src/plugins/nat/nat44-ed/tcp_conn_track.rst

   1 NAT44ED TCP connection tracking
   2 ===============================
   3
   4 TCP connection tracking in endpoint-dependent NAT is based on RFC 7857
   5 and RFC 6146, which RFC 7857 references.
   6
   7 See RFC 7857 for the original graph - our graph is slightly different,
   8 allowing creation of new session, while an old session is in transitory
   9 timeout after seeing FIN packets from both sides:
  10
  11 After discussion on vpp-dev and with Andrew Yourtschenko we agreed that
  12 it's friendly behaviour to allow creating a new session while the old
  13 one is closed and in transitory timeout. The alternative means VPP is
  14 insisting that a 5-tuple connection cannot be created while an old one
  15 is finished and timing out. There is no apparent reason why our change
  16 would break anything and we agreed that it could only help users.
  17
  18 ::
  19
  20
  21                   +------------transitory timeout----------------+
  22                   |                                              |
  23                   |                           +-------------+    |
  24                   |       session created---->+    CLOSED   |    |
  25                   |                           +-------------+    |
  26                   |                             |         |      |
  27 +-----+           |                            SYN       SYN     |
  28 |     v           v                           IN2OUT   OUT2IN    |
  29 | +->session removed                            |         |      |
  30 | |  ^ ^    ^  ^  ^                             v         v      |
  31 | |  | |    |  |  |                         +-------+ +-------+  |
  32 | |  | |    |  |  +----transitory timeout---+SYN_I2O| |SYN_O2I+--+
  33 | |  | |    |  |              +---------+   |-------| |-------|
  34 | |  | |    |  +-transitory---+RST_TRANS|       |         |
  35 | |  | |    |      timeout    +---------+      SYN       SYN
  36 | |  | |    |                   |    ^       OUT2IN     IN2OUT
  37 | |  | |    |                   |    |          |         |
  38 | |  | |    |                   |    |          v         v
  39 | |  | |    |                   |    |         +-----------+
  40 | |  | |    |                   |    +--RST----+ESTABLISHED+<-SYN IN2OUT-+
  41 | |  | |    |                   |              +-----------+             |
  42 | |  | |    |                   +---data pkt-----^ | | |   ^             |
  43 | |  | |    |                                      | | |   |             |
  44 | |  | |    +----established timeout---------------+ | |   |             |
  45 | |  | |                                             | |   |             |
  46 | |  | |                    +-----FIN IN2OUT---------+ |   |             |
  47 | |  | |                    v                          |   |             |
  48 | |  | |                +-------+     +--FIN OUT2IN----+   |             |
  49 | |  | +--established---+FIN_I2O|     |                    |             |
  50 | |  |      timeout     +-------+     v       +-SYN OUT2IN-+             |
  51 | |  |                      |     +-------+   |                          |
  52 | |  +----established-------------+FIN_O2I| +--------------+             |
  53 | |         timeout         |     +-------+ |REOPEN_SYN_I2O| +--------------+
  54 | |                         |         |     +--------------+ |REOPEN_SYN_O2I|
  55 | |                        FIN       FIN             ^  |    +--------------+
  56 | |                      OUT2IN     IN2OUT           |  |           ^  |
  57 | |                         |         |              |  |           |  |
  58 | |                         v         v              |  |           |  |
  59 | |                       +-------------+            |  |           |  |
  60 | +--transitory timeout---+  FIN_TRANS  +-SYN IN2OUT-+  |           |  |
  61 |                         +-------------+               |           |  |
  62 |                                |                      |           |  |
  63 |                                +--------SYN OUT2IN----|-----------+  |
  64 |                                                       v              |
  65 +------------------transitory timeout-------------------+<-------------+