src/plugins/nat/nat44-ed/nat44_ed_out2in.c

   1 /*
   2  * Copyright (c) 2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 /**
  16  * @file
  17  * @brief NAT44 endpoint-dependent outside to inside network translation
  18  */
  19
  20 #include <vlib/vlib.h>
  21 #include <vnet/vnet.h>
  22 #include <vnet/ip/ip.h>
  23 #include <vnet/ethernet/ethernet.h>
  24 #include <vnet/fib/ip4_fib.h>
  25 #include <vnet/udp/udp_local.h>
  26 #include <vppinfra/error.h>
  27
  28 #include <nat/lib/nat_syslog.h>
  29 #include <nat/lib/ipfix_logging.h>
  30
  31 #include <nat/nat44-ed/nat44_ed.h>
  32 #include <nat/nat44-ed/nat44_ed_inlines.h>
  33
  34 static char *nat_out2in_ed_error_strings[] = {
  35 #define _(sym,string) string,
  36   foreach_nat_out2in_ed_error
  37 #undef _
  38 };
  39
  40 typedef enum
  41 {
  42   NAT_ED_SP_REASON_NO_REASON,
  43   NAT_ED_SP_REASON_LOOKUP_FAILED,
  44   NAT_ED_SP_REASON_VRF_EXPIRED,
  45   NAT_ED_SP_TCP_CLOSED,
  46   NAT_ED_SP_SESS_EXPIRED,
  47 } nat_slow_path_reason_e;
  48
  49 typedef struct
  50 {
  51   u32 sw_if_index;
  52   u32 next_index;
  53   u32 session_index;
  54   nat_translation_error_e translation_error;
  55   nat_6t_flow_t i2of;
  56   nat_6t_flow_t o2if;
  57   clib_bihash_kv_16_8_t search_key;
  58   u8 is_slow_path;
  59   u8 translation_via_i2of;
  60   u8 lookup_skipped;
  61   nat_slow_path_reason_e slow_path_reason;
  62 } nat44_ed_out2in_trace_t;
  63
  64 static u8 *
  65 format_slow_path_reason (u8 *s, va_list *args)
  66 {
  67   nat_slow_path_reason_e reason = va_arg (*args, nat_slow_path_reason_e);
  68   switch (reason)
  69     {
  70     case NAT_ED_SP_REASON_NO_REASON:
  71       return format (s, "no reason for slow path");
  72     case NAT_ED_SP_REASON_LOOKUP_FAILED:
  73       return format (s, "slow path because lookup failed");
  74     case NAT_ED_SP_REASON_VRF_EXPIRED:
  75       return format (s, "slow path because vrf expired");
  76     case NAT_ED_SP_TCP_CLOSED:
  77       return format (s, "slow path because tcp closed");
  78     case NAT_ED_SP_SESS_EXPIRED:
  79       return format (s, "slow path because session expired");
  80     }
  81   return format (s, "invalid reason value");
  82 }
  83
  84 static u8 *
  85 format_nat44_ed_out2in_trace (u8 * s, va_list * args)
  86 {
  87   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  88   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  89   nat44_ed_out2in_trace_t *t = va_arg (*args, nat44_ed_out2in_trace_t *);
  90   char *tag;
  91
  92   tag =
  93     t->is_slow_path ? "NAT44_OUT2IN_ED_SLOW_PATH" :
  94     "NAT44_OUT2IN_ED_FAST_PATH";
  95
  96   s = format (s, "%s: sw_if_index %d, next index %d", tag, t->sw_if_index,
  97               t->next_index);
  98   if (~0 != t->session_index)
  99     {
 100       s = format (s, ", session %d, translation result '%U' via %s",
 101                   t->session_index, format_nat_ed_translation_error,
 102                   t->translation_error,
 103                   t->translation_via_i2of ? "i2of" : "o2if");
 104       s = format (s, "\n  i2of %U", format_nat_6t_flow, &t->i2of);
 105       s = format (s, "\n  o2if %U", format_nat_6t_flow, &t->o2if);
 106     }
 107   if (!t->is_slow_path)
 108     {
 109       if (t->lookup_skipped)
 110         {
 111           s = format (s, "\n lookup skipped - cached session index used");
 112         }
 113       else
 114         {
 115           s = format (s, "\n  search key %U", format_ed_session_kvp,
 116                       &t->search_key);
 117         }
 118       s = format (s, "\n %U", format_slow_path_reason, t->slow_path_reason);
 119     }
 120
 121   return s;
 122 }
 123
 124 static int
 125 next_src_nat (snat_main_t *sm, ip4_header_t *ip, u16 src_port, u16 dst_port,
 126               u32 thread_index, u32 rx_fib_index)
 127 {
 128   clib_bihash_kv_16_8_t kv, value;
 129
 130   init_ed_k (&kv, ip->src_address, src_port, ip->dst_address, dst_port,
 131              rx_fib_index, ip->protocol);
 132   if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv, &value))
 133     return 1;
 134
 135   return 0;
 136 }
 137
 138 static void create_bypass_for_fwd (snat_main_t *sm, vlib_buffer_t *b,
 139                                    snat_session_t *s, ip4_header_t *ip,
 140                                    u32 rx_fib_index, u32 thread_index);
 141
 142 static snat_session_t *create_session_for_static_mapping_ed (
 143   snat_main_t *sm, vlib_buffer_t *b, ip4_address_t i2o_addr, u16 i2o_port,
 144   u32 i2o_fib_index, ip4_address_t o2i_addr, u16 o2i_port, u32 o2i_fib_index,
 145   nat_protocol_t nat_proto, vlib_node_runtime_t *node, u32 rx_fib_index,
 146   u32 thread_index, twice_nat_type_t twice_nat, lb_nat_type_t lb_nat, f64 now,
 147   snat_static_mapping_t *mapping);
 148
 149 static inline u32
 150 icmp_out2in_ed_slow_path (snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip,
 151                           icmp46_header_t *icmp, u32 sw_if_index,
 152                           u32 rx_fib_index, vlib_node_runtime_t *node,
 153                           u32 next, f64 now, u32 thread_index,
 154                           snat_session_t **s_p)
 155 {
 156   vlib_main_t *vm = vlib_get_main ();
 157
 158   ip_csum_t sum;
 159   u16 checksum;
 160
 161   snat_session_t *s = 0;
 162   u8 is_addr_only, identity_nat;
 163   ip4_address_t sm_addr;
 164   u16 sm_port;
 165   u32 sm_fib_index;
 166   snat_static_mapping_t *m;
 167   u8 lookup_protocol;
 168   ip4_address_t lookup_saddr, lookup_daddr;
 169   u16 lookup_sport, lookup_dport;
 170
 171   sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_RX];
 172   rx_fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 173
 174   if (nat_get_icmp_session_lookup_values (b, ip, &lookup_saddr, &lookup_sport,
 175                                           &lookup_daddr, &lookup_dport,
 176                                           &lookup_protocol))
 177     {
 178       b->error = node->errors[NAT_OUT2IN_ED_ERROR_UNSUPPORTED_PROTOCOL];
 179       next = NAT_NEXT_DROP;
 180       goto out;
 181     }
 182
 183   if (snat_static_mapping_match (
 184         vm, sm, ip->dst_address, lookup_sport, rx_fib_index,
 185         ip_proto_to_nat_proto (ip->protocol), &sm_addr, &sm_port,
 186         &sm_fib_index, 1, &is_addr_only, 0, 0, 0, &identity_nat, &m))
 187     {
 188       // static mapping not matched
 189       if (!sm->forwarding_enabled)
 190         {
 191           /* Don't NAT packet aimed at the intfc address */
 192           if (!is_interface_addr (sm, node, sw_if_index,
 193                                   ip->dst_address.as_u32))
 194             {
 195               b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
 196               next = NAT_NEXT_DROP;
 197             }
 198         }
 199       else
 200         {
 201           if (next_src_nat (sm, ip, lookup_sport, lookup_dport, thread_index,
 202                             rx_fib_index))
 203             {
 204               next = NAT_NEXT_IN2OUT_ED_FAST_PATH;
 205             }
 206           else
 207             {
 208               create_bypass_for_fwd (sm, b, s, ip, rx_fib_index, thread_index);
 209             }
 210         }
 211       goto out;
 212     }
 213
 214   if (PREDICT_FALSE (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
 215                        ICMP4_echo_reply &&
 216                      (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
 217                         ICMP4_echo_request ||
 218                       !is_addr_only)))
 219     {
 220       b->error = node->errors[NAT_OUT2IN_ED_ERROR_BAD_ICMP_TYPE];
 221       next = NAT_NEXT_DROP;
 222       goto out;
 223     }
 224
 225   if (PREDICT_FALSE (identity_nat))
 226     {
 227       goto out;
 228     }
 229
 230   /* Create session initiated by host from external network */
 231   s = create_session_for_static_mapping_ed (
 232     sm, b, sm_addr, sm_port, sm_fib_index, ip->dst_address, lookup_sport,
 233     rx_fib_index, ip_proto_to_nat_proto (lookup_protocol), node, rx_fib_index,
 234     thread_index, 0, 0, vlib_time_now (vm), m);
 235   if (!s)
 236     next = NAT_NEXT_DROP;
 237
 238   if (PREDICT_TRUE (!ip4_is_fragment (ip)))
 239     {
 240       sum = ip_incremental_checksum_buffer (
 241         vm, b, (u8 *) icmp - (u8 *) vlib_buffer_get_current (b),
 242         ntohs (ip->length) - ip4_header_bytes (ip), 0);
 243       checksum = ~ip_csum_fold (sum);
 244       if (checksum != 0 && checksum != 0xffff)
 245         {
 246           next = NAT_NEXT_DROP;
 247           goto out;
 248         }
 249     }
 250
 251   if (PREDICT_TRUE (next != NAT_NEXT_DROP && s))
 252     {
 253       /* Accounting */
 254       nat44_session_update_counters (
 255         s, now, vlib_buffer_length_in_chain (vm, b), thread_index);
 256       /* Per-user LRU list maintenance */
 257       nat44_session_update_lru (sm, s, thread_index);
 258     }
 259 out:
 260   if (NAT_NEXT_DROP == next && s)
 261     {
 262       nat_ed_session_delete (sm, s, thread_index, 1);
 263       s = 0;
 264     }
 265   *s_p = s;
 266   return next;
 267 }
 268
 269 // allocate exact address based on preference
 270 static_always_inline int
 271 nat_alloc_addr_and_port_exact (snat_address_t * a,
 272                                u32 thread_index,
 273                                nat_protocol_t proto,
 274                                ip4_address_t * addr,
 275                                u16 * port,
 276                                u16 port_per_thread, u32 snat_thread_index)
 277 {
 278   snat_main_t *sm = &snat_main;
 279   u32 portnum;
 280
 281   switch (proto)
 282     {
 283 #define _(N, j, n, s) \
 284     case NAT_PROTOCOL_##N: \
 285       if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
 286         { \
 287           while (1) \
 288             { \
 289               portnum = (port_per_thread * \
 290                 snat_thread_index) + \
 291                 snat_random_port(0, port_per_thread - 1) + 1024; \
 292               if (a->busy_##n##_port_refcounts[portnum]) \
 293                 continue; \
 294               --a->busy_##n##_port_refcounts[portnum]; \
 295               a->busy_##n##_ports_per_thread[thread_index]++; \
 296               a->busy_##n##_ports++; \
 297               *addr = a->addr; \
 298               *port = clib_host_to_net_u16(portnum); \
 299               return 0; \
 300             } \
 301         } \
 302       break;
 303       foreach_nat_protocol
 304 #undef _
 305         default : nat_elog_info (sm, "unknown protocol");
 306       return 1;
 307     }
 308
 309   /* Totally out of translations to use... */
 310   nat_ipfix_logging_addresses_exhausted (thread_index, 0);
 311   return 1;
 312 }
 313
 314 static_always_inline int
 315 nat44_ed_alloc_outside_addr_and_port (snat_address_t *addresses, u32 fib_index,
 316                                       u32 thread_index, nat_protocol_t proto,
 317                                       ip4_address_t *addr, u16 *port,
 318                                       u16 port_per_thread,
 319                                       u32 snat_thread_index)
 320 {
 321   snat_main_t *sm = &snat_main;
 322   snat_address_t *a, *ga = 0;
 323   u32 portnum;
 324   int i;
 325
 326   for (i = 0; i < vec_len (addresses); i++)
 327     {
 328       a = addresses + i;
 329       switch (proto)
 330         {
 331 #define _(N, j, n, s)                                                         \
 332   case NAT_PROTOCOL_##N:                                                      \
 333     if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread)       \
 334       {                                                                       \
 335         if (a->fib_index == fib_index)                                        \
 336           {                                                                   \
 337             while (1)                                                         \
 338               {                                                               \
 339                 portnum = (port_per_thread * snat_thread_index) +             \
 340                           snat_random_port (0, port_per_thread - 1) + 1024;   \
 341                 if (a->busy_##n##_port_refcounts[portnum])                    \
 342                   continue;                                                   \
 343                 --a->busy_##n##_port_refcounts[portnum];                      \
 344                 a->busy_##n##_ports_per_thread[thread_index]++;               \
 345                 a->busy_##n##_ports++;                                        \
 346                 *addr = a->addr;                                              \
 347                 *port = clib_host_to_net_u16 (portnum);                       \
 348                 return 0;                                                     \
 349               }                                                               \
 350           }                                                                   \
 351         else if (a->fib_index == ~0)                                          \
 352           {                                                                   \
 353             ga = a;                                                           \
 354           }                                                                   \
 355       }                                                                       \
 356     break;
 357           foreach_nat_protocol
 358 #undef _
 359             default : nat_elog_info (sm, "unknown protocol");
 360           return 1;
 361         }
 362     }
 363
 364   if (ga)
 365     {
 366       a = ga;
 367       switch (proto)
 368         {
 369 #define _(N, j, n, s)                                                         \
 370   case NAT_PROTOCOL_##N:                                                      \
 371     while (1)                                                                 \
 372       {                                                                       \
 373         portnum = (port_per_thread * snat_thread_index) +                     \
 374                   snat_random_port (0, port_per_thread - 1) + 1024;           \
 375         if (a->busy_##n##_port_refcounts[portnum])                            \
 376           continue;                                                           \
 377         ++a->busy_##n##_port_refcounts[portnum];                              \
 378         a->busy_##n##_ports_per_thread[thread_index]++;                       \
 379         a->busy_##n##_ports++;                                                \
 380         *addr = a->addr;                                                      \
 381         *port = clib_host_to_net_u16 (portnum);                               \
 382         return 0;                                                             \
 383       }
 384           break;
 385           foreach_nat_protocol
 386 #undef _
 387             default : nat_elog_info (sm, "unknown protocol");
 388           return 1;
 389         }
 390     }
 391
 392   /* Totally out of translations to use... */
 393   nat_ipfix_logging_addresses_exhausted (thread_index, 0);
 394   return 1;
 395 }
 396
 397 static snat_session_t *
 398 create_session_for_static_mapping_ed (
 399   snat_main_t *sm, vlib_buffer_t *b, ip4_address_t i2o_addr, u16 i2o_port,
 400   u32 i2o_fib_index, ip4_address_t o2i_addr, u16 o2i_port, u32 o2i_fib_index,
 401   nat_protocol_t nat_proto, vlib_node_runtime_t *node, u32 rx_fib_index,
 402   u32 thread_index, twice_nat_type_t twice_nat, lb_nat_type_t lb_nat, f64 now,
 403   snat_static_mapping_t *mapping)
 404 {
 405   snat_session_t *s;
 406   ip4_header_t *ip;
 407   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 408
 409   if (PREDICT_FALSE
 410       (nat44_ed_maximum_sessions_exceeded (sm, rx_fib_index, thread_index)))
 411     {
 412       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 413       nat_elog_notice (sm, "maximum sessions exceeded");
 414       return 0;
 415     }
 416
 417   s = nat_ed_session_alloc (sm, thread_index, now, nat_proto);
 418   if (!s)
 419     {
 420       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 421       nat_elog_warn (sm, "create NAT session failed");
 422       return 0;
 423     }
 424
 425   ip = vlib_buffer_get_current (b);
 426
 427   s->ext_host_addr.as_u32 = ip->src_address.as_u32;
 428   s->ext_host_port =
 429     nat_proto == NAT_PROTOCOL_ICMP ? 0 : vnet_buffer (b)->ip.reass.l4_src_port;
 430   s->flags |= SNAT_SESSION_FLAG_STATIC_MAPPING;
 431   if (lb_nat)
 432     s->flags |= SNAT_SESSION_FLAG_LOAD_BALANCING;
 433   if (lb_nat == AFFINITY_LB_NAT)
 434     s->flags |= SNAT_SESSION_FLAG_AFFINITY;
 435   s->flags |= SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT;
 436   s->out2in.addr = o2i_addr;
 437   s->out2in.port = o2i_port;
 438   s->out2in.fib_index = o2i_fib_index;
 439   s->in2out.addr = i2o_addr;
 440   s->in2out.port = i2o_port;
 441   s->in2out.fib_index = i2o_fib_index;
 442   s->nat_proto = nat_proto;
 443
 444   if (NAT_PROTOCOL_ICMP == nat_proto)
 445     {
 446       nat_6t_o2i_flow_init (sm, thread_index, s, s->ext_host_addr, o2i_port,
 447                             o2i_addr, o2i_port, o2i_fib_index, ip->protocol);
 448       nat_6t_flow_icmp_id_rewrite_set (&s->o2i, i2o_port);
 449     }
 450   else
 451     {
 452       nat_6t_o2i_flow_init (sm, thread_index, s, s->ext_host_addr,
 453                             s->ext_host_port, o2i_addr, o2i_port,
 454                             o2i_fib_index, ip->protocol);
 455       nat_6t_flow_dport_rewrite_set (&s->o2i, i2o_port);
 456     }
 457   nat_6t_flow_daddr_rewrite_set (&s->o2i, i2o_addr.as_u32);
 458   nat_6t_flow_txfib_rewrite_set (&s->o2i, i2o_fib_index);
 459
 460   if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 1))
 461     {
 462       b->error = node->errors[NAT_OUT2IN_ED_ERROR_HASH_ADD_FAILED];
 463       nat_ed_session_delete (sm, s, thread_index, 1);
 464       nat_elog_warn (sm, "out2in flow hash add failed");
 465       return 0;
 466     }
 467
 468   if (twice_nat == TWICE_NAT || (twice_nat == TWICE_NAT_SELF &&
 469                                  ip->src_address.as_u32 == i2o_addr.as_u32))
 470     {
 471       int rc = 0;
 472       snat_address_t *filter = 0;
 473
 474       // if exact address is specified use this address
 475       if (is_exact_address (mapping))
 476         {
 477           snat_address_t *ap;
 478           vec_foreach (ap, sm->twice_nat_addresses)
 479           {
 480             if (mapping->pool_addr.as_u32 == ap->addr.as_u32)
 481               {
 482                 filter = ap;
 483                 break;
 484               }
 485           }
 486         }
 487
 488       if (filter)
 489         {
 490           rc = nat_alloc_addr_and_port_exact (filter,
 491                                               thread_index,
 492                                               nat_proto,
 493                                               &s->ext_host_nat_addr,
 494                                               &s->ext_host_nat_port,
 495                                               sm->port_per_thread,
 496                                               tsm->snat_thread_index);
 497           s->flags |= SNAT_SESSION_FLAG_EXACT_ADDRESS;
 498         }
 499       else
 500         {
 501           rc = nat44_ed_alloc_outside_addr_and_port (
 502             sm->twice_nat_addresses, 0, thread_index, nat_proto,
 503             &s->ext_host_nat_addr, &s->ext_host_nat_port, sm->port_per_thread,
 504             tsm->snat_thread_index);
 505         }
 506
 507       if (rc)
 508         {
 509           b->error = node->errors[NAT_OUT2IN_ED_ERROR_OUT_OF_PORTS];
 510           if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 0))
 511             {
 512               nat_elog_warn (sm, "out2in flow hash del failed");
 513             }
 514           snat_free_outside_address_and_port (
 515             sm->twice_nat_addresses, thread_index, &s->ext_host_nat_addr,
 516             s->ext_host_nat_port, s->nat_proto);
 517           nat_ed_session_delete (sm, s, thread_index, 1);
 518           return 0;
 519         }
 520
 521       s->flags |= SNAT_SESSION_FLAG_TWICE_NAT;
 522
 523       nat_6t_flow_saddr_rewrite_set (&s->o2i, s->ext_host_nat_addr.as_u32);
 524       if (NAT_PROTOCOL_ICMP == nat_proto)
 525         {
 526           nat_6t_flow_icmp_id_rewrite_set (&s->o2i, s->ext_host_nat_port);
 527         }
 528       else
 529         {
 530           nat_6t_flow_sport_rewrite_set (&s->o2i, s->ext_host_nat_port);
 531         }
 532
 533       nat_6t_l3_l4_csum_calc (&s->o2i);
 534
 535       nat_6t_i2o_flow_init (sm, thread_index, s, i2o_addr, i2o_port,
 536                             s->ext_host_nat_addr, s->ext_host_nat_port,
 537                             i2o_fib_index, ip->protocol);
 538       nat_6t_flow_daddr_rewrite_set (&s->i2o, s->ext_host_addr.as_u32);
 539       if (NAT_PROTOCOL_ICMP == nat_proto)
 540         {
 541           nat_6t_flow_icmp_id_rewrite_set (&s->i2o, s->ext_host_port);
 542         }
 543       else
 544         {
 545           nat_6t_flow_dport_rewrite_set (&s->i2o, s->ext_host_port);
 546         }
 547     }
 548   else
 549     {
 550       if (NAT_PROTOCOL_ICMP == nat_proto)
 551         {
 552           nat_6t_i2o_flow_init (sm, thread_index, s, i2o_addr, i2o_port,
 553                                 s->ext_host_addr, i2o_port, i2o_fib_index,
 554                                 ip->protocol);
 555         }
 556       else
 557         {
 558           nat_6t_i2o_flow_init (sm, thread_index, s, i2o_addr, i2o_port,
 559                                 s->ext_host_addr, s->ext_host_port,
 560                                 i2o_fib_index, ip->protocol);
 561         }
 562     }
 563
 564   nat_6t_flow_saddr_rewrite_set (&s->i2o, o2i_addr.as_u32);
 565   if (NAT_PROTOCOL_ICMP == nat_proto)
 566     {
 567       nat_6t_flow_icmp_id_rewrite_set (&s->i2o, o2i_port);
 568     }
 569   else
 570     {
 571       nat_6t_flow_sport_rewrite_set (&s->i2o, o2i_port);
 572     }
 573
 574   if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, s, 1))
 575     {
 576       nat_elog_notice (sm, "in2out flow hash add failed");
 577       if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 0))
 578         {
 579           nat_elog_warn (sm, "out2in flow hash del failed");
 580         }
 581       nat_ed_session_delete (sm, s, thread_index, 1);
 582       return 0;
 583     }
 584
 585   nat_ipfix_logging_nat44_ses_create (thread_index,
 586                                       s->in2out.addr.as_u32,
 587                                       s->out2in.addr.as_u32,
 588                                       s->nat_proto,
 589                                       s->in2out.port,
 590                                       s->out2in.port, s->in2out.fib_index);
 591
 592   nat_syslog_nat44_sadd (0, s->in2out.fib_index, &s->in2out.addr,
 593                          s->in2out.port, &s->ext_host_nat_addr,
 594                          s->ext_host_nat_port, &s->out2in.addr, s->out2in.port,
 595                          &s->ext_host_addr, s->ext_host_port, s->nat_proto,
 596                          is_twice_nat_session (s));
 597
 598   per_vrf_sessions_register_session (s, thread_index);
 599
 600   return s;
 601 }
 602
 603 static void
 604 create_bypass_for_fwd (snat_main_t *sm, vlib_buffer_t *b, snat_session_t *s,
 605                        ip4_header_t *ip, u32 rx_fib_index, u32 thread_index)
 606 {
 607   clib_bihash_kv_16_8_t kv, value;
 608   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 609   vlib_main_t *vm = vlib_get_main ();
 610   f64 now = vlib_time_now (vm);
 611   u16 lookup_sport, lookup_dport;
 612   u8 lookup_protocol;
 613   ip4_address_t lookup_saddr, lookup_daddr;
 614
 615   if (ip->protocol == IP_PROTOCOL_ICMP)
 616     {
 617       if (nat_get_icmp_session_lookup_values (b, ip, &lookup_daddr,
 618                                               &lookup_sport, &lookup_saddr,
 619                                               &lookup_dport, &lookup_protocol))
 620         return;
 621     }
 622   else
 623     {
 624       if (ip->protocol == IP_PROTOCOL_UDP || ip->protocol == IP_PROTOCOL_TCP)
 625         {
 626           lookup_sport = vnet_buffer (b)->ip.reass.l4_dst_port;
 627           lookup_dport = vnet_buffer (b)->ip.reass.l4_src_port;
 628         }
 629       else
 630         {
 631           lookup_sport = 0;
 632           lookup_dport = 0;
 633         }
 634       lookup_saddr.as_u32 = ip->dst_address.as_u32;
 635       lookup_daddr.as_u32 = ip->src_address.as_u32;
 636       lookup_protocol = ip->protocol;
 637     }
 638
 639   init_ed_k (&kv, lookup_saddr, lookup_sport, lookup_daddr, lookup_dport,
 640              rx_fib_index, lookup_protocol);
 641
 642   if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv, &value))
 643     {
 644       ASSERT (thread_index == ed_value_get_thread_index (&value));
 645       s =
 646         pool_elt_at_index (tsm->sessions,
 647                            ed_value_get_session_index (&value));
 648     }
 649   else if (ip->protocol == IP_PROTOCOL_ICMP &&
 650            icmp_type_is_error_message
 651            (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags))
 652     {
 653       return;
 654     }
 655   else
 656     {
 657       u32 proto;
 658
 659       if (PREDICT_FALSE
 660           (nat44_ed_maximum_sessions_exceeded
 661            (sm, rx_fib_index, thread_index)))
 662         return;
 663
 664       s = nat_ed_session_alloc (sm, thread_index, now, ip->protocol);
 665       if (!s)
 666         {
 667           nat_elog_warn (sm, "create NAT session failed");
 668           return;
 669         }
 670
 671       proto = ip_proto_to_nat_proto (ip->protocol);
 672
 673       s->ext_host_addr = ip->src_address;
 674       s->ext_host_port = lookup_dport;
 675       s->flags |= SNAT_SESSION_FLAG_FWD_BYPASS;
 676       s->out2in.addr = ip->dst_address;
 677       s->out2in.port = lookup_sport;
 678       s->nat_proto = proto;
 679       if (proto == NAT_PROTOCOL_OTHER)
 680         {
 681           s->flags |= SNAT_SESSION_FLAG_UNKNOWN_PROTO;
 682           s->out2in.port = ip->protocol;
 683         }
 684       s->out2in.fib_index = rx_fib_index;
 685       s->in2out.addr = s->out2in.addr;
 686       s->in2out.port = s->out2in.port;
 687       s->in2out.fib_index = s->out2in.fib_index;
 688
 689       nat_6t_i2o_flow_init (sm, thread_index, s, ip->dst_address, lookup_sport,
 690                             ip->src_address, lookup_dport, rx_fib_index,
 691                             ip->protocol);
 692       nat_6t_flow_txfib_rewrite_set (&s->i2o, rx_fib_index);
 693       if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, s, 1))
 694         {
 695           nat_elog_notice (sm, "in2out flow add failed");
 696           nat_ed_session_delete (sm, s, thread_index, 1);
 697           return;
 698         }
 699
 700       per_vrf_sessions_register_session (s, thread_index);
 701     }
 702
 703   if (ip->protocol == IP_PROTOCOL_TCP)
 704     {
 705       tcp_header_t *tcp = ip4_next_header (ip);
 706       nat44_set_tcp_session_state_o2i (sm, now, s, tcp->flags,
 707                                        tcp->ack_number, tcp->seq_number,
 708                                        thread_index);
 709     }
 710
 711   /* Accounting */
 712   nat44_session_update_counters (s, now, 0, thread_index);
 713   /* Per-user LRU list maintenance */
 714   nat44_session_update_lru (sm, s, thread_index);
 715 }
 716
 717 static snat_session_t *
 718 nat44_ed_out2in_slowpath_unknown_proto (snat_main_t *sm, vlib_buffer_t *b,
 719                                         ip4_header_t *ip, u32 rx_fib_index,
 720                                         u32 thread_index, f64 now,
 721                                         vlib_main_t *vm,
 722                                         vlib_node_runtime_t *node)
 723 {
 724   clib_bihash_kv_8_8_t kv, value;
 725   snat_static_mapping_t *m;
 726   snat_session_t *s;
 727
 728   if (PREDICT_FALSE (
 729         nat44_ed_maximum_sessions_exceeded (sm, rx_fib_index, thread_index)))
 730     {
 731       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 732       nat_elog_notice (sm, "maximum sessions exceeded");
 733       return 0;
 734     }
 735
 736   init_nat_k (&kv, ip->dst_address, 0, 0, 0);
 737   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 738     {
 739       b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
 740       return 0;
 741     }
 742
 743   m = pool_elt_at_index (sm->static_mappings, value.value);
 744
 745   /* Create a new session */
 746   s = nat_ed_session_alloc (sm, thread_index, now, ip->protocol);
 747   if (!s)
 748     {
 749       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 750       nat_elog_warn (sm, "create NAT session failed");
 751       return 0;
 752     }
 753
 754   s->ext_host_addr.as_u32 = ip->src_address.as_u32;
 755   s->flags |= SNAT_SESSION_FLAG_UNKNOWN_PROTO;
 756   s->flags |= SNAT_SESSION_FLAG_STATIC_MAPPING;
 757   s->flags |= SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT;
 758   s->out2in.addr.as_u32 = ip->dst_address.as_u32;
 759   s->out2in.fib_index = rx_fib_index;
 760   s->in2out.addr.as_u32 = m->local_addr.as_u32;
 761   s->in2out.fib_index = m->fib_index;
 762   s->in2out.port = s->out2in.port = ip->protocol;
 763
 764   nat_6t_o2i_flow_init (sm, thread_index, s, ip->dst_address, 0,
 765                         ip->src_address, 0, m->fib_index, ip->protocol);
 766   nat_6t_flow_saddr_rewrite_set (&s->i2o, ip->dst_address.as_u32);
 767   if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, s, 1))
 768     {
 769       nat_elog_notice (sm, "in2out key add failed");
 770       nat_ed_session_delete (sm, s, thread_index, 1);
 771       return NULL;
 772     }
 773
 774   nat_6t_o2i_flow_init (sm, thread_index, s, ip->src_address, 0,
 775                         ip->dst_address, 0, rx_fib_index, ip->protocol);
 776   nat_6t_flow_daddr_rewrite_set (&s->o2i, m->local_addr.as_u32);
 777   nat_6t_flow_txfib_rewrite_set (&s->o2i, m->fib_index);
 778   if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 1))
 779     {
 780       nat_elog_notice (sm, "out2in flow hash add failed");
 781       nat_ed_session_delete (sm, s, thread_index, 1);
 782       return NULL;
 783     }
 784
 785   per_vrf_sessions_register_session (s, thread_index);
 786
 787   /* Accounting */
 788   nat44_session_update_counters (s, now, vlib_buffer_length_in_chain (vm, b),
 789                                  thread_index);
 790   /* Per-user LRU list maintenance */
 791   nat44_session_update_lru (sm, s, thread_index);
 792
 793   return s;
 794 }
 795
 796 static inline uword
 797 nat44_ed_out2in_fast_path_node_fn_inline (vlib_main_t * vm,
 798                                           vlib_node_runtime_t * node,
 799                                           vlib_frame_t * frame,
 800                                           int is_multi_worker)
 801 {
 802   u32 n_left_from, *from;
 803   snat_main_t *sm = &snat_main;
 804   f64 now = vlib_time_now (vm);
 805   u32 thread_index = vm->thread_index;
 806   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 807
 808   from = vlib_frame_vector_args (frame);
 809   n_left_from = frame->n_vectors;
 810
 811   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
 812   u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
 813   vlib_get_buffers (vm, from, b, n_left_from);
 814
 815   while (n_left_from > 0)
 816     {
 817       vlib_buffer_t *b0;
 818       u32 sw_if_index0, rx_fib_index0;
 819       nat_protocol_t proto0;
 820       ip4_header_t *ip0;
 821       snat_session_t *s0 = 0;
 822       clib_bihash_kv_16_8_t kv0, value0;
 823       nat_translation_error_e translation_error = NAT_ED_TRNSL_ERR_SUCCESS;
 824       nat_slow_path_reason_e slow_path_reason = NAT_ED_SP_REASON_NO_REASON;
 825       nat_6t_flow_t *f = 0;
 826       nat_6t_t lookup;
 827       int lookup_skipped = 0;
 828
 829       b0 = *b;
 830       b++;
 831
 832       /* Prefetch next iteration. */
 833       if (PREDICT_TRUE (n_left_from >= 2))
 834         {
 835           vlib_buffer_t *p2;
 836
 837           p2 = *b;
 838
 839           vlib_prefetch_buffer_header (p2, LOAD);
 840
 841           CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
 842         }
 843
 844       next[0] = vnet_buffer2 (b0)->nat.arc_next;
 845
 846       lookup.sport = vnet_buffer (b0)->ip.reass.l4_src_port;
 847       lookup.dport = vnet_buffer (b0)->ip.reass.l4_dst_port;
 848
 849       vnet_buffer (b0)->snat.flags = 0;
 850       ip0 = vlib_buffer_get_current (b0);
 851
 852       sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 853       rx_fib_index0 =
 854         fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index0);
 855
 856       lookup.fib_index = rx_fib_index0;
 857
 858       if (PREDICT_FALSE (ip0->ttl == 1))
 859         {
 860           vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 861           icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
 862                                        ICMP4_time_exceeded_ttl_exceeded_in_transit,
 863                                        0);
 864           next[0] = NAT_NEXT_ICMP_ERROR;
 865           goto trace0;
 866         }
 867
 868       proto0 = ip_proto_to_nat_proto (ip0->protocol);
 869
 870       if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
 871         {
 872           if (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags !=
 873                 ICMP4_echo_request &&
 874               vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags !=
 875                 ICMP4_echo_reply &&
 876               !icmp_type_is_error_message (
 877                 vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
 878             {
 879               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_BAD_ICMP_TYPE];
 880               next[0] = NAT_NEXT_DROP;
 881               goto trace0;
 882             }
 883           int err = nat_get_icmp_session_lookup_values (
 884             b0, ip0, &lookup.saddr, &lookup.sport, &lookup.daddr,
 885             &lookup.dport, &lookup.proto);
 886           if (err != 0)
 887             {
 888               b0->error = node->errors[err];
 889               next[0] = NAT_NEXT_DROP;
 890               goto trace0;
 891             }
 892         }
 893       else
 894         {
 895           lookup.saddr.as_u32 = ip0->src_address.as_u32;
 896           lookup.daddr.as_u32 = ip0->dst_address.as_u32;
 897           lookup.proto = ip0->protocol;
 898         }
 899
 900       /* there might be a stashed index in vnet_buffer2 from handoff or
 901        * classify node, see if it can be used */
 902       if (is_multi_worker &&
 903           !pool_is_free_index (tsm->sessions,
 904                                vnet_buffer2 (b0)->nat.cached_session_index))
 905         {
 906           s0 = pool_elt_at_index (tsm->sessions,
 907                                   vnet_buffer2 (b0)->nat.cached_session_index);
 908           if (PREDICT_TRUE (nat_6t_t_eq (&s0->o2i.match, &lookup)) ||
 909               (s0->flags & SNAT_SESSION_FLAG_TWICE_NAT &&
 910                nat_6t_t_eq (&s0->i2o.match, &lookup)))
 911             {
 912               /* yes, this is the droid we're looking for */
 913               lookup_skipped = 1;
 914               goto skip_lookup;
 915             }
 916           s0 = NULL;
 917         }
 918
 919       init_ed_k (&kv0, lookup.saddr, lookup.sport, lookup.daddr, lookup.dport,
 920                  lookup.fib_index, lookup.proto);
 921
 922       // lookup flow
 923       if (clib_bihash_search_16_8 (&sm->flow_hash, &kv0, &value0))
 924         {
 925           // flow does not exist go slow path
 926           slow_path_reason = NAT_ED_SP_REASON_LOOKUP_FAILED;
 927           next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 928           goto trace0;
 929         }
 930       ASSERT (thread_index == ed_value_get_thread_index (&value0));
 931       s0 =
 932         pool_elt_at_index (tsm->sessions,
 933                            ed_value_get_session_index (&value0));
 934     skip_lookup:
 935
 936       if (PREDICT_FALSE (per_vrf_sessions_is_expired (s0, thread_index)))
 937         {
 938           // session is closed, go slow path
 939           nat_free_session_data (sm, s0, thread_index, 0);
 940           nat_ed_session_delete (sm, s0, thread_index, 1);
 941           slow_path_reason = NAT_ED_SP_REASON_VRF_EXPIRED;
 942           next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 943           goto trace0;
 944         }
 945
 946       if (s0->tcp_closed_timestamp)
 947         {
 948           if (now >= s0->tcp_closed_timestamp)
 949             {
 950               // session is closed, go slow path, freed in slow path
 951               slow_path_reason = NAT_ED_SP_TCP_CLOSED;
 952               next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 953             }
 954           else
 955             {
 956               // session in transitory timeout, drop
 957               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_TCP_CLOSED];
 958               next[0] = NAT_NEXT_DROP;
 959             }
 960           goto trace0;
 961         }
 962
 963       // drop if session expired
 964       u64 sess_timeout_time;
 965       sess_timeout_time =
 966         s0->last_heard + (f64) nat44_session_get_timeout (sm, s0);
 967       if (now >= sess_timeout_time)
 968         {
 969           // session is closed, go slow path
 970           nat_free_session_data (sm, s0, thread_index, 0);
 971           nat_ed_session_delete (sm, s0, thread_index, 1);
 972           slow_path_reason = NAT_ED_SP_SESS_EXPIRED;
 973           next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 974           goto trace0;
 975         }
 976
 977       if (nat_6t_t_eq (&s0->o2i.match, &lookup))
 978         {
 979           f = &s0->o2i;
 980         }
 981       else if (s0->flags & SNAT_SESSION_FLAG_TWICE_NAT &&
 982                nat_6t_t_eq (&s0->i2o.match, &lookup))
 983         {
 984           f = &s0->i2o;
 985         }
 986       else
 987         {
 988           /*
 989            * Send DHCP packets to the ipv4 stack, or we won't
 990            * be able to use dhcp client on the outside interface
 991            */
 992           if (PREDICT_FALSE (
 993                 proto0 == NAT_PROTOCOL_UDP &&
 994                 (vnet_buffer (b0)->ip.reass.l4_dst_port ==
 995                  clib_host_to_net_u16 (UDP_DST_PORT_dhcp_to_client))))
 996             {
 997               goto trace0;
 998             }
 999
1000           if (!sm->forwarding_enabled)
1001             {
1002               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
1003               next[0] = NAT_NEXT_DROP;
1004               goto trace0;
1005             }
1006           else
1007             {
1008               if (nat_6t_t_eq (&s0->i2o.match, &lookup))
1009                 {
1010                   f = &s0->i2o;
1011                 }
1012               else
1013                 {
1014                   // FIXME TODO bypass ???
1015                   //  create_bypass_for_fwd (sm, b0, s0, ip0, rx_fib_index0,
1016                   //                       thread_index);
1017                   translation_error = NAT_ED_TRNSL_ERR_FLOW_MISMATCH;
1018                   nat_free_session_data (sm, s0, thread_index, 0);
1019                   nat_ed_session_delete (sm, s0, thread_index, 1);
1020                   next[0] = NAT_NEXT_DROP;
1021                   goto trace0;
1022                 }
1023             }
1024         }
1025
1026       if (NAT_ED_TRNSL_ERR_SUCCESS !=
1027           (translation_error = nat_6t_flow_buf_translate (
1028              sm, b0, ip0, f, proto0, 0 /* is_output_feature */)))
1029         {
1030           next[0] = NAT_NEXT_DROP;
1031           goto trace0;
1032         }
1033
1034       switch (proto0)
1035         {
1036         case NAT_PROTOCOL_TCP:
1037           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.tcp,
1038                                          thread_index, sw_if_index0, 1);
1039           nat44_set_tcp_session_state_o2i (sm, now, s0,
1040                                            vnet_buffer (b0)->ip.
1041                                            reass.icmp_type_or_tcp_flags,
1042                                            vnet_buffer (b0)->ip.
1043                                            reass.tcp_ack_number,
1044                                            vnet_buffer (b0)->ip.
1045                                            reass.tcp_seq_number,
1046                                            thread_index);
1047           break;
1048         case NAT_PROTOCOL_UDP:
1049           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.udp,
1050                                          thread_index, sw_if_index0, 1);
1051           break;
1052         case NAT_PROTOCOL_ICMP:
1053           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.icmp,
1054                                          thread_index, sw_if_index0, 1);
1055           break;
1056         case NAT_PROTOCOL_OTHER:
1057           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.other,
1058                                          thread_index, sw_if_index0, 1);
1059           break;
1060         }
1061
1062       /* Accounting */
1063       nat44_session_update_counters (s0, now,
1064                                      vlib_buffer_length_in_chain (vm, b0),
1065                                      thread_index);
1066       /* Per-user LRU list maintenance */
1067       nat44_session_update_lru (sm, s0, thread_index);
1068
1069     trace0:
1070       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
1071                          && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1072         {
1073           nat44_ed_out2in_trace_t *t =
1074             vlib_add_trace (vm, node, b0, sizeof (*t));
1075           t->sw_if_index = sw_if_index0;
1076           t->next_index = next[0];
1077           t->is_slow_path = 0;
1078           t->translation_error = translation_error;
1079           clib_memcpy (&t->search_key, &kv0, sizeof (t->search_key));
1080           t->lookup_skipped = lookup_skipped;
1081           t->slow_path_reason = slow_path_reason;
1082
1083           if (s0)
1084             {
1085               t->session_index = s0 - tsm->sessions;
1086               clib_memcpy (&t->i2of, &s0->i2o, sizeof (t->i2of));
1087               clib_memcpy (&t->o2if, &s0->o2i, sizeof (t->o2if));
1088               t->translation_via_i2of = (&s0->i2o == f);
1089             }
1090           else
1091             {
1092               t->session_index = ~0;
1093             }
1094         }
1095
1096       if (next[0] == NAT_NEXT_DROP)
1097         {
1098           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.drops,
1099                                          thread_index, sw_if_index0, 1);
1100         }
1101
1102       n_left_from--;
1103       next++;
1104     }
1105
1106   vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
1107                                frame->n_vectors);
1108   return frame->n_vectors;
1109 }
1110
1111 static inline uword
1112 nat44_ed_out2in_slow_path_node_fn_inline (vlib_main_t * vm,
1113                                           vlib_node_runtime_t * node,
1114                                           vlib_frame_t * frame)
1115 {
1116   u32 n_left_from, *from;
1117   snat_main_t *sm = &snat_main;
1118   f64 now = vlib_time_now (vm);
1119   u32 thread_index = vm->thread_index;
1120   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
1121   snat_static_mapping_t *m;
1122
1123   from = vlib_frame_vector_args (frame);
1124   n_left_from = frame->n_vectors;
1125
1126   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
1127   u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
1128   vlib_get_buffers (vm, from, b, n_left_from);
1129
1130   while (n_left_from > 0)
1131     {
1132       vlib_buffer_t *b0;
1133       u32 sw_if_index0, rx_fib_index0;
1134       nat_protocol_t proto0;
1135       ip4_header_t *ip0;
1136       udp_header_t *udp0;
1137       icmp46_header_t *icmp0;
1138       snat_session_t *s0 = 0;
1139       clib_bihash_kv_16_8_t kv0, value0;
1140       lb_nat_type_t lb_nat0;
1141       twice_nat_type_t twice_nat0;
1142       u8 identity_nat0;
1143       ip4_address_t sm_addr;
1144       u16 sm_port;
1145       u32 sm_fib_index;
1146       nat_translation_error_e translation_error = NAT_ED_TRNSL_ERR_SUCCESS;
1147
1148       b0 = *b;
1149       next[0] = vnet_buffer2 (b0)->nat.arc_next;
1150
1151       vnet_buffer (b0)->snat.flags = 0;
1152       ip0 = vlib_buffer_get_current (b0);
1153
1154       sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
1155       rx_fib_index0 =
1156         fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index0);
1157
1158       if (PREDICT_FALSE (ip0->ttl == 1))
1159         {
1160           vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
1161           icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
1162                                        ICMP4_time_exceeded_ttl_exceeded_in_transit,
1163                                        0);
1164           next[0] = NAT_NEXT_ICMP_ERROR;
1165           goto trace0;
1166         }
1167
1168       udp0 = ip4_next_header (ip0);
1169       icmp0 = (icmp46_header_t *) udp0;
1170       proto0 = ip_proto_to_nat_proto (ip0->protocol);
1171
1172       if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_OTHER))
1173         {
1174           s0 = nat44_ed_out2in_slowpath_unknown_proto (
1175             sm, b0, ip0, rx_fib_index0, thread_index, now, vm, node);
1176           if (!sm->forwarding_enabled)
1177             {
1178               if (!s0)
1179                 next[0] = NAT_NEXT_DROP;
1180             }
1181           if (NAT_NEXT_DROP != next[0] &&
1182               NAT_ED_TRNSL_ERR_SUCCESS !=
1183                 (translation_error = nat_6t_flow_buf_translate (
1184                    sm, b0, ip0, &s0->o2i, proto0, 0 /* is_output_feature */)))
1185             {
1186               goto trace0;
1187             }
1188
1189           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.other,
1190                                          thread_index, sw_if_index0, 1);
1191           goto trace0;
1192         }
1193
1194       if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
1195         {
1196           next[0] = icmp_out2in_ed_slow_path
1197             (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
1198              next[0], now, thread_index, &s0);
1199
1200           if (NAT_NEXT_DROP != next[0] && s0 &&
1201               NAT_ED_TRNSL_ERR_SUCCESS !=
1202                 (translation_error = nat_6t_flow_buf_translate (
1203                    sm, b0, ip0, &s0->o2i, proto0, 0 /* is_output_feature */)))
1204             {
1205               goto trace0;
1206             }
1207
1208           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.icmp,
1209                                          thread_index, sw_if_index0, 1);
1210           goto trace0;
1211         }
1212
1213       init_ed_k (&kv0, ip0->src_address,
1214                  vnet_buffer (b0)->ip.reass.l4_src_port, ip0->dst_address,
1215                  vnet_buffer (b0)->ip.reass.l4_dst_port, rx_fib_index0,
1216                  ip0->protocol);
1217
1218       s0 = NULL;
1219       if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv0, &value0))
1220         {
1221           ASSERT (thread_index == ed_value_get_thread_index (&value0));
1222           s0 =
1223             pool_elt_at_index (tsm->sessions,
1224                                ed_value_get_session_index (&value0));
1225
1226           if (s0->tcp_closed_timestamp && now >= s0->tcp_closed_timestamp)
1227             {
1228               nat_free_session_data (sm, s0, thread_index, 0);
1229               nat_ed_session_delete (sm, s0, thread_index, 1);
1230               s0 = NULL;
1231             }
1232         }
1233
1234       if (!s0)
1235         {
1236           /* Try to match static mapping by external address and port,
1237              destination address and port in packet */
1238
1239           if (snat_static_mapping_match (
1240                 vm, sm, ip0->dst_address,
1241                 vnet_buffer (b0)->ip.reass.l4_dst_port, rx_fib_index0, proto0,
1242                 &sm_addr, &sm_port, &sm_fib_index, 1, 0, &twice_nat0, &lb_nat0,
1243                 &ip0->src_address, &identity_nat0, &m))
1244             {
1245               /*
1246                * Send DHCP packets to the ipv4 stack, or we won't
1247                * be able to use dhcp client on the outside interface
1248                */
1249               if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_UDP
1250                                  && (vnet_buffer (b0)->ip.reass.l4_dst_port ==
1251                                      clib_host_to_net_u16
1252                                      (UDP_DST_PORT_dhcp_to_client))))
1253                 {
1254                   goto trace0;
1255                 }
1256
1257               if (!sm->forwarding_enabled)
1258                 {
1259                   b0->error =
1260                     node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
1261                   next[0] = NAT_NEXT_DROP;
1262                 }
1263               else
1264                 {
1265                   if (next_src_nat
1266                       (sm, ip0, vnet_buffer (b0)->ip.reass.l4_src_port,
1267                        vnet_buffer (b0)->ip.reass.l4_dst_port,
1268                        thread_index, rx_fib_index0))
1269                     {
1270                       next[0] = NAT_NEXT_IN2OUT_ED_FAST_PATH;
1271                     }
1272                   else
1273                     {
1274                       create_bypass_for_fwd (sm, b0, s0, ip0, rx_fib_index0,
1275                                              thread_index);
1276                     }
1277                 }
1278               goto trace0;
1279             }
1280
1281           if (PREDICT_FALSE (identity_nat0))
1282             goto trace0;
1283
1284           if ((proto0 == NAT_PROTOCOL_TCP)
1285               && !tcp_flags_is_init (vnet_buffer (b0)->ip.
1286                                      reass.icmp_type_or_tcp_flags))
1287             {
1288               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
1289               next[0] = NAT_NEXT_DROP;
1290               goto trace0;
1291             }
1292
1293           /* Create session initiated by host from external network */
1294           s0 = create_session_for_static_mapping_ed (sm, b0,
1295                                                      sm_addr, sm_port,
1296                                                      sm_fib_index,
1297                                                      ip0->dst_address,
1298                                                      vnet_buffer (b0)->
1299                                                      ip.reass.l4_dst_port,
1300                                                      rx_fib_index0, proto0,
1301                                                      node, rx_fib_index0,
1302                                                      thread_index, twice_nat0,
1303                                                      lb_nat0, now, m);
1304           if (!s0)
1305             {
1306               next[0] = NAT_NEXT_DROP;
1307               goto trace0;
1308             }
1309         }
1310
1311       if (NAT_ED_TRNSL_ERR_SUCCESS !=
1312           (translation_error = nat_6t_flow_buf_translate (
1313              sm, b0, ip0, &s0->o2i, proto0, 0 /* is_output_feature */)))
1314         {
1315           next[0] = NAT_NEXT_DROP;
1316           goto trace0;
1317         }
1318
1319       if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
1320         {
1321           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.tcp,
1322                                          thread_index, sw_if_index0, 1);
1323           nat44_set_tcp_session_state_o2i (sm, now, s0,
1324                                            vnet_buffer (b0)->ip.
1325                                            reass.icmp_type_or_tcp_flags,
1326                                            vnet_buffer (b0)->ip.
1327                                            reass.tcp_ack_number,
1328                                            vnet_buffer (b0)->ip.
1329                                            reass.tcp_seq_number,
1330                                            thread_index);
1331         }
1332       else
1333         {
1334           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.udp,
1335                                          thread_index, sw_if_index0, 1);
1336         }
1337
1338       /* Accounting */
1339       nat44_session_update_counters (s0, now,
1340                                      vlib_buffer_length_in_chain (vm, b0),
1341                                      thread_index);
1342       /* Per-user LRU list maintenance */
1343       nat44_session_update_lru (sm, s0, thread_index);
1344
1345     trace0:
1346       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
1347                          && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1348         {
1349           nat44_ed_out2in_trace_t *t =
1350             vlib_add_trace (vm, node, b0, sizeof (*t));
1351           t->sw_if_index = sw_if_index0;
1352           t->next_index = next[0];
1353           t->is_slow_path = 1;
1354           t->translation_error = translation_error;
1355           clib_memcpy (&t->search_key, &kv0, sizeof (t->search_key));
1356
1357           if (s0)
1358             {
1359               t->session_index = s0 - tsm->sessions;
1360               clib_memcpy (&t->i2of, &s0->i2o, sizeof (t->i2of));
1361               clib_memcpy (&t->o2if, &s0->o2i, sizeof (t->o2if));
1362             }
1363           else
1364             {
1365               t->session_index = ~0;
1366             }
1367         }
1368
1369       if (next[0] == NAT_NEXT_DROP)
1370         {
1371           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.drops,
1372                                          thread_index, sw_if_index0, 1);
1373         }
1374
1375       n_left_from--;
1376       next++;
1377       b++;
1378     }
1379
1380   vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
1381                                frame->n_vectors);
1382
1383   return frame->n_vectors;
1384 }
1385
1386 VLIB_NODE_FN (nat44_ed_out2in_node) (vlib_main_t * vm,
1387                                      vlib_node_runtime_t * node,
1388                                      vlib_frame_t * frame)
1389 {
1390   if (snat_main.num_workers > 1)
1391     {
1392       return nat44_ed_out2in_fast_path_node_fn_inline (vm, node, frame, 1);
1393     }
1394   else
1395     {
1396       return nat44_ed_out2in_fast_path_node_fn_inline (vm, node, frame, 0);
1397     }
1398 }
1399
1400 /* *INDENT-OFF* */
1401 VLIB_REGISTER_NODE (nat44_ed_out2in_node) = {
1402   .name = "nat44-ed-out2in",
1403   .vector_size = sizeof (u32),
1404   .sibling_of = "nat-default",
1405   .format_trace = format_nat44_ed_out2in_trace,
1406   .type = VLIB_NODE_TYPE_INTERNAL,
1407   .n_errors = ARRAY_LEN(nat_out2in_ed_error_strings),
1408   .error_strings = nat_out2in_ed_error_strings,
1409   .runtime_data_bytes = sizeof (snat_runtime_t),
1410 };
1411 /* *INDENT-ON* */
1412
1413 VLIB_NODE_FN (nat44_ed_out2in_slowpath_node) (vlib_main_t * vm,
1414                                               vlib_node_runtime_t * node,
1415                                               vlib_frame_t * frame)
1416 {
1417   return nat44_ed_out2in_slow_path_node_fn_inline (vm, node, frame);
1418 }
1419
1420 /* *INDENT-OFF* */
1421 VLIB_REGISTER_NODE (nat44_ed_out2in_slowpath_node) = {
1422   .name = "nat44-ed-out2in-slowpath",
1423   .vector_size = sizeof (u32),
1424   .sibling_of = "nat-default",
1425   .format_trace = format_nat44_ed_out2in_trace,
1426   .type = VLIB_NODE_TYPE_INTERNAL,
1427   .n_errors = ARRAY_LEN(nat_out2in_ed_error_strings),
1428   .error_strings = nat_out2in_ed_error_strings,
1429   .runtime_data_bytes = sizeof (snat_runtime_t),
1430 };
1431 /* *INDENT-ON* */
1432
1433 static u8 *
1434 format_nat_pre_trace (u8 * s, va_list * args)
1435 {
1436   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1437   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1438   nat_pre_trace_t *t = va_arg (*args, nat_pre_trace_t *);
1439   return format (s, "out2in next_index %d arc_next_index %d", t->next_index,
1440                  t->arc_next_index);
1441 }
1442
1443 VLIB_NODE_FN (nat_pre_out2in_node) (vlib_main_t * vm,
1444                                     vlib_node_runtime_t * node,
1445                                     vlib_frame_t * frame)
1446 {
1447   return nat_pre_node_fn_inline (vm, node, frame,
1448                                  NAT_NEXT_OUT2IN_ED_FAST_PATH);
1449 }
1450
1451 /* *INDENT-OFF* */
1452 VLIB_REGISTER_NODE (nat_pre_out2in_node) = {
1453   .name = "nat-pre-out2in",
1454   .vector_size = sizeof (u32),
1455   .sibling_of = "nat-default",
1456   .format_trace = format_nat_pre_trace,
1457   .type = VLIB_NODE_TYPE_INTERNAL,
1458   .n_errors = 0,
1459  };
1460 /* *INDENT-ON* */
1461
1462 /*
1463  * fd.io coding-style-patch-verification: ON
1464  *
1465  * Local Variables:
1466  * eval: (c-set-style "gnu")
1467  * End:
1468  */