}
#endif
+// allocate exact address based on preference
+static_always_inline int
+nat_alloc_addr_and_port_exact (snat_address_t * a,
+ u32 thread_index,
+ nat_protocol_t proto,
+ ip4_address_t * addr,
+ u16 * port,
+ u16 port_per_thread, u32 snat_thread_index)
+{
+ u32 portnum;
+
+ switch (proto)
+ {
+#define _(N, j, n, s) \
+ case NAT_PROTOCOL_##N: \
+ if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
+ { \
+ while (1) \
+ { \
+ portnum = (port_per_thread * \
+ snat_thread_index) + \
+ snat_random_port(0, port_per_thread - 1) + 1024; \
+ if (a->busy_##n##_port_refcounts[portnum]) \
+ continue; \
+ --a->busy_##n##_port_refcounts[portnum]; \
+ a->busy_##n##_ports_per_thread[thread_index]++; \
+ a->busy_##n##_ports++; \
+ *addr = a->addr; \
+ *port = clib_host_to_net_u16(portnum); \
+ return 0; \
+ } \
+ } \
+ break;
+ foreach_nat_protocol
+#undef _
+ default:
+ nat_elog_info ("unknown protocol");
+ return 1;
+ }
+
+ /* Totally out of translations to use... */
+ snat_ipfix_logging_addresses_exhausted (thread_index, 0);
+ return 1;
+}
+
+
static snat_session_t *
create_session_for_static_mapping_ed (snat_main_t * sm,
vlib_buffer_t * b,
u32 rx_fib_index,
u32 thread_index,
twice_nat_type_t twice_nat,
- lb_nat_type_t lb_nat, f64 now)
+ lb_nat_type_t lb_nat, f64 now,
+ snat_static_mapping_t * mapping)
{
snat_session_t *s;
ip4_header_t *ip;
if (twice_nat == TWICE_NAT || (twice_nat == TWICE_NAT_SELF &&
ip->src_address.as_u32 == i2o_addr.as_u32))
{
- if (snat_alloc_outside_address_and_port (sm->twice_nat_addresses, 0,
- thread_index,
- nat_proto,
- &s->ext_host_nat_addr,
- &s->ext_host_nat_port,
- sm->port_per_thread,
- tsm->snat_thread_index))
+ int rc = 0;
+ snat_address_t *filter = 0;
+
+ // if exact address is specified use this address
+ if (is_exact_address (mapping))
+ {
+ snat_address_t *ap;
+ vec_foreach (ap, sm->twice_nat_addresses)
+ {
+ if (mapping->pool_addr.as_u32 == ap->addr.as_u32)
+ {
+ filter = ap;
+ break;
+ }
+ }
+ }
+
+ if (filter)
+ {
+ rc = nat_alloc_addr_and_port_exact (filter,
+ thread_index,
+ nat_proto,
+ &s->ext_host_nat_addr,
+ &s->ext_host_nat_port,
+ sm->port_per_thread,
+ tsm->snat_thread_index);
+ s->flags |= SNAT_SESSION_FLAG_EXACT_ADDRESS;
+ }
+ else
+ {
+ rc =
+ snat_alloc_outside_address_and_port (sm->twice_nat_addresses, 0,
+ thread_index, nat_proto,
+ &s->ext_host_nat_addr,
+ &s->ext_host_nat_port,
+ sm->port_per_thread,
+ tsm->snat_thread_index);
+ }
+
+ if (rc)
{
b->error = node->errors[NAT_OUT2IN_ED_ERROR_OUT_OF_PORTS];
nat_ed_session_delete (sm, s, thread_index, 1);
nat_elog_notice ("out2in-ed key del failed");
return 0;
}
+
s->flags |= SNAT_SESSION_FLAG_TWICE_NAT;
init_ed_kv (&kv, i2o_addr, i2o_port, s->ext_host_nat_addr,
s->ext_host_nat_port, i2o_fib_index, ip->protocol,
&s->ext_host_nat_addr, s->ext_host_nat_port,
s->nat_proto, s->in2out.fib_index, s->flags, thread_index, 0);
+ per_vrf_sessions_register_session (s, thread_index);
+
return s;
}
kv.value = s - tsm->sessions;
if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &kv, 1))
nat_elog_notice ("in2out_ed key add failed");
+
+ per_vrf_sessions_register_session (s, thread_index);
}
if (ip->protocol == IP_PROTOCOL_TCP)
u16 sm_port;
u32 sm_fib_index;
*dont_translate = 0;
+ snat_static_mapping_t *m;
sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_RX];
rx_fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
if (clib_bihash_search_16_8 (&sm->out2in_ed, &kv, &value))
{
- /* Try to match static mapping */
if (snat_static_mapping_match
(sm, ip->dst_address, l_port, rx_fib_index,
ip_proto_to_nat_proto (ip->protocol), &sm_addr, &sm_port,
- &sm_fib_index, 1, &is_addr_only, 0, 0, 0, &identity_nat))
+ &sm_fib_index, 1, &is_addr_only, 0, 0, 0, &identity_nat, &m))
{
+ // static mapping not matched
if (!sm->forwarding_enabled)
{
/* Don't NAT packet aimed at the intfc address */
ip->dst_address.as_u32)))
{
*dont_translate = 1;
- goto out;
}
- b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
- next = NAT_NEXT_DROP;
- goto out;
+ else
+ {
+ b->error = node->errors[NAT_OUT2IN_ED_ERROR_NO_TRANSLATION];
+ next = NAT_NEXT_DROP;
+ }
}
else
{
thread_index, rx_fib_index))
{
next = NAT_NEXT_IN2OUT_ED_FAST_PATH;
- goto out;
}
- if (sm->num_workers > 1)
- create_bypass_for_fwd_worker (sm, b, ip, rx_fib_index);
else
- create_bypass_for_fwd (sm, b, ip, rx_fib_index, thread_index);
- goto out;
+ {
+ if (sm->num_workers > 1)
+ create_bypass_for_fwd_worker (sm, b, ip, rx_fib_index);
+ else
+ create_bypass_for_fwd (sm, b, ip, rx_fib_index,
+ thread_index);
+ }
}
+ goto out;
}
if (PREDICT_FALSE
l_port, rx_fib_index, *proto,
node, rx_fib_index,
thread_index, 0, 0,
- vlib_time_now (vm));
-
+ vlib_time_now (vm), m);
if (!s)
- {
- next = NAT_NEXT_DROP;
- goto out;
- }
+ next = NAT_NEXT_DROP;
}
else
{
ip->protocol, thread_index, s - tsm->sessions);
if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &s_kv, 1))
nat_elog_notice ("in2out key add failed");
+
+ per_vrf_sessions_register_session (s, thread_index);
}
/* Update IP checksum */
vlib_frame_t * frame,
int is_multi_worker)
{
- u32 n_left_from, *from, pkts_processed = 0, stats_node_index;
+ u32 n_left_from, *from;
snat_main_t *sm = &snat_main;
f64 now = vlib_time_now (vm);
u32 thread_index = vm->thread_index;
snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
- u32 tcp_packets = 0, udp_packets = 0, icmp_packets = 0, other_packets =
- 0, fragments = 0;
-
- stats_node_index = sm->ed_out2in_node_index;
from = vlib_frame_vector_args (frame);
n_left_from = frame->n_vectors;
ip_csum_t sum0;
b0 = *b;
+ b++;
+
+ /* Prefetch next iteration. */
+ if (PREDICT_TRUE (n_left_from >= 2))
+ {
+ vlib_buffer_t *p2;
+
+ p2 = *b;
+
+ vlib_prefetch_buffer_header (p2, LOAD);
+
+ CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ }
+
next[0] = vnet_buffer2 (b0)->nat.arc_next;
vnet_buffer (b0)->snat.flags = 0;
}
}
+ // lookup for session
if (clib_bihash_search_16_8 (&sm->out2in_ed, &kv0, &value0))
{
+ // session does not exist go slow path
next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
goto trace0;
}
ed_value_get_session_index (&value0));
skip_lookup:
+
+ if (PREDICT_FALSE (per_vrf_sessions_is_expired (s0, thread_index)))
+ {
+ // session is closed, go slow path
+ nat_free_session_data (sm, s0, thread_index, 0);
+ nat_ed_session_delete (sm, s0, thread_index, 1);
+ next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
+ goto trace0;
+ }
+
if (s0->tcp_closed_timestamp)
{
if (now >= s0->tcp_closed_timestamp)
{
- // session is closed, go slow path
+ // session is closed, go slow path, freed in slow path
next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
}
else
next[0] = NAT_NEXT_OUT2IN_ED_SLOW_PATH;
goto trace0;
}
- //
old_addr0 = ip0->dst_address.as_u32;
new_addr0 = ip0->dst_address.as_u32 = s0->in2out.addr.as_u32;
}
tcp0->checksum = ip_csum_fold (sum0);
}
- tcp_packets++;
+ vlib_increment_simple_counter (&sm->counters.fastpath.out2in_ed.tcp,
+ thread_index, sw_if_index0, 1);
if (nat44_set_tcp_session_state_o2i
- (sm, now, s0,
- vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags,
+ (sm, now, s0, vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags,
vnet_buffer (b0)->ip.reass.tcp_ack_number,
vnet_buffer (b0)->ip.reass.tcp_seq_number, thread_index))
goto trace0;
ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
}
udp0->checksum = ip_csum_fold (sum0);
- udp_packets++;
+ vlib_increment_simple_counter (&sm->counters.fastpath.out2in_ed.udp,
+ thread_index, sw_if_index0, 1);
}
else
{
ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
}
}
- udp_packets++;
+ vlib_increment_simple_counter (&sm->counters.fastpath.out2in_ed.udp,
+ thread_index, sw_if_index0, 1);
}
/* Accounting */
t->session_index = ~0;
}
- pkts_processed += next[0] == vnet_buffer2 (b0)->nat.arc_next;
+ if (next[0] == NAT_NEXT_DROP)
+ {
+ vlib_increment_simple_counter (&sm->counters.fastpath.
+ out2in_ed.drops, thread_index,
+ sw_if_index0, 1);
+ }
n_left_from--;
next++;
- b++;
}
vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
frame->n_vectors);
-
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_OUT2IN_PACKETS,
- pkts_processed);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_TCP_PACKETS, tcp_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_UDP_PACKETS, udp_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_ICMP_PACKETS,
- icmp_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_OTHER_PACKETS,
- other_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_FRAGMENTS, fragments);
return frame->n_vectors;
}
vlib_node_runtime_t * node,
vlib_frame_t * frame)
{
- u32 n_left_from, *from, pkts_processed = 0, stats_node_index;
+ u32 n_left_from, *from;
snat_main_t *sm = &snat_main;
f64 now = vlib_time_now (vm);
u32 thread_index = vm->thread_index;
snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
- u32 tcp_packets = 0, udp_packets = 0, icmp_packets = 0, other_packets =
- 0, fragments = 0;
-
- stats_node_index = sm->ed_out2in_slowpath_node_index;
+ snat_static_mapping_t *m;
from = vlib_frame_vector_args (frame);
n_left_from = frame->n_vectors;
if (!s0)
next[0] = NAT_NEXT_DROP;
}
- other_packets++;
+ vlib_increment_simple_counter (&sm->counters.slowpath.
+ out2in_ed.other, thread_index,
+ sw_if_index0, 1);
goto trace0;
}
next[0] = icmp_out2in_ed_slow_path
(sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
next[0], now, thread_index, &s0);
- icmp_packets++;
+ vlib_increment_simple_counter (&sm->counters.slowpath.
+ out2in_ed.icmp, thread_index,
+ sw_if_index0, 1);
goto trace0;
}
(sm, ip0->dst_address,
vnet_buffer (b0)->ip.reass.l4_dst_port, rx_fib_index0,
proto0, &sm_addr, &sm_port, &sm_fib_index, 1, 0,
- &twice_nat0, &lb_nat0, &ip0->src_address, &identity_nat0))
+ &twice_nat0, &lb_nat0, &ip0->src_address, &identity_nat0, &m))
{
/*
* Send DHCP packets to the ipv4 stack, or we won't
thread_index, rx_fib_index0))
{
next[0] = NAT_NEXT_IN2OUT_ED_FAST_PATH;
- goto trace0;
}
- if (sm->num_workers > 1)
- create_bypass_for_fwd_worker (sm, b0, ip0, rx_fib_index0);
else
- create_bypass_for_fwd (sm, b0, ip0, rx_fib_index0,
- thread_index);
+ {
+ if (sm->num_workers > 1)
+ create_bypass_for_fwd_worker (sm, b0, ip0,
+ rx_fib_index0);
+ else
+ create_bypass_for_fwd (sm, b0, ip0, rx_fib_index0,
+ thread_index);
+ }
}
goto trace0;
}
rx_fib_index0, proto0,
node, rx_fib_index0,
thread_index, twice_nat0,
- lb_nat0, now);
+ lb_nat0, now, m);
if (!s0)
{
next[0] = NAT_NEXT_DROP;
}
tcp0->checksum = ip_csum_fold (sum0);
}
- tcp_packets++;
+ vlib_increment_simple_counter (&sm->counters.slowpath.out2in_ed.tcp,
+ thread_index, sw_if_index0, 1);
if (nat44_set_tcp_session_state_o2i
- (sm, now, s0,
- vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags,
+ (sm, now, s0, vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags,
vnet_buffer (b0)->ip.reass.tcp_ack_number,
vnet_buffer (b0)->ip.reass.tcp_seq_number, thread_index))
goto trace0;
ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
}
udp0->checksum = ip_csum_fold (sum0);
- udp_packets++;
+ vlib_increment_simple_counter (&sm->counters.slowpath.out2in_ed.udp,
+ thread_index, sw_if_index0, 1);
}
else
{
ip0->src_address.as_u32 = s0->ext_host_nat_addr.as_u32;
}
}
- udp_packets++;
+ vlib_increment_simple_counter (&sm->counters.slowpath.out2in_ed.udp,
+ thread_index, sw_if_index0, 1);
}
/* Accounting */
t->session_index = ~0;
}
- pkts_processed += next[0] == vnet_buffer2 (b0)->nat.arc_next;
+ if (next[0] == NAT_NEXT_DROP)
+ {
+ vlib_increment_simple_counter (&sm->counters.slowpath.
+ out2in_ed.drops, thread_index,
+ sw_if_index0, 1);
+ }
n_left_from--;
next++;
vlib_buffer_enqueue_to_next (vm, node, from, (u16 *) nexts,
frame->n_vectors);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_OUT2IN_PACKETS,
- pkts_processed);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_TCP_PACKETS, tcp_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_UDP_PACKETS, udp_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_ICMP_PACKETS,
- icmp_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_OTHER_PACKETS,
- other_packets);
- vlib_node_increment_counter (vm, stats_node_index,
- NAT_OUT2IN_ED_ERROR_FRAGMENTS, fragments);
return frame->n_vectors;
}
Code Review / vpp.git / blobdiff