src/plugins/map/ip6_map_t.c

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include "map.h"
  16
  17 #include <vnet/ip/ip4_to_ip6.h>
  18 #include <vnet/ip/ip6_to_ip4.h>
  19 #include <vnet/ip/ip_frag.h>
  20
  21 typedef enum
  22 {
  23   IP6_MAPT_NEXT_MAPT_TCP_UDP,
  24   IP6_MAPT_NEXT_MAPT_ICMP,
  25   IP6_MAPT_NEXT_MAPT_FRAGMENTED,
  26   IP6_MAPT_NEXT_DROP,
  27   IP6_MAPT_NEXT_ICMP,
  28   IP6_MAPT_N_NEXT
  29 } ip6_mapt_next_t;
  30
  31 typedef enum
  32 {
  33   IP6_MAPT_ICMP_NEXT_IP4_LOOKUP,
  34   IP6_MAPT_ICMP_NEXT_IP4_FRAG,
  35   IP6_MAPT_ICMP_NEXT_DROP,
  36   IP6_MAPT_ICMP_N_NEXT
  37 } ip6_mapt_icmp_next_t;
  38
  39 typedef enum
  40 {
  41   IP6_MAPT_TCP_UDP_NEXT_IP4_LOOKUP,
  42   IP6_MAPT_TCP_UDP_NEXT_IP4_FRAG,
  43   IP6_MAPT_TCP_UDP_NEXT_DROP,
  44   IP6_MAPT_TCP_UDP_N_NEXT
  45 } ip6_mapt_tcp_udp_next_t;
  46
  47 typedef enum
  48 {
  49   IP6_MAPT_FRAGMENTED_NEXT_IP4_LOOKUP,
  50   IP6_MAPT_FRAGMENTED_NEXT_IP4_FRAG,
  51   IP6_MAPT_FRAGMENTED_NEXT_DROP,
  52   IP6_MAPT_FRAGMENTED_N_NEXT
  53 } ip6_mapt_fragmented_next_t;
  54
  55 typedef struct
  56 {
  57   map_domain_t *d;
  58   u16 sender_port;
  59 } icmp6_to_icmp_ctx_t;
  60
  61 static int
  62 ip6_to_ip4_set_icmp_cb (ip6_header_t * ip6, ip4_header_t * ip4, void *arg)
  63 {
  64   icmp6_to_icmp_ctx_t *ctx = arg;
  65   u32 ip4_sadr;
  66
  67   // Security check
  68   // Note that this prevents an intermediate IPv6 router from answering
  69   // the request.
  70   ip4_sadr = map_get_ip4 (&ip6->src_address, ctx->d->ip6_src_len);
  71   if (ip6->src_address.as_u64[0] !=
  72       map_get_pfx_net (ctx->d, ip4_sadr, ctx->sender_port)
  73       || ip6->src_address.as_u64[1] != map_get_sfx_net (ctx->d, ip4_sadr,
  74                                                         ctx->sender_port))
  75     return -1;
  76
  77   ip4->dst_address.as_u32 =
  78     ip6_map_t_embedded_address (ctx->d, &ip6->dst_address);
  79   ip4->src_address.as_u32 = ip4_sadr;
  80
  81   return 0;
  82 }
  83
  84 static int
  85 ip6_to_ip4_set_inner_icmp_cb (ip6_header_t * ip6, ip4_header_t * ip4,
  86                               void *arg)
  87 {
  88   icmp6_to_icmp_ctx_t *ctx = arg;
  89   u32 inner_ip4_dadr;
  90
  91   //Security check of inner packet
  92   inner_ip4_dadr = map_get_ip4 (&ip6->dst_address, ctx->d->ip6_src_len);
  93   if (ip6->dst_address.as_u64[0] !=
  94       map_get_pfx_net (ctx->d, inner_ip4_dadr, ctx->sender_port)
  95       || ip6->dst_address.as_u64[1] != map_get_sfx_net (ctx->d,
  96                                                         inner_ip4_dadr,
  97                                                         ctx->sender_port))
  98     return -1;
  99
 100   ip4->dst_address.as_u32 = inner_ip4_dadr;
 101   ip4->src_address.as_u32 =
 102     ip6_map_t_embedded_address (ctx->d, &ip6->src_address);
 103
 104   return 0;
 105 }
 106
 107 static uword
 108 ip6_map_t_icmp (vlib_main_t * vm,
 109                 vlib_node_runtime_t * node, vlib_frame_t * frame)
 110 {
 111   u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
 112   vlib_node_runtime_t *error_node =
 113     vlib_node_get_runtime (vm, ip6_map_t_icmp_node.index);
 114   from = vlib_frame_vector_args (frame);
 115   n_left_from = frame->n_vectors;
 116   next_index = node->cached_next_index;
 117   vlib_combined_counter_main_t *cm = map_main.domain_counters;
 118   u32 thread_index = vm->thread_index;
 119
 120   while (n_left_from > 0)
 121     {
 122       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 123
 124       while (n_left_from > 0 && n_left_to_next > 0)
 125         {
 126           u32 pi0;
 127           vlib_buffer_t *p0;
 128           u8 error0;
 129           ip6_mapt_icmp_next_t next0;
 130           map_domain_t *d0;
 131           u16 len0;
 132           icmp6_to_icmp_ctx_t ctx0;
 133           ip6_header_t *ip60;
 134
 135           pi0 = to_next[0] = from[0];
 136           from += 1;
 137           n_left_from -= 1;
 138           to_next += 1;
 139           n_left_to_next -= 1;
 140           error0 = MAP_ERROR_NONE;
 141           next0 = IP6_MAPT_ICMP_NEXT_IP4_LOOKUP;
 142
 143           p0 = vlib_get_buffer (vm, pi0);
 144           ip60 = vlib_buffer_get_current (p0);
 145           len0 = clib_net_to_host_u16 (ip60->payload_length);
 146           d0 =
 147             pool_elt_at_index (map_main.domains,
 148                                vnet_buffer (p0)->map_t.map_domain_index);
 149           ctx0.d = d0;
 150           ctx0.sender_port = 0;
 151           if (!ip6_get_port
 152               (vm, p0, ip60, p0->current_length, NULL, &ctx0.sender_port,
 153                NULL, NULL, NULL, NULL))
 154             {
 155               // In case of 1:1 mapping, we don't care about the port
 156               if (!(d0->ea_bits_len == 0 && d0->rules))
 157                 {
 158                   error0 = MAP_ERROR_ICMP;
 159                   goto err0;
 160                 }
 161             }
 162
 163           if (icmp6_to_icmp (vm, p0, ip6_to_ip4_set_icmp_cb, &ctx0,
 164                              ip6_to_ip4_set_inner_icmp_cb, &ctx0))
 165             {
 166               error0 = MAP_ERROR_ICMP;
 167               goto err0;
 168             }
 169
 170           if (vnet_buffer (p0)->map_t.mtu < p0->current_length)
 171             {
 172               // Send to fragmentation node if necessary
 173               vnet_buffer (p0)->ip_frag.mtu = vnet_buffer (p0)->map_t.mtu;
 174               vnet_buffer (p0)->ip_frag.next_index = IP_FRAG_NEXT_IP4_LOOKUP;
 175               next0 = IP6_MAPT_ICMP_NEXT_IP4_FRAG;
 176             }
 177         err0:
 178           if (PREDICT_TRUE (error0 == MAP_ERROR_NONE))
 179             {
 180               vlib_increment_combined_counter (cm + MAP_DOMAIN_COUNTER_RX,
 181                                                thread_index,
 182                                                vnet_buffer (p0)->
 183                                                map_t.map_domain_index, 1,
 184                                                len0);
 185             }
 186           else
 187             {
 188               next0 = IP6_MAPT_ICMP_NEXT_DROP;
 189             }
 190
 191           p0->error = error_node->errors[error0];
 192           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 193                                            to_next, n_left_to_next, pi0,
 194                                            next0);
 195         }
 196       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 197     }
 198   return frame->n_vectors;
 199 }
 200
 201 /*
 202  * Translate IPv6 fragmented packet to IPv4.
 203  */
 204 always_inline int
 205 map_ip6_to_ip4_fragmented (vlib_main_t * vm, vlib_buffer_t * p)
 206 {
 207   ip6_header_t *ip6;
 208   ip6_frag_hdr_t *frag;
 209   ip4_header_t *ip4;
 210   u16 frag_id;
 211   u8 frag_more;
 212   u16 frag_offset;
 213   u8 l4_protocol;
 214   u16 l4_offset;
 215
 216   ip6 = vlib_buffer_get_current (p);
 217
 218   if (ip6_parse
 219       (vm, p, ip6, p->current_length, &l4_protocol, &l4_offset, &frag_offset))
 220     return -1;
 221
 222   frag = (ip6_frag_hdr_t *) u8_ptr_add (ip6, frag_offset);
 223   ip4 = (ip4_header_t *) u8_ptr_add (ip6, l4_offset - sizeof (*ip4));
 224   vlib_buffer_advance (p, l4_offset - sizeof (*ip4));
 225
 226   frag_id = frag_id_6to4 (frag->identification);
 227   frag_more = ip6_frag_hdr_more (frag);
 228   frag_offset = ip6_frag_hdr_offset (frag);
 229
 230   ip4->dst_address.as_u32 = vnet_buffer (p)->map_t.v6.daddr;
 231   ip4->src_address.as_u32 = vnet_buffer (p)->map_t.v6.saddr;
 232
 233   ip4->ip_version_and_header_length =
 234     IP4_VERSION_AND_HEADER_LENGTH_NO_OPTIONS;
 235   ip4->tos = ip6_translate_tos (ip6->ip_version_traffic_class_and_flow_label);
 236   ip4->length =
 237     u16_net_add (ip6->payload_length,
 238                  sizeof (*ip4) - l4_offset + sizeof (*ip6));
 239   ip4->fragment_id = frag_id;
 240   ip4->flags_and_fragment_offset =
 241     clib_host_to_net_u16 (frag_offset |
 242                           (frag_more ? IP4_HEADER_FLAG_MORE_FRAGMENTS : 0));
 243   ip4->ttl = ip6->hop_limit;
 244   ip4->protocol =
 245     (l4_protocol == IP_PROTOCOL_ICMP6) ? IP_PROTOCOL_ICMP : l4_protocol;
 246   ip4->checksum = ip4_header_checksum (ip4);
 247
 248   return 0;
 249 }
 250
 251 static uword
 252 ip6_map_t_fragmented (vlib_main_t * vm,
 253                       vlib_node_runtime_t * node, vlib_frame_t * frame)
 254 {
 255   u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
 256   from = vlib_frame_vector_args (frame);
 257   n_left_from = frame->n_vectors;
 258   next_index = node->cached_next_index;
 259   vlib_node_runtime_t *error_node =
 260     vlib_node_get_runtime (vm, ip6_map_t_fragmented_node.index);
 261
 262   while (n_left_from > 0)
 263     {
 264       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 265
 266       while (n_left_from > 0 && n_left_to_next > 0)
 267         {
 268           u32 pi0;
 269           vlib_buffer_t *p0;
 270           u32 next0;
 271
 272           pi0 = to_next[0] = from[0];
 273           from += 1;
 274           n_left_from -= 1;
 275           to_next += 1;
 276           n_left_to_next -= 1;
 277
 278           next0 = IP6_MAPT_TCP_UDP_NEXT_IP4_LOOKUP;
 279           p0 = vlib_get_buffer (vm, pi0);
 280
 281           if (map_ip6_to_ip4_fragmented (vm, p0))
 282             {
 283               p0->error = error_node->errors[MAP_ERROR_FRAGMENT_DROPPED];
 284               next0 = IP6_MAPT_FRAGMENTED_NEXT_DROP;
 285             }
 286           else
 287             {
 288               if (vnet_buffer (p0)->map_t.mtu < p0->current_length)
 289                 {
 290                   // Send to fragmentation node if necessary
 291                   vnet_buffer (p0)->ip_frag.mtu = vnet_buffer (p0)->map_t.mtu;
 292                   vnet_buffer (p0)->ip_frag.next_index =
 293                     IP_FRAG_NEXT_IP4_LOOKUP;
 294                   next0 = IP6_MAPT_FRAGMENTED_NEXT_IP4_FRAG;
 295                 }
 296             }
 297
 298           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 299                                            to_next, n_left_to_next, pi0,
 300                                            next0);
 301         }
 302       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 303     }
 304   return frame->n_vectors;
 305 }
 306
 307 /*
 308  * Translate IPv6 UDP/TCP packet to IPv4.
 309  * Returns 0 on success.
 310  * Returns a non-zero error code on error.
 311  */
 312 always_inline int
 313 map_ip6_to_ip4_tcp_udp (vlib_main_t * vm, vlib_buffer_t * p,
 314                         bool udp_checksum)
 315 {
 316   map_main_t *mm = &map_main;
 317   ip6_header_t *ip6;
 318   u16 *checksum;
 319   ip_csum_t csum = 0;
 320   ip4_header_t *ip4;
 321   u16 fragment_id;
 322   u16 flags;
 323   u16 frag_offset;
 324   u8 l4_protocol;
 325   u16 l4_offset;
 326   ip6_address_t old_src, old_dst;
 327
 328   ip6 = vlib_buffer_get_current (p);
 329
 330   if (ip6_parse
 331       (vm, p, ip6, p->current_length, &l4_protocol, &l4_offset, &frag_offset))
 332     return -1;
 333
 334   if (l4_protocol == IP_PROTOCOL_TCP)
 335     {
 336       tcp_header_t *tcp = ip6_next_header (ip6);
 337       if (mm->tcp_mss > 0)
 338         {
 339           csum = tcp->checksum;
 340           map_mss_clamping (tcp, &csum, mm->tcp_mss);
 341           tcp->checksum = ip_csum_fold (csum);
 342         }
 343       checksum = &tcp->checksum;
 344     }
 345   else
 346     {
 347       udp_header_t *udp = ip6_next_header (ip6);
 348       checksum = &udp->checksum;
 349     }
 350
 351   old_src.as_u64[0] = ip6->src_address.as_u64[0];
 352   old_src.as_u64[1] = ip6->src_address.as_u64[1];
 353   old_dst.as_u64[0] = ip6->dst_address.as_u64[0];
 354   old_dst.as_u64[1] = ip6->dst_address.as_u64[1];
 355
 356   ip4 = (ip4_header_t *) u8_ptr_add (ip6, l4_offset - sizeof (*ip4));
 357
 358   vlib_buffer_advance (p, l4_offset - sizeof (*ip4));
 359
 360   if (PREDICT_FALSE (frag_offset))
 361     {
 362       // Only the first fragment
 363       ip6_frag_hdr_t *hdr = (ip6_frag_hdr_t *) u8_ptr_add (ip6, frag_offset);
 364       fragment_id = frag_id_6to4 (hdr->identification);
 365       flags = clib_host_to_net_u16 (IP4_HEADER_FLAG_MORE_FRAGMENTS);
 366     }
 367   else
 368     {
 369       fragment_id = 0;
 370       flags = 0;
 371     }
 372
 373   ip4->dst_address.as_u32 = vnet_buffer (p)->map_t.v6.daddr;
 374   ip4->src_address.as_u32 = vnet_buffer (p)->map_t.v6.saddr;
 375
 376   /*
 377    * Drop spoofed packets that from a known domain source.
 378    */
 379   u32 map_domain_index = -1;
 380   u8 error = 0;
 381
 382   ip4_map_get_domain (&ip4->src_address, &map_domain_index, &error);
 383   if (error)
 384     return error;
 385
 386   ip4->ip_version_and_header_length =
 387     IP4_VERSION_AND_HEADER_LENGTH_NO_OPTIONS;
 388   ip4->tos = ip6_translate_tos (ip6->ip_version_traffic_class_and_flow_label);
 389   ip4->length =
 390     u16_net_add (ip6->payload_length,
 391                  sizeof (*ip4) + sizeof (*ip6) - l4_offset);
 392   ip4->fragment_id = fragment_id;
 393   ip4->flags_and_fragment_offset = flags;
 394   ip4->ttl = ip6->hop_limit;
 395   ip4->protocol = l4_protocol;
 396   ip4->checksum = ip4_header_checksum (ip4);
 397
 398   // UDP checksum is optional over IPv4
 399   if (!udp_checksum && l4_protocol == IP_PROTOCOL_UDP)
 400     {
 401       *checksum = 0;
 402     }
 403   else
 404     {
 405       csum = ip_csum_sub_even (*checksum, old_src.as_u64[0]);
 406       csum = ip_csum_sub_even (csum, old_src.as_u64[1]);
 407       csum = ip_csum_sub_even (csum, old_dst.as_u64[0]);
 408       csum = ip_csum_sub_even (csum, old_dst.as_u64[1]);
 409       csum = ip_csum_add_even (csum, ip4->dst_address.as_u32);
 410       csum = ip_csum_add_even (csum, ip4->src_address.as_u32);
 411       *checksum = ip_csum_fold (csum);
 412     }
 413
 414   return 0;
 415 }
 416
 417 static uword
 418 ip6_map_t_tcp_udp (vlib_main_t * vm,
 419                    vlib_node_runtime_t * node, vlib_frame_t * frame)
 420 {
 421   u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
 422   vlib_node_runtime_t *error_node =
 423     vlib_node_get_runtime (vm, ip6_map_t_tcp_udp_node.index);
 424
 425   from = vlib_frame_vector_args (frame);
 426   n_left_from = frame->n_vectors;
 427   next_index = node->cached_next_index;
 428   while (n_left_from > 0)
 429     {
 430       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 431
 432       while (n_left_from > 0 && n_left_to_next > 0)
 433         {
 434           u32 pi0;
 435           vlib_buffer_t *p0;
 436           ip6_mapt_tcp_udp_next_t next0;
 437
 438           pi0 = to_next[0] = from[0];
 439           from += 1;
 440           n_left_from -= 1;
 441           to_next += 1;
 442           n_left_to_next -= 1;
 443           next0 = IP6_MAPT_TCP_UDP_NEXT_IP4_LOOKUP;
 444
 445           p0 = vlib_get_buffer (vm, pi0);
 446
 447           if (map_ip6_to_ip4_tcp_udp (vm, p0, true))
 448             {
 449               p0->error = error_node->errors[MAP_ERROR_UNKNOWN];
 450               next0 = IP6_MAPT_TCP_UDP_NEXT_DROP;
 451             }
 452           else
 453             {
 454               if (vnet_buffer (p0)->map_t.mtu < p0->current_length)
 455                 {
 456                   // Send to fragmentation node if necessary
 457                   vnet_buffer (p0)->ip_frag.mtu = vnet_buffer (p0)->map_t.mtu;
 458                   vnet_buffer (p0)->ip_frag.next_index =
 459                     IP_FRAG_NEXT_IP4_LOOKUP;
 460                   next0 = IP6_MAPT_TCP_UDP_NEXT_IP4_FRAG;
 461                 }
 462             }
 463
 464           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 465                                            to_next, n_left_to_next, pi0,
 466                                            next0);
 467         }
 468       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 469     }
 470   return frame->n_vectors;
 471 }
 472
 473 static uword
 474 ip6_map_t (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
 475 {
 476   u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
 477   vlib_node_runtime_t *error_node =
 478     vlib_node_get_runtime (vm, ip6_map_t_node.index);
 479   map_main_t *mm = &map_main;
 480   vlib_combined_counter_main_t *cm = map_main.domain_counters;
 481   u32 thread_index = vm->thread_index;
 482
 483   from = vlib_frame_vector_args (frame);
 484   n_left_from = frame->n_vectors;
 485   next_index = node->cached_next_index;
 486   while (n_left_from > 0)
 487     {
 488       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 489
 490       while (n_left_from > 0 && n_left_to_next > 0)
 491         {
 492           u32 pi0;
 493           vlib_buffer_t *p0;
 494           ip6_header_t *ip60;
 495           u8 error0;
 496           u32 l4_len0;
 497           i32 map_port0;
 498           map_domain_t *d0;
 499           ip6_frag_hdr_t *frag0;
 500           ip6_mapt_next_t next0 = 0;
 501           u32 saddr;
 502
 503           pi0 = to_next[0] = from[0];
 504           from += 1;
 505           n_left_from -= 1;
 506           to_next += 1;
 507           n_left_to_next -= 1;
 508           error0 = MAP_ERROR_NONE;
 509           p0 = vlib_get_buffer (vm, pi0);
 510           u16 l4_src_port = vnet_buffer (p0)->ip.reass.l4_src_port;
 511
 512           ip60 = vlib_buffer_get_current (p0);
 513
 514           d0 =
 515             ip6_map_get_domain (&ip60->dst_address,
 516                                 &vnet_buffer (p0)->map_t.map_domain_index,
 517                                 &error0);
 518           if (!d0)
 519             {                   /* Guess it wasn't for us */
 520               vnet_feature_next (&next0, p0);
 521               goto exit;
 522             }
 523
 524           saddr = map_get_ip4 (&ip60->src_address, d0->ip6_src_len);
 525           vnet_buffer (p0)->map_t.v6.saddr = saddr;
 526           vnet_buffer (p0)->map_t.v6.daddr =
 527             ip6_map_t_embedded_address (d0, &ip60->dst_address);
 528           vnet_buffer (p0)->map_t.mtu = d0->mtu ? d0->mtu : ~0;
 529
 530           if (PREDICT_FALSE
 531               (ip6_parse (vm, p0, ip60, p0->current_length,
 532                           &(vnet_buffer (p0)->map_t.v6.l4_protocol),
 533                           &(vnet_buffer (p0)->map_t.v6.l4_offset),
 534                           &(vnet_buffer (p0)->map_t.v6.frag_offset))))
 535             {
 536               error0 =
 537                 error0 == MAP_ERROR_NONE ? MAP_ERROR_MALFORMED : error0;
 538             }
 539
 540           map_port0 = -1;
 541           l4_len0 =
 542             (u32) clib_net_to_host_u16 (ip60->payload_length) +
 543             sizeof (*ip60) - vnet_buffer (p0)->map_t.v6.l4_offset;
 544           frag0 =
 545             (ip6_frag_hdr_t *) u8_ptr_add (ip60,
 546                                            vnet_buffer (p0)->map_t.v6.
 547                                            frag_offset);
 548
 549           if (PREDICT_FALSE
 550               (vnet_buffer (p0)->map_t.v6.frag_offset
 551                && ip6_frag_hdr_offset (frag0)))
 552             {
 553               map_port0 = l4_src_port;
 554               next0 = IP6_MAPT_NEXT_MAPT_FRAGMENTED;
 555             }
 556           else
 557             if (PREDICT_TRUE
 558                 (vnet_buffer (p0)->map_t.v6.l4_protocol == IP_PROTOCOL_TCP))
 559             {
 560               error0 =
 561                 l4_len0 <
 562                 sizeof (tcp_header_t) ? MAP_ERROR_MALFORMED : error0;
 563               vnet_buffer (p0)->map_t.checksum_offset =
 564                 vnet_buffer (p0)->map_t.v6.l4_offset + 16;
 565               next0 = IP6_MAPT_NEXT_MAPT_TCP_UDP;
 566               map_port0 = l4_src_port;
 567             }
 568           else
 569             if (PREDICT_TRUE
 570                 (vnet_buffer (p0)->map_t.v6.l4_protocol == IP_PROTOCOL_UDP))
 571             {
 572               error0 =
 573                 l4_len0 <
 574                 sizeof (udp_header_t) ? MAP_ERROR_MALFORMED : error0;
 575               vnet_buffer (p0)->map_t.checksum_offset =
 576                 vnet_buffer (p0)->map_t.v6.l4_offset + 6;
 577               next0 = IP6_MAPT_NEXT_MAPT_TCP_UDP;
 578               map_port0 = l4_src_port;
 579             }
 580           else if (vnet_buffer (p0)->map_t.v6.l4_protocol ==
 581                    IP_PROTOCOL_ICMP6)
 582             {
 583               error0 =
 584                 l4_len0 <
 585                 sizeof (icmp46_header_t) ? MAP_ERROR_MALFORMED : error0;
 586               next0 = IP6_MAPT_NEXT_MAPT_ICMP;
 587               if (((icmp46_header_t *)
 588                    u8_ptr_add (ip60,
 589                                vnet_buffer (p0)->map_t.v6.l4_offset))->code ==
 590                   ICMP6_echo_reply
 591                   || ((icmp46_header_t *)
 592                       u8_ptr_add (ip60,
 593                                   vnet_buffer (p0)->map_t.v6.l4_offset))->
 594                   code == ICMP6_echo_request)
 595                 map_port0 = l4_src_port;
 596             }
 597           else
 598             {
 599               // TODO: In case of 1:1 mapping, it might be possible to
 600               // do something with those packets.
 601               error0 = MAP_ERROR_BAD_PROTOCOL;
 602             }
 603
 604           if (PREDICT_FALSE (map_port0 != -1) &&
 605               (ip60->src_address.as_u64[0] !=
 606                map_get_pfx_net (d0, vnet_buffer (p0)->map_t.v6.saddr,
 607                                 map_port0)
 608                || ip60->src_address.as_u64[1] != map_get_sfx_net (d0,
 609                                                                   vnet_buffer
 610                                                                   (p0)->map_t.
 611                                                                   v6.saddr,
 612                                                                   map_port0)))
 613             {
 614               // Security check when map_port0 is not zero (non-first
 615               // fragment, UDP or TCP)
 616               error0 =
 617                 error0 == MAP_ERROR_NONE ? MAP_ERROR_SEC_CHECK : error0;
 618             }
 619
 620           if (PREDICT_TRUE
 621               (error0 == MAP_ERROR_NONE && next0 != IP6_MAPT_NEXT_MAPT_ICMP))
 622             {
 623               vlib_increment_combined_counter (cm + MAP_DOMAIN_COUNTER_RX,
 624                                                thread_index,
 625                                                vnet_buffer (p0)->map_t.
 626                                                map_domain_index, 1,
 627                                                clib_net_to_host_u16 (ip60->
 628                                                                      payload_length));
 629             }
 630
 631           if (PREDICT_FALSE
 632               (error0 == MAP_ERROR_SEC_CHECK && mm->icmp6_enabled))
 633             {
 634               icmp6_error_set_vnet_buffer (p0, ICMP6_destination_unreachable,
 635                                            ICMP6_destination_unreachable_source_address_failed_policy,
 636                                            0);
 637               next0 = IP6_MAPT_NEXT_ICMP;
 638             }
 639           else
 640             {
 641               next0 = (error0 != MAP_ERROR_NONE) ? IP6_MAPT_NEXT_DROP : next0;
 642             }
 643
 644           p0->error = error_node->errors[error0];
 645           if (PREDICT_FALSE (p0->flags & VLIB_BUFFER_IS_TRACED))
 646             {
 647               map_add_trace (vm, node, p0,
 648                              vnet_buffer (p0)->map_t.map_domain_index,
 649                              map_port0);
 650             }
 651         exit:
 652           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 653                                            to_next, n_left_to_next, pi0,
 654                                            next0);
 655         }
 656       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 657     }
 658   return frame->n_vectors;
 659 }
 660
 661 static char *map_t_error_strings[] = {
 662 #define _(sym, string) string,
 663   foreach_map_error
 664 #undef _
 665 };
 666
 667 /* *INDENT-OFF* */
 668 VLIB_REGISTER_NODE(ip6_map_t_fragmented_node) = {
 669   .function = ip6_map_t_fragmented,
 670   .name = "ip6-map-t-fragmented",
 671   .vector_size = sizeof (u32),
 672   .format_trace = format_map_trace,
 673   .type = VLIB_NODE_TYPE_INTERNAL,
 674
 675   .n_errors = MAP_N_ERROR,
 676   .error_strings = map_t_error_strings,
 677
 678   .n_next_nodes = IP6_MAPT_FRAGMENTED_N_NEXT,
 679   .next_nodes =
 680   {
 681     [IP6_MAPT_FRAGMENTED_NEXT_IP4_LOOKUP] = "ip4-lookup",
 682     [IP6_MAPT_FRAGMENTED_NEXT_IP4_FRAG] = IP4_FRAG_NODE_NAME,
 683     [IP6_MAPT_FRAGMENTED_NEXT_DROP] = "error-drop",
 684   },
 685 };
 686 /* *INDENT-ON* */
 687
 688 /* *INDENT-OFF* */
 689 VLIB_REGISTER_NODE(ip6_map_t_icmp_node) = {
 690   .function = ip6_map_t_icmp,
 691   .name = "ip6-map-t-icmp",
 692   .vector_size = sizeof (u32),
 693   .format_trace = format_map_trace,
 694   .type = VLIB_NODE_TYPE_INTERNAL,
 695
 696   .n_errors = MAP_N_ERROR,
 697   .error_strings = map_t_error_strings,
 698
 699   .n_next_nodes = IP6_MAPT_ICMP_N_NEXT,
 700   .next_nodes =
 701   {
 702     [IP6_MAPT_ICMP_NEXT_IP4_LOOKUP] = "ip4-lookup",
 703     [IP6_MAPT_ICMP_NEXT_IP4_FRAG] = IP4_FRAG_NODE_NAME,
 704     [IP6_MAPT_ICMP_NEXT_DROP] = "error-drop",
 705   },
 706 };
 707 /* *INDENT-ON* */
 708
 709 /* *INDENT-OFF* */
 710 VLIB_REGISTER_NODE(ip6_map_t_tcp_udp_node) = {
 711   .function = ip6_map_t_tcp_udp,
 712   .name = "ip6-map-t-tcp-udp",
 713   .vector_size = sizeof (u32),
 714   .format_trace = format_map_trace,
 715   .type = VLIB_NODE_TYPE_INTERNAL,
 716
 717   .n_errors = MAP_N_ERROR,
 718   .error_strings = map_t_error_strings,
 719
 720   .n_next_nodes = IP6_MAPT_TCP_UDP_N_NEXT,
 721   .next_nodes =
 722   {
 723     [IP6_MAPT_TCP_UDP_NEXT_IP4_LOOKUP] = "ip4-lookup",
 724     [IP6_MAPT_TCP_UDP_NEXT_IP4_FRAG] = IP4_FRAG_NODE_NAME,
 725     [IP6_MAPT_TCP_UDP_NEXT_DROP] = "error-drop",
 726   },
 727 };
 728 /* *INDENT-ON* */
 729
 730 /* *INDENT-OFF* */
 731 VNET_FEATURE_INIT (ip6_map_t_feature, static) = {
 732     .arc_name = "ip6-unicast",
 733     .node_name = "ip6-map-t",
 734     .runs_before = VNET_FEATURES ("ip6-flow-classify"),
 735     .runs_after = VNET_FEATURES ("ip6-sv-reassembly-feature"),
 736 };
 737
 738 VLIB_REGISTER_NODE(ip6_map_t_node) = {
 739   .function = ip6_map_t,
 740   .name = "ip6-map-t",
 741   .vector_size = sizeof(u32),
 742   .format_trace = format_map_trace,
 743   .type = VLIB_NODE_TYPE_INTERNAL,
 744
 745   .n_errors = MAP_N_ERROR,
 746   .error_strings = map_t_error_strings,
 747
 748   .n_next_nodes = IP6_MAPT_N_NEXT,
 749   .next_nodes =
 750   {
 751     [IP6_MAPT_NEXT_MAPT_TCP_UDP] = "ip6-map-t-tcp-udp",
 752     [IP6_MAPT_NEXT_MAPT_ICMP] = "ip6-map-t-icmp",
 753     [IP6_MAPT_NEXT_MAPT_FRAGMENTED] = "ip6-map-t-fragmented",
 754     [IP6_MAPT_NEXT_DROP] = "error-drop",
 755     [IP6_MAPT_NEXT_ICMP] = "ip6-icmp-error",
 756   },
 757 };
 758 /* *INDENT-ON* */
 759
 760 /*
 761  * fd.io coding-style-patch-verification: ON
 762  *
 763  * Local Variables:
 764  * eval: (c-set-style "gnu")
 765  * End:
 766  */