src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_ipfix_logging.h>
  24 #include <nat/nat_det.h>
  25 #include <nat/nat64.h>
  26 #include <vnet/fib/fib_table.h>
  27 #include <vnet/fib/ip4_fib.h>
  28
  29 #include <vpp/app/version.h>
  30
  31 snat_main_t snat_main;
  32
  33
  34 /* Hook up input features */
  35 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  36   .arc_name = "ip4-unicast",
  37   .node_name = "nat44-in2out",
  38   .runs_before = VNET_FEATURES ("nat44-out2in"),
  39 };
  40 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  41   .arc_name = "ip4-unicast",
  42   .node_name = "nat44-out2in",
  43   .runs_before = VNET_FEATURES ("ip4-lookup"),
  44 };
  45 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  46   .arc_name = "ip4-unicast",
  47   .node_name = "nat44-det-in2out",
  48   .runs_before = VNET_FEATURES ("nat44-det-out2in"),
  49 };
  50 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  51   .arc_name = "ip4-unicast",
  52   .node_name = "nat44-det-out2in",
  53   .runs_before = VNET_FEATURES ("ip4-lookup"),
  54 };
  55 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  56   .arc_name = "ip4-unicast",
  57   .node_name = "nat44-in2out-worker-handoff",
  58   .runs_before = VNET_FEATURES ("nat44-out2in-worker-handoff"),
  59 };
  60 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  61   .arc_name = "ip4-unicast",
  62   .node_name = "nat44-out2in-worker-handoff",
  63   .runs_before = VNET_FEATURES ("ip4-lookup"),
  64 };
  65 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
  66   .arc_name = "ip4-unicast",
  67   .node_name = "nat44-in2out-fast",
  68   .runs_before = VNET_FEATURES ("nat44-out2in-fast"),
  69 };
  70 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
  71   .arc_name = "ip4-unicast",
  72   .node_name = "nat44-out2in-fast",
  73   .runs_before = VNET_FEATURES ("ip4-lookup"),
  74 };
  75 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
  76   .arc_name = "ip4-unicast",
  77   .node_name = "nat44-hairpin-dst",
  78   .runs_before = VNET_FEATURES ("ip4-lookup"),
  79 };
  80
  81 /* Hook up output features */
  82 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
  83   .arc_name = "ip4-output",
  84   .node_name = "nat44-in2out-output",
  85   .runs_before = VNET_FEATURES ("interface-output"),
  86 };
  87 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
  88   .arc_name = "ip4-output",
  89   .node_name = "nat44-in2out-output-worker-handoff",
  90   .runs_before = VNET_FEATURES ("interface-output"),
  91 };
  92 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
  93   .arc_name = "ip4-output",
  94   .node_name = "nat44-hairpin-src",
  95   .runs_before = VNET_FEATURES ("interface-output"),
  96 };
  97
  98
  99 /* *INDENT-OFF* */
 100 VLIB_PLUGIN_REGISTER () = {
 101     .version = VPP_BUILD_VER,
 102     .description = "Network Address Translation",
 103 };
 104 /* *INDENT-ON* */
 105
 106 /**
 107  * @brief Add/del NAT address to FIB.
 108  *
 109  * Add the external NAT address to the FIB as receive entries. This ensures
 110  * that VPP will reply to ARP for this address and we don't need to enable
 111  * proxy ARP on the outside interface.
 112  *
 113  * @param addr IPv4 address.
 114  * @param plen address prefix length
 115  * @param sw_if_index Interface.
 116  * @param is_add If 0 delete, otherwise add.
 117  */
 118 void
 119 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 120                           int is_add)
 121 {
 122   fib_prefix_t prefix = {
 123     .fp_len = p_len,
 124     .fp_proto = FIB_PROTOCOL_IP4,
 125     .fp_addr = {
 126         .ip4.as_u32 = addr->as_u32,
 127     },
 128   };
 129   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 130
 131   if (is_add)
 132     fib_table_entry_update_one_path(fib_index,
 133                                     &prefix,
 134                                     FIB_SOURCE_PLUGIN_HI,
 135                                     (FIB_ENTRY_FLAG_CONNECTED |
 136                                      FIB_ENTRY_FLAG_LOCAL |
 137                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 138                                     DPO_PROTO_IP4,
 139                                     NULL,
 140                                     sw_if_index,
 141                                     ~0,
 142                                     1,
 143                                     NULL,
 144                                     FIB_ROUTE_PATH_FLAG_NONE);
 145   else
 146     fib_table_entry_delete(fib_index,
 147                            &prefix,
 148                            FIB_SOURCE_PLUGIN_HI);
 149 }
 150
 151 void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id)
 152 {
 153   snat_address_t * ap;
 154   snat_interface_t *i;
 155
 156   if (vrf_id != ~0)
 157     sm->vrf_mode = 1;
 158
 159   /* Check if address already exists */
 160   vec_foreach (ap, sm->addresses)
 161     {
 162       if (ap->addr.as_u32 == addr->as_u32)
 163         return;
 164     }
 165
 166   vec_add2 (sm->addresses, ap, 1);
 167   ap->addr = *addr;
 168   if (vrf_id != ~0)
 169     ap->fib_index =
 170       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id);
 171   else
 172     ap->fib_index = ~0;
 173 #define _(N, i, n, s) \
 174   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535);
 175   foreach_snat_protocol
 176 #undef _
 177
 178   /* Add external address to FIB */
 179   pool_foreach (i, sm->interfaces,
 180   ({
 181     if (i->is_inside)
 182       continue;
 183
 184     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 185     break;
 186   }));
 187   pool_foreach (i, sm->output_feature_interfaces,
 188   ({
 189     if (i->is_inside)
 190       continue;
 191
 192     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 193     break;
 194   }));
 195 }
 196
 197 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 198                                                    ip4_address_t addr)
 199 {
 200   snat_static_mapping_t *m;
 201   pool_foreach (m, sm->static_mappings,
 202   ({
 203       if (m->external_addr.as_u32 == addr.as_u32)
 204         return 1;
 205   }));
 206
 207   return 0;
 208 }
 209
 210 void increment_v4_address (ip4_address_t * a)
 211 {
 212   u32 v;
 213
 214   v = clib_net_to_host_u32(a->as_u32) + 1;
 215   a->as_u32 = clib_host_to_net_u32(v);
 216 }
 217
 218 static void
 219 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 220                                        ip4_address_t l_addr,
 221                                        u16 l_port,
 222                                        u32 sw_if_index,
 223                                        u16 e_port,
 224                                        u32 vrf_id,
 225                                        snat_protocol_t proto,
 226                                        int addr_only,
 227                                        int is_add)
 228 {
 229   snat_static_map_resolve_t *rp;
 230
 231   vec_add2 (sm->to_resolve, rp, 1);
 232   rp->l_addr.as_u32 = l_addr.as_u32;
 233   rp->l_port = l_port;
 234   rp->sw_if_index = sw_if_index;
 235   rp->e_port = e_port;
 236   rp->vrf_id = vrf_id;
 237   rp->proto = proto;
 238   rp->addr_only = addr_only;
 239   rp->is_add = is_add;
 240 }
 241
 242 /**
 243  * @brief Add static mapping.
 244  *
 245  * Create static mapping between local addr+port and external addr+port.
 246  *
 247  * @param l_addr Local IPv4 address.
 248  * @param e_addr External IPv4 address.
 249  * @param l_port Local port number.
 250  * @param e_port External port number.
 251  * @param vrf_id VRF ID.
 252  * @param addr_only If 0 address port and pair mapping, otherwise address only.
 253  * @param sw_if_index External port instead of specific IP address.
 254  * @param is_add If 0 delete static mapping, otherwise add.
 255  *
 256  * @returns
 257  */
 258 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
 259                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 260                             u32 sw_if_index, snat_protocol_t proto, int is_add)
 261 {
 262   snat_main_t * sm = &snat_main;
 263   snat_static_mapping_t *m;
 264   snat_session_key_t m_key;
 265   clib_bihash_kv_8_8_t kv, value;
 266   snat_address_t *a = 0;
 267   u32 fib_index = ~0;
 268   uword * p;
 269   snat_interface_t *interface;
 270   int i;
 271
 272   /* If the external address is a specific interface address */
 273   if (sw_if_index != ~0)
 274     {
 275       ip4_address_t * first_int_addr;
 276
 277       /* Might be already set... */
 278       first_int_addr = ip4_interface_first_address
 279         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
 280
 281       /* DHCP resolution required? */
 282       if (first_int_addr == 0)
 283         {
 284           snat_add_static_mapping_when_resolved
 285             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 286              addr_only,  is_add);
 287           return 0;
 288         }
 289         else
 290           e_addr.as_u32 = first_int_addr->as_u32;
 291     }
 292
 293   m_key.addr = e_addr;
 294   m_key.port = addr_only ? 0 : e_port;
 295   m_key.protocol = addr_only ? 0 : proto;
 296   m_key.fib_index = sm->outside_fib_index;
 297   kv.key = m_key.as_u64;
 298   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 299     m = 0;
 300   else
 301     m = pool_elt_at_index (sm->static_mappings, value.value);
 302
 303   if (is_add)
 304     {
 305       if (m)
 306         return VNET_API_ERROR_VALUE_EXIST;
 307
 308       /* Convert VRF id to FIB index */
 309       if (vrf_id != ~0)
 310         {
 311           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
 312           if (!p)
 313             return VNET_API_ERROR_NO_SUCH_FIB;
 314           fib_index = p[0];
 315         }
 316       /* If not specified use inside VRF id from SNAT plugin startup config */
 317       else
 318         {
 319           fib_index = sm->inside_fib_index;
 320           vrf_id = sm->inside_vrf_id;
 321         }
 322
 323       /* Find external address in allocated addresses and reserve port for
 324          address and port pair mapping when dynamic translations enabled */
 325       if (!addr_only && !(sm->static_mapping_only))
 326         {
 327           for (i = 0; i < vec_len (sm->addresses); i++)
 328             {
 329               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 330                 {
 331                   a = sm->addresses + i;
 332                   /* External port must be unused */
 333                   switch (proto)
 334                     {
 335 #define _(N, j, n, s) \
 336                     case SNAT_PROTOCOL_##N: \
 337                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 338                         return VNET_API_ERROR_INVALID_VALUE; \
 339                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 340                       if (e_port > 1024) \
 341                         a->busy_##n##_ports++; \
 342                       break;
 343                       foreach_snat_protocol
 344 #undef _
 345                     default:
 346                       clib_warning("unknown_protocol");
 347                       return VNET_API_ERROR_INVALID_VALUE_2;
 348                     }
 349                   break;
 350                 }
 351             }
 352           /* External address must be allocated */
 353           if (!a)
 354             return VNET_API_ERROR_NO_SUCH_ENTRY;
 355         }
 356
 357       pool_get (sm->static_mappings, m);
 358       memset (m, 0, sizeof (*m));
 359       m->local_addr = l_addr;
 360       m->external_addr = e_addr;
 361       m->addr_only = addr_only;
 362       m->vrf_id = vrf_id;
 363       m->fib_index = fib_index;
 364       if (!addr_only)
 365         {
 366           m->local_port = l_port;
 367           m->external_port = e_port;
 368           m->proto = proto;
 369         }
 370
 371       m_key.addr = m->local_addr;
 372       m_key.port = m->local_port;
 373       m_key.protocol = m->proto;
 374       m_key.fib_index = m->fib_index;
 375       kv.key = m_key.as_u64;
 376       kv.value = m - sm->static_mappings;
 377       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 378
 379       m_key.addr = m->external_addr;
 380       m_key.port = m->external_port;
 381       m_key.fib_index = sm->outside_fib_index;
 382       kv.key = m_key.as_u64;
 383       kv.value = m - sm->static_mappings;
 384       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
 385
 386       /* Assign worker */
 387       if (sm->workers)
 388         {
 389           snat_user_key_t w_key0;
 390           snat_worker_key_t w_key1;
 391
 392           w_key0.addr = m->local_addr;
 393           w_key0.fib_index = m->fib_index;
 394           kv.key = w_key0.as_u64;
 395
 396           if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 397             {
 398               kv.value = sm->first_worker_index +
 399                 sm->workers[sm->next_worker++ % vec_len (sm->workers)];
 400
 401               clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv, 1);
 402             }
 403           else
 404             {
 405               kv.value = value.value;
 406             }
 407
 408           w_key1.addr = m->external_addr;
 409           w_key1.port = clib_host_to_net_u16 (m->external_port);
 410           w_key1.fib_index = sm->outside_fib_index;
 411           kv.key = w_key1.as_u64;
 412           clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv, 1);
 413         }
 414     }
 415   else
 416     {
 417       if (!m)
 418         return VNET_API_ERROR_NO_SUCH_ENTRY;
 419
 420       /* Free external address port */
 421       if (!addr_only && !(sm->static_mapping_only))
 422         {
 423           for (i = 0; i < vec_len (sm->addresses); i++)
 424             {
 425               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 426                 {
 427                   a = sm->addresses + i;
 428                   switch (proto)
 429                     {
 430 #define _(N, j, n, s) \
 431                     case SNAT_PROTOCOL_##N: \
 432                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 433                       if (e_port > 1024) \
 434                         a->busy_##n##_ports--; \
 435                       break;
 436                       foreach_snat_protocol
 437 #undef _
 438                     default:
 439                       clib_warning("unknown_protocol");
 440                       return VNET_API_ERROR_INVALID_VALUE_2;
 441                     }
 442                   break;
 443                 }
 444             }
 445         }
 446
 447       m_key.addr = m->local_addr;
 448       m_key.port = m->local_port;
 449       m_key.protocol = m->proto;
 450       m_key.fib_index = m->fib_index;
 451       kv.key = m_key.as_u64;
 452       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
 453
 454       m_key.addr = m->external_addr;
 455       m_key.port = m->external_port;
 456       m_key.fib_index = sm->outside_fib_index;
 457       kv.key = m_key.as_u64;
 458       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
 459
 460       /* Delete session(s) for static mapping if exist */
 461       if (!(sm->static_mapping_only) ||
 462           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
 463         {
 464           snat_user_key_t u_key;
 465           snat_user_t *u;
 466           dlist_elt_t * head, * elt;
 467           u32 elt_index, head_index, del_elt_index;
 468           u32 ses_index;
 469           u64 user_index;
 470           snat_session_t * s;
 471           snat_main_per_thread_data_t *tsm;
 472
 473           u_key.addr = m->local_addr;
 474           u_key.fib_index = m->fib_index;
 475           kv.key = u_key.as_u64;
 476           if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
 477             {
 478               user_index = value.value;
 479               if (!clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 480                 tsm = vec_elt_at_index (sm->per_thread_data, value.value);
 481               else
 482                 tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 483               u = pool_elt_at_index (tsm->users, user_index);
 484               if (u->nstaticsessions)
 485                 {
 486                   head_index = u->sessions_per_user_list_head_index;
 487                   head = pool_elt_at_index (tsm->list_pool, head_index);
 488                   elt_index = head->next;
 489                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 490                   ses_index = elt->value;
 491                   while (ses_index != ~0)
 492                     {
 493                       s =  pool_elt_at_index (tsm->sessions, ses_index);
 494                       del_elt_index = elt_index;
 495                       elt_index = elt->next;
 496                       elt = pool_elt_at_index (tsm->list_pool, elt_index);
 497                       ses_index = elt->value;
 498
 499                       if (!addr_only)
 500                         {
 501                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) &&
 502                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
 503                             continue;
 504                         }
 505
 506                       if (snat_is_unk_proto_session (s))
 507                         {
 508                           clib_bihash_kv_16_8_t up_kv;
 509                           nat_ed_ses_key_t up_key;
 510                           up_key.l_addr = s->in2out.addr;
 511                           up_key.r_addr = s->ext_host_addr;
 512                           up_key.fib_index = s->in2out.fib_index;
 513                           up_key.proto = s->in2out.port;
 514                           up_key.rsvd = 0;
 515                           up_key.l_port = 0;
 516                           up_kv.key[0] = up_key.as_u64[0];
 517                           up_kv.key[1] = up_key.as_u64[1];
 518                           if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
 519                                                         &up_kv, 0))
 520                             clib_warning ("in2out key del failed");
 521
 522                           up_key.l_addr = s->out2in.addr;
 523                           up_key.fib_index = s->out2in.fib_index;
 524                           up_kv.key[0] = up_key.as_u64[0];
 525                           up_kv.key[1] = up_key.as_u64[1];
 526                           if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
 527                                                         &up_kv, 0))
 528                             clib_warning ("out2in key del failed");
 529
 530                           goto delete;
 531                         }
 532                       /* log NAT event */
 533                       snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 534                                                           s->out2in.addr.as_u32,
 535                                                           s->in2out.protocol,
 536                                                           s->in2out.port,
 537                                                           s->out2in.port,
 538                                                           s->in2out.fib_index);
 539
 540                       value.key = s->in2out.as_u64;
 541                       if (clib_bihash_add_del_8_8 (&sm->in2out, &value, 0))
 542                         clib_warning ("in2out key del failed");
 543                       value.key = s->out2in.as_u64;
 544                       if (clib_bihash_add_del_8_8 (&sm->out2in, &value, 0))
 545                         clib_warning ("out2in key del failed");
 546 delete:
 547                       pool_put (tsm->sessions, s);
 548
 549                       clib_dlist_remove (tsm->list_pool, del_elt_index);
 550                       pool_put_index (tsm->list_pool, del_elt_index);
 551                       u->nstaticsessions--;
 552
 553                       if (!addr_only)
 554                         break;
 555                     }
 556                   if (addr_only)
 557                     {
 558                       pool_put (tsm->users, u);
 559                       clib_bihash_add_del_8_8 (&sm->user_hash, &kv, 0);
 560                     }
 561                 }
 562             }
 563         }
 564
 565       /* Delete static mapping from pool */
 566       pool_put (sm->static_mappings, m);
 567     }
 568
 569   if (!addr_only)
 570     return 0;
 571
 572   /* Add/delete external address to FIB */
 573   pool_foreach (interface, sm->interfaces,
 574   ({
 575     if (interface->is_inside)
 576       continue;
 577
 578     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 579     break;
 580   }));
 581   pool_foreach (interface, sm->output_feature_interfaces,
 582   ({
 583     if (interface->is_inside)
 584       continue;
 585
 586     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 587     break;
 588   }));
 589
 590   return 0;
 591 }
 592
 593 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
 594                                      snat_protocol_t proto, u32 vrf_id,
 595                                      nat44_lb_addr_port_t *locals, u8 is_add)
 596 {
 597   snat_main_t * sm = &snat_main;
 598   snat_static_mapping_t *m;
 599   snat_session_key_t m_key;
 600   clib_bihash_kv_8_8_t kv, value;
 601   u32 fib_index;
 602   snat_address_t *a = 0;
 603   int i;
 604   nat44_lb_addr_port_t *local;
 605   snat_user_key_t w_key0;
 606   snat_worker_key_t w_key1;
 607   u32 worker_index = 0;
 608
 609   m_key.addr = e_addr;
 610   m_key.port = e_port;
 611   m_key.protocol = proto;
 612   m_key.fib_index = sm->outside_fib_index;
 613   kv.key = m_key.as_u64;
 614   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 615     m = 0;
 616   else
 617     m = pool_elt_at_index (sm->static_mappings, value.value);
 618
 619   if (is_add)
 620     {
 621       if (m)
 622         return VNET_API_ERROR_VALUE_EXIST;
 623
 624       if (vec_len (locals) < 2)
 625         return VNET_API_ERROR_INVALID_VALUE;
 626
 627       fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
 628                                                      vrf_id);
 629
 630       /* Find external address in allocated addresses and reserve port for
 631          address and port pair mapping when dynamic translations enabled */
 632       if (!sm->static_mapping_only)
 633         {
 634           for (i = 0; i < vec_len (sm->addresses); i++)
 635             {
 636               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 637                 {
 638                   a = sm->addresses + i;
 639                   /* External port must be unused */
 640                   switch (proto)
 641                     {
 642 #define _(N, j, n, s) \
 643                     case SNAT_PROTOCOL_##N: \
 644                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 645                         return VNET_API_ERROR_INVALID_VALUE; \
 646                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 647                       if (e_port > 1024) \
 648                         a->busy_##n##_ports++; \
 649                       break;
 650                       foreach_snat_protocol
 651 #undef _
 652                     default:
 653                       clib_warning("unknown_protocol");
 654                       return VNET_API_ERROR_INVALID_VALUE_2;
 655                     }
 656                   break;
 657                 }
 658             }
 659           /* External address must be allocated */
 660           if (!a)
 661             return VNET_API_ERROR_NO_SUCH_ENTRY;
 662         }
 663
 664       pool_get (sm->static_mappings, m);
 665       memset (m, 0, sizeof (*m));
 666       m->external_addr = e_addr;
 667       m->addr_only = 0;
 668       m->vrf_id = vrf_id;
 669       m->fib_index = fib_index;
 670       m->external_port = e_port;
 671       m->proto = proto;
 672
 673       m_key.addr = m->external_addr;
 674       m_key.port = m->external_port;
 675       m_key.protocol = m->proto;
 676       m_key.fib_index = sm->outside_fib_index;
 677       kv.key = m_key.as_u64;
 678       kv.value = m - sm->static_mappings;
 679       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1))
 680         {
 681           clib_warning ("static_mapping_by_external key add failed");
 682           return VNET_API_ERROR_UNSPECIFIED;
 683         }
 684       m_key.port = clib_host_to_net_u16 (m->external_port);
 685       kv.key = m_key.as_u64;
 686       kv.value = ~0ULL;
 687       if (clib_bihash_add_del_8_8(&sm->out2in, &kv, 1))
 688         {
 689           clib_warning ("static_mapping_by_local key add failed");
 690           return VNET_API_ERROR_UNSPECIFIED;
 691         }
 692
 693       m_key.fib_index = m->fib_index;
 694
 695       /* Assign worker */
 696       if (sm->workers)
 697         {
 698           w_key0.addr = locals[0].addr;
 699           w_key0.fib_index = fib_index;
 700           kv.key = w_key0.as_u64;
 701
 702           if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv, &value))
 703             worker_index = sm->first_worker_index +
 704               sm->workers[sm->next_worker++ % vec_len (sm->workers)];
 705           else
 706             worker_index = value.value;
 707
 708           w_key1.addr = m->external_addr;
 709           w_key1.port = clib_host_to_net_u16 (m->external_port);
 710           w_key1.fib_index = sm->outside_fib_index;
 711           kv.key = w_key1.as_u64;
 712           kv.value = worker_index;
 713           if (clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv, 1))
 714             {
 715               clib_warning ("worker-by-out add key failed");
 716               return VNET_API_ERROR_UNSPECIFIED;
 717             }
 718         }
 719
 720       for (i = 0; i < vec_len (locals); i++)
 721         {
 722           m_key.addr = locals[i].addr;
 723           m_key.port = locals[i].port;
 724           kv.key = m_key.as_u64;
 725           kv.value = m - sm->static_mappings;
 726           clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 727           locals[i].prefix = locals[i - 1].prefix + locals[i].probability;
 728           vec_add1 (m->locals, locals[i]);
 729           m_key.port = clib_host_to_net_u16 (locals[i].port);
 730           kv.key = m_key.as_u64;
 731           kv.value = ~0ULL;
 732           if (clib_bihash_add_del_8_8(&sm->in2out, &kv, 1))
 733             {
 734               clib_warning ("in2out key add failed");
 735               return VNET_API_ERROR_UNSPECIFIED;
 736             }
 737           /* Assign worker */
 738           if (sm->workers)
 739             {
 740               w_key0.addr = locals[i].addr;
 741               w_key0.fib_index = fib_index;
 742               kv.key = w_key0.as_u64;
 743               kv.value = worker_index;
 744               if (clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv, 1))
 745                 {
 746                   clib_warning ("worker-by-in key add failed");
 747                   return VNET_API_ERROR_UNSPECIFIED;
 748                 }
 749             }
 750         }
 751     }
 752   else
 753     {
 754       if (!m)
 755         return VNET_API_ERROR_NO_SUCH_ENTRY;
 756
 757       fib_table_unlock (m->fib_index, FIB_PROTOCOL_IP4);
 758
 759       /* Free external address port */
 760       if (!sm->static_mapping_only)
 761         {
 762           for (i = 0; i < vec_len (sm->addresses); i++)
 763             {
 764               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 765                 {
 766                   a = sm->addresses + i;
 767                   switch (proto)
 768                     {
 769 #define _(N, j, n, s) \
 770                     case SNAT_PROTOCOL_##N: \
 771                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 772                       if (e_port > 1024) \
 773                         a->busy_##n##_ports--; \
 774                       break;
 775                       foreach_snat_protocol
 776 #undef _
 777                     default:
 778                       clib_warning("unknown_protocol");
 779                       return VNET_API_ERROR_INVALID_VALUE_2;
 780                     }
 781                   break;
 782                 }
 783             }
 784         }
 785
 786       m_key.addr = m->external_addr;
 787       m_key.port = m->external_port;
 788       m_key.protocol = m->proto;
 789       m_key.fib_index = sm->outside_fib_index;
 790       kv.key = m_key.as_u64;
 791       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0))
 792         {
 793           clib_warning ("static_mapping_by_external key del failed");
 794           return VNET_API_ERROR_UNSPECIFIED;
 795         }
 796       m_key.port = clib_host_to_net_u16 (m->external_port);
 797       kv.key = m_key.as_u64;
 798       if (clib_bihash_add_del_8_8(&sm->out2in, &kv, 0))
 799         {
 800           clib_warning ("outi2in key del failed");
 801           return VNET_API_ERROR_UNSPECIFIED;
 802         }
 803
 804       vec_foreach (local, m->locals)
 805         {
 806           m_key.addr = local->addr;
 807           m_key.port = local->port;
 808           m_key.fib_index = m->fib_index;
 809           kv.key = m_key.as_u64;
 810           if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
 811             {
 812               clib_warning ("static_mapping_by_local key del failed");
 813               return VNET_API_ERROR_UNSPECIFIED;
 814             }
 815           m_key.port = clib_host_to_net_u16 (local->port);
 816           kv.key = m_key.as_u64;
 817           if (clib_bihash_add_del_8_8(&sm->in2out, &kv, 0))
 818             {
 819               clib_warning ("in2out key del failed");
 820               return VNET_API_ERROR_UNSPECIFIED;
 821             }
 822         }
 823
 824       pool_put (sm->static_mappings, m);
 825     }
 826
 827   return 0;
 828 }
 829
 830 int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
 831 {
 832   snat_address_t *a = 0;
 833   snat_session_t *ses;
 834   u32 *ses_to_be_removed = 0, *ses_index;
 835   clib_bihash_kv_8_8_t kv, value;
 836   snat_user_key_t user_key;
 837   snat_user_t *u;
 838   snat_main_per_thread_data_t *tsm;
 839   snat_static_mapping_t *m;
 840   snat_interface_t *interface;
 841   int i;
 842
 843   /* Find SNAT address */
 844   for (i=0; i < vec_len (sm->addresses); i++)
 845     {
 846       if (sm->addresses[i].addr.as_u32 == addr.as_u32)
 847         {
 848           a = sm->addresses + i;
 849           break;
 850         }
 851     }
 852   if (!a)
 853     return VNET_API_ERROR_NO_SUCH_ENTRY;
 854
 855   if (delete_sm)
 856     {
 857       pool_foreach (m, sm->static_mappings,
 858       ({
 859           if (m->external_addr.as_u32 == addr.as_u32)
 860             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
 861                                             m->local_port, m->external_port,
 862                                             m->vrf_id, m->addr_only, ~0,
 863                                             m->proto, 0);
 864       }));
 865     }
 866   else
 867     {
 868       /* Check if address is used in some static mapping */
 869       if (is_snat_address_used_in_static_mapping(sm, addr))
 870         {
 871           clib_warning ("address used in static mapping");
 872           return VNET_API_ERROR_UNSPECIFIED;
 873         }
 874     }
 875
 876   if (a->fib_index != ~0)
 877     fib_table_unlock(a->fib_index, FIB_PROTOCOL_IP4);
 878
 879   /* Delete sessions using address */
 880   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
 881     {
 882       vec_foreach (tsm, sm->per_thread_data)
 883         {
 884           pool_foreach (ses, tsm->sessions, ({
 885             if (ses->out2in.addr.as_u32 == addr.as_u32)
 886               {
 887                 if (snat_is_unk_proto_session (ses))
 888                   {
 889                     clib_bihash_kv_16_8_t up_kv;
 890                     nat_ed_ses_key_t up_key;
 891                     up_key.l_addr = ses->in2out.addr;
 892                     up_key.r_addr = ses->ext_host_addr;
 893                     up_key.fib_index = ses->in2out.fib_index;
 894                     up_key.proto = ses->in2out.port;
 895                     up_key.rsvd = 0;
 896                     up_key.l_port = 0;
 897                     up_kv.key[0] = up_key.as_u64[0];
 898                     up_kv.key[1] = up_key.as_u64[1];
 899                     if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
 900                                                   &up_kv, 0))
 901                       clib_warning ("in2out key del failed");
 902
 903                     up_key.l_addr = ses->out2in.addr;
 904                     up_key.fib_index = ses->out2in.fib_index;
 905                     up_kv.key[0] = up_key.as_u64[0];
 906                     up_kv.key[1] = up_key.as_u64[1];
 907                     if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
 908                                                   &up_kv, 0))
 909                       clib_warning ("out2in key del failed");
 910                   }
 911                 else
 912                   {
 913                     /* log NAT event */
 914                     snat_ipfix_logging_nat44_ses_delete(ses->in2out.addr.as_u32,
 915                                                         ses->out2in.addr.as_u32,
 916                                                         ses->in2out.protocol,
 917                                                         ses->in2out.port,
 918                                                         ses->out2in.port,
 919                                                         ses->in2out.fib_index);
 920                     kv.key = ses->in2out.as_u64;
 921                     clib_bihash_add_del_8_8 (&sm->in2out, &kv, 0);
 922                     kv.key = ses->out2in.as_u64;
 923                     clib_bihash_add_del_8_8 (&sm->out2in, &kv, 0);
 924                   }
 925                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
 926                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
 927                 user_key.addr = ses->in2out.addr;
 928                 user_key.fib_index = ses->in2out.fib_index;
 929                 kv.key = user_key.as_u64;
 930                 if (!clib_bihash_search_8_8 (&sm->user_hash, &kv, &value))
 931                   {
 932                     u = pool_elt_at_index (tsm->users, value.value);
 933                     u->nsessions--;
 934                   }
 935               }
 936           }));
 937
 938           vec_foreach (ses_index, ses_to_be_removed)
 939             pool_put_index (tsm->sessions, ses_index[0]);
 940
 941           vec_free (ses_to_be_removed);
 942        }
 943     }
 944
 945   vec_del1 (sm->addresses, i);
 946
 947   /* Delete external address from FIB */
 948   pool_foreach (interface, sm->interfaces,
 949   ({
 950     if (interface->is_inside)
 951       continue;
 952
 953     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 954     break;
 955   }));
 956   pool_foreach (interface, sm->output_feature_interfaces,
 957   ({
 958     if (interface->is_inside)
 959       continue;
 960
 961     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 962     break;
 963   }));
 964
 965   return 0;
 966 }
 967
 968 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
 969 {
 970   snat_main_t *sm = &snat_main;
 971   snat_interface_t *i;
 972   const char * feature_name;
 973   snat_address_t * ap;
 974   snat_static_mapping_t * m;
 975   snat_det_map_t * dm;
 976
 977   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
 978     feature_name = is_inside ?  "nat44-in2out-fast" : "nat44-out2in-fast";
 979   else
 980     {
 981       if (sm->num_workers > 1 && !sm->deterministic)
 982         feature_name = is_inside ?  "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff";
 983       else if (sm->deterministic)
 984         feature_name = is_inside ?  "nat44-det-in2out" : "nat44-det-out2in";
 985       else
 986         feature_name = is_inside ?  "nat44-in2out" : "nat44-out2in";
 987     }
 988
 989   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
 990                                !is_del, 0, 0);
 991
 992   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 993     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, 0);
 994
 995   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 996     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
 997
 998   pool_foreach (i, sm->interfaces,
 999   ({
1000     if (i->sw_if_index == sw_if_index)
1001       {
1002         if (is_del)
1003           pool_put (sm->interfaces, i);
1004         else
1005           return VNET_API_ERROR_VALUE_EXIST;
1006
1007         goto fib;
1008       }
1009   }));
1010
1011   if (is_del)
1012     return VNET_API_ERROR_NO_SUCH_ENTRY;
1013
1014   pool_get (sm->interfaces, i);
1015   i->sw_if_index = sw_if_index;
1016   i->is_inside = is_inside;
1017
1018   /* Add/delete external addresses to FIB */
1019 fib:
1020   if (is_inside)
1021     return 0;
1022
1023   vec_foreach (ap, sm->addresses)
1024     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1025
1026   pool_foreach (m, sm->static_mappings,
1027   ({
1028     if (!(m->addr_only))
1029       continue;
1030
1031     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1032   }));
1033
1034   pool_foreach (dm, sm->det_maps,
1035   ({
1036     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1037   }));
1038
1039   return 0;
1040 }
1041
1042 int snat_interface_add_del_output_feature (u32 sw_if_index,
1043                                            u8 is_inside,
1044                                            int is_del)
1045 {
1046   snat_main_t *sm = &snat_main;
1047   snat_interface_t *i;
1048   snat_address_t * ap;
1049   snat_static_mapping_t * m;
1050
1051   if (sm->deterministic ||
1052       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1053     return VNET_API_ERROR_UNSUPPORTED;
1054
1055   if (is_inside)
1056     {
1057       vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1058                                    sw_if_index, !is_del, 0, 0);
1059       vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1060                                    sw_if_index, !is_del, 0, 0);
1061       goto fq;
1062     }
1063
1064   if (sm->num_workers > 1)
1065     {
1066       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in-worker-handoff",
1067                                    sw_if_index, !is_del, 0, 0);
1068       vnet_feature_enable_disable ("ip4-output",
1069                                    "nat44-in2out-output-worker-handoff",
1070                                    sw_if_index, !is_del, 0, 0);
1071     }
1072   else
1073     {
1074       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in", sw_if_index,
1075                                    !is_del, 0, 0);
1076       vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1077                                    sw_if_index, !is_del, 0, 0);
1078     }
1079
1080 fq:
1081   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1082     sm->fq_in2out_output_index =
1083       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1084
1085   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1086     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1087
1088   pool_foreach (i, sm->output_feature_interfaces,
1089   ({
1090     if (i->sw_if_index == sw_if_index)
1091       {
1092         if (is_del)
1093           pool_put (sm->output_feature_interfaces, i);
1094         else
1095           return VNET_API_ERROR_VALUE_EXIST;
1096
1097         goto fib;
1098       }
1099   }));
1100
1101   if (is_del)
1102     return VNET_API_ERROR_NO_SUCH_ENTRY;
1103
1104   pool_get (sm->output_feature_interfaces, i);
1105   i->sw_if_index = sw_if_index;
1106   i->is_inside = is_inside;
1107
1108   /* Add/delete external addresses to FIB */
1109 fib:
1110   if (is_inside)
1111     return 0;
1112
1113   vec_foreach (ap, sm->addresses)
1114     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1115
1116   pool_foreach (m, sm->static_mappings,
1117   ({
1118     if (!(m->addr_only))
1119       continue;
1120
1121     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1122   }));
1123
1124   return 0;
1125 }
1126
1127 int snat_set_workers (uword * bitmap)
1128 {
1129   snat_main_t *sm = &snat_main;
1130   int i, j = 0;
1131
1132   if (sm->num_workers < 2)
1133     return VNET_API_ERROR_FEATURE_DISABLED;
1134
1135   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1136     return VNET_API_ERROR_INVALID_WORKER;
1137
1138   vec_free (sm->workers);
1139   clib_bitmap_foreach (i, bitmap,
1140     ({
1141       vec_add1(sm->workers, i);
1142       sm->per_thread_data[i].snat_thread_index = j;
1143       j++;
1144     }));
1145
1146   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1147   sm->num_snat_thread = _vec_len (sm->workers);
1148
1149   return 0;
1150 }
1151
1152
1153 static void
1154 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1155                                        uword opaque,
1156                                        u32 sw_if_index,
1157                                        ip4_address_t * address,
1158                                        u32 address_length,
1159                                        u32 if_address_index,
1160                                        u32 is_delete);
1161
1162 static clib_error_t * snat_init (vlib_main_t * vm)
1163 {
1164   snat_main_t * sm = &snat_main;
1165   clib_error_t * error = 0;
1166   ip4_main_t * im = &ip4_main;
1167   ip_lookup_main_t * lm = &im->lookup_main;
1168   uword *p;
1169   vlib_thread_registration_t *tr;
1170   vlib_thread_main_t *tm = vlib_get_thread_main ();
1171   uword *bitmap = 0;
1172   u32 i;
1173   ip4_add_del_interface_address_callback_t cb4;
1174
1175   sm->vlib_main = vm;
1176   sm->vnet_main = vnet_get_main();
1177   sm->ip4_main = im;
1178   sm->ip4_lookup_main = lm;
1179   sm->api_main = &api_main;
1180   sm->first_worker_index = 0;
1181   sm->next_worker = 0;
1182   sm->num_workers = 0;
1183   sm->num_snat_thread = 1;
1184   sm->workers = 0;
1185   sm->port_per_thread = 0xffff - 1024;
1186   sm->fq_in2out_index = ~0;
1187   sm->fq_out2in_index = ~0;
1188   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1189   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1190   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1191   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1192
1193   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1194   if (p)
1195     {
1196       tr = (vlib_thread_registration_t *) p[0];
1197       if (tr)
1198         {
1199           sm->num_workers = tr->count;
1200           sm->first_worker_index = tr->first_index;
1201         }
1202     }
1203
1204   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1205
1206   /* Use all available workers by default */
1207   if (sm->num_workers > 1)
1208     {
1209       for (i=0; i < sm->num_workers; i++)
1210         bitmap = clib_bitmap_set (bitmap, i, 1);
1211       snat_set_workers(bitmap);
1212       clib_bitmap_free (bitmap);
1213     }
1214   else
1215     {
1216       sm->per_thread_data[0].snat_thread_index = 0;
1217     }
1218
1219   error = snat_api_init(vm, sm);
1220   if (error)
1221     return error;
1222
1223   /* Set up the interface address add/del callback */
1224   cb4.function = snat_ip4_add_del_interface_address_cb;
1225   cb4.function_opaque = 0;
1226
1227   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1228
1229   /* Init IPFIX logging */
1230   snat_ipfix_logging_init(vm);
1231
1232   error = nat64_init(vm);
1233
1234   return error;
1235 }
1236
1237 VLIB_INIT_FUNCTION (snat_init);
1238
1239 void snat_free_outside_address_and_port (snat_main_t * sm,
1240                                          snat_session_key_t * k,
1241                                          u32 address_index)
1242 {
1243   snat_address_t *a;
1244   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
1245
1246   ASSERT (address_index < vec_len (sm->addresses));
1247
1248   a = sm->addresses + address_index;
1249
1250   switch (k->protocol)
1251     {
1252 #define _(N, i, n, s) \
1253     case SNAT_PROTOCOL_##N: \
1254       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
1255         port_host_byte_order) == 1); \
1256       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
1257         port_host_byte_order, 0); \
1258       a->busy_##n##_ports--; \
1259       break;
1260       foreach_snat_protocol
1261 #undef _
1262     default:
1263       clib_warning("unknown_protocol");
1264       return;
1265     }
1266 }
1267
1268 /**
1269  * @brief Match NAT44 static mapping.
1270  *
1271  * @param sm          NAT main.
1272  * @param match       Address and port to match.
1273  * @param mapping     External or local address and port of the matched mapping.
1274  * @param by_external If 0 match by local address otherwise match by external
1275  *                    address.
1276  * @param is_addr_only If matched mapping is address only
1277  *
1278  * @returns 0 if match found otherwise 1.
1279  */
1280 int snat_static_mapping_match (snat_main_t * sm,
1281                                snat_session_key_t match,
1282                                snat_session_key_t * mapping,
1283                                u8 by_external,
1284                                u8 *is_addr_only)
1285 {
1286   clib_bihash_kv_8_8_t kv, value;
1287   snat_static_mapping_t *m;
1288   snat_session_key_t m_key;
1289   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
1290   u32 rand, lo = 0, hi, mid;
1291
1292   if (by_external)
1293     mapping_hash = &sm->static_mapping_by_external;
1294
1295   m_key.addr = match.addr;
1296   m_key.port = clib_net_to_host_u16 (match.port);
1297   m_key.protocol = match.protocol;
1298   m_key.fib_index = match.fib_index;
1299
1300   kv.key = m_key.as_u64;
1301
1302   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1303     {
1304       /* Try address only mapping */
1305       m_key.port = 0;
1306       m_key.protocol = 0;
1307       kv.key = m_key.as_u64;
1308       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1309         return 1;
1310     }
1311
1312   m = pool_elt_at_index (sm->static_mappings, value.value);
1313
1314   if (by_external)
1315     {
1316       if (vec_len (m->locals))
1317         {
1318           hi = vec_len (m->locals) - 1;
1319           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
1320           while (lo < hi)
1321             {
1322               mid = ((hi - 1) >> 1) + lo;
1323               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
1324             }
1325           if (!(m->locals[lo].prefix >= rand))
1326             return 1;
1327           mapping->addr = m->locals[lo].addr;
1328           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
1329         }
1330       else
1331         {
1332           mapping->addr = m->local_addr;
1333           /* Address only mapping doesn't change port */
1334           mapping->port = m->addr_only ? match.port
1335             : clib_host_to_net_u16 (m->local_port);
1336         }
1337       mapping->fib_index = m->fib_index;
1338       mapping->protocol = m->proto;
1339     }
1340   else
1341     {
1342       mapping->addr = m->external_addr;
1343       /* Address only mapping doesn't change port */
1344       mapping->port = m->addr_only ? match.port
1345         : clib_host_to_net_u16 (m->external_port);
1346       mapping->fib_index = sm->outside_fib_index;
1347     }
1348
1349   if (PREDICT_FALSE(is_addr_only != 0))
1350     *is_addr_only = m->addr_only;
1351
1352   return 0;
1353 }
1354
1355 static_always_inline u16
1356 snat_random_port (snat_main_t * sm, u16 min, u16 max)
1357 {
1358   return min + random_u32 (&sm->random_seed) /
1359     (random_u32_max() / (max - min + 1) + 1);
1360 }
1361
1362 int snat_alloc_outside_address_and_port (snat_main_t * sm,
1363                                          u32 fib_index,
1364                                          u32 thread_index,
1365                                          snat_session_key_t * k,
1366                                          u32 * address_indexp)
1367 {
1368   int i;
1369   snat_address_t *a;
1370   u32 portnum;
1371
1372   for (i = 0; i < vec_len (sm->addresses); i++)
1373     {
1374       a = sm->addresses + i;
1375       if (sm->vrf_mode && a->fib_index != ~0 && a->fib_index != fib_index)
1376         continue;
1377       switch (k->protocol)
1378         {
1379 #define _(N, j, n, s) \
1380         case SNAT_PROTOCOL_##N: \
1381           if (a->busy_##n##_ports < (sm->port_per_thread * sm->num_snat_thread)) \
1382             { \
1383               while (1) \
1384                 { \
1385                   portnum = (sm->port_per_thread * \
1386                     sm->per_thread_data[thread_index].snat_thread_index) + \
1387                     snat_random_port(sm, 0, sm->port_per_thread) + 1024; \
1388                   if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
1389                     continue; \
1390                   clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
1391                   a->busy_##n##_ports++; \
1392                   k->addr = a->addr; \
1393                   k->port = clib_host_to_net_u16(portnum); \
1394                   *address_indexp = i; \
1395                   return 0; \
1396                 } \
1397             } \
1398           break;
1399           foreach_snat_protocol
1400 #undef _
1401         default:
1402           clib_warning("unknown protocol");
1403           return 1;
1404         }
1405
1406     }
1407   /* Totally out of translations to use... */
1408   snat_ipfix_logging_addresses_exhausted(0);
1409   return 1;
1410 }
1411
1412
1413 static clib_error_t *
1414 add_address_command_fn (vlib_main_t * vm,
1415                         unformat_input_t * input,
1416                         vlib_cli_command_t * cmd)
1417 {
1418   unformat_input_t _line_input, *line_input = &_line_input;
1419   snat_main_t * sm = &snat_main;
1420   ip4_address_t start_addr, end_addr, this_addr;
1421   u32 start_host_order, end_host_order;
1422   u32 vrf_id = ~0;
1423   int i, count;
1424   int is_add = 1;
1425   int rv = 0;
1426   clib_error_t *error = 0;
1427
1428   /* Get a line of input. */
1429   if (!unformat_user (input, unformat_line_input, line_input))
1430     return 0;
1431
1432   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1433     {
1434       if (unformat (line_input, "%U - %U",
1435                     unformat_ip4_address, &start_addr,
1436                     unformat_ip4_address, &end_addr))
1437         ;
1438       else if (unformat (line_input, "tenant-vrf %u", &vrf_id))
1439         ;
1440       else if (unformat (line_input, "%U", unformat_ip4_address, &start_addr))
1441         end_addr = start_addr;
1442       else if (unformat (line_input, "del"))
1443         is_add = 0;
1444       else
1445         {
1446           error = clib_error_return (0, "unknown input '%U'",
1447             format_unformat_error, line_input);
1448           goto done;
1449         }
1450      }
1451
1452   if (sm->static_mapping_only)
1453     {
1454       error = clib_error_return (0, "static mapping only mode");
1455       goto done;
1456     }
1457
1458   start_host_order = clib_host_to_net_u32 (start_addr.as_u32);
1459   end_host_order = clib_host_to_net_u32 (end_addr.as_u32);
1460
1461   if (end_host_order < start_host_order)
1462     {
1463       error = clib_error_return (0, "end address less than start address");
1464       goto done;
1465     }
1466
1467   count = (end_host_order - start_host_order) + 1;
1468
1469   if (count > 1024)
1470     clib_warning ("%U - %U, %d addresses...",
1471                   format_ip4_address, &start_addr,
1472                   format_ip4_address, &end_addr,
1473                   count);
1474
1475   this_addr = start_addr;
1476
1477   for (i = 0; i < count; i++)
1478     {
1479       if (is_add)
1480         snat_add_address (sm, &this_addr, vrf_id);
1481       else
1482         rv = snat_del_address (sm, this_addr, 0);
1483
1484       switch (rv)
1485         {
1486         case VNET_API_ERROR_NO_SUCH_ENTRY:
1487           error = clib_error_return (0, "S-NAT address not exist.");
1488           goto done;
1489         case VNET_API_ERROR_UNSPECIFIED:
1490           error = clib_error_return (0, "S-NAT address used in static mapping.");
1491           goto done;
1492         default:
1493           break;
1494         }
1495
1496       increment_v4_address (&this_addr);
1497     }
1498
1499 done:
1500   unformat_free (line_input);
1501
1502   return error;
1503 }
1504
1505 VLIB_CLI_COMMAND (add_address_command, static) = {
1506   .path = "nat44 add address",
1507   .short_help = "nat44 add address <ip4-range-start> [- <ip4-range-end>] "
1508                 "[tenant-vrf <vrf-id>] [del]",
1509   .function = add_address_command_fn,
1510 };
1511
1512 static clib_error_t *
1513 snat_feature_command_fn (vlib_main_t * vm,
1514                           unformat_input_t * input,
1515                           vlib_cli_command_t * cmd)
1516 {
1517   unformat_input_t _line_input, *line_input = &_line_input;
1518   vnet_main_t * vnm = vnet_get_main();
1519   clib_error_t * error = 0;
1520   u32 sw_if_index;
1521   u32 * inside_sw_if_indices = 0;
1522   u32 * outside_sw_if_indices = 0;
1523   u8 is_output_feature = 0;
1524   int is_del = 0;
1525   int i;
1526
1527   sw_if_index = ~0;
1528
1529   /* Get a line of input. */
1530   if (!unformat_user (input, unformat_line_input, line_input))
1531     return 0;
1532
1533   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1534     {
1535       if (unformat (line_input, "in %U", unformat_vnet_sw_interface,
1536                     vnm, &sw_if_index))
1537         vec_add1 (inside_sw_if_indices, sw_if_index);
1538       else if (unformat (line_input, "out %U", unformat_vnet_sw_interface,
1539                          vnm, &sw_if_index))
1540         vec_add1 (outside_sw_if_indices, sw_if_index);
1541       else if (unformat (line_input, "output-feature"))
1542         is_output_feature = 1;
1543       else if (unformat (line_input, "del"))
1544         is_del = 1;
1545       else
1546         {
1547           error = clib_error_return (0, "unknown input '%U'",
1548             format_unformat_error, line_input);
1549           goto done;
1550         }
1551     }
1552
1553   if (vec_len (inside_sw_if_indices))
1554     {
1555       for (i = 0; i < vec_len(inside_sw_if_indices); i++)
1556         {
1557           sw_if_index = inside_sw_if_indices[i];
1558           if (is_output_feature)
1559             {
1560               if (snat_interface_add_del_output_feature (sw_if_index, 1, is_del))
1561                 {
1562                   error = clib_error_return (0, "%s %U failed",
1563                                              is_del ? "del" : "add",
1564                                              format_vnet_sw_interface_name, vnm,
1565                                              vnet_get_sw_interface (vnm,
1566                                                                     sw_if_index));
1567                   goto done;
1568                 }
1569             }
1570           else
1571             {
1572               if (snat_interface_add_del (sw_if_index, 1, is_del))
1573                 {
1574                   error = clib_error_return (0, "%s %U failed",
1575                                              is_del ? "del" : "add",
1576                                              format_vnet_sw_interface_name, vnm,
1577                                              vnet_get_sw_interface (vnm,
1578                                                                     sw_if_index));
1579                   goto done;
1580                 }
1581             }
1582         }
1583     }
1584
1585   if (vec_len (outside_sw_if_indices))
1586     {
1587       for (i = 0; i < vec_len(outside_sw_if_indices); i++)
1588         {
1589           sw_if_index = outside_sw_if_indices[i];
1590           if (is_output_feature)
1591             {
1592               if (snat_interface_add_del_output_feature (sw_if_index, 0, is_del))
1593                 {
1594                   error = clib_error_return (0, "%s %U failed",
1595                                              is_del ? "del" : "add",
1596                                              format_vnet_sw_interface_name, vnm,
1597                                              vnet_get_sw_interface (vnm,
1598                                                                     sw_if_index));
1599                   goto done;
1600                 }
1601             }
1602           else
1603             {
1604               if (snat_interface_add_del (sw_if_index, 0, is_del))
1605                 {
1606                   error = clib_error_return (0, "%s %U failed",
1607                                              is_del ? "del" : "add",
1608                                              format_vnet_sw_interface_name, vnm,
1609                                              vnet_get_sw_interface (vnm,
1610                                                                     sw_if_index));
1611                   goto done;
1612                 }
1613             }
1614         }
1615     }
1616
1617 done:
1618   unformat_free (line_input);
1619   vec_free (inside_sw_if_indices);
1620   vec_free (outside_sw_if_indices);
1621
1622   return error;
1623 }
1624
1625 VLIB_CLI_COMMAND (set_interface_snat_command, static) = {
1626   .path = "set interface nat44",
1627   .function = snat_feature_command_fn,
1628   .short_help = "set interface nat44 in <intfc> out <intfc> [output-feature] "
1629                 "[del]",
1630 };
1631
1632 uword
1633 unformat_snat_protocol (unformat_input_t * input, va_list * args)
1634 {
1635   u32 *r = va_arg (*args, u32 *);
1636
1637   if (0);
1638 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
1639   foreach_snat_protocol
1640 #undef _
1641   else
1642     return 0;
1643   return 1;
1644 }
1645
1646 u8 *
1647 format_snat_protocol (u8 * s, va_list * args)
1648 {
1649   u32 i = va_arg (*args, u32);
1650   u8 *t = 0;
1651
1652   switch (i)
1653     {
1654 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
1655       foreach_snat_protocol
1656 #undef _
1657     default:
1658       s = format (s, "unknown");
1659       return s;
1660     }
1661   s = format (s, "%s", t);
1662   return s;
1663 }
1664
1665 static clib_error_t *
1666 add_static_mapping_command_fn (vlib_main_t * vm,
1667                                unformat_input_t * input,
1668                                vlib_cli_command_t * cmd)
1669 {
1670   unformat_input_t _line_input, *line_input = &_line_input;
1671   clib_error_t * error = 0;
1672   ip4_address_t l_addr, e_addr;
1673   u32 l_port = 0, e_port = 0, vrf_id = ~0;
1674   int is_add = 1;
1675   int addr_only = 1;
1676   u32 sw_if_index = ~0;
1677   vnet_main_t * vnm = vnet_get_main();
1678   int rv;
1679   snat_protocol_t proto;
1680   u8 proto_set = 0;
1681
1682   /* Get a line of input. */
1683   if (!unformat_user (input, unformat_line_input, line_input))
1684     return 0;
1685
1686   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1687     {
1688       if (unformat (line_input, "local %U %u", unformat_ip4_address, &l_addr,
1689                     &l_port))
1690         addr_only = 0;
1691       else if (unformat (line_input, "local %U", unformat_ip4_address, &l_addr))
1692         ;
1693       else if (unformat (line_input, "external %U %u", unformat_ip4_address,
1694                          &e_addr, &e_port))
1695         addr_only = 0;
1696       else if (unformat (line_input, "external %U", unformat_ip4_address,
1697                          &e_addr))
1698         ;
1699       else if (unformat (line_input, "external %U %u",
1700                          unformat_vnet_sw_interface, vnm, &sw_if_index,
1701                          &e_port))
1702         addr_only = 0;
1703
1704       else if (unformat (line_input, "external %U",
1705                          unformat_vnet_sw_interface, vnm, &sw_if_index))
1706         ;
1707       else if (unformat (line_input, "vrf %u", &vrf_id))
1708         ;
1709       else if (unformat (line_input, "%U", unformat_snat_protocol, &proto))
1710         proto_set = 1;
1711       else if (unformat (line_input, "del"))
1712         is_add = 0;
1713       else
1714         {
1715           error = clib_error_return (0, "unknown input: '%U'",
1716             format_unformat_error, line_input);
1717           goto done;
1718         }
1719     }
1720
1721   if (!addr_only && !proto_set)
1722     {
1723       error = clib_error_return (0, "missing protocol");
1724       goto done;
1725     }
1726
1727   rv = snat_add_static_mapping(l_addr, e_addr, (u16) l_port, (u16) e_port,
1728                                vrf_id, addr_only, sw_if_index, proto, is_add);
1729
1730   switch (rv)
1731     {
1732     case VNET_API_ERROR_INVALID_VALUE:
1733       error = clib_error_return (0, "External port already in use.");
1734       goto done;
1735     case VNET_API_ERROR_NO_SUCH_ENTRY:
1736       if (is_add)
1737         error = clib_error_return (0, "External addres must be allocated.");
1738       else
1739         error = clib_error_return (0, "Mapping not exist.");
1740       goto done;
1741     case VNET_API_ERROR_NO_SUCH_FIB:
1742       error = clib_error_return (0, "No such VRF id.");
1743       goto done;
1744     case VNET_API_ERROR_VALUE_EXIST:
1745       error = clib_error_return (0, "Mapping already exist.");
1746       goto done;
1747     default:
1748       break;
1749     }
1750
1751 done:
1752   unformat_free (line_input);
1753
1754   return error;
1755 }
1756
1757 /*?
1758  * @cliexpar
1759  * @cliexstart{snat add static mapping}
1760  * Static mapping allows hosts on the external network to initiate connection
1761  * to to the local network host.
1762  * To create static mapping between local host address 10.0.0.3 port 6303 and
1763  * external address 4.4.4.4 port 3606 for TCP protocol use:
1764  *  vpp# nat44 add static mapping tcp local 10.0.0.3 6303 external 4.4.4.4 3606
1765  * If not runnig "static mapping only" NAT plugin mode use before:
1766  *  vpp# nat44 add address 4.4.4.4
1767  * To create static mapping between local and external address use:
1768  *  vpp# nat44 add static mapping local 10.0.0.3 external 4.4.4.4
1769  * @cliexend
1770 ?*/
1771 VLIB_CLI_COMMAND (add_static_mapping_command, static) = {
1772   .path = "nat44 add static mapping",
1773   .function = add_static_mapping_command_fn,
1774   .short_help =
1775     "nat44 add static mapping tcp|udp|icmp local <addr> [<port>] external <addr> [<port>] [vrf <table-id>] [del]",
1776 };
1777
1778 static clib_error_t *
1779 add_lb_static_mapping_command_fn (vlib_main_t * vm,
1780                                   unformat_input_t * input,
1781                                   vlib_cli_command_t * cmd)
1782 {
1783   unformat_input_t _line_input, *line_input = &_line_input;
1784   clib_error_t * error = 0;
1785   ip4_address_t l_addr, e_addr;
1786   u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0;
1787   int is_add = 1;
1788   int rv;
1789   snat_protocol_t proto;
1790   u8 proto_set = 0;
1791   nat44_lb_addr_port_t *locals = 0, local;
1792
1793   /* Get a line of input. */
1794   if (!unformat_user (input, unformat_line_input, line_input))
1795     return 0;
1796
1797   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1798     {
1799       if (unformat (line_input, "local %U:%u probability %u",
1800                     unformat_ip4_address, &l_addr, &l_port, &probability))
1801         {
1802           memset (&local, 0, sizeof (local));
1803           local.addr = l_addr;
1804           local.port = (u16) l_port;
1805           local.probability = (u8) probability;
1806           vec_add1 (locals, local);
1807         }
1808       else if (unformat (line_input, "external %U:%u", unformat_ip4_address,
1809                          &e_addr, &e_port))
1810         ;
1811       else if (unformat (line_input, "vrf %u", &vrf_id))
1812         ;
1813       else if (unformat (line_input, "protocol %U", unformat_snat_protocol,
1814                          &proto))
1815         proto_set = 1;
1816       else if (unformat (line_input, "del"))
1817         is_add = 0;
1818       else
1819         {
1820           error = clib_error_return (0, "unknown input: '%U'",
1821             format_unformat_error, line_input);
1822           goto done;
1823         }
1824     }
1825
1826   if (vec_len (locals) < 2)
1827     {
1828       error = clib_error_return (0, "at least two local must be set");
1829       goto done;
1830     }
1831
1832   if (!proto_set)
1833     {
1834       error = clib_error_return (0, "missing protocol");
1835       goto done;
1836     }
1837
1838   rv = nat44_add_del_lb_static_mapping (e_addr, (u16) e_port, proto, vrf_id,
1839                                         locals, is_add);
1840
1841   switch (rv)
1842     {
1843     case VNET_API_ERROR_INVALID_VALUE:
1844       error = clib_error_return (0, "External port already in use.");
1845       goto done;
1846     case VNET_API_ERROR_NO_SUCH_ENTRY:
1847       if (is_add)
1848         error = clib_error_return (0, "External addres must be allocated.");
1849       else
1850         error = clib_error_return (0, "Mapping not exist.");
1851       goto done;
1852     case VNET_API_ERROR_VALUE_EXIST:
1853       error = clib_error_return (0, "Mapping already exist.");
1854       goto done;
1855     default:
1856       break;
1857     }
1858
1859 done:
1860   unformat_free (line_input);
1861   vec_free (locals);
1862
1863   return error;
1864 }
1865
1866 VLIB_CLI_COMMAND (add_lb_static_mapping_command, static) = {
1867   .path = "nat44 add load-balancing static mapping",
1868   .function = add_lb_static_mapping_command_fn,
1869   .short_help =
1870     "nat44 add load-balancing static mapping protocol tcp|udp external <addr>:<port> local <addr>:<port> probability <n> [vrf <table-id>] [del]",
1871 };
1872
1873 static clib_error_t *
1874 set_workers_command_fn (vlib_main_t * vm,
1875                         unformat_input_t * input,
1876                         vlib_cli_command_t * cmd)
1877 {
1878   unformat_input_t _line_input, *line_input = &_line_input;
1879   uword *bitmap = 0;
1880   int rv = 0;
1881   clib_error_t *error = 0;
1882
1883   /* Get a line of input. */
1884   if (!unformat_user (input, unformat_line_input, line_input))
1885     return 0;
1886
1887   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1888     {
1889       if (unformat (line_input, "%U", unformat_bitmap_list, &bitmap))
1890         ;
1891       else
1892         {
1893           error = clib_error_return (0, "unknown input '%U'",
1894             format_unformat_error, line_input);
1895           goto done;
1896         }
1897      }
1898
1899   if (bitmap == 0)
1900     {
1901       error = clib_error_return (0, "List of workers must be specified.");
1902       goto done;
1903     }
1904
1905   rv = snat_set_workers(bitmap);
1906
1907   clib_bitmap_free (bitmap);
1908
1909   switch (rv)
1910     {
1911     case VNET_API_ERROR_INVALID_WORKER:
1912       error = clib_error_return (0, "Invalid worker(s).");
1913       goto done;
1914     case VNET_API_ERROR_FEATURE_DISABLED:
1915       error = clib_error_return (0,
1916         "Supported only if 2 or more workes available.");
1917       goto done;
1918     default:
1919       break;
1920     }
1921
1922 done:
1923   unformat_free (line_input);
1924
1925   return error;
1926 }
1927
1928 /*?
1929  * @cliexpar
1930  * @cliexstart{set snat workers}
1931  * Set NAT workers if 2 or more workers available, use:
1932  *  vpp# set snat workers 0-2,5
1933  * @cliexend
1934 ?*/
1935 VLIB_CLI_COMMAND (set_workers_command, static) = {
1936   .path = "set nat workers",
1937   .function = set_workers_command_fn,
1938   .short_help =
1939     "set nat workers <workers-list>",
1940 };
1941
1942 static clib_error_t *
1943 snat_ipfix_logging_enable_disable_command_fn (vlib_main_t * vm,
1944                                               unformat_input_t * input,
1945                                               vlib_cli_command_t * cmd)
1946 {
1947   unformat_input_t _line_input, *line_input = &_line_input;
1948   u32 domain_id = 0;
1949   u32 src_port = 0;
1950   u8 enable = 1;
1951   int rv = 0;
1952   clib_error_t *error = 0;
1953
1954   /* Get a line of input. */
1955   if (!unformat_user (input, unformat_line_input, line_input))
1956     return 0;
1957
1958   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1959     {
1960       if (unformat (line_input, "domain %d", &domain_id))
1961         ;
1962       else if (unformat (line_input, "src-port %d", &src_port))
1963         ;
1964       else if (unformat (line_input, "disable"))
1965         enable = 0;
1966       else
1967         {
1968           error = clib_error_return (0, "unknown input '%U'",
1969             format_unformat_error, line_input);
1970           goto done;
1971         }
1972      }
1973
1974   rv = snat_ipfix_logging_enable_disable (enable, domain_id, (u16) src_port);
1975
1976   if (rv)
1977     {
1978       error = clib_error_return (0, "ipfix logging enable failed");
1979       goto done;
1980     }
1981
1982 done:
1983   unformat_free (line_input);
1984
1985   return error;
1986 }
1987
1988 /*?
1989  * @cliexpar
1990  * @cliexstart{snat ipfix logging}
1991  * To enable NAT IPFIX logging use:
1992  *  vpp# nat ipfix logging
1993  * To set IPFIX exporter use:
1994  *  vpp# set ipfix exporter collector 10.10.10.3 src 10.10.10.1
1995  * @cliexend
1996 ?*/
1997 VLIB_CLI_COMMAND (snat_ipfix_logging_enable_disable_command, static) = {
1998   .path = "nat ipfix logging",
1999   .function = snat_ipfix_logging_enable_disable_command_fn,
2000   .short_help = "nat ipfix logging [domain <domain-id>] [src-port <port>] [disable]",
2001 };
2002
2003 static u32
2004 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2005 {
2006   snat_main_t *sm = &snat_main;
2007   snat_user_key_t key0;
2008   clib_bihash_kv_8_8_t kv0, value0;
2009   u32 next_worker_index = 0;
2010
2011   key0.addr = ip0->src_address;
2012   key0.fib_index = rx_fib_index0;
2013
2014   kv0.key = key0.as_u64;
2015
2016   /* Ever heard of of the "user" before? */
2017   if (clib_bihash_search_8_8 (&sm->worker_by_in, &kv0, &value0))
2018     {
2019       /* No, assign next available worker (RR) */
2020       next_worker_index = sm->first_worker_index;
2021       if (vec_len (sm->workers))
2022         {
2023           next_worker_index +=
2024             sm->workers[sm->next_worker++ % _vec_len (sm->workers)];
2025         }
2026
2027       /* add non-traslated packets worker lookup */
2028       kv0.value = next_worker_index;
2029       clib_bihash_add_del_8_8 (&sm->worker_by_in, &kv0, 1);
2030     }
2031   else
2032     next_worker_index = value0.value;
2033
2034   return next_worker_index;
2035 }
2036
2037 static u32
2038 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2039 {
2040   snat_main_t *sm = &snat_main;
2041   snat_worker_key_t key0;
2042   clib_bihash_kv_8_8_t kv0, value0;
2043   udp_header_t * udp0;
2044   u32 next_worker_index = 0;
2045
2046   udp0 = ip4_next_header (ip0);
2047
2048   key0.addr = ip0->dst_address;
2049   key0.port = udp0->dst_port;
2050   key0.fib_index = rx_fib_index0;
2051
2052   if (PREDICT_FALSE(ip0->protocol == IP_PROTOCOL_ICMP))
2053     {
2054       icmp46_header_t * icmp0 = (icmp46_header_t *) udp0;
2055       icmp_echo_header_t *echo0 = (icmp_echo_header_t *)(icmp0+1);
2056       key0.port = echo0->identifier;
2057     }
2058
2059   kv0.key = key0.as_u64;
2060
2061   /* Ever heard of of the "user" before? */
2062   if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
2063     {
2064       key0.port = 0;
2065       kv0.key = key0.as_u64;
2066
2067       if (clib_bihash_search_8_8 (&sm->worker_by_out, &kv0, &value0))
2068         {
2069           /* No, assign next available worker (RR) */
2070           next_worker_index = sm->first_worker_index;
2071           if (vec_len (sm->workers))
2072             {
2073               next_worker_index +=
2074                 sm->workers[sm->next_worker++ % _vec_len (sm->workers)];
2075             }
2076         }
2077       else
2078         {
2079           /* Static mapping without port */
2080           next_worker_index = value0.value;
2081         }
2082
2083       /* Add to translated packets worker lookup */
2084       kv0.value = next_worker_index;
2085       clib_bihash_add_del_8_8 (&sm->worker_by_out, &kv0, 1);
2086     }
2087   else
2088     next_worker_index = value0.value;
2089
2090   return next_worker_index;
2091 }
2092
2093 static clib_error_t *
2094 snat_config (vlib_main_t * vm, unformat_input_t * input)
2095 {
2096   snat_main_t * sm = &snat_main;
2097   u32 translation_buckets = 1024;
2098   u32 translation_memory_size = 128<<20;
2099   u32 user_buckets = 128;
2100   u32 user_memory_size = 64<<20;
2101   u32 max_translations_per_user = 100;
2102   u32 outside_vrf_id = 0;
2103   u32 inside_vrf_id = 0;
2104   u32 static_mapping_buckets = 1024;
2105   u32 static_mapping_memory_size = 64<<20;
2106   u8 static_mapping_only = 0;
2107   u8 static_mapping_connection_tracking = 0;
2108
2109   sm->deterministic = 0;
2110
2111   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2112     {
2113       if (unformat (input, "translation hash buckets %d", &translation_buckets))
2114         ;
2115       else if (unformat (input, "translation hash memory %d",
2116                          &translation_memory_size));
2117       else if (unformat (input, "user hash buckets %d", &user_buckets))
2118         ;
2119       else if (unformat (input, "user hash memory %d",
2120                          &user_memory_size))
2121         ;
2122       else if (unformat (input, "max translations per user %d",
2123                          &max_translations_per_user))
2124         ;
2125       else if (unformat (input, "outside VRF id %d",
2126                          &outside_vrf_id))
2127         ;
2128       else if (unformat (input, "inside VRF id %d",
2129                          &inside_vrf_id))
2130         ;
2131       else if (unformat (input, "static mapping only"))
2132         {
2133           static_mapping_only = 1;
2134           if (unformat (input, "connection tracking"))
2135             static_mapping_connection_tracking = 1;
2136         }
2137       else if (unformat (input, "deterministic"))
2138         sm->deterministic = 1;
2139       else
2140         return clib_error_return (0, "unknown input '%U'",
2141                                   format_unformat_error, input);
2142     }
2143
2144   /* for show commands, etc. */
2145   sm->translation_buckets = translation_buckets;
2146   sm->translation_memory_size = translation_memory_size;
2147   sm->user_buckets = user_buckets;
2148   sm->user_memory_size = user_memory_size;
2149   sm->max_translations_per_user = max_translations_per_user;
2150   sm->outside_vrf_id = outside_vrf_id;
2151   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2152                                                              outside_vrf_id);
2153   sm->inside_vrf_id = inside_vrf_id;
2154   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2155                                                             inside_vrf_id);
2156   sm->static_mapping_only = static_mapping_only;
2157   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
2158
2159   if (sm->deterministic)
2160     {
2161       sm->in2out_node_index = snat_det_in2out_node.index;
2162       sm->in2out_output_node_index = ~0;
2163       sm->out2in_node_index = snat_det_out2in_node.index;
2164       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
2165       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
2166     }
2167   else
2168     {
2169       sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2170       sm->worker_out2in_cb = snat_get_worker_out2in_cb;
2171       sm->in2out_node_index = snat_in2out_node.index;
2172       sm->in2out_output_node_index = snat_in2out_output_node.index;
2173       sm->out2in_node_index = snat_out2in_node.index;
2174       if (!static_mapping_only ||
2175           (static_mapping_only && static_mapping_connection_tracking))
2176         {
2177           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
2178           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
2179
2180           clib_bihash_init_8_8 (&sm->worker_by_in, "worker-by-in", user_buckets,
2181                                 user_memory_size);
2182
2183           clib_bihash_init_8_8 (&sm->worker_by_out, "worker-by-out", user_buckets,
2184                                 user_memory_size);
2185
2186           clib_bihash_init_8_8 (&sm->in2out, "in2out", translation_buckets,
2187                                 translation_memory_size);
2188
2189           clib_bihash_init_8_8 (&sm->out2in, "out2in", translation_buckets,
2190                                 translation_memory_size);
2191
2192           clib_bihash_init_8_8 (&sm->user_hash, "users", user_buckets,
2193                                 user_memory_size);
2194
2195           clib_bihash_init_16_8 (&sm->in2out_ed, "in2out-ed",
2196                                  translation_buckets, translation_memory_size);
2197
2198           clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
2199                                  translation_buckets, translation_memory_size);
2200         }
2201       else
2202         {
2203           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
2204           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
2205         }
2206       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
2207                             "static_mapping_by_local", static_mapping_buckets,
2208                             static_mapping_memory_size);
2209
2210       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
2211                             "static_mapping_by_external", static_mapping_buckets,
2212                             static_mapping_memory_size);
2213     }
2214
2215   return 0;
2216 }
2217
2218 VLIB_CONFIG_FUNCTION (snat_config, "nat");
2219
2220 u8 * format_snat_session_state (u8 * s, va_list * args)
2221 {
2222   u32 i = va_arg (*args, u32);
2223   u8 *t = 0;
2224
2225   switch (i)
2226     {
2227 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
2228     foreach_snat_session_state
2229 #undef _
2230     default:
2231       t = format (t, "unknown");
2232     }
2233   s = format (s, "%s", t);
2234   return s;
2235 }
2236
2237 u8 * format_snat_key (u8 * s, va_list * args)
2238 {
2239   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
2240
2241   s = format (s, "%U proto %U port %d fib %d",
2242               format_ip4_address, &key->addr,
2243               format_snat_protocol, key->protocol,
2244               clib_net_to_host_u16 (key->port), key->fib_index);
2245   return s;
2246 }
2247
2248 u8 * format_snat_session (u8 * s, va_list * args)
2249 {
2250   snat_main_t * sm __attribute__((unused)) = va_arg (*args, snat_main_t *);
2251   snat_session_t * sess = va_arg (*args, snat_session_t *);
2252
2253   if (snat_is_unk_proto_session (sess))
2254     {
2255       s = format (s, "  i2o %U proto %u fib %u\n",
2256                   format_ip4_address, &sess->in2out.addr, sess->in2out.port,
2257                   sess->in2out.fib_index);
2258       s = format (s, "    o2i %U proto %u fib %u\n",
2259                   format_ip4_address, &sess->out2in.addr, sess->out2in.port,
2260                   sess->out2in.fib_index);
2261     }
2262   else
2263     {
2264       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
2265       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
2266     }
2267   if (sess->ext_host_addr.as_u32)
2268       s = format (s, "       external host %U\n",
2269                   format_ip4_address, &sess->ext_host_addr);
2270   s = format (s, "       last heard %.2f\n", sess->last_heard);
2271   s = format (s, "       total pkts %d, total bytes %lld\n",
2272               sess->total_pkts, sess->total_bytes);
2273   if (snat_is_session_static (sess))
2274     s = format (s, "       static translation\n");
2275   else
2276     s = format (s, "       dynamic translation\n");
2277   if (sess->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
2278     s = format (s, "       load-balancing\n");
2279
2280   return s;
2281 }
2282
2283 u8 * format_snat_user (u8 * s, va_list * args)
2284 {
2285   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
2286   snat_user_t * u = va_arg (*args, snat_user_t *);
2287   int verbose = va_arg (*args, int);
2288   dlist_elt_t * head, * elt;
2289   u32 elt_index, head_index;
2290   u32 session_index;
2291   snat_session_t * sess;
2292
2293   s = format (s, "%U: %d dynamic translations, %d static translations\n",
2294               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
2295
2296   if (verbose == 0)
2297     return s;
2298
2299   if (u->nsessions || u->nstaticsessions)
2300     {
2301       head_index = u->sessions_per_user_list_head_index;
2302       head = pool_elt_at_index (sm->list_pool, head_index);
2303
2304       elt_index = head->next;
2305       elt = pool_elt_at_index (sm->list_pool, elt_index);
2306       session_index = elt->value;
2307
2308       while (session_index != ~0)
2309         {
2310           sess = pool_elt_at_index (sm->sessions, session_index);
2311
2312           s = format (s, "  %U\n", format_snat_session, sm, sess);
2313
2314           elt_index = elt->next;
2315           elt = pool_elt_at_index (sm->list_pool, elt_index);
2316           session_index = elt->value;
2317         }
2318     }
2319
2320   return s;
2321 }
2322
2323 u8 * format_snat_static_mapping (u8 * s, va_list * args)
2324 {
2325   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
2326   nat44_lb_addr_port_t *local;
2327
2328   if (m->addr_only)
2329       s = format (s, "local %U external %U vrf %d",
2330                   format_ip4_address, &m->local_addr,
2331                   format_ip4_address, &m->external_addr,
2332                   m->vrf_id);
2333   else
2334    {
2335       if (vec_len (m->locals))
2336         {
2337           s = format (s, "%U vrf %d external %U:%d",
2338                       format_snat_protocol, m->proto,
2339                       m->vrf_id,
2340                       format_ip4_address, &m->external_addr, m->external_port);
2341           vec_foreach (local, m->locals)
2342             s = format (s, "\n  local %U:%d probability %d\%",
2343                         format_ip4_address, &local->addr, local->port,
2344                         local->probability);
2345         }
2346       else
2347         s = format (s, "%U local %U:%d external %U:%d vrf %d",
2348                     format_snat_protocol, m->proto,
2349                     format_ip4_address, &m->local_addr, m->local_port,
2350                     format_ip4_address, &m->external_addr, m->external_port,
2351                     m->vrf_id);
2352    }
2353   return s;
2354 }
2355
2356 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
2357 {
2358   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
2359   vnet_main_t *vnm = vnet_get_main();
2360
2361   if (m->addr_only)
2362       s = format (s, "local %U external %U vrf %d",
2363                   format_ip4_address, &m->l_addr,
2364                   format_vnet_sw_interface_name, vnm,
2365                   vnet_get_sw_interface (vnm, m->sw_if_index),
2366                   m->vrf_id);
2367   else
2368       s = format (s, "%U local %U:%d external %U:%d vrf %d",
2369                   format_snat_protocol, m->proto,
2370                   format_ip4_address, &m->l_addr, m->l_port,
2371                   format_vnet_sw_interface_name, vnm,
2372                   vnet_get_sw_interface (vnm, m->sw_if_index), m->e_port,
2373                   m->vrf_id);
2374
2375   return s;
2376 }
2377
2378 u8 * format_det_map_ses (u8 * s, va_list * args)
2379 {
2380   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
2381   ip4_address_t in_addr, out_addr;
2382   u32 in_offset, out_offset;
2383   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
2384   u32 * i = va_arg (*args, u32 *);
2385
2386   u32 user_index = *i / SNAT_DET_SES_PER_USER;
2387   in_addr.as_u32 = clib_host_to_net_u32 (
2388     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
2389   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
2390     clib_net_to_host_u32(det_map->in_addr.as_u32);
2391   out_offset = in_offset / det_map->sharing_ratio;
2392   out_addr.as_u32 = clib_host_to_net_u32(
2393     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
2394   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
2395               format_ip4_address, &in_addr,
2396               clib_net_to_host_u16 (ses->in_port),
2397               format_ip4_address, &out_addr,
2398               clib_net_to_host_u16 (ses->out.out_port),
2399               format_ip4_address, &ses->out.ext_host_addr,
2400               clib_net_to_host_u16 (ses->out.ext_host_port),
2401               format_snat_session_state, ses->state,
2402               ses->expire);
2403
2404   return s;
2405 }
2406
2407 static clib_error_t *
2408 show_snat_command_fn (vlib_main_t * vm,
2409                  unformat_input_t * input,
2410                  vlib_cli_command_t * cmd)
2411 {
2412   int verbose = 0;
2413   snat_main_t * sm = &snat_main;
2414   snat_user_t * u;
2415   snat_static_mapping_t *m;
2416   snat_interface_t *i;
2417   snat_address_t * ap;
2418   vnet_main_t *vnm = vnet_get_main();
2419   snat_main_per_thread_data_t *tsm;
2420   u32 users_num = 0, sessions_num = 0, *worker, *sw_if_index;
2421   uword j = 0;
2422   snat_static_map_resolve_t *rp;
2423   snat_det_map_t * dm;
2424   snat_det_session_t * ses;
2425
2426   if (unformat (input, "detail"))
2427     verbose = 1;
2428   else if (unformat (input, "verbose"))
2429     verbose = 2;
2430
2431   if (sm->static_mapping_only)
2432     {
2433       if (sm->static_mapping_connection_tracking)
2434         vlib_cli_output (vm, "NAT plugin mode: static mapping only connection "
2435                          "tracking");
2436       else
2437         vlib_cli_output (vm, "NAT plugin mode: static mapping only");
2438     }
2439   else if (sm->deterministic)
2440     {
2441       vlib_cli_output (vm, "NAT plugin mode: deterministic mapping");
2442     }
2443   else
2444     {
2445       vlib_cli_output (vm, "NAT plugin mode: dynamic translations enabled");
2446     }
2447
2448   if (verbose > 0)
2449     {
2450       pool_foreach (i, sm->interfaces,
2451       ({
2452         vlib_cli_output (vm, "%U %s", format_vnet_sw_interface_name, vnm,
2453                          vnet_get_sw_interface (vnm, i->sw_if_index),
2454                          i->is_inside ? "in" : "out");
2455       }));
2456
2457       pool_foreach (i, sm->output_feature_interfaces,
2458       ({
2459         vlib_cli_output (vm, "%U output-feature %s",
2460                          format_vnet_sw_interface_name, vnm,
2461                          vnet_get_sw_interface (vnm, i->sw_if_index),
2462                          i->is_inside ? "in" : "out");
2463       }));
2464
2465       if (vec_len (sm->auto_add_sw_if_indices))
2466         {
2467           vlib_cli_output (vm, "NAT44 pool addresses interfaces:");
2468           vec_foreach (sw_if_index, sm->auto_add_sw_if_indices)
2469             {
2470               vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
2471                                vnet_get_sw_interface (vnm, *sw_if_index));
2472             }
2473         }
2474
2475       vec_foreach (ap, sm->addresses)
2476         {
2477           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
2478           if (ap->fib_index != ~0)
2479               vlib_cli_output (vm, "  tenant VRF: %u",
2480                                ip4_fib_get(ap->fib_index)->table_id);
2481           else
2482             vlib_cli_output (vm, "  tenant VRF independent");
2483 #define _(N, i, n, s) \
2484           vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
2485           foreach_snat_protocol
2486 #undef _
2487         }
2488     }
2489
2490   if (sm->num_workers > 1)
2491     {
2492       vlib_cli_output (vm, "%d workers", vec_len (sm->workers));
2493       if (verbose > 0)
2494         {
2495           vec_foreach (worker, sm->workers)
2496             {
2497               vlib_worker_thread_t *w =
2498                 vlib_worker_threads + *worker + sm->first_worker_index;
2499               vlib_cli_output (vm, "  %s", w->name);
2500             }
2501         }
2502     }
2503
2504   if (sm->deterministic)
2505     {
2506       vlib_cli_output (vm, "udp timeout: %dsec", sm->udp_timeout);
2507       vlib_cli_output (vm, "tcp-established timeout: %dsec",
2508                        sm->tcp_established_timeout);
2509       vlib_cli_output (vm, "tcp-transitory timeout: %dsec",
2510                        sm->tcp_transitory_timeout);
2511       vlib_cli_output (vm, "icmp timeout: %dsec", sm->icmp_timeout);
2512       vlib_cli_output (vm, "%d deterministic mappings",
2513                        pool_elts (sm->det_maps));
2514       if (verbose > 0)
2515         {
2516           pool_foreach (dm, sm->det_maps,
2517           ({
2518             vlib_cli_output (vm, "in %U/%d out %U/%d\n",
2519                              format_ip4_address, &dm->in_addr, dm->in_plen,
2520                              format_ip4_address, &dm->out_addr, dm->out_plen);
2521             vlib_cli_output (vm, " outside address sharing ratio: %d\n",
2522                              dm->sharing_ratio);
2523             vlib_cli_output (vm, " number of ports per inside host: %d\n",
2524                              dm->ports_per_host);
2525             vlib_cli_output (vm, " sessions number: %d\n", dm->ses_num);
2526             if (verbose > 1)
2527               {
2528                 vec_foreach_index (j, dm->sessions)
2529                   {
2530                     ses = vec_elt_at_index (dm->sessions, j);
2531                     if (ses->in_port)
2532                       vlib_cli_output (vm, "  %U", format_det_map_ses, dm, ses,
2533                                        &j);
2534                   }
2535               }
2536           }));
2537         }
2538     }
2539   else
2540     {
2541       if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
2542         {
2543           vlib_cli_output (vm, "%d static mappings",
2544                            pool_elts (sm->static_mappings));
2545
2546           if (verbose > 0)
2547             {
2548               pool_foreach (m, sm->static_mappings,
2549               ({
2550                 vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2551               }));
2552             }
2553         }
2554       else
2555         {
2556           vec_foreach (tsm, sm->per_thread_data)
2557             {
2558               users_num += pool_elts (tsm->users);
2559               sessions_num += pool_elts (tsm->sessions);
2560             }
2561
2562           vlib_cli_output (vm, "%d users, %d outside addresses, %d active sessions,"
2563                            " %d static mappings",
2564                            users_num,
2565                            vec_len (sm->addresses),
2566                            sessions_num,
2567                            pool_elts (sm->static_mappings));
2568
2569           if (verbose > 0)
2570             {
2571               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->in2out,
2572                                verbose - 1);
2573               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->out2in,
2574                                verbose - 1);
2575               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->in2out_ed,
2576                                verbose - 1);
2577               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->out2in_ed,
2578                                verbose - 1);
2579               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->worker_by_in,
2580                                verbose - 1);
2581               vlib_cli_output (vm, "%U", format_bihash_8_8, &sm->worker_by_out,
2582                                verbose - 1);
2583               vec_foreach_index (j, sm->per_thread_data)
2584                 {
2585                   tsm = vec_elt_at_index (sm->per_thread_data, j);
2586
2587                   if (pool_elts (tsm->users) == 0)
2588                     continue;
2589
2590                   vlib_worker_thread_t *w = vlib_worker_threads + j;
2591                   vlib_cli_output (vm, "Thread %d (%s at lcore %u):", j, w->name,
2592                                    w->lcore_id);
2593                   vlib_cli_output (vm, "  %d list pool elements",
2594                                    pool_elts (tsm->list_pool));
2595
2596                   pool_foreach (u, tsm->users,
2597                   ({
2598                     vlib_cli_output (vm, "  %U", format_snat_user, tsm, u,
2599                                      verbose - 1);
2600                   }));
2601                 }
2602
2603               if (pool_elts (sm->static_mappings))
2604                 {
2605                   vlib_cli_output (vm, "static mappings:");
2606                   pool_foreach (m, sm->static_mappings,
2607                   ({
2608                     vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2609                   }));
2610                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2611                     {
2612                       rp = sm->to_resolve + j;
2613                       vlib_cli_output (vm, "%U",
2614                                        format_snat_static_map_to_resolve, rp);
2615                     }
2616                 }
2617             }
2618         }
2619     }
2620   return 0;
2621 }
2622
2623 VLIB_CLI_COMMAND (show_snat_command, static) = {
2624     .path = "show nat44",
2625     .short_help = "show nat44",
2626     .function = show_snat_command_fn,
2627 };
2628
2629
2630 static void
2631 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2632                                        uword opaque,
2633                                        u32 sw_if_index,
2634                                        ip4_address_t * address,
2635                                        u32 address_length,
2636                                        u32 if_address_index,
2637                                        u32 is_delete)
2638 {
2639   snat_main_t *sm = &snat_main;
2640   snat_static_map_resolve_t *rp;
2641   u32 *indices_to_delete = 0;
2642   int i, j;
2643   int rv;
2644
2645   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2646     {
2647       if (sw_if_index == sm->auto_add_sw_if_indices[i])
2648         {
2649           if (!is_delete)
2650             {
2651               /* Don't trip over lease renewal, static config */
2652               for (j = 0; j < vec_len(sm->addresses); j++)
2653                 if (sm->addresses[j].addr.as_u32 == address->as_u32)
2654                   return;
2655
2656               snat_add_address (sm, address, ~0);
2657               /* Scan static map resolution vector */
2658               for (j = 0; j < vec_len (sm->to_resolve); j++)
2659                 {
2660                   rp = sm->to_resolve + j;
2661                   /* On this interface? */
2662                   if (rp->sw_if_index == sw_if_index)
2663                     {
2664                       /* Add the static mapping */
2665                       rv = snat_add_static_mapping (rp->l_addr,
2666                                                     address[0],
2667                                                     rp->l_port,
2668                                                     rp->e_port,
2669                                                     rp->vrf_id,
2670                                                     rp->addr_only,
2671                                                     ~0 /* sw_if_index */,
2672                                                     rp->proto,
2673                                                     rp->is_add);
2674                       if (rv)
2675                         clib_warning ("snat_add_static_mapping returned %d",
2676                                       rv);
2677                       vec_add1 (indices_to_delete, j);
2678                     }
2679                 }
2680               /* If we resolved any of the outstanding static mappings */
2681               if (vec_len(indices_to_delete))
2682                 {
2683                   /* Delete them */
2684                   for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2685                     vec_delete(sm->to_resolve, 1, j);
2686                   vec_free(indices_to_delete);
2687                 }
2688               return;
2689             }
2690           else
2691             {
2692               (void) snat_del_address(sm, address[0], 1);
2693               return;
2694             }
2695         }
2696     }
2697 }
2698
2699
2700 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
2701 {
2702   ip4_main_t * ip4_main = sm->ip4_main;
2703   ip4_address_t * first_int_addr;
2704   snat_static_map_resolve_t *rp;
2705   u32 *indices_to_delete = 0;
2706   int i, j;
2707
2708   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
2709                                                 0 /* just want the address*/);
2710
2711   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2712     {
2713       if (sm->auto_add_sw_if_indices[i] == sw_if_index)
2714         {
2715           if (is_del)
2716             {
2717               /* if have address remove it */
2718               if (first_int_addr)
2719                   (void) snat_del_address (sm, first_int_addr[0], 1);
2720               else
2721                 {
2722                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2723                     {
2724                       rp = sm->to_resolve + j;
2725                       if (rp->sw_if_index == sw_if_index)
2726                         vec_add1 (indices_to_delete, j);
2727                     }
2728                   if (vec_len(indices_to_delete))
2729                     {
2730                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2731                         vec_del1(sm->to_resolve, j);
2732                       vec_free(indices_to_delete);
2733                     }
2734                 }
2735               vec_del1(sm->auto_add_sw_if_indices, i);
2736             }
2737           else
2738             return VNET_API_ERROR_VALUE_EXIST;
2739
2740           return 0;
2741         }
2742     }
2743
2744   if (is_del)
2745     return VNET_API_ERROR_NO_SUCH_ENTRY;
2746
2747   /* add to the auto-address list */
2748   vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
2749
2750   /* If the address is already bound - or static - add it now */
2751   if (first_int_addr)
2752       snat_add_address (sm, first_int_addr, ~0);
2753
2754   return 0;
2755 }
2756
2757 static clib_error_t *
2758 snat_add_interface_address_command_fn (vlib_main_t * vm,
2759                                        unformat_input_t * input,
2760                                        vlib_cli_command_t * cmd)
2761 {
2762   snat_main_t *sm = &snat_main;
2763   unformat_input_t _line_input, *line_input = &_line_input;
2764   u32 sw_if_index;
2765   int rv;
2766   int is_del = 0;
2767   clib_error_t *error = 0;
2768
2769   /* Get a line of input. */
2770   if (!unformat_user (input, unformat_line_input, line_input))
2771     return 0;
2772
2773   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2774     {
2775       if (unformat (line_input, "%U", unformat_vnet_sw_interface,
2776                     sm->vnet_main, &sw_if_index))
2777         ;
2778       else if (unformat (line_input, "del"))
2779         is_del = 1;
2780       else
2781         {
2782           error = clib_error_return (0, "unknown input '%U'",
2783                                      format_unformat_error, line_input);
2784           goto done;
2785         }
2786     }
2787
2788   rv = snat_add_interface_address (sm, sw_if_index, is_del);
2789
2790   switch (rv)
2791     {
2792     case 0:
2793       break;
2794
2795     default:
2796       error = clib_error_return (0, "snat_add_interface_address returned %d",
2797                                  rv);
2798       goto done;
2799     }
2800
2801 done:
2802   unformat_free (line_input);
2803
2804   return error;
2805 }
2806
2807 VLIB_CLI_COMMAND (snat_add_interface_address_command, static) = {
2808     .path = "nat44 add interface address",
2809     .short_help = "nat44 add interface address <interface> [del]",
2810     .function = snat_add_interface_address_command_fn,
2811 };
2812
2813 static clib_error_t *
2814 snat_det_map_command_fn (vlib_main_t * vm,
2815                          unformat_input_t * input,
2816                          vlib_cli_command_t * cmd)
2817 {
2818   snat_main_t *sm = &snat_main;
2819   unformat_input_t _line_input, *line_input = &_line_input;
2820   ip4_address_t in_addr, out_addr;
2821   u32 in_plen, out_plen;
2822   int is_add = 1, rv;
2823   clib_error_t *error = 0;
2824
2825   /* Get a line of input. */
2826   if (!unformat_user (input, unformat_line_input, line_input))
2827     return 0;
2828
2829   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2830     {
2831       if (unformat (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
2832         ;
2833       else if (unformat (line_input, "out %U/%u", unformat_ip4_address, &out_addr, &out_plen))
2834         ;
2835       else if (unformat (line_input, "del"))
2836         is_add = 0;
2837       else
2838         {
2839           error = clib_error_return (0, "unknown input '%U'",
2840                                      format_unformat_error, line_input);
2841           goto done;
2842         }
2843     }
2844
2845   unformat_free (line_input);
2846
2847   rv = snat_det_add_map(sm, &in_addr, (u8) in_plen, &out_addr, (u8)out_plen,
2848                         is_add);
2849
2850   if (rv)
2851     {
2852       error = clib_error_return (0, "snat_det_add_map return %d", rv);
2853       goto done;
2854     }
2855
2856 done:
2857   unformat_free (line_input);
2858
2859   return error;
2860 }
2861
2862 /*?
2863  * @cliexpar
2864  * @cliexstart{snat deterministic add}
2865  * Create bijective mapping of inside address to outside address and port range
2866  * pairs, with the purpose of enabling deterministic NAT to reduce logging in
2867  * CGN deployments.
2868  * To create deterministic mapping between inside network 10.0.0.0/18 and
2869  * outside network 1.1.1.0/30 use:
2870  * # vpp# nat44 deterministic add in 10.0.0.0/18 out 1.1.1.0/30
2871  * @cliexend
2872 ?*/
2873 VLIB_CLI_COMMAND (snat_det_map_command, static) = {
2874     .path = "nat44 deterministic add",
2875     .short_help = "nat44 deterministic add in <addr>/<plen> out <addr>/<plen> [del]",
2876     .function = snat_det_map_command_fn,
2877 };
2878
2879 static clib_error_t *
2880 snat_det_forward_command_fn (vlib_main_t * vm,
2881                              unformat_input_t * input,
2882                              vlib_cli_command_t * cmd)
2883 {
2884   snat_main_t *sm = &snat_main;
2885   unformat_input_t _line_input, *line_input = &_line_input;
2886   ip4_address_t in_addr, out_addr;
2887   u16 lo_port;
2888   snat_det_map_t * dm;
2889   clib_error_t *error = 0;
2890
2891   /* Get a line of input. */
2892   if (!unformat_user (input, unformat_line_input, line_input))
2893     return 0;
2894
2895   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2896     {
2897       if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
2898         ;
2899       else
2900         {
2901           error = clib_error_return (0, "unknown input '%U'",
2902                                      format_unformat_error, line_input);
2903           goto done;
2904         }
2905     }
2906
2907   unformat_free (line_input);
2908
2909   dm = snat_det_map_by_user(sm, &in_addr);
2910   if (!dm)
2911     vlib_cli_output (vm, "no match");
2912   else
2913     {
2914       snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
2915       vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
2916                        lo_port, lo_port + dm->ports_per_host - 1);
2917     }
2918
2919 done:
2920   unformat_free (line_input);
2921
2922   return error;
2923 }
2924
2925 /*?
2926  * @cliexpar
2927  * @cliexstart{snat deterministic forward}
2928  * Return outside address and port range from inside address for deterministic
2929  * NAT.
2930  * To obtain outside address and port of inside host use:
2931  *  vpp# nat44 deterministic forward 10.0.0.2
2932  *  1.1.1.0:<1054-1068>
2933  * @cliexend
2934 ?*/
2935 VLIB_CLI_COMMAND (snat_det_forward_command, static) = {
2936     .path = "nat44 deterministic forward",
2937     .short_help = "nat44 deterministic forward <addr>",
2938     .function = snat_det_forward_command_fn,
2939 };
2940
2941 static clib_error_t *
2942 snat_det_reverse_command_fn (vlib_main_t * vm,
2943                              unformat_input_t * input,
2944                              vlib_cli_command_t * cmd)
2945 {
2946   snat_main_t *sm = &snat_main;
2947   unformat_input_t _line_input, *line_input = &_line_input;
2948   ip4_address_t in_addr, out_addr;
2949   u32 out_port;
2950   snat_det_map_t * dm;
2951   clib_error_t *error = 0;
2952
2953   /* Get a line of input. */
2954   if (!unformat_user (input, unformat_line_input, line_input))
2955     return 0;
2956
2957   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2958     {
2959       if (unformat (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
2960         ;
2961       else
2962         {
2963           error =  clib_error_return (0, "unknown input '%U'",
2964                                       format_unformat_error, line_input);
2965         }
2966     }
2967
2968   unformat_free (line_input);
2969
2970   if (out_port < 1024 || out_port > 65535)
2971     {
2972       error = clib_error_return (0, "wrong port, must be <1024-65535>");
2973       goto done;
2974     }
2975
2976   dm = snat_det_map_by_out(sm, &out_addr);
2977   if (!dm)
2978     vlib_cli_output (vm, "no match");
2979   else
2980     {
2981       snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr);
2982       vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
2983     }
2984
2985 done:
2986   unformat_free (line_input);
2987
2988   return error;
2989 }
2990
2991 /*?
2992  * @cliexpar
2993  * @cliexstart{snat deterministic reverse}
2994  * Return inside address from outside address and port for deterministic NAT.
2995  * To obtain inside host address from outside address and port use:
2996  *  #vpp nat44 deterministic reverse 1.1.1.1:1276
2997  *  10.0.16.16
2998  * @cliexend
2999 ?*/
3000 VLIB_CLI_COMMAND (snat_det_reverse_command, static) = {
3001     .path = "nat44 deterministic reverse",
3002     .short_help = "nat44 deterministic reverse <addr>:<port>",
3003     .function = snat_det_reverse_command_fn,
3004 };
3005
3006 static clib_error_t *
3007 set_timeout_command_fn (vlib_main_t * vm,
3008                         unformat_input_t * input,
3009                         vlib_cli_command_t * cmd)
3010 {
3011   snat_main_t *sm = &snat_main;
3012   unformat_input_t _line_input, *line_input = &_line_input;
3013   clib_error_t *error = 0;
3014
3015   /* Get a line of input. */
3016   if (!unformat_user (input, unformat_line_input, line_input))
3017     return 0;
3018
3019   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3020     {
3021       if (unformat (line_input, "udp %u", &sm->udp_timeout))
3022         ;
3023       else if (unformat (line_input, "tcp-established %u",
3024                &sm->tcp_established_timeout))
3025         ;
3026       else if (unformat (line_input, "tcp-transitory %u",
3027                &sm->tcp_transitory_timeout))
3028         ;
3029       else if (unformat (line_input, "icmp %u", &sm->icmp_timeout))
3030         ;
3031       else if (unformat (line_input, "reset"))
3032         {
3033           sm->udp_timeout = SNAT_UDP_TIMEOUT;
3034           sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
3035           sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
3036           sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
3037         }
3038       else
3039         {
3040           error = clib_error_return (0, "unknown input '%U'",
3041                                      format_unformat_error, line_input);
3042           goto done;
3043         }
3044     }
3045
3046   unformat_free (line_input);
3047
3048 done:
3049   unformat_free (line_input);
3050
3051   return error;
3052 }
3053
3054 /*?
3055  * @cliexpar
3056  * @cliexstart{set snat deterministic timeout}
3057  * Set values of timeouts for deterministic NAT (in seconds), use:
3058  *  vpp# set nat44 deterministic timeout udp 120 tcp-established 7500
3059  *  tcp-transitory 250 icmp 90
3060  * To reset default values use:
3061  *  vpp# set nat44 deterministic timeout reset
3062  * @cliexend
3063 ?*/
3064 VLIB_CLI_COMMAND (set_timeout_command, static) = {
3065   .path = "set nat44 deterministic timeout",
3066   .function = set_timeout_command_fn,
3067   .short_help =
3068     "set nat44 deterministic timeout [udp <sec> | tcp-established <sec> "
3069     "tcp-transitory <sec> | icmp <sec> | reset]",
3070 };
3071
3072 static clib_error_t *
3073 snat_det_close_session_out_fn (vlib_main_t *vm,
3074                                unformat_input_t * input,
3075                                vlib_cli_command_t * cmd)
3076 {
3077   snat_main_t *sm = &snat_main;
3078   unformat_input_t _line_input, *line_input = &_line_input;
3079   ip4_address_t out_addr, ext_addr, in_addr;
3080   u16 out_port, ext_port;
3081   snat_det_map_t * dm;
3082   snat_det_session_t * ses;
3083   snat_det_out_key_t key;
3084   clib_error_t *error = 0;
3085
3086   /* Get a line of input. */
3087   if (!unformat_user (input, unformat_line_input, line_input))
3088     return 0;
3089
3090   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3091     {
3092       if (unformat (line_input, "%U:%d %U:%d",
3093                     unformat_ip4_address, &out_addr, &out_port,
3094                     unformat_ip4_address, &ext_addr, &ext_port))
3095         ;
3096       else
3097         {
3098           error = clib_error_return (0, "unknown input '%U'",
3099                                      format_unformat_error, line_input);
3100           goto done;
3101         }
3102     }
3103
3104   unformat_free (line_input);
3105
3106   dm = snat_det_map_by_out(sm, &out_addr);
3107   if (!dm)
3108     vlib_cli_output (vm, "no match");
3109   else
3110     {
3111       snat_det_reverse(dm, &ext_addr, out_port, &in_addr);
3112       key.ext_host_addr = out_addr;
3113       key.ext_host_port = ntohs(ext_port);
3114       key.out_port = ntohs(out_port);
3115       ses = snat_det_get_ses_by_out(dm, &out_addr, key.as_u64);
3116       if (!ses)
3117         vlib_cli_output (vm, "no match");
3118       else
3119        snat_det_ses_close(dm, ses);
3120     }
3121
3122 done:
3123   unformat_free (line_input);
3124
3125   return error;
3126 }
3127
3128 /*?
3129  * @cliexpar
3130  * @cliexstart{snat deterministic close session out}
3131  * Close session using outside ip address and port
3132  * and external ip address and port, use:
3133  *  vpp# nat44 deterministic close session out 1.1.1.1:1276 2.2.2.2:2387
3134  * @cliexend
3135 ?*/
3136 VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = {
3137   .path = "nat44 deterministic close session out",
3138   .short_help = "nat44 deterministic close session out "
3139                 "<out_addr>:<out_port> <ext_addr>:<ext_port>",
3140   .function = snat_det_close_session_out_fn,
3141 };
3142
3143 static clib_error_t *
3144 snat_det_close_session_in_fn (vlib_main_t *vm,
3145                               unformat_input_t * input,
3146                               vlib_cli_command_t * cmd)
3147 {
3148   snat_main_t *sm = &snat_main;
3149   unformat_input_t _line_input, *line_input = &_line_input;
3150   ip4_address_t in_addr, ext_addr;
3151   u16 in_port, ext_port;
3152   snat_det_map_t * dm;
3153   snat_det_session_t * ses;
3154   snat_det_out_key_t key;
3155   clib_error_t *error = 0;
3156
3157   /* Get a line of input. */
3158   if (!unformat_user (input, unformat_line_input, line_input))
3159     return 0;
3160
3161   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3162     {
3163       if (unformat (line_input, "%U:%d %U:%d",
3164                     unformat_ip4_address, &in_addr, &in_port,
3165                     unformat_ip4_address, &ext_addr, &ext_port))
3166         ;
3167       else
3168         {
3169           error = clib_error_return (0, "unknown input '%U'",
3170                                      format_unformat_error, line_input);
3171           goto done;
3172         }
3173     }
3174
3175   unformat_free (line_input);
3176
3177   dm = snat_det_map_by_user (sm, &in_addr);
3178   if (!dm)
3179     vlib_cli_output (vm, "no match");
3180   else
3181     {
3182       key.ext_host_addr = ext_addr;
3183       key.ext_host_port = ntohs (ext_port);
3184       ses = snat_det_find_ses_by_in (dm, &in_addr, ntohs(in_port), key);
3185       if (!ses)
3186         vlib_cli_output (vm, "no match");
3187       else
3188         snat_det_ses_close(dm, ses);
3189     }
3190
3191 done:
3192   unformat_free(line_input);
3193
3194   return error;
3195 }
3196
3197 /*?
3198  * @cliexpar
3199  * @cliexstart{snat deterministic close_session_in}
3200  * Close session using inside ip address and port
3201  * and external ip address and port, use:
3202  *  vpp# nat44 deterministic close session in 3.3.3.3:3487 2.2.2.2:2387
3203  * @cliexend
3204 ?*/
3205 VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = {
3206   .path = "nat44 deterministic close session in",
3207   .short_help = "nat44 deterministic close session in "
3208                 "<in_addr>:<in_port> <ext_addr>:<ext_port>",
3209   .function = snat_det_close_session_in_fn,
3210 };