src/plugins/nat/nat44-ed/nat44_ed_out2in.c

   1 /*
   2  * Copyright (c) 2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 /**
  16  * @file
  17  * @brief NAT44 endpoint-dependent outside to inside network translation
  18  */
  19
  20 #include <vlib/vlib.h>
  21 #include <vnet/vnet.h>
  22 #include <vnet/ip/ip.h>
  23 #include <vnet/ethernet/ethernet.h>
  24 #include <vnet/fib/ip4_fib.h>
  25 #include <vnet/udp/udp_local.h>
  26 #include <vppinfra/error.h>
  27
  28 #include <nat/lib/nat_syslog.h>
  29 #include <nat/lib/ipfix_logging.h>
  30
  31 #include <nat/nat44-ed/nat44_ed.h>
  32 #include <nat/nat44-ed/nat44_ed_inlines.h>
  33
  34 static char *nat_out2in_ed_error_strings[] = {
  35 #define _(sym,string) string,
  36   foreach_nat_out2in_ed_error
  37 #undef _
  38 };
  39
  40 typedef enum
  41 {
  42   NAT_ED_SP_REASON_NO_REASON,
  43   NAT_ED_SP_REASON_LOOKUP_FAILED,
  44   NAT_ED_SP_REASON_VRF_EXPIRED,
  45   NAT_ED_SP_TCP_CLOSED,
  46   NAT_ED_SP_SESS_EXPIRED,
  47 } nat_slow_path_reason_e;
  48
  49 typedef struct
  50 {
  51   u32 sw_if_index;
  52   u32 next_index;
  53   u32 session_index;
  54   nat_translation_error_e translation_error;
  55   nat_6t_flow_t i2of;
  56   nat_6t_flow_t o2if;
  57   clib_bihash_kv_16_8_t search_key;
  58   u8 is_slow_path;
  59   u8 translation_via_i2of;
  60   u8 lookup_skipped;
  61   nat_slow_path_reason_e slow_path_reason;
  62 } nat44_ed_out2in_trace_t;
  63
  64 static u8 *
  65 format_slow_path_reason (u8 *s, va_list *args)
  66 {
  67   nat_slow_path_reason_e reason = va_arg (*args, nat_slow_path_reason_e);
  68   switch (reason)
  69     {
  70     case NAT_ED_SP_REASON_NO_REASON:
  71       return format (s, "no reason for slow path");
  72     case NAT_ED_SP_REASON_LOOKUP_FAILED:
  73       return format (s, "slow path because lookup failed");
  74     case NAT_ED_SP_REASON_VRF_EXPIRED:
  75       return format (s, "slow path because vrf expired");
  76     case NAT_ED_SP_TCP_CLOSED:
  77       return format (s, "slow path because tcp closed");
  78     case NAT_ED_SP_SESS_EXPIRED:
  79       return format (s, "slow path because session expired");
  80     }
  81   return format (s, "invalid reason value");
  82 }
  83
  84 static u8 *
  85 format_nat44_ed_out2in_trace (u8 * s, va_list * args)
  86 {
  87   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  88   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  89   nat44_ed_out2in_trace_t *t = va_arg (*args, nat44_ed_out2in_trace_t *);
  90   char *tag;
  91
  92   tag =
  93     t->is_slow_path ? "NAT44_OUT2IN_ED_SLOW_PATH" :
  94     "NAT44_OUT2IN_ED_FAST_PATH";
  95
  96   s = format (s, "%s: sw_if_index %d, next index %d", tag, t->sw_if_index,
  97               t->next_index);
  98   if (~0 != t->session_index)
  99     {
 100       s = format (s, ", session %d, translation result '%U' via %s",
 101                   t->session_index, format_nat_ed_translation_error,
 102                   t->translation_error,
 103                   t->translation_via_i2of ? "i2of" : "o2if");
 104       s = format (s, "\n  i2of %U", format_nat_6t_flow, &t->i2of);
 105       s = format (s, "\n  o2if %U", format_nat_6t_flow, &t->o2if);
 106     }
 107   if (!t->is_slow_path)
 108     {
 109       if (t->lookup_skipped)
 110         {
 111           s = format (s, "\n lookup skipped - cached session index used");
 112         }
 113       else
 114         {
 115           s = format (s, "\n  search key %U", format_ed_session_kvp,
 116                       &t->search_key);
 117         }
 118       s = format (s, "\n %U", format_slow_path_reason, t->slow_path_reason);
 119     }
 120
 121   return s;
 122 }
 123
 124 static int
 125 next_src_nat (snat_main_t *sm, ip4_header_t *ip, u16 src_port, u16 dst_port,
 126               u32 thread_index, u32 rx_fib_index)
 127 {
 128   clib_bihash_kv_16_8_t kv, value;
 129
 130   init_ed_k (&kv, ip->src_address, src_port, ip->dst_address, dst_port,
 131              rx_fib_index, ip->protocol);
 132   if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv, &value))
 133     return 1;
 134
 135   return 0;
 136 }
 137
 138 static void create_bypass_for_fwd (snat_main_t *sm, vlib_buffer_t *b,
 139                                    snat_session_t *s, ip4_header_t *ip,
 140                                    u32 rx_fib_index, u32 thread_index);
 141
 142 static snat_session_t *create_session_for_static_mapping_ed (
 143   snat_main_t *sm, vlib_buffer_t *b, ip4_address_t i2o_addr, u16 i2o_port,
 144   u32 i2o_fib_index, ip4_address_t o2i_addr, u16 o2i_port, u32 o2i_fib_index,
 145   nat_protocol_t nat_proto, vlib_node_runtime_t *node, u32 rx_fib_index,
 146   u32 thread_index, twice_nat_type_t twice_nat, lb_nat_type_t lb_nat, f64 now,
 147   snat_static_mapping_t *mapping);
 148
 149 static inline u32
 150 icmp_out2in_ed_slow_path (snat_main_t *sm, vlib_buffer_t *b, ip4_header_t *ip,
 151                           icmp46_header_t *icmp, u32 sw_if_index,
 152                           u32 rx_fib_index, vlib_node_runtime_t *node,
 153                           u32 next, f64 now, u32 thread_index,
 154                           snat_session_t **s_p)
 155 {
 156   vlib_main_t *vm = vlib_get_main ();
 157
 158   ip_csum_t sum;
 159   u16 checksum;
 160
 161   snat_session_t *s = 0;
 162   u8 is_addr_only, identity_nat;
 163   ip4_address_t sm_addr;
 164   u16 sm_port;
 165   u32 sm_fib_index;
 166   snat_static_mapping_t *m;
 167   u8 lookup_protocol;
 168   ip4_address_t lookup_saddr, lookup_daddr;
 169   u16 lookup_sport, lookup_dport;
 170
 171   sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_RX];
 172   rx_fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 173
 174   if (nat_get_icmp_session_lookup_values (b, ip, &lookup_saddr, &lookup_sport,
 175                                           &lookup_daddr, &lookup_dport,
 176                                           &lookup_protocol))
 177     {
 178       b->error = node->errors[NAT_OUT2IN_ED_ERROR_UNSUPPORTED_PROTOCOL];
 179       next = NAT_NEXT_DROP;
 180       goto out;
 181     }
 182
 183   if (snat_static_mapping_match (
 184         vm, sm, ip->dst_address, lookup_sport, rx_fib_index,
 185         ip_proto_to_nat_proto (ip->protocol), &sm_addr, &sm_port,
 186         &sm_fib_index, 1, &is_addr_only, 0, 0, 0, &identity_nat, &m))
 187     {
 188       // static mapping not matched
 189       if (!sm->forwarding_enabled)
 190         {
 191           /* Don't NAT packet aimed at the intfc address */
 192           if (!is_interface_addr (sm, node, sw_if_index,
 193                                   ip->dst_address.as_u32))
 194             {
 195               b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
 196               next = NAT_NEXT_DROP;
 197             }
 198         }
 199       else
 200         {
 201           if (next_src_nat (sm, ip, lookup_sport, lookup_dport, thread_index,
 202                             rx_fib_index))
 203             {
 204               next = NAT_NEXT_IN2OUT_ED_FAST_PATH;
 205             }
 206           else
 207             {
 208               create_bypass_for_fwd (sm, b, s, ip, rx_fib_index, thread_index);
 209             }
 210         }
 211       goto out;
 212     }
 213
 214   if (PREDICT_FALSE (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
 215                        ICMP4_echo_reply &&
 216                      (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags !=
 217                         ICMP4_echo_request ||
 218                       !is_addr_only)))
 219     {
 220       b->error = node->errors[NAT_OUT2IN_ED_ERROR_BAD_ICMP_TYPE];
 221       next = NAT_NEXT_DROP;
 222       goto out;
 223     }
 224
 225   if (PREDICT_FALSE (identity_nat))
 226     {
 227       goto out;
 228     }
 229
 230   /* Create session initiated by host from external network */
 231   s = create_session_for_static_mapping_ed (
 232     sm, b, sm_addr, sm_port, sm_fib_index, ip->dst_address, lookup_sport,
 233     rx_fib_index, ip_proto_to_nat_proto (lookup_protocol), node, rx_fib_index,
 234     thread_index, 0, 0, vlib_time_now (vm), m);
 235   if (!s)
 236     next = NAT_NEXT_DROP;
 237
 238   if (PREDICT_TRUE (!ip4_is_fragment (ip)))
 239     {
 240       sum = ip_incremental_checksum_buffer (
 241         vm, b, (u8 *) icmp - (u8 *) vlib_buffer_get_current (b),
 242         ntohs (ip->length) - ip4_header_bytes (ip), 0);
 243       checksum = ~ip_csum_fold (sum);
 244       if (checksum != 0 && checksum != 0xffff)
 245         {
 246           next = NAT_NEXT_DROP;
 247           goto out;
 248         }
 249     }
 250
 251   if (PREDICT_TRUE (next != NAT_NEXT_DROP && s))
 252     {
 253       /* Accounting */
 254       nat44_session_update_counters (
 255         s, now, vlib_buffer_length_in_chain (vm, b), thread_index);
 256       /* Per-user LRU list maintenance */
 257       nat44_session_update_lru (sm, s, thread_index);
 258     }
 259 out:
 260   if (NAT_NEXT_DROP == next && s)
 261     {
 262       nat_ed_session_delete (sm, s, thread_index, 1);
 263       s = 0;
 264     }
 265   *s_p = s;
 266   return next;
 267 }
 268
 269 // allocate exact address based on preference
 270 static_always_inline int
 271 nat_alloc_addr_and_port_exact (snat_address_t * a,
 272                                u32 thread_index,
 273                                nat_protocol_t proto,
 274                                ip4_address_t * addr,
 275                                u16 * port,
 276                                u16 port_per_thread, u32 snat_thread_index)
 277 {
 278   snat_main_t *sm = &snat_main;
 279   u32 portnum;
 280
 281   switch (proto)
 282     {
 283 #define _(N, j, n, s) \
 284     case NAT_PROTOCOL_##N: \
 285       if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
 286         { \
 287           while (1) \
 288             { \
 289               portnum = (port_per_thread * \
 290                 snat_thread_index) + \
 291                 snat_random_port(0, port_per_thread - 1) + 1024; \
 292               if (a->busy_##n##_port_refcounts[portnum]) \
 293                 continue; \
 294               --a->busy_##n##_port_refcounts[portnum]; \
 295               a->busy_##n##_ports_per_thread[thread_index]++; \
 296               a->busy_##n##_ports++; \
 297               *addr = a->addr; \
 298               *port = clib_host_to_net_u16(portnum); \
 299               return 0; \
 300             } \
 301         } \
 302       break;
 303       foreach_nat_protocol
 304 #undef _
 305         default : nat_elog_info (sm, "unknown protocol");
 306       return 1;
 307     }
 308
 309   /* Totally out of translations to use... */
 310   nat_ipfix_logging_addresses_exhausted (thread_index, 0);
 311   return 1;
 312 }
 313
 314 static_always_inline int
 315 nat44_ed_alloc_outside_addr_and_port (snat_address_t *addresses, u32 fib_index,
 316                                       u32 thread_index, nat_protocol_t proto,
 317                                       ip4_address_t *addr, u16 *port,
 318                                       u16 port_per_thread,
 319                                       u32 snat_thread_index)
 320 {
 321   snat_main_t *sm = &snat_main;
 322   snat_address_t *a, *ga = 0;
 323   u32 portnum;
 324   int i;
 325
 326   for (i = 0; i < vec_len (addresses); i++)
 327     {
 328       a = addresses + i;
 329       switch (proto)
 330         {
 331 #define _(N, j, n, s)                                                         \
 332   case NAT_PROTOCOL_##N:                                                      \
 333     if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread)       \
 334       {                                                                       \
 335         if (a->fib_index == fib_index)                                        \
 336           {                                                                   \
 337             while (1)                                                         \
 338               {                                                               \
 339                 portnum = (port_per_thread * snat_thread_index) +             \
 340                           snat_random_port (0, port_per_thread - 1) + 1024;   \
 341                 if (a->busy_##n##_port_refcounts[portnum])                    \
 342                   continue;                                                   \
 343                 --a->busy_##n##_port_refcounts[portnum];                      \
 344                 a->busy_##n##_ports_per_thread[thread_index]++;               \
 345                 a->busy_##n##_ports++;                                        \
 346                 *addr = a->addr;                                              \
 347                 *port = clib_host_to_net_u16 (portnum);                       \
 348                 return 0;                                                     \
 349               }                                                               \
 350           }                                                                   \
 351         else if (a->fib_index == ~0)                                          \
 352           {                                                                   \
 353             ga = a;                                                           \
 354           }                                                                   \
 355       }                                                                       \
 356     break;
 357           foreach_nat_protocol
 358 #undef _
 359             default : nat_elog_info (sm, "unknown protocol");
 360           return 1;
 361         }
 362     }
 363
 364   if (ga)
 365     {
 366       a = ga;
 367       switch (proto)
 368         {
 369 #define _(N, j, n, s)                                                         \
 370   case NAT_PROTOCOL_##N:                                                      \
 371     while (1)                                                                 \
 372       {                                                                       \
 373         portnum = (port_per_thread * snat_thread_index) +                     \
 374                   snat_random_port (0, port_per_thread - 1) + 1024;           \
 375         if (a->busy_##n##_port_refcounts[portnum])                            \
 376           continue;                                                           \
 377         ++a->busy_##n##_port_refcounts[portnum];                              \
 378         a->busy_##n##_ports_per_thread[thread_index]++;                       \
 379         a->busy_##n##_ports++;                                                \
 380         *addr = a->addr;                                                      \
 381         *port = clib_host_to_net_u16 (portnum);                               \
 382         return 0;                                                             \
 383       }
 384           break;
 385           foreach_nat_protocol
 386 #undef _
 387             default : nat_elog_info (sm, "unknown protocol");
 388           return 1;
 389         }
 390     }
 391
 392   /* Totally out of translations to use... */
 393   nat_ipfix_logging_addresses_exhausted (thread_index, 0);
 394   return 1;
 395 }
 396
 397 static snat_session_t *
 398 create_session_for_static_mapping_ed (
 399   snat_main_t *sm, vlib_buffer_t *b, ip4_address_t i2o_addr, u16 i2o_port,
 400   u32 i2o_fib_index, ip4_address_t o2i_addr, u16 o2i_port, u32 o2i_fib_index,
 401   nat_protocol_t nat_proto, vlib_node_runtime_t *node, u32 rx_fib_index,
 402   u32 thread_index, twice_nat_type_t twice_nat, lb_nat_type_t lb_nat, f64 now,
 403   snat_static_mapping_t *mapping)
 404 {
 405   snat_session_t *s;
 406   ip4_header_t *ip;
 407   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 408
 409   if (PREDICT_FALSE
 410       (nat44_ed_maximum_sessions_exceeded (sm, rx_fib_index, thread_index)))
 411     {
 412       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 413       nat_elog_notice (sm, "maximum sessions exceeded");
 414       return 0;
 415     }
 416
 417   s = nat_ed_session_alloc (sm, thread_index, now, nat_proto);
 418   if (!s)
 419     {
 420       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 421       nat_elog_warn (sm, "create NAT session failed");
 422       return 0;
 423     }
 424
 425   ip = vlib_buffer_get_current (b);
 426
 427   s->ext_host_addr.as_u32 = ip->src_address.as_u32;
 428   s->ext_host_port =
 429     nat_proto == NAT_PROTOCOL_ICMP ? 0 : vnet_buffer (b)->ip.reass.l4_src_port;
 430   s->flags |= SNAT_SESSION_FLAG_STATIC_MAPPING;
 431   if (lb_nat)
 432     s->flags |= SNAT_SESSION_FLAG_LOAD_BALANCING;
 433   if (lb_nat == AFFINITY_LB_NAT)
 434     s->flags |= SNAT_SESSION_FLAG_AFFINITY;
 435   s->out2in.addr = o2i_addr;
 436   s->out2in.port = o2i_port;
 437   s->out2in.fib_index = o2i_fib_index;
 438   s->in2out.addr = i2o_addr;
 439   s->in2out.port = i2o_port;
 440   s->in2out.fib_index = i2o_fib_index;
 441   s->nat_proto = nat_proto;
 442
 443   if (NAT_PROTOCOL_ICMP == nat_proto)
 444     {
 445       nat_6t_o2i_flow_init (sm, thread_index, s, s->ext_host_addr, o2i_port,
 446                             o2i_addr, o2i_port, o2i_fib_index, ip->protocol);
 447       nat_6t_flow_icmp_id_rewrite_set (&s->o2i, i2o_port);
 448     }
 449   else
 450     {
 451       nat_6t_o2i_flow_init (sm, thread_index, s, s->ext_host_addr,
 452                             s->ext_host_port, o2i_addr, o2i_port,
 453                             o2i_fib_index, ip->protocol);
 454       nat_6t_flow_dport_rewrite_set (&s->o2i, i2o_port);
 455     }
 456   nat_6t_flow_daddr_rewrite_set (&s->o2i, i2o_addr.as_u32);
 457   nat_6t_flow_txfib_rewrite_set (&s->o2i, i2o_fib_index);
 458
 459   if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 1))
 460     {
 461       b->error = node->errors[NAT_OUT2IN_ED_ERROR_HASH_ADD_FAILED];
 462       nat_ed_session_delete (sm, s, thread_index, 1);
 463       nat_elog_warn (sm, "out2in flow hash add failed");
 464       return 0;
 465     }
 466
 467   if (twice_nat == TWICE_NAT || (twice_nat == TWICE_NAT_SELF &&
 468                                  ip->src_address.as_u32 == i2o_addr.as_u32))
 469     {
 470       int rc = 0;
 471       snat_address_t *filter = 0;
 472
 473       // if exact address is specified use this address
 474       if (is_sm_exact_address (mapping->flags))
 475         {
 476           snat_address_t *ap;
 477           vec_foreach (ap, sm->twice_nat_addresses)
 478           {
 479             if (mapping->pool_addr.as_u32 == ap->addr.as_u32)
 480               {
 481                 filter = ap;
 482                 break;
 483               }
 484           }
 485         }
 486
 487       if (filter)
 488         {
 489           rc = nat_alloc_addr_and_port_exact (filter,
 490                                               thread_index,
 491                                               nat_proto,
 492                                               &s->ext_host_nat_addr,
 493                                               &s->ext_host_nat_port,
 494                                               sm->port_per_thread,
 495                                               tsm->snat_thread_index);
 496           s->flags |= SNAT_SESSION_FLAG_EXACT_ADDRESS;
 497         }
 498       else
 499         {
 500           rc = nat44_ed_alloc_outside_addr_and_port (
 501             sm->twice_nat_addresses, 0, thread_index, nat_proto,
 502             &s->ext_host_nat_addr, &s->ext_host_nat_port, sm->port_per_thread,
 503             tsm->snat_thread_index);
 504         }
 505
 506       if (rc)
 507         {
 508           b->error = node->errors[NAT_OUT2IN_ED_ERROR_OUT_OF_PORTS];
 509           if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 0))
 510             {
 511               nat_elog_warn (sm, "out2in flow hash del failed");
 512             }
 513           snat_free_outside_address_and_port (
 514             sm->twice_nat_addresses, thread_index, &s->ext_host_nat_addr,
 515             s->ext_host_nat_port, s->nat_proto);
 516           nat_ed_session_delete (sm, s, thread_index, 1);
 517           return 0;
 518         }
 519
 520       s->flags |= SNAT_SESSION_FLAG_TWICE_NAT;
 521
 522       nat_6t_flow_saddr_rewrite_set (&s->o2i, s->ext_host_nat_addr.as_u32);
 523       if (NAT_PROTOCOL_ICMP == nat_proto)
 524         {
 525           nat_6t_flow_icmp_id_rewrite_set (&s->o2i, s->ext_host_nat_port);
 526         }
 527       else
 528         {
 529           nat_6t_flow_sport_rewrite_set (&s->o2i, s->ext_host_nat_port);
 530         }
 531
 532       nat_6t_l3_l4_csum_calc (&s->o2i);
 533
 534       nat_6t_i2o_flow_init (sm, thread_index, s, i2o_addr, i2o_port,
 535                             s->ext_host_nat_addr, s->ext_host_nat_port,
 536                             i2o_fib_index, ip->protocol);
 537       nat_6t_flow_daddr_rewrite_set (&s->i2o, s->ext_host_addr.as_u32);
 538       if (NAT_PROTOCOL_ICMP == nat_proto)
 539         {
 540           nat_6t_flow_icmp_id_rewrite_set (&s->i2o, s->ext_host_port);
 541         }
 542       else
 543         {
 544           nat_6t_flow_dport_rewrite_set (&s->i2o, s->ext_host_port);
 545         }
 546     }
 547   else
 548     {
 549       if (NAT_PROTOCOL_ICMP == nat_proto)
 550         {
 551           nat_6t_i2o_flow_init (sm, thread_index, s, i2o_addr, i2o_port,
 552                                 s->ext_host_addr, i2o_port, i2o_fib_index,
 553                                 ip->protocol);
 554         }
 555       else
 556         {
 557           nat_6t_i2o_flow_init (sm, thread_index, s, i2o_addr, i2o_port,
 558                                 s->ext_host_addr, s->ext_host_port,
 559                                 i2o_fib_index, ip->protocol);
 560         }
 561     }
 562
 563   nat_6t_flow_saddr_rewrite_set (&s->i2o, o2i_addr.as_u32);
 564   if (NAT_PROTOCOL_ICMP == nat_proto)
 565     {
 566       nat_6t_flow_icmp_id_rewrite_set (&s->i2o, o2i_port);
 567     }
 568   else
 569     {
 570       nat_6t_flow_sport_rewrite_set (&s->i2o, o2i_port);
 571     }
 572
 573   if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, s, 1))
 574     {
 575       nat_elog_notice (sm, "in2out flow hash add failed");
 576       if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 0))
 577         {
 578           nat_elog_warn (sm, "out2in flow hash del failed");
 579         }
 580       nat_ed_session_delete (sm, s, thread_index, 1);
 581       return 0;
 582     }
 583
 584   nat_ipfix_logging_nat44_ses_create (thread_index,
 585                                       s->in2out.addr.as_u32,
 586                                       s->out2in.addr.as_u32,
 587                                       s->nat_proto,
 588                                       s->in2out.port,
 589                                       s->out2in.port, s->in2out.fib_index);
 590
 591   nat_syslog_nat44_sadd (0, s->in2out.fib_index, &s->in2out.addr,
 592                          s->in2out.port, &s->ext_host_nat_addr,
 593                          s->ext_host_nat_port, &s->out2in.addr, s->out2in.port,
 594                          &s->ext_host_addr, s->ext_host_port, s->nat_proto,
 595                          nat44_ed_is_twice_nat_session (s));
 596
 597   per_vrf_sessions_register_session (s, thread_index);
 598
 599   return s;
 600 }
 601
 602 static void
 603 create_bypass_for_fwd (snat_main_t *sm, vlib_buffer_t *b, snat_session_t *s,
 604                        ip4_header_t *ip, u32 rx_fib_index, u32 thread_index)
 605 {
 606   clib_bihash_kv_16_8_t kv, value;
 607   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 608   vlib_main_t *vm = vlib_get_main ();
 609   f64 now = vlib_time_now (vm);
 610   u16 lookup_sport, lookup_dport;
 611   u8 lookup_protocol;
 612   ip4_address_t lookup_saddr, lookup_daddr;
 613
 614   if (ip->protocol == IP_PROTOCOL_ICMP)
 615     {
 616       if (nat_get_icmp_session_lookup_values (b, ip, &lookup_daddr,
 617                                               &lookup_sport, &lookup_saddr,
 618                                               &lookup_dport, &lookup_protocol))
 619         return;
 620     }
 621   else
 622     {
 623       if (ip->protocol == IP_PROTOCOL_UDP || ip->protocol == IP_PROTOCOL_TCP)
 624         {
 625           lookup_sport = vnet_buffer (b)->ip.reass.l4_dst_port;
 626           lookup_dport = vnet_buffer (b)->ip.reass.l4_src_port;
 627         }
 628       else
 629         {
 630           lookup_sport = 0;
 631           lookup_dport = 0;
 632         }
 633       lookup_saddr.as_u32 = ip->dst_address.as_u32;
 634       lookup_daddr.as_u32 = ip->src_address.as_u32;
 635       lookup_protocol = ip->protocol;
 636     }
 637
 638   init_ed_k (&kv, lookup_saddr, lookup_sport, lookup_daddr, lookup_dport,
 639              rx_fib_index, lookup_protocol);
 640
 641   if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv, &value))
 642     {
 643       ASSERT (thread_index == ed_value_get_thread_index (&value));
 644       s =
 645         pool_elt_at_index (tsm->sessions,
 646                            ed_value_get_session_index (&value));
 647     }
 648   else if (ip->protocol == IP_PROTOCOL_ICMP &&
 649            icmp_type_is_error_message
 650            (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags))
 651     {
 652       return;
 653     }
 654   else
 655     {
 656       u32 proto;
 657
 658       if (PREDICT_FALSE
 659           (nat44_ed_maximum_sessions_exceeded
 660            (sm, rx_fib_index, thread_index)))
 661         return;
 662
 663       s = nat_ed_session_alloc (sm, thread_index, now, ip->protocol);
 664       if (!s)
 665         {
 666           nat_elog_warn (sm, "create NAT session failed");
 667           return;
 668         }
 669
 670       proto = ip_proto_to_nat_proto (ip->protocol);
 671
 672       s->ext_host_addr = ip->src_address;
 673       s->ext_host_port = lookup_dport;
 674       s->flags |= SNAT_SESSION_FLAG_FWD_BYPASS;
 675       s->out2in.addr = ip->dst_address;
 676       s->out2in.port = lookup_sport;
 677       s->nat_proto = proto;
 678       if (proto == NAT_PROTOCOL_OTHER)
 679         {
 680           s->flags |= SNAT_SESSION_FLAG_UNKNOWN_PROTO;
 681           s->out2in.port = ip->protocol;
 682         }
 683       s->out2in.fib_index = rx_fib_index;
 684       s->in2out.addr = s->out2in.addr;
 685       s->in2out.port = s->out2in.port;
 686       s->in2out.fib_index = s->out2in.fib_index;
 687
 688       nat_6t_i2o_flow_init (sm, thread_index, s, ip->dst_address, lookup_sport,
 689                             ip->src_address, lookup_dport, rx_fib_index,
 690                             ip->protocol);
 691       nat_6t_flow_txfib_rewrite_set (&s->i2o, rx_fib_index);
 692       if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, s, 1))
 693         {
 694           nat_elog_notice (sm, "in2out flow add failed");
 695           nat_ed_session_delete (sm, s, thread_index, 1);
 696           return;
 697         }
 698
 699       per_vrf_sessions_register_session (s, thread_index);
 700     }
 701
 702   if (ip->protocol == IP_PROTOCOL_TCP)
 703     {
 704       tcp_header_t *tcp = ip4_next_header (ip);
 705       nat44_set_tcp_session_state_o2i (sm, now, s, tcp->flags,
 706                                        tcp->ack_number, tcp->seq_number,
 707                                        thread_index);
 708     }
 709
 710   /* Accounting */
 711   nat44_session_update_counters (s, now, 0, thread_index);
 712   /* Per-user LRU list maintenance */
 713   nat44_session_update_lru (sm, s, thread_index);
 714 }
 715
 716 static snat_session_t *
 717 nat44_ed_out2in_slowpath_unknown_proto (snat_main_t *sm, vlib_buffer_t *b,
 718                                         ip4_header_t *ip, u32 rx_fib_index,
 719                                         u32 thread_index, f64 now,
 720                                         vlib_main_t *vm,
 721                                         vlib_node_runtime_t *node)
 722 {
 723   clib_bihash_kv_8_8_t kv, value;
 724   snat_static_mapping_t *m;
 725   snat_session_t *s;
 726
 727   if (PREDICT_FALSE (
 728         nat44_ed_maximum_sessions_exceeded (sm, rx_fib_index, thread_index)))
 729     {
 730       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 731       nat_elog_notice (sm, "maximum sessions exceeded");
 732       return 0;
 733     }
 734
 735   init_nat_k (&kv, ip->dst_address, 0, 0, 0);
 736   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 737     {
 738       b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
 739       return 0;
 740     }
 741
 742   m = pool_elt_at_index (sm->static_mappings, value.value);
 743
 744   /* Create a new session */
 745   s = nat_ed_session_alloc (sm, thread_index, now, ip->protocol);
 746   if (!s)
 747     {
 748       b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
 749       nat_elog_warn (sm, "create NAT session failed");
 750       return 0;
 751     }
 752
 753   s->ext_host_addr.as_u32 = ip->src_address.as_u32;
 754   s->flags |= SNAT_SESSION_FLAG_UNKNOWN_PROTO;
 755   s->flags |= SNAT_SESSION_FLAG_STATIC_MAPPING;
 756   s->out2in.addr.as_u32 = ip->dst_address.as_u32;
 757   s->out2in.fib_index = rx_fib_index;
 758   s->in2out.addr.as_u32 = m->local_addr.as_u32;
 759   s->in2out.fib_index = m->fib_index;
 760   s->in2out.port = s->out2in.port = ip->protocol;
 761
 762   nat_6t_o2i_flow_init (sm, thread_index, s, ip->dst_address, 0,
 763                         ip->src_address, 0, m->fib_index, ip->protocol);
 764   nat_6t_flow_saddr_rewrite_set (&s->i2o, ip->dst_address.as_u32);
 765   if (nat_ed_ses_i2o_flow_hash_add_del (sm, thread_index, s, 1))
 766     {
 767       nat_elog_notice (sm, "in2out key add failed");
 768       nat_ed_session_delete (sm, s, thread_index, 1);
 769       return NULL;
 770     }
 771
 772   nat_6t_o2i_flow_init (sm, thread_index, s, ip->src_address, 0,
 773                         ip->dst_address, 0, rx_fib_index, ip->protocol);
 774   nat_6t_flow_daddr_rewrite_set (&s->o2i, m->local_addr.as_u32);
 775   nat_6t_flow_txfib_rewrite_set (&s->o2i, m->fib_index);
 776   if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 1))
 777     {
 778       nat_elog_notice (sm, "out2in flow hash add failed");
 779       nat_ed_session_delete (sm, s, thread_index, 1);
 780       return NULL;
 781     }
 782
 783   per_vrf_sessions_register_session (s, thread_index);
 784
 785   /* Accounting */
 786   nat44_session_update_counters (s, now, vlib_buffer_length_in_chain (vm, b),
 787                                  thread_index);
 788   /* Per-user LRU list maintenance */
 789   nat44_session_update_lru (sm, s, thread_index);
 790
 791   return s;
 792 }
 793
 794 static inline uword
 795 nat44_ed_out2in_fast_path_node_fn_inline (vlib_main_t * vm,
 796                                           vlib_node_runtime_t * node,
 797                                           vlib_frame_t * frame,
 798                                           int is_multi_worker)
 799 {
 800   u32 n_left_from, *from;
 801   snat_main_t *sm = &snat_main;
 802   f64 now = vlib_time_now (vm);
 803   u32 thread_index = vm->thread_index;
 804   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 805
 806   from = vlib_frame_vector_args (frame);
 807   n_left_from = frame->n_vectors;
 808
 809   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
 810   u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
 811   vlib_get_buffers (vm, from, b, n_left_from);
 812
 813   while (n_left_from > 0)
 814     {
 815       vlib_buffer_t *b0;
 816       u32 sw_if_index0, rx_fib_index0;
 817       nat_protocol_t proto0;
 818       ip4_header_t *ip0;
 819       snat_session_t *s0 = 0;
 820       clib_bihash_kv_16_8_t kv0, value0;
 821       nat_translation_error_e translation_error = NAT_ED_TRNSL_ERR_SUCCESS;
 822       nat_slow_path_reason_e slow_path_reason = NAT_ED_SP_REASON_NO_REASON;
 823       nat_6t_flow_t *f = 0;
 824       nat_6t_t lookup;
 825       int lookup_skipped = 0;
 826
 827       b0 = *b;
 828       b++;
 829
 830       /* Prefetch next iteration. */
 831       if (PREDICT_TRUE (n_left_from >= 2))
 832         {
 833           vlib_buffer_t *p2;
 834
 835           p2 = *b;
 836
 837           vlib_prefetch_buffer_header (p2, LOAD);
 838
 839           clib_prefetch_load (p2->data);
 840         }
 841
 842       next[0] = vnet_buffer2 (b0)->nat.arc_next;
 843
 844       lookup.sport = vnet_buffer (b0)->ip.reass.l4_src_port;
 845       lookup.dport = vnet_buffer (b0)->ip.reass.l4_dst_port;
 846
 847       vnet_buffer (b0)->snat.flags = 0;
 848       ip0 = vlib_buffer_get_current (b0);
 849
 850       sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 851       rx_fib_index0 =
 852         fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index0);
 853
 854       lookup.fib_index = rx_fib_index0;
 855
 856       if (PREDICT_FALSE (ip0->ttl == 1))
 857         {
 858           vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 859           icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
 860                                        ICMP4_time_exceeded_ttl_exceeded_in_transit,
 861                                        0);
 862           next[0] = NAT_NEXT_ICMP_ERROR;
 863           goto trace0;
 864         }
 865
 866       proto0 = ip_proto_to_nat_proto (ip0->protocol);
 867
 868       if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
 869         {
 870           if (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags !=
 871                 ICMP4_echo_request &&
 872               vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags !=
 873                 ICMP4_echo_reply &&
 874               !icmp_type_is_error_message (
 875                 vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
 876             {
 877               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_BAD_ICMP_TYPE];
 878               next[0] = NAT_NEXT_DROP;
 879               goto trace0;
 880             }
 881           int err = nat_get_icmp_session_lookup_values (
 882             b0, ip0, &lookup.saddr, &lookup.sport, &lookup.daddr,
 883             &lookup.dport, &lookup.proto);
 884           if (err != 0)
 885             {
 886               b0->error = node->errors[err];
 887               next[0] = NAT_NEXT_DROP;
 888               goto trace0;
 889             }
 890         }
 891       else
 892         {
 893           lookup.saddr.as_u32 = ip0->src_address.as_u32;
 894           lookup.daddr.as_u32 = ip0->dst_address.as_u32;
 895           lookup.proto = ip0->protocol;
 896         }
 897
 898       /* there might be a stashed index in vnet_buffer2 from handoff or
 899        * classify node, see if it can be used */
 900       if (is_multi_worker &&
 901           !pool_is_free_index (tsm->sessions,
 902                                vnet_buffer2 (b0)->nat.cached_session_index))
 903         {
 904           s0 = pool_elt_at_index (tsm->sessions,
 905                                   vnet_buffer2 (b0)->nat.cached_session_index);
 906           if (PREDICT_TRUE (nat_6t_t_eq (&s0->o2i.match, &lookup)) ||
 907               (s0->flags & SNAT_SESSION_FLAG_TWICE_NAT &&
 908                nat_6t_t_eq (&s0->i2o.match, &lookup)))
 909             {
 910               /* yes, this is the droid we're looking for */
 911               lookup_skipped = 1;
 912               goto skip_lookup;
 913             }
 914           s0 = NULL;
 915         }
 916
 917       init_ed_k (&kv0, lookup.saddr, lookup.sport, lookup.daddr, lookup.dport,
 918                  lookup.fib_index, lookup.proto);
 919
 920       // lookup flow
 921       if (clib_bihash_search_16_8 (&sm->flow_hash, &kv0, &value0))
 922         {
 923           // flow does not exist go slow path
 924           slow_path_reason = NAT_ED_SP_REASON_LOOKUP_FAILED;
 925           next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 926           goto trace0;
 927         }
 928       ASSERT (thread_index == ed_value_get_thread_index (&value0));
 929       s0 =
 930         pool_elt_at_index (tsm->sessions,
 931                            ed_value_get_session_index (&value0));
 932     skip_lookup:
 933
 934       ASSERT (thread_index == s0->thread_index);
 935
 936       if (PREDICT_FALSE (per_vrf_sessions_is_expired (s0, thread_index)))
 937         {
 938           // session is closed, go slow path
 939           nat_free_session_data (sm, s0, thread_index, 0);
 940           nat_ed_session_delete (sm, s0, thread_index, 1);
 941           slow_path_reason = NAT_ED_SP_REASON_VRF_EXPIRED;
 942           next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 943           goto trace0;
 944         }
 945
 946       if (s0->tcp_closed_timestamp)
 947         {
 948           if (now >= s0->tcp_closed_timestamp)
 949             {
 950               // session is closed, go slow path, freed in slow path
 951               slow_path_reason = NAT_ED_SP_TCP_CLOSED;
 952               next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 953             }
 954           else
 955             {
 956               // session in transitory timeout, drop
 957               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_TCP_CLOSED];
 958               next[0] = NAT_NEXT_DROP;
 959             }
 960           goto trace0;
 961         }
 962
 963       // drop if session expired
 964       u64 sess_timeout_time;
 965       sess_timeout_time =
 966         s0->last_heard + (f64) nat44_session_get_timeout (sm, s0);
 967       if (now >= sess_timeout_time)
 968         {
 969           // session is closed, go slow path
 970           nat_free_session_data (sm, s0, thread_index, 0);
 971           nat_ed_session_delete (sm, s0, thread_index, 1);
 972           slow_path_reason = NAT_ED_SP_SESS_EXPIRED;
 973           next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
 974           goto trace0;
 975         }
 976
 977       if (nat_6t_t_eq (&s0->o2i.match, &lookup))
 978         {
 979           f = &s0->o2i;
 980         }
 981       else if (s0->flags & SNAT_SESSION_FLAG_TWICE_NAT &&
 982                nat_6t_t_eq (&s0->i2o.match, &lookup))
 983         {
 984           f = &s0->i2o;
 985         }
 986       else
 987         {
 988           /*
 989            * Send DHCP packets to the ipv4 stack, or we won't
 990            * be able to use dhcp client on the outside interface
 991            */
 992           if (PREDICT_FALSE (
 993                 proto0 == NAT_PROTOCOL_UDP &&
 994                 (vnet_buffer (b0)->ip.reass.l4_dst_port ==
 995                  clib_host_to_net_u16 (UDP_DST_PORT_dhcp_to_client))))
 996             {
 997               goto trace0;
 998             }
 999
1000           if (!sm->forwarding_enabled)
1001             {
1002               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
1003               next[0] = NAT_NEXT_DROP;
1004               goto trace0;
1005             }
1006           else
1007             {
1008               if (nat_6t_t_eq (&s0->i2o.match, &lookup))
1009                 {
1010                   f = &s0->i2o;
1011                 }
1012               else
1013                 {
1014                   // FIXME TODO bypass ???
1015                   //  create_bypass_for_fwd (sm, b0, s0, ip0, rx_fib_index0,
1016                   //                       thread_index);
1017                   translation_error = NAT_ED_TRNSL_ERR_FLOW_MISMATCH;
1018                   nat_free_session_data (sm, s0, thread_index, 0);
1019                   nat_ed_session_delete (sm, s0, thread_index, 1);
1020                   next[0] = NAT_NEXT_DROP;
1021                   b0->error = node->errors[NAT_OUT2IN_ED_ERROR_TRNSL_FAILED];
1022                   goto trace0;
1023                 }
1024             }
1025         }
1026
1027       if (NAT_ED_TRNSL_ERR_SUCCESS !=
1028           (translation_error = nat_6t_flow_buf_translate_o2i (
1029              vm, sm, b0, ip0, f, proto0, 0 /* is_output_feature */)))
1030         {
1031           next[0] = NAT_NEXT_DROP;
1032           b0->error = node->errors[NAT_OUT2IN_ED_ERROR_TRNSL_FAILED];
1033           goto trace0;
1034         }
1035
1036       switch (proto0)
1037         {
1038         case NAT_PROTOCOL_TCP:
1039           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.tcp,
1040                                          thread_index, sw_if_index0, 1);
1041           nat44_set_tcp_session_state_o2i (sm, now, s0,
1042                                            vnet_buffer (b0)->ip.
1043                                            reass.icmp_type_or_tcp_flags,
1044                                            vnet_buffer (b0)->ip.
1045                                            reass.tcp_ack_number,
1046                                            vnet_buffer (b0)->ip.
1047                                            reass.tcp_seq_number,
1048                                            thread_index);
1049           break;
1050         case NAT_PROTOCOL_UDP:
1051           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.udp,
1052                                          thread_index, sw_if_index0, 1);
1053           break;
1054         case NAT_PROTOCOL_ICMP:
1055           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.icmp,
1056                                          thread_index, sw_if_index0, 1);
1057           break;
1058         case NAT_PROTOCOL_OTHER:
1059           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.other,
1060                                          thread_index, sw_if_index0, 1);
1061           break;
1062         }
1063
1064       /* Accounting */
1065       nat44_session_update_counters (s0, now,
1066                                      vlib_buffer_length_in_chain (vm, b0),
1067                                      thread_index);
1068       /* Per-user LRU list maintenance */
1069       nat44_session_update_lru (sm, s0, thread_index);
1070
1071     trace0:
1072       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
1073                          && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1074         {
1075           nat44_ed_out2in_trace_t *t =
1076             vlib_add_trace (vm, node, b0, sizeof (*t));
1077           t->sw_if_index = sw_if_index0;
1078           t->next_index = next[0];
1079           t->is_slow_path = 0;
1080           t->translation_error = translation_error;
1081           clib_memcpy (&t->search_key, &kv0, sizeof (t->search_key));
1082           t->lookup_skipped = lookup_skipped;
1083           t->slow_path_reason = slow_path_reason;
1084
1085           if (s0)
1086             {
1087               t->session_index = s0 - tsm->sessions;
1088               clib_memcpy (&t->i2of, &s0->i2o, sizeof (t->i2of));
1089               clib_memcpy (&t->o2if, &s0->o2i, sizeof (t->o2if));
1090               t->translation_via_i2of = (&s0->i2o == f);
1091             }
1092           else
1093             {
1094               t->session_index = ~0;
1095             }
1096         }
1097
1098       if (next[0] == NAT_NEXT_DROP)
1099         {
1100           vlib_increment_simple_counter (&sm->counters.fastpath.out2in.drops,
1101                                          thread_index, sw_if_index0, 1);
1102         }
1103
1104       n_left_from--;
1105       next++;
1106     }
1107
1108   vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
1109                                frame->n_vectors);
1110   return frame->n_vectors;
1111 }
1112
1113 static inline uword
1114 nat44_ed_out2in_slow_path_node_fn_inline (vlib_main_t * vm,
1115                                           vlib_node_runtime_t * node,
1116                                           vlib_frame_t * frame)
1117 {
1118   u32 n_left_from, *from;
1119   snat_main_t *sm = &snat_main;
1120   f64 now = vlib_time_now (vm);
1121   u32 thread_index = vm->thread_index;
1122   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
1123   snat_static_mapping_t *m;
1124
1125   from = vlib_frame_vector_args (frame);
1126   n_left_from = frame->n_vectors;
1127
1128   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
1129   u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
1130   vlib_get_buffers (vm, from, b, n_left_from);
1131
1132   while (n_left_from > 0)
1133     {
1134       vlib_buffer_t *b0;
1135       u32 sw_if_index0, rx_fib_index0;
1136       nat_protocol_t proto0;
1137       ip4_header_t *ip0;
1138       udp_header_t *udp0;
1139       icmp46_header_t *icmp0;
1140       snat_session_t *s0 = 0;
1141       clib_bihash_kv_16_8_t kv0, value0;
1142       lb_nat_type_t lb_nat0;
1143       twice_nat_type_t twice_nat0;
1144       u8 identity_nat0;
1145       ip4_address_t sm_addr;
1146       u16 sm_port;
1147       u32 sm_fib_index;
1148       nat_translation_error_e translation_error = NAT_ED_TRNSL_ERR_SUCCESS;
1149
1150       b0 = *b;
1151       next[0] = vnet_buffer2 (b0)->nat.arc_next;
1152
1153       vnet_buffer (b0)->snat.flags = 0;
1154       ip0 = vlib_buffer_get_current (b0);
1155
1156       sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
1157       rx_fib_index0 =
1158         fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4, sw_if_index0);
1159
1160       if (PREDICT_FALSE (ip0->ttl == 1))
1161         {
1162           vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
1163           icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
1164                                        ICMP4_time_exceeded_ttl_exceeded_in_transit,
1165                                        0);
1166           next[0] = NAT_NEXT_ICMP_ERROR;
1167           goto trace0;
1168         }
1169
1170       udp0 = ip4_next_header (ip0);
1171       icmp0 = (icmp46_header_t *) udp0;
1172       proto0 = ip_proto_to_nat_proto (ip0->protocol);
1173
1174       if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_OTHER))
1175         {
1176           s0 = nat44_ed_out2in_slowpath_unknown_proto (
1177             sm, b0, ip0, rx_fib_index0, thread_index, now, vm, node);
1178           if (!sm->forwarding_enabled)
1179             {
1180               if (!s0)
1181                 next[0] = NAT_NEXT_DROP;
1182             }
1183           if (NAT_NEXT_DROP != next[0] && s0 &&
1184               NAT_ED_TRNSL_ERR_SUCCESS !=
1185                 (translation_error = nat_6t_flow_buf_translate_o2i (
1186                    vm, sm, b0, ip0, &s0->o2i, proto0,
1187                    0 /* is_output_feature */)))
1188             {
1189               next[0] = NAT_NEXT_DROP;
1190               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_TRNSL_FAILED];
1191               goto trace0;
1192             }
1193
1194           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.other,
1195                                          thread_index, sw_if_index0, 1);
1196           goto trace0;
1197         }
1198
1199       if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
1200         {
1201           next[0] = icmp_out2in_ed_slow_path
1202             (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
1203              next[0], now, thread_index, &s0);
1204
1205           if (NAT_NEXT_DROP != next[0] && s0 &&
1206               NAT_ED_TRNSL_ERR_SUCCESS !=
1207                 (translation_error = nat_6t_flow_buf_translate_o2i (
1208                    vm, sm, b0, ip0, &s0->o2i, proto0,
1209                    0 /* is_output_feature */)))
1210             {
1211               next[0] = NAT_NEXT_DROP;
1212               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_TRNSL_FAILED];
1213               goto trace0;
1214             }
1215
1216           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.icmp,
1217                                          thread_index, sw_if_index0, 1);
1218           goto trace0;
1219         }
1220
1221       init_ed_k (&kv0, ip0->src_address,
1222                  vnet_buffer (b0)->ip.reass.l4_src_port, ip0->dst_address,
1223                  vnet_buffer (b0)->ip.reass.l4_dst_port, rx_fib_index0,
1224                  ip0->protocol);
1225
1226       s0 = NULL;
1227       if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv0, &value0))
1228         {
1229           ASSERT (thread_index == ed_value_get_thread_index (&value0));
1230           s0 =
1231             pool_elt_at_index (tsm->sessions,
1232                                ed_value_get_session_index (&value0));
1233
1234           if (s0->tcp_closed_timestamp && now >= s0->tcp_closed_timestamp)
1235             {
1236               nat_free_session_data (sm, s0, thread_index, 0);
1237               nat_ed_session_delete (sm, s0, thread_index, 1);
1238               s0 = NULL;
1239             }
1240         }
1241
1242       if (!s0)
1243         {
1244           /* Try to match static mapping by external address and port,
1245              destination address and port in packet */
1246
1247           if (snat_static_mapping_match (
1248                 vm, sm, ip0->dst_address,
1249                 vnet_buffer (b0)->ip.reass.l4_dst_port, rx_fib_index0, proto0,
1250                 &sm_addr, &sm_port, &sm_fib_index, 1, 0, &twice_nat0, &lb_nat0,
1251                 &ip0->src_address, &identity_nat0, &m))
1252             {
1253               /*
1254                * Send DHCP packets to the ipv4 stack, or we won't
1255                * be able to use dhcp client on the outside interface
1256                */
1257               if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_UDP
1258                                  && (vnet_buffer (b0)->ip.reass.l4_dst_port ==
1259                                      clib_host_to_net_u16
1260                                      (UDP_DST_PORT_dhcp_to_client))))
1261                 {
1262                   goto trace0;
1263                 }
1264
1265               if (!sm->forwarding_enabled)
1266                 {
1267                   b0->error =
1268                     node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
1269                   next[0] = NAT_NEXT_DROP;
1270                 }
1271               else
1272                 {
1273                   if (next_src_nat
1274                       (sm, ip0, vnet_buffer (b0)->ip.reass.l4_src_port,
1275                        vnet_buffer (b0)->ip.reass.l4_dst_port,
1276                        thread_index, rx_fib_index0))
1277                     {
1278                       next[0] = NAT_NEXT_IN2OUT_ED_FAST_PATH;
1279                     }
1280                   else
1281                     {
1282                       create_bypass_for_fwd (sm, b0, s0, ip0, rx_fib_index0,
1283                                              thread_index);
1284                     }
1285                 }
1286               goto trace0;
1287             }
1288
1289           if (PREDICT_FALSE (identity_nat0))
1290             goto trace0;
1291
1292           if ((proto0 == NAT_PROTOCOL_TCP)
1293               && !tcp_flags_is_init (vnet_buffer (b0)->ip.
1294                                      reass.icmp_type_or_tcp_flags))
1295             {
1296               b0->error = node->errors[NAT_OUT2IN_ED_ERROR_NON_SYN];
1297               next[0] = NAT_NEXT_DROP;
1298               goto trace0;
1299             }
1300
1301           /* Create session initiated by host from external network */
1302           s0 = create_session_for_static_mapping_ed (sm, b0,
1303                                                      sm_addr, sm_port,
1304                                                      sm_fib_index,
1305                                                      ip0->dst_address,
1306                                                      vnet_buffer (b0)->
1307                                                      ip.reass.l4_dst_port,
1308                                                      rx_fib_index0, proto0,
1309                                                      node, rx_fib_index0,
1310                                                      thread_index, twice_nat0,
1311                                                      lb_nat0, now, m);
1312           if (!s0)
1313             {
1314               next[0] = NAT_NEXT_DROP;
1315               goto trace0;
1316             }
1317         }
1318
1319       if (NAT_ED_TRNSL_ERR_SUCCESS !=
1320           (translation_error = nat_6t_flow_buf_translate_o2i (
1321              vm, sm, b0, ip0, &s0->o2i, proto0, 0 /* is_output_feature */)))
1322         {
1323           next[0] = NAT_NEXT_DROP;
1324           goto trace0;
1325         }
1326
1327       if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
1328         {
1329           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.tcp,
1330                                          thread_index, sw_if_index0, 1);
1331           nat44_set_tcp_session_state_o2i (sm, now, s0,
1332                                            vnet_buffer (b0)->ip.
1333                                            reass.icmp_type_or_tcp_flags,
1334                                            vnet_buffer (b0)->ip.
1335                                            reass.tcp_ack_number,
1336                                            vnet_buffer (b0)->ip.
1337                                            reass.tcp_seq_number,
1338                                            thread_index);
1339         }
1340       else
1341         {
1342           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.udp,
1343                                          thread_index, sw_if_index0, 1);
1344         }
1345
1346       /* Accounting */
1347       nat44_session_update_counters (s0, now,
1348                                      vlib_buffer_length_in_chain (vm, b0),
1349                                      thread_index);
1350       /* Per-user LRU list maintenance */
1351       nat44_session_update_lru (sm, s0, thread_index);
1352
1353     trace0:
1354       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
1355                          && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1356         {
1357           nat44_ed_out2in_trace_t *t =
1358             vlib_add_trace (vm, node, b0, sizeof (*t));
1359           t->sw_if_index = sw_if_index0;
1360           t->next_index = next[0];
1361           t->is_slow_path = 1;
1362           t->translation_error = translation_error;
1363           clib_memcpy (&t->search_key, &kv0, sizeof (t->search_key));
1364
1365           if (s0)
1366             {
1367               t->session_index = s0 - tsm->sessions;
1368               clib_memcpy (&t->i2of, &s0->i2o, sizeof (t->i2of));
1369               clib_memcpy (&t->o2if, &s0->o2i, sizeof (t->o2if));
1370             }
1371           else
1372             {
1373               t->session_index = ~0;
1374             }
1375         }
1376
1377       if (next[0] == NAT_NEXT_DROP)
1378         {
1379           vlib_increment_simple_counter (&sm->counters.slowpath.out2in.drops,
1380                                          thread_index, sw_if_index0, 1);
1381         }
1382
1383       n_left_from--;
1384       next++;
1385       b++;
1386     }
1387
1388   vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
1389                                frame->n_vectors);
1390
1391   return frame->n_vectors;
1392 }
1393
1394 VLIB_NODE_FN (nat44_ed_out2in_node) (vlib_main_t * vm,
1395                                      vlib_node_runtime_t * node,
1396                                      vlib_frame_t * frame)
1397 {
1398   if (snat_main.num_workers > 1)
1399     {
1400       return nat44_ed_out2in_fast_path_node_fn_inline (vm, node, frame, 1);
1401     }
1402   else
1403     {
1404       return nat44_ed_out2in_fast_path_node_fn_inline (vm, node, frame, 0);
1405     }
1406 }
1407
1408 VLIB_REGISTER_NODE (nat44_ed_out2in_node) = {
1409   .name = "nat44-ed-out2in",
1410   .vector_size = sizeof (u32),
1411   .sibling_of = "nat-default",
1412   .format_trace = format_nat44_ed_out2in_trace,
1413   .type = VLIB_NODE_TYPE_INTERNAL,
1414   .n_errors = ARRAY_LEN(nat_out2in_ed_error_strings),
1415   .error_strings = nat_out2in_ed_error_strings,
1416   .runtime_data_bytes = sizeof (snat_runtime_t),
1417 };
1418
1419 VLIB_NODE_FN (nat44_ed_out2in_slowpath_node) (vlib_main_t * vm,
1420                                               vlib_node_runtime_t * node,
1421                                               vlib_frame_t * frame)
1422 {
1423   return nat44_ed_out2in_slow_path_node_fn_inline (vm, node, frame);
1424 }
1425
1426 VLIB_REGISTER_NODE (nat44_ed_out2in_slowpath_node) = {
1427   .name = "nat44-ed-out2in-slowpath",
1428   .vector_size = sizeof (u32),
1429   .sibling_of = "nat-default",
1430   .format_trace = format_nat44_ed_out2in_trace,
1431   .type = VLIB_NODE_TYPE_INTERNAL,
1432   .n_errors = ARRAY_LEN(nat_out2in_ed_error_strings),
1433   .error_strings = nat_out2in_ed_error_strings,
1434   .runtime_data_bytes = sizeof (snat_runtime_t),
1435 };
1436
1437 static u8 *
1438 format_nat_pre_trace (u8 * s, va_list * args)
1439 {
1440   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1441   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1442   nat_pre_trace_t *t = va_arg (*args, nat_pre_trace_t *);
1443   return format (s, "out2in next_index %d arc_next_index %d", t->next_index,
1444                  t->arc_next_index);
1445 }
1446
1447 VLIB_NODE_FN (nat_pre_out2in_node) (vlib_main_t * vm,
1448                                     vlib_node_runtime_t * node,
1449                                     vlib_frame_t * frame)
1450 {
1451   return nat_pre_node_fn_inline (vm, node, frame,
1452                                  NAT_NEXT_OUT2IN_ED_FAST_PATH);
1453 }
1454
1455 VLIB_REGISTER_NODE (nat_pre_out2in_node) = {
1456   .name = "nat-pre-out2in",
1457   .vector_size = sizeof (u32),
1458   .sibling_of = "nat-default",
1459   .format_trace = format_nat_pre_trace,
1460   .type = VLIB_NODE_TYPE_INTERNAL,
1461   .n_errors = 0,
1462  };
1463
1464 /*
1465  * fd.io coding-style-patch-verification: ON
1466  *
1467  * Local Variables:
1468  * eval: (c-set-style "gnu")
1469  * End:
1470  */