src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_dpo.h>
  24 #include <nat/nat_ipfix_logging.h>
  25 #include <nat/nat_det.h>
  26 #include <nat/nat64.h>
  27 #include <nat/nat66.h>
  28 #include <nat/dslite.h>
  29 #include <nat/nat_reass.h>
  30 #include <nat/nat_inlines.h>
  31 #include <nat/nat_affinity.h>
  32 #include <nat/nat_syslog.h>
  33 #include <nat/nat_ha.h>
  34 #include <vnet/fib/fib_table.h>
  35 #include <vnet/fib/ip4_fib.h>
  36
  37 #include <vpp/app/version.h>
  38
  39 snat_main_t snat_main;
  40
  41 /* *INDENT-OFF* */
  42
  43 /* Hook up input features */
  44 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  45   .arc_name = "ip4-unicast",
  46   .node_name = "nat44-in2out",
  47   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  48 };
  49 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  50   .arc_name = "ip4-unicast",
  51   .node_name = "nat44-out2in",
  52   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  53                                "ip4-dhcp-client-detect"),
  54 };
  55 VNET_FEATURE_INIT (ip4_nat_classify, static) = {
  56   .arc_name = "ip4-unicast",
  57   .node_name = "nat44-classify",
  58   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  59 };
  60 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  61   .arc_name = "ip4-unicast",
  62   .node_name = "nat44-det-in2out",
  63   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  64 };
  65 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  66   .arc_name = "ip4-unicast",
  67   .node_name = "nat44-det-out2in",
  68   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  69                                "ip4-dhcp-client-detect"),
  70 };
  71 VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
  72   .arc_name = "ip4-unicast",
  73   .node_name = "nat44-det-classify",
  74   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  75 };
  76 VNET_FEATURE_INIT (ip4_nat44_ed_in2out, static) = {
  77   .arc_name = "ip4-unicast",
  78   .node_name = "nat44-ed-in2out",
  79   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  80 };
  81 VNET_FEATURE_INIT (ip4_nat44_ed_out2in, static) = {
  82   .arc_name = "ip4-unicast",
  83   .node_name = "nat44-ed-out2in",
  84   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  85                                "ip4-dhcp-client-detect"),
  86 };
  87 VNET_FEATURE_INIT (ip4_nat44_ed_classify, static) = {
  88   .arc_name = "ip4-unicast",
  89   .node_name = "nat44-ed-classify",
  90   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  91 };
  92 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  93   .arc_name = "ip4-unicast",
  94   .node_name = "nat44-in2out-worker-handoff",
  95   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  96 };
  97 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  98   .arc_name = "ip4-unicast",
  99   .node_name = "nat44-out2in-worker-handoff",
 100   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
 101                                "ip4-dhcp-client-detect"),
 102 };
 103 VNET_FEATURE_INIT (ip4_nat_handoff_classify, static) = {
 104   .arc_name = "ip4-unicast",
 105   .node_name = "nat44-handoff-classify",
 106   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 107 };
 108 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
 109   .arc_name = "ip4-unicast",
 110   .node_name = "nat44-in2out-fast",
 111   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 112 };
 113 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
 114   .arc_name = "ip4-unicast",
 115   .node_name = "nat44-out2in-fast",
 116   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
 117                                "ip4-dhcp-client-detect"),
 118 };
 119 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
 120   .arc_name = "ip4-unicast",
 121   .node_name = "nat44-hairpin-dst",
 122   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 123 };
 124 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_dst, static) = {
 125   .arc_name = "ip4-unicast",
 126   .node_name = "nat44-ed-hairpin-dst",
 127   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 128 };
 129
 130 /* Hook up output features */
 131 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
 132   .arc_name = "ip4-output",
 133   .node_name = "nat44-in2out-output",
 134   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 135 };
 136 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
 137   .arc_name = "ip4-output",
 138   .node_name = "nat44-in2out-output-worker-handoff",
 139   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 140 };
 141 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
 142   .arc_name = "ip4-output",
 143   .node_name = "nat44-hairpin-src",
 144   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 145 };
 146 VNET_FEATURE_INIT (ip4_nat44_ed_in2out_output, static) = {
 147   .arc_name = "ip4-output",
 148   .node_name = "nat44-ed-in2out-output",
 149   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 150 };
 151 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_src, static) = {
 152   .arc_name = "ip4-output",
 153   .node_name = "nat44-ed-hairpin-src",
 154   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 155 };
 156
 157 /* Hook up ip4-local features */
 158 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 159 {
 160   .arc_name = "ip4-local",
 161   .node_name = "nat44-hairpinning",
 162   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 163 };
 164 VNET_FEATURE_INIT (ip4_nat44_ed_hairpinning, static) =
 165 {
 166   .arc_name = "ip4-local",
 167   .node_name = "nat44-ed-hairpinning",
 168   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 169 };
 170
 171
 172 VLIB_PLUGIN_REGISTER () = {
 173     .version = VPP_BUILD_VER,
 174     .description = "Network Address Translation (NAT)",
 175 };
 176 /* *INDENT-ON* */
 177
 178 void
 179 nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index,
 180                        u8 is_ha)
 181 {
 182   snat_session_key_t key;
 183   clib_bihash_kv_8_8_t kv;
 184   nat_ed_ses_key_t ed_key;
 185   clib_bihash_kv_16_8_t ed_kv;
 186   snat_main_per_thread_data_t *tsm =
 187     vec_elt_at_index (sm->per_thread_data, thread_index);
 188
 189   if (is_fwd_bypass_session (s))
 190     {
 191       if (snat_is_unk_proto_session (s))
 192         {
 193           ed_key.proto = s->in2out.port;
 194           ed_key.r_port = 0;
 195           ed_key.l_port = 0;
 196         }
 197       else
 198         {
 199           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 200           ed_key.l_port = s->in2out.port;
 201           ed_key.r_port = s->ext_host_port;
 202         }
 203       ed_key.l_addr = s->in2out.addr;
 204       ed_key.r_addr = s->ext_host_addr;
 205       ed_key.fib_index = 0;
 206       ed_kv.key[0] = ed_key.as_u64[0];
 207       ed_kv.key[1] = ed_key.as_u64[1];
 208       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 209         nat_log_warn ("in2out_ed key del failed");
 210       return;
 211     }
 212
 213   /* session lookup tables */
 214   if (is_ed_session (s))
 215     {
 216       if (is_affinity_sessions (s))
 217         nat_affinity_unlock (s->ext_host_addr, s->out2in.addr,
 218                              s->in2out.protocol, s->out2in.port);
 219       ed_key.l_addr = s->out2in.addr;
 220       ed_key.r_addr = s->ext_host_addr;
 221       ed_key.fib_index = s->out2in.fib_index;
 222       if (snat_is_unk_proto_session (s))
 223         {
 224           ed_key.proto = s->in2out.port;
 225           ed_key.r_port = 0;
 226           ed_key.l_port = 0;
 227         }
 228       else
 229         {
 230           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 231           ed_key.l_port = s->out2in.port;
 232           ed_key.r_port = s->ext_host_port;
 233         }
 234       ed_kv.key[0] = ed_key.as_u64[0];
 235       ed_kv.key[1] = ed_key.as_u64[1];
 236       if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &ed_kv, 0))
 237         nat_log_warn ("out2in_ed key del failed");
 238       ed_key.l_addr = s->in2out.addr;
 239       ed_key.fib_index = s->in2out.fib_index;
 240       if (!snat_is_unk_proto_session (s))
 241         ed_key.l_port = s->in2out.port;
 242       if (is_twice_nat_session (s))
 243         {
 244           ed_key.r_addr = s->ext_host_nat_addr;
 245           ed_key.r_port = s->ext_host_nat_port;
 246         }
 247       ed_kv.key[0] = ed_key.as_u64[0];
 248       ed_kv.key[1] = ed_key.as_u64[1];
 249       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 250         nat_log_warn ("in2out_ed key del failed");
 251
 252       if (!is_ha)
 253         nat_syslog_nat44_sdel (s->user_index, s->in2out.fib_index,
 254                                &s->in2out.addr, s->in2out.port,
 255                                &s->ext_host_nat_addr, s->ext_host_nat_port,
 256                                &s->out2in.addr, s->out2in.port,
 257                                &s->ext_host_addr, s->ext_host_port,
 258                                s->in2out.protocol, is_twice_nat_session (s));
 259     }
 260   else
 261     {
 262       kv.key = s->in2out.as_u64;
 263       if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
 264         nat_log_warn ("in2out key del failed");
 265       kv.key = s->out2in.as_u64;
 266       if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
 267         nat_log_warn ("out2in key del failed");
 268
 269       if (!is_ha)
 270         nat_syslog_nat44_apmdel (s->user_index, s->in2out.fib_index,
 271                                  &s->in2out.addr, s->in2out.port,
 272                                  &s->out2in.addr, s->out2in.port,
 273                                  s->in2out.protocol);
 274     }
 275
 276   if (snat_is_unk_proto_session (s))
 277     return;
 278
 279   if (!is_ha)
 280     {
 281       /* log NAT event */
 282       snat_ipfix_logging_nat44_ses_delete (thread_index,
 283                                            s->in2out.addr.as_u32,
 284                                            s->out2in.addr.as_u32,
 285                                            s->in2out.protocol,
 286                                            s->in2out.port,
 287                                            s->out2in.port,
 288                                            s->in2out.fib_index);
 289
 290       nat_ha_sdel (&s->out2in.addr, s->out2in.port, &s->ext_host_addr,
 291                    s->ext_host_port, s->out2in.protocol, s->out2in.fib_index,
 292                    thread_index);
 293     }
 294
 295   /* Twice NAT address and port for external host */
 296   if (is_twice_nat_session (s))
 297     {
 298       key.protocol = s->in2out.protocol;
 299       key.port = s->ext_host_nat_port;
 300       key.addr.as_u32 = s->ext_host_nat_addr.as_u32;
 301       snat_free_outside_address_and_port (sm->twice_nat_addresses,
 302                                           thread_index, &key);
 303     }
 304
 305   if (snat_is_session_static (s))
 306     return;
 307
 308   snat_free_outside_address_and_port (sm->addresses, thread_index,
 309                                       &s->out2in);
 310 }
 311
 312 snat_user_t *
 313 nat_user_get_or_create (snat_main_t * sm, ip4_address_t * addr, u32 fib_index,
 314                         u32 thread_index)
 315 {
 316   snat_user_t *u = 0;
 317   snat_user_key_t user_key;
 318   clib_bihash_kv_8_8_t kv, value;
 319   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 320   dlist_elt_t *per_user_list_head_elt;
 321
 322   user_key.addr.as_u32 = addr->as_u32;
 323   user_key.fib_index = fib_index;
 324   kv.key = user_key.as_u64;
 325
 326   /* Ever heard of the "user" = src ip4 address before? */
 327   if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 328     {
 329       /* no, make a new one */
 330       pool_get (tsm->users, u);
 331       clib_memset (u, 0, sizeof (*u));
 332       u->addr.as_u32 = addr->as_u32;
 333       u->fib_index = fib_index;
 334
 335       pool_get (tsm->list_pool, per_user_list_head_elt);
 336
 337       u->sessions_per_user_list_head_index = per_user_list_head_elt -
 338         tsm->list_pool;
 339
 340       clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
 341
 342       kv.value = u - tsm->users;
 343
 344       /* add user */
 345       if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
 346         nat_log_warn ("user_hash keay add failed");
 347
 348       vlib_set_simple_counter (&sm->total_users, thread_index, 0,
 349                                pool_elts (tsm->users));
 350     }
 351   else
 352     {
 353       u = pool_elt_at_index (tsm->users, value.value);
 354     }
 355
 356   return u;
 357 }
 358
 359 snat_session_t *
 360 nat_session_alloc_or_recycle (snat_main_t * sm, snat_user_t * u,
 361                               u32 thread_index, f64 now)
 362 {
 363   snat_session_t *s;
 364   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 365   u32 oldest_per_user_translation_list_index, session_index;
 366   dlist_elt_t *oldest_per_user_translation_list_elt;
 367   dlist_elt_t *per_user_translation_list_elt;
 368
 369   /* Over quota? Recycle the least recently used translation */
 370   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 371     {
 372       oldest_per_user_translation_list_index =
 373         clib_dlist_remove_head (tsm->list_pool,
 374                                 u->sessions_per_user_list_head_index);
 375
 376       ASSERT (oldest_per_user_translation_list_index != ~0);
 377
 378       /* Add it back to the end of the LRU list */
 379       clib_dlist_addtail (tsm->list_pool,
 380                           u->sessions_per_user_list_head_index,
 381                           oldest_per_user_translation_list_index);
 382       /* Get the list element */
 383       oldest_per_user_translation_list_elt =
 384         pool_elt_at_index (tsm->list_pool,
 385                            oldest_per_user_translation_list_index);
 386
 387       /* Get the session index from the list element */
 388       session_index = oldest_per_user_translation_list_elt->value;
 389
 390       /* Get the session */
 391       s = pool_elt_at_index (tsm->sessions, session_index);
 392       nat_free_session_data (sm, s, thread_index, 0);
 393       if (snat_is_session_static (s))
 394         u->nstaticsessions--;
 395       else
 396         u->nsessions--;
 397       s->flags = 0;
 398       s->total_bytes = 0;
 399       s->total_pkts = 0;
 400       s->state = 0;
 401       s->ext_host_addr.as_u32 = 0;
 402       s->ext_host_port = 0;
 403       s->ext_host_nat_addr.as_u32 = 0;
 404       s->ext_host_nat_port = 0;
 405     }
 406   else
 407     {
 408       pool_get (tsm->sessions, s);
 409       clib_memset (s, 0, sizeof (*s));
 410
 411       /* Create list elts */
 412       pool_get (tsm->list_pool, per_user_translation_list_elt);
 413       clib_dlist_init (tsm->list_pool,
 414                        per_user_translation_list_elt - tsm->list_pool);
 415
 416       per_user_translation_list_elt->value = s - tsm->sessions;
 417       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 418       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 419
 420       clib_dlist_addtail (tsm->list_pool,
 421                           s->per_user_list_head_index,
 422                           per_user_translation_list_elt - tsm->list_pool);
 423
 424       s->user_index = u - tsm->users;
 425       vlib_set_simple_counter (&sm->total_sessions, thread_index, 0,
 426                                pool_elts (tsm->sessions));
 427     }
 428
 429   s->ha_last_refreshed = now;
 430
 431   return s;
 432 }
 433
 434 snat_session_t *
 435 nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u, u32 thread_index,
 436                       f64 now)
 437 {
 438   snat_session_t *s;
 439   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 440   dlist_elt_t *per_user_translation_list_elt, *oldest_elt;
 441   u32 oldest_index;
 442   u64 sess_timeout_time;
 443
 444   if (PREDICT_FALSE (!(u->nsessions) && !(u->nstaticsessions)))
 445     goto alloc_new;
 446
 447   oldest_index =
 448     clib_dlist_remove_head (tsm->list_pool,
 449                             u->sessions_per_user_list_head_index);
 450   oldest_elt = pool_elt_at_index (tsm->list_pool, oldest_index);
 451   s = pool_elt_at_index (tsm->sessions, oldest_elt->value);
 452   sess_timeout_time = s->last_heard + (f64) nat44_session_get_timeout (sm, s);
 453   if (now >= sess_timeout_time)
 454     {
 455       clib_dlist_addtail (tsm->list_pool,
 456                           u->sessions_per_user_list_head_index, oldest_index);
 457       nat_free_session_data (sm, s, thread_index, 0);
 458       if (snat_is_session_static (s))
 459         u->nstaticsessions--;
 460       else
 461         u->nsessions--;
 462       s->flags = 0;
 463       s->total_bytes = 0;
 464       s->total_pkts = 0;
 465       s->state = 0;
 466       s->ext_host_addr.as_u32 = 0;
 467       s->ext_host_port = 0;
 468       s->ext_host_nat_addr.as_u32 = 0;
 469       s->ext_host_nat_port = 0;
 470     }
 471   else
 472     {
 473       clib_dlist_addhead (tsm->list_pool,
 474                           u->sessions_per_user_list_head_index, oldest_index);
 475       if ((u->nsessions + u->nstaticsessions) >=
 476           sm->max_translations_per_user)
 477         {
 478           nat_log_warn ("max translations per user %U", format_ip4_address,
 479                         &u->addr);
 480           snat_ipfix_logging_max_entries_per_user
 481             (thread_index, sm->max_translations_per_user, u->addr.as_u32);
 482           return 0;
 483         }
 484       else
 485         {
 486         alloc_new:
 487           pool_get (tsm->sessions, s);
 488           clib_memset (s, 0, sizeof (*s));
 489
 490           /* Create list elts */
 491           pool_get (tsm->list_pool, per_user_translation_list_elt);
 492           clib_dlist_init (tsm->list_pool,
 493                            per_user_translation_list_elt - tsm->list_pool);
 494
 495           per_user_translation_list_elt->value = s - tsm->sessions;
 496           s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 497           s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 498
 499           clib_dlist_addtail (tsm->list_pool,
 500                               s->per_user_list_head_index,
 501                               per_user_translation_list_elt - tsm->list_pool);
 502         }
 503
 504       vlib_set_simple_counter (&sm->total_sessions, thread_index, 0,
 505                                pool_elts (tsm->sessions));
 506     }
 507
 508   s->ha_last_refreshed = now;
 509
 510   return s;
 511 }
 512
 513 void
 514 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 515                           int is_add)
 516 {
 517   fib_prefix_t prefix = {
 518     .fp_len = p_len,
 519     .fp_proto = FIB_PROTOCOL_IP4,
 520     .fp_addr = {
 521                 .ip4.as_u32 = addr->as_u32,
 522                 },
 523   };
 524   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 525
 526   if (is_add)
 527     fib_table_entry_update_one_path (fib_index,
 528                                      &prefix,
 529                                      FIB_SOURCE_PLUGIN_LOW,
 530                                      (FIB_ENTRY_FLAG_CONNECTED |
 531                                       FIB_ENTRY_FLAG_LOCAL |
 532                                       FIB_ENTRY_FLAG_EXCLUSIVE),
 533                                      DPO_PROTO_IP4,
 534                                      NULL,
 535                                      sw_if_index,
 536                                      ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
 537   else
 538     fib_table_entry_delete (fib_index, &prefix, FIB_SOURCE_PLUGIN_LOW);
 539 }
 540
 541 int
 542 snat_add_address (snat_main_t * sm, ip4_address_t * addr, u32 vrf_id,
 543                   u8 twice_nat)
 544 {
 545   snat_address_t *ap;
 546   snat_interface_t *i;
 547   vlib_thread_main_t *tm = vlib_get_thread_main ();
 548
 549   if (twice_nat && !sm->endpoint_dependent)
 550     return VNET_API_ERROR_FEATURE_DISABLED;
 551
 552   /* Check if address already exists */
 553   /* *INDENT-OFF* */
 554   vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
 555     {
 556       if (ap->addr.as_u32 == addr->as_u32)
 557         return VNET_API_ERROR_VALUE_EXIST;
 558     }
 559   /* *INDENT-ON* */
 560
 561   if (twice_nat)
 562     vec_add2 (sm->twice_nat_addresses, ap, 1);
 563   else
 564     vec_add2 (sm->addresses, ap, 1);
 565
 566   ap->addr = *addr;
 567   if (vrf_id != ~0)
 568     ap->fib_index =
 569       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 570                                          FIB_SOURCE_PLUGIN_LOW);
 571   else
 572     ap->fib_index = ~0;
 573 #define _(N, i, n, s) \
 574   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 575   ap->busy_##n##_ports = 0; \
 576   ap->busy_##n##_ports_per_thread = 0;\
 577   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 578   foreach_snat_protocol
 579 #undef _
 580     if (twice_nat)
 581     return 0;
 582
 583   /* Add external address to FIB */
 584   /* *INDENT-OFF* */
 585   pool_foreach (i, sm->interfaces,
 586   ({
 587     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 588       continue;
 589
 590     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 591     break;
 592   }));
 593   pool_foreach (i, sm->output_feature_interfaces,
 594   ({
 595     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 596       continue;
 597
 598     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 599     break;
 600   }));
 601   /* *INDENT-ON* */
 602
 603   return 0;
 604 }
 605
 606 static int
 607 is_snat_address_used_in_static_mapping (snat_main_t * sm, ip4_address_t addr)
 608 {
 609   snat_static_mapping_t *m;
 610   /* *INDENT-OFF* */
 611   pool_foreach (m, sm->static_mappings,
 612   ({
 613       if (is_addr_only_static_mapping (m) ||
 614           is_out2in_only_static_mapping (m) ||
 615           is_identity_static_mapping (m))
 616         continue;
 617       if (m->external_addr.as_u32 == addr.as_u32)
 618         return 1;
 619   }));
 620   /* *INDENT-ON* */
 621
 622   return 0;
 623 }
 624
 625 void
 626 increment_v4_address (ip4_address_t * a)
 627 {
 628   u32 v;
 629
 630   v = clib_net_to_host_u32 (a->as_u32) + 1;
 631   a->as_u32 = clib_host_to_net_u32 (v);
 632 }
 633
 634 static void
 635 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 636                                        ip4_address_t l_addr,
 637                                        u16 l_port,
 638                                        u32 sw_if_index,
 639                                        u16 e_port,
 640                                        u32 vrf_id,
 641                                        snat_protocol_t proto,
 642                                        int addr_only, int is_add, u8 * tag,
 643                                        int twice_nat, int out2in_only,
 644                                        int identity_nat)
 645 {
 646   snat_static_map_resolve_t *rp;
 647
 648   vec_add2 (sm->to_resolve, rp, 1);
 649   rp->l_addr.as_u32 = l_addr.as_u32;
 650   rp->l_port = l_port;
 651   rp->sw_if_index = sw_if_index;
 652   rp->e_port = e_port;
 653   rp->vrf_id = vrf_id;
 654   rp->proto = proto;
 655   rp->addr_only = addr_only;
 656   rp->is_add = is_add;
 657   rp->twice_nat = twice_nat;
 658   rp->out2in_only = out2in_only;
 659   rp->identity_nat = identity_nat;
 660   rp->tag = vec_dup (tag);
 661 }
 662
 663 static u32
 664 get_thread_idx_by_port (u16 e_port)
 665 {
 666   snat_main_t *sm = &snat_main;
 667   u32 thread_idx = sm->num_workers;
 668   if (sm->num_workers > 1)
 669     {
 670       thread_idx =
 671         sm->first_worker_index +
 672         sm->workers[(e_port - 1024) / sm->port_per_thread];
 673     }
 674   return thread_idx;
 675 }
 676
 677 int
 678 snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr,
 679                          u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 680                          u32 sw_if_index, snat_protocol_t proto, int is_add,
 681                          twice_nat_type_t twice_nat, u8 out2in_only, u8 * tag,
 682                          u8 identity_nat)
 683 {
 684   snat_main_t *sm = &snat_main;
 685   snat_static_mapping_t *m;
 686   snat_session_key_t m_key;
 687   clib_bihash_kv_8_8_t kv, value;
 688   snat_address_t *a = 0;
 689   u32 fib_index = ~0;
 690   snat_interface_t *interface;
 691   int i;
 692   snat_main_per_thread_data_t *tsm;
 693   snat_user_key_t u_key;
 694   snat_user_t *u;
 695   dlist_elt_t *head, *elt;
 696   u32 elt_index, head_index;
 697   u32 ses_index;
 698   u64 user_index;
 699   snat_session_t *s;
 700   snat_static_map_resolve_t *rp, *rp_match = 0;
 701   nat44_lb_addr_port_t *local;
 702   u32 find = ~0;
 703
 704   if (!sm->endpoint_dependent)
 705     {
 706       if (twice_nat || out2in_only)
 707         return VNET_API_ERROR_FEATURE_DISABLED;
 708     }
 709
 710   /* If the external address is a specific interface address */
 711   if (sw_if_index != ~0)
 712     {
 713       ip4_address_t *first_int_addr;
 714
 715       for (i = 0; i < vec_len (sm->to_resolve); i++)
 716         {
 717           rp = sm->to_resolve + i;
 718           if (rp->sw_if_index != sw_if_index ||
 719               rp->l_addr.as_u32 != l_addr.as_u32 ||
 720               rp->vrf_id != vrf_id || rp->addr_only != addr_only)
 721             continue;
 722
 723           if (!addr_only)
 724             {
 725               if ((rp->l_port != l_port && rp->e_port != e_port)
 726                   || rp->proto != proto)
 727                 continue;
 728             }
 729
 730           rp_match = rp;
 731           break;
 732         }
 733
 734       /* Might be already set... */
 735       first_int_addr = ip4_interface_first_address
 736         (sm->ip4_main, sw_if_index, 0 /* just want the address */ );
 737
 738       if (is_add)
 739         {
 740           if (rp_match)
 741             return VNET_API_ERROR_VALUE_EXIST;
 742
 743           snat_add_static_mapping_when_resolved
 744             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 745              addr_only, is_add, tag, twice_nat, out2in_only, identity_nat);
 746
 747           /* DHCP resolution required? */
 748           if (first_int_addr == 0)
 749             {
 750               return 0;
 751             }
 752           else
 753             {
 754               e_addr.as_u32 = first_int_addr->as_u32;
 755               /* Identity mapping? */
 756               if (l_addr.as_u32 == 0)
 757                 l_addr.as_u32 = e_addr.as_u32;
 758             }
 759         }
 760       else
 761         {
 762           if (!rp_match)
 763             return VNET_API_ERROR_NO_SUCH_ENTRY;
 764
 765           vec_del1 (sm->to_resolve, i);
 766
 767           if (first_int_addr)
 768             {
 769               e_addr.as_u32 = first_int_addr->as_u32;
 770               /* Identity mapping? */
 771               if (l_addr.as_u32 == 0)
 772                 l_addr.as_u32 = e_addr.as_u32;
 773             }
 774           else
 775             return 0;
 776         }
 777     }
 778
 779   m_key.addr = e_addr;
 780   m_key.port = addr_only ? 0 : e_port;
 781   m_key.protocol = addr_only ? 0 : proto;
 782   m_key.fib_index = 0;
 783   kv.key = m_key.as_u64;
 784   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 785     m = 0;
 786   else
 787     m = pool_elt_at_index (sm->static_mappings, value.value);
 788
 789   if (is_add)
 790     {
 791       if (m)
 792         {
 793           if (is_identity_static_mapping (m))
 794             {
 795               /* *INDENT-OFF* */
 796               pool_foreach (local, m->locals,
 797               ({
 798                 if (local->vrf_id == vrf_id)
 799                   return VNET_API_ERROR_VALUE_EXIST;
 800               }));
 801               /* *INDENT-ON* */
 802               pool_get (m->locals, local);
 803               local->vrf_id = vrf_id;
 804               local->fib_index =
 805                 fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 806                                                    FIB_SOURCE_PLUGIN_LOW);
 807               m_key.addr = m->local_addr;
 808               m_key.port = m->local_port;
 809               m_key.protocol = m->proto;
 810               m_key.fib_index = local->fib_index;
 811               kv.key = m_key.as_u64;
 812               kv.value = m - sm->static_mappings;
 813               clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
 814               return 0;
 815             }
 816           else
 817             return VNET_API_ERROR_VALUE_EXIST;
 818         }
 819
 820       if (twice_nat && addr_only)
 821         return VNET_API_ERROR_UNSUPPORTED;
 822
 823       /* Convert VRF id to FIB index */
 824       if (vrf_id != ~0)
 825         fib_index =
 826           fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 827                                              FIB_SOURCE_PLUGIN_LOW);
 828       /* If not specified use inside VRF id from SNAT plugin startup config */
 829       else
 830         {
 831           fib_index = sm->inside_fib_index;
 832           vrf_id = sm->inside_vrf_id;
 833           fib_table_lock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
 834         }
 835
 836       if (!(out2in_only || identity_nat))
 837         {
 838           m_key.addr = l_addr;
 839           m_key.port = addr_only ? 0 : l_port;
 840           m_key.protocol = addr_only ? 0 : proto;
 841           m_key.fib_index = fib_index;
 842           kv.key = m_key.as_u64;
 843           if (!clib_bihash_search_8_8
 844               (&sm->static_mapping_by_local, &kv, &value))
 845             return VNET_API_ERROR_VALUE_EXIST;
 846         }
 847
 848       /* Find external address in allocated addresses and reserve port for
 849          address and port pair mapping when dynamic translations enabled */
 850       if (!(addr_only || sm->static_mapping_only || out2in_only))
 851         {
 852           for (i = 0; i < vec_len (sm->addresses); i++)
 853             {
 854               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 855                 {
 856                   a = sm->addresses + i;
 857                   /* External port must be unused */
 858                   switch (proto)
 859                     {
 860 #define _(N, j, n, s) \
 861                     case SNAT_PROTOCOL_##N: \
 862                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 863                         return VNET_API_ERROR_INVALID_VALUE; \
 864                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 865                       if (e_port > 1024) \
 866                         { \
 867                           a->busy_##n##_ports++; \
 868                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
 869                         } \
 870                       break;
 871                       foreach_snat_protocol
 872 #undef _
 873                     default:
 874                       nat_log_info ("unknown protocol");
 875                       return VNET_API_ERROR_INVALID_VALUE_2;
 876                     }
 877                   break;
 878                 }
 879             }
 880           /* External address must be allocated */
 881           if (!a && (l_addr.as_u32 != e_addr.as_u32))
 882             {
 883               if (sw_if_index != ~0)
 884                 {
 885                   for (i = 0; i < vec_len (sm->to_resolve); i++)
 886                     {
 887                       rp = sm->to_resolve + i;
 888                       if (rp->addr_only)
 889                         continue;
 890                       if (rp->sw_if_index != sw_if_index &&
 891                           rp->l_addr.as_u32 != l_addr.as_u32 &&
 892                           rp->vrf_id != vrf_id && rp->l_port != l_port &&
 893                           rp->e_port != e_port && rp->proto != proto)
 894                         continue;
 895
 896                       vec_del1 (sm->to_resolve, i);
 897                       break;
 898                     }
 899                 }
 900               return VNET_API_ERROR_NO_SUCH_ENTRY;
 901             }
 902         }
 903
 904       pool_get (sm->static_mappings, m);
 905       clib_memset (m, 0, sizeof (*m));
 906       m->tag = vec_dup (tag);
 907       m->local_addr = l_addr;
 908       m->external_addr = e_addr;
 909       m->twice_nat = twice_nat;
 910       if (out2in_only)
 911         m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY;
 912       if (addr_only)
 913         m->flags |= NAT_STATIC_MAPPING_FLAG_ADDR_ONLY;
 914       if (identity_nat)
 915         {
 916           m->flags |= NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT;
 917           pool_get (m->locals, local);
 918           local->vrf_id = vrf_id;
 919           local->fib_index = fib_index;
 920         }
 921       else
 922         {
 923           m->vrf_id = vrf_id;
 924           m->fib_index = fib_index;
 925         }
 926       if (!addr_only)
 927         {
 928           m->local_port = l_port;
 929           m->external_port = e_port;
 930           m->proto = proto;
 931         }
 932
 933       if (sm->num_workers > 1)
 934         {
 935           ip4_header_t ip = {
 936             .src_address = m->local_addr,
 937           };
 938           vec_add1 (m->workers, sm->worker_in2out_cb (&ip, m->fib_index));
 939           tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
 940         }
 941       else
 942         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 943
 944       m_key.addr = m->local_addr;
 945       m_key.port = m->local_port;
 946       m_key.protocol = m->proto;
 947       m_key.fib_index = fib_index;
 948       kv.key = m_key.as_u64;
 949       kv.value = m - sm->static_mappings;
 950       if (!out2in_only)
 951         clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
 952
 953       m_key.addr = m->external_addr;
 954       m_key.port = m->external_port;
 955       m_key.fib_index = 0;
 956       kv.key = m_key.as_u64;
 957       kv.value = m - sm->static_mappings;
 958       clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 1);
 959
 960       /* Delete dynamic sessions matching local address (+ local port) */
 961       if (!(sm->static_mapping_only))
 962         {
 963           u_key.addr = m->local_addr;
 964           u_key.fib_index = m->fib_index;
 965           kv.key = u_key.as_u64;
 966           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 967             {
 968               user_index = value.value;
 969               u = pool_elt_at_index (tsm->users, user_index);
 970               if (u->nsessions)
 971                 {
 972                   head_index = u->sessions_per_user_list_head_index;
 973                   head = pool_elt_at_index (tsm->list_pool, head_index);
 974                   elt_index = head->next;
 975                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 976                   ses_index = elt->value;
 977                   while (ses_index != ~0)
 978                     {
 979                       s = pool_elt_at_index (tsm->sessions, ses_index);
 980                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
 981                       ses_index = elt->value;
 982
 983                       if (snat_is_session_static (s))
 984                         continue;
 985
 986                       if (!addr_only
 987                           && (clib_net_to_host_u16 (s->in2out.port) !=
 988                               m->local_port))
 989                         continue;
 990
 991                       nat_free_session_data (sm, s,
 992                                              tsm - sm->per_thread_data, 0);
 993                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
 994
 995                       if (!addr_only && !sm->endpoint_dependent)
 996                         break;
 997                     }
 998                 }
 999             }
1000         }
1001     }
1002   else
1003     {
1004       if (!m)
1005         {
1006           if (sw_if_index != ~0)
1007             return 0;
1008           else
1009             return VNET_API_ERROR_NO_SUCH_ENTRY;
1010         }
1011
1012       if (identity_nat)
1013         {
1014           if (vrf_id == ~0)
1015             vrf_id = sm->inside_vrf_id;
1016
1017           /* *INDENT-OFF* */
1018           pool_foreach (local, m->locals,
1019           ({
1020             if (local->vrf_id == vrf_id)
1021               find = local - m->locals;
1022           }));
1023           /* *INDENT-ON* */
1024           if (find == ~0)
1025             return VNET_API_ERROR_NO_SUCH_ENTRY;
1026
1027           local = pool_elt_at_index (m->locals, find);
1028           fib_index = local->fib_index;
1029           pool_put (m->locals, local);
1030         }
1031       else
1032         fib_index = m->fib_index;
1033
1034       /* Free external address port */
1035       if (!(addr_only || sm->static_mapping_only || out2in_only))
1036         {
1037           for (i = 0; i < vec_len (sm->addresses); i++)
1038             {
1039               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1040                 {
1041                   a = sm->addresses + i;
1042                   switch (proto)
1043                     {
1044 #define _(N, j, n, s) \
1045                     case SNAT_PROTOCOL_##N: \
1046                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1047                       if (e_port > 1024) \
1048                         { \
1049                           a->busy_##n##_ports--; \
1050                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
1051                         } \
1052                       break;
1053                       foreach_snat_protocol
1054 #undef _
1055                     default:
1056                       nat_log_info ("unknown protocol");
1057                       return VNET_API_ERROR_INVALID_VALUE_2;
1058                     }
1059                   break;
1060                 }
1061             }
1062         }
1063
1064       if (sm->num_workers > 1)
1065         tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
1066       else
1067         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1068
1069       m_key.addr = m->local_addr;
1070       m_key.port = m->local_port;
1071       m_key.protocol = m->proto;
1072       m_key.fib_index = fib_index;
1073       kv.key = m_key.as_u64;
1074       if (!out2in_only)
1075         clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0);
1076
1077       /* Delete session(s) for static mapping if exist */
1078       if (!(sm->static_mapping_only) ||
1079           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
1080         {
1081           u_key.addr = m->local_addr;
1082           u_key.fib_index = fib_index;
1083           kv.key = u_key.as_u64;
1084           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1085             {
1086               user_index = value.value;
1087               u = pool_elt_at_index (tsm->users, user_index);
1088               if (u->nstaticsessions)
1089                 {
1090                   head_index = u->sessions_per_user_list_head_index;
1091                   head = pool_elt_at_index (tsm->list_pool, head_index);
1092                   elt_index = head->next;
1093                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1094                   ses_index = elt->value;
1095                   while (ses_index != ~0)
1096                     {
1097                       s = pool_elt_at_index (tsm->sessions, ses_index);
1098                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1099                       ses_index = elt->value;
1100
1101                       if (!addr_only)
1102                         {
1103                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) ||
1104                               (clib_net_to_host_u16 (s->out2in.port) !=
1105                                e_port))
1106                             continue;
1107                         }
1108
1109                       if (is_lb_session (s))
1110                         continue;
1111
1112                       if (!snat_is_session_static (s))
1113                         continue;
1114
1115                       nat_free_session_data (sm, s,
1116                                              tsm - sm->per_thread_data, 0);
1117                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1118
1119                       if (!addr_only && !sm->endpoint_dependent)
1120                         break;
1121                     }
1122                 }
1123             }
1124         }
1125
1126       fib_table_unlock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1127       if (pool_elts (m->locals))
1128         return 0;
1129
1130       m_key.addr = m->external_addr;
1131       m_key.port = m->external_port;
1132       m_key.fib_index = 0;
1133       kv.key = m_key.as_u64;
1134       clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0);
1135
1136       vec_free (m->tag);
1137       vec_free (m->workers);
1138       /* Delete static mapping from pool */
1139       pool_put (sm->static_mappings, m);
1140     }
1141
1142   if (!addr_only || (l_addr.as_u32 == e_addr.as_u32))
1143     return 0;
1144
1145   /* Add/delete external address to FIB */
1146   /* *INDENT-OFF* */
1147   pool_foreach (interface, sm->interfaces,
1148   ({
1149     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1150       continue;
1151
1152     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1153     break;
1154   }));
1155   pool_foreach (interface, sm->output_feature_interfaces,
1156   ({
1157     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1158       continue;
1159
1160     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1161     break;
1162   }));
1163   /* *INDENT-ON* */
1164
1165   return 0;
1166 }
1167
1168 int
1169 nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
1170                                  snat_protocol_t proto,
1171                                  nat44_lb_addr_port_t * locals, u8 is_add,
1172                                  twice_nat_type_t twice_nat, u8 out2in_only,
1173                                  u8 * tag, u32 affinity)
1174 {
1175   snat_main_t *sm = &snat_main;
1176   snat_static_mapping_t *m;
1177   snat_session_key_t m_key;
1178   clib_bihash_kv_8_8_t kv, value;
1179   snat_address_t *a = 0;
1180   int i;
1181   nat44_lb_addr_port_t *local;
1182   u32 elt_index, head_index, ses_index;
1183   snat_main_per_thread_data_t *tsm;
1184   snat_user_key_t u_key;
1185   snat_user_t *u;
1186   snat_session_t *s;
1187   dlist_elt_t *head, *elt;
1188   uword *bitmap = 0;
1189
1190   if (!sm->endpoint_dependent)
1191     return VNET_API_ERROR_FEATURE_DISABLED;
1192
1193   m_key.addr = e_addr;
1194   m_key.port = e_port;
1195   m_key.protocol = proto;
1196   m_key.fib_index = 0;
1197   kv.key = m_key.as_u64;
1198   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1199     m = 0;
1200   else
1201     m = pool_elt_at_index (sm->static_mappings, value.value);
1202
1203   if (is_add)
1204     {
1205       if (m)
1206         return VNET_API_ERROR_VALUE_EXIST;
1207
1208       if (vec_len (locals) < 2)
1209         return VNET_API_ERROR_INVALID_VALUE;
1210
1211       /* Find external address in allocated addresses and reserve port for
1212          address and port pair mapping when dynamic translations enabled */
1213       if (!(sm->static_mapping_only || out2in_only))
1214         {
1215           for (i = 0; i < vec_len (sm->addresses); i++)
1216             {
1217               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1218                 {
1219                   a = sm->addresses + i;
1220                   /* External port must be unused */
1221                   switch (proto)
1222                     {
1223 #define _(N, j, n, s) \
1224                     case SNAT_PROTOCOL_##N: \
1225                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1226                         return VNET_API_ERROR_INVALID_VALUE; \
1227                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1228                       if (e_port > 1024) \
1229                         { \
1230                           a->busy_##n##_ports++; \
1231                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
1232                         } \
1233                       break;
1234                       foreach_snat_protocol
1235 #undef _
1236                     default:
1237                       nat_log_info ("unknown protocol");
1238                       return VNET_API_ERROR_INVALID_VALUE_2;
1239                     }
1240                   break;
1241                 }
1242             }
1243           /* External address must be allocated */
1244           if (!a)
1245             return VNET_API_ERROR_NO_SUCH_ENTRY;
1246         }
1247
1248       pool_get (sm->static_mappings, m);
1249       clib_memset (m, 0, sizeof (*m));
1250       m->tag = vec_dup (tag);
1251       m->external_addr = e_addr;
1252       m->external_port = e_port;
1253       m->proto = proto;
1254       m->twice_nat = twice_nat;
1255       m->flags |= NAT_STATIC_MAPPING_FLAG_LB;
1256       if (out2in_only)
1257         m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY;
1258       m->affinity = affinity;
1259
1260       if (affinity)
1261         m->affinity_per_service_list_head_index =
1262           nat_affinity_get_per_service_list_head_index ();
1263       else
1264         m->affinity_per_service_list_head_index = ~0;
1265
1266       m_key.addr = m->external_addr;
1267       m_key.port = m->external_port;
1268       m_key.protocol = m->proto;
1269       m_key.fib_index = 0;
1270       kv.key = m_key.as_u64;
1271       kv.value = m - sm->static_mappings;
1272       if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 1))
1273         {
1274           nat_log_err ("static_mapping_by_external key add failed");
1275           return VNET_API_ERROR_UNSPECIFIED;
1276         }
1277
1278       m_key.fib_index = m->fib_index;
1279       for (i = 0; i < vec_len (locals); i++)
1280         {
1281           locals[i].fib_index =
1282             fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1283                                                locals[i].vrf_id,
1284                                                FIB_SOURCE_PLUGIN_LOW);
1285           m_key.addr = locals[i].addr;
1286           m_key.fib_index = locals[i].fib_index;
1287           if (!out2in_only)
1288             {
1289               m_key.port = locals[i].port;
1290               kv.key = m_key.as_u64;
1291               kv.value = m - sm->static_mappings;
1292               clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
1293             }
1294           locals[i].prefix = (i == 0) ? locals[i].probability :
1295             (locals[i - 1].prefix + locals[i].probability);
1296           pool_get (m->locals, local);
1297           *local = locals[i];
1298           if (sm->num_workers > 1)
1299             {
1300               ip4_header_t ip = {
1301                 .src_address = locals[i].addr,
1302               };
1303               bitmap =
1304                 clib_bitmap_set (bitmap,
1305                                  sm->worker_in2out_cb (&ip, m->fib_index), 1);
1306             }
1307         }
1308
1309       /* Assign workers */
1310       if (sm->num_workers > 1)
1311         {
1312           /* *INDENT-OFF* */
1313           clib_bitmap_foreach (i, bitmap,
1314             ({
1315                vec_add1(m->workers, i);
1316             }));
1317           /* *INDENT-ON* */
1318         }
1319     }
1320   else
1321     {
1322       if (!m)
1323         return VNET_API_ERROR_NO_SUCH_ENTRY;
1324
1325       if (!is_lb_static_mapping (m))
1326         return VNET_API_ERROR_INVALID_VALUE;
1327
1328       /* Free external address port */
1329       if (!(sm->static_mapping_only || out2in_only))
1330         {
1331           for (i = 0; i < vec_len (sm->addresses); i++)
1332             {
1333               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1334                 {
1335                   a = sm->addresses + i;
1336                   switch (proto)
1337                     {
1338 #define _(N, j, n, s) \
1339                     case SNAT_PROTOCOL_##N: \
1340                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1341                       if (e_port > 1024) \
1342                         { \
1343                           a->busy_##n##_ports--; \
1344                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
1345                         } \
1346                       break;
1347                       foreach_snat_protocol
1348 #undef _
1349                     default:
1350                       nat_log_info ("unknown protocol");
1351                       return VNET_API_ERROR_INVALID_VALUE_2;
1352                     }
1353                   break;
1354                 }
1355             }
1356         }
1357
1358       m_key.addr = m->external_addr;
1359       m_key.port = m->external_port;
1360       m_key.protocol = m->proto;
1361       m_key.fib_index = 0;
1362       kv.key = m_key.as_u64;
1363       if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0))
1364         {
1365           nat_log_err ("static_mapping_by_external key del failed");
1366           return VNET_API_ERROR_UNSPECIFIED;
1367         }
1368
1369       /* *INDENT-OFF* */
1370       pool_foreach (local, m->locals,
1371       ({
1372           fib_table_unlock (local->fib_index, FIB_PROTOCOL_IP4,
1373                             FIB_SOURCE_PLUGIN_LOW);
1374           m_key.addr = local->addr;
1375           if (!out2in_only)
1376             {
1377               m_key.port = local->port;
1378               m_key.fib_index = local->fib_index;
1379               kv.key = m_key.as_u64;
1380               if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1381                 {
1382                   nat_log_err ("static_mapping_by_local key del failed");
1383                   return VNET_API_ERROR_UNSPECIFIED;
1384                 }
1385             }
1386
1387           if (sm->num_workers > 1)
1388             {
1389               ip4_header_t ip = {
1390                 .src_address = local->addr,
1391               };
1392               tsm = vec_elt_at_index (sm->per_thread_data,
1393                                       sm->worker_in2out_cb (&ip, m->fib_index));
1394             }
1395           else
1396             tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1397
1398           /* Delete sessions */
1399           u_key.addr = local->addr;
1400           u_key.fib_index = local->fib_index;
1401           kv.key = u_key.as_u64;
1402           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1403             {
1404               u = pool_elt_at_index (tsm->users, value.value);
1405               if (u->nstaticsessions)
1406                 {
1407                   head_index = u->sessions_per_user_list_head_index;
1408                   head = pool_elt_at_index (tsm->list_pool, head_index);
1409                   elt_index = head->next;
1410                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1411                   ses_index = elt->value;
1412                   while (ses_index != ~0)
1413                     {
1414                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1415                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1416                       ses_index = elt->value;
1417
1418                       if (!(is_lb_session (s)))
1419                         continue;
1420
1421                       if ((s->in2out.addr.as_u32 != local->addr.as_u32) ||
1422                           (clib_net_to_host_u16 (s->in2out.port) != local->port))
1423                         continue;
1424
1425                       nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
1426                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1427                     }
1428                 }
1429             }
1430       }));
1431       /* *INDENT-ON* */
1432       if (m->affinity)
1433         nat_affinity_flush_service (m->affinity_per_service_list_head_index);
1434       pool_free (m->locals);
1435       vec_free (m->tag);
1436       vec_free (m->workers);
1437
1438       pool_put (sm->static_mappings, m);
1439     }
1440
1441   return 0;
1442 }
1443
1444 int
1445 nat44_lb_static_mapping_add_del_local (ip4_address_t e_addr, u16 e_port,
1446                                        ip4_address_t l_addr, u16 l_port,
1447                                        snat_protocol_t proto, u32 vrf_id,
1448                                        u8 probability, u8 is_add)
1449 {
1450   snat_main_t *sm = &snat_main;
1451   snat_static_mapping_t *m = 0;
1452   snat_session_key_t m_key;
1453   clib_bihash_kv_8_8_t kv, value;
1454   nat44_lb_addr_port_t *local, *prev_local, *match_local = 0;
1455   snat_main_per_thread_data_t *tsm;
1456   snat_user_key_t u_key;
1457   snat_user_t *u;
1458   snat_session_t *s;
1459   dlist_elt_t *head, *elt;
1460   u32 elt_index, head_index, ses_index, *locals = 0;
1461   uword *bitmap = 0;
1462   int i;
1463
1464   if (!sm->endpoint_dependent)
1465     return VNET_API_ERROR_FEATURE_DISABLED;
1466
1467   m_key.addr = e_addr;
1468   m_key.port = e_port;
1469   m_key.protocol = proto;
1470   m_key.fib_index = 0;
1471   kv.key = m_key.as_u64;
1472   if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1473     m = pool_elt_at_index (sm->static_mappings, value.value);
1474
1475   if (!m)
1476     return VNET_API_ERROR_NO_SUCH_ENTRY;
1477
1478   if (!is_lb_static_mapping (m))
1479     return VNET_API_ERROR_INVALID_VALUE;
1480
1481   /* *INDENT-OFF* */
1482   pool_foreach (local, m->locals,
1483   ({
1484     if ((local->addr.as_u32 == l_addr.as_u32) && (local->port == l_port) &&
1485         (local->vrf_id == vrf_id))
1486       {
1487         match_local = local;
1488         break;
1489       }
1490   }));
1491   /* *INDENT-ON* */
1492
1493   if (is_add)
1494     {
1495       if (match_local)
1496         return VNET_API_ERROR_VALUE_EXIST;
1497
1498       pool_get (m->locals, local);
1499       clib_memset (local, 0, sizeof (*local));
1500       local->addr.as_u32 = l_addr.as_u32;
1501       local->port = l_port;
1502       local->probability = probability;
1503       local->vrf_id = vrf_id;
1504       local->fib_index =
1505         fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
1506                                            FIB_SOURCE_PLUGIN_LOW);
1507
1508       if (!is_out2in_only_static_mapping (m))
1509         {
1510           m_key.addr = l_addr;
1511           m_key.port = l_port;
1512           m_key.fib_index = local->fib_index;
1513           kv.key = m_key.as_u64;
1514           kv.value = m - sm->static_mappings;
1515           if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1))
1516             nat_log_err ("static_mapping_by_local key add failed");
1517         }
1518     }
1519   else
1520     {
1521       if (!match_local)
1522         return VNET_API_ERROR_NO_SUCH_ENTRY;
1523
1524       if (pool_elts (m->locals) < 3)
1525         return VNET_API_ERROR_UNSPECIFIED;
1526
1527       fib_table_unlock (match_local->fib_index, FIB_PROTOCOL_IP4,
1528                         FIB_SOURCE_PLUGIN_LOW);
1529
1530       if (!is_out2in_only_static_mapping (m))
1531         {
1532           m_key.addr = l_addr;
1533           m_key.port = l_port;
1534           m_key.fib_index = match_local->fib_index;
1535           kv.key = m_key.as_u64;
1536           if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0))
1537             nat_log_err ("static_mapping_by_local key del failed");
1538         }
1539
1540       if (sm->num_workers > 1)
1541         {
1542           ip4_header_t ip = {
1543             .src_address = local->addr,
1544           };
1545           tsm = vec_elt_at_index (sm->per_thread_data,
1546                                   sm->worker_in2out_cb (&ip, m->fib_index));
1547         }
1548       else
1549         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1550
1551       /* Delete sessions */
1552       u_key.addr = match_local->addr;
1553       u_key.fib_index = match_local->fib_index;
1554       kv.key = u_key.as_u64;
1555       if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1556         {
1557           u = pool_elt_at_index (tsm->users, value.value);
1558           if (u->nstaticsessions)
1559             {
1560               head_index = u->sessions_per_user_list_head_index;
1561               head = pool_elt_at_index (tsm->list_pool, head_index);
1562               elt_index = head->next;
1563               elt = pool_elt_at_index (tsm->list_pool, elt_index);
1564               ses_index = elt->value;
1565               while (ses_index != ~0)
1566                 {
1567                   s = pool_elt_at_index (tsm->sessions, ses_index);
1568                   elt = pool_elt_at_index (tsm->list_pool, elt->next);
1569                   ses_index = elt->value;
1570
1571                   if (!(is_lb_session (s)))
1572                     continue;
1573
1574                   if ((s->in2out.addr.as_u32 != match_local->addr.as_u32) ||
1575                       (clib_net_to_host_u16 (s->in2out.port) !=
1576                        match_local->port))
1577                     continue;
1578
1579                   nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
1580                   nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1581                 }
1582             }
1583         }
1584
1585       pool_put (m->locals, match_local);
1586     }
1587
1588   vec_free (m->workers);
1589
1590   /* *INDENT-OFF* */
1591   pool_foreach (local, m->locals,
1592   ({
1593     vec_add1 (locals, local - m->locals);
1594     if (sm->num_workers > 1)
1595       {
1596         ip4_header_t ip;
1597         ip.src_address.as_u32 = local->addr.as_u32,
1598         bitmap = clib_bitmap_set (bitmap,
1599                                   sm->worker_in2out_cb (&ip, local->fib_index),
1600                                   1);
1601       }
1602   }));
1603   /* *INDENT-ON* */
1604
1605   ASSERT (vec_len (locals) > 1);
1606
1607   local = pool_elt_at_index (m->locals, locals[0]);
1608   local->prefix = local->probability;
1609   for (i = 1; i < vec_len (locals); i++)
1610     {
1611       local = pool_elt_at_index (m->locals, locals[i]);
1612       prev_local = pool_elt_at_index (m->locals, locals[i - 1]);
1613       local->prefix = local->probability + prev_local->prefix;
1614     }
1615
1616   /* Assign workers */
1617   if (sm->num_workers > 1)
1618     {
1619       /* *INDENT-OFF* */
1620       clib_bitmap_foreach (i, bitmap, ({ vec_add1(m->workers, i); }));
1621       /* *INDENT-ON* */
1622     }
1623
1624   return 0;
1625 }
1626
1627 int
1628 snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
1629                   u8 twice_nat)
1630 {
1631   snat_address_t *a = 0;
1632   snat_session_t *ses;
1633   u32 *ses_to_be_removed = 0, *ses_index;
1634   snat_main_per_thread_data_t *tsm;
1635   snat_static_mapping_t *m;
1636   snat_interface_t *interface;
1637   int i;
1638   snat_address_t *addresses =
1639     twice_nat ? sm->twice_nat_addresses : sm->addresses;
1640
1641   /* Find SNAT address */
1642   for (i = 0; i < vec_len (addresses); i++)
1643     {
1644       if (addresses[i].addr.as_u32 == addr.as_u32)
1645         {
1646           a = addresses + i;
1647           break;
1648         }
1649     }
1650   if (!a)
1651     return VNET_API_ERROR_NO_SUCH_ENTRY;
1652
1653   if (delete_sm)
1654     {
1655       /* *INDENT-OFF* */
1656       pool_foreach (m, sm->static_mappings,
1657       ({
1658           if (m->external_addr.as_u32 == addr.as_u32)
1659             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1660                                             m->local_port, m->external_port,
1661                                             m->vrf_id, is_addr_only_static_mapping(m), ~0,
1662                                             m->proto, 0, m->twice_nat,
1663                                             is_out2in_only_static_mapping(m), m->tag, is_identity_static_mapping(m));
1664       }));
1665       /* *INDENT-ON* */
1666     }
1667   else
1668     {
1669       /* Check if address is used in some static mapping */
1670       if (is_snat_address_used_in_static_mapping (sm, addr))
1671         {
1672           nat_log_notice ("address used in static mapping");
1673           return VNET_API_ERROR_UNSPECIFIED;
1674         }
1675     }
1676
1677   if (a->fib_index != ~0)
1678     fib_table_unlock (a->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1679
1680   /* Delete sessions using address */
1681   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1682     {
1683       /* *INDENT-OFF* */
1684       vec_foreach (tsm, sm->per_thread_data)
1685         {
1686           pool_foreach (ses, tsm->sessions, ({
1687             if (ses->out2in.addr.as_u32 == addr.as_u32)
1688               {
1689                 nat_free_session_data (sm, ses, tsm - sm->per_thread_data, 0);
1690                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1691               }
1692           }));
1693
1694           vec_foreach (ses_index, ses_to_be_removed)
1695             {
1696               ses = pool_elt_at_index (tsm->sessions, ses_index[0]);
1697               nat44_delete_session (sm, ses, tsm - sm->per_thread_data);
1698             }
1699
1700           vec_free (ses_to_be_removed);
1701         }
1702       /* *INDENT-ON* */
1703     }
1704
1705 #define _(N, i, n, s) \
1706   clib_bitmap_free (a->busy_##n##_port_bitmap); \
1707   vec_free (a->busy_##n##_ports_per_thread);
1708   foreach_snat_protocol
1709 #undef _
1710     if (twice_nat)
1711     {
1712       vec_del1 (sm->twice_nat_addresses, i);
1713       return 0;
1714     }
1715   else
1716     vec_del1 (sm->addresses, i);
1717
1718   /* Delete external address from FIB */
1719   /* *INDENT-OFF* */
1720   pool_foreach (interface, sm->interfaces,
1721   ({
1722     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1723       continue;
1724
1725     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1726     break;
1727   }));
1728   pool_foreach (interface, sm->output_feature_interfaces,
1729   ({
1730     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1731       continue;
1732
1733     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1734     break;
1735   }));
1736   /* *INDENT-ON* */
1737
1738   return 0;
1739 }
1740
1741 int
1742 snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
1743 {
1744   snat_main_t *sm = &snat_main;
1745   snat_interface_t *i;
1746   const char *feature_name, *del_feature_name;
1747   snat_address_t *ap;
1748   snat_static_mapping_t *m;
1749   snat_det_map_t *dm;
1750   nat_outside_fib_t *outside_fib;
1751   u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
1752                                                        sw_if_index);
1753
1754   if (sm->out2in_dpo && !is_inside)
1755     return VNET_API_ERROR_UNSUPPORTED;
1756
1757   /* *INDENT-OFF* */
1758   pool_foreach (i, sm->output_feature_interfaces,
1759   ({
1760     if (i->sw_if_index == sw_if_index)
1761       return VNET_API_ERROR_VALUE_EXIST;
1762   }));
1763   /* *INDENT-ON* */
1764
1765   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1766     feature_name = is_inside ? "nat44-in2out-fast" : "nat44-out2in-fast";
1767   else
1768     {
1769       if (sm->num_workers > 1 && !sm->deterministic)
1770         feature_name =
1771           is_inside ? "nat44-in2out-worker-handoff" :
1772           "nat44-out2in-worker-handoff";
1773       else if (sm->deterministic)
1774         feature_name = is_inside ? "nat44-det-in2out" : "nat44-det-out2in";
1775       else if (sm->endpoint_dependent)
1776         feature_name = is_inside ? "nat44-ed-in2out" : "nat44-ed-out2in";
1777       else
1778         feature_name = is_inside ? "nat44-in2out" : "nat44-out2in";
1779     }
1780
1781   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1782     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index,
1783                                                       NAT_FQ_NELTS);
1784
1785   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1786     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index,
1787                                                       NAT_FQ_NELTS);
1788
1789   if (!is_inside)
1790     {
1791       /* *INDENT-OFF* */
1792       vec_foreach (outside_fib, sm->outside_fibs)
1793         {
1794           if (outside_fib->fib_index == fib_index)
1795             {
1796               if (is_del)
1797                 {
1798                   outside_fib->refcount--;
1799                   if (!outside_fib->refcount)
1800                     vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
1801                 }
1802               else
1803                 outside_fib->refcount++;
1804               goto feature_set;
1805             }
1806         }
1807       /* *INDENT-ON* */
1808       if (!is_del)
1809         {
1810           vec_add2 (sm->outside_fibs, outside_fib, 1);
1811           outside_fib->refcount = 1;
1812           outside_fib->fib_index = fib_index;
1813         }
1814     }
1815 feature_set:
1816   /* *INDENT-OFF* */
1817   pool_foreach (i, sm->interfaces,
1818   ({
1819     if (i->sw_if_index == sw_if_index)
1820       {
1821         if (is_del)
1822           {
1823             if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1824               {
1825                 if (is_inside)
1826                   i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1827                 else
1828                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1829
1830                 if (sm->num_workers > 1 && !sm->deterministic)
1831                   {
1832                     del_feature_name = "nat44-handoff-classify";
1833                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1834                                                  "nat44-out2in-worker-handoff";
1835                   }
1836                 else if (sm->deterministic)
1837                   {
1838                     del_feature_name = "nat44-det-classify";
1839                     feature_name = !is_inside ?  "nat44-det-in2out" :
1840                                                  "nat44-det-out2in";
1841                   }
1842                 else if (sm->endpoint_dependent)
1843                   {
1844                     del_feature_name = "nat44-ed-classify";
1845                     feature_name = !is_inside ?  "nat44-ed-in2out" :
1846                                                  "nat44-ed-out2in";
1847                   }
1848                 else
1849                   {
1850                     del_feature_name = "nat44-classify";
1851                     feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1852                   }
1853
1854                 vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1855                                              sw_if_index, 0, 0, 0);
1856                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1857                                              sw_if_index, 1, 0, 0);
1858                 if (!is_inside)
1859                   {
1860                     if (sm->endpoint_dependent)
1861                       vnet_feature_enable_disable ("ip4-local",
1862                                                    "nat44-ed-hairpinning",
1863                                                    sw_if_index, 1, 0, 0);
1864                     else if (!sm->deterministic)
1865                       vnet_feature_enable_disable ("ip4-local",
1866                                                    "nat44-hairpinning",
1867                                                    sw_if_index, 1, 0, 0);
1868                   }
1869               }
1870             else
1871               {
1872                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1873                                              sw_if_index, 0, 0, 0);
1874                 pool_put (sm->interfaces, i);
1875                 if (is_inside)
1876                   {
1877                     if (sm->endpoint_dependent)
1878                       vnet_feature_enable_disable ("ip4-local",
1879                                                    "nat44-ed-hairpinning",
1880                                                    sw_if_index, 0, 0, 0);
1881                     else if (!sm->deterministic)
1882                       vnet_feature_enable_disable ("ip4-local",
1883                                                    "nat44-hairpinning",
1884                                                    sw_if_index, 0, 0, 0);
1885                   }
1886               }
1887           }
1888         else
1889           {
1890             if ((nat_interface_is_inside(i) && is_inside) ||
1891                 (nat_interface_is_outside(i) && !is_inside))
1892               return 0;
1893
1894             if (sm->num_workers > 1 && !sm->deterministic)
1895               {
1896                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1897                                                  "nat44-out2in-worker-handoff";
1898                 feature_name = "nat44-handoff-classify";
1899               }
1900             else if (sm->deterministic)
1901               {
1902                 del_feature_name = !is_inside ?  "nat44-det-in2out" :
1903                                                  "nat44-det-out2in";
1904                 feature_name = "nat44-det-classify";
1905               }
1906             else if (sm->endpoint_dependent)
1907               {
1908                 del_feature_name = !is_inside ?  "nat44-ed-in2out" :
1909                                                  "nat44-ed-out2in";
1910                 feature_name = "nat44-ed-classify";
1911               }
1912             else
1913               {
1914                 del_feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1915                 feature_name = "nat44-classify";
1916               }
1917
1918             vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1919                                          sw_if_index, 0, 0, 0);
1920             vnet_feature_enable_disable ("ip4-unicast", feature_name,
1921                                          sw_if_index, 1, 0, 0);
1922             if (!is_inside)
1923               {
1924                 if (sm->endpoint_dependent)
1925                   vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
1926                                                sw_if_index, 0, 0, 0);
1927                 else if (!sm->deterministic)
1928                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1929                                                sw_if_index, 0, 0, 0);
1930               }
1931             goto set_flags;
1932           }
1933
1934         goto fib;
1935       }
1936   }));
1937   /* *INDENT-ON* */
1938
1939   if (is_del)
1940     return VNET_API_ERROR_NO_SUCH_ENTRY;
1941
1942   pool_get (sm->interfaces, i);
1943   i->sw_if_index = sw_if_index;
1944   i->flags = 0;
1945   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, 1, 0,
1946                                0);
1947
1948   if (is_inside && !sm->out2in_dpo)
1949     {
1950       if (sm->endpoint_dependent)
1951         vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
1952                                      sw_if_index, 1, 0, 0);
1953       else if (!sm->deterministic)
1954         vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1955                                      sw_if_index, 1, 0, 0);
1956     }
1957
1958 set_flags:
1959   if (is_inside)
1960     {
1961       i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1962       return 0;
1963     }
1964   else
1965     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1966
1967   /* Add/delete external addresses to FIB */
1968 fib:
1969   /* *INDENT-OFF* */
1970   vec_foreach (ap, sm->addresses)
1971     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1972
1973   pool_foreach (m, sm->static_mappings,
1974   ({
1975     if (!(is_addr_only_static_mapping(m)) || (m->local_addr.as_u32 == m->external_addr.as_u32))
1976       continue;
1977
1978     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1979   }));
1980
1981   pool_foreach (dm, sm->det_maps,
1982   ({
1983     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1984   }));
1985   /* *INDENT-ON* */
1986
1987   return 0;
1988 }
1989
1990 int
1991 snat_interface_add_del_output_feature (u32 sw_if_index,
1992                                        u8 is_inside, int is_del)
1993 {
1994   snat_main_t *sm = &snat_main;
1995   snat_interface_t *i;
1996   snat_address_t *ap;
1997   snat_static_mapping_t *m;
1998   nat_outside_fib_t *outside_fib;
1999   u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
2000                                                        sw_if_index);
2001
2002
2003   if (sm->deterministic ||
2004       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
2005     return VNET_API_ERROR_UNSUPPORTED;
2006
2007   /* *INDENT-OFF* */
2008   pool_foreach (i, sm->interfaces,
2009   ({
2010     if (i->sw_if_index == sw_if_index)
2011       return VNET_API_ERROR_VALUE_EXIST;
2012   }));
2013   /* *INDENT-ON* */
2014
2015   if (!is_inside)
2016     {
2017       /* *INDENT-OFF* */
2018       vec_foreach (outside_fib, sm->outside_fibs)
2019         {
2020           if (outside_fib->fib_index == fib_index)
2021             {
2022               if (is_del)
2023                 {
2024                   outside_fib->refcount--;
2025                   if (!outside_fib->refcount)
2026                     vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
2027                 }
2028               else
2029                 outside_fib->refcount++;
2030               goto feature_set;
2031             }
2032         }
2033       /* *INDENT-ON* */
2034       if (!is_del)
2035         {
2036           vec_add2 (sm->outside_fibs, outside_fib, 1);
2037           outside_fib->refcount = 1;
2038           outside_fib->fib_index = fib_index;
2039         }
2040     }
2041
2042 feature_set:
2043   if (is_inside)
2044     {
2045       if (sm->endpoint_dependent)
2046         {
2047           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-hairpin-dst",
2048                                        sw_if_index, !is_del, 0, 0);
2049           vnet_feature_enable_disable ("ip4-output", "nat44-ed-hairpin-src",
2050                                        sw_if_index, !is_del, 0, 0);
2051         }
2052       else
2053         {
2054           vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
2055                                        sw_if_index, !is_del, 0, 0);
2056           vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
2057                                        sw_if_index, !is_del, 0, 0);
2058         }
2059       goto fq;
2060     }
2061
2062   if (sm->num_workers > 1)
2063     {
2064       vnet_feature_enable_disable ("ip4-unicast",
2065                                    "nat44-out2in-worker-handoff",
2066                                    sw_if_index, !is_del, 0, 0);
2067       vnet_feature_enable_disable ("ip4-output",
2068                                    "nat44-in2out-output-worker-handoff",
2069                                    sw_if_index, !is_del, 0, 0);
2070     }
2071   else
2072     {
2073       if (sm->endpoint_dependent)
2074         {
2075           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-out2in",
2076                                        sw_if_index, !is_del, 0, 0);
2077           vnet_feature_enable_disable ("ip4-output", "nat44-ed-in2out-output",
2078                                        sw_if_index, !is_del, 0, 0);
2079         }
2080       else
2081         {
2082           vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in",
2083                                        sw_if_index, !is_del, 0, 0);
2084           vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
2085                                        sw_if_index, !is_del, 0, 0);
2086         }
2087     }
2088
2089 fq:
2090   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
2091     sm->fq_in2out_output_index =
2092       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
2093
2094   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
2095     sm->fq_out2in_index =
2096       vlib_frame_queue_main_init (sm->out2in_node_index, 0);
2097
2098   /* *INDENT-OFF* */
2099   pool_foreach (i, sm->output_feature_interfaces,
2100   ({
2101     if (i->sw_if_index == sw_if_index)
2102       {
2103         if (is_del)
2104           pool_put (sm->output_feature_interfaces, i);
2105         else
2106           return VNET_API_ERROR_VALUE_EXIST;
2107
2108         goto fib;
2109       }
2110   }));
2111   /* *INDENT-ON* */
2112
2113   if (is_del)
2114     return VNET_API_ERROR_NO_SUCH_ENTRY;
2115
2116   pool_get (sm->output_feature_interfaces, i);
2117   i->sw_if_index = sw_if_index;
2118   i->flags = 0;
2119   if (is_inside)
2120     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
2121   else
2122     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
2123
2124   /* Add/delete external addresses to FIB */
2125 fib:
2126   if (is_inside)
2127     return 0;
2128
2129   /* *INDENT-OFF* */
2130   vec_foreach (ap, sm->addresses)
2131     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
2132
2133   pool_foreach (m, sm->static_mappings,
2134   ({
2135     if (!((is_addr_only_static_mapping(m)))  || (m->local_addr.as_u32 == m->external_addr.as_u32))
2136       continue;
2137
2138     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
2139   }));
2140   /* *INDENT-ON* */
2141
2142   return 0;
2143 }
2144
2145 int
2146 snat_set_workers (uword * bitmap)
2147 {
2148   snat_main_t *sm = &snat_main;
2149   int i, j = 0;
2150
2151   if (sm->num_workers < 2)
2152     return VNET_API_ERROR_FEATURE_DISABLED;
2153
2154   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
2155     return VNET_API_ERROR_INVALID_WORKER;
2156
2157   vec_free (sm->workers);
2158   /* *INDENT-OFF* */
2159   clib_bitmap_foreach (i, bitmap,
2160     ({
2161       vec_add1(sm->workers, i);
2162       sm->per_thread_data[sm->first_worker_index + i].snat_thread_index = j;
2163       j++;
2164     }));
2165   /* *INDENT-ON* */
2166
2167   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
2168   sm->num_snat_thread = _vec_len (sm->workers);
2169
2170   return 0;
2171 }
2172
2173 static void
2174 snat_update_outside_fib (u32 sw_if_index, u32 new_fib_index,
2175                          u32 old_fib_index)
2176 {
2177   snat_main_t *sm = &snat_main;
2178   nat_outside_fib_t *outside_fib;
2179   snat_interface_t *i;
2180   u8 is_add = 1;
2181
2182   if (new_fib_index == old_fib_index)
2183     return;
2184
2185   if (!vec_len (sm->outside_fibs))
2186     return;
2187
2188   pool_foreach (i, sm->interfaces, (
2189                                      {
2190                                      if (i->sw_if_index == sw_if_index)
2191                                      {
2192                                      if (!(nat_interface_is_outside (i)))
2193                                      return;}
2194                                      }
2195                 ));
2196   vec_foreach (outside_fib, sm->outside_fibs)
2197   {
2198     if (outside_fib->fib_index == old_fib_index)
2199       {
2200         outside_fib->refcount--;
2201         if (!outside_fib->refcount)
2202           vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
2203         break;
2204       }
2205   }
2206
2207   vec_foreach (outside_fib, sm->outside_fibs)
2208   {
2209     if (outside_fib->fib_index == new_fib_index)
2210       {
2211         outside_fib->refcount++;
2212         is_add = 0;
2213         break;
2214       }
2215   }
2216
2217   if (is_add)
2218     {
2219       vec_add2 (sm->outside_fibs, outside_fib, 1);
2220       outside_fib->refcount = 1;
2221       outside_fib->fib_index = new_fib_index;
2222     }
2223 }
2224
2225 static void
2226 snat_ip4_table_bind (ip4_main_t * im,
2227                      uword opaque,
2228                      u32 sw_if_index, u32 new_fib_index, u32 old_fib_index)
2229 {
2230   snat_update_outside_fib (sw_if_index, new_fib_index, old_fib_index);
2231 }
2232
2233 static void
2234 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2235                                        uword opaque,
2236                                        u32 sw_if_index,
2237                                        ip4_address_t * address,
2238                                        u32 address_length,
2239                                        u32 if_address_index, u32 is_delete);
2240
2241 static void
2242 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
2243                                  uword opaque,
2244                                  u32 sw_if_index,
2245                                  ip4_address_t * address,
2246                                  u32 address_length,
2247                                  u32 if_address_index, u32 is_delete);
2248
2249 static int
2250 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2251                                  u32 fib_index,
2252                                  u32 thread_index,
2253                                  snat_session_key_t * k,
2254                                  u16 port_per_thread, u32 snat_thread_index);
2255
2256 static clib_error_t *
2257 snat_init (vlib_main_t * vm)
2258 {
2259   snat_main_t *sm = &snat_main;
2260   clib_error_t *error = 0;
2261   ip4_main_t *im = &ip4_main;
2262   ip_lookup_main_t *lm = &im->lookup_main;
2263   uword *p;
2264   vlib_thread_registration_t *tr;
2265   vlib_thread_main_t *tm = vlib_get_thread_main ();
2266   uword *bitmap = 0;
2267   u32 i;
2268   ip4_add_del_interface_address_callback_t cb4;
2269   vlib_node_t *node;
2270
2271   sm->vlib_main = vm;
2272   sm->vnet_main = vnet_get_main ();
2273   sm->ip4_main = im;
2274   sm->ip4_lookup_main = lm;
2275   sm->api_main = &api_main;
2276   sm->first_worker_index = 0;
2277   sm->num_workers = 0;
2278   sm->num_snat_thread = 1;
2279   sm->workers = 0;
2280   sm->port_per_thread = 0xffff - 1024;
2281   sm->fq_in2out_index = ~0;
2282   sm->fq_in2out_output_index = ~0;
2283   sm->fq_out2in_index = ~0;
2284   sm->udp_timeout = SNAT_UDP_TIMEOUT;
2285   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
2286   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
2287   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
2288   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
2289   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
2290   sm->forwarding_enabled = 0;
2291   sm->log_class = vlib_log_register_class ("nat", 0);
2292   sm->mss_clamping = 0;
2293
2294   node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
2295   sm->error_node_index = node->index;
2296
2297   node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out");
2298   sm->in2out_node_index = node->index;
2299   node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out-output");
2300   sm->in2out_output_node_index = node->index;
2301   node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out-fast");
2302   sm->in2out_fast_node_index = node->index;
2303   node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out-slowpath");
2304   sm->in2out_slowpath_node_index = node->index;
2305   node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out-output-slowpath");
2306   sm->in2out_slowpath_output_node_index = node->index;
2307   node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out-reass");
2308   sm->in2out_reass_node_index = node->index;
2309
2310   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-in2out");
2311   sm->ed_in2out_node_index = node->index;
2312   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-in2out-slowpath");
2313   sm->ed_in2out_slowpath_node_index = node->index;
2314   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-in2out-reass");
2315   sm->ed_in2out_reass_node_index = node->index;
2316
2317   node = vlib_get_node_by_name (vm, (u8 *) "nat44-out2in");
2318   sm->out2in_node_index = node->index;
2319   node = vlib_get_node_by_name (vm, (u8 *) "nat44-out2in-fast");
2320   sm->out2in_fast_node_index = node->index;
2321   node = vlib_get_node_by_name (vm, (u8 *) "nat44-out2in-reass");
2322   sm->out2in_reass_node_index = node->index;
2323
2324   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-out2in");
2325   sm->ed_out2in_node_index = node->index;
2326   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-out2in-slowpath");
2327   sm->ed_out2in_slowpath_node_index = node->index;
2328   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-out2in-reass");
2329   sm->ed_out2in_reass_node_index = node->index;
2330
2331   node = vlib_get_node_by_name (vm, (u8 *) "nat44-det-in2out");
2332   sm->det_in2out_node_index = node->index;
2333   node = vlib_get_node_by_name (vm, (u8 *) "nat44-det-out2in");
2334   sm->det_out2in_node_index = node->index;
2335
2336   node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpinning");
2337   sm->hairpinning_node_index = node->index;
2338   node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpin-dst");
2339   sm->hairpin_dst_node_index = node->index;
2340   node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpin-src");
2341   sm->hairpin_src_node_index = node->index;
2342   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-hairpinning");
2343   sm->ed_hairpinning_node_index = node->index;
2344   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-hairpin-dst");
2345   sm->ed_hairpin_dst_node_index = node->index;
2346   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-hairpin-src");
2347   sm->ed_hairpin_src_node_index = node->index;
2348
2349   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
2350   if (p)
2351     {
2352       tr = (vlib_thread_registration_t *) p[0];
2353       if (tr)
2354         {
2355           sm->num_workers = tr->count;
2356           sm->first_worker_index = tr->first_index;
2357         }
2358     }
2359
2360   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
2361
2362   /* Use all available workers by default */
2363   if (sm->num_workers > 1)
2364     {
2365       for (i = 0; i < sm->num_workers; i++)
2366         bitmap = clib_bitmap_set (bitmap, i, 1);
2367       snat_set_workers (bitmap);
2368       clib_bitmap_free (bitmap);
2369     }
2370   else
2371     {
2372       sm->per_thread_data[0].snat_thread_index = 0;
2373     }
2374
2375   error = snat_api_init (vm, sm);
2376   if (error)
2377     return error;
2378
2379   /* Set up the interface address add/del callback */
2380   cb4.function = snat_ip4_add_del_interface_address_cb;
2381   cb4.function_opaque = 0;
2382
2383   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2384
2385   cb4.function = nat_ip4_add_del_addr_only_sm_cb;
2386   cb4.function_opaque = 0;
2387
2388   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2389
2390   nat_dpo_module_init ();
2391
2392   /* Init counters */
2393   sm->total_users.name = "total-users";
2394   sm->total_users.stat_segment_name = "/nat44/total-users";
2395   vlib_validate_simple_counter (&sm->total_users, 0);
2396   vlib_zero_simple_counter (&sm->total_users, 0);
2397   sm->total_sessions.name = "total-sessions";
2398   sm->total_sessions.stat_segment_name = "/nat44/total-sessions";
2399   vlib_validate_simple_counter (&sm->total_sessions, 0);
2400   vlib_zero_simple_counter (&sm->total_sessions, 0);
2401
2402   /* Init IPFIX logging */
2403   snat_ipfix_logging_init (vm);
2404
2405   /* Init NAT64 */
2406   error = nat64_init (vm);
2407   if (error)
2408     return error;
2409
2410   dslite_init (vm);
2411
2412   nat66_init (vm);
2413
2414   ip4_table_bind_callback_t cbt4 = {
2415     .function = snat_ip4_table_bind,
2416   };
2417   vec_add1 (ip4_main.table_bind_callbacks, cbt4);
2418
2419   /* Init virtual fragmenentation reassembly */
2420   return nat_reass_init (vm);
2421 }
2422
2423 VLIB_INIT_FUNCTION (snat_init);
2424
2425 void
2426 snat_free_outside_address_and_port (snat_address_t * addresses,
2427                                     u32 thread_index, snat_session_key_t * k)
2428 {
2429   snat_address_t *a;
2430   u32 address_index;
2431   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
2432
2433   for (address_index = 0; address_index < vec_len (addresses);
2434        address_index++)
2435     {
2436       if (addresses[address_index].addr.as_u32 == k->addr.as_u32)
2437         break;
2438     }
2439
2440   ASSERT (address_index < vec_len (addresses));
2441
2442   a = addresses + address_index;
2443
2444   switch (k->protocol)
2445     {
2446 #define _(N, i, n, s) \
2447     case SNAT_PROTOCOL_##N: \
2448       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
2449         port_host_byte_order) == 1); \
2450       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
2451         port_host_byte_order, 0); \
2452       a->busy_##n##_ports--; \
2453       a->busy_##n##_ports_per_thread[thread_index]--; \
2454       break;
2455       foreach_snat_protocol
2456 #undef _
2457     default:
2458       nat_log_info ("unknown protocol");
2459       return;
2460     }
2461 }
2462
2463 static int
2464 nat_set_outside_address_and_port (snat_address_t * addresses,
2465                                   u32 thread_index, snat_session_key_t * k)
2466 {
2467   snat_address_t *a = 0;
2468   u32 address_index;
2469   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
2470
2471   for (address_index = 0; address_index < vec_len (addresses);
2472        address_index++)
2473     {
2474       if (addresses[address_index].addr.as_u32 != k->addr.as_u32)
2475         continue;
2476
2477       a = addresses + address_index;
2478       switch (k->protocol)
2479         {
2480 #define _(N, j, n, s) \
2481         case SNAT_PROTOCOL_##N: \
2482           if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, port_host_byte_order)) \
2483             return VNET_API_ERROR_INSTANCE_IN_USE; \
2484           clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, port_host_byte_order, 1); \
2485           a->busy_##n##_ports_per_thread[thread_index]++; \
2486           a->busy_##n##_ports++; \
2487           return 0;
2488           foreach_snat_protocol
2489 #undef _
2490         default:
2491           nat_log_info ("unknown protocol");
2492           return 1;
2493         }
2494     }
2495
2496   return VNET_API_ERROR_NO_SUCH_ENTRY;
2497 }
2498
2499 int
2500 snat_static_mapping_match (snat_main_t * sm,
2501                            snat_session_key_t match,
2502                            snat_session_key_t * mapping,
2503                            u8 by_external,
2504                            u8 * is_addr_only,
2505                            twice_nat_type_t * twice_nat,
2506                            lb_nat_type_t * lb, ip4_address_t * ext_host_addr,
2507                            u8 * is_identity_nat)
2508 {
2509   clib_bihash_kv_8_8_t kv, value;
2510   snat_static_mapping_t *m;
2511   snat_session_key_t m_key;
2512   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
2513   u32 rand, lo = 0, hi, mid, *tmp = 0, i;
2514   u8 backend_index;
2515   nat44_lb_addr_port_t *local;
2516
2517   m_key.fib_index = match.fib_index;
2518   if (by_external)
2519     {
2520       mapping_hash = &sm->static_mapping_by_external;
2521       m_key.fib_index = 0;
2522     }
2523
2524   m_key.addr = match.addr;
2525   m_key.port = clib_net_to_host_u16 (match.port);
2526   m_key.protocol = match.protocol;
2527
2528   kv.key = m_key.as_u64;
2529
2530   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2531     {
2532       /* Try address only mapping */
2533       m_key.port = 0;
2534       m_key.protocol = 0;
2535       kv.key = m_key.as_u64;
2536       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2537         return 1;
2538     }
2539
2540   m = pool_elt_at_index (sm->static_mappings, value.value);
2541
2542   if (by_external)
2543     {
2544       if (is_lb_static_mapping (m))
2545         {
2546           if (PREDICT_FALSE (lb != 0))
2547             *lb = m->affinity ? AFFINITY_LB_NAT : LB_NAT;
2548           if (m->affinity)
2549             {
2550               if (nat_affinity_find_and_lock (ext_host_addr[0], match.addr,
2551                                               match.protocol, match.port,
2552                                               &backend_index))
2553                 goto get_local;
2554
2555               local = pool_elt_at_index (m->locals, backend_index);
2556               mapping->addr = local->addr;
2557               mapping->port = clib_host_to_net_u16 (local->port);
2558               mapping->fib_index = local->fib_index;
2559               goto end;
2560             }
2561         get_local:
2562           /* *INDENT-OFF* */
2563           pool_foreach_index (i, m->locals,
2564           ({
2565             vec_add1 (tmp, i);
2566           }));
2567           /* *INDENT-ON* */
2568           hi = vec_len (tmp) - 1;
2569           local = pool_elt_at_index (m->locals, tmp[hi]);
2570           rand = 1 + (random_u32 (&sm->random_seed) % local->prefix);
2571           while (lo < hi)
2572             {
2573               mid = ((hi - lo) >> 1) + lo;
2574               local = pool_elt_at_index (m->locals, tmp[mid]);
2575               (rand > local->prefix) ? (lo = mid + 1) : (hi = mid);
2576             }
2577           local = pool_elt_at_index (m->locals, tmp[lo]);
2578           if (!(local->prefix >= rand))
2579             return 1;
2580           if (PREDICT_FALSE (sm->num_workers > 1))
2581             {
2582               ip4_header_t ip = {
2583                 .src_address = local->addr,
2584               };
2585               if (sm->worker_in2out_cb (&ip, m->fib_index) !=
2586                   vlib_get_thread_index ())
2587                 goto get_local;
2588             }
2589           mapping->addr = local->addr;
2590           mapping->port = clib_host_to_net_u16 (local->port);
2591           mapping->fib_index = local->fib_index;
2592           if (m->affinity)
2593             {
2594               if (nat_affinity_create_and_lock (ext_host_addr[0], match.addr,
2595                                                 match.protocol, match.port,
2596                                                 tmp[lo], m->affinity,
2597                                                 m->affinity_per_service_list_head_index))
2598                 nat_log_info ("create affinity record failed");
2599             }
2600           vec_free (tmp);
2601         }
2602       else
2603         {
2604           if (PREDICT_FALSE (lb != 0))
2605             *lb = NO_LB_NAT;
2606           mapping->fib_index = m->fib_index;
2607           mapping->addr = m->local_addr;
2608           /* Address only mapping doesn't change port */
2609           mapping->port = is_addr_only_static_mapping (m) ? match.port
2610             : clib_host_to_net_u16 (m->local_port);
2611         }
2612       mapping->protocol = m->proto;
2613     }
2614   else
2615     {
2616       mapping->addr = m->external_addr;
2617       /* Address only mapping doesn't change port */
2618       mapping->port = is_addr_only_static_mapping (m) ? match.port
2619         : clib_host_to_net_u16 (m->external_port);
2620       mapping->fib_index = sm->outside_fib_index;
2621     }
2622
2623 end:
2624   if (PREDICT_FALSE (is_addr_only != 0))
2625     *is_addr_only = is_addr_only_static_mapping (m);
2626
2627   if (PREDICT_FALSE (twice_nat != 0))
2628     *twice_nat = m->twice_nat;
2629
2630   if (PREDICT_FALSE (is_identity_nat != 0))
2631     *is_identity_nat = is_identity_static_mapping (m);
2632
2633   return 0;
2634 }
2635
2636 static_always_inline u16
2637 snat_random_port (u16 min, u16 max)
2638 {
2639   snat_main_t *sm = &snat_main;
2640   return min + random_u32 (&sm->random_seed) /
2641     (random_u32_max () / (max - min + 1) + 1);
2642 }
2643
2644 int
2645 snat_alloc_outside_address_and_port (snat_address_t * addresses,
2646                                      u32 fib_index,
2647                                      u32 thread_index,
2648                                      snat_session_key_t * k,
2649                                      u16 port_per_thread,
2650                                      u32 snat_thread_index)
2651 {
2652   snat_main_t *sm = &snat_main;
2653
2654   return sm->alloc_addr_and_port (addresses, fib_index, thread_index, k,
2655                                   port_per_thread, snat_thread_index);
2656 }
2657
2658 static int
2659 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2660                                  u32 fib_index,
2661                                  u32 thread_index,
2662                                  snat_session_key_t * k,
2663                                  u16 port_per_thread, u32 snat_thread_index)
2664 {
2665   int i;
2666   snat_address_t *a, *ga = 0;
2667   u32 portnum;
2668
2669   for (i = 0; i < vec_len (addresses); i++)
2670     {
2671       a = addresses + i;
2672       switch (k->protocol)
2673         {
2674 #define _(N, j, n, s) \
2675         case SNAT_PROTOCOL_##N: \
2676           if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
2677             { \
2678               if (a->fib_index == fib_index) \
2679                 { \
2680                   while (1) \
2681                     { \
2682                       portnum = (port_per_thread * \
2683                         snat_thread_index) + \
2684                         snat_random_port(1, port_per_thread) + 1024; \
2685                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2686                         continue; \
2687                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2688                       a->busy_##n##_ports_per_thread[thread_index]++; \
2689                       a->busy_##n##_ports++; \
2690                       k->addr = a->addr; \
2691                       k->port = clib_host_to_net_u16(portnum); \
2692                       return 0; \
2693                     } \
2694                 } \
2695               else if (a->fib_index == ~0) \
2696                 { \
2697                   ga = a; \
2698                 } \
2699             } \
2700           break;
2701           foreach_snat_protocol
2702 #undef _
2703         default:
2704           nat_log_info ("unknown protocol");
2705           return 1;
2706         }
2707
2708     }
2709
2710   if (ga)
2711     {
2712       a = ga;
2713       switch (k->protocol)
2714         {
2715 #define _(N, j, n, s) \
2716         case SNAT_PROTOCOL_##N: \
2717           while (1) \
2718             { \
2719               portnum = (port_per_thread * \
2720                 snat_thread_index) + \
2721                 snat_random_port(1, port_per_thread) + 1024; \
2722               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2723                 continue; \
2724               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2725               a->busy_##n##_ports_per_thread[thread_index]++; \
2726               a->busy_##n##_ports++; \
2727               k->addr = a->addr; \
2728               k->port = clib_host_to_net_u16(portnum); \
2729               return 0; \
2730             }
2731           break;
2732           foreach_snat_protocol
2733 #undef _
2734         default:
2735           nat_log_info ("unknown protocol");
2736           return 1;
2737         }
2738     }
2739
2740   /* Totally out of translations to use... */
2741   snat_ipfix_logging_addresses_exhausted (thread_index, 0);
2742   return 1;
2743 }
2744
2745 static int
2746 nat_alloc_addr_and_port_mape (snat_address_t * addresses,
2747                               u32 fib_index,
2748                               u32 thread_index,
2749                               snat_session_key_t * k,
2750                               u16 port_per_thread, u32 snat_thread_index)
2751 {
2752   snat_main_t *sm = &snat_main;
2753   snat_address_t *a = addresses;
2754   u16 m, ports, portnum, A, j;
2755   m = 16 - (sm->psid_offset + sm->psid_length);
2756   ports = (1 << (16 - sm->psid_length)) - (1 << m);
2757
2758   if (!vec_len (addresses))
2759     goto exhausted;
2760
2761   switch (k->protocol)
2762     {
2763 #define _(N, i, n, s) \
2764     case SNAT_PROTOCOL_##N: \
2765       if (a->busy_##n##_ports < ports) \
2766         { \
2767           while (1) \
2768             { \
2769               A = snat_random_port(1, pow2_mask(sm->psid_offset)); \
2770               j = snat_random_port(0, pow2_mask(m)); \
2771               portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \
2772               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2773                 continue; \
2774               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2775               a->busy_##n##_ports++; \
2776               k->addr = a->addr; \
2777               k->port = clib_host_to_net_u16 (portnum); \
2778               return 0; \
2779             } \
2780         } \
2781       break;
2782       foreach_snat_protocol
2783 #undef _
2784     default:
2785       nat_log_info ("unknown protocol");
2786       return 1;
2787     }
2788
2789 exhausted:
2790   /* Totally out of translations to use... */
2791   snat_ipfix_logging_addresses_exhausted (thread_index, 0);
2792   return 1;
2793 }
2794
2795 static int
2796 nat_alloc_addr_and_port_range (snat_address_t * addresses,
2797                                u32 fib_index,
2798                                u32 thread_index,
2799                                snat_session_key_t * k,
2800                                u16 port_per_thread, u32 snat_thread_index)
2801 {
2802   snat_main_t *sm = &snat_main;
2803   snat_address_t *a = addresses;
2804   u16 portnum, ports;
2805
2806   ports = sm->end_port - sm->start_port + 1;
2807
2808   if (!vec_len (addresses))
2809     goto exhausted;
2810
2811   switch (k->protocol)
2812     {
2813 #define _(N, i, n, s) \
2814     case SNAT_PROTOCOL_##N: \
2815       if (a->busy_##n##_ports < ports) \
2816         { \
2817           while (1) \
2818             { \
2819               portnum = snat_random_port(sm->start_port, sm->end_port); \
2820               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2821                 continue; \
2822               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2823               a->busy_##n##_ports++; \
2824               k->addr = a->addr; \
2825               k->port = clib_host_to_net_u16 (portnum); \
2826               return 0; \
2827             } \
2828         } \
2829       break;
2830       foreach_snat_protocol
2831 #undef _
2832     default:
2833       nat_log_info ("unknown protocol");
2834       return 1;
2835     }
2836
2837 exhausted:
2838   /* Totally out of translations to use... */
2839   snat_ipfix_logging_addresses_exhausted (thread_index, 0);
2840   return 1;
2841 }
2842
2843 void
2844 nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add)
2845 {
2846   dpo_id_t dpo_v4 = DPO_INVALID;
2847   fib_prefix_t pfx = {
2848     .fp_proto = FIB_PROTOCOL_IP4,
2849     .fp_len = 32,
2850     .fp_addr.ip4.as_u32 = addr.as_u32,
2851   };
2852
2853   if (is_add)
2854     {
2855       nat_dpo_create (DPO_PROTO_IP4, 0, &dpo_v4);
2856       fib_table_entry_special_dpo_add (0, &pfx, FIB_SOURCE_PLUGIN_HI,
2857                                        FIB_ENTRY_FLAG_EXCLUSIVE, &dpo_v4);
2858       dpo_reset (&dpo_v4);
2859     }
2860   else
2861     {
2862       fib_table_entry_special_remove (0, &pfx, FIB_SOURCE_PLUGIN_HI);
2863     }
2864 }
2865
2866 u8 *
2867 format_session_kvp (u8 * s, va_list * args)
2868 {
2869   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2870   snat_session_key_t k;
2871
2872   k.as_u64 = v->key;
2873
2874   s = format (s, "%U session-index %llu", format_snat_key, &k, v->value);
2875
2876   return s;
2877 }
2878
2879 u8 *
2880 format_static_mapping_kvp (u8 * s, va_list * args)
2881 {
2882   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2883   snat_session_key_t k;
2884
2885   k.as_u64 = v->key;
2886
2887   s = format (s, "%U static-mapping-index %llu",
2888               format_static_mapping_key, &k, v->value);
2889
2890   return s;
2891 }
2892
2893 u8 *
2894 format_user_kvp (u8 * s, va_list * args)
2895 {
2896   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2897   snat_user_key_t k;
2898
2899   k.as_u64 = v->key;
2900
2901   s = format (s, "%U fib %d user-index %llu", format_ip4_address, &k.addr,
2902               k.fib_index, v->value);
2903
2904   return s;
2905 }
2906
2907 u8 *
2908 format_ed_session_kvp (u8 * s, va_list * args)
2909 {
2910   clib_bihash_kv_16_8_t *v = va_arg (*args, clib_bihash_kv_16_8_t *);
2911   nat_ed_ses_key_t k;
2912
2913   k.as_u64[0] = v->key[0];
2914   k.as_u64[1] = v->key[1];
2915
2916   s =
2917     format (s, "local %U:%d remote %U:%d proto %U fib %d session-index %llu",
2918             format_ip4_address, &k.l_addr, clib_net_to_host_u16 (k.l_port),
2919             format_ip4_address, &k.r_addr, clib_net_to_host_u16 (k.r_port),
2920             format_ip_protocol, k.proto, k.fib_index, v->value);
2921
2922   return s;
2923 }
2924
2925 static u32
2926 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2927 {
2928   snat_main_t *sm = &snat_main;
2929   u32 next_worker_index = 0;
2930   u32 hash;
2931
2932   next_worker_index = sm->first_worker_index;
2933   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2934     (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >> 24);
2935
2936   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2937     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2938   else
2939     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2940
2941   return next_worker_index;
2942 }
2943
2944 static u32
2945 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2946 {
2947   snat_main_t *sm = &snat_main;
2948   udp_header_t *udp;
2949   u16 port;
2950   snat_session_key_t m_key;
2951   clib_bihash_kv_8_8_t kv, value;
2952   snat_static_mapping_t *m;
2953   u32 proto;
2954   u32 next_worker_index = 0;
2955
2956   /* first try static mappings without port */
2957   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2958     {
2959       m_key.addr = ip0->dst_address;
2960       m_key.port = 0;
2961       m_key.protocol = 0;
2962       m_key.fib_index = rx_fib_index0;
2963       kv.key = m_key.as_u64;
2964       if (!clib_bihash_search_8_8
2965           (&sm->static_mapping_by_external, &kv, &value))
2966         {
2967           m = pool_elt_at_index (sm->static_mappings, value.value);
2968           return m->workers[0];
2969         }
2970     }
2971
2972   proto = ip_proto_to_snat_proto (ip0->protocol);
2973   udp = ip4_next_header (ip0);
2974   port = udp->dst_port;
2975
2976   if (PREDICT_FALSE (ip4_is_fragment (ip0)))
2977     {
2978       if (PREDICT_FALSE (nat_reass_is_drop_frag (0)))
2979         return vlib_get_thread_index ();
2980
2981       nat_reass_ip4_t *reass;
2982       reass = nat_ip4_reass_find (ip0->src_address, ip0->dst_address,
2983                                   ip0->fragment_id, ip0->protocol);
2984
2985       if (reass && (reass->thread_index != (u32) ~ 0))
2986         return reass->thread_index;
2987
2988       if (ip4_is_first_fragment (ip0))
2989         {
2990           reass =
2991             nat_ip4_reass_create (ip0->src_address, ip0->dst_address,
2992                                   ip0->fragment_id, ip0->protocol);
2993           if (!reass)
2994             goto no_reass;
2995
2996           if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2997             {
2998               m_key.addr = ip0->dst_address;
2999               m_key.port = clib_net_to_host_u16 (port);
3000               m_key.protocol = proto;
3001               m_key.fib_index = rx_fib_index0;
3002               kv.key = m_key.as_u64;
3003               if (!clib_bihash_search_8_8
3004                   (&sm->static_mapping_by_external, &kv, &value))
3005                 {
3006                   m = pool_elt_at_index (sm->static_mappings, value.value);
3007                   reass->thread_index = m->workers[0];
3008                   return reass->thread_index;
3009                 }
3010             }
3011           reass->thread_index = sm->first_worker_index;
3012           reass->thread_index +=
3013             sm->workers[(clib_net_to_host_u16 (port) - 1024) /
3014                         sm->port_per_thread];
3015           return reass->thread_index;
3016         }
3017       else
3018         return vlib_get_thread_index ();
3019     }
3020
3021 no_reass:
3022   /* unknown protocol */
3023   if (PREDICT_FALSE (proto == ~0))
3024     {
3025       /* use current thread */
3026       return vlib_get_thread_index ();
3027     }
3028
3029   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
3030     {
3031       icmp46_header_t *icmp = (icmp46_header_t *) udp;
3032       icmp_echo_header_t *echo = (icmp_echo_header_t *) (icmp + 1);
3033       if (!icmp_is_error_message (icmp))
3034         port = echo->identifier;
3035       else
3036         {
3037           ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1);
3038           proto = ip_proto_to_snat_proto (inner_ip->protocol);
3039           void *l4_header = ip4_next_header (inner_ip);
3040           switch (proto)
3041             {
3042             case SNAT_PROTOCOL_ICMP:
3043               icmp = (icmp46_header_t *) l4_header;
3044               echo = (icmp_echo_header_t *) (icmp + 1);
3045               port = echo->identifier;
3046               break;
3047             case SNAT_PROTOCOL_UDP:
3048             case SNAT_PROTOCOL_TCP:
3049               port = ((tcp_udp_header_t *) l4_header)->src_port;
3050               break;
3051             default:
3052               return vlib_get_thread_index ();
3053             }
3054         }
3055     }
3056
3057   /* try static mappings with port */
3058   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
3059     {
3060       m_key.addr = ip0->dst_address;
3061       m_key.port = clib_net_to_host_u16 (port);
3062       m_key.protocol = proto;
3063       m_key.fib_index = rx_fib_index0;
3064       kv.key = m_key.as_u64;
3065       if (!clib_bihash_search_8_8
3066           (&sm->static_mapping_by_external, &kv, &value))
3067         {
3068           m = pool_elt_at_index (sm->static_mappings, value.value);
3069           return m->workers[0];
3070         }
3071     }
3072
3073   /* worker by outside port */
3074   next_worker_index = sm->first_worker_index;
3075   next_worker_index +=
3076     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
3077   return next_worker_index;
3078 }
3079
3080 static u32
3081 nat44_ed_get_worker_out2in_cb (ip4_header_t * ip, u32 rx_fib_index)
3082 {
3083   snat_main_t *sm = &snat_main;
3084   clib_bihash_kv_8_8_t kv, value;
3085   u32 proto, next_worker_index = 0;
3086   udp_header_t *udp;
3087   u16 port;
3088   snat_static_mapping_t *m;
3089   u32 hash;
3090
3091   /* first try static mappings without port */
3092   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
3093     {
3094       make_sm_kv (&kv, &ip->dst_address, 0, rx_fib_index, 0);
3095       if (!clib_bihash_search_8_8
3096           (&sm->static_mapping_by_external, &kv, &value))
3097         {
3098           m = pool_elt_at_index (sm->static_mappings, value.value);
3099           return m->workers[0];
3100         }
3101     }
3102
3103   proto = ip_proto_to_snat_proto (ip->protocol);
3104
3105   /* unknown protocol */
3106   if (PREDICT_FALSE (proto == ~0))
3107     {
3108       /* use current thread */
3109       return vlib_get_thread_index ();
3110     }
3111
3112   udp = ip4_next_header (ip);
3113   port = udp->dst_port;
3114
3115   if (PREDICT_FALSE (ip->protocol == IP_PROTOCOL_ICMP))
3116     {
3117       icmp46_header_t *icmp = (icmp46_header_t *) udp;
3118       icmp_echo_header_t *echo = (icmp_echo_header_t *) (icmp + 1);
3119       if (!icmp_is_error_message (icmp))
3120         port = echo->identifier;
3121       else
3122         {
3123           ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1);
3124           proto = ip_proto_to_snat_proto (inner_ip->protocol);
3125           void *l4_header = ip4_next_header (inner_ip);
3126           switch (proto)
3127             {
3128             case SNAT_PROTOCOL_ICMP:
3129               icmp = (icmp46_header_t *) l4_header;
3130               echo = (icmp_echo_header_t *) (icmp + 1);
3131               port = echo->identifier;
3132               break;
3133             case SNAT_PROTOCOL_UDP:
3134             case SNAT_PROTOCOL_TCP:
3135               port = ((tcp_udp_header_t *) l4_header)->src_port;
3136               break;
3137             default:
3138               return vlib_get_thread_index ();
3139             }
3140         }
3141     }
3142
3143   /* try static mappings with port */
3144   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
3145     {
3146       make_sm_kv (&kv, &ip->dst_address, proto, rx_fib_index,
3147                   clib_net_to_host_u16 (port));
3148       if (!clib_bihash_search_8_8
3149           (&sm->static_mapping_by_external, &kv, &value))
3150         {
3151           m = pool_elt_at_index (sm->static_mappings, value.value);
3152           if (!is_lb_static_mapping (m))
3153             return m->workers[0];
3154
3155           hash = ip->src_address.as_u32 + (ip->src_address.as_u32 >> 8) +
3156             (ip->src_address.as_u32 >> 16) + (ip->src_address.as_u32 >> 24);
3157
3158           if (PREDICT_TRUE (is_pow2 (_vec_len (m->workers))))
3159             return m->workers[hash & (_vec_len (m->workers) - 1)];
3160           else
3161             return m->workers[hash % _vec_len (m->workers)];
3162         }
3163     }
3164
3165   /* worker by outside port */
3166   next_worker_index = sm->first_worker_index;
3167   next_worker_index +=
3168     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
3169
3170   return next_worker_index;
3171 }
3172
3173 void
3174 nat_ha_sadd_cb (ip4_address_t * in_addr, u16 in_port,
3175                 ip4_address_t * out_addr, u16 out_port,
3176                 ip4_address_t * eh_addr, u16 eh_port,
3177                 ip4_address_t * ehn_addr, u16 ehn_port, u8 proto,
3178                 u32 fib_index, u16 flags, u32 thread_index)
3179 {
3180   snat_main_t *sm = &snat_main;
3181   snat_session_key_t key;
3182   snat_user_t *u;
3183   snat_session_t *s;
3184   clib_bihash_kv_8_8_t kv;
3185   f64 now = vlib_time_now (sm->vlib_main);
3186   nat_outside_fib_t *outside_fib;
3187   fib_node_index_t fei = FIB_NODE_INDEX_INVALID;
3188   snat_main_per_thread_data_t *tsm;
3189   fib_prefix_t pfx = {
3190     .fp_proto = FIB_PROTOCOL_IP4,
3191     .fp_len = 32,
3192     .fp_addr = {
3193                 .ip4.as_u32 = eh_addr->as_u32,
3194                 },
3195   };
3196
3197   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
3198
3199   key.addr.as_u32 = out_addr->as_u32;
3200   key.port = out_port;
3201   key.protocol = proto;
3202
3203   if (!(flags & SNAT_SESSION_FLAG_STATIC_MAPPING))
3204     {
3205       if (nat_set_outside_address_and_port
3206           (sm->addresses, thread_index, &key))
3207         return;
3208     }
3209
3210   u = nat_user_get_or_create (sm, in_addr, fib_index, thread_index);
3211   if (!u)
3212     return;
3213
3214   s = nat_session_alloc_or_recycle (sm, u, thread_index, now);
3215   if (!s)
3216     return;
3217
3218   s->last_heard = now;
3219   s->flags = flags;
3220   s->ext_host_addr.as_u32 = eh_addr->as_u32;
3221   s->ext_host_port = eh_port;
3222   user_session_increment (sm, u, snat_is_session_static (s));
3223   switch (vec_len (sm->outside_fibs))
3224     {
3225     case 0:
3226       key.fib_index = sm->outside_fib_index;
3227       break;
3228     case 1:
3229       key.fib_index = sm->outside_fibs[0].fib_index;
3230       break;
3231     default:
3232       /* *INDENT-OFF* */
3233       vec_foreach (outside_fib, sm->outside_fibs)
3234         {
3235           fei = fib_table_lookup (outside_fib->fib_index, &pfx);
3236           if (FIB_NODE_INDEX_INVALID != fei)
3237             {
3238               if (fib_entry_get_resolving_interface (fei) != ~0)
3239                 {
3240                   key.fib_index = outside_fib->fib_index;
3241                   break;
3242                 }
3243             }
3244         }
3245       /* *INDENT-ON* */
3246       break;
3247     }
3248   s->out2in = key;
3249   kv.key = key.as_u64;
3250   kv.value = s - tsm->sessions;
3251   if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 1))
3252     nat_log_warn ("out2in key add failed");
3253
3254   key.addr.as_u32 = in_addr->as_u32;
3255   key.port = in_port;
3256   key.fib_index = fib_index;
3257   s->in2out = key;
3258   kv.key = key.as_u64;
3259   if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 1))
3260     nat_log_warn ("in2out key add failed");
3261 }
3262
3263 void
3264 nat_ha_sdel_cb (ip4_address_t * out_addr, u16 out_port,
3265                 ip4_address_t * eh_addr, u16 eh_port, u8 proto, u32 fib_index,
3266                 u32 ti)
3267 {
3268   snat_main_t *sm = &snat_main;
3269   snat_session_key_t key;
3270   clib_bihash_kv_8_8_t kv, value;
3271   u32 thread_index;
3272   snat_session_t *s;
3273   snat_main_per_thread_data_t *tsm;
3274
3275   if (sm->num_workers > 1)
3276     thread_index =
3277       sm->first_worker_index +
3278       (sm->workers[(clib_net_to_host_u16 (out_port) -
3279                     1024) / sm->port_per_thread]);
3280   else
3281     thread_index = sm->num_workers;
3282   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
3283
3284   key.addr.as_u32 = out_addr->as_u32;
3285   key.port = out_port;
3286   key.protocol = proto;
3287   key.fib_index = fib_index;
3288   kv.key = key.as_u64;
3289   if (clib_bihash_search_8_8 (&tsm->out2in, &kv, &value))
3290     return;
3291
3292   s = pool_elt_at_index (tsm->sessions, value.value);
3293   nat_free_session_data (sm, s, thread_index, 1);
3294   nat44_delete_session (sm, s, thread_index);
3295 }
3296
3297 void
3298 nat_ha_sref_cb (ip4_address_t * out_addr, u16 out_port,
3299                 ip4_address_t * eh_addr, u16 eh_port, u8 proto, u32 fib_index,
3300                 u32 total_pkts, u64 total_bytes, u32 thread_index)
3301 {
3302   snat_main_t *sm = &snat_main;
3303   snat_session_key_t key;
3304   clib_bihash_kv_8_8_t kv, value;
3305   snat_session_t *s;
3306   snat_main_per_thread_data_t *tsm;
3307
3308   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
3309
3310   key.addr.as_u32 = out_addr->as_u32;
3311   key.port = out_port;
3312   key.protocol = proto;
3313   key.fib_index = fib_index;
3314   kv.key = key.as_u64;
3315   if (clib_bihash_search_8_8 (&tsm->out2in, &kv, &value))
3316     return;
3317
3318   s = pool_elt_at_index (tsm->sessions, value.value);
3319   s->total_pkts = total_pkts;
3320   s->total_bytes = total_bytes;
3321 }
3322
3323 void
3324 nat_ha_sadd_ed_cb (ip4_address_t * in_addr, u16 in_port,
3325                    ip4_address_t * out_addr, u16 out_port,
3326                    ip4_address_t * eh_addr, u16 eh_port,
3327                    ip4_address_t * ehn_addr, u16 ehn_port, u8 proto,
3328                    u32 fib_index, u16 flags, u32 thread_index)
3329 {
3330   snat_main_t *sm = &snat_main;
3331   snat_session_key_t key;
3332   snat_user_t *u;
3333   snat_session_t *s;
3334   clib_bihash_kv_16_8_t kv;
3335   f64 now = vlib_time_now (sm->vlib_main);
3336   nat_outside_fib_t *outside_fib;
3337   fib_node_index_t fei = FIB_NODE_INDEX_INVALID;
3338   snat_main_per_thread_data_t *tsm;
3339   fib_prefix_t pfx = {
3340     .fp_proto = FIB_PROTOCOL_IP4,
3341     .fp_len = 32,
3342     .fp_addr = {
3343                 .ip4.as_u32 = eh_addr->as_u32,
3344                 },
3345   };
3346
3347   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
3348
3349   key.addr.as_u32 = out_addr->as_u32;
3350   key.port = out_port;
3351   key.protocol = proto;
3352
3353   if (!(flags & SNAT_SESSION_FLAG_STATIC_MAPPING))
3354     {
3355       if (nat_set_outside_address_and_port
3356           (sm->addresses, thread_index, &key))
3357         return;
3358     }
3359
3360   key.addr.as_u32 = ehn_addr->as_u32;
3361   key.port = ehn_port;
3362   if (flags & SNAT_SESSION_FLAG_TWICE_NAT)
3363     {
3364       if (nat_set_outside_address_and_port
3365           (sm->twice_nat_addresses, thread_index, &key))
3366         return;
3367     }
3368
3369   u = nat_user_get_or_create (sm, in_addr, fib_index, thread_index);
3370   if (!u)
3371     return;
3372
3373   s = nat_ed_session_alloc (sm, u, thread_index, now);
3374   if (!s)
3375     return;
3376
3377   s->last_heard = now;
3378   s->flags = flags;
3379   s->ext_host_nat_addr.as_u32 = s->ext_host_addr.as_u32 = eh_addr->as_u32;
3380   s->ext_host_nat_port = s->ext_host_port = eh_port;
3381   if (is_twice_nat_session (s))
3382     {
3383       s->ext_host_nat_addr.as_u32 = ehn_addr->as_u32;
3384       s->ext_host_nat_port = ehn_port;
3385     }
3386   user_session_increment (sm, u, snat_is_session_static (s));
3387   switch (vec_len (sm->outside_fibs))
3388     {
3389     case 0:
3390       key.fib_index = sm->outside_fib_index;
3391       break;
3392     case 1:
3393       key.fib_index = sm->outside_fibs[0].fib_index;
3394       break;
3395     default:
3396       /* *INDENT-OFF* */
3397       vec_foreach (outside_fib, sm->outside_fibs)
3398         {
3399           fei = fib_table_lookup (outside_fib->fib_index, &pfx);
3400           if (FIB_NODE_INDEX_INVALID != fei)
3401             {
3402               if (fib_entry_get_resolving_interface (fei) != ~0)
3403                 {
3404                   key.fib_index = outside_fib->fib_index;
3405                   break;
3406                 }
3407             }
3408         }
3409       /* *INDENT-ON* */
3410       break;
3411     }
3412   key.addr.as_u32 = out_addr->as_u32;
3413   key.port = out_port;
3414   s->out2in = key;
3415   kv.value = s - tsm->sessions;
3416
3417   key.addr.as_u32 = in_addr->as_u32;
3418   key.port = in_port;
3419   key.fib_index = fib_index;
3420   s->in2out = key;
3421
3422   make_ed_kv (&kv, in_addr, &s->ext_host_nat_addr,
3423               snat_proto_to_ip_proto (proto), fib_index, in_port,
3424               s->ext_host_nat_port);
3425   if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &kv, 1))
3426     nat_log_warn ("in2out key add failed");
3427
3428   make_ed_kv (&kv, out_addr, eh_addr, snat_proto_to_ip_proto (proto),
3429               s->out2in.fib_index, out_port, eh_port);
3430   if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &kv, 1))
3431     nat_log_warn ("out2in key add failed");
3432 }
3433
3434 void
3435 nat_ha_sdel_ed_cb (ip4_address_t * out_addr, u16 out_port,
3436                    ip4_address_t * eh_addr, u16 eh_port, u8 proto,
3437                    u32 fib_index, u32 ti)
3438 {
3439   snat_main_t *sm = &snat_main;
3440   nat_ed_ses_key_t key;
3441   clib_bihash_kv_16_8_t kv, value;
3442   u32 thread_index;
3443   snat_session_t *s;
3444   snat_main_per_thread_data_t *tsm;
3445
3446   if (sm->num_workers > 1)
3447     thread_index =
3448       sm->first_worker_index +
3449       (sm->workers[(clib_net_to_host_u16 (out_port) -
3450                     1024) / sm->port_per_thread]);
3451   else
3452     thread_index = sm->num_workers;
3453   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
3454
3455   key.l_addr.as_u32 = out_addr->as_u32;
3456   key.l_port = out_port;
3457   key.r_addr.as_u32 = eh_addr->as_u32;
3458   key.r_port = eh_port;
3459   key.proto = proto;
3460   key.fib_index = fib_index;
3461   kv.key[0] = key.as_u64[0];
3462   kv.key[1] = key.as_u64[1];
3463   if (clib_bihash_search_16_8 (&tsm->out2in_ed, &kv, &value))
3464     return;
3465
3466   s = pool_elt_at_index (tsm->sessions, value.value);
3467   nat_free_session_data (sm, s, thread_index, 1);
3468   nat44_delete_session (sm, s, thread_index);
3469 }
3470
3471 void
3472 nat_ha_sref_ed_cb (ip4_address_t * out_addr, u16 out_port,
3473                    ip4_address_t * eh_addr, u16 eh_port, u8 proto,
3474                    u32 fib_index, u32 total_pkts, u64 total_bytes,
3475                    u32 thread_index)
3476 {
3477   snat_main_t *sm = &snat_main;
3478   nat_ed_ses_key_t key;
3479   clib_bihash_kv_16_8_t kv, value;
3480   snat_session_t *s;
3481   snat_main_per_thread_data_t *tsm;
3482
3483   tsm = vec_elt_at_index (sm->per_thread_data, thread_index);
3484
3485   key.l_addr.as_u32 = out_addr->as_u32;
3486   key.l_port = out_port;
3487   key.r_addr.as_u32 = eh_addr->as_u32;
3488   key.r_port = eh_port;
3489   key.proto = proto;
3490   key.fib_index = fib_index;
3491   kv.key[0] = key.as_u64[0];
3492   kv.key[1] = key.as_u64[1];
3493   if (clib_bihash_search_16_8 (&tsm->out2in_ed, &kv, &value))
3494     return;
3495
3496   s = pool_elt_at_index (tsm->sessions, value.value);
3497   s->total_pkts = total_pkts;
3498   s->total_bytes = total_bytes;
3499 }
3500
3501 static clib_error_t *
3502 snat_config (vlib_main_t * vm, unformat_input_t * input)
3503 {
3504   snat_main_t *sm = &snat_main;
3505   nat66_main_t *nm = &nat66_main;
3506   u32 translation_buckets = 1024;
3507   u32 translation_memory_size = 128 << 20;
3508   u32 user_buckets = 128;
3509   u32 user_memory_size = 64 << 20;
3510   u32 max_translations_per_user = 100;
3511   u32 outside_vrf_id = 0;
3512   u32 outside_ip6_vrf_id = 0;
3513   u32 inside_vrf_id = 0;
3514   u32 static_mapping_buckets = 1024;
3515   u32 static_mapping_memory_size = 64 << 20;
3516   u32 nat64_bib_buckets = 1024;
3517   u32 nat64_bib_memory_size = 128 << 20;
3518   u32 nat64_st_buckets = 2048;
3519   u32 nat64_st_memory_size = 256 << 20;
3520   u8 static_mapping_only = 0;
3521   u8 static_mapping_connection_tracking = 0;
3522   snat_main_per_thread_data_t *tsm;
3523   dslite_main_t *dm = &dslite_main;
3524
3525   sm->deterministic = 0;
3526   sm->out2in_dpo = 0;
3527   sm->endpoint_dependent = 0;
3528
3529   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
3530     {
3531       if (unformat
3532           (input, "translation hash buckets %d", &translation_buckets))
3533         ;
3534       else if (unformat (input, "translation hash memory %d",
3535                          &translation_memory_size));
3536       else if (unformat (input, "user hash buckets %d", &user_buckets))
3537         ;
3538       else if (unformat (input, "user hash memory %d", &user_memory_size))
3539         ;
3540       else if (unformat (input, "max translations per user %d",
3541                          &max_translations_per_user))
3542         ;
3543       else if (unformat (input, "outside VRF id %d", &outside_vrf_id))
3544         ;
3545       else if (unformat (input, "outside ip6 VRF id %d", &outside_ip6_vrf_id))
3546         ;
3547       else if (unformat (input, "inside VRF id %d", &inside_vrf_id))
3548         ;
3549       else if (unformat (input, "static mapping only"))
3550         {
3551           static_mapping_only = 1;
3552           if (unformat (input, "connection tracking"))
3553             static_mapping_connection_tracking = 1;
3554         }
3555       else if (unformat (input, "deterministic"))
3556         sm->deterministic = 1;
3557       else if (unformat (input, "nat64 bib hash buckets %d",
3558                          &nat64_bib_buckets))
3559         ;
3560       else if (unformat (input, "nat64 bib hash memory %d",
3561                          &nat64_bib_memory_size))
3562         ;
3563       else
3564         if (unformat (input, "nat64 st hash buckets %d", &nat64_st_buckets))
3565         ;
3566       else if (unformat (input, "nat64 st hash memory %d",
3567                          &nat64_st_memory_size))
3568         ;
3569       else if (unformat (input, "out2in dpo"))
3570         sm->out2in_dpo = 1;
3571       else if (unformat (input, "dslite ce"))
3572         dslite_set_ce (dm, 1);
3573       else if (unformat (input, "endpoint-dependent"))
3574         sm->endpoint_dependent = 1;
3575       else
3576         return clib_error_return (0, "unknown input '%U'",
3577                                   format_unformat_error, input);
3578     }
3579
3580   if (sm->deterministic && sm->endpoint_dependent)
3581     return clib_error_return (0,
3582                               "deterministic and endpoint-dependent modes are mutually exclusive");
3583
3584   if (static_mapping_only && (sm->deterministic || sm->endpoint_dependent))
3585     return clib_error_return (0,
3586                               "static mapping only mode available only for simple nat");
3587
3588   if (sm->out2in_dpo && (sm->deterministic || sm->endpoint_dependent))
3589     return clib_error_return (0,
3590                               "out2in dpo mode available only for simple nat");
3591
3592   /* for show commands, etc. */
3593   sm->translation_buckets = translation_buckets;
3594   sm->translation_memory_size = translation_memory_size;
3595   /* do not exceed load factor 10 */
3596   sm->max_translations = 10 * translation_buckets;
3597   sm->user_buckets = user_buckets;
3598   sm->user_memory_size = user_memory_size;
3599   sm->max_translations_per_user = max_translations_per_user;
3600   sm->outside_vrf_id = outside_vrf_id;
3601   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
3602                                                              outside_vrf_id,
3603                                                              FIB_SOURCE_PLUGIN_HI);
3604   nm->outside_vrf_id = outside_ip6_vrf_id;
3605   nm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP6,
3606                                                              outside_ip6_vrf_id,
3607                                                              FIB_SOURCE_PLUGIN_HI);
3608   sm->inside_vrf_id = inside_vrf_id;
3609   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
3610                                                             inside_vrf_id,
3611                                                             FIB_SOURCE_PLUGIN_HI);
3612   sm->static_mapping_only = static_mapping_only;
3613   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
3614
3615   nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
3616                   nat64_st_memory_size);
3617
3618   if (sm->deterministic)
3619     {
3620       sm->in2out_node_index = snat_det_in2out_node.index;
3621       sm->in2out_output_node_index = ~0;
3622       sm->out2in_node_index = snat_det_out2in_node.index;
3623       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
3624       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
3625     }
3626   else
3627     {
3628       if (sm->endpoint_dependent)
3629         {
3630           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
3631           sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb;
3632           sm->in2out_node_index = nat44_ed_in2out_node.index;
3633           sm->in2out_output_node_index = nat44_ed_in2out_output_node.index;
3634           sm->out2in_node_index = nat44_ed_out2in_node.index;
3635           sm->icmp_match_in2out_cb = icmp_match_in2out_ed;
3636           sm->icmp_match_out2in_cb = icmp_match_out2in_ed;
3637           nat_affinity_init (vm);
3638           nat_ha_init (vm, nat_ha_sadd_ed_cb, nat_ha_sdel_ed_cb,
3639                        nat_ha_sref_ed_cb);
3640         }
3641       else
3642         {
3643           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
3644           sm->worker_out2in_cb = snat_get_worker_out2in_cb;
3645           sm->in2out_node_index = snat_in2out_node.index;
3646           sm->in2out_output_node_index = snat_in2out_output_node.index;
3647           sm->out2in_node_index = snat_out2in_node.index;
3648           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
3649           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
3650           nat_ha_init (vm, nat_ha_sadd_cb, nat_ha_sdel_cb, nat_ha_sref_cb);
3651         }
3652       if (!static_mapping_only ||
3653           (static_mapping_only && static_mapping_connection_tracking))
3654         {
3655           /* *INDENT-OFF* */
3656           vec_foreach (tsm, sm->per_thread_data)
3657             {
3658               if (sm->endpoint_dependent)
3659                 {
3660                   clib_bihash_init_16_8 (&tsm->in2out_ed, "in2out-ed",
3661                                          translation_buckets,
3662                                          translation_memory_size);
3663                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->in2out_ed,
3664                                                       format_ed_session_kvp);
3665
3666                   clib_bihash_init_16_8 (&tsm->out2in_ed, "out2in-ed",
3667                                          translation_buckets,
3668                                          translation_memory_size);
3669                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->out2in_ed,
3670                                                       format_ed_session_kvp);
3671                 }
3672               else
3673                 {
3674                   clib_bihash_init_8_8 (&tsm->in2out, "in2out",
3675                                         translation_buckets,
3676                                         translation_memory_size);
3677                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->in2out,
3678                                                      format_session_kvp);
3679
3680                   clib_bihash_init_8_8 (&tsm->out2in, "out2in",
3681                                         translation_buckets,
3682                                         translation_memory_size);
3683                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->out2in,
3684                                                      format_session_kvp);
3685                 }
3686
3687               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
3688                                     user_memory_size);
3689               clib_bihash_set_kvp_format_fn_8_8 (&tsm->user_hash,
3690                                                  format_user_kvp);
3691             }
3692           /* *INDENT-ON* */
3693
3694         }
3695       else
3696         {
3697           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
3698           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
3699         }
3700       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
3701                             "static_mapping_by_local", static_mapping_buckets,
3702                             static_mapping_memory_size);
3703       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local,
3704                                          format_static_mapping_kvp);
3705
3706       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
3707                             "static_mapping_by_external",
3708                             static_mapping_buckets,
3709                             static_mapping_memory_size);
3710       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external,
3711                                          format_static_mapping_kvp);
3712     }
3713
3714   return 0;
3715 }
3716
3717 VLIB_CONFIG_FUNCTION (snat_config, "nat");
3718
3719 static void
3720 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
3721                                  uword opaque,
3722                                  u32 sw_if_index,
3723                                  ip4_address_t * address,
3724                                  u32 address_length,
3725                                  u32 if_address_index, u32 is_delete)
3726 {
3727   snat_main_t *sm = &snat_main;
3728   snat_static_map_resolve_t *rp;
3729   snat_static_mapping_t *m;
3730   snat_session_key_t m_key;
3731   clib_bihash_kv_8_8_t kv, value;
3732   int i, rv;
3733   ip4_address_t l_addr;
3734
3735   for (i = 0; i < vec_len (sm->to_resolve); i++)
3736     {
3737       rp = sm->to_resolve + i;
3738       if (rp->addr_only == 0)
3739         continue;
3740       if (rp->sw_if_index == sw_if_index)
3741         goto match;
3742     }
3743
3744   return;
3745
3746 match:
3747   m_key.addr.as_u32 = address->as_u32;
3748   m_key.port = rp->addr_only ? 0 : rp->e_port;
3749   m_key.protocol = rp->addr_only ? 0 : rp->proto;
3750   m_key.fib_index = sm->outside_fib_index;
3751   kv.key = m_key.as_u64;
3752   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
3753     m = 0;
3754   else
3755     m = pool_elt_at_index (sm->static_mappings, value.value);
3756
3757   if (!is_delete)
3758     {
3759       /* Don't trip over lease renewal, static config */
3760       if (m)
3761         return;
3762     }
3763   else
3764     {
3765       if (!m)
3766         return;
3767     }
3768
3769   /* Indetity mapping? */
3770   if (rp->l_addr.as_u32 == 0)
3771     l_addr.as_u32 = address[0].as_u32;
3772   else
3773     l_addr.as_u32 = rp->l_addr.as_u32;
3774   /* Add the static mapping */
3775   rv = snat_add_static_mapping (l_addr,
3776                                 address[0],
3777                                 rp->l_port,
3778                                 rp->e_port,
3779                                 rp->vrf_id,
3780                                 rp->addr_only, ~0 /* sw_if_index */ ,
3781                                 rp->proto, !is_delete, rp->twice_nat,
3782                                 rp->out2in_only, rp->tag, rp->identity_nat);
3783   if (rv)
3784     nat_log_notice ("snat_add_static_mapping returned %d", rv);
3785 }
3786
3787 static void
3788 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
3789                                        uword opaque,
3790                                        u32 sw_if_index,
3791                                        ip4_address_t * address,
3792                                        u32 address_length,
3793                                        u32 if_address_index, u32 is_delete)
3794 {
3795   snat_main_t *sm = &snat_main;
3796   snat_static_map_resolve_t *rp;
3797   ip4_address_t l_addr;
3798   int i, j;
3799   int rv;
3800   u8 twice_nat = 0;
3801   snat_address_t *addresses = sm->addresses;
3802
3803   for (i = 0; i < vec_len (sm->auto_add_sw_if_indices); i++)
3804     {
3805       if (sw_if_index == sm->auto_add_sw_if_indices[i])
3806         goto match;
3807     }
3808
3809   for (i = 0; i < vec_len (sm->auto_add_sw_if_indices_twice_nat); i++)
3810     {
3811       twice_nat = 1;
3812       addresses = sm->twice_nat_addresses;
3813       if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
3814         goto match;
3815     }
3816
3817   return;
3818
3819 match:
3820   if (!is_delete)
3821     {
3822       /* Don't trip over lease renewal, static config */
3823       for (j = 0; j < vec_len (addresses); j++)
3824         if (addresses[j].addr.as_u32 == address->as_u32)
3825           return;
3826
3827       (void) snat_add_address (sm, address, ~0, twice_nat);
3828       /* Scan static map resolution vector */
3829       for (j = 0; j < vec_len (sm->to_resolve); j++)
3830         {
3831           rp = sm->to_resolve + j;
3832           if (rp->addr_only)
3833             continue;
3834           /* On this interface? */
3835           if (rp->sw_if_index == sw_if_index)
3836             {
3837               /* Indetity mapping? */
3838               if (rp->l_addr.as_u32 == 0)
3839                 l_addr.as_u32 = address[0].as_u32;
3840               else
3841                 l_addr.as_u32 = rp->l_addr.as_u32;
3842               /* Add the static mapping */
3843               rv = snat_add_static_mapping (l_addr,
3844                                             address[0],
3845                                             rp->l_port,
3846                                             rp->e_port,
3847                                             rp->vrf_id,
3848                                             rp->addr_only,
3849                                             ~0 /* sw_if_index */ ,
3850                                             rp->proto,
3851                                             rp->is_add, rp->twice_nat,
3852                                             rp->out2in_only, rp->tag,
3853                                             rp->identity_nat);
3854               if (rv)
3855                 nat_log_notice ("snat_add_static_mapping returned %d", rv);
3856             }
3857         }
3858       return;
3859     }
3860   else
3861     {
3862       (void) snat_del_address (sm, address[0], 1, twice_nat);
3863       return;
3864     }
3865 }
3866
3867
3868 int
3869 snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
3870                             u8 twice_nat)
3871 {
3872   ip4_main_t *ip4_main = sm->ip4_main;
3873   ip4_address_t *first_int_addr;
3874   snat_static_map_resolve_t *rp;
3875   u32 *indices_to_delete = 0;
3876   int i, j;
3877   u32 *auto_add_sw_if_indices =
3878     twice_nat ? sm->
3879     auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
3880
3881   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index, 0        /* just want the address */
3882     );
3883
3884   for (i = 0; i < vec_len (auto_add_sw_if_indices); i++)
3885     {
3886       if (auto_add_sw_if_indices[i] == sw_if_index)
3887         {
3888           if (is_del)
3889             {
3890               /* if have address remove it */
3891               if (first_int_addr)
3892                 (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
3893               else
3894                 {
3895                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3896                     {
3897                       rp = sm->to_resolve + j;
3898                       if (rp->sw_if_index == sw_if_index)
3899                         vec_add1 (indices_to_delete, j);
3900                     }
3901                   if (vec_len (indices_to_delete))
3902                     {
3903                       for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
3904                         vec_del1 (sm->to_resolve, j);
3905                       vec_free (indices_to_delete);
3906                     }
3907                 }
3908               if (twice_nat)
3909                 vec_del1 (sm->auto_add_sw_if_indices_twice_nat, i);
3910               else
3911                 vec_del1 (sm->auto_add_sw_if_indices, i);
3912             }
3913           else
3914             return VNET_API_ERROR_VALUE_EXIST;
3915
3916           return 0;
3917         }
3918     }
3919
3920   if (is_del)
3921     return VNET_API_ERROR_NO_SUCH_ENTRY;
3922
3923   /* add to the auto-address list */
3924   if (twice_nat)
3925     vec_add1 (sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
3926   else
3927     vec_add1 (sm->auto_add_sw_if_indices, sw_if_index);
3928
3929   /* If the address is already bound - or static - add it now */
3930   if (first_int_addr)
3931     (void) snat_add_address (sm, first_int_addr, ~0, twice_nat);
3932
3933   return 0;
3934 }
3935
3936 int
3937 nat44_del_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
3938                    snat_protocol_t proto, u32 vrf_id, int is_in)
3939 {
3940   snat_main_per_thread_data_t *tsm;
3941   clib_bihash_kv_8_8_t kv, value;
3942   ip4_header_t ip;
3943   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3944   snat_session_key_t key;
3945   snat_session_t *s;
3946   clib_bihash_8_8_t *t;
3947
3948   if (sm->endpoint_dependent)
3949     return VNET_API_ERROR_UNSUPPORTED;
3950
3951   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3952   if (sm->num_workers > 1)
3953     tsm =
3954       vec_elt_at_index (sm->per_thread_data,
3955                         sm->worker_in2out_cb (&ip, fib_index));
3956   else
3957     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3958
3959   key.addr.as_u32 = addr->as_u32;
3960   key.port = clib_host_to_net_u16 (port);
3961   key.protocol = proto;
3962   key.fib_index = fib_index;
3963   kv.key = key.as_u64;
3964   t = is_in ? &tsm->in2out : &tsm->out2in;
3965   if (!clib_bihash_search_8_8 (t, &kv, &value))
3966     {
3967       if (pool_is_free_index (tsm->sessions, value.value))
3968         return VNET_API_ERROR_UNSPECIFIED;
3969
3970       s = pool_elt_at_index (tsm->sessions, value.value);
3971       nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
3972       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3973       return 0;
3974     }
3975
3976   return VNET_API_ERROR_NO_SUCH_ENTRY;
3977 }
3978
3979 int
3980 nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
3981                       ip4_address_t * eh_addr, u16 eh_port, u8 proto,
3982                       u32 vrf_id, int is_in)
3983 {
3984   ip4_header_t ip;
3985   clib_bihash_16_8_t *t;
3986   nat_ed_ses_key_t key;
3987   clib_bihash_kv_16_8_t kv, value;
3988   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3989   snat_session_t *s;
3990   snat_main_per_thread_data_t *tsm;
3991
3992   if (!sm->endpoint_dependent)
3993     return VNET_API_ERROR_FEATURE_DISABLED;
3994
3995   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3996   if (sm->num_workers > 1)
3997     tsm =
3998       vec_elt_at_index (sm->per_thread_data,
3999                         sm->worker_in2out_cb (&ip, fib_index));
4000   else
4001     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
4002
4003   t = is_in ? &tsm->in2out_ed : &tsm->out2in_ed;
4004   key.l_addr.as_u32 = addr->as_u32;
4005   key.r_addr.as_u32 = eh_addr->as_u32;
4006   key.l_port = clib_host_to_net_u16 (port);
4007   key.r_port = clib_host_to_net_u16 (eh_port);
4008   key.proto = proto;
4009   key.fib_index = fib_index;
4010   kv.key[0] = key.as_u64[0];
4011   kv.key[1] = key.as_u64[1];
4012   if (clib_bihash_search_16_8 (t, &kv, &value))
4013     return VNET_API_ERROR_NO_SUCH_ENTRY;
4014
4015   if (pool_is_free_index (tsm->sessions, value.value))
4016     return VNET_API_ERROR_UNSPECIFIED;
4017   s = pool_elt_at_index (tsm->sessions, value.value);
4018   nat_free_session_data (sm, s, tsm - sm->per_thread_data, 0);
4019   nat44_delete_session (sm, s, tsm - sm->per_thread_data);
4020   return 0;
4021 }
4022
4023 void
4024 nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, u16 psid_length)
4025 {
4026   snat_main_t *sm = &snat_main;
4027
4028   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_MAPE;
4029   sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape;
4030   sm->psid = psid;
4031   sm->psid_offset = psid_offset;
4032   sm->psid_length = psid_length;
4033 }
4034
4035 void
4036 nat_set_alloc_addr_and_port_range (u16 start_port, u16 end_port)
4037 {
4038   snat_main_t *sm = &snat_main;
4039
4040   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_RANGE;
4041   sm->alloc_addr_and_port = nat_alloc_addr_and_port_range;
4042   sm->start_port = start_port;
4043   sm->end_port = end_port;
4044 }
4045
4046 void
4047 nat_set_alloc_addr_and_port_default (void)
4048 {
4049   snat_main_t *sm = &snat_main;
4050
4051   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
4052   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
4053 }
4054
4055 /*
4056  * fd.io coding-style-patch-verification: ON
4057  *
4058  * Local Variables:
4059  * eval: (c-set-style "gnu")
4060  * End:
4061  */