2 * det44.c - deterministic NAT
4 * Copyright (c) 2020 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
19 * @brief deterministic NAT (CGN)
22 #include <vnet/vnet.h>
23 #include <vnet/ip/ip.h>
24 #include <vnet/ip/ip4.h>
25 #include <vpp/app/version.h>
26 #include <vnet/plugin/plugin.h>
28 #include <nat/det44/det44.h>
30 det44_main_t det44_main;
33 VNET_FEATURE_INIT (ip4_det44_in2out, static) = {
34 .arc_name = "ip4-unicast",
35 .node_name = "det44-in2out",
36 .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
37 "ip4-sv-reassembly-feature"),
39 VNET_FEATURE_INIT (ip4_det44_out2in, static) = {
40 .arc_name = "ip4-unicast",
41 .node_name = "det44-out2in",
42 .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
43 "ip4-sv-reassembly-feature",
44 "ip4-dhcp-client-detect"),
46 VLIB_PLUGIN_REGISTER () = {
47 .version = VPP_BUILD_VER,
48 .description = "Deterministic NAT (CGN)",
53 det44_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
56 det44_main_t *dm = &det44_main;
57 fib_prefix_t prefix = {
59 .fp_proto = FIB_PROTOCOL_IP4,
61 .ip4.as_u32 = addr->as_u32,
64 u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
68 fib_table_entry_update_one_path (fib_index,
71 (FIB_ENTRY_FLAG_CONNECTED |
72 FIB_ENTRY_FLAG_LOCAL |
73 FIB_ENTRY_FLAG_EXCLUSIVE),
77 ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
81 fib_table_entry_delete (fib_index, &prefix, dm->fib_src_low);
86 * @brief Add/delete deterministic NAT mapping.
88 * Create bijective mapping of inside address to outside address and port range
89 * pairs, with the purpose of enabling deterministic NAT to reduce logging in
92 * @param in_addr Inside network address.
93 * @param in_plen Inside network prefix length.
94 * @param out_addr Outside network address.
95 * @param out_plen Outside network prefix length.
96 * @param is_add If 0 delete, otherwise add.
99 snat_det_add_map (ip4_address_t * in_addr, u8 in_plen,
100 ip4_address_t * out_addr, u8 out_plen, int is_add)
102 static snat_det_session_t empty_snat_det_session = { 0 };
103 det44_main_t *dm = &det44_main;
104 ip4_address_t in_cmp, out_cmp;
105 det44_interface_t *i;
109 in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
110 out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
111 vec_foreach (mp, dm->det_maps)
113 /* Checking for overlapping addresses to be added here */
114 if (mp->in_addr.as_u32 == in_cmp.as_u32 &&
115 mp->in_plen == in_plen &&
116 mp->out_addr.as_u32 == out_cmp.as_u32 && mp->out_plen == out_plen)
123 /* If found, don't add again */
125 return VNET_API_ERROR_VALUE_EXIST;
127 /* If not found, don't delete */
128 if (!found && !is_add)
129 return VNET_API_ERROR_NO_SUCH_ENTRY;
133 pool_get (dm->det_maps, mp);
134 clib_memset (mp, 0, sizeof (*mp));
135 mp->in_addr.as_u32 = in_cmp.as_u32;
136 mp->in_plen = in_plen;
137 mp->out_addr.as_u32 = out_cmp.as_u32;
138 mp->out_plen = out_plen;
139 mp->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
140 mp->ports_per_host = (65535 - 1023) / mp->sharing_ratio;
142 vec_validate_init_empty (mp->sessions,
143 DET44_SES_PER_USER * (1 << (32 - in_plen)) -
144 1, empty_snat_det_session);
148 vec_free (mp->sessions);
149 vec_del1 (dm->det_maps, mp - dm->det_maps);
152 /* Add/del external address range to FIB */
154 pool_foreach (i, dm->interfaces, ({
155 if (det44_interface_is_inside(i))
157 det44_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
166 det44_set_timeouts (nat_timeouts_t * timeouts)
168 det44_main_t *dm = &det44_main;
170 dm->timeouts.udp = timeouts->udp;
171 if (timeouts->tcp.established)
172 dm->timeouts.tcp.established = timeouts->tcp.established;
173 if (timeouts->tcp.transitory)
174 dm->timeouts.tcp.transitory = timeouts->tcp.transitory;
176 dm->timeouts.icmp = timeouts->icmp;
181 det44_get_timeouts ()
183 det44_main_t *dm = &det44_main;
188 det44_reset_timeouts ()
190 det44_main_t *dm = &det44_main;
191 dm->timeouts.udp = 300;
192 dm->timeouts.tcp.established = 7440;
193 dm->timeouts.tcp.transitory = 240;
194 dm->timeouts.icmp = 60;
198 det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
200 det44_main_t *dm = &det44_main;
201 det44_interface_t *tmp, *i = 0;
202 const char *feature_name;
205 // TODO: if plugin is not enabled do not register nodes on interfaces
206 // rather make a structure and when enable call is used
207 // then register nodes
210 pool_foreach (tmp, dm->interfaces, ({
211 if (tmp->sw_if_index == sw_if_index)
220 feature_name = is_inside ? "det44-in2out" : "det44-out2in";
226 det44_log_err ("det44 is not enabled on this interface");
227 return VNET_API_ERROR_INVALID_VALUE;
230 rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0);
234 rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
235 sw_if_index, 1, 0, 0);
239 pool_put (dm->interfaces, i);
245 det44_log_err ("det44 is already enabled on this interface");
246 return VNET_API_ERROR_INVALID_VALUE;
249 rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 1);
253 rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
254 sw_if_index, 1, 0, 0);
258 pool_get (dm->interfaces, i);
259 clib_memset (i, 0, sizeof (*i));
261 i->sw_if_index = sw_if_index;
264 i->flags |= DET44_INTERFACE_FLAG_IS_INSIDE;
266 i->flags |= DET44_INTERFACE_FLAG_IS_OUTSIDE;
271 u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
273 // add/del outside interface fib to registry
275 det44_fib_t *outside_fib;
277 vec_foreach (outside_fib, dm->outside_fibs)
279 if (outside_fib->fib_index == fib_index)
283 outside_fib->refcount++;
287 outside_fib->refcount--;
288 if (!outside_fib->refcount)
290 vec_del1 (dm->outside_fibs,
291 outside_fib - dm->outside_fibs);
299 if (!is_del && !found)
301 vec_add2 (dm->outside_fibs, outside_fib, 1);
302 outside_fib->fib_index = fib_index;
303 outside_fib->refcount = 1;
305 // add/del outside address to FIB
308 pool_foreach (mp, dm->det_maps, ({
309 det44_add_del_addr_to_fib(&mp->out_addr,
310 mp->out_plen, sw_if_index, !is_del);
318 * @brief The 'det44-expire-walk' process's main loop.
320 * Check expire time for active sessions.
323 det44_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
326 det44_main_t *dm = &det44_main;
327 snat_det_session_t *ses;
330 vlib_process_wait_for_event_or_clock (vm, 10.0);
331 vlib_process_get_events (vm, NULL);
332 u32 now = (u32) vlib_time_now (vm);
334 pool_foreach (mp, dm->det_maps, ({
335 vec_foreach(ses, mp->sessions)
337 /* Delete if session expired */
338 if (ses->in_port && (ses->expire < now))
339 snat_det_ses_close (mp, ses);
347 det44_create_expire_walk_process ()
349 det44_main_t *dm = &det44_main;
351 if (dm->expire_walk_node_index)
354 dm->expire_walk_node_index = vlib_process_create (vlib_get_main (),
356 det44_expire_walk_fn,
357 16 /* stack_bytes */ );
361 det44_plugin_enable (det44_config_t c)
363 det44_main_t *dm = &det44_main;
365 if (plugin_enabled () == 1)
367 det44_log_err ("plugin already enabled!");
371 det44_log_err ("inside %u, outside %u", c.inside_vrf_id, c.outside_vrf_id);
373 dm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
376 dm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
380 det44_create_expire_walk_process ();
381 dm->mss_clamping = 0;
388 det44_plugin_disable ()
390 det44_main_t *dm = &det44_main;
391 det44_interface_t *i, *interfaces;
395 if (plugin_enabled () == 0)
397 det44_log_err ("plugin already disabled!");
401 // DET44 cleanup (order dependent)
402 // 1) remove interfaces (det44_interface_add_del) removes map ranges from fib
406 interfaces = vec_dup (dm->interfaces);
407 vec_foreach (i, interfaces)
409 vnet_main_t *vnm = vnet_get_main ();
411 if (i->flags & DET44_INTERFACE_FLAG_IS_INSIDE)
413 rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
416 det44_log_err ("inside interface %U del failed",
417 unformat_vnet_sw_interface, vnm, i->sw_if_index);
421 if (i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE)
423 rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
426 det44_log_err ("outside interface %U del failed",
427 unformat_vnet_sw_interface, vnm, i->sw_if_index);
432 vec_free (interfaces);
435 pool_foreach (mp, dm->det_maps,
437 vec_free (mp->sessions);
441 det44_reset_timeouts ();
444 pool_free (dm->interfaces);
445 pool_free (dm->det_maps);
451 det44_update_outside_fib (ip4_main_t * im,
453 u32 sw_if_index, u32 new_fib_index,
456 det44_main_t *dm = &det44_main;
458 det44_fib_t *outside_fib;
459 det44_interface_t *i;
464 if (plugin_enabled () == 0)
467 if (new_fib_index == old_fib_index)
470 if (!vec_len (dm->outside_fibs))
474 pool_foreach (i, dm->interfaces,
476 if (i->sw_if_index == sw_if_index)
478 if (!(det44_interface_is_outside (i)))
488 vec_foreach (outside_fib, dm->outside_fibs)
490 if (outside_fib->fib_index == old_fib_index)
492 outside_fib->refcount--;
493 if (!outside_fib->refcount)
494 vec_del1 (dm->outside_fibs, outside_fib - dm->outside_fibs);
499 vec_foreach (outside_fib, dm->outside_fibs)
501 if (outside_fib->fib_index == new_fib_index)
503 outside_fib->refcount++;
511 vec_add2 (dm->outside_fibs, outside_fib, 1);
512 outside_fib->refcount = 1;
513 outside_fib->fib_index = new_fib_index;
517 static clib_error_t *
518 det44_init (vlib_main_t * vm)
520 det44_main_t *dm = &det44_main;
521 ip4_table_bind_callback_t cb;
524 clib_memset (dm, 0, sizeof (*dm));
526 dm->ip4_main = &ip4_main;
527 dm->log_class = vlib_log_register_class ("det44", 0);
529 node = vlib_get_node_by_name (vm, (u8 *) "det44-in2out");
530 dm->in2out_node_index = node->index;
531 node = vlib_get_node_by_name (vm, (u8 *) "det44-out2in");
532 dm->out2in_node_index = node->index;
534 dm->fib_src_hi = fib_source_allocate ("det44-hi",
535 FIB_SOURCE_PRIORITY_HI,
536 FIB_SOURCE_BH_SIMPLE);
537 dm->fib_src_low = fib_source_allocate ("det44-low",
538 FIB_SOURCE_PRIORITY_LOW,
539 FIB_SOURCE_BH_SIMPLE);
541 cb.function = det44_update_outside_fib;
542 cb.function_opaque = 0;
543 vec_add1 (dm->ip4_main->table_bind_callbacks, cb);
545 det44_reset_timeouts ();
546 return det44_api_hookup (vm);
549 VLIB_INIT_FUNCTION (det44_init);
552 format_det44_session_state (u8 * s, va_list * args)
554 u32 i = va_arg (*args, u32);
559 #define _(v, N, str) case DET44_SESSION_##N: t = (u8 *) str; break;
560 foreach_det44_session_state
563 t = format (t, "unknown");
565 s = format (s, "%s", t);
570 format_det_map_ses (u8 * s, va_list * args)
572 snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *);
573 ip4_address_t in_addr, out_addr;
574 u32 in_offset, out_offset;
575 snat_det_session_t *ses = va_arg (*args, snat_det_session_t *);
576 u32 *i = va_arg (*args, u32 *);
578 u32 user_index = *i / DET44_SES_PER_USER;
580 clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) +
583 clib_net_to_host_u32 (in_addr.as_u32) -
584 clib_net_to_host_u32 (det_map->in_addr.as_u32);
585 out_offset = in_offset / det_map->sharing_ratio;
587 clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) +
591 "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
592 format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port),
593 format_ip4_address, &out_addr,
594 clib_net_to_host_u16 (ses->out.out_port), format_ip4_address,
595 &ses->out.ext_host_addr,
596 clib_net_to_host_u16 (ses->out.ext_host_port),
597 format_det44_session_state, ses->state, ses->expire);
603 * fd.io coding-style-patch-verification: ON
606 * eval: (c-set-style "gnu")