+/* NAT API Logging Levels */
+#define foreach_nat_log_level \
+ _(0x00, LOG_NONE) \
+ _(0x01, LOG_ERROR) \
+ _(0x02, LOG_WARNING) \
+ _(0x03, LOG_NOTICE) \
+ _(0x04, LOG_INFO) \
+ _(0x05, LOG_DEBUG)
+
+typedef enum nat_log_level_t_
+{
+#define _(n,f) SNAT_##f = n,
+ foreach_nat_log_level
+#undef _
+} nat_log_level_t;
+
+#define nat_elog(_level, _str) \
+do \
+ { \
+ snat_main_t *sm = &snat_main; \
+ if (PREDICT_FALSE (sm->log_level >= _level)) \
+ { \
+ ELOG_TYPE_DECLARE (e) = \
+ { \
+ .format = "nat-msg " _str, \
+ .format_args = "", \
+ }; \
+ ELOG_DATA (&sm->vlib_main->elog_main, e); \
+ } \
+ } while (0);
+
+#define nat_elog_addr(_level, _str, _addr) \
+do \
+ { \
+ if (PREDICT_FALSE (sm->log_level >= _level)) \
+ { \
+ ELOG_TYPE_DECLARE (e) = \
+ { \
+ .format = "nat-msg " _str " %d.%d.%d.%d", \
+ .format_args = "i1i1i1i1", \
+ }; \
+ CLIB_PACKED(struct \
+ { \
+ u8 oct1; \
+ u8 oct2; \
+ u8 oct3; \
+ u8 oct4; \
+ }) *ed; \
+ ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
+ ed->oct4 = _addr >> 24; \
+ ed->oct3 = _addr >> 16; \
+ ed->oct2 = _addr >> 8; \
+ ed->oct1 = _addr; \
+ } \
+ } while (0);
+
+#define nat_elog_debug_handoff(_str, _tid, _fib, _src, _dst) \
+do \
+ { \
+ if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG)) \
+ { \
+ ELOG_TYPE_DECLARE (e) = \
+ { \
+ .format = "nat-msg " _str " ip src: %d.%d.%d.%d dst: %d.%d.%d.%d" \
+ " tid from: %d to: %d fib: %d", \
+ .format_args = "i1i1i1i1i1i1i1i1i4i4i4", \
+ }; \
+ CLIB_PACKED(struct \
+ { \
+ u8 src_oct1; \
+ u8 src_oct2; \
+ u8 src_oct3; \
+ u8 src_oct4; \
+ u8 dst_oct1; \
+ u8 dst_oct2; \
+ u8 dst_oct3; \
+ u8 dst_oct4; \
+ u32 ftid; \
+ u32 ttid; \
+ u32 fib; \
+ }) *ed; \
+ ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
+ ed->src_oct1 = _src >> 24; \
+ ed->src_oct2 = _src >> 16; \
+ ed->src_oct3 = _src >> 8; \
+ ed->src_oct4 = _src; \
+ ed->dst_oct1 = _dst >> 24; \
+ ed->dst_oct2 = _dst >> 16; \
+ ed->dst_oct3 = _dst >> 8; \
+ ed->dst_oct4 = _dst; \
+ ed->ftid = vlib_get_thread_index (); \
+ ed->ttid = _tid; \
+ ed->fib = _fib; \
+ } \
+ } while (0);
+
+#define nat_elog_debug_handoff_v2(_str, _prt, _fib, _src, _dst) \
+do \
+ { \
+ if (PREDICT_FALSE (sm->log_level >= SNAT_LOG_DEBUG)) \
+ { \
+ ELOG_TYPE_DECLARE (e) = \
+ { \
+ .format = "nat-msg " _str " ip_src:%d.%d.%d.%d ip_dst:%d.%d.%d.%d" \
+ " tid:%d prt:%d fib:%d", \
+ .format_args = "i1i1i1i1i1i1i1i1i4i4i4", \
+ }; \
+ CLIB_PACKED(struct \
+ { \
+ u8 src_oct1; \
+ u8 src_oct2; \
+ u8 src_oct3; \
+ u8 src_oct4; \
+ u8 dst_oct1; \
+ u8 dst_oct2; \
+ u8 dst_oct3; \
+ u8 dst_oct4; \
+ u32 tid; \
+ u32 prt; \
+ u32 fib; \
+ }) *ed; \
+ ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
+ ed->src_oct1 = _src >> 24; \
+ ed->src_oct2 = _src >> 16; \
+ ed->src_oct3 = _src >> 8; \
+ ed->src_oct4 = _src; \
+ ed->dst_oct1 = _dst >> 24; \
+ ed->dst_oct2 = _dst >> 16; \
+ ed->dst_oct3 = _dst >> 8; \
+ ed->dst_oct4 = _dst; \
+ ed->tid = vlib_get_thread_index (); \
+ ed->prt = _prt; \
+ ed->fib = _fib; \
+ } \
+ } while (0);
+
+#define nat_elog_X1(_level, _fmt, _arg, _val1) \
+do \
+ { \
+ snat_main_t *sm = &snat_main; \
+ if (PREDICT_FALSE (sm->log_level >= _level)) \
+ { \
+ ELOG_TYPE_DECLARE (e) = \
+ { \
+ .format = "nat-msg " _fmt, \
+ .format_args = _arg, \
+ }; \
+ CLIB_PACKED(struct \
+ { \
+ typeof (_val1) val1; \
+ }) *ed; \
+ ed = ELOG_DATA (&sm->vlib_main->elog_main, e); \
+ ed->val1 = _val1; \
+ } \
+ } while (0);
+
+#define nat_elog_notice(nat_elog_str) \
+ nat_elog(SNAT_LOG_INFO, "[notice] " nat_elog_str)
+#define nat_elog_warn(nat_elog_str) \
+ nat_elog(SNAT_LOG_WARNING, "[warning] " nat_elog_str)
+#define nat_elog_err(nat_elog_str) \
+ nat_elog(SNAT_LOG_ERROR, "[error] " nat_elog_str)
+#define nat_elog_debug(nat_elog_str) \
+ nat_elog(SNAT_LOG_DEBUG, "[debug] " nat_elog_str)
+#define nat_elog_info(nat_elog_str) \
+ nat_elog(SNAT_LOG_INFO, "[info] " nat_elog_str)
+
+#define nat_elog_notice_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
+ nat_elog_X1(SNAT_LOG_NOTICE, "[notice] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
+#define nat_elog_warn_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
+ nat_elog_X1(SNAT_LOG_WARNING, "[warning] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
+#define nat_elog_err_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
+ nat_elog_X1(SNAT_LOG_ERROR, "[error] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
+#define nat_elog_debug_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
+ nat_elog_X1(SNAT_LOG_DEBUG, "[debug] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
+#define nat_elog_info_X1(nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1) \
+ nat_elog_X1(SNAT_LOG_INFO, "[info] " nat_elog_fmt_str, nat_elog_fmt_arg, nat_elog_val1)
+
+/* ICMP session match functions */
+u32 icmp_match_in2out_fast (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+u32 icmp_match_in2out_slow (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+u32 icmp_match_out2in_fast (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+u32 icmp_match_out2in_slow (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+
+/* ICMP deterministic NAT session match functions */
+u32 icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+u32 icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+
+/* ICMP endpoint-dependent session match functions */
+u32 icmp_match_out2in_ed (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+u32 icmp_match_in2out_ed (snat_main_t * sm, vlib_node_runtime_t * node,
+ u32 thread_index, vlib_buffer_t * b0,
+ ip4_header_t * ip0, u8 * p_proto,
+ snat_session_key_t * p_value,
+ u8 * p_dont_translate, void *d, void *e);
+
+u32 icmp_in2out (snat_main_t * sm, vlib_buffer_t * b0, ip4_header_t * ip0,
+ icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
+ vlib_node_runtime_t * node, u32 next0, u32 thread_index,
+ void *d, void *e);
+
+u32 icmp_out2in (snat_main_t * sm, vlib_buffer_t * b0, ip4_header_t * ip0,
+ icmp46_header_t * icmp0, u32 sw_if_index0, u32 rx_fib_index0,
+ vlib_node_runtime_t * node, u32 next0, u32 thread_index,
+ void *d, void *e);
+
+/* hairpinning functions */
+u32 snat_icmp_hairpinning (snat_main_t * sm, vlib_buffer_t * b0,
+ ip4_header_t * ip0, icmp46_header_t * icmp0,
+ int is_ed);
+void nat_hairpinning_sm_unknown_proto (snat_main_t * sm, vlib_buffer_t * b,
+ ip4_header_t * ip);
+void nat44_ed_hairpinning_unknown_proto (snat_main_t * sm, vlib_buffer_t * b,
+ ip4_header_t * ip);
+int snat_hairpinning (snat_main_t * sm, vlib_buffer_t * b0,
+ ip4_header_t * ip0, udp_header_t * udp0,
+ tcp_header_t * tcp0, u32 proto0, int is_ed);
+
+/* Call back functions for clib_bihash_add_or_overwrite_stale */
+int nat44_i2o_ed_is_idle_session_cb (clib_bihash_kv_16_8_t * kv, void *arg);
+int nat44_o2i_ed_is_idle_session_cb (clib_bihash_kv_16_8_t * kv, void *arg);
+int nat44_i2o_is_idle_session_cb (clib_bihash_kv_8_8_t * kv, void *arg);
+int nat44_o2i_is_idle_session_cb (clib_bihash_kv_8_8_t * kv, void *arg);
+
+/**
+ * @brief Add external address to NAT44 pool
+ *
+ * @param addr IPv4 address
+ * @param vrf_id VRF id of tenant, ~0 means independent of VRF
+ * @param twice_nat 1 if twice NAT address
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_add_address (snat_main_t * sm, ip4_address_t * addr, u32 vrf_id,
+ u8 twice_nat);
+
+/**
+ * @brief Delete external address from NAT44 pool
+ *
+ * @param addr IPv4 address
+ * @param delete_sm 1 if delete static mapping using address
+ * @param twice_nat 1 if twice NAT address
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
+ u8 twice_nat);
+
+/**
+ * @brief Add/delete external address to FIB DPO (out2in DPO mode)
+ *
+ * @param addr IPv4 address
+ * @param is_add 1 = add, 0 = delete
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+void nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add);
+
+/**
+ * @brief Add/delete NAT44 static mapping
+ *
+ * @param l_addr local IPv4 address
+ * @param e_addr external IPv4 address
+ * @param l_port local port number
+ * @param e_port external port number
+ * @param vrf_id local VRF ID
+ * @param addr_only 1 = 1:1NAT, 0 = 1:1NAPT
+ * @param sw_if_index use interface address as external IPv4 address
+ * @param proto L4 protocol
+ * @param is_add 1 = add, 0 = delete
+ * @param twice_nat twice-nat mode
+ * @param out2in_only if 1 rule match only out2in direction
+ * @param tag opaque string tag
+ * @param identity_nat identity NAT
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr,
+ u16 l_port, u16 e_port, u32 vrf_id,
+ int addr_only, u32 sw_if_index,
+ snat_protocol_t proto, int is_add,
+ twice_nat_type_t twice_nat, u8 out2in_only,
+ u8 * tag, u8 identity_nat);
+
+/**
+ * @brief Add/delete static mapping with load-balancing (multiple backends)
+ *
+ * @param e_addr external IPv4 address
+ * @param e_port external port number
+ * @param proto L4 protocol
+ * @param locals list of local backends
+ * @param is_add 1 = add, 0 = delete
+ * @param twice_nat twice-nat mode
+ * @param out2in_only if 1 rule match only out2in direction
+ * @param tag opaque string tag
+ * @param affinity 0 = disabled, otherwise client IP affinity sticky time
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
+ snat_protocol_t proto,
+ nat44_lb_addr_port_t * locals, u8 is_add,
+ twice_nat_type_t twice_nat,
+ u8 out2in_only, u8 * tag, u32 affinity);
+
+int nat44_lb_static_mapping_add_del_local (ip4_address_t e_addr, u16 e_port,
+ ip4_address_t l_addr, u16 l_port,
+ snat_protocol_t proto, u32 vrf_id,
+ u8 probability, u8 is_add);
+
+clib_error_t *snat_api_init (vlib_main_t * vm, snat_main_t * sm);
+
+/**
+ * @brief Set NAT plugin workers
+ *
+ * @param bitmap NAT workers bitmap
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_set_workers (uword * bitmap);
+
+/**
+ * @brief Enable/disable NAT44 feature on the interface
+ *
+ * @param sw_if_index software index of the interface
+ * @param is_inside 1 = inside, 0 = outside
+ * @param is_del 1 = delete, 0 = add
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del);
+
+/**
+ * @brief Enable/disable NAT44 output feature on the interface (postrouting NAT)
+ *
+ * @param sw_if_index software index of the interface
+ * @param is_inside 1 = inside, 0 = outside
+ * @param is_del 1 = delete, 0 = add
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_interface_add_del_output_feature (u32 sw_if_index, u8 is_inside,
+ int is_del);
+
+/**
+ * @brief Add/delete NAT44 pool address from specific interfce
+ *
+ * @param sw_if_index software index of the interface
+ * @param is_del 1 = delete, 0 = add
+ * @param twice_nat 1 = twice NAT address for extenal hosts
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
+ u8 twice_nat);
+
+/**
+ * @brief Delete NAT44 session
+ *
+ * @param addr IPv4 address
+ * @param port L4 port number
+ * @param proto L4 protocol
+ * @param vrf_id VRF ID
+ * @param is_in 1 = inside network address and port pair, 0 = outside
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int nat44_del_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
+ snat_protocol_t proto, u32 vrf_id, int is_in);
+
+/**
+ * @brief Delete NAT44 endpoint-dependent session
+ *
+ * @param addr IPv4 address
+ * @param port L4 port number
+ * @param proto L4 protocol
+ * @param vrf_id VRF ID
+ * @param is_in 1 = inside network address and port pair, 0 = outside
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
+ ip4_address_t * eh_addr, u16 eh_port, u8 proto,
+ u32 vrf_id, int is_in);
+
+/**
+ * @brief Free NAT44 session data (lookup keys, external addrres port)
+ *
+ * @param s NAT session
+ * @param thread_index thread index
+ * @param is_ha is HA event
+ */
+void nat_free_session_data (snat_main_t * sm, snat_session_t * s,
+ u32 thread_index, u8 is_ha);
+
+/**
+ * @brief Free NAT44 ED session data (lookup keys, external addrres port)
+ *
+ * @param s NAT session
+ * @param thread_index thread index
+ * @param is_ha is HA event
+ */
+void
+nat44_free_session_data (snat_main_t * sm, snat_session_t * s,
+ u32 thread_index, u8 is_ha);
+/**
+ * @brief Find or create NAT user
+ *
+ * @param addr IPv4 address
+ * @param fib_index FIB table index
+ * @param thread_index thread index
+ *
+ * @return NAT user data structure on success otherwise zero value
+ */
+snat_user_t *nat_user_get_or_create (snat_main_t * sm,
+ ip4_address_t * addr, u32 fib_index,
+ u32 thread_index);
+
+/**
+ * @brief Allocate new NAT session or recycle last used
+ *
+ * @param u NAT user
+ * @param thread_index thread index
+ *
+ * @return session data structure on success otherwise zero value
+ */
+snat_session_t *nat_session_alloc_or_recycle (snat_main_t * sm,
+ snat_user_t * u,
+ u32 thread_index, f64 now);
+
+/**
+ * @brief Allocate NAT endpoint-dependent session
+ *
+ * @param u NAT user
+ * @param thread_index thread index
+ *
+ * @return session data structure on success otherwise zero value
+ */
+snat_session_t *nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u,
+ u32 thread_index, f64 now);
+
+/**
+ * @brief Set address and port assignment algorithm for MAP-E CE
+ *
+ * @param psid Port Set Identifier value
+ * @param psid_offset number of offset bits
+ * @param psid_length length of PSID
+ */
+void nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset,
+ u16 psid_length);
+
+/**
+ * @brief Set address and port assignment algorithm for port range
+ *
+ * @param start_port beginning of the port range
+ * @param end_port end of the port range
+ */
+void nat_set_alloc_addr_and_port_range (u16 start_port, u16 end_port);
+
+/**
+ * @brief Set address and port assignment algorithm to default/standard
+ */
+void nat_set_alloc_addr_and_port_default (void);
+
+/**
+ * @brief Free outside address and port pair
+ *
+ * @param addresses vector of outside addresses
+ * @param thread_index thread index
+ * @param k address, port and protocol
+ */
+void snat_free_outside_address_and_port (snat_address_t * addresses,
+ u32 thread_index,
+ snat_session_key_t * k);
+
+/**
+ * @brief Alloc outside address and port
+ *
+ * @param addresses vector of outside addresses
+ * @param fib_index FIB table index
+ * @param thread_index thread index
+ * @param k allocated address and port pair
+ * @param port_per_thread number of ports per threead
+ * @param snat_thread_index NAT thread index
+ *
+ * @return 0 on success, non-zero value otherwise
+ */
+int snat_alloc_outside_address_and_port (snat_address_t * addresses,
+ u32 fib_index,
+ u32 thread_index,
+ snat_session_key_t * k,
+ u16 port_per_thread,
+ u32 snat_thread_index);
+
+/**
+ * @brief Match NAT44 static mapping.
+ *
+ * @param match address and port to match
+ * @param mapping external/local address and port of the matched mapping
+ * @param by_external if 0 match by local address otherwise match by external
+ * address
+ * @param is_addr_only 1 if matched mapping is address only
+ * @param twice_nat matched mapping is twice NAT type
+ * @param lb 1 if matched mapping is load-balanced
+ * @param ext_host_addr external host address
+ *
+ * @returns 0 if match found otherwise 1.
+ */
+int snat_static_mapping_match (snat_main_t * sm,
+ snat_session_key_t match,
+ snat_session_key_t * mapping,
+ u8 by_external,
+ u8 * is_addr_only,
+ twice_nat_type_t * twice_nat,
+ lb_nat_type_t * lb,
+ ip4_address_t * ext_host_addr,
+ u8 * is_identity_nat);
+
+/**
+ * @brief Add/del NAT address to FIB.
+ *
+ * Add the external NAT address to the FIB as receive entries. This ensures
+ * that VPP will reply to ARP for this address and we don't need to enable
+ * proxy ARP on the outside interface.
+ *
+ * @param addr IPv4 address
+ * @param plen address prefix length
+ * @param sw_if_index software index of the outside interface
+ * @param is_add 0 = delete, 1 = add.
+ */
+void snat_add_del_addr_to_fib (ip4_address_t * addr,
+ u8 p_len, u32 sw_if_index, int is_add);
+