4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/fib/fib_table.h>
19 #include <vnet/fib/fib_entry_track.h>
20 #include <vnet/fib/ip6_fib.h>
21 #include <vnet/adj/adj.h>
22 #include <vppinfra/crc32.h>
23 #include <vnet/plugin/plugin.h>
24 #include <vpp/app/version.h>
30 * This code supports the following MAP modes:
32 * Algorithmic Shared IPv4 address (ea_bits_len > 0):
33 * ea_bits_len + ip4_prefix > 32
34 * psid_length > 0, ip6_prefix < 64, ip4_prefix <= 32
35 * Algorithmic Full IPv4 address (ea_bits_len > 0):
36 * ea_bits_len + ip4_prefix = 32
37 * psid_length = 0, ip6_prefix < 64, ip4_prefix <= 32
38 * Algorithmic IPv4 prefix (ea_bits_len > 0):
39 * ea_bits_len + ip4_prefix < 32
40 * psid_length = 0, ip6_prefix < 64, ip4_prefix <= 32
42 * Independent Shared IPv4 address (ea_bits_len = 0):
45 * Rule IPv6 address = 128, Rule PSID Set
46 * Independent Full IPv4 address (ea_bits_len = 0):
48 * psid_length = 0, ip6_prefix = 128
49 * Independent IPv4 prefix (ea_bits_len = 0):
51 * psid_length = 0, ip6_prefix = 128
56 * This code supports MAP-T:
58 * With a DMR prefix length of 64 or 96 (RFC6052).
64 * Save user-assigned MAP domain names ("tags") in a vector of
65 * extra domain information.
68 map_save_extras (u32 map_domain_index, u8 * tag)
70 map_main_t *mm = &map_main;
71 map_domain_extra_t *de;
73 if (map_domain_index == ~0)
76 vec_validate (mm->domain_extras, map_domain_index);
77 de = vec_elt_at_index (mm->domain_extras, map_domain_index);
78 clib_memset (de, 0, sizeof (*de));
83 de->tag = vec_dup (tag);
88 map_free_extras (u32 map_domain_index)
90 map_main_t *mm = &map_main;
91 map_domain_extra_t *de;
94 if (map_domain_index == ~0)
97 de = vec_elt_at_index (mm->domain_extras, map_domain_index);
108 map_create_domain (ip4_address_t * ip4_prefix,
110 ip6_address_t * ip6_prefix,
112 ip6_address_t * ip6_src,
117 u32 * map_domain_index, u16 mtu, u8 flags, u8 * tag)
119 u8 suffix_len, suffix_shift;
120 map_main_t *mm = &map_main;
123 /* How many, and which bits to grab from the IPv4 DA */
124 if (ip4_prefix_len + ea_bits_len < 32)
126 flags |= MAP_DOMAIN_PREFIX;
127 suffix_shift = 32 - ip4_prefix_len - ea_bits_len;
128 suffix_len = ea_bits_len;
133 suffix_len = 32 - ip4_prefix_len;
136 /* EA bits must be within the first 64 bits */
137 if (ea_bits_len > 0 && ((ip6_prefix_len + ea_bits_len) > 64 ||
138 ip6_prefix_len + suffix_len + psid_length > 64))
141 ("Embedded Address bits must be within the first 64 bits of "
146 /* Get domain index */
147 pool_get_aligned (mm->domains, d, CLIB_CACHE_LINE_BYTES);
148 clib_memset (d, 0, sizeof (*d));
149 *map_domain_index = d - mm->domains;
151 /* Init domain struct */
152 d->ip4_prefix.as_u32 = ip4_prefix->as_u32;
153 d->ip4_prefix_len = ip4_prefix_len;
154 d->ip6_prefix = *ip6_prefix;
155 d->ip6_prefix_len = ip6_prefix_len;
156 d->ip6_src = *ip6_src;
157 d->ip6_src_len = ip6_src_len;
158 d->ea_bits_len = ea_bits_len;
159 d->psid_offset = psid_offset;
160 d->psid_length = psid_length;
163 d->suffix_shift = suffix_shift;
164 d->suffix_mask = (1 << suffix_len) - 1;
166 d->psid_shift = 16 - psid_length - psid_offset;
167 d->psid_mask = (1 << d->psid_length) - 1;
168 d->ea_shift = 64 - ip6_prefix_len - suffix_len - d->psid_length;
170 /* Save a user-assigned MAP domain name if provided. */
172 map_save_extras (*map_domain_index, tag);
174 /* MAP longest match lookup table (input feature / FIB) */
175 mm->ip4_prefix_tbl->add (mm->ip4_prefix_tbl, &d->ip4_prefix,
176 d->ip4_prefix_len, *map_domain_index);
178 /* Really needed? Or always use FIB? */
179 mm->ip6_src_prefix_tbl->add (mm->ip6_src_prefix_tbl, &d->ip6_src,
180 d->ip6_src_len, *map_domain_index);
182 /* Validate packet/byte counters */
183 map_domain_counter_lock (mm);
185 for (i = 0; i < vec_len (mm->simple_domain_counters); i++)
187 vlib_validate_simple_counter (&mm->simple_domain_counters[i],
189 vlib_zero_simple_counter (&mm->simple_domain_counters[i],
192 for (i = 0; i < vec_len (mm->domain_counters); i++)
194 vlib_validate_combined_counter (&mm->domain_counters[i],
196 vlib_zero_combined_counter (&mm->domain_counters[i], *map_domain_index);
198 map_domain_counter_unlock (mm);
207 map_delete_domain (u32 map_domain_index)
209 map_main_t *mm = &map_main;
212 if (pool_is_free_index (mm->domains, map_domain_index))
214 clib_warning ("MAP domain delete: domain does not exist: %d",
219 d = pool_elt_at_index (mm->domains, map_domain_index);
220 mm->ip4_prefix_tbl->delete (mm->ip4_prefix_tbl, &d->ip4_prefix,
222 mm->ip6_src_prefix_tbl->delete (mm->ip6_src_prefix_tbl, &d->ip6_src,
225 /* Release user-assigned MAP domain name. */
226 map_free_extras (map_domain_index);
230 clib_mem_free (d->rules);
232 pool_put (mm->domains, d);
238 map_add_del_psid (u32 map_domain_index, u16 psid, ip6_address_t * tep,
242 map_main_t *mm = &map_main;
244 if (pool_is_free_index (mm->domains, map_domain_index))
246 clib_warning ("MAP rule: domain does not exist: %d", map_domain_index);
249 d = pool_elt_at_index (mm->domains, map_domain_index);
251 /* Rules are only used in 1:1 independent case */
252 if (d->ea_bits_len > 0)
257 u32 l = (0x1 << d->psid_length) * sizeof (ip6_address_t);
258 d->rules = clib_mem_alloc_aligned (l, CLIB_CACHE_LINE_BYTES);
261 clib_memset (d->rules, 0, l);
264 if (psid >= (0x1 << d->psid_length))
266 clib_warning ("MAP rule: PSID outside bounds: %d [%d]", psid,
267 0x1 << d->psid_length);
273 d->rules[psid] = *tep;
277 clib_memset (&d->rules[psid], 0, sizeof (ip6_address_t));
282 #ifdef MAP_SKIP_IP6_LOOKUP
284 * Pre-resolved per-protocol global next-hops
286 map_main_pre_resolved_t pre_resolved[FIB_PROTOCOL_MAX];
289 map_pre_resolve_init (map_main_pre_resolved_t * pr)
291 pr->fei = FIB_NODE_INDEX_INVALID;
292 fib_node_init (&pr->node, FIB_NODE_TYPE_MAP_E);
296 format_map_pre_resolve (u8 * s, va_list * ap)
298 map_main_pre_resolved_t *pr = va_arg (*ap, map_main_pre_resolved_t *);
300 if (FIB_NODE_INDEX_INVALID != pr->fei)
302 const fib_prefix_t *pfx;
304 pfx = fib_entry_get_prefix (pr->fei);
306 return (format (s, "%U (%u)",
307 format_ip46_address, &pfx->fp_addr, IP46_TYPE_ANY,
308 pr->dpo.dpoi_index));
312 return (format (s, "un-set"));
318 * Function definition to inform the FIB node that its last lock has gone.
321 map_last_lock_gone (fib_node_t * node)
324 * The MAP is a root of the graph. As such
325 * it never has children and thus is never locked.
330 static map_main_pre_resolved_t *
331 map_from_fib_node (fib_node_t * node)
333 ASSERT (FIB_NODE_TYPE_MAP_E == node->fn_type);
334 return ((map_main_pre_resolved_t *)
336 STRUCT_OFFSET_OF (map_main_pre_resolved_t, node)));
340 map_stack (map_main_pre_resolved_t * pr)
344 dpo = fib_entry_contribute_ip_forwarding (pr->fei);
346 dpo_copy (&pr->dpo, dpo);
350 * Function definition to backwalk a FIB node
352 static fib_node_back_walk_rc_t
353 map_back_walk (fib_node_t * node, fib_node_back_walk_ctx_t * ctx)
355 map_stack (map_from_fib_node (node));
357 return (FIB_NODE_BACK_WALK_CONTINUE);
361 * Function definition to get a FIB node from its index
364 map_fib_node_get (fib_node_index_t index)
366 return (&pre_resolved[index].node);
370 * Virtual function table registered by MPLS GRE tunnels
371 * for participation in the FIB object graph.
373 const static fib_node_vft_t map_vft = {
374 .fnv_get = map_fib_node_get,
375 .fnv_last_lock = map_last_lock_gone,
376 .fnv_back_walk = map_back_walk,
380 map_fib_resolve (map_main_pre_resolved_t * pr,
381 fib_protocol_t proto, u8 len, const ip46_address_t * addr)
389 pr->fei = fib_entry_track (0, // default fib
390 &pfx, FIB_NODE_TYPE_MAP_E, proto, &pr->sibling);
395 map_fib_unresolve (map_main_pre_resolved_t * pr,
396 fib_protocol_t proto, u8 len, const ip46_address_t * addr)
398 if (pr->fei != FIB_NODE_INDEX_INVALID)
400 fib_entry_untrack (pr->fei, pr->sibling);
402 dpo_reset (&pr->dpo);
404 pr->fei = FIB_NODE_INDEX_INVALID;
405 pr->sibling = FIB_NODE_INDEX_INVALID;
410 map_pre_resolve (ip4_address_t * ip4, ip6_address_t * ip6, bool is_del)
412 if (ip6 && (ip6->as_u64[0] != 0 || ip6->as_u64[1] != 0))
414 ip46_address_t addr = {
418 map_fib_unresolve (&pre_resolved[FIB_PROTOCOL_IP6],
419 FIB_PROTOCOL_IP6, 128, &addr);
421 map_fib_resolve (&pre_resolved[FIB_PROTOCOL_IP6],
422 FIB_PROTOCOL_IP6, 128, &addr);
424 if (ip4 && (ip4->as_u32 != 0))
426 ip46_address_t addr = {
430 map_fib_unresolve (&pre_resolved[FIB_PROTOCOL_IP4],
431 FIB_PROTOCOL_IP4, 32, &addr);
433 map_fib_resolve (&pre_resolved[FIB_PROTOCOL_IP4],
434 FIB_PROTOCOL_IP4, 32, &addr);
439 static clib_error_t *
440 map_security_check_command_fn (vlib_main_t * vm,
441 unformat_input_t * input,
442 vlib_cli_command_t * cmd)
444 unformat_input_t _line_input, *line_input = &_line_input;
445 clib_error_t *error = NULL;
447 bool check_frag = false;
448 bool saw_enable = false;
449 bool saw_frag = false;
451 /* Get a line of input. */
452 if (!unformat_user (input, unformat_line_input, line_input))
455 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
457 if (unformat (line_input, "enable"))
462 else if (unformat (line_input, "disable"))
467 else if (unformat (line_input, "fragments on"))
472 else if (unformat (line_input, "fragments off"))
479 error = clib_error_return (0, "unknown input `%U'",
480 format_unformat_error, line_input);
487 error = clib_error_return (0,
488 "Must specify enable 'enable' or 'disable'");
494 error = clib_error_return (0, "Must specify fragments 'on' or 'off'");
498 map_param_set_security_check (enable, check_frag);
501 unformat_free (line_input);
507 static clib_error_t *
508 map_add_domain_command_fn (vlib_main_t * vm,
509 unformat_input_t * input, vlib_cli_command_t * cmd)
511 unformat_input_t _line_input, *line_input = &_line_input;
512 ip4_address_t ip4_prefix;
513 ip6_address_t ip6_prefix;
514 ip6_address_t ip6_src;
515 u32 ip6_prefix_len = 0, ip4_prefix_len = 0, map_domain_index, ip6_src_len;
517 /* Optional arguments */
518 u32 ea_bits_len = 0, psid_offset = 0, psid_length = 0;
523 clib_error_t *error = NULL;
525 /* Get a line of input. */
526 if (!unformat_user (input, unformat_line_input, line_input))
529 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
532 (line_input, "ip4-pfx %U/%d", unformat_ip4_address, &ip4_prefix,
537 (line_input, "ip6-pfx %U/%d", unformat_ip6_address, &ip6_prefix,
542 (line_input, "ip6-src %U/%d", unformat_ip6_address, &ip6_src,
547 (line_input, "ip6-src %U", unformat_ip6_address, &ip6_src))
549 else if (unformat (line_input, "ea-bits-len %d", &ea_bits_len))
551 else if (unformat (line_input, "psid-offset %d", &psid_offset))
553 else if (unformat (line_input, "psid-len %d", &psid_length))
555 else if (unformat (line_input, "mtu %d", &mtu))
557 else if (unformat (line_input, "tag %v", &tag))
561 error = clib_error_return (0, "unknown input `%U'",
562 format_unformat_error, line_input);
569 error = clib_error_return (0, "mandatory argument(s) missing");
573 map_create_domain (&ip4_prefix, ip4_prefix_len,
574 &ip6_prefix, ip6_prefix_len, &ip6_src, ip6_src_len,
575 ea_bits_len, psid_offset, psid_length, &map_domain_index,
579 unformat_free (line_input);
584 static clib_error_t *
585 map_del_domain_command_fn (vlib_main_t * vm,
586 unformat_input_t * input, vlib_cli_command_t * cmd)
588 unformat_input_t _line_input, *line_input = &_line_input;
590 u32 map_domain_index;
591 clib_error_t *error = NULL;
593 /* Get a line of input. */
594 if (!unformat_user (input, unformat_line_input, line_input))
597 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
599 if (unformat (line_input, "index %d", &map_domain_index))
603 error = clib_error_return (0, "unknown input `%U'",
604 format_unformat_error, line_input);
611 error = clib_error_return (0, "mandatory argument(s) missing");
615 map_delete_domain (map_domain_index);
618 unformat_free (line_input);
623 static clib_error_t *
624 map_add_rule_command_fn (vlib_main_t * vm,
625 unformat_input_t * input, vlib_cli_command_t * cmd)
627 unformat_input_t _line_input, *line_input = &_line_input;
630 u32 psid = 0, map_domain_index;
631 clib_error_t *error = NULL;
633 /* Get a line of input. */
634 if (!unformat_user (input, unformat_line_input, line_input))
637 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
639 if (unformat (line_input, "index %d", &map_domain_index))
641 else if (unformat (line_input, "psid %d", &psid))
644 if (unformat (line_input, "ip6-dst %U", unformat_ip6_address, &tep))
648 error = clib_error_return (0, "unknown input `%U'",
649 format_unformat_error, line_input);
656 error = clib_error_return (0, "mandatory argument(s) missing");
660 if (map_add_del_psid (map_domain_index, psid, &tep, 1) != 0)
662 error = clib_error_return (0, "Failing to add Mapping Rule");
667 unformat_free (line_input);
672 #if MAP_SKIP_IP6_LOOKUP
673 static clib_error_t *
674 map_pre_resolve_command_fn (vlib_main_t * vm,
675 unformat_input_t * input,
676 vlib_cli_command_t * cmd)
678 unformat_input_t _line_input, *line_input = &_line_input;
679 ip4_address_t ip4nh, *p_v4 = NULL;
680 ip6_address_t ip6nh, *p_v6 = NULL;
681 clib_error_t *error = NULL;
684 clib_memset (&ip4nh, 0, sizeof (ip4nh));
685 clib_memset (&ip6nh, 0, sizeof (ip6nh));
687 /* Get a line of input. */
688 if (!unformat_user (input, unformat_line_input, line_input))
691 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
693 if (unformat (line_input, "ip4-nh %U", unformat_ip4_address, &ip4nh))
696 if (unformat (line_input, "ip6-nh %U", unformat_ip6_address, &ip6nh))
698 else if (unformat (line_input, "del"))
702 error = clib_error_return (0, "unknown input `%U'",
703 format_unformat_error, line_input);
708 map_pre_resolve (p_v4, p_v6, is_del);
711 unformat_free (line_input);
717 static clib_error_t *
718 map_icmp_relay_source_address_command_fn (vlib_main_t * vm,
719 unformat_input_t * input,
720 vlib_cli_command_t * cmd)
722 unformat_input_t _line_input, *line_input = &_line_input;
723 ip4_address_t icmp_src_address;
724 ip4_address_t *p_icmp_addr = 0;
725 map_main_t *mm = &map_main;
726 clib_error_t *error = NULL;
728 mm->icmp4_src_address.as_u32 = 0;
730 /* Get a line of input. */
731 if (!unformat_user (input, unformat_line_input, line_input))
734 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
737 (line_input, "%U", unformat_ip4_address, &icmp_src_address))
739 mm->icmp4_src_address = icmp_src_address;
740 p_icmp_addr = &icmp_src_address;
744 error = clib_error_return (0, "unknown input `%U'",
745 format_unformat_error, line_input);
750 map_param_set_icmp (p_icmp_addr);
753 unformat_free (line_input);
758 static clib_error_t *
759 map_icmp_unreachables_command_fn (vlib_main_t * vm,
760 unformat_input_t * input,
761 vlib_cli_command_t * cmd)
763 unformat_input_t _line_input, *line_input = &_line_input;
765 clib_error_t *error = NULL;
766 bool enabled = false;
768 /* Get a line of input. */
769 if (!unformat_user (input, unformat_line_input, line_input))
772 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
775 if (unformat (line_input, "on"))
777 else if (unformat (line_input, "off"))
781 error = clib_error_return (0, "unknown input `%U'",
782 format_unformat_error, line_input);
789 error = clib_error_return (0, "mandatory argument(s) missing");
792 map_param_set_icmp6 (enabled);
795 unformat_free (line_input);
801 static clib_error_t *
802 map_fragment_command_fn (vlib_main_t * vm,
803 unformat_input_t * input, vlib_cli_command_t * cmd)
805 unformat_input_t _line_input, *line_input = &_line_input;
806 clib_error_t *error = NULL;
807 bool frag_inner = false;
808 bool frag_ignore_df = false;
809 bool saw_in_out = false;
812 /* Get a line of input. */
813 if (!unformat_user (input, unformat_line_input, line_input))
816 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
818 if (unformat (line_input, "inner"))
823 else if (unformat (line_input, "outer"))
828 else if (unformat (line_input, "ignore-df"))
830 frag_ignore_df = true;
833 else if (unformat (line_input, "honor-df"))
835 frag_ignore_df = false;
840 error = clib_error_return (0, "unknown input `%U'",
841 format_unformat_error, line_input);
848 error = clib_error_return (0, "Must specify 'inner' or 'outer'");
854 error = clib_error_return (0, "Must specify 'ignore-df' or 'honor-df'");
858 map_param_set_fragmentation (frag_inner, frag_ignore_df);
861 unformat_free (line_input);
866 static clib_error_t *
867 map_traffic_class_command_fn (vlib_main_t * vm,
868 unformat_input_t * input,
869 vlib_cli_command_t * cmd)
871 unformat_input_t _line_input, *line_input = &_line_input;
873 clib_error_t *error = NULL;
874 bool tc_copy = false;
877 /* Get a line of input. */
878 if (!unformat_user (input, unformat_line_input, line_input))
881 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
883 if (unformat (line_input, "copy"))
885 else if (unformat (line_input, "%x", &tc))
889 error = clib_error_return (0, "unknown input `%U'",
890 format_unformat_error, line_input);
895 map_param_set_traffic_class (tc_copy, tc);
898 unformat_free (line_input);
904 map_flags_to_string (u32 flags)
906 if (flags & MAP_DOMAIN_PREFIX)
912 format_map_domain (u8 * s, va_list * args)
914 map_domain_t *d = va_arg (*args, map_domain_t *);
915 bool counters = va_arg (*args, int);
916 map_main_t *mm = &map_main;
917 ip6_address_t ip6_prefix;
918 u32 map_domain_index = d - mm->domains;
919 map_domain_extra_t *de;
922 clib_memset (&ip6_prefix, 0, sizeof (ip6_prefix));
924 ip6_prefix = d->ip6_prefix;
926 de = vec_elt_at_index (mm->domain_extras, map_domain_index);
929 "[%d] tag {%v} ip4-pfx %U/%d ip6-pfx %U/%d ip6-src %U/%d "
930 "ea-bits-len %d psid-offset %d psid-len %d mtu %d %s",
931 map_domain_index, de->tag,
932 format_ip4_address, &d->ip4_prefix, d->ip4_prefix_len,
933 format_ip6_address, &ip6_prefix, d->ip6_prefix_len,
934 format_ip6_address, &d->ip6_src, d->ip6_src_len,
935 d->ea_bits_len, d->psid_offset, d->psid_length, d->mtu,
936 map_flags_to_string (d->flags));
940 map_domain_counter_lock (mm);
942 vlib_get_combined_counter (&mm->domain_counters[MAP_DOMAIN_COUNTER_TX],
943 map_domain_index, &v);
944 s = format (s, " TX: %lld/%lld", v.packets, v.bytes);
945 vlib_get_combined_counter (&mm->domain_counters[MAP_DOMAIN_COUNTER_RX],
946 map_domain_index, &v);
947 s = format (s, " RX: %lld/%lld", v.packets, v.bytes);
948 map_domain_counter_unlock (mm);
950 s = format (s, "\n");
956 for (i = 0; i < (0x1 << d->psid_length); i++)
959 if (dst.as_u64[0] == 0 && dst.as_u64[1] == 0)
962 " rule psid: %d ip6-dst %U\n", i, format_ip6_address,
970 format_map_ip4_reass (u8 * s, va_list * args)
972 map_main_t *mm = &map_main;
973 map_ip4_reass_t *r = va_arg (*args, map_ip4_reass_t *);
974 map_ip4_reass_key_t *k = &r->key;
975 f64 now = vlib_time_now (mm->vlib_main);
976 f64 lifetime = (((f64) mm->ip4_reass_conf_lifetime_ms) / 1000);
977 f64 dt = (r->ts + lifetime > now) ? (r->ts + lifetime - now) : -1;
979 "ip4-reass src=%U dst=%U protocol=%d identifier=%d port=%d lifetime=%.3lf\n",
980 format_ip4_address, &k->src.as_u8, format_ip4_address,
981 &k->dst.as_u8, k->protocol,
982 clib_net_to_host_u16 (k->fragment_id),
983 (r->port >= 0) ? clib_net_to_host_u16 (r->port) : -1, dt);
988 format_map_ip6_reass (u8 * s, va_list * args)
990 map_main_t *mm = &map_main;
991 map_ip6_reass_t *r = va_arg (*args, map_ip6_reass_t *);
992 map_ip6_reass_key_t *k = &r->key;
993 f64 now = vlib_time_now (mm->vlib_main);
994 f64 lifetime = (((f64) mm->ip6_reass_conf_lifetime_ms) / 1000);
995 f64 dt = (r->ts + lifetime > now) ? (r->ts + lifetime - now) : -1;
997 "ip6-reass src=%U dst=%U protocol=%d identifier=%d lifetime=%.3lf\n",
998 format_ip6_address, &k->src.as_u8, format_ip6_address,
999 &k->dst.as_u8, k->protocol,
1000 clib_net_to_host_u32 (k->fragment_id), dt);
1004 static clib_error_t *
1005 show_map_domain_command_fn (vlib_main_t * vm, unformat_input_t * input,
1006 vlib_cli_command_t * cmd)
1008 unformat_input_t _line_input, *line_input = &_line_input;
1009 map_main_t *mm = &map_main;
1011 bool counters = false;
1012 u32 map_domain_index = ~0;
1013 clib_error_t *error = NULL;
1015 /* Get a line of input. */
1016 if (!unformat_user (input, unformat_line_input, line_input))
1019 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1021 if (unformat (line_input, "counters"))
1023 else if (unformat (line_input, "index %d", &map_domain_index))
1027 error = clib_error_return (0, "unknown input `%U'",
1028 format_unformat_error, line_input);
1033 if (pool_elts (mm->domains) == 0)
1034 vlib_cli_output (vm, "No MAP domains are configured...");
1036 if (map_domain_index == ~0)
1039 pool_foreach(d, mm->domains,
1040 ({vlib_cli_output(vm, "%U", format_map_domain, d, counters);}));
1045 if (pool_is_free_index (mm->domains, map_domain_index))
1047 error = clib_error_return (0, "MAP domain does not exists %d",
1052 d = pool_elt_at_index (mm->domains, map_domain_index);
1053 vlib_cli_output (vm, "%U", format_map_domain, d, counters);
1057 unformat_free (line_input);
1062 static clib_error_t *
1063 show_map_fragments_command_fn (vlib_main_t * vm, unformat_input_t * input,
1064 vlib_cli_command_t * cmd)
1066 map_main_t *mm = &map_main;
1067 map_ip4_reass_t *f4;
1068 map_ip6_reass_t *f6;
1071 pool_foreach(f4, mm->ip4_reass_pool, ({vlib_cli_output (vm, "%U", format_map_ip4_reass, f4);}));
1074 pool_foreach(f6, mm->ip6_reass_pool, ({vlib_cli_output (vm, "%U", format_map_ip6_reass, f6);}));
1080 map_error_counter_get (u32 node_index, map_error_t map_error)
1082 vlib_main_t *vm = vlib_get_main ();
1083 vlib_node_runtime_t *error_node = vlib_node_get_runtime (vm, node_index);
1084 vlib_error_main_t *em = &vm->error_main;
1085 vlib_error_t e = error_node->errors[map_error];
1086 vlib_node_t *n = vlib_get_node (vm, node_index);
1089 ci = vlib_error_get_code (&vm->node_main, e);
1090 ASSERT (ci < n->n_errors);
1091 ci += n->error_heap_index;
1093 return (em->counters[ci]);
1096 static clib_error_t *
1097 show_map_stats_command_fn (vlib_main_t * vm, unformat_input_t * input,
1098 vlib_cli_command_t * cmd)
1100 map_main_t *mm = &map_main;
1102 int domains = 0, rules = 0, domaincount = 0, rulecount = 0;
1103 if (pool_elts (mm->domains) == 0)
1105 vlib_cli_output (vm, "No MAP domains are configured...");
1110 pool_foreach(d, mm->domains, ({
1112 rulecount+= 0x1 << d->psid_length;
1113 rules += sizeof(ip6_address_t) * 0x1 << d->psid_length;
1115 domains += sizeof(*d);
1120 vlib_cli_output (vm, "MAP domains structure: %d\n", sizeof (map_domain_t));
1121 vlib_cli_output (vm, "MAP domains: %d (%d bytes)\n", domaincount, domains);
1122 vlib_cli_output (vm, "MAP rules: %d (%d bytes)\n", rulecount, rules);
1123 vlib_cli_output (vm, "Total: %d bytes)\n", rules + domains);
1125 #if MAP_SKIP_IP6_LOOKUP
1126 vlib_cli_output (vm,
1127 "MAP pre-resolve: IP6 next-hop: %U, IP4 next-hop: %U\n",
1128 format_map_pre_resolve, &pre_resolved[FIB_PROTOCOL_IP6],
1129 format_map_pre_resolve, &pre_resolved[FIB_PROTOCOL_IP4]);
1134 vlib_cli_output (vm, "MAP traffic-class: copy");
1136 vlib_cli_output (vm, "MAP traffic-class: %x", mm->tc);
1139 vlib_cli_output (vm, "MAP TCP MSS clamping: %u", mm->tcp_mss);
1141 vlib_cli_output (vm,
1142 "MAP IPv6 inbound security check: %s, fragmented packet security check: %s",
1143 mm->sec_check ? "enabled" : "disabled",
1144 mm->sec_check_frag ? "enabled" : "disabled");
1146 vlib_cli_output (vm, "ICMP-relay IPv4 source address: %U\n",
1147 format_ip4_address, &mm->icmp4_src_address);
1148 vlib_cli_output (vm, "ICMP6 unreachables sent for unmatched packets: %s\n",
1149 mm->icmp6_enabled ? "enabled" : "disabled");
1150 vlib_cli_output (vm, "Inner fragmentation: %s\n",
1151 mm->frag_inner ? "enabled" : "disabled");
1152 vlib_cli_output (vm, "Fragment packets regardless of DF flag: %s\n",
1153 mm->frag_ignore_df ? "enabled" : "disabled");
1158 vlib_combined_counter_main_t *cm = mm->domain_counters;
1159 u64 total_pkts[MAP_N_DOMAIN_COUNTER];
1160 u64 total_bytes[MAP_N_DOMAIN_COUNTER];
1164 clib_memset (total_pkts, 0, sizeof (total_pkts));
1165 clib_memset (total_bytes, 0, sizeof (total_bytes));
1167 map_domain_counter_lock (mm);
1168 vec_foreach (cm, mm->domain_counters)
1170 which = cm - mm->domain_counters;
1172 for (i = 0; i < vlib_combined_counter_n_counters (cm); i++)
1174 vlib_get_combined_counter (cm, i, &v);
1175 total_pkts[which] += v.packets;
1176 total_bytes[which] += v.bytes;
1179 map_domain_counter_unlock (mm);
1181 vlib_cli_output (vm, "Encapsulated packets: %lld bytes: %lld\n",
1182 total_pkts[MAP_DOMAIN_COUNTER_TX],
1183 total_bytes[MAP_DOMAIN_COUNTER_TX]);
1184 vlib_cli_output (vm, "Decapsulated packets: %lld bytes: %lld\n",
1185 total_pkts[MAP_DOMAIN_COUNTER_RX],
1186 total_bytes[MAP_DOMAIN_COUNTER_RX]);
1188 vlib_cli_output (vm, "ICMP relayed packets: %d\n",
1189 vlib_get_simple_counter (&mm->icmp_relayed, 0));
1194 static clib_error_t *
1195 map_params_reass_command_fn (vlib_main_t * vm, unformat_input_t * input,
1196 vlib_cli_command_t * cmd)
1198 unformat_input_t _line_input, *line_input = &_line_input;
1200 f64 ht_ratio = (MAP_IP4_REASS_CONF_HT_RATIO_MAX + 1);
1202 u64 buffers = ~(0ull);
1203 u8 ip4 = 0, ip6 = 0;
1205 if (!unformat_user (input, unformat_line_input, line_input))
1208 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1210 if (unformat (line_input, "lifetime %u", &lifetime))
1212 else if (unformat (line_input, "ht-ratio %lf", &ht_ratio))
1214 else if (unformat (line_input, "pool-size %u", &pool_size))
1216 else if (unformat (line_input, "buffers %llu", &buffers))
1218 else if (unformat (line_input, "ip4"))
1220 else if (unformat (line_input, "ip6"))
1224 unformat_free (line_input);
1225 return clib_error_return (0, "invalid input");
1228 unformat_free (line_input);
1231 return clib_error_return (0, "must specify ip4 and/or ip6");
1235 if (pool_size != ~0 && pool_size > MAP_IP4_REASS_CONF_POOL_SIZE_MAX)
1236 return clib_error_return (0, "invalid ip4-reass pool-size ( > %d)",
1237 MAP_IP4_REASS_CONF_POOL_SIZE_MAX);
1238 if (ht_ratio != (MAP_IP4_REASS_CONF_HT_RATIO_MAX + 1)
1239 && ht_ratio > MAP_IP4_REASS_CONF_HT_RATIO_MAX)
1240 return clib_error_return (0, "invalid ip4-reass ht-ratio ( > %d)",
1241 MAP_IP4_REASS_CONF_HT_RATIO_MAX);
1242 if (lifetime != ~0 && lifetime > MAP_IP4_REASS_CONF_LIFETIME_MAX)
1243 return clib_error_return (0, "invalid ip4-reass lifetime ( > %d)",
1244 MAP_IP4_REASS_CONF_LIFETIME_MAX);
1245 if (buffers != ~(0ull) && buffers > MAP_IP4_REASS_CONF_BUFFERS_MAX)
1246 return clib_error_return (0, "invalid ip4-reass buffers ( > %ld)",
1247 MAP_IP4_REASS_CONF_BUFFERS_MAX);
1252 if (pool_size != ~0 && pool_size > MAP_IP6_REASS_CONF_POOL_SIZE_MAX)
1253 return clib_error_return (0, "invalid ip6-reass pool-size ( > %d)",
1254 MAP_IP6_REASS_CONF_POOL_SIZE_MAX);
1255 if (ht_ratio != (MAP_IP4_REASS_CONF_HT_RATIO_MAX + 1)
1256 && ht_ratio > MAP_IP6_REASS_CONF_HT_RATIO_MAX)
1257 return clib_error_return (0, "invalid ip6-reass ht-log2len ( > %d)",
1258 MAP_IP6_REASS_CONF_HT_RATIO_MAX);
1259 if (lifetime != ~0 && lifetime > MAP_IP6_REASS_CONF_LIFETIME_MAX)
1260 return clib_error_return (0, "invalid ip6-reass lifetime ( > %d)",
1261 MAP_IP6_REASS_CONF_LIFETIME_MAX);
1262 if (buffers != ~(0ull) && buffers > MAP_IP6_REASS_CONF_BUFFERS_MAX)
1263 return clib_error_return (0, "invalid ip6-reass buffers ( > %ld)",
1264 MAP_IP6_REASS_CONF_BUFFERS_MAX);
1268 u32 reass = 0, packets = 0;
1269 rv = map_param_set_reassembly (!ip4, lifetime, pool_size, buffers, ht_ratio,
1275 vlib_cli_output (vm,
1276 "Note: destroyed-reassembly=%u , dropped-fragments=%u",
1280 case MAP_ERR_BAD_POOL_SIZE:
1281 return clib_error_return (0, "Could not set reass pool-size");
1283 case MAP_ERR_BAD_HT_RATIO:
1284 return clib_error_return (0, "Could not set reass ht-log2len");
1286 case MAP_ERR_BAD_LIFETIME:
1287 return clib_error_return (0, "Could not set ip6-reass lifetime");
1289 case MAP_ERR_BAD_BUFFERS:
1290 return clib_error_return (0, "Could not set ip6-reass buffers");
1292 case MAP_ERR_BAD_BUFFERS_TOO_LARGE:
1293 return clib_error_return (0,
1294 "Note: 'ip6-reass buffers' > pool-size * max-fragments-per-reassembly.");
1301 static clib_error_t *
1302 map_if_command_fn (vlib_main_t * vm,
1303 unformat_input_t * input, vlib_cli_command_t * cmd)
1305 unformat_input_t _line_input, *line_input = &_line_input;
1306 clib_error_t *error = NULL;
1307 bool is_enable = true, is_translation = false;
1308 vnet_main_t *vnm = vnet_get_main ();
1309 u32 sw_if_index = ~0;
1311 /* Get a line of input. */
1312 if (!unformat_user (input, unformat_line_input, line_input))
1315 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1318 (line_input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index))
1320 else if (unformat (line_input, "del"))
1322 else if (unformat (line_input, "map-t"))
1323 is_translation = true;
1326 error = clib_error_return (0, "unknown input `%U'",
1327 format_unformat_error, line_input);
1333 unformat_free (line_input);
1335 if (sw_if_index == ~0)
1337 error = clib_error_return (0, "unknown interface");
1341 int rv = map_if_enable_disable (is_enable, sw_if_index, is_translation);
1344 error = clib_error_return (0, "failure enabling MAP on interface");
1352 * packet trace format function
1355 format_map_trace (u8 * s, va_list * args)
1357 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1358 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1359 map_trace_t *t = va_arg (*args, map_trace_t *);
1360 u32 map_domain_index = t->map_domain_index;
1364 format (s, "MAP domain index: %d L4 port: %u", map_domain_index,
1365 clib_net_to_host_u16 (port));
1370 static_always_inline map_ip4_reass_t *
1371 map_ip4_reass_lookup (map_ip4_reass_key_t * k, u32 bucket, f64 now)
1373 map_main_t *mm = &map_main;
1374 u32 ri = mm->ip4_reass_hash_table[bucket];
1375 while (ri != MAP_REASS_INDEX_NONE)
1377 map_ip4_reass_t *r = pool_elt_at_index (mm->ip4_reass_pool, ri);
1378 if (r->key.as_u64[0] == k->as_u64[0] &&
1379 r->key.as_u64[1] == k->as_u64[1] &&
1380 now < r->ts + (((f64) mm->ip4_reass_conf_lifetime_ms) / 1000))
1384 ri = r->bucket_next;
1389 #define map_ip4_reass_pool_index(r) (r - map_main.ip4_reass_pool)
1392 map_ip4_reass_free (map_ip4_reass_t * r, u32 ** pi_to_drop)
1394 map_main_t *mm = &map_main;
1395 map_ip4_reass_get_fragments (r, pi_to_drop);
1397 // Unlink in hash bucket
1398 map_ip4_reass_t *r2 = NULL;
1399 u32 r2i = mm->ip4_reass_hash_table[r->bucket];
1400 while (r2i != map_ip4_reass_pool_index (r))
1402 ASSERT (r2i != MAP_REASS_INDEX_NONE);
1403 r2 = pool_elt_at_index (mm->ip4_reass_pool, r2i);
1404 r2i = r2->bucket_next;
1408 r2->bucket_next = r->bucket_next;
1412 mm->ip4_reass_hash_table[r->bucket] = r->bucket_next;
1416 if (r->fifo_next == map_ip4_reass_pool_index (r))
1418 mm->ip4_reass_fifo_last = MAP_REASS_INDEX_NONE;
1422 if (mm->ip4_reass_fifo_last == map_ip4_reass_pool_index (r))
1423 mm->ip4_reass_fifo_last = r->fifo_prev;
1424 pool_elt_at_index (mm->ip4_reass_pool, r->fifo_prev)->fifo_next =
1426 pool_elt_at_index (mm->ip4_reass_pool, r->fifo_next)->fifo_prev =
1430 pool_put (mm->ip4_reass_pool, r);
1431 mm->ip4_reass_allocated--;
1435 map_ip4_reass_get (u32 src, u32 dst, u16 fragment_id,
1436 u8 protocol, u32 ** pi_to_drop)
1439 map_main_t *mm = &map_main;
1440 map_ip4_reass_key_t k = {.src.data_u32 = src,
1441 .dst.data_u32 = dst,
1442 .fragment_id = fragment_id,
1443 .protocol = protocol
1447 #ifdef clib_crc32c_uses_intrinsics
1448 h = clib_crc32c ((u8 *) k.as_u32, 16);
1450 u64 tmp = k.as_u32[0] ^ k.as_u32[1] ^ k.as_u32[2] ^ k.as_u32[3];
1451 h = clib_xxhash (tmp);
1453 h = h >> (32 - mm->ip4_reass_ht_log2len);
1455 f64 now = vlib_time_now (mm->vlib_main);
1457 //Cache garbage collection
1458 while (mm->ip4_reass_fifo_last != MAP_REASS_INDEX_NONE)
1460 map_ip4_reass_t *last =
1461 pool_elt_at_index (mm->ip4_reass_pool, mm->ip4_reass_fifo_last);
1462 if (last->ts + (((f64) mm->ip4_reass_conf_lifetime_ms) / 1000) < now)
1463 map_ip4_reass_free (last, pi_to_drop);
1468 if ((r = map_ip4_reass_lookup (&k, h, now)))
1471 if (mm->ip4_reass_allocated >= mm->ip4_reass_conf_pool_size)
1474 pool_get (mm->ip4_reass_pool, r);
1475 mm->ip4_reass_allocated++;
1477 for (i = 0; i < MAP_IP4_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1478 r->fragments[i] = ~0;
1480 u32 ri = map_ip4_reass_pool_index (r);
1482 //Link in new bucket
1484 r->bucket_next = mm->ip4_reass_hash_table[h];
1485 mm->ip4_reass_hash_table[h] = ri;
1488 if (mm->ip4_reass_fifo_last != MAP_REASS_INDEX_NONE)
1491 pool_elt_at_index (mm->ip4_reass_pool,
1492 mm->ip4_reass_fifo_last)->fifo_next;
1493 r->fifo_prev = mm->ip4_reass_fifo_last;
1494 pool_elt_at_index (mm->ip4_reass_pool, r->fifo_prev)->fifo_next = ri;
1495 pool_elt_at_index (mm->ip4_reass_pool, r->fifo_next)->fifo_prev = ri;
1499 r->fifo_next = r->fifo_prev = ri;
1500 mm->ip4_reass_fifo_last = ri;
1507 #ifdef MAP_IP4_REASS_COUNT_BYTES
1508 r->expected_total = 0xffff;
1516 map_ip4_reass_add_fragment (map_ip4_reass_t * r, u32 pi)
1518 if (map_main.ip4_reass_buffered_counter >= map_main.ip4_reass_conf_buffers)
1522 for (i = 0; i < MAP_IP4_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1523 if (r->fragments[i] == ~0)
1525 r->fragments[i] = pi;
1526 map_main.ip4_reass_buffered_counter++;
1532 static_always_inline map_ip6_reass_t *
1533 map_ip6_reass_lookup (map_ip6_reass_key_t * k, u32 bucket, f64 now)
1535 map_main_t *mm = &map_main;
1536 u32 ri = mm->ip6_reass_hash_table[bucket];
1537 while (ri != MAP_REASS_INDEX_NONE)
1539 map_ip6_reass_t *r = pool_elt_at_index (mm->ip6_reass_pool, ri);
1540 if (now < r->ts + (((f64) mm->ip6_reass_conf_lifetime_ms) / 1000) &&
1541 r->key.as_u64[0] == k->as_u64[0] &&
1542 r->key.as_u64[1] == k->as_u64[1] &&
1543 r->key.as_u64[2] == k->as_u64[2] &&
1544 r->key.as_u64[3] == k->as_u64[3] &&
1545 r->key.as_u64[4] == k->as_u64[4])
1547 ri = r->bucket_next;
1552 #define map_ip6_reass_pool_index(r) (r - map_main.ip6_reass_pool)
1555 map_ip6_reass_free (map_ip6_reass_t * r, u32 ** pi_to_drop)
1557 map_main_t *mm = &map_main;
1559 for (i = 0; i < MAP_IP6_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1560 if (r->fragments[i].pi != ~0)
1562 vec_add1 (*pi_to_drop, r->fragments[i].pi);
1563 r->fragments[i].pi = ~0;
1564 map_main.ip6_reass_buffered_counter--;
1567 // Unlink in hash bucket
1568 map_ip6_reass_t *r2 = NULL;
1569 u32 r2i = mm->ip6_reass_hash_table[r->bucket];
1570 while (r2i != map_ip6_reass_pool_index (r))
1572 ASSERT (r2i != MAP_REASS_INDEX_NONE);
1573 r2 = pool_elt_at_index (mm->ip6_reass_pool, r2i);
1574 r2i = r2->bucket_next;
1578 r2->bucket_next = r->bucket_next;
1582 mm->ip6_reass_hash_table[r->bucket] = r->bucket_next;
1586 if (r->fifo_next == map_ip6_reass_pool_index (r))
1588 //Single element in the list, list is now empty
1589 mm->ip6_reass_fifo_last = MAP_REASS_INDEX_NONE;
1593 if (mm->ip6_reass_fifo_last == map_ip6_reass_pool_index (r)) //First element
1594 mm->ip6_reass_fifo_last = r->fifo_prev;
1595 pool_elt_at_index (mm->ip6_reass_pool, r->fifo_prev)->fifo_next =
1597 pool_elt_at_index (mm->ip6_reass_pool, r->fifo_next)->fifo_prev =
1601 // Free from pool if necessary
1602 pool_put (mm->ip6_reass_pool, r);
1603 mm->ip6_reass_allocated--;
1607 map_ip6_reass_get (ip6_address_t * src, ip6_address_t * dst, u32 fragment_id,
1608 u8 protocol, u32 ** pi_to_drop)
1611 map_main_t *mm = &map_main;
1612 map_ip6_reass_key_t k = {
1615 .fragment_id = fragment_id,
1616 .protocol = protocol
1622 #ifdef clib_crc32c_uses_intrinsics
1623 h = clib_crc32c ((u8 *) k.as_u32, 40);
1626 k.as_u64[0] ^ k.as_u64[1] ^ k.as_u64[2] ^ k.as_u64[3] ^ k.as_u64[4];
1627 h = clib_xxhash (tmp);
1630 h = h >> (32 - mm->ip6_reass_ht_log2len);
1632 f64 now = vlib_time_now (mm->vlib_main);
1634 //Cache garbage collection
1635 while (mm->ip6_reass_fifo_last != MAP_REASS_INDEX_NONE)
1637 map_ip6_reass_t *last =
1638 pool_elt_at_index (mm->ip6_reass_pool, mm->ip6_reass_fifo_last);
1639 if (last->ts + (((f64) mm->ip6_reass_conf_lifetime_ms) / 1000) < now)
1640 map_ip6_reass_free (last, pi_to_drop);
1645 if ((r = map_ip6_reass_lookup (&k, h, now)))
1648 if (mm->ip6_reass_allocated >= mm->ip6_reass_conf_pool_size)
1651 pool_get (mm->ip6_reass_pool, r);
1652 mm->ip6_reass_allocated++;
1653 for (i = 0; i < MAP_IP6_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1655 r->fragments[i].pi = ~0;
1656 r->fragments[i].next_data_len = 0;
1657 r->fragments[i].next_data_offset = 0;
1660 u32 ri = map_ip6_reass_pool_index (r);
1662 //Link in new bucket
1664 r->bucket_next = mm->ip6_reass_hash_table[h];
1665 mm->ip6_reass_hash_table[h] = ri;
1668 if (mm->ip6_reass_fifo_last != MAP_REASS_INDEX_NONE)
1671 pool_elt_at_index (mm->ip6_reass_pool,
1672 mm->ip6_reass_fifo_last)->fifo_next;
1673 r->fifo_prev = mm->ip6_reass_fifo_last;
1674 pool_elt_at_index (mm->ip6_reass_pool, r->fifo_prev)->fifo_next = ri;
1675 pool_elt_at_index (mm->ip6_reass_pool, r->fifo_next)->fifo_prev = ri;
1679 r->fifo_next = r->fifo_prev = ri;
1680 mm->ip6_reass_fifo_last = ri;
1686 r->ip4_header.ip_version_and_header_length = 0;
1687 #ifdef MAP_IP6_REASS_COUNT_BYTES
1688 r->expected_total = 0xffff;
1695 map_ip6_reass_add_fragment (map_ip6_reass_t * r, u32 pi,
1696 u16 data_offset, u16 next_data_offset,
1697 u8 * data_start, u16 data_len)
1699 map_ip6_fragment_t *f = NULL, *prev_f = NULL;
1700 u16 copied_len = (data_len > 20) ? 20 : data_len;
1702 if (map_main.ip6_reass_buffered_counter >= map_main.ip6_reass_conf_buffers)
1705 //Lookup for fragments for the current buffer
1706 //and the one before that
1708 for (i = 0; i < MAP_IP6_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1710 if (data_offset && r->fragments[i].next_data_offset == data_offset)
1712 prev_f = &r->fragments[i]; // This is buffer for previous packet
1714 else if (r->fragments[i].next_data_offset == next_data_offset)
1716 f = &r->fragments[i]; // This is a buffer for the current packet
1718 else if (r->fragments[i].next_data_offset == 0)
1721 f = &r->fragments[i];
1722 else if (prev_f == NULL)
1723 prev_f = &r->fragments[i];
1727 if (!f || f->pi != ~0)
1735 clib_memcpy_fast (prev_f->next_data, data_start, copied_len);
1736 prev_f->next_data_len = copied_len;
1737 prev_f->next_data_offset = data_offset;
1741 if (((ip4_header_t *) data_start)->ip_version_and_header_length != 0x45)
1744 if (r->ip4_header.ip_version_and_header_length == 0)
1745 clib_memcpy_fast (&r->ip4_header, data_start, sizeof (ip4_header_t));
1750 f->next_data_offset = next_data_offset;
1752 map_main.ip6_reass_buffered_counter++;
1758 map_ip4_reass_reinit (u32 * trashed_reass, u32 * dropped_packets)
1760 map_main_t *mm = &map_main;
1763 if (dropped_packets)
1764 *dropped_packets = mm->ip4_reass_buffered_counter;
1766 *trashed_reass = mm->ip4_reass_allocated;
1767 if (mm->ip4_reass_fifo_last != MAP_REASS_INDEX_NONE)
1769 u16 ri = mm->ip4_reass_fifo_last;
1772 map_ip4_reass_t *r = pool_elt_at_index (mm->ip4_reass_pool, ri);
1773 for (i = 0; i < MAP_IP4_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1774 if (r->fragments[i] != ~0)
1775 map_ip4_drop_pi (r->fragments[i]);
1778 pool_put (mm->ip4_reass_pool, r);
1780 while (ri != mm->ip4_reass_fifo_last);
1783 vec_free (mm->ip4_reass_hash_table);
1784 vec_resize (mm->ip4_reass_hash_table, 1 << mm->ip4_reass_ht_log2len);
1785 for (i = 0; i < (1 << mm->ip4_reass_ht_log2len); i++)
1786 mm->ip4_reass_hash_table[i] = MAP_REASS_INDEX_NONE;
1787 pool_free (mm->ip4_reass_pool);
1788 pool_alloc (mm->ip4_reass_pool, mm->ip4_reass_conf_pool_size);
1790 mm->ip4_reass_allocated = 0;
1791 mm->ip4_reass_fifo_last = MAP_REASS_INDEX_NONE;
1792 mm->ip4_reass_buffered_counter = 0;
1796 map_get_ht_log2len (f32 ht_ratio, u16 pool_size)
1798 u32 desired_size = (u32) (pool_size * ht_ratio);
1800 for (i = 1; i < 31; i++)
1801 if ((1 << i) >= desired_size)
1807 map_ip4_reass_conf_ht_ratio (f32 ht_ratio, u32 * trashed_reass,
1808 u32 * dropped_packets)
1810 map_main_t *mm = &map_main;
1811 if (ht_ratio > MAP_IP4_REASS_CONF_HT_RATIO_MAX)
1814 map_ip4_reass_lock ();
1815 mm->ip4_reass_conf_ht_ratio = ht_ratio;
1816 mm->ip4_reass_ht_log2len =
1817 map_get_ht_log2len (ht_ratio, mm->ip4_reass_conf_pool_size);
1818 map_ip4_reass_reinit (trashed_reass, dropped_packets);
1819 map_ip4_reass_unlock ();
1824 map_ip4_reass_conf_pool_size (u16 pool_size, u32 * trashed_reass,
1825 u32 * dropped_packets)
1827 map_main_t *mm = &map_main;
1828 if (pool_size > MAP_IP4_REASS_CONF_POOL_SIZE_MAX)
1831 map_ip4_reass_lock ();
1832 mm->ip4_reass_conf_pool_size = pool_size;
1833 map_ip4_reass_reinit (trashed_reass, dropped_packets);
1834 map_ip4_reass_unlock ();
1839 map_ip4_reass_conf_lifetime (u16 lifetime_ms)
1841 map_main.ip4_reass_conf_lifetime_ms = lifetime_ms;
1846 map_ip4_reass_conf_buffers (u32 buffers)
1848 map_main.ip4_reass_conf_buffers = buffers;
1853 map_ip6_reass_reinit (u32 * trashed_reass, u32 * dropped_packets)
1855 map_main_t *mm = &map_main;
1856 if (dropped_packets)
1857 *dropped_packets = mm->ip6_reass_buffered_counter;
1859 *trashed_reass = mm->ip6_reass_allocated;
1861 if (mm->ip6_reass_fifo_last != MAP_REASS_INDEX_NONE)
1863 u16 ri = mm->ip6_reass_fifo_last;
1866 map_ip6_reass_t *r = pool_elt_at_index (mm->ip6_reass_pool, ri);
1867 for (i = 0; i < MAP_IP6_REASS_MAX_FRAGMENTS_PER_REASSEMBLY; i++)
1868 if (r->fragments[i].pi != ~0)
1869 map_ip6_drop_pi (r->fragments[i].pi);
1872 pool_put (mm->ip6_reass_pool, r);
1874 while (ri != mm->ip6_reass_fifo_last);
1875 mm->ip6_reass_fifo_last = MAP_REASS_INDEX_NONE;
1878 vec_free (mm->ip6_reass_hash_table);
1879 vec_resize (mm->ip6_reass_hash_table, 1 << mm->ip6_reass_ht_log2len);
1880 for (i = 0; i < (1 << mm->ip6_reass_ht_log2len); i++)
1881 mm->ip6_reass_hash_table[i] = MAP_REASS_INDEX_NONE;
1882 pool_free (mm->ip6_reass_pool);
1883 pool_alloc (mm->ip6_reass_pool, mm->ip4_reass_conf_pool_size);
1885 mm->ip6_reass_allocated = 0;
1886 mm->ip6_reass_buffered_counter = 0;
1890 map_ip6_reass_conf_ht_ratio (f32 ht_ratio, u32 * trashed_reass,
1891 u32 * dropped_packets)
1893 map_main_t *mm = &map_main;
1894 if (ht_ratio > MAP_IP6_REASS_CONF_HT_RATIO_MAX)
1897 map_ip6_reass_lock ();
1898 mm->ip6_reass_conf_ht_ratio = ht_ratio;
1899 mm->ip6_reass_ht_log2len =
1900 map_get_ht_log2len (ht_ratio, mm->ip6_reass_conf_pool_size);
1901 map_ip6_reass_reinit (trashed_reass, dropped_packets);
1902 map_ip6_reass_unlock ();
1907 map_ip6_reass_conf_pool_size (u16 pool_size, u32 * trashed_reass,
1908 u32 * dropped_packets)
1910 map_main_t *mm = &map_main;
1911 if (pool_size > MAP_IP6_REASS_CONF_POOL_SIZE_MAX)
1914 map_ip6_reass_lock ();
1915 mm->ip6_reass_conf_pool_size = pool_size;
1916 map_ip6_reass_reinit (trashed_reass, dropped_packets);
1917 map_ip6_reass_unlock ();
1922 map_ip6_reass_conf_lifetime (u16 lifetime_ms)
1924 map_main.ip6_reass_conf_lifetime_ms = lifetime_ms;
1929 map_ip6_reass_conf_buffers (u32 buffers)
1931 map_main.ip6_reass_conf_buffers = buffers;
1935 static clib_error_t *
1936 map_tcp_mss_command_fn (vlib_main_t * vm,
1937 unformat_input_t * input, vlib_cli_command_t * cmd)
1939 unformat_input_t _line_input, *line_input = &_line_input;
1940 clib_error_t *error = NULL;
1943 /* Get a line of input. */
1944 if (!unformat_user (input, unformat_line_input, line_input))
1947 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1949 if (unformat (line_input, "%u", &tcp_mss))
1953 error = clib_error_return (0, "unknown input `%U'",
1954 format_unformat_error, line_input);
1959 if (tcp_mss >= (0x1 << 16))
1961 error = clib_error_return (0, "invalid value `%u'", tcp_mss);
1965 map_param_set_tcp (tcp_mss);
1968 unformat_free (line_input);
1977 * Configure MAP reassembly behaviour
1980 * @cliexstart{map params reassembly}
1983 VLIB_CLI_COMMAND(map_ip4_reass_lifetime_command, static) = {
1984 .path = "map params reassembly",
1985 .short_help = "map params reassembly [ip4 | ip6] [lifetime <lifetime-ms>] "
1986 "[pool-size <pool-size>] [buffers <buffers>] "
1987 "[ht-ratio <ht-ratio>]",
1988 .function = map_params_reass_command_fn,
1992 * Set or copy the IP TOS/Traffic Class field
1995 * @cliexstart{map params traffic-class}
1997 * This command is used to set the traffic-class field in translated
1998 * or encapsulated packets. If copy is specifed (the default) then the
1999 * traffic-class/TOS field is copied from the original packet to the
2000 * translated / encapsulating header.
2003 VLIB_CLI_COMMAND(map_traffic_class_command, static) = {
2004 .path = "map params traffic-class",
2005 .short_help = "map params traffic-class {0x0-0xff | copy}",
2006 .function = map_traffic_class_command_fn,
2013 * @cliexstart{map params tcp-mss}
2015 * This command is used to set the TCP MSS in translated
2016 * or encapsulated packets.
2019 VLIB_CLI_COMMAND(map_tcp_mss_command, static) = {
2020 .path = "map params tcp-mss",
2021 .short_help = "map params tcp-mss <value>",
2022 .function = map_tcp_mss_command_fn,
2026 * Bypass IP4/IP6 lookup
2029 * @cliexstart{map params pre-resolve}
2031 * Bypass a second FIB lookup of the translated or encapsulated
2032 * packet, and forward the packet directly to the specified
2033 * next-hop. This optimization trades forwarding flexibility for
2037 VLIB_CLI_COMMAND(map_pre_resolve_command, static) = {
2038 .path = "map params pre-resolve",
2039 .short_help = " map params pre-resolve {ip4-nh <address>} "
2040 "| {ip6-nh <address>}",
2041 .function = map_pre_resolve_command_fn,
2045 * Enable or disable the MAP-E inbound security check
2046 * Specifiy if the inbound security check should be done on fragments
2049 * @cliexstart{map params security-check}
2051 * By default, a decapsulated packet's IPv4 source address will be
2052 * verified against the outer header's IPv6 source address. Disabling
2053 * this feature will allow IPv4 source address spoofing.
2055 * Typically the inbound on-decapsulation security check is only done
2056 * on the first packet. The packet that contains the L4
2057 * information. While a security check on every fragment is possible,
2058 * it has a cost. State must be created on the first fragment.
2061 VLIB_CLI_COMMAND(map_security_check_command, static) = {
2062 .path = "map params security-check",
2063 .short_help = "map params security-check enable|disable fragments on|off",
2064 .function = map_security_check_command_fn,
2069 * Specifiy the IPv4 source address used for relayed ICMP error messages
2072 * @cliexstart{map params icmp source-address}
2074 * This command specifies which IPv4 source address (must be local to
2075 * the system), that is used for relayed received IPv6 ICMP error
2079 VLIB_CLI_COMMAND(map_icmp_relay_source_address_command, static) = {
2080 .path = "map params icmp source-address",
2081 .short_help = "map params icmp source-address <ip4-address>",
2082 .function = map_icmp_relay_source_address_command_fn,
2086 * Send IPv6 ICMP unreachables
2089 * @cliexstart{map params icmp6 unreachables}
2091 * Send IPv6 ICMP unreachable messages back if security check fails or
2092 * no MAP domain exists.
2095 VLIB_CLI_COMMAND(map_icmp_unreachables_command, static) = {
2096 .path = "map params icmp6 unreachables",
2097 .short_help = "map params icmp6 unreachables {on|off}",
2098 .function = map_icmp_unreachables_command_fn,
2102 * Configure MAP fragmentation behaviour
2105 * @cliexstart{map params fragment}
2107 * Allows fragmentation of the IPv4 packet even if the DF bit is
2108 * set. The choice between inner or outer fragmentation of tunnel
2109 * packets is complicated. The benefit of inner fragmentation is that
2110 * the ultimate endpoint must reassemble, instead of the tunnel
2114 VLIB_CLI_COMMAND(map_fragment_command, static) = {
2115 .path = "map params fragment",
2116 .short_help = "map params fragment inner|outer ignore-df|honor-df",
2117 .function = map_fragment_command_fn,
2125 * @cliexstart{map add domain}
2128 VLIB_CLI_COMMAND(map_add_domain_command, static) = {
2129 .path = "map add domain",
2130 .short_help = "map add domain [tag <tag>] ip4-pfx <ip4-pfx> "
2131 "ip6-pfx <ip6-pfx> "
2132 "ip6-src <ip6-pfx> ea-bits-len <n> psid-offset <n> psid-len <n> "
2133 "[map-t] [mtu <mtu>]",
2134 .function = map_add_domain_command_fn,
2138 * Add MAP rule to a domain
2141 * @cliexstart{map add rule}
2144 VLIB_CLI_COMMAND(map_add_rule_command, static) = {
2145 .path = "map add rule",
2146 .short_help = "map add rule index <domain> psid <psid> ip6-dst <ip6-addr>",
2147 .function = map_add_rule_command_fn,
2154 * @cliexstart{map del domain}
2157 VLIB_CLI_COMMAND(map_del_command, static) = {
2158 .path = "map del domain",
2159 .short_help = "map del domain index <domain>",
2160 .function = map_del_domain_command_fn,
2167 * @cliexstart{show map domain}
2170 VLIB_CLI_COMMAND(show_map_domain_command, static) = {
2171 .path = "show map domain",
2172 .short_help = "show map domain index <n> [counters]",
2173 .function = show_map_domain_command_fn,
2177 * Show MAP statistics
2180 * @cliexstart{show map stats}
2183 VLIB_CLI_COMMAND(show_map_stats_command, static) = {
2184 .path = "show map stats",
2185 .short_help = "show map stats",
2186 .function = show_map_stats_command_fn,
2190 * Show MAP fragmentation information
2193 * @cliexstart{show map fragments}
2196 VLIB_CLI_COMMAND(show_map_fragments_command, static) = {
2197 .path = "show map fragments",
2198 .short_help = "show map fragments",
2199 .function = show_map_fragments_command_fn,
2203 * Enable MAP processing on interface (input feature)
2206 VLIB_CLI_COMMAND(map_if_command, static) = {
2207 .path = "map interface",
2208 .short_help = "map interface <interface-name> [map-t] [del]",
2209 .function = map_if_command_fn,
2212 VLIB_PLUGIN_REGISTER() = {
2213 .version = VPP_BUILD_VER,
2214 .description = "Mapping of Address and Port (MAP)",
2223 map_init (vlib_main_t * vm)
2225 map_main_t *mm = &map_main;
2226 clib_error_t *error = 0;
2228 memset (mm, 0, sizeof (*mm));
2230 mm->vnet_main = vnet_get_main ();
2233 #ifdef MAP_SKIP_IP6_LOOKUP
2234 fib_protocol_t proto;
2236 FOR_EACH_FIB_PROTOCOL (proto)
2238 map_pre_resolve_init (&pre_resolved[proto]);
2246 /* Inbound security check */
2247 mm->sec_check = true;
2248 mm->sec_check_frag = false;
2250 /* ICMP6 Type 1, Code 5 for security check failure */
2251 mm->icmp6_enabled = false;
2253 /* Inner or outer fragmentation */
2254 mm->frag_inner = false;
2255 mm->frag_ignore_df = false;
2257 vec_validate (mm->domain_counters, MAP_N_DOMAIN_COUNTER - 1);
2258 mm->domain_counters[MAP_DOMAIN_COUNTER_RX].name = "/map/rx";
2259 mm->domain_counters[MAP_DOMAIN_COUNTER_TX].name = "/map/tx";
2261 vlib_validate_simple_counter (&mm->icmp_relayed, 0);
2262 vlib_zero_simple_counter (&mm->icmp_relayed, 0);
2263 mm->icmp_relayed.stat_segment_name = "/map/icmp-relayed";
2265 /* IP4 virtual reassembly */
2266 mm->ip4_reass_hash_table = 0;
2267 mm->ip4_reass_pool = 0;
2268 clib_spinlock_init (&mm->ip4_reass_lock);
2269 mm->ip4_reass_conf_ht_ratio = MAP_IP4_REASS_HT_RATIO_DEFAULT;
2270 mm->ip4_reass_conf_lifetime_ms = MAP_IP4_REASS_LIFETIME_DEFAULT;
2271 mm->ip4_reass_conf_pool_size = MAP_IP4_REASS_POOL_SIZE_DEFAULT;
2272 mm->ip4_reass_conf_buffers = MAP_IP4_REASS_BUFFERS_DEFAULT;
2273 mm->ip4_reass_ht_log2len =
2274 map_get_ht_log2len (mm->ip4_reass_conf_ht_ratio,
2275 mm->ip4_reass_conf_pool_size);
2276 mm->ip4_reass_fifo_last = MAP_REASS_INDEX_NONE;
2277 map_ip4_reass_reinit (NULL, NULL);
2279 /* IP6 virtual reassembly */
2280 mm->ip6_reass_hash_table = 0;
2281 mm->ip6_reass_pool = 0;
2282 clib_spinlock_init (&mm->ip6_reass_lock);
2283 mm->ip6_reass_conf_ht_ratio = MAP_IP6_REASS_HT_RATIO_DEFAULT;
2284 mm->ip6_reass_conf_lifetime_ms = MAP_IP6_REASS_LIFETIME_DEFAULT;
2285 mm->ip6_reass_conf_pool_size = MAP_IP6_REASS_POOL_SIZE_DEFAULT;
2286 mm->ip6_reass_conf_buffers = MAP_IP6_REASS_BUFFERS_DEFAULT;
2287 mm->ip6_reass_ht_log2len =
2288 map_get_ht_log2len (mm->ip6_reass_conf_ht_ratio,
2289 mm->ip6_reass_conf_pool_size);
2290 mm->ip6_reass_fifo_last = MAP_REASS_INDEX_NONE;
2291 map_ip6_reass_reinit (NULL, NULL);
2293 #ifdef MAP_SKIP_IP6_LOOKUP
2294 fib_node_register_type (FIB_NODE_TYPE_MAP_E, &map_vft);
2297 /* LPM lookup tables */
2298 mm->ip4_prefix_tbl = lpm_table_init (LPM_TYPE_KEY32);
2299 mm->ip6_prefix_tbl = lpm_table_init (LPM_TYPE_KEY128);
2300 mm->ip6_src_prefix_tbl = lpm_table_init (LPM_TYPE_KEY128);
2302 mm->bm_trans_enabled_by_sw_if = 0;
2303 mm->bm_encap_enabled_by_sw_if = 0;
2305 error = map_plugin_api_hookup (vm);
2310 VLIB_INIT_FUNCTION (map_init);
2313 * fd.io coding-style-patch-verification: ON
2316 * eval: (c-set-style "gnu")