tcp: make syn-rcvd timeout configurable
[vpp.git] / src / plugins / nat / nat44-ed / nat44_ed_inlines.h
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15
16 /**
17  * @brief The NAT inline functions
18  */
19
20 #ifndef __included_nat44_ed_inlines_h__
21 #define __included_nat44_ed_inlines_h__
22
23 #include <float.h>
24 #include <vppinfra/clib.h>
25 #include <vnet/fib/ip4_fib.h>
26
27 #include <nat/lib/log.h>
28 #include <nat/lib/ipfix_logging.h>
29 #include <nat/nat44-ed/nat44_ed.h>
30
31 always_inline void
32 init_ed_k (clib_bihash_kv_16_8_t *kv, u32 l_addr, u16 l_port, u32 r_addr,
33            u16 r_port, u32 fib_index, ip_protocol_t proto)
34 {
35   kv->key[0] = (u64) r_addr << 32 | l_addr;
36   kv->key[1] =
37     (u64) r_port << 48 | (u64) l_port << 32 | fib_index << 8 | proto;
38 }
39
40 always_inline void
41 init_ed_kv (clib_bihash_kv_16_8_t *kv, u32 l_addr, u16 l_port, u32 r_addr,
42             u16 r_port, u32 fib_index, u8 proto, u32 thread_index,
43             u32 session_index)
44 {
45   init_ed_k (kv, l_addr, l_port, r_addr, r_port, fib_index, proto);
46   kv->value = (u64) thread_index << 32 | session_index;
47 }
48
49 always_inline void
50 nat44_ed_sm_init_i2o_kv (clib_bihash_kv_16_8_t *kv, u32 addr, u16 port,
51                          u32 fib_index, u8 proto, u32 sm_index)
52 {
53   return init_ed_kv (kv, addr, port, 0, 0, fib_index, proto, 0, sm_index);
54 }
55
56 always_inline void
57 nat44_ed_sm_init_o2i_kv (clib_bihash_kv_16_8_t *kv, u32 e_addr, u16 e_port,
58                          u32 fib_index, u8 proto, u32 sm_index)
59 {
60   return init_ed_kv (kv, 0, 0, e_addr, e_port, fib_index, proto, 0, sm_index);
61 }
62
63 always_inline void
64 nat44_ed_sm_init_i2o_k (clib_bihash_kv_16_8_t *kv, u32 addr, u16 port,
65                         u32 fib_index, u8 proto)
66 {
67   return nat44_ed_sm_init_i2o_kv (kv, addr, port, fib_index, proto, 0);
68 }
69
70 always_inline void
71 nat44_ed_sm_init_o2i_k (clib_bihash_kv_16_8_t *kv, u32 e_addr, u16 e_port,
72                         u32 fib_index, u8 proto)
73 {
74   return nat44_ed_sm_init_o2i_kv (kv, e_addr, e_port, fib_index, proto, 0);
75 }
76
77 always_inline u32
78 ed_value_get_thread_index (clib_bihash_kv_16_8_t *value)
79 {
80   return value->value >> 32;
81 }
82
83 always_inline u32
84 ed_value_get_session_index (clib_bihash_kv_16_8_t *value)
85 {
86   return value->value & ~(u32) 0;
87 }
88
89 always_inline void
90 split_ed_kv (clib_bihash_kv_16_8_t *kv, ip4_address_t *l_addr,
91              ip4_address_t *r_addr, u8 *proto, u32 *fib_index, u16 *l_port,
92              u16 *r_port)
93 {
94   if (l_addr)
95     {
96       l_addr->as_u32 = kv->key[0] & (u32) ~0;
97     }
98   if (r_addr)
99     {
100       r_addr->as_u32 = kv->key[0] >> 32;
101     }
102   if (r_port)
103     {
104       *r_port = kv->key[1] >> 48;
105     }
106   if (l_port)
107     {
108       *l_port = (kv->key[1] >> 32) & (u16) ~0;
109     }
110   if (fib_index)
111     {
112       *fib_index = (kv->key[1] >> 8) & ((1 << 24) - 1);
113     }
114   if (proto)
115     {
116       *proto = kv->key[1] & (u8) ~0;
117     }
118 }
119
120 static_always_inline int
121 nat_get_icmp_session_lookup_values (vlib_buffer_t *b, ip4_header_t *ip0,
122                                     ip4_address_t *lookup_saddr,
123                                     u16 *lookup_sport,
124                                     ip4_address_t *lookup_daddr,
125                                     u16 *lookup_dport, u8 *lookup_protocol)
126 {
127   icmp46_header_t *icmp0;
128   nat_icmp_echo_header_t *echo0, *inner_echo0 = 0;
129   ip4_header_t *inner_ip0 = 0;
130   void *l4_header = 0;
131   icmp46_header_t *inner_icmp0;
132
133   icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
134   echo0 = (nat_icmp_echo_header_t *) (icmp0 + 1);
135
136   // avoid warning about unused variables in caller by setting to bogus values
137   *lookup_sport = 0;
138   *lookup_dport = 0;
139
140   if (!icmp_type_is_error_message (
141         vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags))
142     {
143       *lookup_protocol = IP_PROTOCOL_ICMP;
144       lookup_saddr->as_u32 = ip0->src_address.as_u32;
145       *lookup_sport = vnet_buffer (b)->ip.reass.l4_src_port;
146       lookup_daddr->as_u32 = ip0->dst_address.as_u32;
147       *lookup_dport = vnet_buffer (b)->ip.reass.l4_dst_port;
148     }
149   else
150     {
151       inner_ip0 = (ip4_header_t *) (echo0 + 1);
152       l4_header = ip4_next_header (inner_ip0);
153       *lookup_protocol = inner_ip0->protocol;
154       lookup_saddr->as_u32 = inner_ip0->dst_address.as_u32;
155       lookup_daddr->as_u32 = inner_ip0->src_address.as_u32;
156       switch (inner_ip0->protocol)
157         {
158         case IP_PROTOCOL_ICMP:
159           inner_icmp0 = (icmp46_header_t *) l4_header;
160           inner_echo0 = (nat_icmp_echo_header_t *) (inner_icmp0 + 1);
161           *lookup_sport = inner_echo0->identifier;
162           *lookup_dport = inner_echo0->identifier;
163           break;
164         case IP_PROTOCOL_UDP:
165         case IP_PROTOCOL_TCP:
166           *lookup_sport = ((nat_tcp_udp_header_t *) l4_header)->dst_port;
167           *lookup_dport = ((nat_tcp_udp_header_t *) l4_header)->src_port;
168           break;
169         default:
170           return NAT_IN2OUT_ED_ERROR_UNSUPPORTED_PROTOCOL;
171         }
172     }
173   return 0;
174 }
175
176 always_inline int
177 nat44_ed_tcp_is_established (nat44_ed_tcp_state_e state)
178 {
179   return state == NAT44_ED_TCP_STATE_ESTABLISHED ? 1 : 0;
180 }
181
182 always_inline u32
183 nat44_session_get_timeout (snat_main_t *sm, snat_session_t *s)
184 {
185   switch (s->proto)
186     {
187     case IP_PROTOCOL_ICMP:
188       /* fallthrough */
189     case IP_PROTOCOL_ICMP6:
190       return sm->timeouts.icmp;
191     case IP_PROTOCOL_UDP:
192       return sm->timeouts.udp;
193     case IP_PROTOCOL_TCP:
194       {
195         if (nat44_ed_tcp_is_established (s->tcp_state))
196           return sm->timeouts.tcp.established;
197         else
198           return sm->timeouts.tcp.transitory;
199       }
200     default:
201       return sm->timeouts.udp;
202     }
203
204   return 0;
205 }
206
207 static_always_inline u8
208 nat44_ed_maximum_sessions_exceeded (snat_main_t *sm, u32 fib_index,
209                                     u32 thread_index)
210 {
211   u32 translations;
212   translations = pool_elts (sm->per_thread_data[thread_index].sessions);
213   if (vec_len (sm->max_translations_per_fib) <= fib_index)
214     fib_index = 0;
215   return translations >= sm->max_translations_per_fib[fib_index];
216 }
217
218 static_always_inline int
219 nat_ed_lru_insert (snat_main_per_thread_data_t *tsm, snat_session_t *s,
220                    f64 now, u8 proto)
221 {
222   dlist_elt_t *lru_list_elt;
223   pool_get (tsm->lru_pool, lru_list_elt);
224   s->lru_index = lru_list_elt - tsm->lru_pool;
225   switch (proto)
226     {
227     case IP_PROTOCOL_UDP:
228       s->lru_head_index = tsm->udp_lru_head_index;
229       break;
230     case IP_PROTOCOL_TCP:
231       s->lru_head_index = tsm->tcp_trans_lru_head_index;
232       break;
233     case IP_PROTOCOL_ICMP:
234       s->lru_head_index = tsm->icmp_lru_head_index;
235       break;
236     default:
237       s->lru_head_index = tsm->unk_proto_lru_head_index;
238       break;
239     }
240   clib_dlist_addtail (tsm->lru_pool, s->lru_head_index, s->lru_index);
241   lru_list_elt->value = s - tsm->sessions;
242   s->last_lru_update = now;
243   return 1;
244 }
245
246 static_always_inline void
247 nat_6t_flow_to_ed_k (clib_bihash_kv_16_8_t *kv, nat_6t_flow_t *f)
248 {
249   init_ed_k (kv, f->match.saddr.as_u32, f->match.sport, f->match.daddr.as_u32,
250              f->match.dport, f->match.fib_index, f->match.proto);
251 }
252
253 static_always_inline void
254 nat_6t_flow_to_ed_kv (clib_bihash_kv_16_8_t *kv, nat_6t_flow_t *f,
255                       u32 thread_idx, u32 session_idx)
256 {
257   init_ed_kv (kv, f->match.saddr.as_u32, f->match.sport, f->match.daddr.as_u32,
258               f->match.dport, f->match.fib_index, f->match.proto, thread_idx,
259               session_idx);
260 }
261
262 static_always_inline int
263 nat_ed_ses_i2o_flow_hash_add_del (snat_main_t *sm, u32 thread_idx,
264                                   snat_session_t *s, int is_add)
265 {
266   snat_main_per_thread_data_t *tsm =
267     vec_elt_at_index (sm->per_thread_data, thread_idx);
268   clib_bihash_kv_16_8_t kv;
269   if (0 == is_add)
270     {
271       nat_6t_flow_to_ed_k (&kv, &s->i2o);
272     }
273   else
274     {
275       nat_6t_flow_to_ed_kv (&kv, &s->i2o, thread_idx, s - tsm->sessions);
276       nat_6t_l3_l4_csum_calc (&s->i2o);
277     }
278
279   ASSERT (thread_idx == s->thread_index);
280   return clib_bihash_add_del_16_8 (&sm->flow_hash, &kv, is_add);
281 }
282
283 static_always_inline int
284 nat_ed_ses_o2i_flow_hash_add_del (snat_main_t *sm, u32 thread_idx,
285                                   snat_session_t *s, int is_add)
286 {
287   snat_main_per_thread_data_t *tsm =
288     vec_elt_at_index (sm->per_thread_data, thread_idx);
289   clib_bihash_kv_16_8_t kv;
290   if (0 == is_add)
291     {
292       nat_6t_flow_to_ed_k (&kv, &s->o2i);
293     }
294   else
295     {
296       nat_6t_flow_to_ed_kv (&kv, &s->o2i, thread_idx, s - tsm->sessions);
297       if (!(s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING))
298         {
299           if (nat44_ed_sm_o2i_lookup (sm, s->o2i.match.daddr,
300                                       s->o2i.match.dport, 0,
301                                       s->o2i.match.proto))
302             {
303               return -1;
304             }
305         }
306       nat_6t_l3_l4_csum_calc (&s->o2i);
307     }
308   ASSERT (thread_idx == s->thread_index);
309   return clib_bihash_add_del_16_8 (&sm->flow_hash, &kv, is_add);
310 }
311
312 always_inline void
313 nat_ed_session_delete (snat_main_t *sm, snat_session_t *ses, u32 thread_index,
314                        int lru_delete
315                        /* delete from global LRU list */)
316 {
317   snat_main_per_thread_data_t *tsm =
318     vec_elt_at_index (sm->per_thread_data, thread_index);
319
320   if (lru_delete)
321     {
322       clib_dlist_remove (tsm->lru_pool, ses->lru_index);
323     }
324   pool_put_index (tsm->lru_pool, ses->lru_index);
325   if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, ses, 0))
326     nat_elog_warn (sm, "flow hash del failed");
327   if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, ses, 0))
328     nat_elog_warn (sm, "flow hash del failed");
329   pool_put (tsm->sessions, ses);
330   vlib_set_simple_counter (&sm->total_sessions, thread_index, 0,
331                            pool_elts (tsm->sessions));
332 }
333
334 static_always_inline int
335 nat_lru_free_one_with_head (snat_main_t *sm, int thread_index, f64 now,
336                             u32 head_index)
337 {
338   snat_session_t *s = NULL;
339   dlist_elt_t *oldest_elt;
340   f64 sess_timeout_time;
341   u32 oldest_index;
342   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
343   oldest_index = clib_dlist_remove_head (tsm->lru_pool, head_index);
344   if (~0 != oldest_index)
345     {
346       oldest_elt = pool_elt_at_index (tsm->lru_pool, oldest_index);
347       s = pool_elt_at_index (tsm->sessions, oldest_elt->value);
348
349       sess_timeout_time =
350         s->last_heard + (f64) nat44_session_get_timeout (sm, s);
351       if (now >= sess_timeout_time)
352         {
353           nat44_ed_free_session_data (sm, s, thread_index, 0);
354           nat_ed_session_delete (sm, s, thread_index, 0);
355           return 1;
356         }
357       else
358         {
359           clib_dlist_addhead (tsm->lru_pool, head_index, oldest_index);
360         }
361     }
362   return 0;
363 }
364
365 static_always_inline int
366 nat_lru_free_one (snat_main_t *sm, int thread_index, f64 now)
367 {
368   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
369   int rc = 0;
370 #define _(p)                                                                  \
371   if ((rc = nat_lru_free_one_with_head (sm, thread_index, now,                \
372                                         tsm->p##_lru_head_index)))            \
373     {                                                                         \
374       return rc;                                                              \
375     }
376   _ (tcp_trans);
377   _ (udp);
378   _ (unk_proto);
379   _ (icmp);
380   _ (tcp_estab);
381 #undef _
382   return 0;
383 }
384
385 static_always_inline snat_session_t *
386 nat_ed_session_alloc (snat_main_t *sm, u32 thread_index, f64 now, u8 proto)
387 {
388   snat_session_t *s;
389   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
390
391   nat_lru_free_one (sm, thread_index, now);
392
393   pool_get (tsm->sessions, s);
394   clib_memset (s, 0, sizeof (*s));
395
396   nat_ed_lru_insert (tsm, s, now, proto);
397
398   s->ha_last_refreshed = now;
399   vlib_set_simple_counter (&sm->total_sessions, thread_index, 0,
400                            pool_elts (tsm->sessions));
401 #if CLIB_ASSERT_ENABLE
402   s->thread_index = thread_index;
403 #endif
404   return s;
405 }
406
407 // slow path
408 static_always_inline void
409 per_vrf_sessions_cleanup (u32 thread_index)
410 {
411   snat_main_t *sm = &snat_main;
412   snat_main_per_thread_data_t *tsm =
413     vec_elt_at_index (sm->per_thread_data, thread_index);
414   per_vrf_sessions_t *per_vrf_sessions;
415   u32 *to_free = 0, *i;
416
417   pool_foreach (per_vrf_sessions, tsm->per_vrf_sessions_pool)
418     {
419       if (per_vrf_sessions->expired && per_vrf_sessions->ses_count == 0)
420         vec_add1 (to_free, per_vrf_sessions - tsm->per_vrf_sessions_pool);
421     }
422
423   vec_foreach (i, to_free)
424     {
425       per_vrf_sessions = pool_elt_at_index (tsm->per_vrf_sessions_pool, *i);
426       pool_put (tsm->per_vrf_sessions_pool, per_vrf_sessions);
427     }
428
429   vec_free (to_free);
430 }
431
432 // slow path
433 static_always_inline void
434 per_vrf_sessions_register_session (snat_session_t *s, u32 thread_index)
435 {
436   snat_main_t *sm = &snat_main;
437   snat_main_per_thread_data_t *tsm =
438     vec_elt_at_index (sm->per_thread_data, thread_index);
439   per_vrf_sessions_t *per_vrf_sessions;
440
441   per_vrf_sessions_cleanup (thread_index);
442
443   // s->per_vrf_sessions_index == ~0 ... reuse of old session
444
445   pool_foreach (per_vrf_sessions, tsm->per_vrf_sessions_pool)
446     {
447       // ignore already expired registrations
448       if (per_vrf_sessions->expired)
449         continue;
450
451       if ((s->in2out.fib_index == per_vrf_sessions->rx_fib_index) &&
452           (s->out2in.fib_index == per_vrf_sessions->tx_fib_index))
453         {
454           goto done;
455         }
456       if ((s->in2out.fib_index == per_vrf_sessions->tx_fib_index) &&
457           (s->out2in.fib_index == per_vrf_sessions->rx_fib_index))
458         {
459           goto done;
460         }
461     }
462
463   // create a new registration
464   pool_get (tsm->per_vrf_sessions_pool, per_vrf_sessions);
465   clib_memset (per_vrf_sessions, 0, sizeof (*per_vrf_sessions));
466   per_vrf_sessions->rx_fib_index = s->in2out.fib_index;
467   per_vrf_sessions->tx_fib_index = s->out2in.fib_index;
468
469 done:
470   s->per_vrf_sessions_index = per_vrf_sessions - tsm->per_vrf_sessions_pool;
471   per_vrf_sessions->ses_count++;
472 }
473
474 // fast path
475 static_always_inline void
476 per_vrf_sessions_unregister_session (snat_session_t *s, u32 thread_index)
477 {
478   snat_main_t *sm = &snat_main;
479   snat_main_per_thread_data_t *tsm;
480   per_vrf_sessions_t *per_vrf_sessions;
481
482   ASSERT (s->per_vrf_sessions_index != ~0);
483
484   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
485   per_vrf_sessions =
486     pool_elt_at_index (tsm->per_vrf_sessions_pool, s->per_vrf_sessions_index);
487
488   ASSERT (per_vrf_sessions->ses_count != 0);
489
490   per_vrf_sessions->ses_count--;
491   s->per_vrf_sessions_index = ~0;
492 }
493
494 // fast path
495 static_always_inline u8
496 per_vrf_sessions_is_expired (snat_session_t *s, u32 thread_index)
497 {
498   snat_main_t *sm = &snat_main;
499   snat_main_per_thread_data_t *tsm;
500   per_vrf_sessions_t *per_vrf_sessions;
501
502   ASSERT (s->per_vrf_sessions_index != ~0);
503
504   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
505   per_vrf_sessions =
506     pool_elt_at_index (tsm->per_vrf_sessions_pool, s->per_vrf_sessions_index);
507   return per_vrf_sessions->expired;
508 }
509
510 static_always_inline void
511 nat_6t_flow_init (nat_6t_flow_t *f, u32 thread_idx, ip4_address_t saddr,
512                   u16 sport, ip4_address_t daddr, u16 dport, u32 fib_index,
513                   u8 proto, u32 session_idx)
514 {
515   clib_memset (f, 0, sizeof (*f));
516   f->match.saddr = saddr;
517   f->match.sport = sport;
518   f->match.daddr = daddr;
519   f->match.dport = dport;
520   f->match.proto = proto;
521   f->match.fib_index = fib_index;
522 }
523
524 static_always_inline void
525 nat_6t_i2o_flow_init (snat_main_t *sm, u32 thread_idx, snat_session_t *s,
526                       ip4_address_t saddr, u16 sport, ip4_address_t daddr,
527                       u16 dport, u32 fib_index, u8 proto)
528 {
529   snat_main_per_thread_data_t *tsm =
530     vec_elt_at_index (sm->per_thread_data, thread_idx);
531   nat_6t_flow_init (&s->i2o, thread_idx, saddr, sport, daddr, dport, fib_index,
532                     proto, s - tsm->sessions);
533 }
534
535 static_always_inline void
536 nat_6t_o2i_flow_init (snat_main_t *sm, u32 thread_idx, snat_session_t *s,
537                       ip4_address_t saddr, u16 sport, ip4_address_t daddr,
538                       u16 dport, u32 fib_index, u8 proto)
539 {
540   snat_main_per_thread_data_t *tsm =
541     vec_elt_at_index (sm->per_thread_data, thread_idx);
542   nat_6t_flow_init (&s->o2i, thread_idx, saddr, sport, daddr, dport, fib_index,
543                     proto, s - tsm->sessions);
544 }
545
546 static_always_inline int
547 nat_6t_t_eq (nat_6t_t *t1, nat_6t_t *t2)
548 {
549   return t1->as_u64[0] == t2->as_u64[0] && t1->as_u64[1] == t2->as_u64[1];
550 }
551
552 static inline uword
553 nat_pre_node_fn_inline (vlib_main_t *vm, vlib_node_runtime_t *node,
554                         vlib_frame_t *frame, u32 def_next)
555 {
556   u32 n_left_from, *from;
557
558   from = vlib_frame_vector_args (frame);
559   n_left_from = frame->n_vectors;
560
561   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
562   u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
563   vlib_get_buffers (vm, from, b, n_left_from);
564
565   while (n_left_from >= 2)
566     {
567       u32 next0, next1;
568       u32 arc_next0, arc_next1;
569       vlib_buffer_t *b0, *b1;
570
571       b0 = *b;
572       b++;
573       b1 = *b;
574       b++;
575
576       /* Prefetch next iteration. */
577       if (PREDICT_TRUE (n_left_from >= 4))
578         {
579           vlib_buffer_t *p2, *p3;
580
581           p2 = *b;
582           p3 = *(b + 1);
583
584           vlib_prefetch_buffer_header (p2, LOAD);
585           vlib_prefetch_buffer_header (p3, LOAD);
586
587           clib_prefetch_load (p2->data);
588           clib_prefetch_load (p3->data);
589         }
590
591       next0 = def_next;
592       next1 = def_next;
593
594       vnet_feature_next (&arc_next0, b0);
595       vnet_feature_next (&arc_next1, b1);
596
597       vnet_buffer2 (b0)->nat.arc_next = arc_next0;
598       vnet_buffer2 (b1)->nat.arc_next = arc_next1;
599
600       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
601         {
602           if (b0->flags & VLIB_BUFFER_IS_TRACED)
603             {
604               nat_pre_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
605               t->next_index = next0;
606               t->arc_next_index = arc_next0;
607             }
608           if (b1->flags & VLIB_BUFFER_IS_TRACED)
609             {
610               nat_pre_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
611               t->next_index = next1;
612               t->arc_next_index = arc_next1;
613             }
614         }
615
616       n_left_from -= 2;
617       next[0] = next0;
618       next[1] = next1;
619       next += 2;
620     }
621
622   while (n_left_from > 0)
623     {
624       u32 next0;
625       u32 arc_next0;
626       vlib_buffer_t *b0;
627
628       b0 = *b;
629       b++;
630
631       next0 = def_next;
632       vnet_feature_next (&arc_next0, b0);
633       vnet_buffer2 (b0)->nat.arc_next = arc_next0;
634
635       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) &&
636                          (b0->flags & VLIB_BUFFER_IS_TRACED)))
637         {
638           nat_pre_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
639           t->next_index = next0;
640           t->arc_next_index = arc_next0;
641         }
642
643       n_left_from--;
644       next[0] = next0;
645       next++;
646     }
647   vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
648                                frame->n_vectors);
649
650   return frame->n_vectors;
651 }
652
653 static_always_inline u16
654 snat_random_port (u16 min, u16 max)
655 {
656   snat_main_t *sm = &snat_main;
657   u32 rwide;
658   u16 r;
659
660   rwide = random_u32 (&sm->random_seed);
661   r = rwide & 0xFFFF;
662   if (r >= min && r <= max)
663     return r;
664
665   return min + (rwide % (max - min + 1));
666 }
667
668 always_inline u8
669 is_interface_addr (snat_main_t *sm, vlib_node_runtime_t *node,
670                    u32 sw_if_index0, u32 ip4_addr)
671 {
672   snat_runtime_t *rt = (snat_runtime_t *) node->runtime_data;
673   u8 ip4_addr_exists;
674
675   if (PREDICT_FALSE (rt->cached_sw_if_index != sw_if_index0))
676     {
677       ip_lookup_main_t *lm = &sm->ip4_main->lookup_main;
678       ip_interface_address_t *ia;
679       ip4_address_t *a;
680
681       rt->cached_sw_if_index = ~0;
682       hash_free (rt->cached_presence_by_ip4_address);
683
684       foreach_ip_interface_address (
685         lm, ia, sw_if_index0, 1 /* honor unnumbered */, ({
686           a = ip_interface_address_get_address (lm, ia);
687           hash_set (rt->cached_presence_by_ip4_address, a->as_u32, 1);
688           rt->cached_sw_if_index = sw_if_index0;
689         }));
690
691       if (rt->cached_sw_if_index == ~0)
692         return 0;
693     }
694
695   ip4_addr_exists = !!hash_get (rt->cached_presence_by_ip4_address, ip4_addr);
696   if (PREDICT_FALSE (ip4_addr_exists))
697     return 1;
698   else
699     return 0;
700 }
701
702 always_inline void
703 nat44_ed_session_reopen (u32 thread_index, snat_session_t *s)
704 {
705   nat_syslog_nat44_sdel (0, s->in2out.fib_index, &s->in2out.addr,
706                          s->in2out.port, &s->ext_host_nat_addr,
707                          s->ext_host_nat_port, &s->out2in.addr, s->out2in.port,
708                          &s->ext_host_addr, s->ext_host_port, s->proto,
709                          nat44_ed_is_twice_nat_session (s));
710
711   nat_ipfix_logging_nat44_ses_delete (
712     thread_index, s->in2out.addr.as_u32, s->out2in.addr.as_u32, s->proto,
713     s->in2out.port, s->out2in.port, s->in2out.fib_index);
714   nat_ipfix_logging_nat44_ses_create (
715     thread_index, s->in2out.addr.as_u32, s->out2in.addr.as_u32, s->proto,
716     s->in2out.port, s->out2in.port, s->in2out.fib_index);
717
718   nat_syslog_nat44_sadd (0, s->in2out.fib_index, &s->in2out.addr,
719                          s->in2out.port, &s->ext_host_nat_addr,
720                          s->ext_host_nat_port, &s->out2in.addr, s->out2in.port,
721                          &s->ext_host_addr, s->ext_host_port, s->proto, 0);
722   s->total_pkts = 0;
723   s->total_bytes = 0;
724 }
725
726 /*
727  * "Some rise by SYN, and some by virtue FIN" - William Shakespeare
728  * TCP state tracking patterned after RFC 7857 (and RFC 6146, which is
729  * referenced by RFC 7857). In contrast to the state machine in RFC7857 we only
730  * transition to ESTABLISHED state after seeing a full 3-way handshake (SYNs
731  * and ACKs in both directions). RFC7857 as a means of protecting against
732  * spurious RSTs closing a session, goes back to ESTABLISHED if a data packet
733  * is received after the RST. This state machine will leave the state in
734  * transitory if RST is seen. Our implementation also goes beyond by supporting
735  * creation of a new session while old session is in transitory timeout after
736  * seeing FIN packets from both sides.
737  */
738 always_inline void
739 nat44_set_tcp_session_state (snat_main_t *sm, f64 now, snat_session_t *ses,
740                              u8 tcp_flags, u32 thread_index,
741                              nat44_ed_dir_e dir)
742 {
743   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
744   u8 old_flags = ses->tcp_flags[dir];
745   ses->tcp_flags[dir] |=
746     tcp_flags & (TCP_FLAG_FIN | TCP_FLAG_SYN | TCP_FLAG_RST | TCP_FLAG_ACK);
747   if (old_flags == ses->tcp_flags[dir])
748     return;
749
750   u8 old_state = ses->tcp_state;
751
752   switch (old_state)
753     {
754     case NAT44_ED_TCP_STATE_CLOSED:
755       // ESTABLISHED when a SYN and ACK is seen from both sides
756       if ((ses->tcp_flags[NAT44_ED_DIR_I2O] &
757            ses->tcp_flags[NAT44_ED_DIR_O2I]) == (TCP_FLAG_SYN | TCP_FLAG_ACK))
758         {
759           ses->tcp_state = NAT44_ED_TCP_STATE_ESTABLISHED;
760           ses->lru_head_index = tsm->tcp_estab_lru_head_index;
761         }
762       break;
763     case NAT44_ED_TCP_STATE_ESTABLISHED:
764       // CLOSING when a FIN is seen from either side or session has been RST
765       if ((ses->tcp_flags[dir] & TCP_FLAG_FIN) ||
766           (ses->tcp_flags[dir] & TCP_FLAG_RST))
767         {
768           ses->tcp_state = NAT44_ED_TCP_STATE_CLOSING;
769           ses->tcp_flags[NAT44_ED_DIR_I2O] = 0;
770           ses->tcp_flags[NAT44_ED_DIR_O2I] = 0;
771           // need to update last heard otherwise session might get
772           // immediately timed out if it has been idle longer than
773           // transitory timeout
774           ses->last_heard = now;
775           ses->lru_head_index = tsm->tcp_trans_lru_head_index;
776         }
777       break;
778     case NAT44_ED_TCP_STATE_CLOSING:
779       // Allow a transitory session to reopen
780       if ((ses->tcp_flags[NAT44_ED_DIR_I2O] &
781            ses->tcp_flags[NAT44_ED_DIR_O2I]) == (TCP_FLAG_SYN | TCP_FLAG_ACK))
782         {
783           nat44_ed_session_reopen (thread_index, ses);
784           ses->tcp_state = NAT44_ED_TCP_STATE_ESTABLISHED;
785           ses->lru_head_index = tsm->tcp_estab_lru_head_index;
786         }
787       break;
788     }
789   if (old_state == ses->tcp_state)
790     return;
791   ses->last_lru_update = now;
792   clib_dlist_remove (tsm->lru_pool, ses->lru_index);
793   clib_dlist_addtail (tsm->lru_pool, ses->lru_head_index, ses->lru_index);
794 }
795
796 always_inline void
797 nat44_set_tcp_session_state_i2o (snat_main_t *sm, f64 now, snat_session_t *ses,
798                                  u8 tcp_flags, u32 thread_index)
799 {
800   return nat44_set_tcp_session_state (sm, now, ses, tcp_flags, thread_index,
801                                       NAT44_ED_DIR_I2O);
802 }
803
804 always_inline void
805 nat44_set_tcp_session_state_o2i (snat_main_t *sm, f64 now, snat_session_t *ses,
806                                  u8 tcp_flags, u32 thread_index)
807 {
808   return nat44_set_tcp_session_state (sm, now, ses, tcp_flags, thread_index,
809                                       NAT44_ED_DIR_O2I);
810 }
811
812 always_inline void
813 nat44_session_update_counters (snat_session_t *s, f64 now, uword bytes,
814                                u32 thread_index)
815 {
816   // regardless of TCP state, reset the timer if data packet is seen.
817   s->last_heard = now;
818   s->total_pkts++;
819   s->total_bytes += bytes;
820 }
821
822 /** \brief Per-user LRU list maintenance */
823 always_inline void
824 nat44_session_update_lru (snat_main_t *sm, snat_session_t *s, u32 thread_index)
825 {
826   /* don't update too often - timeout is in magnitude of seconds anyway */
827   if (s->last_heard > s->last_lru_update + 1)
828     {
829       clib_dlist_remove (sm->per_thread_data[thread_index].lru_pool,
830                          s->lru_index);
831       clib_dlist_addtail (sm->per_thread_data[thread_index].lru_pool,
832                           s->lru_head_index, s->lru_index);
833       s->last_lru_update = s->last_heard;
834     }
835 }
836
837 static_always_inline int
838 nat44_ed_is_unk_proto (u8 proto)
839 {
840   static const int lookup_table[256] = {
841     [IP_PROTOCOL_TCP] = 1,
842     [IP_PROTOCOL_UDP] = 1,
843     [IP_PROTOCOL_ICMP] = 1,
844     [IP_PROTOCOL_ICMP6] = 1,
845   };
846
847   return 1 - lookup_table[proto];
848 }
849
850 #endif /* __included_nat44_ed_inlines_h__ */
851
852 /*
853  * fd.io coding-style-patch-verification: ON
854  *
855  * Local Variables:
856  * eval: (c-set-style "gnu")
857  * End:
858  */