X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fnat%2Fnat.c;h=3c891f274b58945ed36bc72e783c2d609bf3450f;hb=76dc22cec340b1c32e82a9ef9b6baff8006a6517;hp=cd5a6eb8fa873ad08160455bee404b02128d08e4;hpb=8ebe62536223e5a8d827b2b870cbd57aa34fd7ef;p=vpp.git diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c index cd5a6eb8fa8..3c891f274b5 100644 --- a/src/plugins/nat/nat.c +++ b/src/plugins/nat/nat.c @@ -24,6 +24,7 @@ #include #include #include +#include #include #include @@ -732,7 +733,7 @@ delete: pool_put (sm->static_mappings, m); } - if (!addr_only) + if (!addr_only || (l_addr.as_u32 == e_addr.as_u32)) return 0; /* Add/delete external address to FIB */ @@ -1239,7 +1240,7 @@ fib: pool_foreach (m, sm->static_mappings, ({ - if (!(m->addr_only)) + if (!(m->addr_only) || (m->local_addr.as_u32 == m->external_addr.as_u32)) continue; snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del); @@ -1377,6 +1378,16 @@ snat_ip4_add_del_interface_address_cb (ip4_main_t * im, u32 if_address_index, u32 is_delete); +static int +nat_alloc_addr_and_port_default (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index); + static clib_error_t * snat_init (vlib_main_t * vm) { snat_main_t * sm = &snat_main; @@ -1407,6 +1418,7 @@ static clib_error_t * snat_init (vlib_main_t * vm) sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT; sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT; sm->icmp_timeout = SNAT_ICMP_TIMEOUT; + sm->alloc_addr_and_port = nat_alloc_addr_and_port_default; p = hash_get_mem (tm->thread_registrations_by_name, "workers"); if (p) @@ -1447,11 +1459,15 @@ static clib_error_t * snat_init (vlib_main_t * vm) /* Init IPFIX logging */ snat_ipfix_logging_init(vm); + /* Init NAT64 */ error = nat64_init(vm); + if (error) + return error; dslite_init(vm); - return error; + /* Init virtual fragmenentation reassembly */ + return nat_reass_init(vm); } VLIB_INIT_FUNCTION (snat_init); @@ -1582,14 +1598,32 @@ snat_random_port (u16 min, u16 max) (random_u32_max() / (max - min + 1) + 1); } -int snat_alloc_outside_address_and_port (snat_address_t * addresses, - u32 fib_index, - u32 thread_index, - snat_session_key_t * k, - u32 * address_indexp, - u8 vrf_mode, - u16 port_per_thread, - u32 snat_thread_index) +int +snat_alloc_outside_address_and_port (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index) +{ + snat_main_t *sm = &snat_main; + + return sm->alloc_addr_and_port(addresses, fib_index, thread_index, k, + address_indexp, vrf_mode, port_per_thread, + snat_thread_index); +} + +static int +nat_alloc_addr_and_port_default (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index) { int i; snat_address_t *a; @@ -1636,6 +1670,59 @@ int snat_alloc_outside_address_and_port (snat_address_t * addresses, return 1; } +static int +nat_alloc_addr_and_port_mape (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u8 vrf_mode, + u16 port_per_thread, + u32 snat_thread_index) +{ + snat_main_t *sm = &snat_main; + snat_address_t *a = addresses; + u16 m, ports, portnum, A, j; + m = 16 - (sm->psid_offset + sm->psid_length); + ports = (1 << (16 - sm->psid_length)) - (1 << m); + + if (!vec_len (addresses)) + goto exhausted; + + switch (k->protocol) + { +#define _(N, i, n, s) \ + case SNAT_PROTOCOL_##N: \ + if (a->busy_##n##_ports < ports) \ + { \ + while (1) \ + { \ + A = snat_random_port(1, pow2_mask(sm->psid_offset)); \ + j = snat_random_port(0, pow2_mask(m)); \ + portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \ + if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \ + continue; \ + clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \ + a->busy_##n##_ports++; \ + k->addr = a->addr; \ + k->port = clib_host_to_net_u16 (portnum); \ + *address_indexp = i; \ + return 0; \ + } \ + } \ + break; + foreach_snat_protocol +#undef _ + default: + clib_warning("unknown protocol"); + return 1; + } + +exhausted: + /* Totally out of translations to use... */ + snat_ipfix_logging_addresses_exhausted(0); + return 1; +} static clib_error_t * add_address_command_fn (vlib_main_t * vm, @@ -1903,7 +1990,7 @@ add_static_mapping_command_fn (vlib_main_t * vm, u32 sw_if_index = ~0; vnet_main_t * vnm = vnet_get_main(); int rv; - snat_protocol_t proto; + snat_protocol_t proto = ~0; u8 proto_set = 0; /* Get a line of input. */ @@ -2002,6 +2089,100 @@ VLIB_CLI_COMMAND (add_static_mapping_command, static) = { "nat44 add static mapping tcp|udp|icmp local [] external [] [vrf ] [del]", }; +static clib_error_t * +add_identity_mapping_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + unformat_input_t _line_input, *line_input = &_line_input; + clib_error_t * error = 0; + ip4_address_t addr; + u32 port = 0, vrf_id = ~0; + int is_add = 1; + int addr_only = 1; + u32 sw_if_index = ~0; + vnet_main_t * vnm = vnet_get_main(); + int rv; + snat_protocol_t proto; + + addr.as_u32 = 0; + + /* Get a line of input. */ + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "%U", unformat_ip4_address, &addr)) + ; + else if (unformat (line_input, "external %U", + unformat_vnet_sw_interface, vnm, &sw_if_index)) + ; + else if (unformat (line_input, "vrf %u", &vrf_id)) + ; + else if (unformat (line_input, "%U %u", unformat_snat_protocol, &proto, + &port)) + addr_only = 0; + else if (unformat (line_input, "del")) + is_add = 0; + else + { + error = clib_error_return (0, "unknown input: '%U'", + format_unformat_error, line_input); + goto done; + } + } + + rv = snat_add_static_mapping(addr, addr, (u16) port, (u16) port, + vrf_id, addr_only, sw_if_index, proto, is_add); + + switch (rv) + { + case VNET_API_ERROR_INVALID_VALUE: + error = clib_error_return (0, "External port already in use."); + goto done; + case VNET_API_ERROR_NO_SUCH_ENTRY: + if (is_add) + error = clib_error_return (0, "External addres must be allocated."); + else + error = clib_error_return (0, "Mapping not exist."); + goto done; + case VNET_API_ERROR_NO_SUCH_FIB: + error = clib_error_return (0, "No such VRF id."); + goto done; + case VNET_API_ERROR_VALUE_EXIST: + error = clib_error_return (0, "Mapping already exist."); + goto done; + default: + break; + } + +done: + unformat_free (line_input); + + return error; +} + +/*? + * @cliexpar + * @cliexstart{snat add identity mapping} + * Identity mapping translate an IP address to itself. + * To create identity mapping for address 10.0.0.3 port 6303 for TCP protocol + * use: + * vpp# nat44 add identity mapping 10.0.0.3 tcp 6303 + * To create identity mapping for address 10.0.0.3 use: + * vpp# nat44 add identity mapping 10.0.0.3 + * To create identity mapping for DHCP addressed interface use: + * vpp# nat44 add identity mapping GigabitEthernet0/a/0 tcp 3606 + * @cliexend +?*/ +VLIB_CLI_COMMAND (add_identity_mapping_command, static) = { + .path = "nat44 add identity mapping", + .function = add_identity_mapping_command_fn, + .short_help = "nat44 add identity mapping | " + "[ ] [vrf ] [del]", +}; + static clib_error_t * add_lb_static_mapping_command_fn (vlib_main_t * vm, unformat_input_t * input, @@ -2889,6 +3070,7 @@ show_snat_command_fn (vlib_main_t * vm, } } } + return 0; } @@ -2911,6 +3093,7 @@ snat_ip4_add_del_interface_address_cb (ip4_main_t * im, snat_main_t *sm = &snat_main; snat_static_map_resolve_t *rp; u32 *indices_to_delete = 0; + ip4_address_t l_addr; int i, j; int rv; @@ -2933,8 +3116,13 @@ snat_ip4_add_del_interface_address_cb (ip4_main_t * im, /* On this interface? */ if (rp->sw_if_index == sw_if_index) { + /* Indetity mapping? */ + if (rp->l_addr.as_u32 == 0) + l_addr.as_u32 = address[0].as_u32; + else + l_addr.as_u32 = rp->l_addr.as_u32; /* Add the static mapping */ - rv = snat_add_static_mapping (rp->l_addr, + rv = snat_add_static_mapping (l_addr, address[0], rp->l_port, rp->e_port, @@ -2944,7 +3132,7 @@ snat_ip4_add_del_interface_address_cb (ip4_main_t * im, rp->proto, rp->is_add); if (rv) - clib_warning ("snat_add_static_mapping returned %d", + clib_warning ("snat_add_static_mapping returned %d", rv); vec_add1 (indices_to_delete, j); } @@ -3195,6 +3383,52 @@ VLIB_CLI_COMMAND (nat44_del_session_command, static) = { .function = nat44_del_session_command_fn, }; +static clib_error_t * +nat44_set_alloc_addr_and_port_alg_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + snat_main_t *sm = &snat_main; + unformat_input_t _line_input, *line_input = &_line_input; + clib_error_t *error = 0; + u32 psid, psid_offset, psid_length; + + /* Get a line of input. */ + if (!unformat_user (input, unformat_line_input, line_input)) + return 0; + + while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (line_input, "default")) + sm->alloc_addr_and_port = nat_alloc_addr_and_port_default; + else if (unformat (line_input, "map-e psid %d psid-offset %d psid-len %d", + &psid, &psid_offset, &psid_length)) + { + sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape; + sm->psid = (u16) psid; + sm->psid_offset = (u16) psid_offset; + sm->psid_length = (u16) psid_length; + } + else + { + error = clib_error_return (0, "unknown input '%U'", + format_unformat_error, line_input); + goto done; + } + } + +done: + unformat_free (line_input); + + return error; +}; + +VLIB_CLI_COMMAND (nat44_set_alloc_addr_and_port_alg_command, static) = { + .path = "nat44 addr-port-assignment-alg", + .short_help = "nat44 addr-port-assignment-alg []", + .function = nat44_set_alloc_addr_and_port_alg_command_fn, +}; + static clib_error_t * snat_det_map_command_fn (vlib_main_t * vm, unformat_input_t * input, @@ -3227,8 +3461,6 @@ snat_det_map_command_fn (vlib_main_t * vm, } } - unformat_free (line_input); - rv = snat_det_add_map(sm, &in_addr, (u8) in_plen, &out_addr, (u8)out_plen, is_add); @@ -3289,8 +3521,6 @@ snat_det_forward_command_fn (vlib_main_t * vm, } } - unformat_free (line_input); - dm = snat_det_map_by_user(sm, &in_addr); if (!dm) vlib_cli_output (vm, "no match"); @@ -3350,8 +3580,6 @@ snat_det_reverse_command_fn (vlib_main_t * vm, } } - unformat_free (line_input); - if (out_port < 1024 || out_port > 65535) { error = clib_error_return (0, "wrong port, must be <1024-65535>"); @@ -3428,8 +3656,6 @@ set_timeout_command_fn (vlib_main_t * vm, } } - unformat_free (line_input); - done: unformat_free (line_input);