X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fnat%2Fnat.c;h=6bfea3c4162ea8ff0d34df63057dd25bf5b8e21a;hb=ad1f3e148224bced41afd47b0ab1ed158c07f399;hp=efca4404dddc026725d4424092bac8d07a7d8da3;hpb=ab395ec884d0ec9279893b1695379e97acd1f24d;p=vpp.git diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c index efca4404ddd..6bfea3c4162 100755 --- a/src/plugins/nat/nat.c +++ b/src/plugins/nat/nat.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include @@ -236,6 +237,13 @@ nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index) ed_kv.key[1] = ed_key.as_u64[1]; if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0)) nat_log_warn ("in2out_ed key del failed"); + + nat_syslog_nat44_sdel (s->user_index, s->in2out.fib_index, + &s->in2out.addr, s->in2out.port, + &s->ext_host_nat_addr, s->ext_host_nat_port, + &s->out2in.addr, s->out2in.port, + &s->ext_host_addr, s->ext_host_port, + s->in2out.protocol, is_twice_nat_session (s)); } else { @@ -245,6 +253,11 @@ nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index) kv.key = s->out2in.as_u64; if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0)) nat_log_warn ("out2in key del failed"); + + nat_syslog_nat44_apmdel (s->user_index, s->in2out.fib_index, + &s->in2out.addr, s->in2out.port, + &s->out2in.addr, s->out2in.port, + s->in2out.protocol); } if (snat_is_unk_proto_session (s)) @@ -293,7 +306,7 @@ nat_user_get_or_create (snat_main_t * sm, ip4_address_t * addr, u32 fib_index, { /* no, make a new one */ pool_get (tsm->users, u); - memset (u, 0, sizeof (*u)); + clib_memset (u, 0, sizeof (*u)); u->addr.as_u32 = addr->as_u32; u->fib_index = fib_index; @@ -368,7 +381,7 @@ nat_session_alloc_or_recycle (snat_main_t * sm, snat_user_t * u, else { pool_get (tsm->sessions, s); - memset (s, 0, sizeof (*s)); + clib_memset (s, 0, sizeof (*s)); /* Create list elts */ pool_get (tsm->list_pool, per_user_translation_list_elt); @@ -382,42 +395,83 @@ nat_session_alloc_or_recycle (snat_main_t * sm, snat_user_t * u, clib_dlist_addtail (tsm->list_pool, s->per_user_list_head_index, per_user_translation_list_elt - tsm->list_pool); + + s->user_index = u - tsm->users; } return s; } snat_session_t * -nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u, u32 thread_index) +nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u, u32 thread_index, + f64 now) { snat_session_t *s; snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index]; - dlist_elt_t *per_user_translation_list_elt; + dlist_elt_t *per_user_translation_list_elt, *oldest_elt; + u32 oldest_index; + u64 sess_timeout_time; - if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user) + if (PREDICT_FALSE (!(u->nsessions) && !(u->nstaticsessions))) + goto alloc_new; + + oldest_index = + clib_dlist_remove_head (tsm->list_pool, + u->sessions_per_user_list_head_index); + oldest_elt = pool_elt_at_index (tsm->list_pool, oldest_index); + s = pool_elt_at_index (tsm->sessions, oldest_elt->value); + sess_timeout_time = s->last_heard + (f64) nat44_session_get_timeout (sm, s); + if (now >= sess_timeout_time) { - nat_log_warn ("max translations per user %U", format_ip4_address, - &u->addr); - snat_ipfix_logging_max_entries_per_user (sm->max_translations_per_user, - u->addr.as_u32); - return 0; + clib_dlist_addtail (tsm->list_pool, + u->sessions_per_user_list_head_index, oldest_index); + nat_free_session_data (sm, s, thread_index); + if (snat_is_session_static (s)) + u->nstaticsessions--; + else + u->nsessions--; + s->flags = 0; + s->total_bytes = 0; + s->total_pkts = 0; + s->state = 0; + s->ext_host_addr.as_u32 = 0; + s->ext_host_port = 0; + s->ext_host_nat_addr.as_u32 = 0; + s->ext_host_nat_port = 0; + } + else + { + clib_dlist_addhead (tsm->list_pool, + u->sessions_per_user_list_head_index, oldest_index); + if ((u->nsessions + u->nstaticsessions) >= + sm->max_translations_per_user) + { + nat_log_warn ("max translations per user %U", format_ip4_address, + &u->addr); + snat_ipfix_logging_max_entries_per_user + (sm->max_translations_per_user, u->addr.as_u32); + return 0; + } + else + { + alloc_new: + pool_get (tsm->sessions, s); + clib_memset (s, 0, sizeof (*s)); + + /* Create list elts */ + pool_get (tsm->list_pool, per_user_translation_list_elt); + clib_dlist_init (tsm->list_pool, + per_user_translation_list_elt - tsm->list_pool); + + per_user_translation_list_elt->value = s - tsm->sessions; + s->per_user_index = per_user_translation_list_elt - tsm->list_pool; + s->per_user_list_head_index = u->sessions_per_user_list_head_index; + + clib_dlist_addtail (tsm->list_pool, + s->per_user_list_head_index, + per_user_translation_list_elt - tsm->list_pool); + } } - - pool_get (tsm->sessions, s); - memset (s, 0, sizeof (*s)); - - /* Create list elts */ - pool_get (tsm->list_pool, per_user_translation_list_elt); - clib_dlist_init (tsm->list_pool, - per_user_translation_list_elt - tsm->list_pool); - - per_user_translation_list_elt->value = s - tsm->sessions; - s->per_user_index = per_user_translation_list_elt - tsm->list_pool; - s->per_user_list_head_index = u->sessions_per_user_list_head_index; - - clib_dlist_addtail (tsm->list_pool, - s->per_user_list_head_index, - per_user_translation_list_elt - tsm->list_pool); return s; } @@ -522,6 +576,10 @@ is_snat_address_used_in_static_mapping (snat_main_t * sm, ip4_address_t addr) /* *INDENT-OFF* */ pool_foreach (m, sm->static_mappings, ({ + if (is_addr_only_static_mapping (m) || + is_out2in_only_static_mapping (m) || + is_identity_static_mapping (m)) + continue; if (m->external_addr.as_u32 == addr.as_u32) return 1; })); @@ -547,7 +605,9 @@ snat_add_static_mapping_when_resolved (snat_main_t * sm, u16 e_port, u32 vrf_id, snat_protocol_t proto, - int addr_only, int is_add, u8 * tag) + int addr_only, int is_add, u8 * tag, + int twice_nat, int out2in_only, + int identity_nat) { snat_static_map_resolve_t *rp; @@ -560,6 +620,9 @@ snat_add_static_mapping_when_resolved (snat_main_t * sm, rp->proto = proto; rp->addr_only = addr_only; rp->is_add = is_add; + rp->twice_nat = twice_nat; + rp->out2in_only = out2in_only; + rp->identity_nat = identity_nat; rp->tag = vec_dup (tag); } @@ -577,34 +640,12 @@ get_thread_idx_by_port (u16 e_port) return thread_idx; } -/** - * @brief Add static mapping. - * - * Create static mapping between local addr+port and external addr+port. - * - * @param l_addr Local IPv4 address. - * @param e_addr External IPv4 address. - * @param l_port Local port number. - * @param e_port External port number. - * @param vrf_id VRF ID. - * @param addr_only If 0 address port and pair mapping, otherwise address only. - * @param sw_if_index External port instead of specific IP address. - * @param is_add If 0 delete static mapping, otherwise add. - * @param twice_nat If value is TWICE_NAT then translate external host address - * and port. - * If value is TWICE_NAT_SELF then translate external host - * address and port whenever external host address equals - * local address of internal host. - * @param out2in_only If 1 rule match only out2in direction - * @param tag - opaque string tag - * - * @returns - */ int snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, snat_protocol_t proto, int is_add, - twice_nat_type_t twice_nat, u8 out2in_only, u8 * tag) + twice_nat_type_t twice_nat, u8 out2in_only, u8 * tag, + u8 identity_nat) { snat_main_t *sm = &snat_main; snat_static_mapping_t *m; @@ -612,7 +653,6 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, clib_bihash_kv_8_8_t kv, value; snat_address_t *a = 0; u32 fib_index = ~0; - uword *p; snat_interface_t *interface; int i; snat_main_per_thread_data_t *tsm; @@ -624,6 +664,8 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, u64 user_index; snat_session_t *s; snat_static_map_resolve_t *rp, *rp_match = 0; + nat44_lb_addr_port_t *local; + u8 find = 0; if (!sm->endpoint_dependent) { @@ -666,7 +708,7 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, snat_add_static_mapping_when_resolved (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto, - addr_only, is_add, tag); + addr_only, is_add, tag, twice_nat, out2in_only, identity_nat); /* DHCP resolution required? */ if (first_int_addr == 0) @@ -713,19 +755,42 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, if (is_add) { if (m) - return VNET_API_ERROR_VALUE_EXIST; + { + if (is_identity_static_mapping (m)) + { + /* *INDENT-OFF* */ + vec_foreach (local, m->locals) + { + if (local->vrf_id == vrf_id) + return VNET_API_ERROR_VALUE_EXIST; + } + /* *INDENT-ON* */ + vec_add2 (m->locals, local, 1); + local->vrf_id = vrf_id; + local->fib_index = + fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id, + FIB_SOURCE_PLUGIN_LOW); + m_key.addr = m->local_addr; + m_key.port = m->local_port; + m_key.protocol = m->proto; + m_key.fib_index = local->fib_index; + kv.key = m_key.as_u64; + kv.value = m - sm->static_mappings; + clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1); + return 0; + } + else + return VNET_API_ERROR_VALUE_EXIST; + } if (twice_nat && addr_only) return VNET_API_ERROR_UNSUPPORTED; /* Convert VRF id to FIB index */ if (vrf_id != ~0) - { - p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id); - if (!p) - return VNET_API_ERROR_NO_SUCH_FIB; - fib_index = p[0]; - } + fib_index = + fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id, + FIB_SOURCE_PLUGIN_LOW); /* If not specified use inside VRF id from SNAT plugin startup config */ else { @@ -733,7 +798,7 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, vrf_id = sm->inside_vrf_id; } - if (!out2in_only) + if (!(out2in_only || identity_nat)) { m_key.addr = l_addr; m_key.port = addr_only ? 0 : l_port; @@ -802,15 +867,27 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, } pool_get (sm->static_mappings, m); - memset (m, 0, sizeof (*m)); + clib_memset (m, 0, sizeof (*m)); m->tag = vec_dup (tag); m->local_addr = l_addr; m->external_addr = e_addr; - m->addr_only = addr_only; - m->vrf_id = vrf_id; - m->fib_index = fib_index; m->twice_nat = twice_nat; - m->out2in_only = out2in_only; + if (out2in_only) + m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY; + if (addr_only) + m->flags |= NAT_STATIC_MAPPING_FLAG_ADDR_ONLY; + if (identity_nat) + { + m->flags |= NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT; + vec_add2 (m->locals, local, 1); + local->vrf_id = vrf_id; + local->fib_index = fib_index; + } + else + { + m->vrf_id = vrf_id; + m->fib_index = fib_index; + } if (!addr_only) { m->local_port = l_port; @@ -832,7 +909,7 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, m_key.addr = m->local_addr; m_key.port = m->local_port; m_key.protocol = m->proto; - m_key.fib_index = m->fib_index; + m_key.fib_index = fib_index; kv.key = m_key.as_u64; kv.value = m - sm->static_mappings; if (!out2in_only) @@ -897,6 +974,28 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, return VNET_API_ERROR_NO_SUCH_ENTRY; } + if (identity_nat) + { + if (vrf_id == ~0) + vrf_id = sm->inside_vrf_id; + + for (i = 0; i < vec_len (m->locals); i++) + { + if (m->locals[i].vrf_id == vrf_id) + { + find = 1; + break; + } + } + if (!find) + return VNET_API_ERROR_NO_SUCH_ENTRY; + + fib_index = m->locals[i].fib_index; + vec_del1 (m->locals, i); + } + else + fib_index = m->fib_index; + /* Free external address port */ if (!(addr_only || sm->static_mapping_only || out2in_only)) { @@ -935,23 +1034,17 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, m_key.addr = m->local_addr; m_key.port = m->local_port; m_key.protocol = m->proto; - m_key.fib_index = m->fib_index; + m_key.fib_index = fib_index; kv.key = m_key.as_u64; if (!out2in_only) clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0); - m_key.addr = m->external_addr; - m_key.port = m->external_port; - m_key.fib_index = 0; - kv.key = m_key.as_u64; - clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0); - /* Delete session(s) for static mapping if exist */ if (!(sm->static_mapping_only) || (sm->static_mapping_only && sm->static_mapping_connection_tracking)) { u_key.addr = m->local_addr; - u_key.fib_index = m->fib_index; + u_key.fib_index = fib_index; kv.key = u_key.as_u64; if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value)) { @@ -995,6 +1088,16 @@ snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr, } } + fib_table_unlock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW); + if (vec_len (m->locals)) + return 0; + + m_key.addr = m->external_addr; + m_key.port = m->external_port; + m_key.fib_index = 0; + kv.key = m_key.as_u64; + clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0); + vec_free (m->tag); vec_free (m->workers); /* Delete static mapping from pool */ @@ -1108,14 +1211,15 @@ nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port, } pool_get (sm->static_mappings, m); - memset (m, 0, sizeof (*m)); + clib_memset (m, 0, sizeof (*m)); m->tag = vec_dup (tag); m->external_addr = e_addr; - m->addr_only = 0; m->external_port = e_port; m->proto = proto; m->twice_nat = twice_nat; - m->out2in_only = out2in_only; + m->flags |= NAT_STATIC_MAPPING_FLAG_LB; + if (out2in_only) + m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY; m->affinity = affinity; if (affinity) @@ -1182,6 +1286,9 @@ nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port, if (!m) return VNET_API_ERROR_NO_SUCH_ENTRY; + if (!is_lb_static_mapping (m)) + return VNET_API_ERROR_INVALID_VALUE; + /* Free external address port */ if (!(sm->static_mapping_only || out2in_only)) { @@ -1332,9 +1439,9 @@ snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm, if (m->external_addr.as_u32 == addr.as_u32) (void) snat_add_static_mapping (m->local_addr, m->external_addr, m->local_port, m->external_port, - m->vrf_id, m->addr_only, ~0, + m->vrf_id, is_addr_only_static_mapping(m), ~0, m->proto, 0, m->twice_nat, - m->out2in_only, m->tag); + is_out2in_only_static_mapping(m), m->tag, is_identity_static_mapping(m)); })); /* *INDENT-ON* */ } @@ -1646,7 +1753,7 @@ fib: pool_foreach (m, sm->static_mappings, ({ - if (!(m->addr_only) || (m->local_addr.as_u32 == m->external_addr.as_u32)) + if (!(is_addr_only_static_mapping(m)) || (m->local_addr.as_u32 == m->external_addr.as_u32)) continue; snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del); @@ -1774,7 +1881,7 @@ fib: pool_foreach (m, sm->static_mappings, ({ - if (!(m->addr_only) || (m->local_addr.as_u32 == m->external_addr.as_u32)) + if (!((is_addr_only_static_mapping(m))) || (m->local_addr.as_u32 == m->external_addr.as_u32)) continue; snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del); @@ -1981,7 +2088,8 @@ snat_static_mapping_match (snat_main_t * sm, u8 by_external, u8 * is_addr_only, twice_nat_type_t * twice_nat, - lb_nat_type_t * lb, ip4_address_t * ext_host_addr) + lb_nat_type_t * lb, ip4_address_t * ext_host_addr, + u8 * is_identity_nat) { clib_bihash_kv_8_8_t kv, value; snat_static_mapping_t *m; @@ -2017,7 +2125,7 @@ snat_static_mapping_match (snat_main_t * sm, if (by_external) { - if (vec_len (m->locals)) + if (is_lb_static_mapping (m)) { if (PREDICT_FALSE (lb != 0)) *lb = m->affinity ? AFFINITY_LB_NAT : LB_NAT; @@ -2072,7 +2180,7 @@ snat_static_mapping_match (snat_main_t * sm, mapping->fib_index = m->fib_index; mapping->addr = m->local_addr; /* Address only mapping doesn't change port */ - mapping->port = m->addr_only ? match.port + mapping->port = is_addr_only_static_mapping (m) ? match.port : clib_host_to_net_u16 (m->local_port); } mapping->protocol = m->proto; @@ -2081,18 +2189,21 @@ snat_static_mapping_match (snat_main_t * sm, { mapping->addr = m->external_addr; /* Address only mapping doesn't change port */ - mapping->port = m->addr_only ? match.port + mapping->port = is_addr_only_static_mapping (m) ? match.port : clib_host_to_net_u16 (m->external_port); mapping->fib_index = sm->outside_fib_index; } end: if (PREDICT_FALSE (is_addr_only != 0)) - *is_addr_only = m->addr_only; + *is_addr_only = is_addr_only_static_mapping (m); if (PREDICT_FALSE (twice_nat != 0)) *twice_nat = m->twice_nat; + if (PREDICT_FALSE (is_identity_nat != 0)) + *is_identity_nat = is_identity_static_mapping (m); + return 0; } @@ -2585,7 +2696,7 @@ nat44_ed_get_worker_out2in_cb (ip4_header_t * ip, u32 rx_fib_index) (&sm->static_mapping_by_external, &kv, &value)) { m = pool_elt_at_index (sm->static_mappings, value.value); - if (!vec_len (m->locals)) + if (!is_lb_static_mapping (m)) return m->workers[0]; hash = ip->src_address.as_u32 + (ip->src_address.as_u32 >> 8) + @@ -2883,7 +2994,8 @@ match: rp->e_port, rp->vrf_id, rp->addr_only, ~0 /* sw_if_index */ , - rp->proto, !is_delete, 0, 0, rp->tag); + rp->proto, !is_delete, rp->twice_nat, + rp->out2in_only, rp->tag, rp->identity_nat); if (rv) nat_log_notice ("snat_add_static_mapping returned %d", rv); } @@ -2952,7 +3064,9 @@ match: rp->addr_only, ~0 /* sw_if_index */ , rp->proto, - rp->is_add, 0, 0, rp->tag); + rp->is_add, rp->twice_nat, + rp->out2in_only, rp->tag, + rp->identity_nat); if (rv) nat_log_notice ("snat_add_static_mapping returned %d", rv); }