if (nat_ed_ses_o2i_flow_hash_add_del (sm, thread_index, s, 0))
nat_elog_warn (sm, "flow hash del failed");
- if (is_fwd_bypass_session (s))
- {
- return;
- }
+ if (na44_ed_is_fwd_bypass_session (s))
+ {
+ return;
+ }
- if (is_affinity_sessions (s))
- nat_affinity_unlock (s->ext_host_addr, s->out2in.addr,
- s->nat_proto, s->out2in.port);
+ if (nat44_ed_is_affinity_session (s))
+ nat_affinity_unlock (s->ext_host_addr, s->out2in.addr, s->nat_proto,
+ s->out2in.port);
if (!is_ha)
nat_syslog_nat44_sdel (
0, s->in2out.fib_index, &s->in2out.addr, s->in2out.port,
&s->ext_host_nat_addr, s->ext_host_nat_port, &s->out2in.addr,
s->out2in.port, &s->ext_host_addr, s->ext_host_port, s->nat_proto,
- is_twice_nat_session (s));
+ nat44_ed_is_twice_nat_session (s));
- if (snat_is_unk_proto_session (s))
- return;
+ if (snat_is_unk_proto_session (s))
+ return;
- if (!is_ha)
- {
- /* log NAT event */
- nat_ipfix_logging_nat44_ses_delete (thread_index,
- s->in2out.addr.as_u32,
- s->out2in.addr.as_u32,
- s->nat_proto,
- s->in2out.port,
- s->out2in.port,
- s->in2out.fib_index);
- }
+ if (!is_ha)
+ {
+ /* log NAT event */
+ nat_ipfix_logging_nat44_ses_delete (
+ thread_index, s->in2out.addr.as_u32, s->out2in.addr.as_u32,
+ s->nat_proto, s->in2out.port, s->out2in.port, s->in2out.fib_index);
+ }
/* Twice NAT address and port for external host */
- if (is_twice_nat_session (s))
- {
- snat_free_outside_address_and_port (sm->twice_nat_addresses,
- thread_index,
- &s->ext_host_nat_addr,
- s->ext_host_nat_port, s->nat_proto);
- }
+ if (nat44_ed_is_twice_nat_session (s))
+ {
+ snat_free_outside_address_and_port (
+ sm->twice_nat_addresses, thread_index, &s->ext_host_nat_addr,
+ s->ext_host_nat_port, s->nat_proto);
+ }
- if (snat_is_session_static (s))
- return;
+ if (nat44_ed_is_session_static (s))
+ return;
- snat_free_outside_address_and_port (sm->addresses, thread_index,
- &s->out2in.addr, s->out2in.port,
- s->nat_proto);
+ snat_free_outside_address_and_port (sm->addresses, thread_index,
+ &s->out2in.addr, s->out2in.port,
+ s->nat_proto);
}
-void
-snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
- int is_add)
+static int
+is_snat_address_used_in_static_mapping (snat_main_t *sm, ip4_address_t addr)
+{
+ snat_static_mapping_t *m;
+ pool_foreach (m, sm->static_mappings)
+ {
+ if (is_sm_addr_only (m->flags) || is_sm_out2in_only (m->flags) ||
+ is_sm_identity_nat (m->flags))
+ {
+ continue;
+ }
+ if (m->external_addr.as_u32 == addr.as_u32)
+ {
+ return 1;
+ }
+ }
+ return 0;
+}
+
+static void
+nat44_ed_add_del_addr_to_fib (ip4_address_t *addr, u8 p_len, u32 sw_if_index,
+ int is_add)
{
+ // Add the external NAT address to the FIB as receive entries. This ensures
+ // that VPP will reply to ARP for this address and we don't need to enable
+ // proxy ARP on the outside interface.
+
snat_main_t *sm = &snat_main;
fib_prefix_t prefix = {
.fp_len = p_len,
u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
if (is_add)
- fib_table_entry_update_one_path (fib_index,
- &prefix,
- sm->fib_src_low,
- (FIB_ENTRY_FLAG_CONNECTED |
- FIB_ENTRY_FLAG_LOCAL |
- FIB_ENTRY_FLAG_EXCLUSIVE),
- DPO_PROTO_IP4,
- NULL,
- sw_if_index,
- ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
+ {
+ fib_table_entry_update_one_path (fib_index, &prefix, sm->fib_src_low,
+ (FIB_ENTRY_FLAG_CONNECTED |
+ FIB_ENTRY_FLAG_LOCAL |
+ FIB_ENTRY_FLAG_EXCLUSIVE),
+ DPO_PROTO_IP4, NULL, sw_if_index, ~0, 1,
+ NULL, FIB_ROUTE_PATH_FLAG_NONE);
+ }
else
- fib_table_entry_delete (fib_index, &prefix, sm->fib_src_low);
+ {
+ fib_table_entry_delete (fib_index, &prefix, sm->fib_src_low);
+ }
}
-int
-snat_add_address (snat_main_t * sm, ip4_address_t * addr, u32 vrf_id,
- u8 twice_nat)
+static void
+nat44_ed_add_del_addr_to_fib_foreach_out_if (ip4_address_t *addr, u8 is_add)
{
- snat_address_t *ap;
+ snat_main_t *sm = &snat_main;
snat_interface_t *i;
+
+ pool_foreach (i, sm->interfaces)
+ {
+ if (nat44_ed_is_interface_outside (i))
+ {
+ nat44_ed_add_del_addr_to_fib (addr, 32, i->sw_if_index, is_add);
+ }
+ }
+ pool_foreach (i, sm->output_feature_interfaces)
+ {
+ if (nat44_ed_is_interface_outside (i))
+ {
+ nat44_ed_add_del_addr_to_fib (addr, 32, i->sw_if_index, is_add);
+ }
+ }
+}
+
+static_always_inline void
+nat44_ed_add_del_addr_to_fib_foreach_addr (u32 sw_if_index, u8 is_add)
+{
+ snat_main_t *sm = &snat_main;
+ snat_address_t *ap;
+
+ vec_foreach (ap, sm->addresses)
+ {
+ nat44_ed_add_del_addr_to_fib (&ap->addr, 32, sw_if_index, is_add);
+ }
+}
+
+static_always_inline void
+nat44_ed_add_del_addr_to_fib_foreach_addr_only_sm (u32 sw_if_index, u8 is_add)
+{
+ snat_main_t *sm = &snat_main;
+ snat_static_mapping_t *m;
+
+ pool_foreach (m, sm->static_mappings)
+ {
+ if (is_sm_addr_only (m->flags) && !is_sm_identity_nat (m->flags))
+ {
+ nat44_ed_add_del_addr_to_fib (&m->external_addr, 32, sw_if_index,
+ is_add);
+ }
+ }
+}
+
+int
+nat44_ed_add_address (ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
+{
+ snat_main_t *sm = &snat_main;
vlib_thread_main_t *tm = vlib_get_thread_main ();
+ snat_address_t *ap, *addresses;
+
+ addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
if (!sm->enabled)
{
return VNET_API_ERROR_UNSUPPORTED;
}
- /* Check if address already exists */
- vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
+ // check if address already exists
+ vec_foreach (ap, addresses)
{
if (ap->addr.as_u32 == addr->as_u32)
{
}
if (twice_nat)
- vec_add2 (sm->twice_nat_addresses, ap, 1);
+ {
+ vec_add2 (sm->twice_nat_addresses, ap, 1);
+ }
else
- vec_add2 (sm->addresses, ap, 1);
+ {
+ vec_add2 (sm->addresses, ap, 1);
+ }
+ ap->fib_index = ~0;
ap->addr = *addr;
- if (vrf_id != ~0)
- ap->fib_index =
- fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
- sm->fib_src_low);
- else
- ap->fib_index = ~0;
-
- #define _(N, i, n, s) \
- clib_memset(ap->busy_##n##_port_refcounts, 0, sizeof(ap->busy_##n##_port_refcounts));\
- ap->busy_##n##_ports = 0; \
- ap->busy_##n##_ports_per_thread = 0;\
- vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
- foreach_nat_protocol
- #undef _
-
- if (twice_nat)
- return 0;
- /* Add external address to FIB */
- pool_foreach (i, sm->interfaces)
- {
- if (nat_interface_is_inside (i))
- continue;
+ if (vrf_id != ~0)
+ {
+ ap->fib_index = fib_table_find_or_create_and_lock (
+ FIB_PROTOCOL_IP4, vrf_id, sm->fib_src_low);
+ }
- snat_add_del_addr_to_fib (addr, 32, i->sw_if_index, 1);
- break;
- }
- pool_foreach (i, sm->output_feature_interfaces)
- {
- if (nat_interface_is_inside (i))
- continue;
+#define _(N, i, n, s) \
+ clib_memset (ap->busy_##n##_port_refcounts, 0, \
+ sizeof (ap->busy_##n##_port_refcounts)); \
+ ap->busy_##n##_ports = 0; \
+ ap->busy_##n##_ports_per_thread = 0; \
+ vec_validate_init_empty (ap->busy_##n##_ports_per_thread, \
+ tm->n_vlib_mains - 1, 0);
+ foreach_nat_protocol
+#undef _
- snat_add_del_addr_to_fib (addr, 32, i->sw_if_index, 1);
- break;
+ if (!twice_nat)
+ {
+ // if we don't have enabled interface we don't add address
+ // to fib
+ nat44_ed_add_del_addr_to_fib_foreach_out_if (addr, 1);
}
-
return 0;
}
-static int
-is_snat_address_used_in_static_mapping (snat_main_t * sm, ip4_address_t addr)
+int
+nat44_ed_del_address (ip4_address_t addr, u8 delete_sm, u8 twice_nat)
{
+ snat_main_t *sm = &snat_main;
+ snat_address_t *a = 0, *addresses;
+ snat_session_t *ses;
+ u32 *ses_to_be_removed = 0, *ses_index;
+ snat_main_per_thread_data_t *tsm;
snat_static_mapping_t *m;
- pool_foreach (m, sm->static_mappings)
- {
- if (is_sm_addr_only (m->flags) || is_sm_out2in_only (m->flags) ||
- is_sm_identity_nat (m->flags))
- continue;
- if (m->external_addr.as_u32 == addr.as_u32)
- return 1;
+ int j;
+
+ addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
+
+ for (j = 0; j < vec_len (addresses); j++)
+ {
+ if (addresses[j].addr.as_u32 == addr.as_u32)
+ {
+ a = addresses + j;
+ break;
+ }
+ }
+ if (!a)
+ {
+ nat_log_err ("no such address");
+ return VNET_API_ERROR_NO_SUCH_ENTRY;
+ }
+
+ if (delete_sm)
+ {
+ pool_foreach (m, sm->static_mappings)
+ {
+ if (m->external_addr.as_u32 == addr.as_u32)
+ {
+ nat44_ed_del_static_mapping (m->local_addr, m->external_addr,
+ m->local_port, m->external_port,
+ m->proto, m->vrf_id, ~0, m->flags);
+ }
+ }
+ }
+ else
+ {
+ // TODO: why ?
+ // check if address is used in some static mapping
+ if (is_snat_address_used_in_static_mapping (sm, addr))
+ {
+ nat_log_err ("address used in static mapping");
+ return VNET_API_ERROR_UNSPECIFIED;
+ }
+ }
+
+ if (a->fib_index != ~0)
+ {
+ fib_table_unlock (a->fib_index, FIB_PROTOCOL_IP4, sm->fib_src_low);
+ }
+
+ // delete sessions using address
+ if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
+ {
+ vec_foreach (tsm, sm->per_thread_data)
+ {
+ pool_foreach (ses, tsm->sessions)
+ {
+ if (ses->out2in.addr.as_u32 == addr.as_u32)
+ {
+ nat_free_session_data (sm, ses, tsm - sm->per_thread_data,
+ 0);
+ vec_add1 (ses_to_be_removed, ses - tsm->sessions);
+ }
+ }
+ vec_foreach (ses_index, ses_to_be_removed)
+ {
+ ses = pool_elt_at_index (tsm->sessions, ses_index[0]);
+ nat_ed_session_delete (sm, ses, tsm - sm->per_thread_data, 1);
+ }
+ vec_free (ses_to_be_removed);
+ }
+ }
+
+#define _(N, i, n, s) vec_free (a->busy_##n##_ports_per_thread);
+ foreach_nat_protocol
+#undef _
+
+ if (!twice_nat)
+ {
+ vec_del1 (sm->addresses, j);
+ nat44_ed_add_del_addr_to_fib_foreach_out_if (&addr, 0);
}
+ else { vec_del1 (sm->twice_nat_addresses, j); }
return 0;
}
continue;
}
- if (is_lb_session (s))
+ if (nat44_ed_is_lb_session (s))
continue;
- if (!snat_is_session_static (s))
+ if (!nat44_ed_is_session_static (s))
continue;
nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
vec_add1 (indexes_to_free, s - tsm->sessions);
{
snat_main_t *sm = &snat_main;
clib_bihash_kv_8_8_t kv, value;
- snat_interface_t *interface;
nat44_lb_addr_port_t *local;
snat_static_mapping_t *m;
u32 fib_index = ~0;
{
m->vrf_id = vrf_id;
m->fib_index = fib_index;
+
+ // not identity && addr only
+ if (is_sm_addr_only (flags))
+ {
+ nat44_ed_add_del_addr_to_fib_foreach_out_if (&e_addr, 1);
+ }
}
if (!is_sm_out2in_only (flags))
vec_add1 (m->workers, worker_index);
}
- if (is_sm_identity_nat (flags) || !is_sm_addr_only (flags))
- return 0;
-
- pool_foreach (interface, sm->interfaces)
- {
- if (nat_interface_is_inside (interface))
- continue;
-
- snat_add_del_addr_to_fib (&e_addr, 32, interface->sw_if_index, 1);
- break;
- }
-
- pool_foreach (interface, sm->output_feature_interfaces)
- {
- if (nat_interface_is_inside (interface))
- continue;
-
- snat_add_del_addr_to_fib (&e_addr, 32, interface->sw_if_index, 1);
- break;
- }
-
return 0;
}
snat_main_t *sm = &snat_main;
clib_bihash_kv_8_8_t kv, value;
- snat_interface_t *interface;
nat44_lb_addr_port_t *local;
snat_static_mapping_t *m;
u32 fib_index = ~0;
fib_table_unlock (fib_index, FIB_PROTOCOL_IP4, sm->fib_src_low);
- if (pool_elts (m->locals))
- return 0;
-
- // fib_index 0
- init_nat_k (&kv, e_addr, e_port, 0, proto);
- clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0);
-
- vec_free (m->tag);
- vec_free (m->workers);
- pool_put (sm->static_mappings, m);
-
- if (is_sm_identity_nat (flags) || !is_sm_addr_only (flags))
- return 0;
-
- pool_foreach (interface, sm->interfaces)
+ if (!pool_elts (m->locals))
{
- if (nat_interface_is_inside (interface))
- continue;
-
- snat_add_del_addr_to_fib (&e_addr, 32, interface->sw_if_index, 0);
- break;
- }
+ // this is last record remove all required stuff
+ // fib_index 0
+ init_nat_k (&kv, e_addr, e_port, 0, proto);
+ clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0);
- pool_foreach (interface, sm->output_feature_interfaces)
- {
- if (nat_interface_is_inside (interface))
- continue;
+ vec_free (m->tag);
+ vec_free (m->workers);
+ pool_put (sm->static_mappings, m);
- snat_add_del_addr_to_fib (&e_addr, 32, interface->sw_if_index, 0);
- break;
+ if (is_sm_addr_only (flags) && !is_sm_identity_nat (flags))
+ {
+ nat44_ed_add_del_addr_to_fib_foreach_out_if (&e_addr, 0);
+ }
}
return 0;
init_nat_k (&kv, e_addr, e_port, 0, proto);
if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
- m = 0;
+ {
+ m = 0;
+ }
else
- m = pool_elt_at_index (sm->static_mappings, value.value);
+ {
+ m = pool_elt_at_index (sm->static_mappings, value.value);
+ }
if (m)
- return VNET_API_ERROR_VALUE_EXIST;
+ {
+ return VNET_API_ERROR_VALUE_EXIST;
+ }
if (vec_len (locals) < 2)
- return VNET_API_ERROR_INVALID_VALUE;
+ {
+ return VNET_API_ERROR_INVALID_VALUE;
+ }
- /* Find external address in allocated addresses and reserve port for
- address and port pair mapping when dynamic translations enabled */
if (!(sm->static_mapping_only || is_sm_out2in_only (flags)))
{
+ /* Find external address in allocated addresses and reserve port for
+ address and port pair mapping when dynamic translations enabled */
for (i = 0; i < vec_len (sm->addresses); i++)
{
if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
break;
}
}
- /* External address must be allocated */
+ // external address must be allocated
if (!a)
- return VNET_API_ERROR_NO_SUCH_ENTRY;
+ {
+ return VNET_API_ERROR_NO_SUCH_ENTRY;
+ }
}
pool_get (sm->static_mappings, m);
if (!is_sm_lb (m->flags))
return VNET_API_ERROR_INVALID_VALUE;
- /* Free external address port */
if (!(sm->static_mapping_only || is_sm_out2in_only (flags)))
{
for (i = 0; i < vec_len (sm->addresses); i++)
/* Delete sessions */
pool_foreach (s, tsm->sessions)
{
- if (!(is_lb_session (s)))
+ if (!(nat44_ed_is_lb_session (s)))
continue;
if ((s->in2out.addr.as_u32 != local->addr.as_u32) ||
m = pool_elt_at_index (sm->static_mappings, value.value);
if (!m)
- return VNET_API_ERROR_NO_SUCH_ENTRY;
+ {
+ return VNET_API_ERROR_NO_SUCH_ENTRY;
+ }
if (!is_sm_lb (m->flags))
- return VNET_API_ERROR_INVALID_VALUE;
+ {
+ return VNET_API_ERROR_INVALID_VALUE;
+ }
pool_foreach (local, m->locals)
{
if (is_add)
{
if (match_local)
- return VNET_API_ERROR_VALUE_EXIST;
+ {
+ return VNET_API_ERROR_VALUE_EXIST;
+ }
pool_get (m->locals, local);
clib_memset (local, 0, sizeof (*local));
/* Delete sessions */
pool_foreach (s, tsm->sessions) {
- if (!(is_lb_session (s)))
- continue;
+ if (!(nat44_ed_is_lb_session (s)))
+ continue;
- if ((s->in2out.addr.as_u32 != match_local->addr.as_u32) ||
- s->in2out.port != match_local->port)
- continue;
+ if ((s->in2out.addr.as_u32 != match_local->addr.as_u32) ||
+ s->in2out.port != match_local->port)
+ continue;
- nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
- nat_ed_session_delete (sm, s, tsm - sm->per_thread_data, 1);
+ nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
+ nat_ed_session_delete (sm, s, tsm - sm->per_thread_data, 1);
}
pool_put (m->locals, match_local);
return 0;
}
-int
-snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
- u8 twice_nat)
-{
- snat_address_t *a = 0;
- snat_session_t *ses;
- u32 *ses_to_be_removed = 0, *ses_index;
- snat_main_per_thread_data_t *tsm;
- snat_static_mapping_t *m;
- snat_interface_t *interface;
- snat_address_t *addresses;
- int i;
-
- if (!sm->enabled)
- {
- return VNET_API_ERROR_UNSUPPORTED;
- }
-
- addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
-
- /* Find SNAT address */
- for (i = 0; i < vec_len (addresses); i++)
- {
- if (addresses[i].addr.as_u32 == addr.as_u32)
- {
- a = addresses + i;
- break;
- }
- }
- if (!a)
- {
- nat_log_err ("no such address");
- return VNET_API_ERROR_NO_SUCH_ENTRY;
- }
-
- if (delete_sm)
- {
- pool_foreach (m, sm->static_mappings)
- {
- if (m->external_addr.as_u32 == addr.as_u32)
- {
- nat44_ed_del_static_mapping (m->local_addr, m->external_addr,
- m->local_port, m->external_port,
- m->proto, m->vrf_id, ~0, m->flags);
- }
- }
- }
- else
- {
- /* Check if address is used in some static mapping */
- if (is_snat_address_used_in_static_mapping (sm, addr))
- {
- nat_log_err ("address used in static mapping");
- return VNET_API_ERROR_UNSPECIFIED;
- }
- }
-
- if (a->fib_index != ~0)
- fib_table_unlock (a->fib_index, FIB_PROTOCOL_IP4, sm->fib_src_low);
-
- /* Delete sessions using address */
- if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
- {
- vec_foreach (tsm, sm->per_thread_data)
- {
- pool_foreach (ses, tsm->sessions) {
- if (ses->out2in.addr.as_u32 == addr.as_u32)
- {
- nat_free_session_data (sm, ses, tsm - sm->per_thread_data, 0);
- vec_add1 (ses_to_be_removed, ses - tsm->sessions);
- }
- }
-
- vec_foreach (ses_index, ses_to_be_removed)
- {
- ses = pool_elt_at_index (tsm->sessions, ses_index[0]);
- nat_ed_session_delete (sm, ses, tsm - sm->per_thread_data, 1);
- }
-
- vec_free (ses_to_be_removed);
- }
- }
-
-#define _(N, i, n, s) \
- vec_free (a->busy_##n##_ports_per_thread);
- foreach_nat_protocol
-#undef _
-
- if (twice_nat)
- {
- vec_del1 (sm->twice_nat_addresses, i);
- return 0;
- }
- else vec_del1 (sm->addresses, i);
-
- /* Delete external address from FIB */
- pool_foreach (interface, sm->interfaces)
- {
- if (nat_interface_is_inside (interface))
- continue;
-
- snat_add_del_addr_to_fib (&addr, 32, interface->sw_if_index, 0);
- break;
- }
- pool_foreach (interface, sm->output_feature_interfaces)
- {
- if (nat_interface_is_inside (interface))
- continue;
-
- snat_add_del_addr_to_fib (&addr, 32, interface->sw_if_index, 0);
- break;
- }
-
- return 0;
-}
-
void
expire_per_vrf_sessions (u32 fib_index)
{
snat_main_t *sm = &snat_main;
nat_outside_fib_t *outside_fib;
- snat_static_mapping_t *m;
snat_interface_t *i;
- snat_address_t *ap;
u32 fib_index;
int rv;
i = nat44_ed_get_interface (sm->interfaces, sw_if_index);
if (i)
{
- if ((nat_interface_is_inside (i) && is_inside) ||
- (nat_interface_is_outside (i) && !is_inside))
+ if ((nat44_ed_is_interface_inside (i) && is_inside) ||
+ (nat44_ed_is_interface_outside (i) && !is_inside))
{
return 0;
}
outside_fib->refcount = 1;
}
- vec_foreach (ap, sm->addresses)
- {
- snat_add_del_addr_to_fib (&ap->addr, 32, sw_if_index, 1);
- }
- pool_foreach (m, sm->static_mappings)
- {
- if (!(is_sm_addr_only (m->flags)) ||
- (m->local_addr.as_u32 == m->external_addr.as_u32))
- {
- continue;
- }
- snat_add_del_addr_to_fib (&m->external_addr, 32, sw_if_index, 1);
- }
+ nat44_ed_add_del_addr_to_fib_foreach_addr (sw_if_index, 1);
+ nat44_ed_add_del_addr_to_fib_foreach_addr_only_sm (sw_if_index, 1);
}
else
{
snat_main_t *sm = &snat_main;
nat_outside_fib_t *outside_fib;
- snat_static_mapping_t *m;
snat_interface_t *i;
- snat_address_t *ap;
u32 fib_index;
int rv;
return VNET_API_ERROR_NO_SUCH_ENTRY;
}
- if (nat_interface_is_inside (i) && nat_interface_is_outside (i))
+ if (nat44_ed_is_interface_inside (i) && nat44_ed_is_interface_outside (i))
{
if (sm->num_workers > 1)
{
}
}
- vec_foreach (ap, sm->addresses)
- {
- snat_add_del_addr_to_fib (&ap->addr, 32, sw_if_index, 0);
- }
-
- pool_foreach (m, sm->static_mappings)
- {
- if (!(is_sm_addr_only (m->flags)) ||
- (m->local_addr.as_u32 == m->external_addr.as_u32))
- {
- continue;
- }
- snat_add_del_addr_to_fib (&m->external_addr, 32, sw_if_index, 0);
- }
+ nat44_ed_add_del_addr_to_fib_foreach_addr (sw_if_index, 0);
+ nat44_ed_add_del_addr_to_fib_foreach_addr_only_sm (sw_if_index, 0);
}
return 0;
snat_main_t *sm = &snat_main;
nat_outside_fib_t *outside_fib;
- snat_static_mapping_t *m;
snat_interface_t *i;
- snat_address_t *ap;
u32 fib_index;
int rv;
outside_fib->refcount = 1;
}
- vec_foreach (ap, sm->addresses)
- {
- snat_add_del_addr_to_fib (&ap->addr, 32, sw_if_index, 1);
- }
-
- pool_foreach (m, sm->static_mappings)
- {
- if (!((is_sm_addr_only (m->flags))) ||
- (m->local_addr.as_u32 == m->external_addr.as_u32))
- {
- continue;
- }
- snat_add_del_addr_to_fib (&m->external_addr, 32, sw_if_index, 1);
- }
+ nat44_ed_add_del_addr_to_fib_foreach_addr (sw_if_index, 1);
+ nat44_ed_add_del_addr_to_fib_foreach_addr_only_sm (sw_if_index, 1);
return 0;
}
snat_main_t *sm = &snat_main;
nat_outside_fib_t *outside_fib;
- snat_static_mapping_t *m;
snat_interface_t *i;
- snat_address_t *ap;
u32 fib_index;
int rv;
}
}
- vec_foreach (ap, sm->addresses)
- {
- snat_add_del_addr_to_fib (&ap->addr, 32, sw_if_index, 0);
- }
-
- pool_foreach (m, sm->static_mappings)
- {
- if (!((is_sm_addr_only (m->flags))) ||
- (m->local_addr.as_u32 == m->external_addr.as_u32))
- {
- continue;
- }
- snat_add_del_addr_to_fib (&m->external_addr, 32, sw_if_index, 0);
- }
+ nat44_ed_add_del_addr_to_fib_foreach_addr (sw_if_index, 0);
+ nat44_ed_add_del_addr_to_fib_foreach_addr_only_sm (sw_if_index, 0);
return 0;
}
}
static void
-snat_update_outside_fib (ip4_main_t * im, uword opaque,
- u32 sw_if_index, u32 new_fib_index,
- u32 old_fib_index)
+nat44_ed_update_outside_fib_cb (ip4_main_t *im, uword opaque, u32 sw_if_index,
+ u32 new_fib_index, u32 old_fib_index)
{
snat_main_t *sm = &snat_main;
nat_outside_fib_t *outside_fib;
{
if (i->sw_if_index == sw_if_index)
{
- if (!(nat_interface_is_outside (i)))
+ if (!(nat44_ed_is_interface_outside (i)))
return;
match = 1;
}
{
if (i->sw_if_index == sw_if_index)
{
- if (!(nat_interface_is_outside (i)))
+ if (!(nat44_ed_is_interface_outside (i)))
return;
match = 1;
}
}
}
-static void
-snat_update_outside_fib (ip4_main_t * im, uword opaque,
- u32 sw_if_index, u32 new_fib_index,
- u32 old_fib_index);
+static void nat44_ed_update_outside_fib_cb (ip4_main_t *im, uword opaque,
+ u32 sw_if_index, u32 new_fib_index,
+ u32 old_fib_index);
-static void
-snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
- uword opaque,
- u32 sw_if_index,
- ip4_address_t * address,
- u32 address_length,
- u32 if_address_index, u32 is_delete);
+static void nat44_ed_add_del_interface_address_cb (
+ ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address,
+ u32 address_length, u32 if_address_index, u32 is_delete);
-static void
-nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
- uword opaque,
- u32 sw_if_index,
- ip4_address_t * address,
- u32 address_length,
- u32 if_address_index, u32 is_delete);
+static void nat44_ed_add_del_static_mapping_addr_only_cb (
+ ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address,
+ u32 address_length, u32 if_address_index, u32 is_delete);
void
test_key_calc_split ()
}
/* callbacks to call when interface address changes. */
- cbi.function = snat_ip4_add_del_interface_address_cb;
+ cbi.function = nat44_ed_add_del_interface_address_cb;
vec_add1 (sm->ip4_main->add_del_interface_address_callbacks, cbi);
- cbi.function = nat_ip4_add_del_addr_only_sm_cb;
+ cbi.function = nat44_ed_add_del_static_mapping_addr_only_cb;
vec_add1 (sm->ip4_main->add_del_interface_address_callbacks, cbi);
/* callbacks to call when interface to table biding changes */
- cbt.function = snat_update_outside_fib;
+ cbt.function = nat44_ed_update_outside_fib_cb;
vec_add1 (sm->ip4_main->table_bind_callbacks, cbt);
sm->fib_src_low =
pool = pool_dup (sm->interfaces);
pool_foreach (i, pool)
{
- if (nat_interface_is_inside (i))
+ if (nat44_ed_is_interface_inside (i))
{
error = nat44_ed_del_interface (i->sw_if_index, 1);
}
- if (nat_interface_is_outside (i))
+ if (nat44_ed_is_interface_outside (i))
{
error = nat44_ed_del_interface (i->sw_if_index, 0);
}
{
pool_foreach (s, tsm->sessions)
{
- if (is_fwd_bypass_session (s))
+ if (na44_ed_is_fwd_bypass_session (s))
{
vec_add1 (ses_to_be_removed, s - tsm->sessions);
}
}
}
+ if (PREDICT_FALSE (ip->protocol == IP_PROTOCOL_ICMP))
+ {
+ ip4_address_t lookup_saddr, lookup_daddr;
+ u16 lookup_sport, lookup_dport;
+ u8 lookup_protocol;
+
+ if (!nat_get_icmp_session_lookup_values (
+ b, ip, &lookup_saddr, &lookup_sport, &lookup_daddr,
+ &lookup_dport, &lookup_protocol))
+ {
+ init_ed_k (&kv16, lookup_saddr, lookup_sport, lookup_daddr,
+ lookup_dport, rx_fib_index, lookup_protocol);
+ if (!clib_bihash_search_16_8 (&sm->flow_hash, &kv16, &value16))
+ {
+ next_worker_index = ed_value_get_thread_index (&value16);
+ vnet_buffer2 (b)->nat.cached_session_index =
+ ed_value_get_session_index (&value16);
+ goto out;
+ }
+ }
+ }
+
init_ed_k (&kv16, ip->src_address, vnet_buffer (b)->ip.reass.l4_src_port,
ip->dst_address, vnet_buffer (b)->ip.reass.l4_dst_port,
fib_index, ip->protocol);
}
static void
-nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
- uword opaque,
- u32 sw_if_index,
- ip4_address_t * address,
- u32 address_length,
- u32 if_address_index, u32 is_delete)
+nat44_ed_add_del_static_mapping_addr_only_cb (
+ ip4_main_t *im, uword opaque, u32 sw_if_index, ip4_address_t *address,
+ u32 address_length, u32 if_address_index, u32 is_delete)
{
- snat_main_t *sm = &snat_main;
+ clib_bihash_kv_8_8_t kv, value;
snat_static_map_resolve_t *rp;
+ snat_main_t *sm = &snat_main;
snat_static_mapping_t *m;
- clib_bihash_kv_8_8_t kv, value;
- ip4_address_t l_addr;
- int i, rv;
+ int i, rv = 0, match = 0;
if (!sm->enabled)
- return;
+ {
+ return;
+ }
+ // find first addr_only resolve record by sw_if_index
for (i = 0; i < vec_len (sm->to_resolve); i++)
{
rp = sm->to_resolve + i;
- if (rp->addr_only == 0)
- continue;
- if (rp->sw_if_index == sw_if_index)
- goto match;
+ if (rp->addr_only && rp->sw_if_index == sw_if_index)
+ {
+ match = 1;
+ break;
+ }
+ }
+ if (!match)
+ {
+ return;
}
- return;
-
-match:
init_nat_k (&kv, *address, rp->addr_only ? 0 : rp->e_port,
sm->outside_fib_index, rp->addr_only ? 0 : rp->proto);
- if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
- m = 0;
- else
- m = pool_elt_at_index (sm->static_mappings, value.value);
- if (!is_delete)
+ if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
{
- /* Don't trip over lease renewal, static config */
- if (m)
- return;
+ m = 0;
}
else
{
- if (!m)
- return;
+ m = pool_elt_at_index (sm->static_mappings, value.value);
}
- /* Indetity mapping? */
- if (rp->l_addr.as_u32 == 0)
- l_addr.as_u32 = address[0].as_u32;
- else
- l_addr.as_u32 = rp->l_addr.as_u32;
-
if (is_delete)
{
- rv = nat44_ed_del_static_mapping (l_addr, address[0], rp->l_port,
- rp->e_port, rp->proto, rp->vrf_id, ~0,
- rp->flags);
+ if (m)
+ {
+ rv = nat44_ed_del_static_mapping (rp->l_addr, address[0], rp->l_port,
+ rp->e_port, rp->proto, rp->vrf_id,
+ ~0, rp->flags);
+ }
}
else
{
- rv = nat44_ed_add_static_mapping (l_addr, address[0], rp->l_port,
- rp->e_port, rp->proto, rp->vrf_id, ~0,
- rp->flags, rp->pool_addr, rp->tag);
+ if (!m)
+ {
+ rv = nat44_ed_add_static_mapping (
+ rp->l_addr, address[0], rp->l_port, rp->e_port, rp->proto,
+ rp->vrf_id, ~0, rp->flags, rp->pool_addr, rp->tag);
+ }
+ // else: don't trip over lease renewal, static config
}
if (rv)
{
- nat_elog_notice_X1 (sm, "add_static_mapping returned %d", "i4", rv);
+ nat_elog_notice_X1 (sm, "nat44_ed_del_static_mapping returned %d", "i4",
+ rv);
+ }
+}
+
+static_always_inline int
+is_sw_if_index_reg_for_auto_resolve (u32 *sw_if_indices, u32 sw_if_index)
+{
+ u32 *i;
+ vec_foreach (i, sw_if_indices)
+ {
+ if (*i == sw_if_index)
+ {
+ return 1;
+ }
}
+ return 0;
}
static void
-snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
- uword opaque,
- u32 sw_if_index,
- ip4_address_t * address,
+nat44_ed_add_del_interface_address_cb (ip4_main_t *im, uword opaque,
+ u32 sw_if_index, ip4_address_t *address,
u32 address_length,
u32 if_address_index, u32 is_delete)
{
snat_main_t *sm = &snat_main;
snat_static_map_resolve_t *rp;
- ip4_address_t l_addr;
- int i, j;
- int rv;
- u8 twice_nat = 0;
snat_address_t *addresses = sm->addresses;
+ u8 twice_nat = 0;
+ int rv, i;
if (!sm->enabled)
- return;
-
- for (i = 0; i < vec_len (sm->auto_add_sw_if_indices); i++)
{
- if (sw_if_index == sm->auto_add_sw_if_indices[i])
- goto match;
+ return;
}
- for (i = 0; i < vec_len (sm->auto_add_sw_if_indices_twice_nat); i++)
+ if (!is_sw_if_index_reg_for_auto_resolve (sm->auto_add_sw_if_indices,
+ sw_if_index))
{
- twice_nat = 1;
- addresses = sm->twice_nat_addresses;
- if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
- goto match;
+ if (!is_sw_if_index_reg_for_auto_resolve (
+ sm->auto_add_sw_if_indices_twice_nat, sw_if_index))
+ {
+ return;
+ }
+ else
+ {
+ addresses = sm->twice_nat_addresses;
+ twice_nat = 1;
+ }
}
- return;
-
-match:
if (!is_delete)
{
- /* Don't trip over lease renewal, static config */
- for (j = 0; j < vec_len (addresses); j++)
- if (addresses[j].addr.as_u32 == address->as_u32)
- return;
+ // don't trip over lease renewal, static config
+ for (i = 0; i < vec_len (addresses); i++)
+ {
+ if (addresses[i].addr.as_u32 == address->as_u32)
+ {
+ return;
+ }
+ }
+
+ (void) nat44_ed_add_address (address, ~0, twice_nat);
- (void) snat_add_address (sm, address, ~0, twice_nat);
- /* Scan static map resolution vector */
- for (j = 0; j < vec_len (sm->to_resolve); j++)
+ // scan static mapping switch address resolution record vector
+ for (i = 0; i < vec_len (sm->to_resolve); i++)
{
- rp = sm->to_resolve + j;
+ rp = sm->to_resolve + i;
if (rp->addr_only)
- continue;
- /* On this interface? */
+ {
+ continue;
+ }
if (rp->sw_if_index == sw_if_index)
{
-
- // TODO: remove if not needed (handled by function)
- /* Indetity mapping? */
- if (rp->l_addr.as_u32 == 0)
- l_addr.as_u32 = address[0].as_u32;
- else
- l_addr.as_u32 = rp->l_addr.as_u32;
-
- /* Add the static mapping */
rv = nat44_ed_add_static_mapping (
- l_addr, address[0], rp->l_port, rp->e_port, rp->proto,
+ rp->l_addr, address[0], rp->l_port, rp->e_port, rp->proto,
rp->vrf_id, ~0, rp->flags, rp->pool_addr, rp->tag);
if (rv)
{
}
}
}
- return;
}
else
{
- (void) snat_del_address (sm, address[0], 1, twice_nat);
- return;
+ // remove all static mapping records
+ (void) nat44_ed_del_address (address[0], 1, twice_nat);
}
}
int
-snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
- u8 twice_nat)
+nat44_ed_add_interface_address (u32 sw_if_index, u8 twice_nat)
{
+ snat_main_t *sm = &snat_main;
+ ip4_main_t *ip4_main = sm->ip4_main;
+ ip4_address_t *first_int_addr;
+ u32 *auto_add_sw_if_indices = twice_nat ?
+ sm->auto_add_sw_if_indices_twice_nat :
+ sm->auto_add_sw_if_indices;
+ int i;
+
+ for (i = 0; i < vec_len (auto_add_sw_if_indices); i++)
+ {
+ if (auto_add_sw_if_indices[i] == sw_if_index)
+ {
+ return VNET_API_ERROR_VALUE_EXIST;
+ }
+ }
+
+ // add to the auto-address list
+ if (twice_nat)
+ {
+ vec_add1 (sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
+ }
+ else
+ {
+ vec_add1 (sm->auto_add_sw_if_indices, sw_if_index);
+ }
+
+ // if the address is already bound - or static - add it now
+ first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index, 0);
+ if (first_int_addr)
+ {
+ (void) nat44_ed_add_address (first_int_addr, ~0, twice_nat);
+ }
+
+ return 0;
+}
+
+int
+nat44_ed_del_interface_address (u32 sw_if_index, u8 twice_nat)
+{
+ snat_main_t *sm = &snat_main;
ip4_main_t *ip4_main = sm->ip4_main;
ip4_address_t *first_int_addr;
snat_static_map_resolve_t *rp;
auto_add_sw_if_indices = twice_nat ? sm->auto_add_sw_if_indices_twice_nat :
sm->auto_add_sw_if_indices;
- first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index, 0);
-
for (i = 0; i < vec_len (auto_add_sw_if_indices); i++)
{
if (auto_add_sw_if_indices[i] == sw_if_index)
{
- if (is_del)
+ first_int_addr =
+ ip4_interface_first_address (ip4_main, sw_if_index, 0);
+ if (first_int_addr)
+ {
+ // remove all static mapping records
+ (void) nat44_ed_del_address (first_int_addr[0], 1, twice_nat);
+ }
+ else
{
- /* if have address remove it */
- if (first_int_addr)
- (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
- else
+ for (j = 0; j < vec_len (sm->to_resolve); j++)
{
- for (j = 0; j < vec_len (sm->to_resolve); j++)
+ rp = sm->to_resolve + j;
+ if (rp->sw_if_index == sw_if_index)
{
- rp = sm->to_resolve + j;
- if (rp->sw_if_index == sw_if_index)
- vec_add1 (indices_to_delete, j);
+ vec_add1 (indices_to_delete, j);
}
- if (vec_len (indices_to_delete))
+ }
+ if (vec_len (indices_to_delete))
+ {
+ for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
{
- for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
- vec_del1 (sm->to_resolve, j);
- vec_free (indices_to_delete);
+ vec_del1 (sm->to_resolve, j);
}
+ vec_free (indices_to_delete);
}
- if (twice_nat)
- vec_del1 (sm->auto_add_sw_if_indices_twice_nat, i);
- else
- vec_del1 (sm->auto_add_sw_if_indices, i);
}
- else
- return VNET_API_ERROR_VALUE_EXIST;
+ if (twice_nat)
+ {
+ vec_del1 (sm->auto_add_sw_if_indices_twice_nat, i);
+ }
+ else
+ {
+ vec_del1 (sm->auto_add_sw_if_indices, i);
+ }
return 0;
}
}
-
- if (is_del)
- return VNET_API_ERROR_NO_SUCH_ENTRY;
-
- /* add to the auto-address list */
- if (twice_nat)
- vec_add1 (sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
- else
- vec_add1 (sm->auto_add_sw_if_indices, sw_if_index);
-
- /* If the address is already bound - or static - add it now */
- if (first_int_addr)
- (void) snat_add_address (sm, first_int_addr, ~0, twice_nat);
-
- return 0;
+ return VNET_API_ERROR_NO_SUCH_ENTRY;
}
int
Code Review / vpp.git / blobdiff