X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fsnat%2Fout2in.c;h=5d308d78c4f8214927753063b7dac983c06e0c89;hb=586afd762bfa149f5ca167bd5fd5a0cd59ce94fe;hp=9b4c73d779e92f1063424e019177e7303eb43891;hpb=066f034b903bda6e938bec1b12f01edef65ee9c4;p=vpp.git

diff --git a/src/plugins/snat/out2in.c b/src/plugins/snat/out2in.c
index 9b4c73d779e..5d308d78c4f 100644
--- a/src/plugins/snat/out2in.c
+++ b/src/plugins/snat/out2in.c
@@ -129,7 +129,7 @@ create_session_for_static_mapping (snat_main_t *sm,
                                    snat_session_key_t in2out,
                                    snat_session_key_t out2in,
                                    vlib_node_runtime_t * node,
-                                   u32 cpu_index)
+                                   u32 thread_index)
 {
   snat_user_t *u;
   snat_user_key_t user_key;
@@ -146,36 +146,36 @@ create_session_for_static_mapping (snat_main_t *sm,
   if (clib_bihash_search_8_8 (&sm->user_hash, &kv0, &value0))
     {
       /* no, make a new one */
-      pool_get (sm->per_thread_data[cpu_index].users, u);
+      pool_get (sm->per_thread_data[thread_index].users, u);
       memset (u, 0, sizeof (*u));
       u->addr = in2out.addr;
       u->fib_index = in2out.fib_index;
 
-      pool_get (sm->per_thread_data[cpu_index].list_pool,
+      pool_get (sm->per_thread_data[thread_index].list_pool,
                 per_user_list_head_elt);
 
       u->sessions_per_user_list_head_index = per_user_list_head_elt -
-        sm->per_thread_data[cpu_index].list_pool;
+        sm->per_thread_data[thread_index].list_pool;
 
-      clib_dlist_init (sm->per_thread_data[cpu_index].list_pool,
+      clib_dlist_init (sm->per_thread_data[thread_index].list_pool,
                        u->sessions_per_user_list_head_index);
 
-      kv0.value = u - sm->per_thread_data[cpu_index].users;
+      kv0.value = u - sm->per_thread_data[thread_index].users;
 
       /* add user */
       clib_bihash_add_del_8_8 (&sm->user_hash, &kv0, 1 /* is_add */);
 
       /* add non-traslated packets worker lookup */
-      kv0.value = cpu_index;
+      kv0.value = thread_index;
       clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv0, 1);
     }
   else
     {
-      u = pool_elt_at_index (sm->per_thread_data[cpu_index].users,
+      u = pool_elt_at_index (sm->per_thread_data[thread_index].users,
                              value0.value);
     }
 
-  pool_get (sm->per_thread_data[cpu_index].sessions, s);
+  pool_get (sm->per_thread_data[thread_index].sessions, s);
   memset (s, 0, sizeof (*s));
 
   s->outside_address_index = ~0;
@@ -183,22 +183,22 @@ create_session_for_static_mapping (snat_main_t *sm,
   u->nstaticsessions++;
 
   /* Create list elts */
-  pool_get (sm->per_thread_data[cpu_index].list_pool,
+  pool_get (sm->per_thread_data[thread_index].list_pool,
             per_user_translation_list_elt);
-  clib_dlist_init (sm->per_thread_data[cpu_index].list_pool,
+  clib_dlist_init (sm->per_thread_data[thread_index].list_pool,
                    per_user_translation_list_elt -
-                   sm->per_thread_data[cpu_index].list_pool);
+                   sm->per_thread_data[thread_index].list_pool);
 
   per_user_translation_list_elt->value =
-    s - sm->per_thread_data[cpu_index].sessions;
+    s - sm->per_thread_data[thread_index].sessions;
   s->per_user_index =
-    per_user_translation_list_elt - sm->per_thread_data[cpu_index].list_pool;
+    per_user_translation_list_elt - sm->per_thread_data[thread_index].list_pool;
   s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 
-  clib_dlist_addtail (sm->per_thread_data[cpu_index].list_pool,
+  clib_dlist_addtail (sm->per_thread_data[thread_index].list_pool,
                       s->per_user_list_head_index,
                       per_user_translation_list_elt -
-                      sm->per_thread_data[cpu_index].list_pool);
+                      sm->per_thread_data[thread_index].list_pool);
 
   s->in2out = in2out;
   s->out2in = out2in;
@@ -206,12 +206,12 @@ create_session_for_static_mapping (snat_main_t *sm,
 
   /* Add to translation hashes */
   kv0.key = s->in2out.as_u64;
-  kv0.value = s - sm->per_thread_data[cpu_index].sessions;
+  kv0.value = s - sm->per_thread_data[thread_index].sessions;
   if (clib_bihash_add_del_8_8 (&sm->in2out, &kv0, 1 /* is_add */))
       clib_warning ("in2out key add failed");
 
   kv0.key = s->out2in.as_u64;
-  kv0.value = s - sm->per_thread_data[cpu_index].sessions;
+  kv0.value = s - sm->per_thread_data[thread_index].sessions;
 
   if (clib_bihash_add_del_8_8 (&sm->out2in, &kv0, 1 /* is_add */))
       clib_warning ("out2in key add failed");
@@ -226,52 +226,19 @@ create_session_for_static_mapping (snat_main_t *sm,
    return s;
 }
 
-typedef struct {
-  u16 src_port, dst_port;
-} tcp_udp_header_t;
-
-static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
-                                         vlib_buffer_t * b0,
-                                         ip4_header_t * ip0,
-                                         icmp46_header_t * icmp0,
-                                         u32 sw_if_index0,
-                                         u32 rx_fib_index0,
-                                         vlib_node_runtime_t * node,
-                                         u32 next0, f64 now,
-                                         u32 cpu_index,
-                                         snat_session_t ** p_s0)
+static_always_inline
+snat_out2in_error_t icmp_get_key(icmp46_header_t *icmp0,
+                                 snat_session_key_t *p_key0)
 {
-  snat_session_key_t key0, sm0;
+  snat_session_key_t key0;
   icmp_echo_header_t *echo0, *inner_echo0 = 0;
-  ip4_header_t *inner_ip0 = 0;
+  ip4_header_t *inner_ip0;
   void *l4_header = 0;
   icmp46_header_t *inner_icmp0;
-  clib_bihash_kv_8_8_t kv0, value0;
-  snat_session_t * s0 = 0;
-  u32 new_addr0, old_addr0;
-  u16 old_id0, new_id0;
-  ip_csum_t sum0;
-  u16 checksum0;
-  snat_runtime_t * rt = (snat_runtime_t *)node->runtime_data;
-  u8 is_error_message = 0;
 
   echo0 = (icmp_echo_header_t *)(icmp0+1);
 
-  key0.addr = ip0->dst_address;
-  key0.fib_index = rx_fib_index0;
-
-  switch(icmp0->type)
-    {
-    case ICMP4_destination_unreachable:
-    case ICMP4_time_exceeded:
-    case ICMP4_parameter_problem:
-    case ICMP4_source_quench:
-    case ICMP4_redirect:
-    case ICMP4_alternate_host_address:
-      is_error_message = 1;
-    }
-
-  if (!is_error_message)
+  if (!icmp_is_error_message (icmp0))
     {
       key0.protocol = SNAT_PROTOCOL_ICMP;
       key0.port = echo0->identifier;
@@ -293,44 +260,105 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
           key0.port = ((tcp_udp_header_t*)l4_header)->src_port;
           break;
         default:
-          b0->error = node->errors[SNAT_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
-          next0 = SNAT_OUT2IN_NEXT_DROP;
-          goto out;
+          return SNAT_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL;
         }
     }
+  *p_key0 = key0;
+  return -1; /* success */
+}
+
+static_always_inline u8
+is_interface_addr(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0,
+                  u32 ip4_addr)
+{
+  snat_runtime_t *rt = (snat_runtime_t *) node->runtime_data;
+  ip4_address_t * first_int_addr;
+
+  if (PREDICT_FALSE(rt->cached_sw_if_index != sw_if_index0))
+    {
+      first_int_addr =
+        ip4_interface_first_address (sm->ip4_main, sw_if_index0,
+                                     0 /* just want the address */);
+      rt->cached_sw_if_index = sw_if_index0;
+      if (first_int_addr)
+        rt->cached_ip4_address = first_int_addr->as_u32;
+      else
+        rt->cached_ip4_address = 0;
+    }
+
+  if (PREDICT_FALSE(ip4_addr == rt->cached_ip4_address))
+    return 1;
+  else
+    return 0;
+}
+
+/**
+ * Get address and port values to be used for packet SNAT translation
+ * and create session if needed
+ *
+ * @param[in,out] sm             SNAT main
+ * @param[in,out] node           SNAT node runtime
+ * @param[in] thread_index       thread index
+ * @param[in,out] b0             buffer containing packet to be translated
+ * @param[out] p_key             address and port before NAT translation
+ * @param[out] p_value           address and port after NAT translation
+ * @param[out] p_dont_translate  if packet should not be translated
+ * @param d                      optional parameter
+ */
+u32 icmp_match_out2in_slow(snat_main_t *sm, vlib_node_runtime_t *node,
+                           u32 thread_index, vlib_buffer_t *b0,
+                           snat_session_key_t *p_key,
+                           snat_session_key_t *p_value,
+                           u8 *p_dont_translate, void *d)
+{
+  ip4_header_t *ip0;
+  icmp46_header_t *icmp0;
+  u32 sw_if_index0;
+  u32 rx_fib_index0;
+  snat_session_key_t key0;
+  snat_session_key_t sm0;
+  snat_session_t *s0 = 0;
+  u8 dont_translate = 0;
+  clib_bihash_kv_8_8_t kv0, value0;
+  u32 next0 = ~0;
+  int err;
+
+  ip0 = vlib_buffer_get_current (b0);
+  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
+  sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX];
+  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+
+  err = icmp_get_key (icmp0, &key0);
+  if (err != -1)
+    {
+      b0->error = node->errors[SNAT_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
+      next0 = SNAT_OUT2IN_NEXT_DROP;
+      goto out;
+    }
+  key0.addr = ip0->dst_address;
+  key0.fib_index = rx_fib_index0;
 
   kv0.key = key0.as_u64;
-  
+
   if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
     {
       /* Try to match static mapping by external address and port,
          destination address and port in packet */
       if (snat_static_mapping_match(sm, key0, &sm0, 1))
         {
-           ip4_address_t * first_int_addr;
-
-          if (PREDICT_FALSE(rt->cached_sw_if_index != sw_if_index0))
+          /* Don't NAT packet aimed at the intfc address */
+          if (is_interface_addr(sm, node, sw_if_index0,
+                                ip0->dst_address.as_u32))
             {
-              first_int_addr = 
-                ip4_interface_first_address (sm->ip4_main, sw_if_index0,
-                                             0 /* just want the address */);
-              rt->cached_sw_if_index = sw_if_index0;
-              if (first_int_addr)
-                rt->cached_ip4_address = first_int_addr->as_u32;
-              else
-                rt->cached_ip4_address = 0;
+              dont_translate = 1;
+              goto out;
             }
-          
-          /* Don't NAT packet aimed at the intfc address */
-          if (PREDICT_FALSE(ip0->dst_address.as_u32 == rt->cached_ip4_address))
-            goto out;
-
           b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
           next0 = SNAT_OUT2IN_NEXT_DROP;
           goto out;
         }
 
-      if (is_error_message)
+      if (icmp_is_error_message (icmp0))
         {
           next0 = SNAT_OUT2IN_NEXT_DROP;
           goto out;
@@ -338,7 +366,7 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
 
       /* Create session initiated by host from external network */
       s0 = create_session_for_static_mapping(sm, b0, sm0, key0,
-                                             node, cpu_index);
+                                             node, thread_index);
 
       if (!s0)
         {
@@ -347,10 +375,117 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
         }
     }
   else
-    s0 = pool_elt_at_index (sm->per_thread_data[cpu_index].sessions,
+    s0 = pool_elt_at_index (sm->per_thread_data[thread_index].sessions,
                             value0.value);
 
-  if (PREDICT_FALSE(icmp0->type != ICMP4_echo_reply && !is_error_message))
+out:
+  *p_key = key0;
+  if (s0)
+    *p_value = s0->in2out;
+  *p_dont_translate = dont_translate;
+  if (d)
+    *(snat_session_t**)d = s0;
+  return next0;
+}
+
+/**
+ * Get address and port values to be used for packet SNAT translation
+ *
+ * @param[in] sm                 SNAT main
+ * @param[in,out] node           SNAT node runtime
+ * @param[in] thread_index       thread index
+ * @param[in,out] b0             buffer containing packet to be translated
+ * @param[out] p_key             address and port before NAT translation
+ * @param[out] p_value           address and port after NAT translation
+ * @param[out] p_dont_translate  if packet should not be translated
+ * @param d                      optional parameter
+ */
+u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node,
+                           u32 thread_index, vlib_buffer_t *b0,
+                           snat_session_key_t *p_key,
+                           snat_session_key_t *p_value,
+                           u8 *p_dont_translate, void *d)
+{
+  ip4_header_t *ip0;
+  icmp46_header_t *icmp0;
+  u32 sw_if_index0;
+  u32 rx_fib_index0;
+  snat_session_key_t key0;
+  snat_session_key_t sm0;
+  u8 dont_translate = 0;
+  u32 next0 = ~0;
+  int err;
+
+  ip0 = vlib_buffer_get_current (b0);
+  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
+  sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX];
+  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+
+  err = icmp_get_key (icmp0, &key0);
+  if (err != -1)
+    {
+      b0->error = node->errors[err];
+      next0 = SNAT_OUT2IN_NEXT_DROP;
+      goto out2;
+    }
+  key0.addr = ip0->dst_address;
+  key0.fib_index = rx_fib_index0;
+
+  if (snat_static_mapping_match(sm, key0, &sm0, 1))
+    {
+      /* Don't NAT packet aimed at the intfc address */
+      if (is_interface_addr(sm, node, sw_if_index0, ip0->dst_address.as_u32))
+        {
+          dont_translate = 1;
+          goto out;
+        }
+      b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
+      next0 = SNAT_OUT2IN_NEXT_DROP;
+      goto out;
+    }
+
+out:
+  *p_value = sm0;
+out2:
+  *p_key = key0;
+  *p_dont_translate = dont_translate;
+  return next0;
+}
+
+static inline u32 icmp_out2in (snat_main_t *sm,
+                               vlib_buffer_t * b0,
+                               ip4_header_t * ip0,
+                               icmp46_header_t * icmp0,
+                               u32 sw_if_index0,
+                               u32 rx_fib_index0,
+                               vlib_node_runtime_t * node,
+                               u32 next0,
+                               u32 thread_index,
+                               void *d)
+{
+  snat_session_key_t key0, sm0;
+  icmp_echo_header_t *echo0, *inner_echo0 = 0;
+  ip4_header_t *inner_ip0 = 0;
+  void *l4_header = 0;
+  icmp46_header_t *inner_icmp0;
+  u8 dont_translate;
+  u32 new_addr0, old_addr0;
+  u16 old_id0, new_id0;
+  ip_csum_t sum0;
+  u16 checksum0;
+  u32 next0_tmp;
+
+  echo0 = (icmp_echo_header_t *)(icmp0+1);
+
+  next0_tmp = sm->icmp_match_out2in_cb(sm, node, thread_index, b0,
+                                       &key0, &sm0, &dont_translate, d);
+  if (next0_tmp != ~0)
+    next0 = next0_tmp;
+  if (next0 == SNAT_OUT2IN_NEXT_DROP || dont_translate)
+    goto out;
+
+  if (PREDICT_FALSE(icmp0->type != ICMP4_echo_reply &&
+                    !icmp_is_error_message (icmp0)))
     {
       b0->error = node->errors[SNAT_OUT2IN_ERROR_BAD_ICMP_TYPE];
       next0 = SNAT_OUT2IN_NEXT_DROP;
@@ -367,28 +502,34 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
     }
 
   old_addr0 = ip0->dst_address.as_u32;
-  ip0->dst_address = s0->in2out.addr;
-  new_addr0 = ip0->dst_address.as_u32;
-  vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index;
-  
+  new_addr0 = ip0->dst_address.as_u32 = sm0.addr.as_u32;
+  vnet_buffer(b0)->sw_if_index[VLIB_TX] = sm0.fib_index;
+
   sum0 = ip0->checksum;
   sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
                          dst_address /* changed member */);
   ip0->checksum = ip_csum_fold (sum0);
-  
-  if (!is_error_message)
+
+  if (!icmp_is_error_message (icmp0))
     {
-      old_id0 = echo0->identifier;
-      new_id0 = s0->in2out.port;
-      echo0->identifier = new_id0;
+      new_id0 = sm0.port;
+      if (PREDICT_FALSE(new_id0 != echo0->identifier))
+        {
+          old_id0 = echo0->identifier;
+          new_id0 = sm0.port;
+          echo0->identifier = new_id0;
 
-      sum0 = icmp0->checksum;
-      sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
-                             identifier /* changed member */);
-      icmp0->checksum = ip_csum_fold (sum0);
+          sum0 = icmp0->checksum;
+          sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+                                 identifier /* changed member */);
+          icmp0->checksum = ip_csum_fold (sum0);
+        }
     }
   else
     {
+      inner_ip0 = (ip4_header_t *)(echo0+1);
+      l4_header = ip4_next_header (inner_ip0);
+
       if (!ip4_header_checksum_is_valid (inner_ip0))
         {
           next0 = SNAT_OUT2IN_NEXT_DROP;
@@ -396,7 +537,7 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
         }
 
       old_addr0 = inner_ip0->src_address.as_u32;
-      inner_ip0->src_address = s0->in2out.addr;
+      inner_ip0->src_address = sm0.addr;
       new_addr0 = inner_ip0->src_address.as_u32;
 
       sum0 = icmp0->checksum;
@@ -407,8 +548,11 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
       switch (key0.protocol)
         {
         case SNAT_PROTOCOL_ICMP:
+          inner_icmp0 = (icmp46_header_t*)l4_header;
+          inner_echo0 = (icmp_echo_header_t *)(inner_icmp0+1);
+
           old_id0 = inner_echo0->identifier;
-          new_id0 = s0->in2out.port;
+          new_id0 = sm0.port;
           inner_echo0->identifier = new_id0;
 
           sum0 = icmp0->checksum;
@@ -419,7 +563,7 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
         case SNAT_PROTOCOL_UDP:
         case SNAT_PROTOCOL_TCP:
           old_id0 = ((tcp_udp_header_t*)l4_header)->src_port;
-          new_id0 = s0->in2out.port;
+          new_id0 = sm0.port;
           ((tcp_udp_header_t*)l4_header)->src_port = new_id0;
 
           sum0 = icmp0->checksum;
@@ -432,22 +576,41 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
         }
     }
 
-  /* Accounting */
-  s0->last_heard = now;
-  s0->total_pkts++;
-  s0->total_bytes += vlib_buffer_length_in_chain (sm->vlib_main, b0);
-  /* Per-user LRU list maintenance for dynamic translation */
-  if (!snat_is_session_static (s0))
+out:
+  return next0;
+}
+
+
+static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
+                                         vlib_buffer_t * b0,
+                                         ip4_header_t * ip0,
+                                         icmp46_header_t * icmp0,
+                                         u32 sw_if_index0,
+                                         u32 rx_fib_index0,
+                                         vlib_node_runtime_t * node,
+                                         u32 next0, f64 now,
+                                         u32 thread_index,
+                                         snat_session_t ** p_s0)
+{
+  next0 = icmp_out2in(sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
+                      next0, thread_index, p_s0);
+  snat_session_t * s0 = *p_s0;
+  if (PREDICT_TRUE(next0 != SNAT_OUT2IN_NEXT_DROP && s0))
     {
-      clib_dlist_remove (sm->per_thread_data[cpu_index].list_pool,
-                         s0->per_user_index);
-      clib_dlist_addtail (sm->per_thread_data[cpu_index].list_pool,
-                          s0->per_user_list_head_index,
-                          s0->per_user_index);
+      /* Accounting */
+      s0->last_heard = now;
+      s0->total_pkts++;
+      s0->total_bytes += vlib_buffer_length_in_chain (sm->vlib_main, b0);
+      /* Per-user LRU list maintenance for dynamic translation */
+      if (!snat_is_session_static (s0))
+        {
+          clib_dlist_remove (sm->per_thread_data[thread_index].list_pool,
+                             s0->per_user_index);
+          clib_dlist_addtail (sm->per_thread_data[thread_index].list_pool,
+                              s0->per_user_list_head_index,
+                              s0->per_user_index);
+        }
     }
-
-out:
-  *p_s0 = s0;
   return next0;
 }
 
@@ -461,7 +624,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
   u32 pkts_processed = 0;
   snat_main_t * sm = &snat_main;
   f64 now = vlib_time_now (vm);
-  u32 cpu_index = os_get_cpu_number ();
+  u32 thread_index = vlib_get_thread_index ();
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
@@ -549,7 +712,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
             {
               next0 = icmp_out2in_slow_path 
                 (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node, 
-                 next0, now, cpu_index, &s0);
+                 next0, now, thread_index, &s0);
               goto trace0;
             }
 
@@ -580,7 +743,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
 
               /* Create session initiated by host from external network */
               s0 = create_session_for_static_mapping(sm, b0, sm0, key0, node,
-                                                     cpu_index);
+                                                     thread_index);
               if (!s0)
                 {
                   b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
@@ -589,7 +752,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
                 }
             }
           else
-            s0 = pool_elt_at_index (sm->per_thread_data[cpu_index].sessions,
+            s0 = pool_elt_at_index (sm->per_thread_data[thread_index].sessions,
                                     value0.value);
 
           old_addr0 = ip0->dst_address.as_u32;
@@ -633,9 +796,9 @@ snat_out2in_node_fn (vlib_main_t * vm,
           /* Per-user LRU list maintenance for dynamic translation */
           if (!snat_is_session_static (s0))
             {
-              clib_dlist_remove (sm->per_thread_data[cpu_index].list_pool,
+              clib_dlist_remove (sm->per_thread_data[thread_index].list_pool,
                                  s0->per_user_index);
-              clib_dlist_addtail (sm->per_thread_data[cpu_index].list_pool,
+              clib_dlist_addtail (sm->per_thread_data[thread_index].list_pool,
                                   s0->per_user_list_head_index,
                                   s0->per_user_index);
             }
@@ -650,7 +813,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
               t->next_index = next0;
               t->session_index = ~0;
               if (s0)
-                t->session_index = s0 - sm->per_thread_data[cpu_index].sessions;
+                t->session_index = s0 - sm->per_thread_data[thread_index].sessions;
             }
 
           pkts_processed += next0 != SNAT_OUT2IN_NEXT_DROP;
@@ -684,7 +847,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
             {
               next1 = icmp_out2in_slow_path 
                 (sm, b1, ip1, icmp1, sw_if_index1, rx_fib_index1, node, 
-                 next1, now, cpu_index, &s1);
+                 next1, now, thread_index, &s1);
               goto trace1;
             }
 
@@ -715,7 +878,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
 
               /* Create session initiated by host from external network */
               s1 = create_session_for_static_mapping(sm, b1, sm1, key1, node,
-                                                     cpu_index);
+                                                     thread_index);
               if (!s1)
                 {
                   b1->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
@@ -724,7 +887,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
                 }
             }
           else
-            s1 = pool_elt_at_index (sm->per_thread_data[cpu_index].sessions,
+            s1 = pool_elt_at_index (sm->per_thread_data[thread_index].sessions,
                                     value1.value);
 
           old_addr1 = ip1->dst_address.as_u32;
@@ -768,9 +931,9 @@ snat_out2in_node_fn (vlib_main_t * vm,
           /* Per-user LRU list maintenance for dynamic translation */
           if (!snat_is_session_static (s1))
             {
-              clib_dlist_remove (sm->per_thread_data[cpu_index].list_pool,
+              clib_dlist_remove (sm->per_thread_data[thread_index].list_pool,
                                  s1->per_user_index);
-              clib_dlist_addtail (sm->per_thread_data[cpu_index].list_pool,
+              clib_dlist_addtail (sm->per_thread_data[thread_index].list_pool,
                                   s1->per_user_list_head_index,
                                   s1->per_user_index);
             }
@@ -785,7 +948,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
               t->next_index = next1;
               t->session_index = ~0;
               if (s1)
-                t->session_index = s1 - sm->per_thread_data[cpu_index].sessions;
+                t->session_index = s1 - sm->per_thread_data[thread_index].sessions;
             }
 
           pkts_processed += next1 != SNAT_OUT2IN_NEXT_DROP;
@@ -853,7 +1016,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
             {
               next0 = icmp_out2in_slow_path 
                 (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node, 
-                 next0, now, cpu_index, &s0);
+                 next0, now, thread_index, &s0);
               goto trace00;
             }
 
@@ -885,7 +1048,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
 
               /* Create session initiated by host from external network */
               s0 = create_session_for_static_mapping(sm, b0, sm0, key0, node,
-                                                     cpu_index);
+                                                     thread_index);
               if (!s0)
                 {
                   b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
@@ -894,7 +1057,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
                 }
             }
           else
-            s0 = pool_elt_at_index (sm->per_thread_data[cpu_index].sessions,
+            s0 = pool_elt_at_index (sm->per_thread_data[thread_index].sessions,
                                     value0.value);
 
           old_addr0 = ip0->dst_address.as_u32;
@@ -938,9 +1101,9 @@ snat_out2in_node_fn (vlib_main_t * vm,
           /* Per-user LRU list maintenance for dynamic translation */
           if (!snat_is_session_static (s0))
             {
-              clib_dlist_remove (sm->per_thread_data[cpu_index].list_pool,
+              clib_dlist_remove (sm->per_thread_data[thread_index].list_pool,
                                  s0->per_user_index);
-              clib_dlist_addtail (sm->per_thread_data[cpu_index].list_pool,
+              clib_dlist_addtail (sm->per_thread_data[thread_index].list_pool,
                                   s0->per_user_list_head_index,
                                   s0->per_user_index);
             }
@@ -955,7 +1118,7 @@ snat_out2in_node_fn (vlib_main_t * vm,
               t->next_index = next0;
               t->session_index = ~0;
               if (s0)
-                t->session_index = s0 - sm->per_thread_data[cpu_index].sessions;
+                t->session_index = s0 - sm->per_thread_data[thread_index].sessions;
             }
 
           pkts_processed += next0 != SNAT_OUT2IN_NEXT_DROP;
@@ -1081,6 +1244,7 @@ snat_det_out2in_node_fn (vlib_main_t * vm,
               clib_warning("unknown dst address:  %U",
                            format_ip4_address, &ip0->dst_address);
               next0 = SNAT_OUT2IN_NEXT_DROP;
+              b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
               goto trace0;
             }
 
@@ -1090,12 +1254,14 @@ snat_det_out2in_node_fn (vlib_main_t * vm,
           ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
           if (PREDICT_FALSE(!ses0))
             {
-              clib_warning("no match src %U:%d dst %d for user %U",
-                           format_ip4_address, &ip0->dst_address,
+              clib_warning("no match src %U:%d dst %U:%d for user %U",
+                           format_ip4_address, &ip0->src_address,
                            clib_net_to_host_u16 (tcp0->src),
+                           format_ip4_address, &ip0->dst_address,
                            clib_net_to_host_u16 (tcp0->dst),
                            format_ip4_address, &new_addr0);
               next0 = SNAT_OUT2IN_NEXT_DROP;
+              b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
               goto trace0;
             }
           new_port0 = ses0->in_port;
@@ -1173,6 +1339,7 @@ snat_det_out2in_node_fn (vlib_main_t * vm,
               clib_warning("unknown dst address:  %U",
                            format_ip4_address, &ip1->dst_address);
               next1 = SNAT_OUT2IN_NEXT_DROP;
+              b1->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
               goto trace1;
             }
 
@@ -1182,12 +1349,14 @@ snat_det_out2in_node_fn (vlib_main_t * vm,
           ses1 = snat_det_get_ses_by_out (dm1, &new_addr1, key1.as_u64);
           if (PREDICT_FALSE(!ses1))
             {
-              clib_warning("no match src %U:%d dst %d for user %U",
-                           format_ip4_address, &ip1->dst_address,
+              clib_warning("no match src %U:%d dst %U:%d for user %U",
+                           format_ip4_address, &ip1->src_address,
                            clib_net_to_host_u16 (tcp1->src),
+                           format_ip4_address, &ip1->dst_address,
                            clib_net_to_host_u16 (tcp1->dst),
                            format_ip4_address, &new_addr1);
               next1 = SNAT_OUT2IN_NEXT_DROP;
+              b1->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
               goto trace1;
             }
           new_port1 = ses1->in_port;
@@ -1296,6 +1465,7 @@ snat_det_out2in_node_fn (vlib_main_t * vm,
               clib_warning("unknown dst address:  %U",
                            format_ip4_address, &ip0->dst_address);
               next0 = SNAT_OUT2IN_NEXT_DROP;
+              b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
               goto trace00;
             }
 
@@ -1305,12 +1475,14 @@ snat_det_out2in_node_fn (vlib_main_t * vm,
           ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
           if (PREDICT_FALSE(!ses0))
             {
-              clib_warning("no match src %U:%d dst %d for user %U",
-                           format_ip4_address, &ip0->dst_address,
+              clib_warning("no match src %U:%d dst %U:%d for user %U",
+                           format_ip4_address, &ip0->src_address,
                            clib_net_to_host_u16 (tcp0->src),
+                           format_ip4_address, &ip0->dst_address,
                            clib_net_to_host_u16 (tcp0->dst),
                            format_ip4_address, &new_addr0);
               next0 = SNAT_OUT2IN_NEXT_DROP;
+              b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
               goto trace00;
             }
           new_port0 = ses0->in_port;
@@ -1427,7 +1599,7 @@ snat_out2in_worker_handoff_fn (vlib_main_t * vm,
   u32 n_left_to_next_worker = 0, *to_next_worker = 0;
   u32 next_worker_index = 0;
   u32 current_worker_index = ~0;
-  u32 cpu_index = os_get_cpu_number ();
+  u32 thread_index = vlib_get_thread_index ();
 
   ASSERT (vec_len (sm->workers));
 
@@ -1465,7 +1637,7 @@ snat_out2in_worker_handoff_fn (vlib_main_t * vm,
 
       next_worker_index = sm->worker_out2in_cb(ip0, rx_fib_index0);
 
-      if (PREDICT_FALSE (next_worker_index != cpu_index))
+      if (PREDICT_FALSE (next_worker_index != thread_index))
         {
           do_handoff = 1;
 
@@ -1570,83 +1742,6 @@ VLIB_REGISTER_NODE (snat_out2in_worker_handoff_node) = {
 
 VLIB_NODE_FUNCTION_MULTIARCH (snat_out2in_worker_handoff_node, snat_out2in_worker_handoff_fn);
 
-/********************************/
-/*** static mapping only mode ***/
-/********************************/
-static inline u32 icmp_out2in_fast (snat_main_t *sm,
-                                    vlib_buffer_t * b0,
-                                    ip4_header_t * ip0,
-                                    icmp46_header_t * icmp0,
-                                    u32 sw_if_index0,
-                                    vlib_node_runtime_t * node,
-                                    u32 next0,
-                                    u32 rx_fib_index0)
-{
-  snat_session_key_t key0, sm0;
-  icmp_echo_header_t *echo0;
-  u32 new_addr0, old_addr0;
-  u16 old_id0, new_id0;
-  ip_csum_t sum0;
-  snat_runtime_t * rt = (snat_runtime_t *)node->runtime_data;
-
-  echo0 = (icmp_echo_header_t *)(icmp0+1);
-
-  key0.addr = ip0->dst_address;
-  key0.port = echo0->identifier;
-  key0.fib_index = rx_fib_index0;
-
-  if (snat_static_mapping_match(sm, key0, &sm0, 1))
-    {
-      ip4_address_t * first_int_addr;
-
-      if (PREDICT_FALSE(rt->cached_sw_if_index != sw_if_index0))
-        {
-          first_int_addr =
-            ip4_interface_first_address (sm->ip4_main, sw_if_index0,
-                                         0 /* just want the address */);
-          rt->cached_sw_if_index = sw_if_index0;
-          if (first_int_addr)
-            rt->cached_ip4_address = first_int_addr->as_u32;
-          else
-            rt->cached_ip4_address = 0;
-        }
-
-      /* Don't NAT packet aimed at the intfc address */
-      if (PREDICT_FALSE(ip0->dst_address.as_u32 ==
-                        rt->cached_ip4_address))
-        return next0;
-
-      b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
-      return SNAT_OUT2IN_NEXT_DROP;
-    }
-
-  new_addr0 = sm0.addr.as_u32;
-  new_id0 = sm0.port;
-  vnet_buffer(b0)->sw_if_index[VLIB_TX] = sm0.fib_index;
-
-  old_addr0 = ip0->dst_address.as_u32;
-  ip0->dst_address.as_u32 = new_addr0;
-
-  sum0 = ip0->checksum;
-  sum0 = ip_csum_update (sum0, old_addr0, new_addr0,
-                         ip4_header_t,
-                         dst_address /* changed member */);
-  ip0->checksum = ip_csum_fold (sum0);
-
-  if (PREDICT_FALSE(new_id0 != echo0->identifier))
-    {
-      old_id0 = echo0->identifier;
-      echo0->identifier = new_id0;
-
-      sum0 = icmp0->checksum;
-      sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
-                             identifier);
-      icmp0->checksum = ip_csum_fold (sum0);
-    }
-
-  return next0;
-}
-
 static uword
 snat_out2in_fast_node_fn (vlib_main_t * vm,
 	        	  vlib_node_runtime_t * node,
@@ -1712,8 +1807,8 @@ snat_out2in_fast_node_fn (vlib_main_t * vm,
 
           if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
             {
-              next0 = icmp_out2in_fast
-                (sm, b0, ip0, icmp0, sw_if_index0, node, next0, rx_fib_index0);
+              next0 = icmp_out2in(sm, b0, ip0, icmp0, sw_if_index0,
+                                  rx_fib_index0, node, next0, ~0, 0);
               goto trace00;
             }