_unformat_error, line_input);
525 if (INDEX_INVALID == del_index)
526 cnat_translation_update (&vip, proto, paths, flags);
528 cnat_translation_delete (del_index);
532 unformat_free (line_input);
537 VLIB_CLI_COMMAND (cnat_translation_cli_add_del_command, static) =
539 .path = "cnat translation",
540 .short_help = "cnat translation [add|del] proto [TCP|UDP] [vip|real] [ip|sw_if_index [v6]] [port] [to [ip|sw_if_index [v6]] [port]->[ip|sw_if_index [v6]] [port]]",
541 .function = cnat_translation_cli_add_del,
546 cnat_if_addr_add_del_translation_cb (addr_resolution_t * ar,
547 ip_address_t * address, u8 is_del)
549 cnat_translation_t *ct;
550 ct = cnat_translation_get (ar->cti);
551 if (!is_del && ct->ct_vip.ce_flags & CNAT_EP_FLAG_RESOLVED)
554 cnat_remove_translation_from_db (ct->ct_cci, &ct->ct_vip, ct->ct_proto);
558 ct->ct_vip.ce_flags &= ~CNAT_EP_FLAG_RESOLVED;
559 ct->ct_cci = INDEX_INVALID;
560 cnat_client_translation_deleted (ct->ct_cci);
561 /* Are there remaining addresses ? */
562 if (0 == cnat_resolve_addr (ar->sw_if_index, ar->af, address))
568 ct->ct_cci = cnat_client_add (address, ct->flags);
569 cnat_client_translation_added (ct->ct_cci);
570 ip_address_copy (&ct->ct_vip.ce_ip, address);
571 ct->ct_vip.ce_flags |= CNAT_EP_FLAG_RESOLVED;
574 cnat_add_translation_to_db (ct->ct_cci, &ct->ct_vip, ct->ct_proto,
579 cnat_if_addr_add_del_backend_cb (addr_resolution_t * ar,
580 ip_address_t * address, u8 is_del)
582 cnat_translation_t *ct;
586 u8 direction = ar->opaque & 0xf;
587 u32 path_idx = ar->opaque >> 32;
589 ct = cnat_translation_get (ar->cti);
591 trk = &ct->ct_paths[path_idx];
592 ep = &trk->ct_ep[direction];
594 if (!is_del && ep->ce_flags & CNAT_EP_FLAG_RESOLVED)
597 ASSERT (ep->ce_sw_if_index == ar->sw_if_index);
601 ep->ce_flags &= ~CNAT_EP_FLAG_RESOLVED;
602 /* Are there remaining addresses ? */
603 if (0 == cnat_resolve_addr (ar->sw_if_index, ar->af, address))
609 ip_address_copy (&ep->ce_ip, address);
610 ep->ce_flags |= CNAT_EP_FLAG_RESOLVED;
613 ct->flags &= ~CNAT_TRANSLATION_STACKED;
614 cnat_tracker_track (ar->cti, trk);
616 cnat_translation_stack (ct);
617 ct->flags |= CNAT_TRANSLATION_STACKED;
621 cnat_if_addr_add_del_snat_cb (addr_resolution_t * ar, ip_address_t * address,
625 ep = AF_IP4 == ar->af ? &cnat_main.snat_ip4 : &cnat_main.snat_ip6;
627 if (!is_del && ep->ce_flags & CNAT_EP_FLAG_RESOLVED)
632 ep->ce_flags &= ~CNAT_EP_FLAG_RESOLVED;
633 /* Are there remaining addresses ? */
634 if (0 == cnat_resolve_addr (ar->sw_if_index, ar->af, address))
640 ip_address_copy (&ep->ce_ip, address);
641 ep->ce_flags |= CNAT_EP_FLAG_RESOLVED;
647 cnat_if_addr_add_del_callback (u32 sw_if_index, ip_address_t * address,
650 addr_resolution_t *ar;
652 pool_foreach (ar, tr_resolutions, ({
653 if (ar->sw_if_index != sw_if_index)
655 if (ar->af != ip_addr_version (address))
657 cnat_if_addr_add_cbs[ar->type] (ar, address, is_del);
663 cnat_ip6_if_addr_add_del_callback (struct ip6_main_t *im,
664 uword opaque, u32 sw_if_index,
665 ip6_address_t * address,
666 u32 address_length, u32 if_address_index,
670 ip_address_set (&addr, address, AF_IP6);
671 cnat_if_addr_add_del_callback (sw_if_index, &addr, is_del);
675 cnat_ip4_if_addr_add_del_callback (struct ip4_main_t *im,
676 uword opaque, u32 sw_if_index,
677 ip4_address_t * address,
678 u32 address_length, u32 if_address_index,
682 ip_address_set (&addr, address, AF_IP4);
683 cnat_if_addr_add_del_callback (sw_if_index, &addr, is_del);
686 static clib_error_t *
687 cnat_translation_init (vlib_main_t * vm)
689 ip4_main_t *i4m = &ip4_main;
690 ip6_main_t *i6m = &ip6_main;
691 cnat_main_t *cm = &cnat_main;
692 cnat_translation_fib_node_type =
693 fib_node_register_new_type (&cnat_translation_vft);
695 clib_bihash_init_8_8 (&cnat_translation_db, "CNat translation DB",
696 cm->translation_hash_buckets,
697 cm->translation_hash_memory);
699 ip4_add_del_interface_address_callback_t cb4;
700 cb4.function = cnat_ip4_if_addr_add_del_callback;
701 vec_add1 (i4m->add_del_interface_address_callbacks, cb4);
703 ip6_add_del_interface_address_callback_t cb6;
704 cb6.function = cnat_ip6_if_addr_add_del_callback;
705 vec_add1 (i6m->add_del_interface_address_callbacks, cb6);
707 vec_validate (cnat_if_addr_add_cbs, CNAT_ADDR_N_RESOLUTIONS);
708 cnat_if_addr_add_cbs[CNAT_RESOLV_ADDR_BACKEND] =
709 cnat_if_addr_add_del_backend_cb;
710 cnat_if_addr_add_cbs[CNAT_RESOLV_ADDR_SNAT] = cnat_if_addr_add_del_snat_cb;
711 cnat_if_addr_add_cbs[CNAT_RESOLV_ADDR_TRANSLATION] =
712 cnat_if_addr_add_del_translation_cb;
716 VLIB_INIT_FUNCTION (cnat_translation_init);
719 * fd.io coding-style-patch-verification: ON
722 * eval: (c-set-style "gnu")