X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fnat%2Fnat.h;h=61d26b2076ca95fadc130a0b0334a3782371979b;hb=ebdf190;hp=d34ff07b7fe4f89533cd6936308d00714c838b21;hpb=41fef50d5db5e7deb3cfd901c3108abbc4406813;p=vpp.git diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h index d34ff07b7fe..61d26b2076c 100644 --- a/src/plugins/nat/nat.h +++ b/src/plugins/nat/nat.h @@ -61,10 +61,10 @@ typedef struct { { ip4_address_t l_addr; ip4_address_t r_addr; - u32 fib_index; + u32 proto:8, + fib_index:24; u16 l_port; - u8 proto; - u8 rsvd; + u16 r_port; }; u64 as_u64[2]; }; @@ -95,19 +95,6 @@ typedef struct { }; } snat_user_key_t; -typedef struct { - union - { - struct - { - ip4_address_t addr; - u16 port; - u16 fib_index; - }; - u64 as_u64; - }; -} snat_worker_key_t; - #define foreach_snat_protocol \ _(UDP, 0, udp, "udp") \ @@ -128,8 +115,10 @@ typedef enum { _(3, TCP_ESTABLISHED, "tcp-established") \ _(4, TCP_FIN_WAIT, "tcp-fin-wait") \ _(5, TCP_CLOSE_WAIT, "tcp-close-wait") \ - _(6, TCP_LAST_ACK, "tcp-last-ack") \ - _(7, ICMP_ACTIVE, "icmp-active") + _(6, TCP_CLOSING, "tcp-closing") \ + _(7, TCP_LAST_ACK, "tcp-last-ack") \ + _(8, TCP_CLOSED, "tcp-closed") \ + _(9, ICMP_ACTIVE, "icmp-active") typedef enum { #define _(v, N, s) SNAT_SESSION_##N = v, @@ -138,9 +127,15 @@ typedef enum { } snat_session_state_t; -#define SNAT_SESSION_FLAG_STATIC_MAPPING 1 -#define SNAT_SESSION_FLAG_UNKNOWN_PROTO 2 -#define SNAT_SESSION_FLAG_LOAD_BALANCING 4 +#define SNAT_SESSION_FLAG_STATIC_MAPPING 1 +#define SNAT_SESSION_FLAG_UNKNOWN_PROTO 2 +#define SNAT_SESSION_FLAG_LOAD_BALANCING 4 +#define SNAT_SESSION_FLAG_TWICE_NAT 8 +#define SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT 16 +#define SNAT_SESSION_FLAG_FWD_BYPASS 32 + +#define NAT_INTERFACE_FLAG_IS_INSIDE 1 +#define NAT_INTERFACE_FLAG_IS_OUTSIDE 2 typedef CLIB_PACKED(struct { snat_session_key_t out2in; /* 0-15 */ @@ -164,9 +159,16 @@ typedef CLIB_PACKED(struct { /* Outside address */ u32 outside_address_index; /* 64-67 */ - /* External host address */ + /* External host address and port */ ip4_address_t ext_host_addr; /* 68-71 */ + u16 ext_host_port; /* 72-73 */ + + /* External hos address and port after translation */ + ip4_address_t ext_host_nat_addr; /* 74-77 */ + u16 ext_host_nat_port; /* 78-79 */ + /* TCP session state */ + u8 state; }) snat_session_t; @@ -215,22 +217,31 @@ typedef struct { u8 prefix; } nat44_lb_addr_port_t; +typedef enum { + TWICE_NAT_DISABLED, + TWICE_NAT, + TWICE_NAT_SELF, +} twice_nat_type_t; + typedef struct { ip4_address_t local_addr; ip4_address_t external_addr; u16 local_port; u16 external_port; u8 addr_only; + twice_nat_type_t twice_nat; + u8 out2in_only; u32 vrf_id; u32 fib_index; snat_protocol_t proto; u32 worker_index; + u8 *tag; nat44_lb_addr_port_t *locals; } snat_static_mapping_t; typedef struct { u32 sw_if_index; - u8 is_inside; + u8 flags; } snat_interface_t; typedef struct { @@ -241,7 +252,9 @@ typedef struct { u32 vrf_id; snat_protocol_t proto; int addr_only; + int twice_nat; int is_add; + u8 *tag; } snat_static_map_resolve_t; typedef struct { @@ -270,6 +283,7 @@ typedef u32 snat_icmp_match_function_t (struct snat_main_s *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, @@ -278,14 +292,19 @@ typedef u32 snat_icmp_match_function_t (struct snat_main_s *sm, typedef u32 (snat_get_worker_function_t) (ip4_header_t * ip, u32 rx_fib_index); +typedef int nat_alloc_out_addr_and_port_function_t (snat_address_t * addresses, + u32 fib_index, + u32 thread_index, + snat_session_key_t * k, + u32 * address_indexp, + u16 port_per_thread, + u32 snat_thread_index); + typedef struct snat_main_s { /* Endpoint address dependent sessions lookup tables */ clib_bihash_16_8_t out2in_ed; clib_bihash_16_8_t in2out_ed; - /* Non-translated packets worker lookup => src address + VRF */ - clib_bihash_8_8_t worker_by_in; - snat_icmp_match_function_t * icmp_match_in2out_cb; snat_icmp_match_function_t * icmp_match_out2in_cb; @@ -316,9 +335,17 @@ typedef struct snat_main_s { /* Vector of outside addresses */ snat_address_t * addresses; + nat_alloc_out_addr_and_port_function_t *alloc_addr_and_port; + u8 psid_offset; + u8 psid_length; + u16 psid; + + /* Vector of twice NAT addresses for extenal hosts */ + snat_address_t * twice_nat_addresses; /* sw_if_indices whose intfc addresses should be auto-added */ u32 * auto_add_sw_if_indices; + u32 * auto_add_sw_if_indices_twice_nat; /* vector of interface address static mappings to resolve. */ snat_static_map_resolve_t *to_resolve; @@ -339,10 +366,14 @@ typedef struct snat_main_s { /* Deterministic NAT */ snat_det_map_t * det_maps; + /* If forwarding is enabled */ + u8 forwarding_enabled; + /* Config parameters */ u8 static_mapping_only; u8 static_mapping_connection_tracking; u8 deterministic; + u8 out2in_dpo; u32 translation_buckets; u32 translation_memory_size; u32 max_translations; @@ -354,9 +385,6 @@ typedef struct snat_main_s { u32 inside_vrf_id; u32 inside_fib_index; - /* tenant VRF aware address pool activation flag */ - u8 vrf_mode; - /* values of various timeouts */ u32 udp_timeout; u32 tcp_established_timeout; @@ -388,22 +416,26 @@ extern vlib_node_registration_t snat_det_out2in_node; extern vlib_node_registration_t snat_hairpin_dst_node; extern vlib_node_registration_t snat_hairpin_src_node; -void snat_free_outside_address_and_port (snat_main_t * sm, +void snat_free_outside_address_and_port (snat_address_t * addresses, u32 thread_index, snat_session_key_t * k, u32 address_index); -int snat_alloc_outside_address_and_port (snat_main_t * sm, +int snat_alloc_outside_address_and_port (snat_address_t * addresses, u32 fib_index, u32 thread_index, snat_session_key_t * k, - u32 * address_indexp); + u32 * address_indexp, + u16 port_per_thread, + u32 snat_thread_index); int snat_static_mapping_match (snat_main_t * sm, snat_session_key_t match, snat_session_key_t * mapping, u8 by_external, - u8 *is_addr_only); + u8 *is_addr_only, + twice_nat_type_t *twice_nat, + u8 *lb); void snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, @@ -411,6 +443,9 @@ void snat_add_del_addr_to_fib (ip4_address_t * addr, int is_add); format_function_t format_snat_user; +format_function_t format_snat_static_mapping; +format_function_t format_snat_static_map_to_resolve; +format_function_t format_det_map_ses; typedef struct { u32 cached_sw_if_index; @@ -421,13 +456,40 @@ typedef struct { @param s SNAT session @return 1 if SNAT session is created from static mapping otherwise 0 */ -#define snat_is_session_static(s) s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING +#define snat_is_session_static(s) (s->flags & SNAT_SESSION_FLAG_STATIC_MAPPING) /** \brief Check if SNAT session for unknown protocol. @param s SNAT session @return 1 if SNAT session for unknown protocol otherwise 0 */ -#define snat_is_unk_proto_session(s) s->flags & SNAT_SESSION_FLAG_UNKNOWN_PROTO +#define snat_is_unk_proto_session(s) (s->flags & SNAT_SESSION_FLAG_UNKNOWN_PROTO) + +/** \brief Check if NAT session is twice NAT. + @param s NAT session + @return 1 if NAT session is twice NAT +*/ +#define is_twice_nat_session(s) (s->flags & SNAT_SESSION_FLAG_TWICE_NAT) + +/** \brief Check if NAT session is load-balancing. + @param s NAT session + @return 1 if NAT session is load-balancing +*/ +#define is_lb_session(s) (s->flags & SNAT_SESSION_FLAG_LOAD_BALANCING) + +/** \brief Check if NAT session is forwarding bypass. + @param s NAT session + @return 1 if NAT session is load-balancing +*/ +#define is_fwd_bypass_session(s) (s->flags & SNAT_SESSION_FLAG_FWD_BYPASS) + +/** \brief Check if NAT session is endpoint dependent. + @param s NAT session + @return 1 if NAT session is endpoint dependent +*/ +#define is_ed_session(s) (s->flags & SNAT_SESSION_FLAG_ENDPOINT_DEPENDENT) + +#define nat_interface_is_inside(i) i->flags & NAT_INTERFACE_FLAG_IS_INSIDE +#define nat_interface_is_outside(i) i->flags & NAT_INTERFACE_FLAG_IS_OUTSIDE /* * Why is this here? Because we don't need to touch this layer to @@ -470,46 +532,71 @@ typedef struct { } tcp_udp_header_t; u32 icmp_match_in2out_fast(snat_main_t *sm, vlib_node_runtime_t *node, - u32 thread_index, vlib_buffer_t *b0, u8 *p_proto, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); u32 icmp_match_in2out_slow(snat_main_t *sm, vlib_node_runtime_t *node, - u32 thread_index, vlib_buffer_t *b0, u8 *p_proto, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, - u32 thread_index, vlib_buffer_t *b0, u8 *p_proto, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, - u32 thread_index, vlib_buffer_t *b0, u8 *p_proto, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node, - u32 thread_index, vlib_buffer_t *b0, u8 *p_proto, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, - u32 thread_index, vlib_buffer_t *b0, u8 *p_proto, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); void increment_v4_address(ip4_address_t * a); -void snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id); -int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm); +void snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, + u8 twice_nat); +int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, + u8 twice_nat); +void nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add); int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, - u32 sw_if_index, snat_protocol_t proto, int is_add); + u32 sw_if_index, snat_protocol_t proto, int is_add, + twice_nat_type_t twice_nat, u8 out2in_only, + u8 *tag); clib_error_t * snat_api_init(vlib_main_t * vm, snat_main_t * sm); int snat_set_workers (uword * bitmap); int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del); int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del); -int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del); +int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, + u8 twice_nat); uword unformat_snat_protocol(unformat_input_t * input, va_list * args); u8 * format_snat_protocol(u8 * s, va_list * args); int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port, snat_protocol_t proto, u32 vrf_id, - nat44_lb_addr_port_t *locals, u8 is_add); + nat44_lb_addr_port_t *locals, u8 is_add, + twice_nat_type_t twice_nat, u8 out2in_only, + u8 *tag); +int nat44_del_session (snat_main_t *sm, ip4_address_t *addr, u16 port, + snat_protocol_t proto, u32 vrf_id, int is_in); +void nat_free_session_data (snat_main_t * sm, snat_session_t * s, + u32 thread_index); +snat_user_t * nat_user_get_or_create (snat_main_t *sm, ip4_address_t *addr, + u32 fib_index, u32 thread_index); +snat_session_t * nat_session_alloc_or_recycle (snat_main_t *sm, snat_user_t *u, + u32 thread_index); +void nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, + u16 psid_length); +void nat_set_alloc_addr_and_port_default (void); static_always_inline u8 icmp_is_error_message (icmp46_header_t * icmp) @@ -561,4 +648,63 @@ maximum_sessions_exceeded (snat_main_t *sm, u32 thread_index) return 0; } -#endif /* __included_nat_h__ */ +static_always_inline void +nat_send_all_to_node(vlib_main_t *vm, u32 *bi_vector, + vlib_node_runtime_t *node, vlib_error_t *error, u32 next) +{ + u32 n_left_from, *from, next_index, *to_next, n_left_to_next; + + from = bi_vector; + n_left_from = vec_len(bi_vector); + next_index = node->cached_next_index; + while (n_left_from > 0) { + vlib_get_next_frame(vm, node, next_index, to_next, n_left_to_next); + while (n_left_from > 0 && n_left_to_next > 0) { + u32 bi0 = to_next[0] = from[0]; + from += 1; + n_left_from -= 1; + to_next += 1; + n_left_to_next -= 1; + vlib_buffer_t *p0 = vlib_get_buffer(vm, bi0); + p0->error = *error; + vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, + n_left_to_next, bi0, next); + } + vlib_put_next_frame(vm, node, next_index, n_left_to_next); + } +} + +always_inline void +user_session_increment(snat_main_t *sm, snat_user_t *u, u8 is_static) +{ + if (u->nsessions + u->nstaticsessions < sm->max_translations_per_user) + { + if (is_static) + u->nstaticsessions++; + else + u->nsessions++; + } +} + +always_inline void +nat44_set_tcp_session_state(snat_main_t * sm, snat_session_t * ses, + tcp_header_t * tcp, u32 thread_index) +{ + if (tcp->flags & TCP_FLAG_FIN && ses->state == SNAT_SESSION_UNKNOWN) + ses->state = SNAT_SESSION_TCP_FIN_WAIT; + else if (tcp->flags & TCP_FLAG_FIN && ses->state == SNAT_SESSION_TCP_FIN_WAIT) + ses->state = SNAT_SESSION_TCP_CLOSING; + else if (tcp->flags & TCP_FLAG_ACK && ses->state == SNAT_SESSION_TCP_FIN_WAIT) + ses->state = SNAT_SESSION_TCP_CLOSE_WAIT; + else if (tcp->flags & TCP_FLAG_FIN && ses->state == SNAT_SESSION_TCP_CLOSE_WAIT) + ses->state = SNAT_SESSION_TCP_LAST_ACK; + else if (tcp->flags & TCP_FLAG_ACK && ses->state == SNAT_SESSION_TCP_CLOSING) + ses->state = SNAT_SESSION_TCP_LAST_ACK; + else if (tcp->flags & TCP_FLAG_ACK && ses->state == SNAT_SESSION_TCP_LAST_ACK) + { + nat_free_session_data (sm, ses, thread_index); + ses->state = SNAT_SESSION_TCP_CLOSED; + } +} + +#endif /* __included_snat_h__ */