NAT: VPP-1552 code migration from old multiarch scheme
[vpp.git] / src / plugins / nat / nat64_out2in.c
index eb5ecb4..b62bbee 100644 (file)
 
 #include <nat/nat64.h>
 #include <nat/nat_reass.h>
+#include <nat/nat_inlines.h>
 #include <vnet/ip/ip4_to_ip6.h>
 #include <vnet/fib/ip4_fib.h>
+#include <vnet/udp/udp.h>
 
 typedef struct
 {
@@ -65,17 +67,22 @@ format_nat64_out2in_reass_trace (u8 * s, va_list * args)
   return s;
 }
 
-vlib_node_registration_t nat64_out2in_node;
-vlib_node_registration_t nat64_out2in_reass_node;
 
 #define foreach_nat64_out2in_error                       \
-_(UNSUPPORTED_PROTOCOL, "Unsupported protocol")          \
-_(OUT2IN_PACKETS, "Good out2in packets processed")       \
-_(NO_TRANSLATION, "No translation")                      \
+_(UNSUPPORTED_PROTOCOL, "unsupported protocol")          \
+_(OUT2IN_PACKETS, "good out2in packets processed")       \
+_(NO_TRANSLATION, "no translation")                      \
 _(UNKNOWN, "unknown")                                    \
-_(DROP_FRAGMENT, "Drop fragment")                        \
-_(MAX_REASS, "Maximum reassemblies exceeded")            \
-_(MAX_FRAG, "Maximum fragments per reassembly exceeded")
+_(DROP_FRAGMENT, "drop fragment")                        \
+_(MAX_REASS, "maximum reassemblies exceeded")            \
+_(MAX_FRAG, "maximum fragments per reassembly exceeded") \
+_(TCP_PACKETS, "TCP packets")                            \
+_(UDP_PACKETS, "UDP packets")                            \
+_(ICMP_PACKETS, "ICMP packets")                          \
+_(OTHER_PACKETS, "other protocol packets")               \
+_(FRAGMENTS, "fragments")                                \
+_(CACHED_FRAGMENTS, "cached fragments")                  \
+_(PROCESSED_FRAGMENTS, "processed fragments")
 
 
 typedef enum
@@ -94,7 +101,8 @@ static char *nat64_out2in_error_strings[] = {
 
 typedef enum
 {
-  NAT64_OUT2IN_NEXT_LOOKUP,
+  NAT64_OUT2IN_NEXT_IP6_LOOKUP,
+  NAT64_OUT2IN_NEXT_IP4_LOOKUP,
   NAT64_OUT2IN_NEXT_DROP,
   NAT64_OUT2IN_NEXT_REASS,
   NAT64_OUT2IN_N_NEXT,
@@ -104,6 +112,7 @@ typedef struct nat64_out2in_set_ctx_t_
 {
   vlib_buffer_t *b;
   vlib_main_t *vm;
+  u32 thread_index;
 } nat64_out2in_set_ctx_t;
 
 static int
@@ -124,39 +133,43 @@ nat64_out2in_tcp_udp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
   u32 sw_if_index, fib_index;
   u16 *checksum;
   ip_csum_t csum;
+  nat64_db_t *db = &nm->db[ctx->thread_index];
 
   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
   fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 
-  memset (&saddr, 0, sizeof (saddr));
+  clib_memset (&saddr, 0, sizeof (saddr));
   saddr.ip4.as_u32 = ip4->src_address.as_u32;
-  memset (&daddr, 0, sizeof (daddr));
+  clib_memset (&daddr, 0, sizeof (daddr));
   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 
   ste =
-    nat64_db_st_entry_find (&nm->db, &daddr, &saddr, dport, sport, proto,
+    nat64_db_st_entry_find (db, &daddr, &saddr, dport, sport, proto,
                            fib_index, 0);
   if (ste)
     {
-      bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
+      bibe = nat64_db_bib_entry_by_index (db, proto, ste->bibe_index);
       if (!bibe)
        return -1;
     }
   else
     {
-      bibe =
-       nat64_db_bib_entry_find (&nm->db, &daddr, dport, proto, fib_index, 0);
+      bibe = nat64_db_bib_entry_find (db, &daddr, dport, proto, fib_index, 0);
 
       if (!bibe)
        return -1;
 
       nat64_compose_ip6 (&ip6_saddr, &ip4->src_address, bibe->fib_index);
       ste =
-       nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4,
-                                 sport);
-    }
+       nat64_db_st_entry_create (ctx->thread_index, db, bibe, &ip6_saddr,
+                                 &saddr.ip4, sport);
 
-  nat64_session_reset_timeout (ste, ctx->vm);
+      if (!ste)
+       return -1;
+
+      vlib_set_simple_counter (&nm->total_sessions, ctx->thread_index, 0,
+                              db->st.st_entries_num);
+    }
 
   ip6->src_address.as_u64[0] = ste->in_r_addr.as_u64[0];
   ip6->src_address.as_u64[1] = ste->in_r_addr.as_u64[1];
@@ -168,13 +181,19 @@ nat64_out2in_tcp_udp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
   if (proto == IP_PROTOCOL_UDP)
     checksum = &udp->checksum;
   else
-    checksum = &tcp->checksum;
+    {
+      checksum = &tcp->checksum;
+      nat64_tcp_session_set_state (ste, tcp, 0);
+    }
+
   csum = ip_csum_sub_even (*checksum, dport);
   csum = ip_csum_add_even (csum, udp->dst_port);
   *checksum = ip_csum_fold (csum);
 
   vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
 
+  nat64_session_reset_timeout (ste, ctx->vm);
+
   return 0;
 }
 
@@ -189,26 +208,27 @@ nat64_out2in_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6, void *arg)
   ip6_address_t ip6_saddr;
   u32 sw_if_index, fib_index;
   icmp46_header_t *icmp = ip4_next_header (ip4);
+  nat64_db_t *db = &nm->db[ctx->thread_index];
 
   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
   fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 
-  memset (&saddr, 0, sizeof (saddr));
+  clib_memset (&saddr, 0, sizeof (saddr));
   saddr.ip4.as_u32 = ip4->src_address.as_u32;
-  memset (&daddr, 0, sizeof (daddr));
+  clib_memset (&daddr, 0, sizeof (daddr));
   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 
   if (icmp->type == ICMP6_echo_request || icmp->type == ICMP6_echo_reply)
     {
       u16 out_id = ((u16 *) (icmp))[2];
       ste =
-       nat64_db_st_entry_find (&nm->db, &daddr, &saddr, out_id, 0,
+       nat64_db_st_entry_find (db, &daddr, &saddr, out_id, 0,
                                IP_PROTOCOL_ICMP, fib_index, 0);
 
       if (ste)
        {
          bibe =
-           nat64_db_bib_entry_by_index (&nm->db, IP_PROTOCOL_ICMP,
+           nat64_db_bib_entry_by_index (db, IP_PROTOCOL_ICMP,
                                         ste->bibe_index);
          if (!bibe)
            return -1;
@@ -216,15 +236,21 @@ nat64_out2in_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6, void *arg)
       else
        {
          bibe =
-           nat64_db_bib_entry_find (&nm->db, &daddr, out_id,
+           nat64_db_bib_entry_find (db, &daddr, out_id,
                                     IP_PROTOCOL_ICMP, fib_index, 0);
          if (!bibe)
            return -1;
 
          nat64_compose_ip6 (&ip6_saddr, &ip4->src_address, bibe->fib_index);
          ste =
-           nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4,
-                                     0);
+           nat64_db_st_entry_create (ctx->thread_index, db,
+                                     bibe, &ip6_saddr, &saddr.ip4, 0);
+
+         if (!ste)
+           return -1;
+
+         vlib_set_simple_counter (&nm->total_sessions, ctx->thread_index, 0,
+                                  db->st.st_entries_num);
        }
 
       nat64_session_reset_timeout (ste, ctx->vm);
@@ -262,14 +288,15 @@ nat64_out2in_inner_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
   ip46_address_t saddr, daddr;
   u32 sw_if_index, fib_index;
   u8 proto = ip4->protocol;
+  nat64_db_t *db = &nm->db[ctx->thread_index];
 
   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
   fib_index =
     fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP6, sw_if_index);
 
-  memset (&saddr, 0, sizeof (saddr));
+  clib_memset (&saddr, 0, sizeof (saddr));
   saddr.ip4.as_u32 = ip4->src_address.as_u32;
-  memset (&daddr, 0, sizeof (daddr));
+  clib_memset (&daddr, 0, sizeof (daddr));
   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 
   if (proto == IP_PROTOCOL_ICMP6)
@@ -284,12 +311,12 @@ nat64_out2in_inner_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
        return -1;
 
       ste =
-       nat64_db_st_entry_find (&nm->db, &saddr, &daddr, out_id, 0, proto,
+       nat64_db_st_entry_find (db, &saddr, &daddr, out_id, 0, proto,
                                fib_index, 0);
       if (!ste)
        return -1;
 
-      bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
+      bibe = nat64_db_bib_entry_by_index (db, proto, ste->bibe_index);
       if (!bibe)
        return -1;
 
@@ -311,12 +338,12 @@ nat64_out2in_inner_icmp_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
       ip_csum_t csum;
 
       ste =
-       nat64_db_st_entry_find (&nm->db, &saddr, &daddr, sport, dport, proto,
+       nat64_db_st_entry_find (db, &saddr, &daddr, sport, dport, proto,
                                fib_index, 0);
       if (!ste)
        return -1;
 
-      bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
+      bibe = nat64_db_bib_entry_by_index (db, proto, ste->bibe_index);
       if (!bibe)
        return -1;
 
@@ -354,35 +381,40 @@ nat64_out2in_unk_proto_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
   ip6_address_t ip6_saddr;
   u32 sw_if_index, fib_index;
   u8 proto = ip4->protocol;
+  nat64_db_t *db = &nm->db[ctx->thread_index];
 
   sw_if_index = vnet_buffer (ctx->b)->sw_if_index[VLIB_RX];
   fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 
-  memset (&saddr, 0, sizeof (saddr));
+  clib_memset (&saddr, 0, sizeof (saddr));
   saddr.ip4.as_u32 = ip4->src_address.as_u32;
-  memset (&daddr, 0, sizeof (daddr));
+  clib_memset (&daddr, 0, sizeof (daddr));
   daddr.ip4.as_u32 = ip4->dst_address.as_u32;
 
   ste =
-    nat64_db_st_entry_find (&nm->db, &daddr, &saddr, 0, 0, proto, fib_index,
-                           0);
+    nat64_db_st_entry_find (db, &daddr, &saddr, 0, 0, proto, fib_index, 0);
   if (ste)
     {
-      bibe = nat64_db_bib_entry_by_index (&nm->db, proto, ste->bibe_index);
+      bibe = nat64_db_bib_entry_by_index (db, proto, ste->bibe_index);
       if (!bibe)
        return -1;
     }
   else
     {
-      bibe =
-       nat64_db_bib_entry_find (&nm->db, &daddr, 0, proto, fib_index, 0);
+      bibe = nat64_db_bib_entry_find (db, &daddr, 0, proto, fib_index, 0);
 
       if (!bibe)
        return -1;
 
       nat64_compose_ip6 (&ip6_saddr, &ip4->src_address, bibe->fib_index);
-      ste =
-       nat64_db_st_entry_create (&nm->db, bibe, &ip6_saddr, &saddr.ip4, 0);
+      ste = nat64_db_st_entry_create (ctx->thread_index, db,
+                                     bibe, &ip6_saddr, &saddr.ip4, 0);
+
+      if (!ste)
+       return -1;
+
+      vlib_set_simple_counter (&nm->total_sessions, ctx->thread_index, 0,
+                              db->st.st_entries_num);
     }
 
   nat64_session_reset_timeout (ste, ctx->vm);
@@ -398,13 +430,17 @@ nat64_out2in_unk_proto_set_cb (ip4_header_t * ip4, ip6_header_t * ip6,
   return 0;
 }
 
-static uword
-nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
-                     vlib_frame_t * frame)
+VLIB_NODE_FN (nat64_out2in_node) (vlib_main_t * vm,
+                                 vlib_node_runtime_t * node,
+                                 vlib_frame_t * frame)
 {
   u32 n_left_from, *from, *to_next;
   nat64_out2in_next_t next_index;
+  nat64_main_t *nm = &nat64_main;
   u32 pkts_processed = 0;
+  u32 thread_index = vm->thread_index;
+  u32 tcp_packets = 0, udp_packets = 0, icmp_packets = 0, other_packets =
+    0, fragments = 0;
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
@@ -423,6 +459,7 @@ nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
          ip4_header_t *ip40;
          u32 proto0;
          nat64_out2in_set_ctx_t ctx0;
+         udp_header_t *udp0;
 
          /* speculatively enqueue b0 to the current next frame */
          bi0 = from[0];
@@ -437,8 +474,9 @@ nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
 
          ctx0.b = b0;
          ctx0.vm = vm;
+         ctx0.thread_index = thread_index;
 
-         next0 = NAT64_OUT2IN_NEXT_LOOKUP;
+         next0 = NAT64_OUT2IN_NEXT_IP6_LOOKUP;
 
          proto0 = ip_proto_to_snat_proto (ip40->protocol);
 
@@ -449,17 +487,20 @@ nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
                  next0 = NAT64_OUT2IN_NEXT_DROP;
                  b0->error = node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
                }
+             other_packets++;
              goto trace0;
            }
 
          if (PREDICT_FALSE (ip4_is_fragment (ip40)))
            {
              next0 = NAT64_OUT2IN_NEXT_REASS;
+             fragments++;
              goto trace0;
            }
 
          if (proto0 == SNAT_PROTOCOL_ICMP)
            {
+             icmp_packets++;
              if (icmp_to_icmp6
                  (b0, nat64_out2in_icmp_set_cb, &ctx0,
                   nat64_out2in_inner_icmp_set_cb, &ctx0))
@@ -471,8 +512,25 @@ nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
            }
          else
            {
+             if (proto0 == SNAT_PROTOCOL_TCP)
+               tcp_packets++;
+             else
+               udp_packets++;
+
              if (ip4_to_ip6_tcp_udp (b0, nat64_out2in_tcp_udp_set_cb, &ctx0))
                {
+                 udp0 = ip4_next_header (ip40);
+                 /*
+                  * Send DHCP packets to the ipv4 stack, or we won't
+                  * be able to use dhcp client on the outside interface
+                  */
+                 if ((proto0 == SNAT_PROTOCOL_UDP)
+                     && (udp0->dst_port ==
+                         clib_host_to_net_u16 (UDP_DST_PORT_dhcp_to_client)))
+                   {
+                     next0 = NAT64_OUT2IN_NEXT_IP4_LOOKUP;
+                     goto trace0;
+                   }
                  next0 = NAT64_OUT2IN_NEXT_DROP;
                  b0->error = node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
                  goto trace0;
@@ -489,7 +547,7 @@ nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
              t->next_index = next0;
            }
 
-         pkts_processed += next0 != NAT64_OUT2IN_NEXT_DROP;
+         pkts_processed += next0 == NAT64_OUT2IN_NEXT_IP6_LOOKUP;
 
          /* verify speculative enqueue, maybe switch current next frame */
          vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
@@ -497,15 +555,26 @@ nat64_out2in_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
        }
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
-  vlib_node_increment_counter (vm, nat64_out2in_node.index,
+  vlib_node_increment_counter (vm, nm->out2in_node_index,
                               NAT64_OUT2IN_ERROR_OUT2IN_PACKETS,
                               pkts_processed);
+  vlib_node_increment_counter (vm, nm->out2in_node_index,
+                              NAT64_OUT2IN_ERROR_TCP_PACKETS, tcp_packets);
+  vlib_node_increment_counter (vm, nm->out2in_node_index,
+                              NAT64_OUT2IN_ERROR_UDP_PACKETS, tcp_packets);
+  vlib_node_increment_counter (vm, nm->out2in_node_index,
+                              NAT64_OUT2IN_ERROR_ICMP_PACKETS, icmp_packets);
+  vlib_node_increment_counter (vm, nm->out2in_node_index,
+                              NAT64_OUT2IN_ERROR_OTHER_PACKETS,
+                              other_packets);
+  vlib_node_increment_counter (vm, nm->out2in_node_index,
+                              NAT64_OUT2IN_ERROR_FRAGMENTS, fragments);
+
   return frame->n_vectors;
 }
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (nat64_out2in_node) = {
-  .function = nat64_out2in_node_fn,
   .name = "nat64-out2in",
   .vector_size = sizeof (u32),
   .format_trace = format_nat64_out2in_trace,
@@ -516,19 +585,19 @@ VLIB_REGISTER_NODE (nat64_out2in_node) = {
   /* edit / add dispositions here */
   .next_nodes = {
     [NAT64_OUT2IN_NEXT_DROP] = "error-drop",
-    [NAT64_OUT2IN_NEXT_LOOKUP] = "ip6-lookup",
+    [NAT64_OUT2IN_NEXT_IP6_LOOKUP] = "ip6-lookup",
+    [NAT64_OUT2IN_NEXT_IP4_LOOKUP] = "ip4-lookup",
     [NAT64_OUT2IN_NEXT_REASS] = "nat64-out2in-reass",
   },
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (nat64_out2in_node, nat64_out2in_node_fn);
-
 typedef struct nat64_out2in_frag_set_ctx_t_
 {
   vlib_main_t *vm;
   vlib_buffer_t *b;
   u32 sess_index;
+  u32 thread_index;
   u8 proto;
   u8 first_frag;
 } nat64_out2in_frag_set_ctx_t;
@@ -543,17 +612,16 @@ nat64_out2in_frag_set_cb (ip4_header_t * ip4, ip6_header_t * ip6, void *arg)
   udp_header_t *udp = ip4_next_header (ip4);
   ip_csum_t csum;
   u16 *checksum;
+  nat64_db_t *db = &nm->db[ctx->thread_index];
 
-  ste = nat64_db_st_entry_by_index (&nm->db, ctx->proto, ctx->sess_index);
+  ste = nat64_db_st_entry_by_index (db, ctx->proto, ctx->sess_index);
   if (!ste)
     return -1;
 
-  bibe = nat64_db_bib_entry_by_index (&nm->db, ctx->proto, ste->bibe_index);
+  bibe = nat64_db_bib_entry_by_index (db, ctx->proto, ste->bibe_index);
   if (!bibe)
     return -1;
 
-  nat64_session_reset_timeout (ste, ctx->vm);
-
   if (ctx->first_frag)
     {
       udp->dst_port = bibe->in_port;
@@ -594,6 +662,7 @@ nat64_out2in_frag_set_cb (ip4_header_t * ip4, ip6_header_t * ip6, void *arg)
       else
        {
          tcp_header_t *tcp = ip4_next_header (ip4);
+         nat64_tcp_session_set_state (ste, tcp, 0);
          checksum = &tcp->checksum;
          csum = ip_csum_sub_even (*checksum, bibe->out_addr.as_u32);
          csum = ip_csum_sub_even (csum, ste->out_r_addr.as_u32);
@@ -616,19 +685,22 @@ nat64_out2in_frag_set_cb (ip4_header_t * ip4, ip6_header_t * ip6, void *arg)
 
   vnet_buffer (ctx->b)->sw_if_index[VLIB_TX] = bibe->fib_index;
 
+  nat64_session_reset_timeout (ste, ctx->vm);
+
   return 0;
 }
 
-static uword
-nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
-                           vlib_frame_t * frame)
+VLIB_NODE_FN (nat64_out2in_reass_node) (vlib_main_t * vm,
+                                       vlib_node_runtime_t * node,
+                                       vlib_frame_t * frame)
 {
   u32 n_left_from, *from, *to_next;
   nat64_out2in_next_t next_index;
-  u32 pkts_processed = 0;
+  u32 pkts_processed = 0, cached_fragments = 0;
   u32 *fragments_to_drop = 0;
   u32 *fragments_to_loopback = 0;
   nat64_main_t *nm = &nat64_main;
+  u32 thread_index = vm->thread_index;
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
@@ -655,6 +727,7 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
          nat64_db_bib_entry_t *bibe0;
          ip6_address_t ip6_saddr0;
          nat64_out2in_frag_set_ctx_t ctx0;
+         nat64_db_t *db = &nm->db[thread_index];
 
          /* speculatively enqueue b0 to the current next frame */
          bi0 = from[0];
@@ -665,13 +738,15 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
          n_left_to_next -= 1;
 
          b0 = vlib_get_buffer (vm, bi0);
-         next0 = NAT64_OUT2IN_NEXT_LOOKUP;
+         next0 = NAT64_OUT2IN_NEXT_IP6_LOOKUP;
 
          sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
          fib_index0 =
            fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
                                                 sw_if_index0);
 
+         ctx0.thread_index = thread_index;
+
          if (PREDICT_FALSE (nat_reass_is_drop_frag (1)))
            {
              next0 = NAT64_OUT2IN_NEXT_DROP;
@@ -708,19 +783,19 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
            {
              ctx0.first_frag = 1;
 
-             memset (&saddr0, 0, sizeof (saddr0));
+             clib_memset (&saddr0, 0, sizeof (saddr0));
              saddr0.ip4.as_u32 = ip40->src_address.as_u32;
-             memset (&daddr0, 0, sizeof (daddr0));
+             clib_memset (&daddr0, 0, sizeof (daddr0));
              daddr0.ip4.as_u32 = ip40->dst_address.as_u32;
 
              ste0 =
-               nat64_db_st_entry_find (&nm->db, &daddr0, &saddr0,
+               nat64_db_st_entry_find (db, &daddr0, &saddr0,
                                        udp0->dst_port, udp0->src_port,
                                        ip40->protocol, fib_index0, 0);
              if (!ste0)
                {
                  bibe0 =
-                   nat64_db_bib_entry_find (&nm->db, &daddr0, udp0->dst_port,
+                   nat64_db_bib_entry_find (db, &daddr0, udp0->dst_port,
                                             ip40->protocol, fib_index0, 0);
                  if (!bibe0)
                    {
@@ -733,7 +808,8 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
                  nat64_compose_ip6 (&ip6_saddr0, &ip40->src_address,
                                     bibe0->fib_index);
                  ste0 =
-                   nat64_db_st_entry_create (&nm->db, bibe0, &ip6_saddr0,
+                   nat64_db_st_entry_create (thread_index,
+                                             db, bibe0, &ip6_saddr0,
                                              &saddr0.ip4, udp0->src_port);
 
                  if (!ste0)
@@ -743,9 +819,12 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
                        node->errors[NAT64_OUT2IN_ERROR_NO_TRANSLATION];
                      goto trace0;
                    }
+
+                 vlib_set_simple_counter (&nm->total_sessions, thread_index,
+                                          0, db->st.st_entries_num);
                }
-             reass0->sess_index =
-               nat64_db_st_entry_get_index (&nm->db, ste0);
+             reass0->sess_index = nat64_db_st_entry_get_index (db, ste0);
+             reass0->thread_index = thread_index;
 
              nat_ip4_reass_get_frags (reass0, &fragments_to_loopback);
            }
@@ -755,7 +834,8 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
 
              if (PREDICT_FALSE (reass0->sess_index == (u32) ~ 0))
                {
-                 if (nat_ip4_reass_add_fragment (reass0, bi0))
+                 if (nat_ip4_reass_add_fragment
+                     (thread_index, reass0, bi0, &fragments_to_drop))
                    {
                      b0->error = node->errors[NAT64_OUT2IN_ERROR_MAX_FRAG];
                      next0 = NAT64_OUT2IN_NEXT_DROP;
@@ -794,6 +874,7 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
            {
              n_left_to_next++;
              to_next--;
+             cached_fragments++;
            }
          else
            {
@@ -811,17 +892,16 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
              u32 len = vec_len (fragments_to_loopback);
              if (len <= VLIB_FRAME_SIZE)
                {
-                 clib_memcpy (from, fragments_to_loopback,
-                              sizeof (u32) * len);
+                 clib_memcpy_fast (from, fragments_to_loopback,
+                                   sizeof (u32) * len);
                  n_left_from = len;
                  vec_reset_length (fragments_to_loopback);
                }
              else
                {
-                 clib_memcpy (from,
-                              fragments_to_loopback + (len -
-                                                       VLIB_FRAME_SIZE),
-                              sizeof (u32) * VLIB_FRAME_SIZE);
+                 clib_memcpy_fast (from, fragments_to_loopback +
+                                   (len - VLIB_FRAME_SIZE),
+                                   sizeof (u32) * VLIB_FRAME_SIZE);
                  n_left_from = VLIB_FRAME_SIZE;
                  _vec_len (fragments_to_loopback) = len - VLIB_FRAME_SIZE;
                }
@@ -831,9 +911,12 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
 
-  vlib_node_increment_counter (vm, nat64_out2in_reass_node.index,
-                              NAT64_OUT2IN_ERROR_OUT2IN_PACKETS,
+  vlib_node_increment_counter (vm, nm->out2in_reass_node_index,
+                              NAT64_OUT2IN_ERROR_PROCESSED_FRAGMENTS,
                               pkts_processed);
+  vlib_node_increment_counter (vm, nm->out2in_reass_node_index,
+                              NAT64_OUT2IN_ERROR_CACHED_FRAGMENTS,
+                              cached_fragments);
 
   nat_send_all_to_node (vm, fragments_to_drop, node,
                        &node->errors[NAT64_OUT2IN_ERROR_DROP_FRAGMENT],
@@ -846,7 +929,6 @@ nat64_out2in_reass_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (nat64_out2in_reass_node) = {
-  .function = nat64_out2in_reass_node_fn,
   .name = "nat64-out2in-reass",
   .vector_size = sizeof (u32),
   .format_trace = format_nat64_out2in_reass_trace,
@@ -857,14 +939,132 @@ VLIB_REGISTER_NODE (nat64_out2in_reass_node) = {
   /* edit / add dispositions here */
   .next_nodes = {
     [NAT64_OUT2IN_NEXT_DROP] = "error-drop",
-    [NAT64_OUT2IN_NEXT_LOOKUP] = "ip6-lookup",
+    [NAT64_OUT2IN_NEXT_IP6_LOOKUP] = "ip6-lookup",
+    [NAT64_OUT2IN_NEXT_IP4_LOOKUP] = "ip4-lookup",
     [NAT64_OUT2IN_NEXT_REASS] = "nat64-out2in-reass",
   },
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (nat64_out2in_reass_node,
-                             nat64_out2in_reass_node_fn);
+#define foreach_nat64_out2in_handoff_error                       \
+_(CONGESTION_DROP, "congestion drop")                            \
+_(SAME_WORKER, "same worker")                                    \
+_(DO_HANDOFF, "do handoff")
+
+typedef enum
+{
+#define _(sym,str) NAT64_OUT2IN_HANDOFF_ERROR_##sym,
+  foreach_nat64_out2in_handoff_error
+#undef _
+    NAT64_OUT2IN_HANDOFF_N_ERROR,
+} nat64_out2in_handoff_error_t;
+
+static char *nat64_out2in_handoff_error_strings[] = {
+#define _(sym,string) string,
+  foreach_nat64_out2in_handoff_error
+#undef _
+};
+
+typedef struct
+{
+  u32 next_worker_index;
+} nat64_out2in_handoff_trace_t;
+
+static u8 *
+format_nat64_out2in_handoff_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  nat64_out2in_handoff_trace_t *t =
+    va_arg (*args, nat64_out2in_handoff_trace_t *);
+
+  s =
+    format (s, "NAT64-OUT2IN-HANDOFF: next-worker %d", t->next_worker_index);
+
+  return s;
+}
+
+VLIB_NODE_FN (nat64_out2in_handoff_node) (vlib_main_t * vm,
+                                         vlib_node_runtime_t * node,
+                                         vlib_frame_t * frame)
+{
+  nat64_main_t *nm = &nat64_main;
+  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
+  u32 n_enq, n_left_from, *from;
+  u16 thread_indices[VLIB_FRAME_SIZE], *ti;
+  u32 fq_index;
+  u32 thread_index = vm->thread_index;
+  u32 do_handoff = 0, same_worker = 0;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  vlib_get_buffers (vm, from, bufs, n_left_from);
+
+  b = bufs;
+  ti = thread_indices;
+
+  fq_index = nm->fq_out2in_index;
+
+  while (n_left_from > 0)
+    {
+      ip4_header_t *ip0;
+
+      ip0 = vlib_buffer_get_current (b[0]);
+      ti[0] = nat64_get_worker_out2in (ip0);
+
+      if (ti[0] != thread_index)
+       do_handoff++;
+      else
+       same_worker++;
+
+      if (PREDICT_FALSE
+         ((node->flags & VLIB_NODE_FLAG_TRACE)
+          && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
+       {
+         nat64_out2in_handoff_trace_t *t =
+           vlib_add_trace (vm, node, b[0], sizeof (*t));
+         t->next_worker_index = ti[0];
+       }
+
+      n_left_from -= 1;
+      ti += 1;
+      b += 1;
+    }
+
+  n_enq =
+    vlib_buffer_enqueue_to_thread (vm, fq_index, from, thread_indices,
+                                  frame->n_vectors, 1);
+
+  if (n_enq < frame->n_vectors)
+    vlib_node_increment_counter (vm, node->node_index,
+                                NAT64_OUT2IN_HANDOFF_ERROR_CONGESTION_DROP,
+                                frame->n_vectors - n_enq);
+  vlib_node_increment_counter (vm, node->node_index,
+                              NAT64_OUT2IN_HANDOFF_ERROR_SAME_WORKER,
+                              same_worker);
+  vlib_node_increment_counter (vm, node->node_index,
+                              NAT64_OUT2IN_HANDOFF_ERROR_DO_HANDOFF,
+                              do_handoff);
+
+  return frame->n_vectors;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (nat64_out2in_handoff_node) = {
+  .name = "nat64-out2in-handoff",
+  .vector_size = sizeof (u32),
+  .format_trace = format_nat64_out2in_handoff_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_errors = ARRAY_LEN(nat64_out2in_handoff_error_strings),
+  .error_strings = nat64_out2in_handoff_error_strings,
+
+  .n_next_nodes = 1,
+
+  .next_nodes = {
+    [0] = "error-drop",
+  },
+};
+/* *INDENT-ON* */
 
 /*
  * fd.io coding-style-patch-verification: ON