src/plugins/snat/snat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <snat/snat.h>
  23 #include <snat/snat_ipfix_logging.h>
  24 #include <snat/snat_det.h>
  25 #include <snat/nat64.h>
  26 #include <vnet/fib/fib_table.h>
  27 #include <vnet/fib/ip4_fib.h>
  28
  29 #include <vpp/app/version.h>
  30
  31 snat_main_t snat_main;
  32
  33
  34 /* Hook up input features */
  35 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  36   .arc_name = "ip4-unicast",
  37   .node_name = "snat-in2out",
  38   .runs_before = VNET_FEATURES ("snat-out2in"),
  39 };
  40 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  41   .arc_name = "ip4-unicast",
  42   .node_name = "snat-out2in",
  43   .runs_before = VNET_FEATURES ("ip4-lookup"),
  44 };
  45 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  46   .arc_name = "ip4-unicast",
  47   .node_name = "snat-det-in2out",
  48   .runs_before = VNET_FEATURES ("snat-det-out2in"),
  49 };
  50 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  51   .arc_name = "ip4-unicast",
  52   .node_name = "snat-det-out2in",
  53   .runs_before = VNET_FEATURES ("ip4-lookup"),
  54 };
  55 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  56   .arc_name = "ip4-unicast",
  57   .node_name = "snat-in2out-worker-handoff",
  58   .runs_before = VNET_FEATURES ("snat-out2in-worker-handoff"),
  59 };
  60 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  61   .arc_name = "ip4-unicast",
  62   .node_name = "snat-out2in-worker-handoff",
  63   .runs_before = VNET_FEATURES ("ip4-lookup"),
  64 };
  65 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
  66   .arc_name = "ip4-unicast",
  67   .node_name = "snat-in2out-fast",
  68   .runs_before = VNET_FEATURES ("snat-out2in-fast"),
  69 };
  70 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
  71   .arc_name = "ip4-unicast",
  72   .node_name = "snat-out2in-fast",
  73   .runs_before = VNET_FEATURES ("ip4-lookup"),
  74 };
  75
  76 /* *INDENT-OFF* */
  77 VLIB_PLUGIN_REGISTER () = {
  78     .version = VPP_BUILD_VER,
  79     .description = "Network Address Translation",
  80 };
  81 /* *INDENT-ON* */
  82
  83 /**
  84  * @brief Add/del NAT address to FIB.
  85  *
  86  * Add the external NAT address to the FIB as receive entries. This ensures
  87  * that VPP will reply to ARP for this address and we don't need to enable
  88  * proxy ARP on the outside interface.
  89  *
  90  * @param addr IPv4 address.
  91  * @param plen address prefix length
  92  * @param sw_if_index Interface.
  93  * @param is_add If 0 delete, otherwise add.
  94  */
  95 void
  96 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
  97                           int is_add)
  98 {
  99   fib_prefix_t prefix = {
 100     .fp_len = p_len,
 101     .fp_proto = FIB_PROTOCOL_IP4,
 102     .fp_addr = {
 103         .ip4.as_u32 = addr->as_u32,
 104     },
 105   };
 106   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 107
 108   if (is_add)
 109     fib_table_entry_update_one_path(fib_index,
 110                                     &prefix,
 111                                     FIB_SOURCE_PLUGIN_HI,
 112                                     (FIB_ENTRY_FLAG_CONNECTED |
 113                                      FIB_ENTRY_FLAG_LOCAL |
 114                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 115                                     FIB_PROTOCOL_IP4,
 116                                     NULL,
 117                                     sw_if_index,
 118                                     ~0,
 119                                     1,
 120                                     NULL,
 121                                     FIB_ROUTE_PATH_FLAG_NONE);
 122   else
 123     fib_table_entry_delete(fib_index,
 124                            &prefix,
 125                            FIB_SOURCE_PLUGIN_HI);
 126 }
 127
 128 void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id)
 129 {
 130   snat_address_t * ap;
 131   snat_interface_t *i;
 132
 133   if (vrf_id != ~0)
 134     sm->vrf_mode = 1;
 135
 136   /* Check if address already exists */
 137   vec_foreach (ap, sm->addresses)
 138     {
 139       if (ap->addr.as_u32 == addr->as_u32)
 140         return;
 141     }
 142
 143   vec_add2 (sm->addresses, ap, 1);
 144   ap->addr = *addr;
 145   ap->fib_index = ip4_fib_index_from_table_id(vrf_id);
 146 #define _(N, i, n, s) \
 147   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535);
 148   foreach_snat_protocol
 149 #undef _
 150
 151   /* Add external address to FIB */
 152   pool_foreach (i, sm->interfaces,
 153   ({
 154     if (i->is_inside)
 155       continue;
 156
 157     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 158     break;
 159   }));
 160 }
 161
 162 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 163                                                    ip4_address_t addr)
 164 {
 165   snat_static_mapping_t *m;
 166   pool_foreach (m, sm->static_mappings,
 167   ({
 168       if (m->external_addr.as_u32 == addr.as_u32)
 169         return 1;
 170   }));
 171
 172   return 0;
 173 }
 174
 175 void increment_v4_address (ip4_address_t * a)
 176 {
 177   u32 v;
 178
 179   v = clib_net_to_host_u32(a->as_u32) + 1;
 180   a->as_u32 = clib_host_to_net_u32(v);
 181 }
 182
 183 static void
 184 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 185                                        ip4_address_t l_addr,
 186                                        u16 l_port,
 187                                        u32 sw_if_index,
 188                                        u16 e_port,
 189                                        u32 vrf_id,
 190                                        snat_protocol_t proto,
 191                                        int addr_only,
 192                                        int is_add)
 193 {
 194   snat_static_map_resolve_t *rp;
 195
 196   vec_add2 (sm->to_resolve, rp, 1);
 197   rp->l_addr.as_u32 = l_addr.as_u32;
 198   rp->l_port = l_port;
 199   rp->sw_if_index = sw_if_index;
 200   rp->e_port = e_port;
 201   rp->vrf_id = vrf_id;
 202   rp->proto = proto;
 203   rp->addr_only = addr_only;
 204   rp->is_add = is_add;
 205 }
 206
 207 /**
 208  * @brief Add static mapping.
 209  *
 210  * Create static mapping between local addr+port and external addr+port.
 211  *
 212  * @param l_addr Local IPv4 address.
 213  * @param e_addr External IPv4 address.
 214  * @param l_port Local port number.
 215  * @param e_port External port number.
 216  * @param vrf_id VRF ID.
 217  * @param addr_only If 0 address port and pair mapping, otherwise address only.
 218  * @param sw_if_index External port instead of specific IP address.
 219  * @param is_add If 0 delete static mapping, otherwise add.
 220  *
 221  * @returns
 222  */
 223 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
 224                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 225                             u32 sw_if_index, snat_protocol_t proto, int is_add)
 226 {
 227   snat_main_t * sm = &snat_main;
 228   snat_static_mapping_t *m;
 229   snat_session_key_t m_key;
 230   clib_bihash_kv_8_8_t kv, value;
 231   snat_address_t *a = 0;
 232   u32 fib_index = ~0;
 233   uword * p;
 234   snat_interface_t *interface;
 235   int i;
 236
 237   /* If the external address is a specific interface address */
 238   if (sw_if_index != ~0)
 239     {
 240       ip4_address_t * first_int_addr;
 241
 242       /* Might be already set... */
 243       first_int_addr = ip4_interface_first_address
 244         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
 245
 246       /* DHCP resolution required? */
 247       if (first_int_addr == 0)
 248         {
 249           snat_add_static_mapping_when_resolved
 250             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 251              addr_only,  is_add);
 252           return 0;
 253         }
 254         else
 255           e_addr.as_u32 = first_int_addr->as_u32;
 256     }
 257
 258   m_key.addr = e_addr;
 259   m_key.port = addr_only ? 0 : e_port;
 260   m_key.protocol = addr_only ? 0 : proto;
 261   m_key.fib_index = sm->outside_fib_index;
 262   kv.key = m_key.as_u64;
 263   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 264     m = 0;
 265   else
 266     m = pool_elt_at_index (sm->static_mappings, value.value);
 267
 268   if (is_add)
 269     {
 270       if (m)
 271         return VNET_API_ERROR_VALUE_EXIST;
 272
 273       /* Convert VRF id to FIB index */
 274       if (vrf_id != ~0)
 275         {
 276           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
 277           if (!p)
 278             return VNET_API_ERROR_NO_SUCH_FIB;
 279           fib_index = p[0];
 280         }
 281       /* If not specified use inside VRF id from SNAT plugin startup config */
 282       else
 283         {
 284           fib_index = sm->inside_fib_index;
 285           vrf_id = sm->inside_vrf_id;
 286         }
 287
 288       /* Find external address in allocated addresses and reserve port for
 289          address and port pair mapping when dynamic translations enabled */
 290       if (!addr_only && !(sm->static_mapping_only))
 291         {
 292           for (i = 0; i < vec_len (sm->addresses); i++)
 293             {
 294               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 295                 {
 296                   a = sm->addresses + i;
 297                   /* External port must be unused */
 298                   switch (proto)
 299                     {
 300 #define _(N, j, n, s) \
 301                     case SNAT_PROTOCOL_##N: \
 302                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 303                         return VNET_API_ERROR_INVALID_VALUE; \
 304                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 305                       if (e_port > 1024) \
 306                         a->busy_##n##_ports++; \
 307                       break;
 308                       foreach_snat_protocol
 309 #undef _
 310                     default:
 311                       clib_warning("unknown_protocol");
 312                       return VNET_API_ERROR_INVALID_VALUE_2;
 313                     }
 314                   break;
 315                 }
 316             }
 317           /* External address must be allocated */
 318           if (!a)
 319             return VNET_API_ERROR_NO_SUCH_ENTRY;
 320         }
 321
 322       pool_get (sm->static_mappings, m);
 323       memset (m, 0, sizeof (*m));
 324       m->local_addr = l_addr;
 325       m->external_addr = e_addr;
 326       m->addr_only = addr_only;
 327       m->vrf_id = vrf_id;
 328       m->fib_index = fib_index;
 329       if (!addr_only)
 330         {
 331           m->local_port = l_port;
 332           m->external_port = e_port;
 333           m->proto = proto;
 334         }
 335
 336       m_key.addr = m->local_addr;
 337       m_key.port = m->local_port;
 338       m_key.protocol = m->proto;
 339       m_key.fib_index = m->fib_index;
 340       kv.key = m_key.as_u64;
 341       kv.value = m - sm->static_mappings;
 342       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 343
 344       m_key.addr = m->external_addr;
 345       m_key.port = m->external_port;
 346       m_key.fib_index = sm->outside_fib_index;
 347       kv.key = m_key.as_u64;
 348       kv.value = m - sm->static_mappings;
 349       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
 350
 351       /* Assign worker */
 352       if (sm->workers)
 353         {
 354           snat_user_key_t w_key0;
 355           snat_worker_key_t w_key1;
 356
 357           w_key0.addr = m->local_addr;
 358           w_key0.fib_index = m->fib_index;
 359           kv.key = w_key0.as_u64;
 360
 361           if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 362             {
 363               kv.value = sm->first_worker_index +
 364                 sm->workers[sm->next_worker++ % vec_len (sm->workers)];
 365
 366               clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv, 1);
 367             }
 368           else
 369             {
 370               kv.value = value.value;
 371             }
 372
 373           w_key1.addr = m->external_addr;
 374           w_key1.port = clib_host_to_net_u16 (m->external_port);
 375           w_key1.fib_index = sm->outside_fib_index;
 376           kv.key = w_key1.as_u64;
 377           clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv, 1);
 378         }
 379     }
 380   else
 381     {
 382       if (!m)
 383         return VNET_API_ERROR_NO_SUCH_ENTRY;
 384
 385       /* Free external address port */
 386       if (!addr_only && !(sm->static_mapping_only))
 387         {
 388           for (i = 0; i < vec_len (sm->addresses); i++)
 389             {
 390               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 391                 {
 392                   a = sm->addresses + i;
 393                   switch (proto)
 394                     {
 395 #define _(N, j, n, s) \
 396                     case SNAT_PROTOCOL_##N: \
 397                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 398                       if (e_port > 1024) \
 399                         a->busy_##n##_ports--; \
 400                       break;
 401                       foreach_snat_protocol
 402 #undef _
 403                     default:
 404                       clib_warning("unknown_protocol");
 405                       return VNET_API_ERROR_INVALID_VALUE_2;
 406                     }
 407                   break;
 408                 }
 409             }
 410         }
 411
 412       m_key.addr = m->local_addr;
 413       m_key.port = m->local_port;
 414       m_key.protocol = m->proto;
 415       m_key.fib_index = m->fib_index;
 416       kv.key = m_key.as_u64;
 417       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
 418
 419       m_key.addr = m->external_addr;
 420       m_key.port = m->external_port;
 421       m_key.fib_index = sm->outside_fib_index;
 422       kv.key = m_key.as_u64;
 423       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
 424
 425       /* Delete session(s) for static mapping if exist */
 426       if (!(sm->static_mapping_only) ||
 427           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
 428         {
 429           snat_user_key_t u_key;
 430           snat_user_t *u;
 431           dlist_elt_t * head, * elt;
 432           u32 elt_index, head_index, del_elt_index;
 433           u32 ses_index;
 434           u64 user_index;
 435           snat_session_t * s;
 436           snat_main_per_thread_data_t *tsm;
 437
 438           u_key.addr = m->local_addr;
 439           u_key.fib_index = m->fib_index;
 440           kv.key = u_key.as_u64;
 441           if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
 442             {
 443               user_index = value.value;
 444               if (!clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 445                 tsm = vec_elt_at_index (sm->per_thread_data, value.value);
 446               else
 447                 tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 448               u = pool_elt_at_index (tsm->users, user_index);
 449               if (u->nstaticsessions)
 450                 {
 451                   head_index = u->sessions_per_user_list_head_index;
 452                   head = pool_elt_at_index (tsm->list_pool, head_index);
 453                   elt_index = head->next;
 454                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 455                   ses_index = elt->value;
 456                   while (ses_index != ~0)
 457                     {
 458                       s =  pool_elt_at_index (tsm->sessions, ses_index);
 459                       del_elt_index = elt_index;
 460                       elt_index = elt->next;
 461                       elt = pool_elt_at_index (tsm->list_pool, elt_index);
 462                       ses_index = elt->value;
 463
 464                       if (!addr_only)
 465                         {
 466                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) &&
 467                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
 468                             continue;
 469                         }
 470
 471                       if (snat_is_unk_proto_session (s))
 472                         {
 473                           clib_bihash_kv_16_8_t up_kv;
 474                           snat_unk_proto_ses_key_t up_key;
 475                           up_key.l_addr = s->in2out.addr;
 476                           up_key.r_addr = s->ext_host_addr;
 477                           up_key.fib_index = s->in2out.fib_index;
 478                           up_key.proto = s->in2out.port;
 479                           up_key.rsvd[0] = up_key.rsvd[1] = up_key.rsvd[2] = 0;
 480                           up_kv.key[0] = up_key.as_u64[0];
 481                           up_kv.key[1] = up_key.as_u64[1];
 482                           if (clib_bihash_add_del_16_8 (&sm->in2out_unk_proto,
 483                                                         &up_kv, 0))
 484                             clib_warning ("in2out key del failed");
 485
 486                           up_key.l_addr = s->out2in.addr;
 487                           up_key.fib_index = s->out2in.fib_index;
 488                           up_kv.key[0] = up_key.as_u64[0];
 489                           up_kv.key[1] = up_key.as_u64[1];
 490                           if (clib_bihash_add_del_16_8 (&sm->out2in_unk_proto,
 491                                                         &up_kv, 0))
 492                             clib_warning ("out2in key del failed");
 493
 494                           goto delete;
 495                         }
 496                       /* log NAT event */
 497                       snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 498                                                           s->out2in.addr.as_u32,
 499                                                           s->in2out.protocol,
 500                                                           s->in2out.port,
 501                                                           s->out2in.port,
 502                                                           s->in2out.fib_index);
 503
 504                       value.key = s->in2out.as_u64;
 505                       if (clib_bihash_add_del_8_8 (&sm->in2out, &value, 0))
 506                         clib_warning ("in2out key del failed");
 507                       value.key = s->out2in.as_u64;
 508                       if (clib_bihash_add_del_8_8 (&sm->out2in, &value, 0))
 509                         clib_warning ("out2in key del failed");
 510 delete:
 511                       pool_put (tsm->sessions, s);
 512
 513                       clib_dlist_remove (tsm->list_pool, del_elt_index);
 514                       pool_put_index (tsm->list_pool, del_elt_index);
 515                       u->nstaticsessions--;
 516
 517                       if (!addr_only)
 518                         break;
 519                     }
 520                   if (addr_only)
 521                     {
 522                       pool_put (tsm->users, u);
 523                       clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 0);
 524                     }
 525                 }
 526             }
 527         }
 528
 529       /* Delete static mapping from pool */
 530       pool_put (sm->static_mappings, m);
 531     }
 532
 533   if (!addr_only)
 534     return 0;
 535
 536   /* Add/delete external address to FIB */
 537   pool_foreach (interface, sm->interfaces,
 538   ({
 539     if (interface->is_inside)
 540       continue;
 541
 542     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 543     break;
 544   }));
 545
 546   return 0;
 547 }
 548
 549 int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
 550 {
 551   snat_address_t *a = 0;
 552   snat_session_t *ses;
 553   u32 *ses_to_be_removed = 0, *ses_index;
 554   clib_bihash_kv_8_8_t kv, value;
 555   snat_user_key_t user_key;
 556   snat_user_t *u;
 557   snat_main_per_thread_data_t *tsm;
 558   snat_static_mapping_t *m;
 559   snat_interface_t *interface;
 560   int i;
 561
 562   /* Find SNAT address */
 563   for (i=0; i < vec_len (sm->addresses); i++)
 564     {
 565       if (sm->addresses[i].addr.as_u32 == addr.as_u32)
 566         {
 567           a = sm->addresses + i;
 568           break;
 569         }
 570     }
 571   if (!a)
 572     return VNET_API_ERROR_NO_SUCH_ENTRY;
 573
 574   if (delete_sm)
 575     {
 576       pool_foreach (m, sm->static_mappings,
 577       ({
 578           if (m->external_addr.as_u32 == addr.as_u32)
 579             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
 580                                             m->local_port, m->external_port,
 581                                             m->vrf_id, m->addr_only, ~0,
 582                                             m->proto, 0);
 583       }));
 584     }
 585   else
 586     {
 587       /* Check if address is used in some static mapping */
 588       if (is_snat_address_used_in_static_mapping(sm, addr))
 589         {
 590           clib_warning ("address used in static mapping");
 591           return VNET_API_ERROR_UNSPECIFIED;
 592         }
 593     }
 594
 595   /* Delete sessions using address */
 596   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
 597     {
 598       vec_foreach (tsm, sm->per_thread_data)
 599         {
 600           pool_foreach (ses, tsm->sessions, ({
 601             if (ses->out2in.addr.as_u32 == addr.as_u32)
 602               {
 603                 if (snat_is_unk_proto_session (ses))
 604                   {
 605                     clib_bihash_kv_16_8_t up_kv;
 606                     snat_unk_proto_ses_key_t up_key;
 607                     up_key.l_addr = ses->in2out.addr;
 608                     up_key.r_addr = ses->ext_host_addr;
 609                     up_key.fib_index = ses->in2out.fib_index;
 610                     up_key.proto = ses->in2out.port;
 611                     up_key.rsvd[0] = up_key.rsvd[1] = up_key.rsvd[2] = 0;
 612                     up_kv.key[0] = up_key.as_u64[0];
 613                     up_kv.key[1] = up_key.as_u64[1];
 614                     if (clib_bihash_add_del_16_8 (&sm->in2out_unk_proto,
 615                                                   &up_kv, 0))
 616                       clib_warning ("in2out key del failed");
 617
 618                     up_key.l_addr = ses->out2in.addr;
 619                     up_key.fib_index = ses->out2in.fib_index;
 620                     up_kv.key[0] = up_key.as_u64[0];
 621                     up_kv.key[1] = up_key.as_u64[1];
 622                     if (clib_bihash_add_del_16_8 (&sm->out2in_unk_proto,
 623                                                   &up_kv, 0))
 624                       clib_warning ("out2in key del failed");
 625                   }
 626                 else
 627                   {
 628                     /* log NAT event */
 629                     snat_ipfix_logging_nat44_ses_delete(ses->in2out.addr.as_u32,
 630                                                         ses->out2in.addr.as_u32,
 631                                                         ses->in2out.protocol,
 632                                                         ses->in2out.port,
 633                                                         ses->out2in.port,
 634                                                         ses->in2out.fib_index);
 635                     kv.key = ses->in2out.as_u64;
 636                     clib_bihash_add_del_8_8 (&sm->in2out, &kv, 0);
 637                     kv.key = ses->out2in.as_u64;
 638                     clib_bihash_add_del_8_8 (&sm->out2in, &kv, 0);
 639                   }
 640                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
 641                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
 642                 user_key.addr = ses->in2out.addr;
 643                 user_key.fib_index = ses->in2out.fib_index;
 644                 kv.key = user_key.as_u64;
 645                 if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
 646                   {
 647                     u = pool_elt_at_index (tsm->users, value.value);
 648                     u->nsessions--;
 649                   }
 650               }
 651           }));
 652
 653           vec_foreach (ses_index, ses_to_be_removed)
 654             pool_put_index (tsm->sessions, ses_index[0]);
 655
 656           vec_free (ses_to_be_removed);
 657        }
 658     }
 659
 660   vec_del1 (sm->addresses, i);
 661
 662   /* Delete external address from FIB */
 663   pool_foreach (interface, sm->interfaces,
 664   ({
 665     if (interface->is_inside)
 666       continue;
 667
 668     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 669     break;
 670   }));
 671
 672   return 0;
 673 }
 674
 675 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
 676 {
 677   snat_main_t *sm = &snat_main;
 678   snat_interface_t *i;
 679   const char * feature_name;
 680   snat_address_t * ap;
 681   snat_static_mapping_t * m;
 682   snat_det_map_t * dm;
 683
 684   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
 685     feature_name = is_inside ?  "snat-in2out-fast" : "snat-out2in-fast";
 686   else
 687     {
 688       if (sm->num_workers > 1 && !sm->deterministic)
 689         feature_name = is_inside ?  "snat-in2out-worker-handoff" : "snat-out2in-worker-handoff";
 690       else if (sm->deterministic)
 691         feature_name = is_inside ?  "snat-det-in2out" : "snat-det-out2in";
 692       else
 693         feature_name = is_inside ?  "snat-in2out" : "snat-out2in";
 694     }
 695
 696   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
 697                                !is_del, 0, 0);
 698
 699   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 700     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, 0);
 701
 702   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 703     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
 704
 705   pool_foreach (i, sm->interfaces,
 706   ({
 707     if (i->sw_if_index == sw_if_index)
 708       {
 709         if (is_del)
 710           pool_put (sm->interfaces, i);
 711         else
 712           return VNET_API_ERROR_VALUE_EXIST;
 713
 714         goto fib;
 715       }
 716   }));
 717
 718   if (is_del)
 719     return VNET_API_ERROR_NO_SUCH_ENTRY;
 720
 721   pool_get (sm->interfaces, i);
 722   i->sw_if_index = sw_if_index;
 723   i->is_inside = is_inside;
 724
 725   /* Add/delete external addresses to FIB */
 726 fib:
 727   if (is_inside)
 728     return 0;
 729
 730   vec_foreach (ap, sm->addresses)
 731     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
 732
 733   pool_foreach (m, sm->static_mappings,
 734   ({
 735     if (!(m->addr_only))
 736       continue;
 737
 738     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
 739   }));
 740
 741   pool_foreach (dm, sm->det_maps,
 742   ({
 743     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
 744   }));
 745
 746   return 0;
 747 }
 748
 749 int snat_set_workers (uword * bitmap)
 750 {
 751   snat_main_t *sm = &snat_main;
 752   int i;
 753
 754   if (sm->num_workers < 2)
 755     return VNET_API_ERROR_FEATURE_DISABLED;
 756
 757   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
 758     return VNET_API_ERROR_INVALID_WORKER;
 759
 760   vec_free (sm->workers);
 761   clib_bitmap_foreach (i, bitmap,
 762     ({
 763       vec_add1(sm->workers, i);
 764     }));
 765
 766   return 0;
 767 }
 768
 769
 770 static void
 771 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
 772                                        uword opaque,
 773                                        u32 sw_if_index,
 774                                        ip4_address_t * address,
 775                                        u32 address_length,
 776                                        u32 if_address_index,
 777                                        u32 is_delete);
 778
 779 static clib_error_t * snat_init (vlib_main_t * vm)
 780 {
 781   snat_main_t * sm = &snat_main;
 782   clib_error_t * error = 0;
 783   ip4_main_t * im = &ip4_main;
 784   ip_lookup_main_t * lm = &im->lookup_main;
 785   uword *p;
 786   vlib_thread_registration_t *tr;
 787   vlib_thread_main_t *tm = vlib_get_thread_main ();
 788   uword *bitmap = 0;
 789   u32 i;
 790   ip4_add_del_interface_address_callback_t cb4;
 791
 792   sm->vlib_main = vm;
 793   sm->vnet_main = vnet_get_main();
 794   sm->ip4_main = im;
 795   sm->ip4_lookup_main = lm;
 796   sm->api_main = &api_main;
 797   sm->first_worker_index = 0;
 798   sm->next_worker = 0;
 799   sm->num_workers = 0;
 800   sm->workers = 0;
 801   sm->fq_in2out_index = ~0;
 802   sm->fq_out2in_index = ~0;
 803   sm->udp_timeout = SNAT_UDP_TIMEOUT;
 804   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
 805   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
 806   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
 807
 808   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
 809   if (p)
 810     {
 811       tr = (vlib_thread_registration_t *) p[0];
 812       if (tr)
 813         {
 814           sm->num_workers = tr->count;
 815           sm->first_worker_index = tr->first_index;
 816         }
 817     }
 818
 819   /* Use all available workers by default */
 820   if (sm->num_workers > 1)
 821     {
 822       for (i=0; i < sm->num_workers; i++)
 823         bitmap = clib_bitmap_set (bitmap, i, 1);
 824       snat_set_workers(bitmap);
 825       clib_bitmap_free (bitmap);
 826     }
 827
 828   error = snat_api_init(vm, sm);
 829   if (error)
 830     return error;
 831
 832   /* Set up the interface address add/del callback */
 833   cb4.function = snat_ip4_add_del_interface_address_cb;
 834   cb4.function_opaque = 0;
 835
 836   vec_add1 (im->add_del_interface_address_callbacks, cb4);
 837
 838   /* Init IPFIX logging */
 839   snat_ipfix_logging_init(vm);
 840
 841   error = nat64_init(vm);
 842
 843   return error;
 844 }
 845
 846 VLIB_INIT_FUNCTION (snat_init);
 847
 848 void snat_free_outside_address_and_port (snat_main_t * sm,
 849                                          snat_session_key_t * k,
 850                                          u32 address_index)
 851 {
 852   snat_address_t *a;
 853   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
 854
 855   ASSERT (address_index < vec_len (sm->addresses));
 856
 857   a = sm->addresses + address_index;
 858
 859   switch (k->protocol)
 860     {
 861 #define _(N, i, n, s) \
 862     case SNAT_PROTOCOL_##N: \
 863       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
 864         port_host_byte_order) == 1); \
 865       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
 866         port_host_byte_order, 0); \
 867       a->busy_##n##_ports--; \
 868       break;
 869       foreach_snat_protocol
 870 #undef _
 871     default:
 872       clib_warning("unknown_protocol");
 873       return;
 874     }
 875 }
 876
 877 /**
 878  * @brief Match SNAT static mapping.
 879  *
 880  * @param sm          SNAT main.
 881  * @param match       Address and port to match.
 882  * @param mapping     External or local address and port of the matched mapping.
 883  * @param by_external If 0 match by local address otherwise match by external
 884  *                    address.
 885  * @param is_addr_only If matched mapping is address only
 886  *
 887  * @returns 0 if match found otherwise 1.
 888  */
 889 int snat_static_mapping_match (snat_main_t * sm,
 890                                snat_session_key_t match,
 891                                snat_session_key_t * mapping,
 892                                u8 by_external,
 893                                u8 *is_addr_only)
 894 {
 895   clib_bihash_kv_8_8_t kv, value;
 896   snat_static_mapping_t *m;
 897   snat_session_key_t m_key;
 898   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
 899
 900   if (by_external)
 901     mapping_hash = &sm->static_mapping_by_external;
 902
 903   m_key.addr = match.addr;
 904   m_key.port = clib_net_to_host_u16 (match.port);
 905   m_key.protocol = match.protocol;
 906   m_key.fib_index = match.fib_index;
 907
 908   kv.key = m_key.as_u64;
 909
 910   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
 911     {
 912       /* Try address only mapping */
 913       m_key.port = 0;
 914       m_key.protocol = 0;
 915       kv.key = m_key.as_u64;
 916       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
 917         return 1;
 918     }
 919
 920   m = pool_elt_at_index (sm->static_mappings, value.value);
 921
 922   if (by_external)
 923     {
 924       mapping->addr = m->local_addr;
 925       /* Address only mapping doesn't change port */
 926       mapping->port = m->addr_only ? match.port
 927         : clib_host_to_net_u16 (m->local_port);
 928       mapping->fib_index = m->fib_index;
 929     }
 930   else
 931     {
 932       mapping->addr = m->external_addr;
 933       /* Address only mapping doesn't change port */
 934       mapping->port = m->addr_only ? match.port
 935         : clib_host_to_net_u16 (m->external_port);
 936       mapping->fib_index = sm->outside_fib_index;
 937     }
 938
 939   if (PREDICT_FALSE(is_addr_only != 0))
 940     *is_addr_only = m->addr_only;
 941
 942   return 0;
 943 }
 944
 945 int snat_alloc_outside_address_and_port (snat_main_t * sm,
 946                                          u32 fib_index,
 947                                          snat_session_key_t * k,
 948                                          u32 * address_indexp)
 949 {
 950   int i;
 951   snat_address_t *a;
 952   u32 portnum;
 953
 954   for (i = 0; i < vec_len (sm->addresses); i++)
 955     {
 956       a = sm->addresses + i;
 957       if (sm->vrf_mode && a->fib_index != ~0 && a->fib_index != fib_index)
 958         continue;
 959       switch (k->protocol)
 960         {
 961 #define _(N, j, n, s) \
 962         case SNAT_PROTOCOL_##N: \
 963           if (a->busy_##n##_ports < (65535-1024)) \
 964             { \
 965               while (1) \
 966                 { \
 967                   portnum = random_u32 (&sm->random_seed); \
 968                   portnum &= 0xFFFF; \
 969                   if (portnum < 1024) \
 970                     continue; \
 971                   if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
 972                     continue; \
 973                   clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
 974                   a->busy_##n##_ports++; \
 975                   k->addr = a->addr; \
 976                   k->port = clib_host_to_net_u16(portnum); \
 977                   *address_indexp = i; \
 978                   return 0; \
 979                 } \
 980             } \
 981           break;
 982           foreach_snat_protocol
 983 #undef _
 984         default:
 985           clib_warning("unknown protocol");
 986           return 1;
 987         }
 988
 989     }
 990   /* Totally out of translations to use... */
 991   snat_ipfix_logging_addresses_exhausted(0);
 992   return 1;
 993 }
 994
 995
 996 static clib_error_t *
 997 add_address_command_fn (vlib_main_t * vm,
 998                         unformat_input_t * input,
 999                         vlib_cli_command_t * cmd)
1000 {
1001   unformat_input_t _line_input, *line_input = &_line_input;
1002   snat_main_t * sm = &snat_main;
1003   ip4_address_t start_addr, end_addr, this_addr;
1004   u32 start_host_order, end_host_order;
1005   u32 vrf_id = ~0;
1006   int i, count;
1007   int is_add = 1;
1008   int rv = 0;
1009   clib_error_t *error = 0;
1010
1011   /* Get a line of input. */
1012   if (!unformat_user (input, unformat_line_input, line_input))
1013     return 0;
1014
1015   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1016     {
1017       if (unformat (line_input, "%U - %U",
1018                     unformat_ip4_address, &start_addr,
1019                     unformat_ip4_address, &end_addr))
1020         ;
1021       else if (unformat (line_input, "tenant-vrf %u", &vrf_id))
1022         ;
1023       else if (unformat (line_input, "%U", unformat_ip4_address, &start_addr))
1024         end_addr = start_addr;
1025       else if (unformat (line_input, "del"))
1026         is_add = 0;
1027       else
1028         {
1029           error = clib_error_return (0, "unknown input '%U'",
1030             format_unformat_error, line_input);
1031           goto done;
1032         }
1033      }
1034
1035   if (sm->static_mapping_only)
1036     {
1037       error = clib_error_return (0, "static mapping only mode");
1038       goto done;
1039     }
1040
1041   start_host_order = clib_host_to_net_u32 (start_addr.as_u32);
1042   end_host_order = clib_host_to_net_u32 (end_addr.as_u32);
1043
1044   if (end_host_order < start_host_order)
1045     {
1046       error = clib_error_return (0, "end address less than start address");
1047       goto done;
1048     }
1049
1050   count = (end_host_order - start_host_order) + 1;
1051
1052   if (count > 1024)
1053     clib_warning ("%U - %U, %d addresses...",
1054                   format_ip4_address, &start_addr,
1055                   format_ip4_address, &end_addr,
1056                   count);
1057
1058   this_addr = start_addr;
1059
1060   for (i = 0; i < count; i++)
1061     {
1062       if (is_add)
1063         snat_add_address (sm, &this_addr, vrf_id);
1064       else
1065         rv = snat_del_address (sm, this_addr, 0);
1066
1067       switch (rv)
1068         {
1069         case VNET_API_ERROR_NO_SUCH_ENTRY:
1070           error = clib_error_return (0, "S-NAT address not exist.");
1071           goto done;
1072         case VNET_API_ERROR_UNSPECIFIED:
1073           error = clib_error_return (0, "S-NAT address used in static mapping.");
1074           goto done;
1075         default:
1076           break;
1077         }
1078
1079       increment_v4_address (&this_addr);
1080     }
1081
1082 done:
1083   unformat_free (line_input);
1084
1085   return error;
1086 }
1087
1088 VLIB_CLI_COMMAND (add_address_command, static) = {
1089   .path = "snat add address",
1090   .short_help = "snat add addresses <ip4-range-start> [- <ip4-range-end>] "
1091                 "[tenant-vrf <vrf-id>] [del]",
1092   .function = add_address_command_fn,
1093 };
1094
1095 static clib_error_t *
1096 snat_feature_command_fn (vlib_main_t * vm,
1097                           unformat_input_t * input,
1098                           vlib_cli_command_t * cmd)
1099 {
1100   unformat_input_t _line_input, *line_input = &_line_input;
1101   vnet_main_t * vnm = vnet_get_main();
1102   clib_error_t * error = 0;
1103   u32 sw_if_index;
1104   u32 * inside_sw_if_indices = 0;
1105   u32 * outside_sw_if_indices = 0;
1106   int is_del = 0;
1107   int i;
1108
1109   sw_if_index = ~0;
1110
1111   /* Get a line of input. */
1112   if (!unformat_user (input, unformat_line_input, line_input))
1113     return 0;
1114
1115   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1116     {
1117       if (unformat (line_input, "in %U", unformat_vnet_sw_interface,
1118                     vnm, &sw_if_index))
1119         vec_add1 (inside_sw_if_indices, sw_if_index);
1120       else if (unformat (line_input, "out %U", unformat_vnet_sw_interface,
1121                          vnm, &sw_if_index))
1122         vec_add1 (outside_sw_if_indices, sw_if_index);
1123       else if (unformat (line_input, "del"))
1124         is_del = 1;
1125       else
1126         {
1127           error = clib_error_return (0, "unknown input '%U'",
1128             format_unformat_error, line_input);
1129           goto done;
1130         }
1131     }
1132
1133   if (vec_len (inside_sw_if_indices))
1134     {
1135       for (i = 0; i < vec_len(inside_sw_if_indices); i++)
1136         {
1137           sw_if_index = inside_sw_if_indices[i];
1138           snat_interface_add_del (sw_if_index, 1, is_del);
1139         }
1140     }
1141
1142   if (vec_len (outside_sw_if_indices))
1143     {
1144       for (i = 0; i < vec_len(outside_sw_if_indices); i++)
1145         {
1146           sw_if_index = outside_sw_if_indices[i];
1147           snat_interface_add_del (sw_if_index, 0, is_del);
1148         }
1149     }
1150
1151 done:
1152   unformat_free (line_input);
1153   vec_free (inside_sw_if_indices);
1154   vec_free (outside_sw_if_indices);
1155
1156   return error;
1157 }
1158
1159 VLIB_CLI_COMMAND (set_interface_snat_command, static) = {
1160   .path = "set interface snat",
1161   .function = snat_feature_command_fn,
1162   .short_help = "set interface snat in <intfc> out <intfc> [del]",
1163 };
1164
1165 uword
1166 unformat_snat_protocol (unformat_input_t * input, va_list * args)
1167 {
1168   u32 *r = va_arg (*args, u32 *);
1169
1170   if (0);
1171 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
1172   foreach_snat_protocol
1173 #undef _
1174   else
1175     return 0;
1176   return 1;
1177 }
1178
1179 u8 *
1180 format_snat_protocol (u8 * s, va_list * args)
1181 {
1182   u32 i = va_arg (*args, u32);
1183   u8 *t = 0;
1184
1185   switch (i)
1186     {
1187 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
1188       foreach_snat_protocol
1189 #undef _
1190     default:
1191       s = format (s, "unknown");
1192     }
1193   s = format (s, "%s", t);
1194   return s;
1195 }
1196
1197 static clib_error_t *
1198 add_static_mapping_command_fn (vlib_main_t * vm,
1199                                unformat_input_t * input,
1200                                vlib_cli_command_t * cmd)
1201 {
1202   unformat_input_t _line_input, *line_input = &_line_input;
1203   clib_error_t * error = 0;
1204   ip4_address_t l_addr, e_addr;
1205   u32 l_port = 0, e_port = 0, vrf_id = ~0;
1206   int is_add = 1;
1207   int addr_only = 1;
1208   u32 sw_if_index = ~0;
1209   vnet_main_t * vnm = vnet_get_main();
1210   int rv;
1211   snat_protocol_t proto;
1212   u8 proto_set = 0;
1213
1214   /* Get a line of input. */
1215   if (!unformat_user (input, unformat_line_input, line_input))
1216     return 0;
1217
1218   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1219     {
1220       if (unformat (line_input, "local %U %u", unformat_ip4_address, &l_addr,
1221                     &l_port))
1222         addr_only = 0;
1223       else if (unformat (line_input, "local %U", unformat_ip4_address, &l_addr))
1224         ;
1225       else if (unformat (line_input, "external %U %u", unformat_ip4_address,
1226                          &e_addr, &e_port))
1227         addr_only = 0;
1228       else if (unformat (line_input, "external %U", unformat_ip4_address,
1229                          &e_addr))
1230         ;
1231       else if (unformat (line_input, "external %U %u",
1232                          unformat_vnet_sw_interface, vnm, &sw_if_index,
1233                          &e_port))
1234         addr_only = 0;
1235
1236       else if (unformat (line_input, "external %U",
1237                          unformat_vnet_sw_interface, vnm, &sw_if_index))
1238         ;
1239       else if (unformat (line_input, "vrf %u", &vrf_id))
1240         ;
1241       else if (unformat (line_input, "%U", unformat_snat_protocol, &proto))
1242         proto_set = 1;
1243       else if (unformat (line_input, "del"))
1244         is_add = 0;
1245       else
1246         {
1247           error = clib_error_return (0, "unknown input: '%U'",
1248             format_unformat_error, line_input);
1249           goto done;
1250         }
1251     }
1252
1253   if (!addr_only && !proto_set)
1254     {
1255       error = clib_error_return (0, "missing protocol");
1256       goto done;
1257     }
1258
1259   rv = snat_add_static_mapping(l_addr, e_addr, (u16) l_port, (u16) e_port,
1260                                vrf_id, addr_only, sw_if_index, proto, is_add);
1261
1262   switch (rv)
1263     {
1264     case VNET_API_ERROR_INVALID_VALUE:
1265       error = clib_error_return (0, "External port already in use.");
1266       goto done;
1267     case VNET_API_ERROR_NO_SUCH_ENTRY:
1268       if (is_add)
1269         error = clib_error_return (0, "External addres must be allocated.");
1270       else
1271         error = clib_error_return (0, "Mapping not exist.");
1272       goto done;
1273     case VNET_API_ERROR_NO_SUCH_FIB:
1274       error = clib_error_return (0, "No such VRF id.");
1275       goto done;
1276     case VNET_API_ERROR_VALUE_EXIST:
1277       error = clib_error_return (0, "Mapping already exist.");
1278       goto done;
1279     default:
1280       break;
1281     }
1282
1283 done:
1284   unformat_free (line_input);
1285
1286   return error;
1287 }
1288
1289 /*?
1290  * @cliexpar
1291  * @cliexstart{snat add static mapping}
1292  * Static mapping allows hosts on the external network to initiate connection
1293  * to to the local network host.
1294  * To create static mapping between local host address 10.0.0.3 port 6303 and
1295  * external address 4.4.4.4 port 3606 for TCP protocol use:
1296  *  vpp# snat add static mapping local tcp 10.0.0.3 6303 external 4.4.4.4 3606
1297  * If not runnig "static mapping only" S-NAT plugin mode use before:
1298  *  vpp# snat add address 4.4.4.4
1299  * To create static mapping between local and external address use:
1300  *  vpp# snat add static mapping local 10.0.0.3 external 4.4.4.4
1301  * @cliexend
1302 ?*/
1303 VLIB_CLI_COMMAND (add_static_mapping_command, static) = {
1304   .path = "snat add static mapping",
1305   .function = add_static_mapping_command_fn,
1306   .short_help =
1307     "snat add static mapping local tcp|udp|icmp <addr> [<port>] external <addr> [<port>] [vrf <table-id>] [del]",
1308 };
1309
1310 static clib_error_t *
1311 set_workers_command_fn (vlib_main_t * vm,
1312                         unformat_input_t * input,
1313                         vlib_cli_command_t * cmd)
1314 {
1315   unformat_input_t _line_input, *line_input = &_line_input;
1316   uword *bitmap = 0;
1317   int rv = 0;
1318   clib_error_t *error = 0;
1319
1320   /* Get a line of input. */
1321   if (!unformat_user (input, unformat_line_input, line_input))
1322     return 0;
1323
1324   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1325     {
1326       if (unformat (line_input, "%U", unformat_bitmap_list, &bitmap))
1327         ;
1328       else
1329         {
1330           error = clib_error_return (0, "unknown input '%U'",
1331             format_unformat_error, line_input);
1332           goto done;
1333         }
1334      }
1335
1336   if (bitmap == 0)
1337     {
1338       error = clib_error_return (0, "List of workers must be specified.");
1339       goto done;
1340     }
1341
1342   rv = snat_set_workers(bitmap);
1343
1344   clib_bitmap_free (bitmap);
1345
1346   switch (rv)
1347     {
1348     case VNET_API_ERROR_INVALID_WORKER:
1349       error = clib_error_return (0, "Invalid worker(s).");
1350       goto done;
1351     case VNET_API_ERROR_FEATURE_DISABLED:
1352       error = clib_error_return (0,
1353         "Supported only if 2 or more workes available.");
1354       goto done;
1355     default:
1356       break;
1357     }
1358
1359 done:
1360   unformat_free (line_input);
1361
1362   return error;
1363 }
1364
1365 /*?
1366  * @cliexpar
1367  * @cliexstart{set snat workers}
1368  * Set SNAT workers if 2 or more workers available, use:
1369  *  vpp# set snat workers 0-2,5
1370  * @cliexend
1371 ?*/
1372 VLIB_CLI_COMMAND (set_workers_command, static) = {
1373   .path = "set snat workers",
1374   .function = set_workers_command_fn,
1375   .short_help =
1376     "set snat workers <workers-list>",
1377 };
1378
1379 static clib_error_t *
1380 snat_ipfix_logging_enable_disable_command_fn (vlib_main_t * vm,
1381                                               unformat_input_t * input,
1382                                               vlib_cli_command_t * cmd)
1383 {
1384   unformat_input_t _line_input, *line_input = &_line_input;
1385   u32 domain_id = 0;
1386   u32 src_port = 0;
1387   u8 enable = 1;
1388   int rv = 0;
1389   clib_error_t *error = 0;
1390
1391   /* Get a line of input. */
1392   if (!unformat_user (input, unformat_line_input, line_input))
1393     return 0;
1394
1395   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1396     {
1397       if (unformat (line_input, "domain %d", &domain_id))
1398         ;
1399       else if (unformat (line_input, "src-port %d", &src_port))
1400         ;
1401       else if (unformat (line_input, "disable"))
1402         enable = 0;
1403       else
1404         {
1405           error = clib_error_return (0, "unknown input '%U'",
1406             format_unformat_error, line_input);
1407           goto done;
1408         }
1409      }
1410
1411   rv = snat_ipfix_logging_enable_disable (enable, domain_id, (u16) src_port);
1412
1413   if (rv)
1414     {
1415       error = clib_error_return (0, "ipfix logging enable failed");
1416       goto done;
1417     }
1418
1419 done:
1420   unformat_free (line_input);
1421
1422   return error;
1423 }
1424
1425 /*?
1426  * @cliexpar
1427  * @cliexstart{snat ipfix logging}
1428  * To enable SNAT IPFIX logging use:
1429  *  vpp# snat ipfix logging
1430  * To set IPFIX exporter use:
1431  *  vpp# set ipfix exporter collector 10.10.10.3 src 10.10.10.1
1432  * @cliexend
1433 ?*/
1434 VLIB_CLI_COMMAND (snat_ipfix_logging_enable_disable_command, static) = {
1435   .path = "snat ipfix logging",
1436   .function = snat_ipfix_logging_enable_disable_command_fn,
1437   .short_help = "snat ipfix logging [domain <domain-id>] [src-port <port>] [disable]",
1438 };
1439
1440 static u32
1441 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
1442 {
1443   snat_main_t *sm = &snat_main;
1444   snat_user_key_t key0;
1445   clib_bihash_kv_8_8_t kv0, value0;
1446   u32 next_worker_index = 0;
1447
1448   key0.addr = ip0->src_address;
1449   key0.fib_index = rx_fib_index0;
1450
1451   kv0.key = key0.as_u64;
1452
1453   /* Ever heard of of the "user" before? */
1454   if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv0, &value0))
1455     {
1456       /* No, assign next available worker (RR) */
1457       next_worker_index = sm->first_worker_index;
1458       if (vec_len (sm->workers))
1459         {
1460           next_worker_index +=
1461             sm->workers[sm->next_worker++ % _vec_len (sm->workers)];
1462         }
1463
1464       /* add non-traslated packets worker lookup */
1465       kv0.value = next_worker_index;
1466       clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv0, 1);
1467     }
1468   else
1469     next_worker_index = value0.value;
1470
1471   return next_worker_index;
1472 }
1473
1474 static u32
1475 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
1476 {
1477   snat_main_t *sm = &snat_main;
1478   snat_worker_key_t key0;
1479   clib_bihash_kv_8_8_t kv0, value0;
1480   udp_header_t * udp0;
1481   u32 next_worker_index = 0;
1482
1483   udp0 = ip4_next_header (ip0);
1484
1485   key0.addr = ip0->dst_address;
1486   key0.port = udp0->dst_port;
1487   key0.fib_index = rx_fib_index0;
1488
1489   if (PREDICT_FALSE(ip0->protocol == IP_PROTOCOL_ICMP))
1490     {
1491       icmp46_header_t * icmp0 = (icmp46_header_t *) udp0;
1492       icmp_echo_header_t *echo0 = (icmp_echo_header_t *)(icmp0+1);
1493       key0.port = echo0->identifier;
1494     }
1495
1496   kv0.key = key0.as_u64;
1497
1498   /* Ever heard of of the "user" before? */
1499   if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
1500     {
1501       key0.port = 0;
1502       kv0.key = key0.as_u64;
1503
1504       if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
1505         {
1506           /* No, assign next available worker (RR) */
1507           next_worker_index = sm->first_worker_index;
1508           if (vec_len (sm->workers))
1509             {
1510               next_worker_index +=
1511                 sm->workers[sm->next_worker++ % _vec_len (sm->workers)];
1512             }
1513         }
1514       else
1515         {
1516           /* Static mapping without port */
1517           next_worker_index = value0.value;
1518         }
1519
1520       /* Add to translated packets worker lookup */
1521       kv0.value = next_worker_index;
1522       clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv0, 1);
1523     }
1524   else
1525     next_worker_index = value0.value;
1526
1527   return next_worker_index;
1528 }
1529
1530 static clib_error_t *
1531 snat_config (vlib_main_t * vm, unformat_input_t * input)
1532 {
1533   snat_main_t * sm = &snat_main;
1534   u32 translation_buckets = 1024;
1535   u32 translation_memory_size = 128<<20;
1536   u32 user_buckets = 128;
1537   u32 user_memory_size = 64<<20;
1538   u32 max_translations_per_user = 100;
1539   u32 outside_vrf_id = 0;
1540   u32 inside_vrf_id = 0;
1541   u32 static_mapping_buckets = 1024;
1542   u32 static_mapping_memory_size = 64<<20;
1543   u8 static_mapping_only = 0;
1544   u8 static_mapping_connection_tracking = 0;
1545   vlib_thread_main_t *tm = vlib_get_thread_main ();
1546
1547   sm->deterministic = 0;
1548
1549   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1550     {
1551       if (unformat (input, "translation hash buckets %d", &translation_buckets))
1552         ;
1553       else if (unformat (input, "translation hash memory %d",
1554                          &translation_memory_size));
1555       else if (unformat (input, "user hash buckets %d", &user_buckets))
1556         ;
1557       else if (unformat (input, "user hash memory %d",
1558                          &user_memory_size))
1559         ;
1560       else if (unformat (input, "max translations per user %d",
1561                          &max_translations_per_user))
1562         ;
1563       else if (unformat (input, "outside VRF id %d",
1564                          &outside_vrf_id))
1565         ;
1566       else if (unformat (input, "inside VRF id %d",
1567                          &inside_vrf_id))
1568         ;
1569       else if (unformat (input, "static mapping only"))
1570         {
1571           static_mapping_only = 1;
1572           if (unformat (input, "connection tracking"))
1573             static_mapping_connection_tracking = 1;
1574         }
1575       else if (unformat (input, "deterministic"))
1576         sm->deterministic = 1;
1577       else
1578         return clib_error_return (0, "unknown input '%U'",
1579                                   format_unformat_error, input);
1580     }
1581
1582   /* for show commands, etc. */
1583   sm->translation_buckets = translation_buckets;
1584   sm->translation_memory_size = translation_memory_size;
1585   sm->user_buckets = user_buckets;
1586   sm->user_memory_size = user_memory_size;
1587   sm->max_translations_per_user = max_translations_per_user;
1588   sm->outside_vrf_id = outside_vrf_id;
1589   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1590                                                              outside_vrf_id);
1591   sm->inside_vrf_id = inside_vrf_id;
1592   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1593                                                             inside_vrf_id);
1594   sm->static_mapping_only = static_mapping_only;
1595   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
1596
1597   if (sm->deterministic)
1598     {
1599       sm->in2out_node_index = snat_det_in2out_node.index;
1600       sm->out2in_node_index = snat_det_out2in_node.index;
1601       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
1602       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
1603     }
1604   else
1605     {
1606       sm->worker_in2out_cb = snat_get_worker_in2out_cb;
1607       sm->worker_out2in_cb = snat_get_worker_out2in_cb;
1608       sm->in2out_node_index = snat_in2out_node.index;
1609       sm->out2in_node_index = snat_out2in_node.index;
1610       if (!static_mapping_only ||
1611           (static_mapping_only && static_mapping_connection_tracking))
1612         {
1613           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
1614           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
1615
1616           clib_bihash_init_8_8 (&sm->worker_by_in, "worker-by-in", user_buckets,
1617                                 user_memory_size);
1618
1619           clib_bihash_init_8_8 (&sm->worker_by_out, "worker-by-out", user_buckets,
1620                                 user_memory_size);
1621
1622           vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1623
1624           clib_bihash_init_8_8 (&sm->in2out, "in2out", translation_buckets,
1625                                 translation_memory_size);
1626
1627           clib_bihash_init_8_8 (&sm->out2in, "out2in", translation_buckets,
1628                                 translation_memory_size);
1629
1630           clib_bihash_init_8_8 (&sm->user_hash, "users", user_buckets,
1631                                 user_memory_size);
1632
1633           clib_bihash_init_16_8 (&sm->in2out_unk_proto, "in2out-unk-proto",
1634                                  translation_buckets, translation_memory_size);
1635
1636           clib_bihash_init_16_8 (&sm->out2in_unk_proto, "out2in-unk-proto",
1637                                  translation_buckets, translation_memory_size);
1638         }
1639       else
1640         {
1641           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
1642           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
1643         }
1644       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
1645                             "static_mapping_by_local", static_mapping_buckets,
1646                             static_mapping_memory_size);
1647
1648       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
1649                             "static_mapping_by_external", static_mapping_buckets,
1650                             static_mapping_memory_size);
1651     }
1652
1653   return 0;
1654 }
1655
1656 VLIB_CONFIG_FUNCTION (snat_config, "snat");
1657
1658 u8 * format_snat_session_state (u8 * s, va_list * args)
1659 {
1660   u32 i = va_arg (*args, u32);
1661   u8 *t = 0;
1662
1663   switch (i)
1664     {
1665 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
1666     foreach_snat_session_state
1667 #undef _
1668     default:
1669       t = format (t, "unknown");
1670     }
1671   s = format (s, "%s", t);
1672   return s;
1673 }
1674
1675 u8 * format_snat_key (u8 * s, va_list * args)
1676 {
1677   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
1678   char * protocol_string = "unknown";
1679   static char *protocol_strings[] = {
1680       "UDP",
1681       "TCP",
1682       "ICMP",
1683   };
1684
1685   if (key->protocol < ARRAY_LEN(protocol_strings))
1686       protocol_string = protocol_strings[key->protocol];
1687
1688   s = format (s, "%U proto %s port %d fib %d",
1689               format_ip4_address, &key->addr, protocol_string,
1690               clib_net_to_host_u16 (key->port), key->fib_index);
1691   return s;
1692 }
1693
1694 u8 * format_snat_session (u8 * s, va_list * args)
1695 {
1696   snat_main_t * sm __attribute__((unused)) = va_arg (*args, snat_main_t *);
1697   snat_session_t * sess = va_arg (*args, snat_session_t *);
1698
1699   if (snat_is_unk_proto_session (sess))
1700     {
1701       s = format (s, "  i2o %U proto %u fib %u\n",
1702                   format_ip4_address, &sess->in2out.addr, sess->in2out.port,
1703                   sess->in2out.fib_index);
1704       s = format (s, "    o2i %U proto %u fib %u\n",
1705                   format_ip4_address, &sess->out2in.addr, sess->out2in.port,
1706                   sess->out2in.fib_index);
1707     }
1708   else
1709     {
1710       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
1711       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
1712     }
1713   s = format (s, "       last heard %.2f\n", sess->last_heard);
1714   s = format (s, "       total pkts %d, total bytes %lld\n",
1715               sess->total_pkts, sess->total_bytes);
1716   if (snat_is_session_static (sess))
1717     s = format (s, "       static translation\n");
1718   else
1719     s = format (s, "       dynamic translation\n");
1720
1721   return s;
1722 }
1723
1724 u8 * format_snat_user (u8 * s, va_list * args)
1725 {
1726   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
1727   snat_user_t * u = va_arg (*args, snat_user_t *);
1728   int verbose = va_arg (*args, int);
1729   dlist_elt_t * head, * elt;
1730   u32 elt_index, head_index;
1731   u32 session_index;
1732   snat_session_t * sess;
1733
1734   s = format (s, "%U: %d dynamic translations, %d static translations\n",
1735               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
1736
1737   if (verbose == 0)
1738     return s;
1739
1740   if (u->nsessions || u->nstaticsessions)
1741     {
1742       head_index = u->sessions_per_user_list_head_index;
1743       head = pool_elt_at_index (sm->list_pool, head_index);
1744
1745       elt_index = head->next;
1746       elt = pool_elt_at_index (sm->list_pool, elt_index);
1747       session_index = elt->value;
1748
1749       while (session_index != ~0)
1750         {
1751           sess = pool_elt_at_index (sm->sessions, session_index);
1752
1753           s = format (s, "  %U\n", format_snat_session, sm, sess);
1754
1755           elt_index = elt->next;
1756           elt = pool_elt_at_index (sm->list_pool, elt_index);
1757           session_index = elt->value;
1758         }
1759     }
1760
1761   return s;
1762 }
1763
1764 u8 * format_snat_static_mapping (u8 * s, va_list * args)
1765 {
1766   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
1767
1768   if (m->addr_only)
1769       s = format (s, "local %U external %U vrf %d",
1770                   format_ip4_address, &m->local_addr,
1771                   format_ip4_address, &m->external_addr,
1772                   m->vrf_id);
1773   else
1774       s = format (s, "%U local %U:%d external %U:%d vrf %d",
1775                   format_snat_protocol, m->proto,
1776                   format_ip4_address, &m->local_addr, m->local_port,
1777                   format_ip4_address, &m->external_addr, m->external_port,
1778                   m->vrf_id);
1779
1780   return s;
1781 }
1782
1783 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
1784 {
1785   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
1786   vnet_main_t *vnm = vnet_get_main();
1787
1788   if (m->addr_only)
1789       s = format (s, "local %U external %U vrf %d",
1790                   format_ip4_address, &m->l_addr,
1791                   format_vnet_sw_interface_name, vnm,
1792                   vnet_get_sw_interface (vnm, m->sw_if_index),
1793                   m->vrf_id);
1794   else
1795       s = format (s, "%U local %U:%d external %U:%d vrf %d",
1796                   format_snat_protocol, m->proto,
1797                   format_ip4_address, &m->l_addr, m->l_port,
1798                   format_vnet_sw_interface_name, vnm,
1799                   vnet_get_sw_interface (vnm, m->sw_if_index), m->e_port,
1800                   m->vrf_id);
1801
1802   return s;
1803 }
1804
1805 u8 * format_det_map_ses (u8 * s, va_list * args)
1806 {
1807   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
1808   ip4_address_t in_addr, out_addr;
1809   u32 in_offset, out_offset;
1810   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
1811   u32 * i = va_arg (*args, u32 *);
1812
1813   u32 user_index = *i / SNAT_DET_SES_PER_USER;
1814   in_addr.as_u32 = clib_host_to_net_u32 (
1815     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
1816   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
1817     clib_net_to_host_u32(det_map->in_addr.as_u32);
1818   out_offset = in_offset / det_map->sharing_ratio;
1819   out_addr.as_u32 = clib_host_to_net_u32(
1820     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
1821   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
1822               format_ip4_address, &in_addr,
1823               clib_net_to_host_u16 (ses->in_port),
1824               format_ip4_address, &out_addr,
1825               clib_net_to_host_u16 (ses->out.out_port),
1826               format_ip4_address, &ses->out.ext_host_addr,
1827               clib_net_to_host_u16 (ses->out.ext_host_port),
1828               format_snat_session_state, ses->state,
1829               ses->expire);
1830
1831   return s;
1832 }
1833
1834 static clib_error_t *
1835 show_snat_command_fn (vlib_main_t * vm,
1836                  unformat_input_t * input,
1837                  vlib_cli_command_t * cmd)
1838 {
1839   int verbose = 0;
1840   snat_main_t * sm = &snat_main;
1841   snat_user_t * u;
1842   snat_static_mapping_t *m;
1843   snat_interface_t *i;
1844   snat_address_t * ap;
1845   vnet_main_t *vnm = vnet_get_main();
1846   snat_main_per_thread_data_t *tsm;
1847   u32 users_num = 0, sessions_num = 0, *worker, *sw_if_index;
1848   uword j = 0;
1849   snat_static_map_resolve_t *rp;
1850   snat_det_map_t * dm;
1851   snat_det_session_t * ses;
1852
1853   if (unformat (input, "detail"))
1854     verbose = 1;
1855   else if (unformat (input, "verbose"))
1856     verbose = 2;
1857
1858   if (sm->static_mapping_only)
1859     {
1860       if (sm->static_mapping_connection_tracking)
1861         vlib_cli_output (vm, "SNAT mode: static mapping only connection "
1862                          "tracking");
1863       else
1864         vlib_cli_output (vm, "SNAT mode: static mapping only");
1865     }
1866   else if (sm->deterministic)
1867     {
1868       vlib_cli_output (vm, "SNAT mode: deterministic mapping");
1869     }
1870   else
1871     {
1872       vlib_cli_output (vm, "SNAT mode: dynamic translations enabled");
1873     }
1874
1875   if (verbose > 0)
1876     {
1877       pool_foreach (i, sm->interfaces,
1878       ({
1879         vlib_cli_output (vm, "%U %s", format_vnet_sw_interface_name, vnm,
1880                          vnet_get_sw_interface (vnm, i->sw_if_index),
1881                          i->is_inside ? "in" : "out");
1882       }));
1883
1884       if (vec_len (sm->auto_add_sw_if_indices))
1885         {
1886           vlib_cli_output (vm, "SNAT pool addresses interfaces:");
1887           vec_foreach (sw_if_index, sm->auto_add_sw_if_indices)
1888             {
1889               vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
1890                                vnet_get_sw_interface (vnm, *sw_if_index));
1891             }
1892         }
1893
1894       vec_foreach (ap, sm->addresses)
1895         {
1896           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
1897           if (ap->fib_index != ~0)
1898               vlib_cli_output (vm, "  tenant VRF: %u",
1899                                ip4_fib_get(ap->fib_index)->table_id);
1900           else
1901             vlib_cli_output (vm, "  tenant VRF independent");
1902 #define _(N, i, n, s) \
1903           vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
1904           foreach_snat_protocol
1905 #undef _
1906         }
1907     }
1908
1909   if (sm->num_workers > 1)
1910     {
1911       vlib_cli_output (vm, "%d workers", vec_len (sm->workers));
1912       if (verbose > 0)
1913         {
1914           vec_foreach (worker, sm->workers)
1915             {
1916               vlib_worker_thread_t *w =
1917                 vlib_worker_threads + *worker + sm->first_worker_index;
1918               vlib_cli_output (vm, "  %s", w->name);
1919             }
1920         }
1921     }
1922
1923   if (sm->deterministic)
1924     {
1925       vlib_cli_output (vm, "udp timeout: %dsec", sm->udp_timeout);
1926       vlib_cli_output (vm, "tcp-established timeout: %dsec",
1927                        sm->tcp_established_timeout);
1928       vlib_cli_output (vm, "tcp-transitory timeout: %dsec",
1929                        sm->tcp_transitory_timeout);
1930       vlib_cli_output (vm, "icmp timeout: %dsec", sm->icmp_timeout);
1931       vlib_cli_output (vm, "%d deterministic mappings",
1932                        pool_elts (sm->det_maps));
1933       if (verbose > 0)
1934         {
1935           pool_foreach (dm, sm->det_maps,
1936           ({
1937             vlib_cli_output (vm, "in %U/%d out %U/%d\n",
1938                              format_ip4_address, &dm->in_addr, dm->in_plen,
1939                              format_ip4_address, &dm->out_addr, dm->out_plen);
1940             vlib_cli_output (vm, " outside address sharing ratio: %d\n",
1941                              dm->sharing_ratio);
1942             vlib_cli_output (vm, " number of ports per inside host: %d\n",
1943                              dm->ports_per_host);
1944             vlib_cli_output (vm, " sessions number: %d\n", dm->ses_num);
1945             if (verbose > 1)
1946               {
1947                 vec_foreach_index (j, dm->sessions)
1948                   {
1949                     ses = vec_elt_at_index (dm->sessions, j);
1950                     if (ses->in_port)
1951                       vlib_cli_output (vm, "  %U", format_det_map_ses, dm, ses,
1952                                        &j);
1953                   }
1954               }
1955           }));
1956         }
1957     }
1958   else
1959     {
1960       if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1961         {
1962           vlib_cli_output (vm, "%d static mappings",
1963                            pool_elts (sm->static_mappings));
1964
1965           if (verbose > 0)
1966             {
1967               pool_foreach (m, sm->static_mappings,
1968               ({
1969                 vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
1970               }));
1971             }
1972         }
1973       else
1974         {
1975           vec_foreach (tsm, sm->per_thread_data)
1976             {
1977               users_num += pool_elts (tsm->users);
1978               sessions_num += pool_elts (tsm->sessions);
1979             }
1980
1981           vlib_cli_output (vm, "%d users, %d outside addresses, %d active sessions,"
1982                            " %d static mappings",
1983                            users_num,
1984                            vec_len (sm->addresses),
1985                            sessions_num,
1986                            pool_elts (sm->static_mappings));
1987
1988           if (verbose > 0)
1989             {
1990               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->in2out,
1991                                verbose - 1);
1992               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->out2in,
1993                                verbose - 1);
1994               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->worker_by_in,
1995                                verbose - 1);
1996               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->worker_by_out,
1997                                verbose - 1);
1998               vec_foreach_index (j, sm->per_thread_data)
1999                 {
2000                   tsm = vec_elt_at_index (sm->per_thread_data, j);
2001
2002                   if (pool_elts (tsm->users) == 0)
2003                     continue;
2004
2005                   vlib_worker_thread_t *w = vlib_worker_threads + j;
2006                   vlib_cli_output (vm, "Thread %d (%s at lcore %u):", j, w->name,
2007                                    w->lcore_id);
2008                   vlib_cli_output (vm, "  %d list pool elements",
2009                                    pool_elts (tsm->list_pool));
2010
2011                   pool_foreach (u, tsm->users,
2012                   ({
2013                     vlib_cli_output (vm, "  %U", format_snat_user, tsm, u,
2014                                      verbose - 1);
2015                   }));
2016                 }
2017
2018               if (pool_elts (sm->static_mappings))
2019                 {
2020                   vlib_cli_output (vm, "static mappings:");
2021                   pool_foreach (m, sm->static_mappings,
2022                   ({
2023                     vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2024                   }));
2025                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2026                     {
2027                       rp = sm->to_resolve + j;
2028                       vlib_cli_output (vm, "%U",
2029                                        format_snat_static_map_to_resolve, rp);
2030                     }
2031                 }
2032             }
2033         }
2034     }
2035   return 0;
2036 }
2037
2038 VLIB_CLI_COMMAND (show_snat_command, static) = {
2039     .path = "show snat",
2040     .short_help = "show snat",
2041     .function = show_snat_command_fn,
2042 };
2043
2044
2045 static void
2046 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2047                                        uword opaque,
2048                                        u32 sw_if_index,
2049                                        ip4_address_t * address,
2050                                        u32 address_length,
2051                                        u32 if_address_index,
2052                                        u32 is_delete)
2053 {
2054   snat_main_t *sm = &snat_main;
2055   snat_static_map_resolve_t *rp;
2056   u32 *indices_to_delete = 0;
2057   int i, j;
2058   int rv;
2059
2060   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2061     {
2062       if (sw_if_index == sm->auto_add_sw_if_indices[i])
2063         {
2064           if (!is_delete)
2065             {
2066               /* Don't trip over lease renewal, static config */
2067               for (j = 0; j < vec_len(sm->addresses); j++)
2068                 if (sm->addresses[j].addr.as_u32 == address->as_u32)
2069                   return;
2070
2071               snat_add_address (sm, address, ~0);
2072               /* Scan static map resolution vector */
2073               for (j = 0; j < vec_len (sm->to_resolve); j++)
2074                 {
2075                   rp = sm->to_resolve + j;
2076                   /* On this interface? */
2077                   if (rp->sw_if_index == sw_if_index)
2078                     {
2079                       /* Add the static mapping */
2080                       rv = snat_add_static_mapping (rp->l_addr,
2081                                                     address[0],
2082                                                     rp->l_port,
2083                                                     rp->e_port,
2084                                                     rp->vrf_id,
2085                                                     rp->addr_only,
2086                                                     ~0 /* sw_if_index */,
2087                                                     rp->proto,
2088                                                     rp->is_add);
2089                       if (rv)
2090                         clib_warning ("snat_add_static_mapping returned %d",
2091                                       rv);
2092                       vec_add1 (indices_to_delete, j);
2093                     }
2094                 }
2095               /* If we resolved any of the outstanding static mappings */
2096               if (vec_len(indices_to_delete))
2097                 {
2098                   /* Delete them */
2099                   for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2100                     vec_delete(sm->to_resolve, 1, j);
2101                   vec_free(indices_to_delete);
2102                 }
2103               return;
2104             }
2105           else
2106             {
2107               (void) snat_del_address(sm, address[0], 1);
2108               return;
2109             }
2110         }
2111     }
2112 }
2113
2114
2115 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
2116 {
2117   ip4_main_t * ip4_main = sm->ip4_main;
2118   ip4_address_t * first_int_addr;
2119   snat_static_map_resolve_t *rp;
2120   u32 *indices_to_delete = 0;
2121   int i, j;
2122
2123   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
2124                                                 0 /* just want the address*/);
2125
2126   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2127     {
2128       if (sm->auto_add_sw_if_indices[i] == sw_if_index)
2129         {
2130           if (is_del)
2131             {
2132               /* if have address remove it */
2133               if (first_int_addr)
2134                   (void) snat_del_address (sm, first_int_addr[0], 1);
2135               else
2136                 {
2137                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2138                     {
2139                       rp = sm->to_resolve + j;
2140                       if (rp->sw_if_index == sw_if_index)
2141                         vec_add1 (indices_to_delete, j);
2142                     }
2143                   if (vec_len(indices_to_delete))
2144                     {
2145                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2146                         vec_del1(sm->to_resolve, j);
2147                       vec_free(indices_to_delete);
2148                     }
2149                 }
2150               vec_del1(sm->auto_add_sw_if_indices, i);
2151             }
2152           else
2153             return VNET_API_ERROR_VALUE_EXIST;
2154
2155           return 0;
2156         }
2157     }
2158
2159   if (is_del)
2160     return VNET_API_ERROR_NO_SUCH_ENTRY;
2161
2162   /* add to the auto-address list */
2163   vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
2164
2165   /* If the address is already bound - or static - add it now */
2166   if (first_int_addr)
2167       snat_add_address (sm, first_int_addr, ~0);
2168
2169   return 0;
2170 }
2171
2172 static clib_error_t *
2173 snat_add_interface_address_command_fn (vlib_main_t * vm,
2174                                        unformat_input_t * input,
2175                                        vlib_cli_command_t * cmd)
2176 {
2177   snat_main_t *sm = &snat_main;
2178   unformat_input_t _line_input, *line_input = &_line_input;
2179   u32 sw_if_index;
2180   int rv;
2181   int is_del = 0;
2182   clib_error_t *error = 0;
2183
2184   /* Get a line of input. */
2185   if (!unformat_user (input, unformat_line_input, line_input))
2186     return 0;
2187
2188   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2189     {
2190       if (unformat (line_input, "%U", unformat_vnet_sw_interface,
2191                     sm->vnet_main, &sw_if_index))
2192         ;
2193       else if (unformat (line_input, "del"))
2194         is_del = 1;
2195       else
2196         {
2197           error = clib_error_return (0, "unknown input '%U'",
2198                                      format_unformat_error, line_input);
2199           goto done;
2200         }
2201     }
2202
2203   rv = snat_add_interface_address (sm, sw_if_index, is_del);
2204
2205   switch (rv)
2206     {
2207     case 0:
2208       break;
2209
2210     default:
2211       error = clib_error_return (0, "snat_add_interface_address returned %d",
2212                                  rv);
2213       goto done;
2214     }
2215
2216 done:
2217   unformat_free (line_input);
2218
2219   return error;
2220 }
2221
2222 VLIB_CLI_COMMAND (snat_add_interface_address_command, static) = {
2223     .path = "snat add interface address",
2224     .short_help = "snat add interface address <interface> [del]",
2225     .function = snat_add_interface_address_command_fn,
2226 };
2227
2228 static clib_error_t *
2229 snat_det_map_command_fn (vlib_main_t * vm,
2230                          unformat_input_t * input,
2231                          vlib_cli_command_t * cmd)
2232 {
2233   snat_main_t *sm = &snat_main;
2234   unformat_input_t _line_input, *line_input = &_line_input;
2235   ip4_address_t in_addr, out_addr;
2236   u32 in_plen, out_plen;
2237   int is_add = 1, rv;
2238   clib_error_t *error = 0;
2239
2240   /* Get a line of input. */
2241   if (!unformat_user (input, unformat_line_input, line_input))
2242     return 0;
2243
2244   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2245     {
2246       if (unformat (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
2247         ;
2248       else if (unformat (line_input, "out %U/%u", unformat_ip4_address, &out_addr, &out_plen))
2249         ;
2250       else if (unformat (line_input, "del"))
2251         is_add = 0;
2252       else
2253         {
2254           error = clib_error_return (0, "unknown input '%U'",
2255                                      format_unformat_error, line_input);
2256           goto done;
2257         }
2258     }
2259
2260   unformat_free (line_input);
2261
2262   rv = snat_det_add_map(sm, &in_addr, (u8) in_plen, &out_addr, (u8)out_plen,
2263                         is_add);
2264
2265   if (rv)
2266     {
2267       error = clib_error_return (0, "snat_det_add_map return %d", rv);
2268       goto done;
2269     }
2270
2271 done:
2272   unformat_free (line_input);
2273
2274   return error;
2275 }
2276
2277 /*?
2278  * @cliexpar
2279  * @cliexstart{snat deterministic add}
2280  * Create bijective mapping of inside address to outside address and port range
2281  * pairs, with the purpose of enabling deterministic NAT to reduce logging in
2282  * CGN deployments.
2283  * To create deterministic mapping between inside network 10.0.0.0/18 and
2284  * outside network 1.1.1.0/30 use:
2285  * # vpp# snat deterministic add in 10.0.0.0/18 out 1.1.1.0/30
2286  * @cliexend
2287 ?*/
2288 VLIB_CLI_COMMAND (snat_det_map_command, static) = {
2289     .path = "snat deterministic add",
2290     .short_help = "snat deterministic add in <addr>/<plen> out <addr>/<plen> [del]",
2291     .function = snat_det_map_command_fn,
2292 };
2293
2294 static clib_error_t *
2295 snat_det_forward_command_fn (vlib_main_t * vm,
2296                              unformat_input_t * input,
2297                              vlib_cli_command_t * cmd)
2298 {
2299   snat_main_t *sm = &snat_main;
2300   unformat_input_t _line_input, *line_input = &_line_input;
2301   ip4_address_t in_addr, out_addr;
2302   u16 lo_port;
2303   snat_det_map_t * dm;
2304   clib_error_t *error = 0;
2305
2306   /* Get a line of input. */
2307   if (!unformat_user (input, unformat_line_input, line_input))
2308     return 0;
2309
2310   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2311     {
2312       if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
2313         ;
2314       else
2315         {
2316           error = clib_error_return (0, "unknown input '%U'",
2317                                      format_unformat_error, line_input);
2318           goto done;
2319         }
2320     }
2321
2322   unformat_free (line_input);
2323
2324   dm = snat_det_map_by_user(sm, &in_addr);
2325   if (!dm)
2326     vlib_cli_output (vm, "no match");
2327   else
2328     {
2329       snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
2330       vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
2331                        lo_port, lo_port + dm->ports_per_host - 1);
2332     }
2333
2334 done:
2335   unformat_free (line_input);
2336
2337   return error;
2338 }
2339
2340 /*?
2341  * @cliexpar
2342  * @cliexstart{snat deterministic forward}
2343  * Return outside address and port range from inside address for deterministic
2344  * NAT.
2345  * To obtain outside address and port of inside host use:
2346  *  vpp# snat deterministic forward 10.0.0.2
2347  *  1.1.1.0:<1054-1068>
2348  * @cliexend
2349 ?*/
2350 VLIB_CLI_COMMAND (snat_det_forward_command, static) = {
2351     .path = "snat deterministic forward",
2352     .short_help = "snat deterministic forward <addr>",
2353     .function = snat_det_forward_command_fn,
2354 };
2355
2356 static clib_error_t *
2357 snat_det_reverse_command_fn (vlib_main_t * vm,
2358                              unformat_input_t * input,
2359                              vlib_cli_command_t * cmd)
2360 {
2361   snat_main_t *sm = &snat_main;
2362   unformat_input_t _line_input, *line_input = &_line_input;
2363   ip4_address_t in_addr, out_addr;
2364   u32 out_port;
2365   snat_det_map_t * dm;
2366   clib_error_t *error = 0;
2367
2368   /* Get a line of input. */
2369   if (!unformat_user (input, unformat_line_input, line_input))
2370     return 0;
2371
2372   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2373     {
2374       if (unformat (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
2375         ;
2376       else
2377         {
2378           error =  clib_error_return (0, "unknown input '%U'",
2379                                       format_unformat_error, line_input);
2380         }
2381     }
2382
2383   unformat_free (line_input);
2384
2385   if (out_port < 1024 || out_port > 65535)
2386     {
2387       error = clib_error_return (0, "wrong port, must be <1024-65535>");
2388       goto done;
2389     }
2390
2391   dm = snat_det_map_by_out(sm, &out_addr);
2392   if (!dm)
2393     vlib_cli_output (vm, "no match");
2394   else
2395     {
2396       snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr);
2397       vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
2398     }
2399
2400 done:
2401   unformat_free (line_input);
2402
2403   return error;
2404 }
2405
2406 /*?
2407  * @cliexpar
2408  * @cliexstart{snat deterministic reverse}
2409  * Return inside address from outside address and port for deterministic NAT.
2410  * To obtain inside host address from outside address and port use:
2411  *  #vpp snat deterministic reverse 1.1.1.1:1276
2412  *  10.0.16.16
2413  * @cliexend
2414 ?*/
2415 VLIB_CLI_COMMAND (snat_det_reverse_command, static) = {
2416     .path = "snat deterministic reverse",
2417     .short_help = "snat deterministic reverse <addr>:<port>",
2418     .function = snat_det_reverse_command_fn,
2419 };
2420
2421 static clib_error_t *
2422 set_timeout_command_fn (vlib_main_t * vm,
2423                         unformat_input_t * input,
2424                         vlib_cli_command_t * cmd)
2425 {
2426   snat_main_t *sm = &snat_main;
2427   unformat_input_t _line_input, *line_input = &_line_input;
2428   clib_error_t *error = 0;
2429
2430   /* Get a line of input. */
2431   if (!unformat_user (input, unformat_line_input, line_input))
2432     return 0;
2433
2434   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2435     {
2436       if (unformat (line_input, "udp %u", &sm->udp_timeout))
2437         ;
2438       else if (unformat (line_input, "tcp-established %u",
2439                &sm->tcp_established_timeout))
2440         ;
2441       else if (unformat (line_input, "tcp-transitory %u",
2442                &sm->tcp_transitory_timeout))
2443         ;
2444       else if (unformat (line_input, "icmp %u", &sm->icmp_timeout))
2445         ;
2446       else if (unformat (line_input, "reset"))
2447         {
2448           sm->udp_timeout = SNAT_UDP_TIMEOUT;
2449           sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
2450           sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
2451           sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
2452         }
2453       else
2454         {
2455           error = clib_error_return (0, "unknown input '%U'",
2456                                      format_unformat_error, line_input);
2457           goto done;
2458         }
2459     }
2460
2461   unformat_free (line_input);
2462
2463 done:
2464   unformat_free (line_input);
2465
2466   return error;
2467 }
2468
2469 /*?
2470  * @cliexpar
2471  * @cliexstart{set snat deterministic timeout}
2472  * Set values of timeouts for deterministic NAT (in seconds), use:
2473  *  vpp# set snat deterministic timeout udp 120 tcp-established 7500
2474  *  tcp-transitory 250 icmp 90
2475  * To reset default values use:
2476  *  vpp# set snat deterministic timeout reset
2477  * @cliexend
2478 ?*/
2479 VLIB_CLI_COMMAND (set_timeout_command, static) = {
2480   .path = "set snat deterministic timeout",
2481   .function = set_timeout_command_fn,
2482   .short_help =
2483     "set snat deterministic timeout [udp <sec> | tcp-established <sec> "
2484     "tcp-transitory <sec> | icmp <sec> | reset]",
2485 };
2486
2487 static clib_error_t *
2488 snat_det_close_session_out_fn (vlib_main_t *vm,
2489                                unformat_input_t * input,
2490                                vlib_cli_command_t * cmd)
2491 {
2492   snat_main_t *sm = &snat_main;
2493   unformat_input_t _line_input, *line_input = &_line_input;
2494   ip4_address_t out_addr, ext_addr, in_addr;
2495   u16 out_port, ext_port;
2496   snat_det_map_t * dm;
2497   snat_det_session_t * ses;
2498   snat_det_out_key_t key;
2499   clib_error_t *error = 0;
2500
2501   /* Get a line of input. */
2502   if (!unformat_user (input, unformat_line_input, line_input))
2503     return 0;
2504
2505   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2506     {
2507       if (unformat (line_input, "%U:%d %U:%d",
2508                     unformat_ip4_address, &out_addr, &out_port,
2509                     unformat_ip4_address, &ext_addr, &ext_port))
2510         ;
2511       else
2512         {
2513           error = clib_error_return (0, "unknown input '%U'",
2514                                      format_unformat_error, line_input);
2515           goto done;
2516         }
2517     }
2518
2519   unformat_free (line_input);
2520
2521   dm = snat_det_map_by_out(sm, &out_addr);
2522   if (!dm)
2523     vlib_cli_output (vm, "no match");
2524   else
2525     {
2526       snat_det_reverse(dm, &ext_addr, out_port, &in_addr);
2527       key.ext_host_addr = out_addr;
2528       key.ext_host_port = ntohs(ext_port);
2529       key.out_port = ntohs(out_port);
2530       ses = snat_det_get_ses_by_out(dm, &out_addr, key.as_u64);
2531       if (!ses)
2532         vlib_cli_output (vm, "no match");
2533       else
2534        snat_det_ses_close(dm, ses);
2535     }
2536
2537 done:
2538   unformat_free (line_input);
2539
2540   return error;
2541 }
2542
2543 /*?
2544  * @cliexpar
2545  * @cliexstart{snat deterministic close session out}
2546  * Close session using outside ip address and port
2547  * and external ip address and port, use:
2548  *  vpp# snat deterministic close session out 1.1.1.1:1276 2.2.2.2:2387
2549  * @cliexend
2550 ?*/
2551 VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = {
2552   .path = "snat deterministic close session out",
2553   .short_help = "snat deterministic close session out "
2554                 "<out_addr>:<out_port> <ext_addr>:<ext_port>",
2555   .function = snat_det_close_session_out_fn,
2556 };
2557
2558 static clib_error_t *
2559 snat_det_close_session_in_fn (vlib_main_t *vm,
2560                               unformat_input_t * input,
2561                               vlib_cli_command_t * cmd)
2562 {
2563   snat_main_t *sm = &snat_main;
2564   unformat_input_t _line_input, *line_input = &_line_input;
2565   ip4_address_t in_addr, ext_addr;
2566   u16 in_port, ext_port;
2567   snat_det_map_t * dm;
2568   snat_det_session_t * ses;
2569   snat_det_out_key_t key;
2570   clib_error_t *error = 0;
2571
2572   /* Get a line of input. */
2573   if (!unformat_user (input, unformat_line_input, line_input))
2574     return 0;
2575
2576   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2577     {
2578       if (unformat (line_input, "%U:%d %U:%d",
2579                     unformat_ip4_address, &in_addr, &in_port,
2580                     unformat_ip4_address, &ext_addr, &ext_port))
2581         ;
2582       else
2583         {
2584           error = clib_error_return (0, "unknown input '%U'",
2585                                      format_unformat_error, line_input);
2586           goto done;
2587         }
2588     }
2589
2590   unformat_free (line_input);
2591
2592   dm = snat_det_map_by_user (sm, &in_addr);
2593   if (!dm)
2594     vlib_cli_output (vm, "no match");
2595   else
2596     {
2597       key.ext_host_addr = ext_addr;
2598       key.ext_host_port = ntohs (ext_port);
2599       ses = snat_det_find_ses_by_in (dm, &in_addr, ntohs(in_port), key);
2600       if (!ses)
2601         vlib_cli_output (vm, "no match");
2602       else
2603         snat_det_ses_close(dm, ses);
2604     }
2605
2606 done:
2607   unformat_free(line_input);
2608
2609   return error;
2610 }
2611
2612 /*?
2613  * @cliexpar
2614  * @cliexstart{snat deterministic close_session_in}
2615  * Close session using inside ip address and port
2616  * and external ip address and port, use:
2617  *  vpp# snat deterministic close session in 3.3.3.3:3487 2.2.2.2:2387
2618  * @cliexend
2619 ?*/
2620 VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = {
2621   .path = "snat deterministic close session in",
2622   .short_help = "snat deterministic close session in "
2623                 "<in_addr>:<in_port> <ext_addr>:<ext_port>",
2624   .function = snat_det_close_session_in_fn,
2625 };