#include <nat/nat_ipfix_logging.h>
#include <nat/nat_reass.h>
#include <nat/nat_inlines.h>
+#include <nat/nat_syslog.h>
-#define foreach_nat_in2out_ed_error \
-_(UNSUPPORTED_PROTOCOL, "Unsupported protocol") \
-_(IN2OUT_PACKETS, "Good in2out packets processed") \
-_(OUT_OF_PORTS, "Out of ports") \
+#define foreach_nat_in2out_ed_error \
+_(UNSUPPORTED_PROTOCOL, "unsupported protocol") \
+_(IN2OUT_PACKETS, "good in2out packets processed") \
+_(OUT_OF_PORTS, "out of ports") \
_(BAD_ICMP_TYPE, "unsupported ICMP type") \
-_(MAX_SESSIONS_EXCEEDED, "Maximum sessions exceeded") \
-_(DROP_FRAGMENT, "Drop fragment") \
-_(MAX_REASS, "Maximum reassemblies exceeded") \
-_(MAX_FRAG, "Maximum fragments per reassembly exceeded")
+_(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \
+_(DROP_FRAGMENT, "drop fragment") \
+_(MAX_REASS, "maximum reassemblies exceeded") \
+_(MAX_FRAG, "maximum fragments per reassembly exceeded")\
+_(NON_SYN, "non-SYN packet try to create session") \
+_(TCP_PACKETS, "TCP packets") \
+_(UDP_PACKETS, "UDP packets") \
+_(ICMP_PACKETS, "ICMP packets") \
+_(OTHER_PACKETS, "other protocol packets") \
+_(FRAGMENTS, "fragments") \
+_(CACHED_FRAGMENTS, "cached fragments") \
+_(PROCESSED_FRAGMENTS, "processed fragments")
+
typedef enum
{
s->out2in.port,
s->in2out.fib_index);
+ nat_syslog_nat44_sdel (s->user_index, s->in2out.fib_index,
+ &s->in2out.addr, s->in2out.port,
+ &s->ext_host_nat_addr, s->ext_host_nat_port,
+ &s->out2in.addr, s->out2in.port,
+ &s->ext_host_addr, s->ext_host_port,
+ s->in2out.protocol, is_twice_nat_session (s));
+
if (is_twice_nat_session (s))
{
for (i = 0; i < vec_len (sm->twice_nat_addresses); i++)
u32 rx_fib_index,
clib_bihash_kv_16_8_t * kv,
snat_session_t ** sessionp,
- vlib_node_runtime_t * node, u32 next, u32 thread_index, f64 now)
+ vlib_node_runtime_t * node, u32 next, u32 thread_index, f64 now,
+ tcp_header_t * tcp)
{
snat_session_t *s = 0;
snat_user_t *u;
is_sm = 1;
}
+ if (proto == SNAT_PROTOCOL_TCP)
+ {
+ if (!tcp_is_init (tcp))
+ {
+ b->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ return NAT_IN2OUT_ED_NEXT_DROP;
+ }
+ }
+
u = nat_user_get_or_create (sm, &key->l_addr, rx_fib_index, thread_index);
if (!u)
{
s->in2out.protocol,
s->in2out.port,
s->out2in.port, s->in2out.fib_index);
+
+ nat_syslog_nat44_sadd (s->user_index, s->in2out.fib_index,
+ &s->in2out.addr, s->in2out.port,
+ &s->ext_host_nat_addr, s->ext_host_nat_port,
+ &s->out2in.addr, s->out2in.port,
+ &s->ext_host_addr, s->ext_host_port,
+ s->in2out.protocol, 0);
+
return next;
}
make_ed_kv (&kv, &ip->src_address, &ip->dst_address, proto, tx_fib_index,
src_port, dst_port);
if (!clib_bihash_search_16_8 (&tsm->out2in_ed, &kv, &value))
- return 1;
+ {
+ s = pool_elt_at_index (tsm->sessions, value.value);
+ if (nat44_is_ses_closed (s))
+ {
+ nat_log_debug ("TCP close connection %U", format_snat_session,
+ &sm->per_thread_data[thread_index], s);
+ nat_free_session_data (sm, s, thread_index);
+ nat44_delete_session (sm, s, thread_index);
+ }
+ else
+ s->flags |= SNAT_SESSION_FLAG_OUTPUT_FEATURE;
+ return 1;
+ }
/* dst NAT check */
make_ed_kv (&kv, &ip->dst_address, &ip->src_address, proto, rx_fib_index,
}
next = slow_path_ed (sm, b, rx_fib_index, &kv, &s, node, next,
- thread_index, vlib_time_now (sm->vlib_main));
+ thread_index, vlib_time_now (sm->vlib_main), 0);
if (PREDICT_FALSE (next == NAT_IN2OUT_ED_NEXT_DROP))
goto out;
f64 now = vlib_time_now (vm);
u32 thread_index = vm->thread_index;
snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+ u32 tcp_packets = 0, udp_packets = 0, icmp_packets = 0, other_packets =
+ 0, fragments = 0;
stats_node_index = is_slow_path ? nat44_ed_in2out_slowpath_node.index :
nat44_ed_in2out_node.index;
node);
if (!s0)
next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ other_packets++;
goto trace00;
}
next0 = icmp_in2out_ed_slow_path
(sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
next0, now, thread_index, &s0);
+ icmp_packets++;
goto trace00;
}
}
if (ip4_is_fragment (ip0))
{
next0 = NAT_IN2OUT_ED_NEXT_REASS;
+ fragments++;
goto trace00;
}
next0 =
slow_path_ed (sm, b0, rx_fib_index0, &kv0, &s0, node,
- next0, thread_index, now);
+ next0, thread_index, now, tcp0);
if (PREDICT_FALSE (next0 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace00;
}
mss_clamping (sm, tcp0, &sum0);
tcp0->checksum = ip_csum_fold (sum0);
+ tcp_packets++;
if (nat44_set_tcp_session_state_i2o
(sm, s0, tcp0, thread_index))
goto trace00;
udp0->dst_port = s0->ext_host_port;
ip0->dst_address.as_u32 = s0->ext_host_addr.as_u32;
}
+ udp_packets++;
}
/* Accounting */
t->session_index = s0 - tsm->sessions;
}
- pkts_processed += next0 != NAT_IN2OUT_ED_NEXT_DROP;
+ pkts_processed += next0 == NAT_IN2OUT_ED_NEXT_LOOKUP;
next1 = NAT_IN2OUT_ED_NEXT_LOOKUP;
node);
if (!s1)
next1 = NAT_IN2OUT_ED_NEXT_DROP;
+ other_packets++;
goto trace01;
}
next1 = icmp_in2out_ed_slow_path
(sm, b1, ip1, icmp1, sw_if_index1, rx_fib_index1, node,
next1, now, thread_index, &s1);
+ icmp_packets++;
goto trace01;
}
}
if (ip4_is_fragment (ip1))
{
next1 = NAT_IN2OUT_ED_NEXT_REASS;
+ fragments++;
goto trace01;
}
next1 =
slow_path_ed (sm, b1, rx_fib_index1, &kv1, &s1, node,
- next1, thread_index, now);
+ next1, thread_index, now, tcp1);
if (PREDICT_FALSE (next1 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace01;
}
tcp1->checksum = ip_csum_fold (sum1);
mss_clamping (sm, tcp1, &sum1);
+ tcp_packets++;
if (nat44_set_tcp_session_state_i2o
(sm, s1, tcp1, thread_index))
goto trace01;
udp1->dst_port = s1->ext_host_port;
ip1->dst_address.as_u32 = s1->ext_host_addr.as_u32;
}
+ udp_packets++;
}
/* Accounting */
t->session_index = s1 - tsm->sessions;
}
- pkts_processed += next1 != NAT_IN2OUT_ED_NEXT_DROP;
+ pkts_processed += next1 == NAT_IN2OUT_ED_NEXT_LOOKUP;
/* verify speculative enqueues, maybe switch current next frame */
vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
node);
if (!s0)
next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ other_packets++;
goto trace0;
}
next0 = icmp_in2out_ed_slow_path
(sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
next0, now, thread_index, &s0);
+ icmp_packets++;
goto trace0;
}
}
if (ip4_is_fragment (ip0))
{
next0 = NAT_IN2OUT_ED_NEXT_REASS;
+ fragments++;
goto trace0;
}
next0 =
slow_path_ed (sm, b0, rx_fib_index0, &kv0, &s0, node,
- next0, thread_index, now);
+ next0, thread_index, now, tcp0);
if (PREDICT_FALSE (next0 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace0;
}
mss_clamping (sm, tcp0, &sum0);
tcp0->checksum = ip_csum_fold (sum0);
+ tcp_packets++;
if (nat44_set_tcp_session_state_i2o
(sm, s0, tcp0, thread_index))
goto trace0;
udp0->dst_port = s0->ext_host_port;
ip0->dst_address.as_u32 = s0->ext_host_addr.as_u32;
}
+ udp_packets++;
}
/* Accounting */
t->session_index = s0 - tsm->sessions;
}
- pkts_processed += next0 != NAT_IN2OUT_ED_NEXT_DROP;
+ pkts_processed += next0 == NAT_IN2OUT_ED_NEXT_LOOKUP;
/* verify speculative enqueue, maybe switch current next frame */
vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
vlib_node_increment_counter (vm, stats_node_index,
NAT_IN2OUT_ED_ERROR_IN2OUT_PACKETS,
pkts_processed);
+ vlib_node_increment_counter (vm, stats_node_index,
+ NAT_IN2OUT_ED_ERROR_TCP_PACKETS, tcp_packets);
+ vlib_node_increment_counter (vm, stats_node_index,
+ NAT_IN2OUT_ED_ERROR_UDP_PACKETS, tcp_packets);
+ vlib_node_increment_counter (vm, stats_node_index,
+ NAT_IN2OUT_ED_ERROR_ICMP_PACKETS,
+ icmp_packets);
+ vlib_node_increment_counter (vm, stats_node_index,
+ NAT_IN2OUT_ED_ERROR_OTHER_PACKETS,
+ other_packets);
+ vlib_node_increment_counter (vm, stats_node_index,
+ NAT_IN2OUT_ED_ERROR_FRAGMENTS, fragments);
+
return frame->n_vectors;
}
{
u32 n_left_from, *from, *to_next;
nat_in2out_ed_next_t next_index;
- u32 pkts_processed = 0;
+ u32 pkts_processed = 0, cached_fragments = 0;
snat_main_t *sm = &snat_main;
f64 now = vlib_time_now (vm);
u32 thread_index = vm->thread_index;
}
next0 = slow_path_ed (sm, b0, rx_fib_index0, &kv0,
- &s0, node, next0, thread_index, now);
+ &s0, node, next0, thread_index, now,
+ tcp0);
if (PREDICT_FALSE (next0 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace0;
{
n_left_to_next++;
to_next--;
+ cached_fragments++;
}
else
{
}
vlib_node_increment_counter (vm, nat44_ed_in2out_reass_node.index,
- NAT_IN2OUT_ED_ERROR_IN2OUT_PACKETS,
+ NAT_IN2OUT_ED_ERROR_PROCESSED_FRAGMENTS,
pkts_processed);
+ vlib_node_increment_counter (vm, nat44_ed_in2out_reass_node.index,
+ NAT_IN2OUT_ED_ERROR_CACHED_FRAGMENTS,
+ cached_fragments);
nat_send_all_to_node (vm, fragments_to_drop, node,
&node->errors[NAT_IN2OUT_ED_ERROR_DROP_FRAGMENT],
Code Review / vpp.git / blobdiff