4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/fib/fib_table.h>
19 #include <vnet/fib/fib_entry_track.h>
20 #include <vnet/fib/ip6_fib.h>
21 #include <vnet/adj/adj.h>
22 #include <vppinfra/crc32.h>
23 #include <vnet/plugin/plugin.h>
24 #include <vpp/app/version.h>
30 * This code supports the following MAP modes:
32 * Algorithmic Shared IPv4 address (ea_bits_len > 0):
33 * ea_bits_len + ip4_prefix > 32
34 * psid_length > 0, ip6_prefix < 64, ip4_prefix <= 32
35 * Algorithmic Full IPv4 address (ea_bits_len > 0):
36 * ea_bits_len + ip4_prefix = 32
37 * psid_length = 0, ip6_prefix < 64, ip4_prefix <= 32
38 * Algorithmic IPv4 prefix (ea_bits_len > 0):
39 * ea_bits_len + ip4_prefix < 32
40 * psid_length = 0, ip6_prefix < 64, ip4_prefix <= 32
42 * Independent Shared IPv4 address (ea_bits_len = 0):
45 * Rule IPv6 address = 128, Rule PSID Set
46 * Independent Full IPv4 address (ea_bits_len = 0):
48 * psid_length = 0, ip6_prefix = 128
49 * Independent IPv4 prefix (ea_bits_len = 0):
51 * psid_length = 0, ip6_prefix = 128
56 * This code supports MAP-T:
58 * With a DMR prefix length of 64 or 96 (RFC6052).
64 * Save user-assigned MAP domain names ("tags") in a vector of
65 * extra domain information.
68 map_save_extras (u32 map_domain_index, u8 * tag)
70 map_main_t *mm = &map_main;
71 map_domain_extra_t *de;
73 if (map_domain_index == ~0)
76 vec_validate (mm->domain_extras, map_domain_index);
77 de = vec_elt_at_index (mm->domain_extras, map_domain_index);
78 clib_memset (de, 0, sizeof (*de));
83 vec_validate_init_c_string (de->tag, tag, strlen ((char *) tag));
88 map_free_extras (u32 map_domain_index)
90 map_main_t *mm = &map_main;
91 map_domain_extra_t *de;
93 if (map_domain_index == ~0)
96 if (map_domain_index >= vec_len (mm->domain_extras))
99 de = vec_elt_at_index (mm->domain_extras, map_domain_index);
105 map_create_domain (ip4_address_t * ip4_prefix,
107 ip6_address_t * ip6_prefix,
109 ip6_address_t * ip6_src,
114 u32 * map_domain_index, u16 mtu, u8 flags, u8 * tag)
116 u8 suffix_len, suffix_shift;
117 map_main_t *mm = &map_main;
120 /* How many, and which bits to grab from the IPv4 DA */
121 if (ip4_prefix_len + ea_bits_len < 32)
123 flags |= MAP_DOMAIN_PREFIX;
124 suffix_shift = 32 - ip4_prefix_len - ea_bits_len;
125 suffix_len = ea_bits_len;
130 suffix_len = 32 - ip4_prefix_len;
133 /* EA bits must be within the first 64 bits */
134 if (ea_bits_len > 0 && ((ip6_prefix_len + ea_bits_len) > 64 ||
135 ip6_prefix_len + suffix_len + psid_length > 64))
138 ("Embedded Address bits must be within the first 64 bits of "
143 /* Get domain index */
144 pool_get_aligned (mm->domains, d, CLIB_CACHE_LINE_BYTES);
145 clib_memset (d, 0, sizeof (*d));
146 *map_domain_index = d - mm->domains;
148 /* Init domain struct */
149 d->ip4_prefix.as_u32 = ip4_prefix->as_u32;
150 d->ip4_prefix_len = ip4_prefix_len;
151 d->ip6_prefix = *ip6_prefix;
152 d->ip6_prefix_len = ip6_prefix_len;
153 d->ip6_src = *ip6_src;
154 d->ip6_src_len = ip6_src_len;
155 d->ea_bits_len = ea_bits_len;
156 d->psid_offset = psid_offset;
157 d->psid_length = psid_length;
160 d->suffix_shift = suffix_shift;
161 d->suffix_mask = (1 << suffix_len) - 1;
163 d->psid_shift = 16 - psid_length - psid_offset;
164 d->psid_mask = (1 << d->psid_length) - 1;
165 d->ea_shift = 64 - ip6_prefix_len - suffix_len - d->psid_length;
167 /* Save a user-assigned MAP domain name if provided. */
169 map_save_extras (*map_domain_index, tag);
171 /* MAP longest match lookup table (input feature / FIB) */
172 mm->ip4_prefix_tbl->add (mm->ip4_prefix_tbl, &d->ip4_prefix,
173 d->ip4_prefix_len, *map_domain_index);
175 /* Really needed? Or always use FIB? */
176 mm->ip6_src_prefix_tbl->add (mm->ip6_src_prefix_tbl, &d->ip6_src,
177 d->ip6_src_len, *map_domain_index);
179 /* Let's build a table with the MAP rule ip6 prefixes as well [dgeist] */
180 mm->ip6_prefix_tbl->add (mm->ip6_prefix_tbl, &d->ip6_prefix,
181 d->ip6_prefix_len, *map_domain_index);
183 /* Validate packet/byte counters */
184 map_domain_counter_lock (mm);
186 for (i = 0; i < vec_len (mm->simple_domain_counters); i++)
188 vlib_validate_simple_counter (&mm->simple_domain_counters[i],
190 vlib_zero_simple_counter (&mm->simple_domain_counters[i],
193 for (i = 0; i < vec_len (mm->domain_counters); i++)
195 vlib_validate_combined_counter (&mm->domain_counters[i],
197 vlib_zero_combined_counter (&mm->domain_counters[i], *map_domain_index);
199 map_domain_counter_unlock (mm);
208 map_delete_domain (u32 map_domain_index)
210 map_main_t *mm = &map_main;
213 if (pool_is_free_index (mm->domains, map_domain_index))
215 clib_warning ("MAP domain delete: domain does not exist: %d",
220 d = pool_elt_at_index (mm->domains, map_domain_index);
221 mm->ip4_prefix_tbl->delete (mm->ip4_prefix_tbl, &d->ip4_prefix,
223 mm->ip6_src_prefix_tbl->delete (mm->ip6_src_prefix_tbl, &d->ip6_src,
225 /* Addition to remove the new table [dgeist] */
226 mm->ip6_prefix_tbl->delete (mm->ip6_prefix_tbl, &d->ip6_prefix,
229 /* Release user-assigned MAP domain name. */
230 map_free_extras (map_domain_index);
234 clib_mem_free (d->rules);
236 pool_put (mm->domains, d);
242 map_add_del_psid (u32 map_domain_index, u16 psid, ip6_address_t * tep,
246 map_main_t *mm = &map_main;
248 if (pool_is_free_index (mm->domains, map_domain_index))
250 clib_warning ("MAP rule: domain does not exist: %d", map_domain_index);
253 d = pool_elt_at_index (mm->domains, map_domain_index);
255 /* Rules are only used in 1:1 independent case */
256 if (d->ea_bits_len > 0)
261 u32 l = (0x1 << d->psid_length) * sizeof (ip6_address_t);
262 d->rules = clib_mem_alloc_aligned (l, CLIB_CACHE_LINE_BYTES);
265 clib_memset (d->rules, 0, l);
268 if (psid >= (0x1 << d->psid_length))
270 clib_warning ("MAP rule: PSID outside bounds: %d [%d]", psid,
271 0x1 << d->psid_length);
277 d->rules[psid] = *tep;
281 clib_memset (&d->rules[psid], 0, sizeof (ip6_address_t));
286 #ifdef MAP_SKIP_IP6_LOOKUP
288 * Pre-resolved per-protocol global next-hops
290 map_main_pre_resolved_t pre_resolved[FIB_PROTOCOL_MAX];
293 map_pre_resolve_init (map_main_pre_resolved_t * pr)
295 pr->fei = FIB_NODE_INDEX_INVALID;
296 fib_node_init (&pr->node, FIB_NODE_TYPE_MAP_E);
300 format_map_pre_resolve (u8 * s, va_list * ap)
302 map_main_pre_resolved_t *pr = va_arg (*ap, map_main_pre_resolved_t *);
304 if (FIB_NODE_INDEX_INVALID != pr->fei)
306 const fib_prefix_t *pfx;
308 pfx = fib_entry_get_prefix (pr->fei);
310 return (format (s, "%U (%u)",
311 format_ip46_address, &pfx->fp_addr, IP46_TYPE_ANY,
312 pr->dpo.dpoi_index));
316 return (format (s, "un-set"));
322 * Function definition to inform the FIB node that its last lock has gone.
325 map_last_lock_gone (fib_node_t * node)
328 * The MAP is a root of the graph. As such
329 * it never has children and thus is never locked.
334 static map_main_pre_resolved_t *
335 map_from_fib_node (fib_node_t * node)
337 ASSERT (FIB_NODE_TYPE_MAP_E == node->fn_type);
338 return ((map_main_pre_resolved_t *)
340 STRUCT_OFFSET_OF (map_main_pre_resolved_t, node)));
344 map_stack (map_main_pre_resolved_t * pr)
348 dpo = fib_entry_contribute_ip_forwarding (pr->fei);
350 dpo_copy (&pr->dpo, dpo);
354 * Function definition to backwalk a FIB node
356 static fib_node_back_walk_rc_t
357 map_back_walk (fib_node_t * node, fib_node_back_walk_ctx_t * ctx)
359 map_stack (map_from_fib_node (node));
361 return (FIB_NODE_BACK_WALK_CONTINUE);
365 * Function definition to get a FIB node from its index
368 map_fib_node_get (fib_node_index_t index)
370 return (&pre_resolved[index].node);
374 * Virtual function table registered by MPLS GRE tunnels
375 * for participation in the FIB object graph.
377 const static fib_node_vft_t map_vft = {
378 .fnv_get = map_fib_node_get,
379 .fnv_last_lock = map_last_lock_gone,
380 .fnv_back_walk = map_back_walk,
384 map_fib_resolve (map_main_pre_resolved_t * pr,
385 fib_protocol_t proto, u8 len, const ip46_address_t * addr)
393 pr->fei = fib_entry_track (0, // default fib
394 &pfx, FIB_NODE_TYPE_MAP_E, proto, &pr->sibling);
399 map_fib_unresolve (map_main_pre_resolved_t * pr,
400 fib_protocol_t proto, u8 len, const ip46_address_t * addr)
402 if (pr->fei != FIB_NODE_INDEX_INVALID)
404 fib_entry_untrack (pr->fei, pr->sibling);
406 dpo_reset (&pr->dpo);
408 pr->fei = FIB_NODE_INDEX_INVALID;
409 pr->sibling = FIB_NODE_INDEX_INVALID;
414 map_pre_resolve (ip4_address_t * ip4, ip6_address_t * ip6, bool is_del)
416 if (ip6 && (ip6->as_u64[0] != 0 || ip6->as_u64[1] != 0))
418 ip46_address_t addr = {
422 map_fib_unresolve (&pre_resolved[FIB_PROTOCOL_IP6],
423 FIB_PROTOCOL_IP6, 128, &addr);
425 map_fib_resolve (&pre_resolved[FIB_PROTOCOL_IP6],
426 FIB_PROTOCOL_IP6, 128, &addr);
428 if (ip4 && (ip4->as_u32 != 0))
430 ip46_address_t addr = {
434 map_fib_unresolve (&pre_resolved[FIB_PROTOCOL_IP4],
435 FIB_PROTOCOL_IP4, 32, &addr);
437 map_fib_resolve (&pre_resolved[FIB_PROTOCOL_IP4],
438 FIB_PROTOCOL_IP4, 32, &addr);
443 static clib_error_t *
444 map_security_check_command_fn (vlib_main_t * vm,
445 unformat_input_t * input,
446 vlib_cli_command_t * cmd)
448 unformat_input_t _line_input, *line_input = &_line_input;
449 clib_error_t *error = NULL;
451 bool check_frag = false;
452 bool saw_enable = false;
453 bool saw_frag = false;
455 /* Get a line of input. */
456 if (!unformat_user (input, unformat_line_input, line_input))
459 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
461 if (unformat (line_input, "enable"))
466 else if (unformat (line_input, "disable"))
471 else if (unformat (line_input, "fragments on"))
476 else if (unformat (line_input, "fragments off"))
483 error = clib_error_return (0, "unknown input `%U'",
484 format_unformat_error, line_input);
491 error = clib_error_return (0,
492 "Must specify enable 'enable' or 'disable'");
498 error = clib_error_return (0, "Must specify fragments 'on' or 'off'");
502 map_param_set_security_check (enable, check_frag);
505 unformat_free (line_input);
511 static clib_error_t *
512 map_add_domain_command_fn (vlib_main_t * vm,
513 unformat_input_t * input, vlib_cli_command_t * cmd)
515 unformat_input_t _line_input, *line_input = &_line_input;
516 ip4_address_t ip4_prefix;
517 ip6_address_t ip6_prefix;
518 ip6_address_t ip6_src;
519 u32 ip6_prefix_len = 0, ip4_prefix_len = 0, map_domain_index, ip6_src_len;
521 /* Optional arguments */
522 u32 ea_bits_len = 0, psid_offset = 0, psid_length = 0;
527 clib_error_t *error = NULL;
529 /* Get a line of input. */
530 if (!unformat_user (input, unformat_line_input, line_input))
533 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
536 (line_input, "ip4-pfx %U/%d", unformat_ip4_address, &ip4_prefix,
541 (line_input, "ip6-pfx %U/%d", unformat_ip6_address, &ip6_prefix,
546 (line_input, "ip6-src %U/%d", unformat_ip6_address, &ip6_src,
551 (line_input, "ip6-src %U", unformat_ip6_address, &ip6_src))
553 else if (unformat (line_input, "ea-bits-len %d", &ea_bits_len))
555 else if (unformat (line_input, "psid-offset %d", &psid_offset))
557 else if (unformat (line_input, "psid-len %d", &psid_length))
559 else if (unformat (line_input, "mtu %d", &mtu))
561 else if (unformat (line_input, "tag %s", &tag))
565 error = clib_error_return (0, "unknown input `%U'",
566 format_unformat_error, line_input);
573 error = clib_error_return (0, "mandatory argument(s) missing");
577 map_create_domain (&ip4_prefix, ip4_prefix_len,
578 &ip6_prefix, ip6_prefix_len, &ip6_src, ip6_src_len,
579 ea_bits_len, psid_offset, psid_length, &map_domain_index,
584 unformat_free (line_input);
589 static clib_error_t *
590 map_del_domain_command_fn (vlib_main_t * vm,
591 unformat_input_t * input, vlib_cli_command_t * cmd)
593 unformat_input_t _line_input, *line_input = &_line_input;
595 u32 map_domain_index;
596 clib_error_t *error = NULL;
598 /* Get a line of input. */
599 if (!unformat_user (input, unformat_line_input, line_input))
602 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
604 if (unformat (line_input, "index %d", &map_domain_index))
608 error = clib_error_return (0, "unknown input `%U'",
609 format_unformat_error, line_input);
616 error = clib_error_return (0, "mandatory argument(s) missing");
620 map_delete_domain (map_domain_index);
623 unformat_free (line_input);
628 static clib_error_t *
629 map_add_rule_command_fn (vlib_main_t * vm,
630 unformat_input_t * input, vlib_cli_command_t * cmd)
632 unformat_input_t _line_input, *line_input = &_line_input;
635 u32 psid = 0, map_domain_index;
636 clib_error_t *error = NULL;
638 /* Get a line of input. */
639 if (!unformat_user (input, unformat_line_input, line_input))
642 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
644 if (unformat (line_input, "index %d", &map_domain_index))
646 else if (unformat (line_input, "psid %d", &psid))
649 if (unformat (line_input, "ip6-dst %U", unformat_ip6_address, &tep))
653 error = clib_error_return (0, "unknown input `%U'",
654 format_unformat_error, line_input);
661 error = clib_error_return (0, "mandatory argument(s) missing");
665 if (map_add_del_psid (map_domain_index, psid, &tep, 1) != 0)
667 error = clib_error_return (0, "Failing to add Mapping Rule");
672 unformat_free (line_input);
677 #if MAP_SKIP_IP6_LOOKUP
678 static clib_error_t *
679 map_pre_resolve_command_fn (vlib_main_t * vm,
680 unformat_input_t * input,
681 vlib_cli_command_t * cmd)
683 unformat_input_t _line_input, *line_input = &_line_input;
684 ip4_address_t ip4nh, *p_v4 = NULL;
685 ip6_address_t ip6nh, *p_v6 = NULL;
686 clib_error_t *error = NULL;
689 clib_memset (&ip4nh, 0, sizeof (ip4nh));
690 clib_memset (&ip6nh, 0, sizeof (ip6nh));
692 /* Get a line of input. */
693 if (!unformat_user (input, unformat_line_input, line_input))
696 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
698 if (unformat (line_input, "ip4-nh %U", unformat_ip4_address, &ip4nh))
701 if (unformat (line_input, "ip6-nh %U", unformat_ip6_address, &ip6nh))
703 else if (unformat (line_input, "del"))
707 error = clib_error_return (0, "unknown input `%U'",
708 format_unformat_error, line_input);
713 map_pre_resolve (p_v4, p_v6, is_del);
716 unformat_free (line_input);
722 static clib_error_t *
723 map_icmp_relay_source_address_command_fn (vlib_main_t * vm,
724 unformat_input_t * input,
725 vlib_cli_command_t * cmd)
727 unformat_input_t _line_input, *line_input = &_line_input;
728 ip4_address_t icmp_src_address;
729 ip4_address_t *p_icmp_addr = 0;
730 map_main_t *mm = &map_main;
731 clib_error_t *error = NULL;
733 mm->icmp4_src_address.as_u32 = 0;
735 /* Get a line of input. */
736 if (!unformat_user (input, unformat_line_input, line_input))
739 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
742 (line_input, "%U", unformat_ip4_address, &icmp_src_address))
744 mm->icmp4_src_address = icmp_src_address;
745 p_icmp_addr = &icmp_src_address;
749 error = clib_error_return (0, "unknown input `%U'",
750 format_unformat_error, line_input);
755 map_param_set_icmp (p_icmp_addr);
758 unformat_free (line_input);
763 static clib_error_t *
764 map_icmp_unreachables_command_fn (vlib_main_t * vm,
765 unformat_input_t * input,
766 vlib_cli_command_t * cmd)
768 unformat_input_t _line_input, *line_input = &_line_input;
770 clib_error_t *error = NULL;
771 bool enabled = false;
773 /* Get a line of input. */
774 if (!unformat_user (input, unformat_line_input, line_input))
777 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
780 if (unformat (line_input, "on"))
782 else if (unformat (line_input, "off"))
786 error = clib_error_return (0, "unknown input `%U'",
787 format_unformat_error, line_input);
794 error = clib_error_return (0, "mandatory argument(s) missing");
797 map_param_set_icmp6 (enabled);
800 unformat_free (line_input);
806 static clib_error_t *
807 map_fragment_command_fn (vlib_main_t * vm,
808 unformat_input_t * input, vlib_cli_command_t * cmd)
810 unformat_input_t _line_input, *line_input = &_line_input;
811 clib_error_t *error = NULL;
812 bool frag_inner = false;
813 bool frag_ignore_df = false;
814 bool saw_in_out = false;
817 /* Get a line of input. */
818 if (!unformat_user (input, unformat_line_input, line_input))
821 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
823 if (unformat (line_input, "inner"))
828 else if (unformat (line_input, "outer"))
833 else if (unformat (line_input, "ignore-df"))
835 frag_ignore_df = true;
838 else if (unformat (line_input, "honor-df"))
840 frag_ignore_df = false;
845 error = clib_error_return (0, "unknown input `%U'",
846 format_unformat_error, line_input);
853 error = clib_error_return (0, "Must specify 'inner' or 'outer'");
859 error = clib_error_return (0, "Must specify 'ignore-df' or 'honor-df'");
863 map_param_set_fragmentation (frag_inner, frag_ignore_df);
866 unformat_free (line_input);
871 static clib_error_t *
872 map_traffic_class_command_fn (vlib_main_t * vm,
873 unformat_input_t * input,
874 vlib_cli_command_t * cmd)
876 unformat_input_t _line_input, *line_input = &_line_input;
878 clib_error_t *error = NULL;
879 bool tc_copy = false;
882 /* Get a line of input. */
883 if (!unformat_user (input, unformat_line_input, line_input))
886 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
888 if (unformat (line_input, "copy"))
890 else if (unformat (line_input, "%x", &tc))
894 error = clib_error_return (0, "unknown input `%U'",
895 format_unformat_error, line_input);
900 map_param_set_traffic_class (tc_copy, tc);
903 unformat_free (line_input);
909 map_flags_to_string (u32 flags)
911 if (flags & MAP_DOMAIN_PREFIX)
917 format_map_domain (u8 * s, va_list * args)
919 map_domain_t *d = va_arg (*args, map_domain_t *);
920 bool counters = va_arg (*args, int);
921 map_main_t *mm = &map_main;
922 ip6_address_t ip6_prefix;
923 u32 map_domain_index = d - mm->domains;
924 map_domain_extra_t *de = 0;
927 clib_memset (&ip6_prefix, 0, sizeof (ip6_prefix));
929 ip6_prefix = d->ip6_prefix;
931 if (map_domain_index < vec_len (mm->domain_extras))
932 de = vec_elt_at_index (mm->domain_extras, map_domain_index);
935 "[%d] tag {%s} ip4-pfx %U/%d ip6-pfx %U/%d ip6-src %U/%d "
936 "ea-bits-len %d psid-offset %d psid-len %d mtu %d %s",
937 map_domain_index, (de && de->tag) ? de->tag : (u8 *) "[no-tag]",
938 format_ip4_address, &d->ip4_prefix, d->ip4_prefix_len,
939 format_ip6_address, &ip6_prefix, d->ip6_prefix_len,
940 format_ip6_address, &d->ip6_src, d->ip6_src_len,
941 d->ea_bits_len, d->psid_offset, d->psid_length, d->mtu,
942 map_flags_to_string (d->flags));
946 map_domain_counter_lock (mm);
948 vlib_get_combined_counter (&mm->domain_counters[MAP_DOMAIN_COUNTER_TX],
949 map_domain_index, &v);
950 s = format (s, " TX: %lld/%lld", v.packets, v.bytes);
951 vlib_get_combined_counter (&mm->domain_counters[MAP_DOMAIN_COUNTER_RX],
952 map_domain_index, &v);
953 s = format (s, " RX: %lld/%lld", v.packets, v.bytes);
954 map_domain_counter_unlock (mm);
956 s = format (s, "\n");
962 for (i = 0; i < (0x1 << d->psid_length); i++)
965 if (dst.as_u64[0] == 0 && dst.as_u64[1] == 0)
968 " rule psid: %d ip6-dst %U\n", i, format_ip6_address,
975 static clib_error_t *
976 show_map_domain_command_fn (vlib_main_t * vm, unformat_input_t * input,
977 vlib_cli_command_t * cmd)
979 unformat_input_t _line_input, *line_input = &_line_input;
980 map_main_t *mm = &map_main;
982 bool counters = false;
983 u32 map_domain_index = ~0;
984 clib_error_t *error = NULL;
986 /* Get a line of input. */
987 if (!unformat_user (input, unformat_line_input, line_input))
989 pool_foreach (d, mm->domains)
990 {vlib_cli_output(vm, "%U", format_map_domain, d, counters);}
994 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
996 if (unformat (line_input, "counters"))
998 else if (unformat (line_input, "index %d", &map_domain_index))
1002 error = clib_error_return (0, "unknown input `%U'",
1003 format_unformat_error, line_input);
1008 if (pool_elts (mm->domains) == 0)
1010 vlib_cli_output (vm, "No MAP domains are configured...");
1014 if (map_domain_index == ~0)
1016 pool_foreach (d, mm->domains)
1017 {vlib_cli_output(vm, "%U", format_map_domain, d, counters);}
1021 if (pool_is_free_index (mm->domains, map_domain_index))
1023 error = clib_error_return (0, "MAP domain does not exists %d",
1028 d = pool_elt_at_index (mm->domains, map_domain_index);
1029 vlib_cli_output (vm, "%U", format_map_domain, d, counters);
1033 unformat_free (line_input);
1039 map_error_counter_get (u32 node_index, map_error_t map_error)
1041 vlib_main_t *vm = vlib_get_main ();
1042 vlib_node_runtime_t *error_node = vlib_node_get_runtime (vm, node_index);
1043 vlib_error_main_t *em = &vm->error_main;
1044 vlib_error_t e = error_node->errors[map_error];
1045 vlib_node_t *n = vlib_get_node (vm, node_index);
1048 ci = vlib_error_get_code (&vm->node_main, e);
1049 ASSERT (ci < n->n_errors);
1050 ci += n->error_heap_index;
1052 return (em->counters[ci]);
1055 static clib_error_t *
1056 show_map_stats_command_fn (vlib_main_t * vm, unformat_input_t * input,
1057 vlib_cli_command_t * cmd)
1059 map_main_t *mm = &map_main;
1061 int domains = 0, rules = 0, domaincount = 0, rulecount = 0;
1062 if (pool_elts (mm->domains) == 0)
1064 vlib_cli_output (vm, "No MAP domains are configured...");
1068 pool_foreach (d, mm->domains) {
1070 rulecount+= 0x1 << d->psid_length;
1071 rules += sizeof(ip6_address_t) * 0x1 << d->psid_length;
1073 domains += sizeof(*d);
1077 vlib_cli_output (vm, "MAP domains structure: %d\n", sizeof (map_domain_t));
1078 vlib_cli_output (vm, "MAP domains: %d (%d bytes)\n", domaincount, domains);
1079 vlib_cli_output (vm, "MAP rules: %d (%d bytes)\n", rulecount, rules);
1080 vlib_cli_output (vm, "Total: %d bytes)\n", rules + domains);
1082 #if MAP_SKIP_IP6_LOOKUP
1083 vlib_cli_output (vm,
1084 "MAP pre-resolve: IP6 next-hop: %U, IP4 next-hop: %U\n",
1085 format_map_pre_resolve, &pre_resolved[FIB_PROTOCOL_IP6],
1086 format_map_pre_resolve, &pre_resolved[FIB_PROTOCOL_IP4]);
1091 vlib_cli_output (vm, "MAP traffic-class: copy");
1093 vlib_cli_output (vm, "MAP traffic-class: %x", mm->tc);
1096 vlib_cli_output (vm, "MAP TCP MSS clamping: %u", mm->tcp_mss);
1098 vlib_cli_output (vm,
1099 "MAP IPv6 inbound security check: %s, fragmented packet security check: %s",
1100 mm->sec_check ? "enabled" : "disabled",
1101 mm->sec_check_frag ? "enabled" : "disabled");
1103 vlib_cli_output (vm, "ICMP-relay IPv4 source address: %U\n",
1104 format_ip4_address, &mm->icmp4_src_address);
1105 vlib_cli_output (vm, "ICMP6 unreachables sent for unmatched packets: %s\n",
1106 mm->icmp6_enabled ? "enabled" : "disabled");
1107 vlib_cli_output (vm, "Inner fragmentation: %s\n",
1108 mm->frag_inner ? "enabled" : "disabled");
1109 vlib_cli_output (vm, "Fragment packets regardless of DF flag: %s\n",
1110 mm->frag_ignore_df ? "enabled" : "disabled");
1115 vlib_combined_counter_main_t *cm = mm->domain_counters;
1116 u64 total_pkts[MAP_N_DOMAIN_COUNTER];
1117 u64 total_bytes[MAP_N_DOMAIN_COUNTER];
1121 clib_memset (total_pkts, 0, sizeof (total_pkts));
1122 clib_memset (total_bytes, 0, sizeof (total_bytes));
1124 map_domain_counter_lock (mm);
1125 vec_foreach (cm, mm->domain_counters)
1127 which = cm - mm->domain_counters;
1129 for (i = 0; i < vlib_combined_counter_n_counters (cm); i++)
1131 vlib_get_combined_counter (cm, i, &v);
1132 total_pkts[which] += v.packets;
1133 total_bytes[which] += v.bytes;
1136 map_domain_counter_unlock (mm);
1138 vlib_cli_output (vm, "Encapsulated packets: %lld bytes: %lld\n",
1139 total_pkts[MAP_DOMAIN_COUNTER_TX],
1140 total_bytes[MAP_DOMAIN_COUNTER_TX]);
1141 vlib_cli_output (vm, "Decapsulated packets: %lld bytes: %lld\n",
1142 total_pkts[MAP_DOMAIN_COUNTER_RX],
1143 total_bytes[MAP_DOMAIN_COUNTER_RX]);
1145 vlib_cli_output (vm, "ICMP relayed packets: %d\n",
1146 vlib_get_simple_counter (&mm->icmp_relayed, 0));
1151 static clib_error_t *
1152 map_if_command_fn (vlib_main_t * vm,
1153 unformat_input_t * input, vlib_cli_command_t * cmd)
1155 unformat_input_t _line_input, *line_input = &_line_input;
1156 clib_error_t *error = NULL;
1157 bool is_enable = true, is_translation = false;
1158 vnet_main_t *vnm = vnet_get_main ();
1159 u32 sw_if_index = ~0;
1161 /* Get a line of input. */
1162 if (!unformat_user (input, unformat_line_input, line_input))
1165 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1168 (line_input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index))
1170 else if (unformat (line_input, "del"))
1172 else if (unformat (line_input, "map-t"))
1173 is_translation = true;
1176 error = clib_error_return (0, "unknown input `%U'",
1177 format_unformat_error, line_input);
1183 unformat_free (line_input);
1185 if (sw_if_index == ~0)
1187 error = clib_error_return (0, "unknown interface");
1191 int rv = map_if_enable_disable (is_enable, sw_if_index, is_translation);
1194 error = clib_error_return (0, "failure enabling MAP on interface");
1202 * packet trace format function
1205 format_map_trace (u8 * s, va_list * args)
1207 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1208 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1209 map_trace_t *t = va_arg (*args, map_trace_t *);
1210 u32 map_domain_index = t->map_domain_index;
1214 format (s, "MAP domain index: %d L4 port: %u", map_domain_index,
1215 clib_net_to_host_u16 (port));
1220 static clib_error_t *
1221 map_tcp_mss_command_fn (vlib_main_t * vm,
1222 unformat_input_t * input, vlib_cli_command_t * cmd)
1224 unformat_input_t _line_input, *line_input = &_line_input;
1225 clib_error_t *error = NULL;
1228 /* Get a line of input. */
1229 if (!unformat_user (input, unformat_line_input, line_input))
1232 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1234 if (unformat (line_input, "%u", &tcp_mss))
1238 error = clib_error_return (0, "unknown input `%U'",
1239 format_unformat_error, line_input);
1244 if (tcp_mss >= (0x1 << 16))
1246 error = clib_error_return (0, "invalid value `%u'", tcp_mss);
1250 map_param_set_tcp (tcp_mss);
1253 unformat_free (line_input);
1261 * Set or copy the IP TOS/Traffic Class field
1264 * @cliexstart{map params traffic-class}
1266 * This command is used to set the traffic-class field in translated
1267 * or encapsulated packets. If copy is specifed (the default) then the
1268 * traffic-class/TOS field is copied from the original packet to the
1269 * translated / encapsulating header.
1272 VLIB_CLI_COMMAND(map_traffic_class_command, static) = {
1273 .path = "map params traffic-class",
1274 .short_help = "map params traffic-class {0x0-0xff | copy}",
1275 .function = map_traffic_class_command_fn,
1282 * @cliexstart{map params tcp-mss}
1284 * This command is used to set the TCP MSS in translated
1285 * or encapsulated packets.
1288 VLIB_CLI_COMMAND(map_tcp_mss_command, static) = {
1289 .path = "map params tcp-mss",
1290 .short_help = "map params tcp-mss <value>",
1291 .function = map_tcp_mss_command_fn,
1295 * Bypass IP4/IP6 lookup
1298 * @cliexstart{map params pre-resolve}
1300 * Bypass a second FIB lookup of the translated or encapsulated
1301 * packet, and forward the packet directly to the specified
1302 * next-hop. This optimization trades forwarding flexibility for
1306 VLIB_CLI_COMMAND(map_pre_resolve_command, static) = {
1307 .path = "map params pre-resolve",
1308 .short_help = " map params pre-resolve {ip4-nh <address>} "
1309 "| {ip6-nh <address>}",
1310 .function = map_pre_resolve_command_fn,
1314 * Enable or disable the MAP-E inbound security check
1315 * Specify if the inbound security check should be done on fragments
1318 * @cliexstart{map params security-check}
1320 * By default, a decapsulated packet's IPv4 source address will be
1321 * verified against the outer header's IPv6 source address. Disabling
1322 * this feature will allow IPv4 source address spoofing.
1324 * Typically the inbound on-decapsulation security check is only done
1325 * on the first packet. The packet that contains the L4
1326 * information. While a security check on every fragment is possible,
1327 * it has a cost. State must be created on the first fragment.
1330 VLIB_CLI_COMMAND(map_security_check_command, static) = {
1331 .path = "map params security-check",
1332 .short_help = "map params security-check enable|disable fragments on|off",
1333 .function = map_security_check_command_fn,
1337 * Specify the IPv4 source address used for relayed ICMP error messages
1340 * @cliexstart{map params icmp source-address}
1342 * This command specifies which IPv4 source address (must be local to
1343 * the system), that is used for relayed received IPv6 ICMP error
1347 VLIB_CLI_COMMAND(map_icmp_relay_source_address_command, static) = {
1348 .path = "map params icmp source-address",
1349 .short_help = "map params icmp source-address <ip4-address>",
1350 .function = map_icmp_relay_source_address_command_fn,
1354 * Send IPv6 ICMP unreachables
1357 * @cliexstart{map params icmp6 unreachables}
1359 * Send IPv6 ICMP unreachable messages back if security check fails or
1360 * no MAP domain exists.
1363 VLIB_CLI_COMMAND(map_icmp_unreachables_command, static) = {
1364 .path = "map params icmp6 unreachables",
1365 .short_help = "map params icmp6 unreachables {on|off}",
1366 .function = map_icmp_unreachables_command_fn,
1370 * Configure MAP fragmentation behaviour
1373 * @cliexstart{map params fragment}
1375 * Allows fragmentation of the IPv4 packet even if the DF bit is
1376 * set. The choice between inner or outer fragmentation of tunnel
1377 * packets is complicated. The benefit of inner fragmentation is that
1378 * the ultimate endpoint must reassemble, instead of the tunnel
1382 VLIB_CLI_COMMAND(map_fragment_command, static) = {
1383 .path = "map params fragment",
1384 .short_help = "map params fragment inner|outer ignore-df|honor-df",
1385 .function = map_fragment_command_fn,
1393 * @cliexstart{map add domain}
1396 VLIB_CLI_COMMAND(map_add_domain_command, static) = {
1397 .path = "map add domain",
1398 .short_help = "map add domain [tag <tag>] ip4-pfx <ip4-pfx> "
1399 "ip6-pfx <ip6-pfx> "
1400 "ip6-src <ip6-pfx> ea-bits-len <n> psid-offset <n> psid-len <n> "
1401 "[map-t] [mtu <mtu>]",
1402 .function = map_add_domain_command_fn,
1406 * Add MAP rule to a domain
1409 * @cliexstart{map add rule}
1412 VLIB_CLI_COMMAND(map_add_rule_command, static) = {
1413 .path = "map add rule",
1414 .short_help = "map add rule index <domain> psid <psid> ip6-dst <ip6-addr>",
1415 .function = map_add_rule_command_fn,
1422 * @cliexstart{map del domain}
1425 VLIB_CLI_COMMAND(map_del_command, static) = {
1426 .path = "map del domain",
1427 .short_help = "map del domain index <domain>",
1428 .function = map_del_domain_command_fn,
1435 * @cliexstart{show map domain}
1438 VLIB_CLI_COMMAND(show_map_domain_command, static) = {
1439 .path = "show map domain",
1440 .short_help = "show map domain index <n> [counters]",
1441 .function = show_map_domain_command_fn,
1445 * Show MAP statistics
1448 * @cliexstart{show map stats}
1451 VLIB_CLI_COMMAND(show_map_stats_command, static) = {
1452 .path = "show map stats",
1453 .short_help = "show map stats",
1454 .function = show_map_stats_command_fn,
1458 * Enable MAP processing on interface (input feature)
1461 VLIB_CLI_COMMAND(map_if_command, static) = {
1462 .path = "map interface",
1463 .short_help = "map interface <interface-name> [map-t] [del]",
1464 .function = map_if_command_fn,
1467 VLIB_PLUGIN_REGISTER() = {
1468 .version = VPP_BUILD_VER,
1469 .description = "Mapping of Address and Port (MAP)",
1477 map_init (vlib_main_t * vm)
1479 map_main_t *mm = &map_main;
1480 clib_error_t *error = 0;
1482 memset (mm, 0, sizeof (*mm));
1484 mm->vnet_main = vnet_get_main ();
1487 #ifdef MAP_SKIP_IP6_LOOKUP
1488 fib_protocol_t proto;
1490 FOR_EACH_FIB_PROTOCOL (proto)
1492 map_pre_resolve_init (&pre_resolved[proto]);
1500 /* Inbound security check */
1501 mm->sec_check = true;
1502 mm->sec_check_frag = false;
1504 /* ICMP6 Type 1, Code 5 for security check failure */
1505 mm->icmp6_enabled = false;
1507 /* Inner or outer fragmentation */
1508 mm->frag_inner = false;
1509 mm->frag_ignore_df = false;
1511 vec_validate (mm->domain_counters, MAP_N_DOMAIN_COUNTER - 1);
1512 mm->domain_counters[MAP_DOMAIN_COUNTER_RX].name = "/map/rx";
1513 mm->domain_counters[MAP_DOMAIN_COUNTER_TX].name = "/map/tx";
1515 vlib_validate_simple_counter (&mm->icmp_relayed, 0);
1516 vlib_zero_simple_counter (&mm->icmp_relayed, 0);
1517 mm->icmp_relayed.stat_segment_name = "/map/icmp-relayed";
1519 /* IP6 virtual reassembly */
1521 #ifdef MAP_SKIP_IP6_LOOKUP
1522 fib_node_register_type (FIB_NODE_TYPE_MAP_E, &map_vft);
1525 /* LPM lookup tables */
1526 mm->ip4_prefix_tbl = lpm_table_init (LPM_TYPE_KEY32);
1527 mm->ip6_prefix_tbl = lpm_table_init (LPM_TYPE_KEY128);
1528 mm->ip6_src_prefix_tbl = lpm_table_init (LPM_TYPE_KEY128);
1530 mm->bm_trans_enabled_by_sw_if = 0;
1531 mm->bm_encap_enabled_by_sw_if = 0;
1533 error = map_plugin_api_hookup (vm);
1538 VLIB_INIT_FUNCTION (map_init);
1541 * fd.io coding-style-patch-verification: ON
1544 * eval: (c-set-style "gnu")