nat: fixed cli nat summary and nat limit
[vpp.git] / src / plugins / nat / nat.h
index 8b04e18..518f200 100644 (file)
@@ -68,21 +68,6 @@ typedef struct
   u32 arc_next_index;
 } nat_pre_trace_t;
 
-/* deterministic session outside key */
-typedef struct
-{
-  union
-  {
-    struct
-    {
-      ip4_address_t ext_host_addr;
-      u16 ext_host_port;
-      u16 out_port;
-    };
-    u64 as_u64;
-  };
-} snat_det_out_key_t;
-
 /* user (internal host) key */
 typedef struct
 {
@@ -150,22 +135,11 @@ typedef enum
 
 #define foreach_nat_in2out_ed_error                     \
 _(UNSUPPORTED_PROTOCOL, "unsupported protocol")         \
-_(IN2OUT_PACKETS, "good in2out packets processed")      \
 _(OUT_OF_PORTS, "out of ports")                         \
 _(BAD_ICMP_TYPE, "unsupported ICMP type")               \
 _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded")   \
-_(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \
-_(DROP_FRAGMENT, "drop fragment")                       \
-_(CANNOT_CREATE_USER, "cannot create NAT user")         \
 _(NON_SYN, "non-SYN packet try to create session")      \
-_(TCP_PACKETS, "TCP packets")                           \
-_(TCP_CLOSED, "drops due to TCP in transitory timeout") \
-_(UDP_PACKETS, "UDP packets")                           \
-_(ICMP_PACKETS, "ICMP packets")                         \
-_(OTHER_PACKETS, "other protocol packets")              \
-_(FRAGMENTS, "fragments")                               \
-_(CACHED_FRAGMENTS, "cached fragments")                 \
-_(PROCESSED_FRAGMENTS, "processed fragments")
+_(TCP_CLOSED, "drops due to TCP in transitory timeout")
 
 typedef enum
 {
@@ -177,23 +151,14 @@ typedef enum
 
 #define foreach_nat_out2in_ed_error                     \
 _(UNSUPPORTED_PROTOCOL, "unsupported protocol")         \
-_(OUT2IN_PACKETS, "good out2in packets processed")      \
 _(OUT_OF_PORTS, "out of ports")                         \
 _(BAD_ICMP_TYPE, "unsupported ICMP type")               \
 _(NO_TRANSLATION, "no translation")                     \
 _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded")   \
 _(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \
-_(DROP_FRAGMENT, "drop fragment")                       \
 _(CANNOT_CREATE_USER, "cannot create NAT user")         \
 _(NON_SYN, "non-SYN packet try to create session")      \
-_(TCP_PACKETS, "TCP packets")                           \
-_(TCP_CLOSED, "drops due to TCP in transitory timeout") \
-_(UDP_PACKETS, "UDP packets")                           \
-_(ICMP_PACKETS, "ICMP packets")                         \
-_(OTHER_PACKETS, "other protocol packets")              \
-_(FRAGMENTS, "fragments")                               \
-_(CACHED_FRAGMENTS, "cached fragments")                 \
-_(PROCESSED_FRAGMENTS, "processed fragments")
+_(TCP_CLOSED, "drops due to TCP in transitory timeout")
 
 typedef enum
 {
@@ -233,6 +198,20 @@ typedef enum
 #define NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT 4
 #define NAT_STATIC_MAPPING_FLAG_LB           8
 
+/* *INDENT-OFF* */
+typedef CLIB_PACKED(struct
+{
+  // number of sessions in this vrf
+  u32 ses_count;
+
+  u32 rx_fib_index;
+  u32 tx_fib_index;
+
+  // is this vrf expired
+  u8 expired;
+}) per_vrf_sessions_t;
+/* *INDENT-ON* */
+
 /* *INDENT-OFF* */
 typedef CLIB_PACKED(struct
 {
@@ -293,10 +272,13 @@ typedef CLIB_PACKED(struct
 
   /* user index */
   u32 user_index;
+
+  /* per vrf sessions index */
+  u32 per_vrf_sessions_index;
+
 }) snat_session_t;
 /* *INDENT-ON* */
 
-
 typedef struct
 {
   ip4_address_t addr;
@@ -323,38 +305,14 @@ typedef struct
 typedef struct
 {
   u32 fib_index;
-  u32 refcount;
-} nat_outside_fib_t;
-
-typedef struct
-{
-  /* Inside network port */
-  u16 in_port;
-  /* Outside network address and port */
-  snat_det_out_key_t out;
-  /* Session state */
-  u8 state;
-  /* Expire timeout */
-  u32 expire;
-} snat_det_session_t;
+  u32 ref_count;
+} nat_fib_t;
 
 typedef struct
 {
-  /* inside IP address range */
-  ip4_address_t in_addr;
-  u8 in_plen;
-  /* outside IP address range */
-  ip4_address_t out_addr;
-  u8 out_plen;
-  /* inside IP addresses / outside IP addresses */
-  u32 sharing_ratio;
-  /* number of ports available to internal host */
-  u16 ports_per_host;
-  /* session counter */
-  u32 ses_num;
-  /* vector of sessions */
-  snat_det_session_t *sessions;
-} snat_det_map_t;
+  u32 fib_index;
+  u32 refcount;
+} nat_outside_fib_t;
 
 typedef struct
 {
@@ -479,6 +437,8 @@ typedef struct
   /* real thread index */
   u32 thread_index;
 
+  per_vrf_sessions_t *per_vrf_sessions_vec;
+
 } snat_main_per_thread_data_t;
 
 struct snat_main_s;
@@ -517,6 +477,7 @@ typedef int (nat_alloc_out_addr_and_port_function_t) (snat_address_t *
                                                      u16 port_per_thread,
                                                      u32 snat_thread_index);
 
+#define foreach_nat_counter _ (tcp) _ (udp) _ (icmp) _ (other) _ (drops)
 
 typedef struct snat_main_s
 {
@@ -565,6 +526,9 @@ typedef struct snat_main_s
   u16 start_port;
   u16 end_port;
 
+  /* vector of fibs */
+  nat_fib_t *fibs;
+
   /* vector of outside fibs */
   nat_outside_fib_t *outside_fibs;
 
@@ -609,8 +573,6 @@ typedef struct snat_main_s
   u32 out2in_fast_node_index;
   u32 ed_out2in_node_index;
   u32 ed_out2in_slowpath_node_index;
-  u32 det_in2out_node_index;
-  u32 det_out2in_node_index;
 
   u32 hairpinning_node_index;
   u32 hairpin_dst_node_index;
@@ -619,25 +581,23 @@ typedef struct snat_main_s
   u32 ed_hairpin_dst_node_index;
   u32 ed_hairpin_src_node_index;
 
-
-  /* Deterministic NAT mappings */
-  snat_det_map_t *det_maps;
-
   /* If forwarding is enabled */
   u8 forwarding_enabled;
 
   /* Config parameters */
   u8 static_mapping_only;
   u8 static_mapping_connection_tracking;
-  u8 deterministic;
   u8 out2in_dpo;
   u8 endpoint_dependent;
 
+  /* Is translation memory size calculated or user defined */
+  u8 translation_memory_size_set;
+
   u32 translation_buckets;
   uword translation_memory_size;
-  u32 max_translations;
+  u32 max_translations_per_thread;
   u32 *max_translations_per_fib;
-
+  u32 max_users_per_thread;
   u32 user_buckets;
   uword user_memory_size;
   u32 max_translations_per_user;
@@ -660,6 +620,60 @@ typedef struct snat_main_s
   /* counters/gauges */
   vlib_simple_counter_main_t total_users;
   vlib_simple_counter_main_t total_sessions;
+  vlib_simple_counter_main_t user_limit_reached;
+
+#define _(x) vlib_simple_counter_main_t x;
+  struct
+  {
+    struct
+    {
+      struct
+      {
+       foreach_nat_counter;
+      } in2out;
+
+      struct
+      {
+       foreach_nat_counter;
+      } out2in;
+
+      struct
+      {
+       foreach_nat_counter;
+      } in2out_ed;
+
+      struct
+      {
+       foreach_nat_counter;
+      } out2in_ed;
+    } fastpath;
+
+    struct
+    {
+      struct
+      {
+       foreach_nat_counter;
+      } in2out;
+
+      struct
+      {
+       foreach_nat_counter;
+      } out2in;
+
+      struct
+      {
+       foreach_nat_counter;
+      } in2out_ed;
+
+      struct
+      {
+       foreach_nat_counter;
+      } out2in_ed;
+    } slowpath;
+
+    vlib_simple_counter_main_t hairpinning;
+  } counters;
+#undef _
 
   /* API message ID base */
   u16 msg_id_base;
@@ -701,8 +715,6 @@ extern vlib_node_registration_t snat_out2in_node;
 extern vlib_node_registration_t snat_in2out_worker_handoff_node;
 extern vlib_node_registration_t snat_in2out_output_worker_handoff_node;
 extern vlib_node_registration_t snat_out2in_worker_handoff_node;
-extern vlib_node_registration_t snat_det_in2out_node;
-extern vlib_node_registration_t snat_det_out2in_node;
 extern vlib_node_registration_t nat44_ed_in2out_node;
 extern vlib_node_registration_t nat44_ed_in2out_output_node;
 extern vlib_node_registration_t nat44_ed_out2in_node;
@@ -715,7 +727,6 @@ format_function_t format_snat_user;
 format_function_t format_snat_static_mapping;
 format_function_t format_snat_static_map_to_resolve;
 format_function_t format_snat_session;
-format_function_t format_det_map_ses;
 format_function_t format_snat_key;
 format_function_t format_static_mapping_key;
 format_function_t format_nat_protocol;
@@ -1033,20 +1044,6 @@ u32 icmp_match_out2in_slow (snat_main_t * sm, vlib_node_runtime_t * node,
                            nat_protocol_t * proto, void *d, void *e,
                            u8 * dont_translate);
 
-/* ICMP deterministic NAT session match functions */
-u32 icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node,
-                          u32 thread_index, vlib_buffer_t * b0,
-                          ip4_header_t * ip0, ip4_address_t * addr,
-                          u16 * port, u32 * fib_index,
-                          nat_protocol_t * proto, void *d, void *e,
-                          u8 * dont_translate);
-u32 icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node,
-                          u32 thread_index, vlib_buffer_t * b0,
-                          ip4_header_t * ip0, ip4_address_t * addr,
-                          u16 * port, u32 * fib_index,
-                          nat_protocol_t * proto, void *d, void *e,
-                          u8 * dont_translate);
-
 /* ICMP endpoint-dependent session match functions */
 u32 icmp_match_out2in_ed (snat_main_t * sm, vlib_node_runtime_t * node,
                          u32 thread_index, vlib_buffer_t * b0,
@@ -1273,6 +1270,14 @@ void nat_free_session_data (snat_main_t * sm, snat_session_t * s,
  */
 int nat44_set_session_limit (u32 session_limit, u32 vrf_id);
 
+/**
+ * @brief Update NAT44 session limit flushing all data (session limit, vrf id)
+ *
+ * @param session_limit Session limit
+ * @param vrf_id        VRF id
+ * @return 0 on success, non-zero value otherwise
+ */
+int nat44_update_session_limit (u32 session_limit, u32 vrf_id);
 /**
  * @brief Free NAT44 ED session data (lookup keys, external address port)
  *
@@ -1384,6 +1389,8 @@ int snat_alloc_outside_address_and_port (snat_address_t * addresses,
                                         u16 port_per_thread,
                                         u32 snat_thread_index);
 
+void expire_per_vrf_sessions (u32 fib_index);
+
 /**
  * @brief Match NAT44 static mapping.
  *
@@ -1448,6 +1455,7 @@ typedef struct
 } tcp_udp_header_t;
 
 u8 *format_user_kvp (u8 * s, va_list * args);
+
 #endif /* __included_nat_h__ */
 /*
  * fd.io coding-style-patch-verification: ON