src/plugins/snat/nat64_out2in.c

   1 /*
   2  * Copyright (c) 2017 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 /**
  16  * @file
  17  * @brief NAT64 IPv4 to IPv6 translation (otside to inside network)
  18  */
  19
  20 #include <snat/nat64.h>
  21 #include <vnet/ip/ip4_to_ip6.h>
  22 #include <vnet/fib/ip4_fib.h>
  23
  24 /* *INDENT-OFF* */
  25 static u8 well_known_prefix[] = {
  26   0x00, 0x64, 0xff, 0x9b,
  27   0x00, 0x00, 0x00, 0x00,
  28   0x00, 0x00, 0x00, 0x00,
  29   0x00, 0x00, 0x00, 0x00
  30 };
  31 /* *INDENT-ON* */
  32
  33 typedef struct
  34 {
  35   u32 sw_if_index;
  36   u32 next_index;
  37 } nat64_out2in_trace_t;
  38
  39 static u8 *
  40 format_nat64_out2in_trace (u8 * s, va_list * args)
  41 {
  42   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  43   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  44   nat64_out2in_trace_t *t = va_arg (*args, nat64_out2in_trace_t *);
  45
  46   s =
  47     format (s, "NAT64-out2in: sw_if_index %d, next index %d", t->sw_if_index,
  48             t->next_index);
  49
  50   return s;
  51 }
  52
  53 vlib_node_registration_t nat64_out2in_node;
  54
  55 #define foreach_nat64_out2in_error                 \
  56 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol")    \
  57 _(OUT2IN_PACKETS, "Good out2in packets processed") \
  58 _(NO_TRANSLATION, "No translation")                \
  59 _(UNKNOWN, "unknown")
  60
  61 typedef enum
  62 {
  63 #define _(sym,str) NAT64_OUT2IN_ERROR_##sym,
  64   foreach_nat64_out2in_error
  65 #undef _
  66     NAT64_OUT2IN_N_ERROR,
  67 } nat64_out2in_error_t;
  68
  69 static char *nat64_out2in_error_strings[] = {
  70 #define _(sym,string) string,
  71   foreach_nat64_out2in_error
  72 #undef _
  73 };
  74
  75 typedef enum
  76 {
  77   NAT64_OUT2IN_NEXT_LOOKUP,
  78   NAT64_OUT2IN_NEXT_DROP,
  79   NAT64_OUT2IN_N_NEXT,
  80 } nat64_out2in_next_t;
  81
  82 typedef struct nat64_out2in_set_ctx_t_
  83 {
  84   vlib_buffer_t *b;
  85   vlib_main_t *vm;
  86 } nat64_out2in_set_ctx_t;
  87
  88 static int
  89 nat64_out2in_tcp_udp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
  90                              void *arg)
  91 {
  92   nat64_main_t *nm = &nat64_main;
  93   nat64_out2in_set_ctx_t *ctx = arg;
  94   nat64_db_bib_entry_t *bibe;
  95   nat64_db_st_entry_t *ste;
  96   ip46_address_t saddr, daddr;
  97   ip6_address_t ip6_saddr;
  98   udp_header_t *udp = ip4_next_header (ip4);
  99   tcp_header_t *tcp = ip4_next_header (ip4);
 100   snat_protocol_t proto = ip_proto_to_snat_proto (ip4->protocol);
 101   u16 dport = udp->dst_port;
 102   u16 sport = udp->src_port;
 103   u32 sw_if_index, fib_index;
 104   u16 *checksum;
 105   ip_csum_t csum;
 106
 107   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
 108   fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 109
 110   memset (&saddr, 0, sizeof (saddr));
 111   saddr.ip4.as_u32 = ip4->src_address.as_u32;
 112   memset (&daddr, 0, sizeof (daddr));
 113   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 114
 115   memcpy (&ip6_saddr, well_known_prefix, sizeof (ip6_saddr));
 116   ip6_saddr.as_u32[3] = ip4->src_address.as_u32;
 117
 118   ste =
 119     nat64_db_st_entry_find (&nm->db, &daddr, &saddr, dport, sport, proto,
 120                             fib_index, 0);
 121   if (ste)
 122     {
 123       bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
 124       if (!bibe)
 125         return -1;
 126     }
 127   else
 128     {
 129       bibe =
 130         nat64_db_bib_entry_find (&nm->db, &daddr, dport, proto, fib_index, 0);
 131
 132       if (!bibe)
 133         return -1;
 134
 135       ste =
 136         nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4,
 137                                   sport);
 138     }
 139
 140   nat64_session_reset_timeout (ste, ctx->vm);
 141
 142   ip6->src_address.as_u64[0] = ip6_saddr.as_u64[0];
 143   ip6->src_address.as_u64[1] = ip6_saddr.as_u64[1];
 144
 145   ip6->dst_address.as_u64[0] = bibe->in_addr.as_u64[0];
 146   ip6->dst_address.as_u64[1] = bibe->in_addr.as_u64[1];
 147   udp->dst_port = bibe->in_port;
 148
 149   if (proto == SNAT_PROTOCOL_UDP)
 150     checksum = &udp->checksum;
 151   else
 152     checksum = &tcp->checksum;
 153   csum = ip_csum_sub_even (*checksum, dport);
 154   csum = ip_csum_add_even (csum, udp->dst_port);
 155   *checksum = ip_csum_fold (csum);
 156
 157   vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
 158
 159   return 0;
 160 }
 161
 162 static int
 163 nat64_out2in_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6, void *arg)
 164 {
 165   nat64_main_t *nm = &nat64_main;
 166   nat64_out2in_set_ctx_t *ctx = arg;
 167   nat64_db_bib_entry_t *bibe;
 168   nat64_db_st_entry_t *ste;
 169   ip46_address_t saddr, daddr;
 170   ip6_address_t ip6_saddr;
 171   u32 sw_if_index, fib_index;
 172   icmp46_header_t *icmp = ip4_next_header (ip4);
 173
 174   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
 175   fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 176
 177   memset (&saddr, 0, sizeof (saddr));
 178   saddr.ip4.as_u32 = ip4->src_address.as_u32;
 179   memset (&daddr, 0, sizeof (daddr));
 180   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 181
 182   memcpy (&ip6_saddr, well_known_prefix, sizeof (ip6_saddr));
 183   ip6_saddr.as_u32[3] = ip4->src_address.as_u32;
 184
 185   if (icmp->type == ICMP6_echo_request || icmp->type == ICMP6_echo_reply)
 186     {
 187       u16 out_id = ((u16 *) (icmp))[2];
 188       ste =
 189         nat64_db_st_entry_find (&nm->db, &daddr, &saddr, out_id, 0,
 190                                 SNAT_PROTOCOL_ICMP, fib_index, 0);
 191
 192       if (ste)
 193         {
 194           bibe =
 195             nat64_db_bib_entry_by_index (&nm->db, SNAT_PROTOCOL_ICMP,
 196                                          ste->bibe_index);
 197           if (!bibe)
 198             return -1;
 199         }
 200       else
 201         {
 202           bibe =
 203             nat64_db_bib_entry_find (&nm->db, &daddr, out_id,
 204                                      SNAT_PROTOCOL_ICMP, fib_index, 0);
 205           if (!bibe)
 206             return -1;
 207
 208           ste =
 209             nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4,
 210                                       0);
 211         }
 212
 213       nat64_session_reset_timeout (ste, ctx->vm);
 214
 215       ip6->src_address.as_u64[0] = ip6_saddr.as_u64[0];
 216       ip6->src_address.as_u64[1] = ip6_saddr.as_u64[1];
 217
 218       ip6->dst_address.as_u64[0] = bibe->in_addr.as_u64[0];
 219       ip6->dst_address.as_u64[1] = bibe->in_addr.as_u64[1];
 220       ((u16 *) (icmp))[2] = bibe->in_port;
 221
 222       vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
 223     }
 224   else
 225     {
 226       ip6_header_t *inner_ip6 = (ip6_header_t *) u8_ptr_add (icmp, 8);
 227
 228       ip6->src_address.as_u64[0] = ip6_saddr.as_u64[0];
 229       ip6->src_address.as_u64[1] = ip6_saddr.as_u64[1];
 230       ip6->dst_address.as_u64[0] = inner_ip6->src_address.as_u64[0];
 231       ip6->dst_address.as_u64[1] = inner_ip6->src_address.as_u64[1];
 232     }
 233
 234   return 0;
 235 }
 236
 237 static int
 238 nat64_out2in_inner_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
 239                                 void *arg)
 240 {
 241   nat64_main_t *nm = &nat64_main;
 242   nat64_out2in_set_ctx_t *ctx = arg;
 243   nat64_db_bib_entry_t *bibe;
 244   nat64_db_st_entry_t *ste;
 245   ip46_address_t saddr, daddr;
 246   ip6_address_t ip6_daddr;
 247   u32 sw_if_index, fib_index;
 248   snat_protocol_t proto = ip_proto_to_snat_proto (ip4->protocol);
 249
 250   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
 251   fib_index =
 252     fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP6, sw_if_index);
 253
 254   memset (&saddr, 0, sizeof (saddr));
 255   saddr.ip4.as_u32 = ip4->src_address.as_u32;
 256   memset (&daddr, 0, sizeof (daddr));
 257   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 258
 259   memcpy (&ip6_daddr, well_known_prefix, sizeof (ip6_daddr));
 260   ip6_daddr.as_u32[3] = ip4->dst_address.as_u32;
 261
 262   if (proto == SNAT_PROTOCOL_ICMP)
 263     {
 264       icmp46_header_t *icmp = ip4_next_header (ip4);
 265       u16 out_id = ((u16 *) (icmp))[2];
 266
 267       if (!
 268           (icmp->type == ICMP6_echo_request
 269            || icmp->type == ICMP6_echo_reply))
 270         return -1;
 271
 272       ste =
 273         nat64_db_st_entry_find (&nm->db, &saddr, &daddr, out_id, 0, proto,
 274                                 fib_index, 0);
 275       if (!ste)
 276         return -1;
 277
 278       bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
 279       if (!bibe)
 280         return -1;
 281
 282       ip6->dst_address.as_u64[0] = ip6_daddr.as_u64[0];
 283       ip6->dst_address.as_u64[1] = ip6_daddr.as_u64[1];
 284       ip6->src_address.as_u64[0] = bibe->in_addr.as_u64[0];
 285       ip6->src_address.as_u64[1] = bibe->in_addr.as_u64[1];
 286       ((u16 *) (icmp))[2] = bibe->in_port;
 287
 288       vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
 289     }
 290   else
 291     {
 292       udp_header_t *udp = ip4_next_header (ip4);
 293       tcp_header_t *tcp = ip4_next_header (ip4);
 294       u16 dport = udp->dst_port;
 295       u16 sport = udp->src_port;
 296       u16 *checksum;
 297       ip_csum_t csum;
 298
 299       ste =
 300         nat64_db_st_entry_find (&nm->db, &saddr, &daddr, sport, dport, proto,
 301                                 fib_index, 0);
 302       if (!ste)
 303         return -1;
 304
 305       bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
 306       if (!bibe)
 307         return -1;
 308
 309       ip6->dst_address.as_u64[0] = ip6_daddr.as_u64[0];
 310       ip6->dst_address.as_u64[1] = ip6_daddr.as_u64[1];
 311       ip6->src_address.as_u64[0] = bibe->in_addr.as_u64[0];
 312       ip6->src_address.as_u64[1] = bibe->in_addr.as_u64[1];
 313       udp->src_port = bibe->in_port;
 314
 315       if (proto == SNAT_PROTOCOL_UDP)
 316         checksum = &udp->checksum;
 317       else
 318         checksum = &tcp->checksum;
 319       if (*checksum)
 320         {
 321           csum = ip_csum_sub_even (*checksum, sport);
 322           csum = ip_csum_add_even (csum, udp->src_port);
 323           *checksum = ip_csum_fold (csum);
 324         }
 325
 326       vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
 327     }
 328
 329   return 0;
 330 }
 331
 332 static uword
 333 nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
 334                       vlib_frame_t * frame)
 335 {
 336   u32 n_left_from, *from, *to_next;
 337   nat64_out2in_next_t next_index;
 338   u32 pkts_processed = 0;
 339
 340   from = vlib_frame_vector_args (frame);
 341   n_left_from = frame->n_vectors;
 342   next_index = node->cached_next_index;
 343   while (n_left_from > 0)
 344     {
 345       u32 n_left_to_next;
 346
 347       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 348
 349       while (n_left_from > 0 && n_left_to_next > 0)
 350         {
 351           u32 bi0;
 352           vlib_buffer_t *b0;
 353           u32 next0;
 354           ip4_header_t *ip40;
 355           u32 proto0;
 356           nat64_out2in_set_ctx_t ctx0;
 357
 358           /* speculatively enqueue b0 to the current next frame */
 359           bi0 = from[0];
 360           to_next[0] = bi0;
 361           from += 1;
 362           to_next += 1;
 363           n_left_from -= 1;
 364           n_left_to_next -= 1;
 365
 366           b0 = vlib_get_buffer (vm, bi0);
 367           ip40 = vlib_buffer_get_current (b0);
 368
 369           ctx0.b = b0;
 370           ctx0.vm = vm;
 371
 372           next0 = NAT64_OUT2IN_NEXT_LOOKUP;
 373
 374           proto0 = ip_proto_to_snat_proto (ip40->protocol);
 375           if (PREDICT_FALSE (proto0 == ~0))
 376             {
 377               next0 = NAT64_OUT2IN_NEXT_DROP;
 378               b0->error =
 379                 node->errors[NAT64_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
 380               goto trace0;
 381             }
 382
 383           if (proto0 == SNAT_PROTOCOL_ICMP)
 384             {
 385               if (icmp_to_icmp6
 386                   (b0, nat64_out2in_icmp_set_cb, &ctx0,
 387                    nat64_out2in_inner_icmp_set_cb, &ctx0))
 388                 {
 389                   next0 = NAT64_OUT2IN_NEXT_DROP;
 390                   b0->error = node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
 391                   goto trace0;
 392                 }
 393             }
 394           else
 395             {
 396               if (ip4_to_ip6_tcp_udp (b0, nat64_out2in_tcp_udp_set_cb, &ctx0))
 397                 {
 398                   next0 = NAT64_OUT2IN_NEXT_DROP;
 399                   b0->error = node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
 400                   goto trace0;
 401                 }
 402             }
 403
 404         trace0:
 405           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 406                              && (b0->flags & VLIB_BUFFER_IS_TRACED)))
 407             {
 408               nat64_out2in_trace_t *t =
 409                 vlib_add_trace (vm, node, b0, sizeof (*t));
 410               t->sw_if_index = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 411               t->next_index = next0;
 412             }
 413
 414           pkts_processed += next0 != NAT64_OUT2IN_NEXT_DROP;
 415
 416           /* verify speculative enqueue, maybe switch current next frame */
 417           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
 418                                            n_left_to_next, bi0, next0);
 419         }
 420       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 421     }
 422   vlib_node_increment_counter (vm, nat64_out2in_node.index,
 423                                NAT64_OUT2IN_ERROR_OUT2IN_PACKETS,
 424                                pkts_processed);
 425   return frame->n_vectors;
 426 }
 427
 428 /* *INDENT-OFF* */
 429 VLIB_REGISTER_NODE (nat64_out2in_node) = {
 430   .function = nat64_out2in_node_fn,
 431   .name = "nat64-out2in",
 432   .vector_size = sizeof (u32),
 433   .format_trace = format_nat64_out2in_trace,
 434   .type = VLIB_NODE_TYPE_INTERNAL,
 435   .n_errors = ARRAY_LEN (nat64_out2in_error_strings),
 436   .error_strings = nat64_out2in_error_strings,.n_next_nodes = 2,
 437   /* edit / add dispositions here */
 438   .next_nodes = {
 439     [NAT64_OUT2IN_NEXT_DROP] = "error-drop",
 440     [NAT64_OUT2IN_NEXT_LOOKUP] = "ip6-lookup",
 441   },
 442 };
 443 /* *INDENT-ON* */
 444
 445 VLIB_NODE_FUNCTION_MULTIARCH (nat64_out2in_node, nat64_out2in_node_fn);
 446
 447 /*
 448  * fd.io coding-style-patch-verification: ON
 449  *
 450  * Local Variables:
 451  * eval: (c-set-style "gnu")
 452  * End:
 453  */