X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fnat%2Fnat.h;h=d2b114afbbecda7d3f8d960a6d166f111d284861;hb=ba5f9bc7534bcf58225b0658993728b1f4d47a67;hp=b65ad1b676f2a12eeaac6e99c7466065e59344c6;hpb=9a6dc8a9376e7270331255861b3ead1045b40c6d;p=vpp.git diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h index b65ad1b676f..d2b114afbbe 100644 --- a/src/plugins/nat/nat.h +++ b/src/plugins/nat/nat.h @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include @@ -30,6 +31,7 @@ #include #include #include +#include /* default session timeouts */ #define SNAT_UDP_TIMEOUT 300 @@ -57,11 +59,8 @@ typedef enum NAT_NEXT_IN2OUT_ED_FAST_PATH, NAT_NEXT_IN2OUT_ED_SLOW_PATH, NAT_NEXT_IN2OUT_ED_OUTPUT_SLOW_PATH, - NAT_NEXT_IN2OUT_ED_REASS, - NAT_NEXT_IN2OUT_ED_OUTPUT_REASS, NAT_NEXT_OUT2IN_ED_FAST_PATH, NAT_NEXT_OUT2IN_ED_SLOW_PATH, - NAT_NEXT_OUT2IN_ED_REASS, NAT_N_NEXT, } nat_next_t; @@ -222,11 +221,14 @@ _(IN2OUT_PACKETS, "good in2out packets processed") \ _(OUT_OF_PORTS, "out of ports") \ _(BAD_ICMP_TYPE, "unsupported ICMP type") \ _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \ +_(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \ _(DROP_FRAGMENT, "drop fragment") \ _(MAX_REASS, "maximum reassemblies exceeded") \ _(MAX_FRAG, "maximum fragments per reassembly exceeded")\ +_(CANNOT_CREATE_USER, "cannot create NAT user") \ _(NON_SYN, "non-SYN packet try to create session") \ _(TCP_PACKETS, "TCP packets") \ +_(TCP_CLOSED, "drops due to TCP in transitory timeout") \ _(UDP_PACKETS, "UDP packets") \ _(ICMP_PACKETS, "ICMP packets") \ _(OTHER_PACKETS, "other protocol packets") \ @@ -249,11 +251,14 @@ _(OUT_OF_PORTS, "out of ports") \ _(BAD_ICMP_TYPE, "unsupported ICMP type") \ _(NO_TRANSLATION, "no translation") \ _(MAX_SESSIONS_EXCEEDED, "maximum sessions exceeded") \ +_(MAX_USER_SESS_EXCEEDED, "max user sessions exceeded") \ _(DROP_FRAGMENT, "drop fragment") \ _(MAX_REASS, "maximum reassemblies exceeded") \ _(MAX_FRAG, "maximum fragments per reassembly exceeded")\ +_(CANNOT_CREATE_USER, "cannot create NAT user") \ _(NON_SYN, "non-SYN packet try to create session") \ _(TCP_PACKETS, "TCP packets") \ +_(TCP_CLOSED, "drops due to TCP in transitory timeout") \ _(UDP_PACKETS, "UDP packets") \ _(ICMP_PACKETS, "ICMP packets") \ _(OTHER_PACKETS, "other protocol packets") \ @@ -315,6 +320,10 @@ typedef CLIB_PACKED(struct u32 per_user_index; u32 per_user_list_head_index; + /* index in global LRU list */ + u32 global_lru_index; + f64 last_lru_update; + /* Last heard timer */ f64 last_heard; @@ -337,6 +346,7 @@ typedef CLIB_PACKED(struct u8 state; u32 i2o_fin_seq; u32 o2i_fin_seq; + u32 tcp_close_timestamp; /* user index */ u32 user_index; @@ -351,6 +361,8 @@ typedef struct u32 sessions_per_user_list_head_index; u32 nsessions; u32 nstaticsessions; + /* discovered minimum session timeout time */ + u64 min_session_timeout; } snat_user_t; typedef struct @@ -361,7 +373,7 @@ typedef struct #define _(N, i, n, s) \ u16 busy_##n##_ports; \ u16 * busy_##n##_ports_per_thread; \ - uword * busy_##n##_port_bitmap; + u32 busy_##n##_port_refcounts[65535]; foreach_snat_protocol #undef _ /* *INDENT-ON* */ @@ -513,11 +525,24 @@ typedef struct /* Pool of doubly-linked list elements */ dlist_elt_t *list_pool; + /* LRU session list - head is stale, tail is fresh */ + dlist_elt_t *global_lru_pool; + u32 global_lru_head_index; + /* NAT thread index */ u32 snat_thread_index; /* real thread index */ u32 thread_index; + + /* discovered minimum session timeout time */ + u64 min_session_timeout; + + /* session scavenging */ + u32 cleared; + u32 cleanup_runs; + f64 cleanup_timeout; + } snat_main_per_thread_data_t; struct snat_main_s; @@ -533,8 +558,14 @@ typedef u32 (snat_icmp_match_function_t) (struct snat_main_s * sm, void *e); /* Return worker thread index for given packet */ -typedef u32 (snat_get_worker_function_t) (ip4_header_t * ip, - u32 rx_fib_index, u8 is_output); +typedef u32 (snat_get_worker_in2out_function_t) (ip4_header_t * ip, + u32 rx_fib_index, + u8 is_output); + +typedef u32 (snat_get_worker_out2in_function_t) (vlib_buffer_t * b, + ip4_header_t * ip, + u32 rx_fib_index, + u8 is_output); /* NAT address and port allacotaion function */ typedef int (nat_alloc_out_addr_and_port_function_t) (snat_address_t * @@ -545,6 +576,28 @@ typedef int (nat_alloc_out_addr_and_port_function_t) (snat_address_t * u16 port_per_thread, u32 snat_thread_index); +typedef struct ed_bihash_key_s +{ + u32 src_address; + u32 dst_address; + u16 src_port; + u16 dst_port; + u8 protocol; +} ed_bihash_key_t; + +typedef struct ed_bihash_kv_s +{ + union + { + ed_bihash_key_t k; + clib_bihash_kv_16_8_t kv; + }; +} ed_bihash_kv_t; + +STATIC_ASSERT (STRUCT_SIZE_OF (ed_bihash_kv_t, k) <= + STRUCT_SIZE_OF (ed_bihash_kv_t, kv.key), + "ed key needs to fit in bihash key"); + typedef struct snat_main_s { /* ICMP session match functions */ @@ -555,8 +608,8 @@ typedef struct snat_main_s u32 num_workers; u32 first_worker_index; u32 *workers; - snat_get_worker_function_t *worker_in2out_cb; - snat_get_worker_function_t *worker_out2in_cb; + snat_get_worker_in2out_function_t *worker_in2out_cb; + snat_get_worker_out2in_function_t *worker_out2in_cb; u16 port_per_thread; u32 num_snat_thread; @@ -628,16 +681,12 @@ typedef struct snat_main_s u32 in2out_fast_node_index; u32 in2out_slowpath_node_index; u32 in2out_slowpath_output_node_index; - u32 in2out_reass_node_index; u32 ed_in2out_node_index; u32 ed_in2out_slowpath_node_index; - u32 ed_in2out_reass_node_index; u32 out2in_node_index; u32 out2in_fast_node_index; - u32 out2in_reass_node_index; u32 ed_out2in_node_index; u32 ed_out2in_slowpath_node_index; - u32 ed_out2in_reass_node_index; u32 det_in2out_node_index; u32 det_out2in_node_index; @@ -673,9 +722,13 @@ typedef struct snat_main_s u32 inside_fib_index; /* values of various timeouts */ + + // min timeout of all proto timeouts + u32 min_timeout; + // proto timeouts u32 udp_timeout; - u32 tcp_established_timeout; u32 tcp_transitory_timeout; + u32 tcp_established_timeout; u32 icmp_timeout; /* TCP MSS clamping */ @@ -700,6 +753,8 @@ typedef struct snat_main_s ip4_main_t *ip4_main; ip_lookup_main_t *ip4_lookup_main; api_main_t *api_main; + + clib_bihash_16_8_t ed_ext_ports; } snat_main_t; typedef struct @@ -724,26 +779,21 @@ extern vlib_node_registration_t nat_pre_out2in_node; extern vlib_node_registration_t snat_in2out_node; extern vlib_node_registration_t snat_in2out_output_node; extern vlib_node_registration_t snat_out2in_node; -extern vlib_node_registration_t snat_in2out_fast_node; -extern vlib_node_registration_t snat_out2in_fast_node; extern vlib_node_registration_t snat_in2out_worker_handoff_node; extern vlib_node_registration_t snat_in2out_output_worker_handoff_node; extern vlib_node_registration_t snat_out2in_worker_handoff_node; extern vlib_node_registration_t snat_det_in2out_node; extern vlib_node_registration_t snat_det_out2in_node; -extern vlib_node_registration_t snat_hairpin_dst_node; -extern vlib_node_registration_t snat_hairpin_src_node; extern vlib_node_registration_t nat44_ed_in2out_node; extern vlib_node_registration_t nat44_ed_in2out_output_node; extern vlib_node_registration_t nat44_ed_out2in_node; -extern vlib_node_registration_t nat44_ed_hairpin_dst_node; -extern vlib_node_registration_t nat44_ed_hairpin_src_node; -extern vlib_node_registration_t nat44_ed_in2out_worker_handoff_node; -extern vlib_node_registration_t nat44_ed_in2out_output_worker_handoff_node; -extern vlib_node_registration_t nat44_ed_out2in_worker_handoff_node; + +extern fib_source_t nat_fib_src_hi; +extern fib_source_t nat_fib_src_low; /* format functions */ format_function_t format_snat_user; +format_function_t format_snat_user_v2; format_function_t format_snat_static_mapping; format_function_t format_snat_static_map_to_resolve; format_function_t format_snat_session; @@ -752,7 +802,6 @@ format_function_t format_snat_key; format_function_t format_static_mapping_key; format_function_t format_snat_protocol; format_function_t format_nat_addr_and_port_alloc_alg; -format_function_t format_nat44_reass_trace; /* unformat functions */ unformat_function_t unformat_snat_protocol; @@ -844,7 +893,11 @@ unformat_function_t unformat_snat_protocol; @param t TCP header @return 1 if client initiating TCP connection */ -#define tcp_is_init(t) ((t->flags & TCP_FLAG_SYN) && !(t->flags & TCP_FLAG_ACK)) +always_inline bool +tcp_flags_is_init (u8 f) +{ + return (f & TCP_FLAG_SYN) && !(f & TCP_FLAG_ACK); +} /* logging */ #define nat_log_err(...) \ @@ -1113,11 +1166,6 @@ int nat44_o2i_ed_is_idle_session_cb (clib_bihash_kv_16_8_t * kv, void *arg); int nat44_i2o_is_idle_session_cb (clib_bihash_kv_8_8_t * kv, void *arg); int nat44_o2i_is_idle_session_cb (clib_bihash_kv_8_8_t * kv, void *arg); -/** - * @brief Increment IPv4 address - */ -void increment_v4_address (ip4_address_t * a); - /** * @brief Add external address to NAT44 pool * @@ -1289,6 +1337,16 @@ int nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port, void nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index, u8 is_ha); +/** + * @brief Free NAT44 ED session data (lookup keys, external addrres port) + * + * @param s NAT session + * @param thread_index thread index + * @param is_ha is HA event + */ +void +nat44_free_session_data (snat_main_t * sm, snat_session_t * s, + u32 thread_index, u8 is_ha); /** * @brief Find or create NAT user * @@ -1298,8 +1356,9 @@ void nat_free_session_data (snat_main_t * sm, snat_session_t * s, * * @return NAT user data structure on success otherwise zero value */ -snat_user_t *nat_user_get_or_create (snat_main_t * sm, ip4_address_t * addr, - u32 fib_index, u32 thread_index); +snat_user_t *nat_user_get_or_create (snat_main_t * sm, + ip4_address_t * addr, u32 fib_index, + u32 thread_index); /** * @brief Allocate new NAT session or recycle last used @@ -1434,7 +1493,6 @@ typedef struct } tcp_udp_header_t; #endif /* __included_nat_h__ */ - /* * fd.io coding-style-patch-verification: ON *