X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fcnat%2Fcnat_node_vip.c;h=d320746c5fa248c25bda863921fa5519243e20b8;hb=663103279;hp=d041606786b0649aac242aa8430d33c954439243;hpb=613b2c3c78fbec12cc87a0095ee5488252449698;p=vpp.git diff --git a/src/plugins/cnat/cnat_node_vip.c b/src/plugins/cnat/cnat_node_vip.c index d041606786b..d320746c5fa 100644 --- a/src/plugins/cnat/cnat_node_vip.c +++ b/src/plugins/cnat/cnat_node_vip.c @@ -15,19 +15,8 @@ #include #include -#include - -#include -#include - -typedef struct cnat_translation_trace_t_ -{ - cnat_session_t session; - cnat_translation_t tr; - u32 found_session; - u32 created_session; - u32 has_tr; -} cnat_translation_trace_t; +#include +#include typedef enum cnat_translation_next_t_ { @@ -39,37 +28,14 @@ typedef enum cnat_translation_next_t_ vlib_node_registration_t cnat_vip_ip4_node; vlib_node_registration_t cnat_vip_ip6_node; -static u8 * -format_cnat_translation_trace (u8 * s, va_list * args) -{ - CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); - CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); - cnat_translation_trace_t *t = - va_arg (*args, cnat_translation_trace_t *); - - if (t->found_session) - s = format (s, "found: %U", format_cnat_session, &t->session, 1); - else if (t->created_session) - s = format (s, "created: %U\n tr: %U", - format_cnat_session, &t->session, 1, - format_cnat_translation, - &t->tr, 0); - else if (t->has_tr) - s = format (s, "tr pass: %U", format_cnat_translation, - &t->tr, 0); - else - s = format (s, "not found"); - return s; -} - /* CNat sub for NAT behind a fib entry (VIP or interposed real IP) */ -always_inline uword -cnat_vip_inline (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_buffer_t * b, - cnat_node_ctx_t * ctx, int rv, cnat_session_t * session) +static uword +cnat_vip_node_fn (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_buffer_t *b, + cnat_node_ctx_t *ctx, int session_not_found, + cnat_session_t *session) { vlib_combined_counter_main_t *cntm = &cnat_translation_counters; + cnat_src_policy_main_t *cspm = &cnat_src_policy_main; const cnat_translation_t *ct = NULL; ip4_header_t *ip4 = NULL; ip_protocol_t iproto; @@ -78,7 +44,9 @@ cnat_vip_inline (vlib_main_t * vm, cnat_client_t *cc; u16 next0; index_t cti; - int created_session = 0; + u8 trace_flags = 0; + int rv; + if (AF_IP4 == ctx->af) { ip4 = vlib_buffer_get_current (b); @@ -94,8 +62,8 @@ cnat_vip_inline (vlib_main_t * vm, cc = cnat_client_get (vnet_buffer (b)->ip.adj_index[VLIB_TX]); - if (iproto != IP_PROTOCOL_UDP && iproto != IP_PROTOCOL_TCP - && iproto != IP_PROTOCOL_ICMP && iproto != IP_PROTOCOL_ICMP6) + /* Wrong session key */ + if (session->key.cs_proto == 0) { /* Dont translate & follow the fib programming */ next0 = cc->cc_parent.dpoi_next_node; @@ -103,19 +71,15 @@ cnat_vip_inline (vlib_main_t * vm, goto trace; } - ct = cnat_find_translation (cc->parent_cci, - clib_host_to_net_u16 (udp0->dst_port), - iproto); - - if (!rv) + if (!session_not_found) { /* session table hit */ cnat_timestamp_update (session->value.cs_ts_index, ctx->now); - if (NULL != ct) + if (INDEX_INVALID != session->value.cs_lbi) { /* Translate & follow the translation given LB */ - next0 = ct->ct_lb.dpoi_next_node; + next0 = session->value.dpoi_next_node; vnet_buffer (b)->ip.adj_index[VLIB_TX] = session->value.cs_lbi; } else if (session->value.flags & CNAT_SESSION_FLAG_HAS_SNAT) @@ -133,6 +97,9 @@ cnat_vip_inline (vlib_main_t * vm, } else { + ct = + cnat_find_translation (cc->parent_cci, + clib_host_to_net_u16 (udp0->dst_port), iproto); if (NULL == ct) { /* Dont translate & Follow the fib programming */ @@ -142,14 +109,12 @@ cnat_vip_inline (vlib_main_t * vm, } /* New flow, create the sessions */ - const load_balance_t *lb0; cnat_ep_trk_t *trk0; - u32 hash_c0, bucket0; u32 rsession_flags = 0; - const dpo_id_t *dpo0; + u32 dpoi_index = -1; - lb0 = load_balance_get (ct->ct_lb.dpoi_index); - if (!lb0->lb_n_buckets) + trk0 = cnat_load_balance (ct, ctx->af, ip4, ip6, &dpoi_index); + if (PREDICT_FALSE (NULL == trk0)) { /* Dont translate & Follow the fib programming */ vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index; @@ -157,16 +122,7 @@ cnat_vip_inline (vlib_main_t * vm, goto trace; } - /* session table miss */ - hash_c0 = (AF_IP4 == ctx->af ? - ip4_compute_flow_hash (ip4, lb0->lb_hash_config) : - ip6_compute_flow_hash (ip6, lb0->lb_hash_config)); - bucket0 = hash_c0 & lb0->lb_n_buckets_minus_1; - dpo0 = load_balance_get_fwd_bucket (lb0, bucket0); - /* add the session */ - trk0 = &ct->ct_paths[bucket0]; - ip46_address_copy (&session->value.cs_ip[VLIB_TX], &trk0->ct_ep[VLIB_TX].ce_ip.ip); if (ip_address_is_zero (&trk0->ct_ep[VLIB_RX].ce_ip)) @@ -190,97 +146,85 @@ cnat_vip_inline (vlib_main_t * vm, session->value.cs_port[VLIB_RX] = clib_host_to_net_u16 (trk0->ct_ep[VLIB_RX].ce_port); + session->value.dpoi_next_node = ct->ct_lb.dpoi_next_node; + session->value.cs_lbi = dpoi_index; session->value.flags = 0; - if (!session->value.cs_port[VLIB_RX]) + + rv = cspm->vip_policy (vm, b, session, &rsession_flags, ct, ctx); + if (CNAT_SOURCE_ERROR_USE_DEFAULT == rv) + rv = cspm->default_policy (vm, b, session, &rsession_flags, ct, ctx); + if (rv) { - u16 sport; - sport = udp0->src_port; - /* Allocate a port only if asked and if we actually sNATed */ - if ((ct->flags & CNAT_TRANSLATION_FLAG_ALLOCATE_PORT) - && (rsession_flags & CNAT_SESSION_FLAG_HAS_SNAT)) { - sport = 0; /* force allocation */ - session->value.flags |= CNAT_SESSION_FLAG_ALLOC_PORT; - rv = cnat_allocate_port (&sport, iproto); - if (rv) - { - vlib_node_increment_counter (vm, cnat_vip_ip4_node.index, - CNAT_ERROR_EXHAUSTED_PORTS, 1); - next0 = CNAT_TRANSLATION_NEXT_DROP; - goto trace; - } + if (CNAT_SOURCE_ERROR_EXHAUSTED_PORTS == rv) + { + vlib_node_registration_t *node = + (AF_IP4 == ctx->af) ? &cnat_vip_ip4_node : &cnat_vip_ip6_node; + vlib_node_increment_counter (vm, node->index, + CNAT_ERROR_EXHAUSTED_PORTS, 1); } - - session->value.cs_port[VLIB_RX] = sport; + next0 = CNAT_TRANSLATION_NEXT_DROP; + goto trace; } - session->value.cs_lbi = dpo0->dpoi_index; /* refcnt session in current client */ cnat_client_cnt_session (cc); - cnat_session_create (session, ctx, rsession_flags); - created_session = 1; + cnat_session_create (session, ctx); + if (!(ct->flags & CNAT_TR_FLAG_NO_RETURN_SESSION)) + cnat_rsession_create (session, ctx, CNAT_LOCATION_FIB, rsession_flags); + trace_flags |= CNAT_TRACE_SESSION_CREATED; next0 = ct->ct_lb.dpoi_next_node; vnet_buffer (b)->ip.adj_index[VLIB_TX] = session->value.cs_lbi; } if (AF_IP4 == ctx->af) - cnat_translation_ip4 (session, ip4, udp0); + cnat_translation_ip4 (session, ip4, udp0, vnet_buffer (b)->oflags); else - cnat_translation_ip6 (session, ip6, udp0); + cnat_translation_ip6 (session, ip6, udp0, vnet_buffer (b)->oflags); if (NULL != ct) { cti = ct - cnat_translation_pool; vlib_increment_combined_counter (cntm, ctx->thread_index, cti, 1, - vlib_buffer_length_in_chain (vm, b)); + vlib_buffer_length_in_chain (vm, b)); } trace: if (PREDICT_FALSE (ctx->do_trace)) { - cnat_translation_trace_t *t; - - t = vlib_add_trace (vm, node, b, sizeof (*t)); - - t->found_session = !rv; - t->created_session = created_session; - if (t->found_session || t->created_session) - clib_memcpy (&t->session, session, sizeof (t->session)); - t->has_tr = (NULL != ct); - if (t->has_tr) - clib_memcpy (&t->tr, ct, sizeof (cnat_translation_t)); + trace_flags |= session_not_found ? 0 : CNAT_TRACE_SESSION_FOUND; + cnat_add_trace (vm, node, b, session, ct, trace_flags); } return next0; } VLIB_NODE_FN (cnat_vip_ip4_node) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) + vlib_node_runtime_t * node, + vlib_frame_t * frame) { if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE))) - return cnat_node_inline (vm, node, frame, cnat_vip_inline, AF_IP4, - 1 /* do_trace */ ); - return cnat_node_inline (vm, node, frame, cnat_vip_inline, AF_IP4, - 0 /* do_trace */ ); + return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP4, + CNAT_LOCATION_FIB, 1 /* do_trace */); + return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP4, + CNAT_LOCATION_FIB, 0 /* do_trace */); } VLIB_NODE_FN (cnat_vip_ip6_node) (vlib_main_t * vm, - vlib_node_runtime_t * node, - vlib_frame_t * frame) + vlib_node_runtime_t * node, + vlib_frame_t * frame) { if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE))) - return cnat_node_inline (vm, node, frame, cnat_vip_inline, AF_IP6, - 1 /* do_trace */ ); - return cnat_node_inline (vm, node, frame, cnat_vip_inline, AF_IP6, - 0 /* do_trace */ ); + return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP6, + CNAT_LOCATION_FIB, 1 /* do_trace */); + return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP6, + CNAT_LOCATION_FIB, 0 /* do_trace */); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (cnat_vip_ip4_node) = { .name = "ip4-cnat-tx", .vector_size = sizeof (u32), - .format_trace = format_cnat_translation_trace, + .format_trace = format_cnat_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0, .n_next_nodes = CNAT_TRANSLATION_N_NEXT, @@ -288,13 +232,13 @@ VLIB_REGISTER_NODE (cnat_vip_ip4_node) = { [CNAT_TRANSLATION_NEXT_DROP] = "ip4-drop", [CNAT_TRANSLATION_NEXT_LOOKUP] = "ip4-lookup", - } + }, }; VLIB_REGISTER_NODE (cnat_vip_ip6_node) = { .name = "ip6-cnat-tx", .vector_size = sizeof (u32), - .format_trace = format_cnat_translation_trace, + .format_trace = format_cnat_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0, .n_next_nodes = CNAT_TRANSLATION_N_NEXT, @@ -302,7 +246,13 @@ VLIB_REGISTER_NODE (cnat_vip_ip6_node) = { [CNAT_TRANSLATION_NEXT_DROP] = "ip6-drop", [CNAT_TRANSLATION_NEXT_LOOKUP] = "ip6-lookup", - } + }, }; -/* *INDENT-ON* */ +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */