src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_dpo.h>
  24 #include <nat/nat_ipfix_logging.h>
  25 #include <nat/nat_det.h>
  26 #include <nat/nat64.h>
  27 #include <nat/nat66.h>
  28 #include <nat/dslite.h>
  29 #include <nat/nat_reass.h>
  30 #include <vnet/fib/fib_table.h>
  31 #include <vnet/fib/ip4_fib.h>
  32
  33 #include <vpp/app/version.h>
  34
  35 snat_main_t snat_main;
  36
  37
  38 /* Hook up input features */
  39 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  40   .arc_name = "ip4-unicast",
  41   .node_name = "nat44-in2out",
  42   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  43 };
  44 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  45   .arc_name = "ip4-unicast",
  46   .node_name = "nat44-out2in",
  47   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  48 };
  49 VNET_FEATURE_INIT (ip4_nat_classify, static) = {
  50   .arc_name = "ip4-unicast",
  51   .node_name = "nat44-classify",
  52   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  53 };
  54 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  55   .arc_name = "ip4-unicast",
  56   .node_name = "nat44-det-in2out",
  57   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  58 };
  59 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  60   .arc_name = "ip4-unicast",
  61   .node_name = "nat44-det-out2in",
  62   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  63 };
  64 VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
  65   .arc_name = "ip4-unicast",
  66   .node_name = "nat44-det-classify",
  67   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  68 };
  69 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  70   .arc_name = "ip4-unicast",
  71   .node_name = "nat44-in2out-worker-handoff",
  72   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  73 };
  74 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  75   .arc_name = "ip4-unicast",
  76   .node_name = "nat44-out2in-worker-handoff",
  77   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  78 };
  79 VNET_FEATURE_INIT (ip4_nat_handoff_classify, static) = {
  80   .arc_name = "ip4-unicast",
  81   .node_name = "nat44-handoff-classify",
  82   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  83 };
  84 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
  85   .arc_name = "ip4-unicast",
  86   .node_name = "nat44-in2out-fast",
  87   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  88 };
  89 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
  90   .arc_name = "ip4-unicast",
  91   .node_name = "nat44-out2in-fast",
  92   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  93 };
  94 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
  95   .arc_name = "ip4-unicast",
  96   .node_name = "nat44-hairpin-dst",
  97   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  98 };
  99
 100 /* Hook up output features */
 101 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
 102   .arc_name = "ip4-output",
 103   .node_name = "nat44-in2out-output",
 104   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 105 };
 106 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
 107   .arc_name = "ip4-output",
 108   .node_name = "nat44-in2out-output-worker-handoff",
 109   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 110 };
 111 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
 112   .arc_name = "ip4-output",
 113   .node_name = "nat44-hairpin-src",
 114   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 115 };
 116
 117 /* Hook up ip4-local features */
 118 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 119 {
 120   .arc_name = "ip4-local",
 121   .node_name = "nat44-hairpinning",
 122   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 123 };
 124
 125
 126 /* *INDENT-OFF* */
 127 VLIB_PLUGIN_REGISTER () = {
 128     .version = VPP_BUILD_VER,
 129     .description = "Network Address Translation",
 130 };
 131 /* *INDENT-ON* */
 132
 133 vlib_node_registration_t nat44_classify_node;
 134 vlib_node_registration_t nat44_det_classify_node;
 135 vlib_node_registration_t nat44_handoff_classify_node;
 136
 137 typedef enum {
 138   NAT44_CLASSIFY_NEXT_IN2OUT,
 139   NAT44_CLASSIFY_NEXT_OUT2IN,
 140   NAT44_CLASSIFY_N_NEXT,
 141 } nat44_classify_next_t;
 142
 143 void
 144 nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index)
 145 {
 146   snat_session_key_t key;
 147   clib_bihash_kv_8_8_t kv;
 148   nat_ed_ses_key_t ed_key;
 149   clib_bihash_kv_16_8_t ed_kv;
 150   int i;
 151   snat_address_t *a;
 152   snat_main_per_thread_data_t *tsm =
 153     vec_elt_at_index (sm->per_thread_data, thread_index);
 154
 155   if (is_fwd_bypass_session (s))
 156     {
 157       ed_key.l_addr = s->in2out.addr;
 158       ed_key.r_addr = s->ext_host_addr;
 159       ed_key.l_port = s->in2out.port;
 160       ed_key.r_port = s->ext_host_port;
 161       ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 162       ed_key.fib_index = 0;
 163       ed_kv.key[0] = ed_key.as_u64[0];
 164       ed_kv.key[1] = ed_key.as_u64[1];
 165       if (clib_bihash_add_del_16_8 (&sm->in2out_ed, &ed_kv, 0))
 166         clib_warning ("in2out_ed key del failed");
 167       return;
 168     }
 169
 170   /* Endpoint dependent session lookup tables */
 171   if (is_ed_session (s))
 172     {
 173       ed_key.l_addr = s->out2in.addr;
 174       ed_key.r_addr = s->ext_host_addr;
 175       ed_key.fib_index = s->out2in.fib_index;
 176       if (snat_is_unk_proto_session (s))
 177         {
 178           ed_key.proto = s->in2out.port;
 179           ed_key.r_port = 0;
 180           ed_key.l_port = 0;
 181         }
 182       else
 183         {
 184           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 185           ed_key.l_port = s->out2in.port;
 186           ed_key.r_port = s->ext_host_port;
 187         }
 188       ed_kv.key[0] = ed_key.as_u64[0];
 189       ed_kv.key[1] = ed_key.as_u64[1];
 190       if (clib_bihash_add_del_16_8 (&sm->out2in_ed, &ed_kv, 0))
 191         clib_warning ("out2in_ed key del failed");
 192
 193       ed_key.l_addr = s->in2out.addr;
 194       ed_key.fib_index = s->in2out.fib_index;
 195       if (!snat_is_unk_proto_session (s))
 196         ed_key.l_port = s->in2out.port;
 197       if (is_twice_nat_session (s))
 198         {
 199           ed_key.r_addr = s->ext_host_nat_addr;
 200           ed_key.r_port = s->ext_host_nat_port;
 201         }
 202       ed_kv.key[0] = ed_key.as_u64[0];
 203       ed_kv.key[1] = ed_key.as_u64[1];
 204       if (clib_bihash_add_del_16_8 (&sm->in2out_ed, &ed_kv, 0))
 205         clib_warning ("in2out_ed key del failed");
 206     }
 207
 208   if (snat_is_unk_proto_session (s))
 209     return;
 210
 211   /* log NAT event */
 212   snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 213                                       s->out2in.addr.as_u32,
 214                                       s->in2out.protocol,
 215                                       s->in2out.port,
 216                                       s->out2in.port,
 217                                       s->in2out.fib_index);
 218
 219   /* Twice NAT address and port for external host */
 220   if (is_twice_nat_session (s))
 221     {
 222       for (i = 0; i < vec_len (sm->twice_nat_addresses); i++)
 223         {
 224           key.protocol = s->in2out.protocol;
 225           key.port = s->ext_host_nat_port;
 226           a = sm->twice_nat_addresses + i;
 227           if (a->addr.as_u32 == s->ext_host_nat_addr.as_u32)
 228             {
 229               snat_free_outside_address_and_port (sm->twice_nat_addresses,
 230                                                   thread_index, &key, i);
 231               break;
 232             }
 233         }
 234     }
 235
 236   if (is_ed_session (s))
 237     return;
 238
 239   /* Session lookup tables */
 240   kv.key = s->in2out.as_u64;
 241   if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
 242     clib_warning ("in2out key del failed");
 243   kv.key = s->out2in.as_u64;
 244   if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
 245     clib_warning ("out2in key del failed");
 246
 247   if (snat_is_session_static (s))
 248     return;
 249
 250   if (s->outside_address_index != ~0)
 251     snat_free_outside_address_and_port (sm->addresses, thread_index,
 252                                         &s->out2in, s->outside_address_index);
 253 }
 254
 255 snat_user_t *
 256 nat_user_get_or_create (snat_main_t *sm, ip4_address_t *addr, u32 fib_index,
 257                         u32 thread_index)
 258 {
 259   snat_user_t *u = 0;
 260   snat_user_key_t user_key;
 261   clib_bihash_kv_8_8_t kv, value;
 262   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 263   dlist_elt_t * per_user_list_head_elt;
 264
 265   user_key.addr.as_u32 = addr->as_u32;
 266   user_key.fib_index = fib_index;
 267   kv.key = user_key.as_u64;
 268
 269   /* Ever heard of the "user" = src ip4 address before? */
 270   if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 271     {
 272       /* no, make a new one */
 273       pool_get (tsm->users, u);
 274       memset (u, 0, sizeof (*u));
 275       u->addr.as_u32 = addr->as_u32;
 276       u->fib_index = fib_index;
 277
 278       pool_get (tsm->list_pool, per_user_list_head_elt);
 279
 280       u->sessions_per_user_list_head_index = per_user_list_head_elt -
 281         tsm->list_pool;
 282
 283       clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
 284
 285       kv.value = u - tsm->users;
 286
 287       /* add user */
 288       if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
 289         clib_warning ("user_hash keay add failed");
 290     }
 291   else
 292     {
 293       u = pool_elt_at_index (tsm->users, value.value);
 294     }
 295
 296   return u;
 297 }
 298
 299 snat_session_t *
 300 nat_session_alloc_or_recycle (snat_main_t *sm, snat_user_t *u, u32 thread_index)
 301 {
 302   snat_session_t *s;
 303   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 304   u32 oldest_per_user_translation_list_index, session_index;
 305   dlist_elt_t * oldest_per_user_translation_list_elt;
 306   dlist_elt_t * per_user_translation_list_elt;
 307
 308   /* Over quota? Recycle the least recently used translation */
 309   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 310     {
 311       oldest_per_user_translation_list_index =
 312         clib_dlist_remove_head (tsm->list_pool,
 313                                 u->sessions_per_user_list_head_index);
 314
 315       ASSERT (oldest_per_user_translation_list_index != ~0);
 316
 317       /* Add it back to the end of the LRU list */
 318       clib_dlist_addtail (tsm->list_pool,
 319                           u->sessions_per_user_list_head_index,
 320                           oldest_per_user_translation_list_index);
 321       /* Get the list element */
 322       oldest_per_user_translation_list_elt =
 323         pool_elt_at_index (tsm->list_pool,
 324                            oldest_per_user_translation_list_index);
 325
 326       /* Get the session index from the list element */
 327       session_index = oldest_per_user_translation_list_elt->value;
 328
 329       /* Get the session */
 330       s = pool_elt_at_index (tsm->sessions, session_index);
 331       nat_free_session_data (sm, s, thread_index);
 332       if (snat_is_session_static(s))
 333         u->nstaticsessions--;
 334       else
 335         u->nsessions--;
 336       s->outside_address_index = ~0;
 337       s->flags = 0;
 338       s->total_bytes = 0;
 339       s->total_pkts = 0;
 340       s->state = 0;
 341       s->ext_host_addr.as_u32 = 0;
 342       s->ext_host_port = 0;
 343       s->ext_host_nat_addr.as_u32 = 0;
 344       s->ext_host_nat_port = 0;
 345     }
 346   else
 347     {
 348       pool_get (tsm->sessions, s);
 349       memset (s, 0, sizeof (*s));
 350       s->outside_address_index = ~0;
 351
 352       /* Create list elts */
 353       pool_get (tsm->list_pool, per_user_translation_list_elt);
 354       clib_dlist_init (tsm->list_pool,
 355                        per_user_translation_list_elt - tsm->list_pool);
 356
 357       per_user_translation_list_elt->value = s - tsm->sessions;
 358       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 359       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 360
 361       clib_dlist_addtail (tsm->list_pool,
 362                           s->per_user_list_head_index,
 363                           per_user_translation_list_elt - tsm->list_pool);
 364     }
 365
 366   return s;
 367 }
 368
 369 static inline uword
 370 nat44_classify_node_fn_inline (vlib_main_t * vm,
 371                                vlib_node_runtime_t * node,
 372                                vlib_frame_t * frame)
 373 {
 374   u32 n_left_from, * from, * to_next;
 375   nat44_classify_next_t next_index;
 376   snat_main_t *sm = &snat_main;
 377   snat_static_mapping_t *m;
 378
 379   from = vlib_frame_vector_args (frame);
 380   n_left_from = frame->n_vectors;
 381   next_index = node->cached_next_index;
 382
 383   while (n_left_from > 0)
 384     {
 385       u32 n_left_to_next;
 386
 387       vlib_get_next_frame (vm, node, next_index,
 388                            to_next, n_left_to_next);
 389
 390       while (n_left_from > 0 && n_left_to_next > 0)
 391         {
 392           u32 bi0;
 393           vlib_buffer_t *b0;
 394           u32 next0 = NAT44_CLASSIFY_NEXT_IN2OUT;
 395           ip4_header_t *ip0;
 396           snat_address_t *ap;
 397           snat_session_key_t m_key0;
 398           clib_bihash_kv_8_8_t kv0, value0;
 399
 400           /* speculatively enqueue b0 to the current next frame */
 401           bi0 = from[0];
 402           to_next[0] = bi0;
 403           from += 1;
 404           to_next += 1;
 405           n_left_from -= 1;
 406           n_left_to_next -= 1;
 407
 408           b0 = vlib_get_buffer (vm, bi0);
 409           ip0 = vlib_buffer_get_current (b0);
 410
 411           vec_foreach (ap, sm->addresses)
 412             {
 413               if (ip0->dst_address.as_u32 == ap->addr.as_u32)
 414                 {
 415                   next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 416                   goto enqueue0;
 417                 }
 418             }
 419
 420           if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
 421             {
 422               m_key0.addr = ip0->dst_address;
 423               m_key0.port = 0;
 424               m_key0.protocol = 0;
 425               m_key0.fib_index = sm->outside_fib_index;
 426               kv0.key = m_key0.as_u64;
 427               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0))
 428                 {
 429                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 430                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 431                     next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 432                   goto enqueue0;
 433                 }
 434               udp_header_t * udp0 = ip4_next_header (ip0);
 435               m_key0.port = clib_net_to_host_u16 (udp0->dst_port);
 436               m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol);
 437               kv0.key = m_key0.as_u64;
 438               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0))
 439                 {
 440                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 441                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 442                     next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 443                 }
 444             }
 445
 446         enqueue0:
 447           /* verify speculative enqueue, maybe switch current next frame */
 448           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 449                                            to_next, n_left_to_next,
 450                                            bi0, next0);
 451         }
 452
 453       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 454     }
 455
 456   return frame->n_vectors;
 457 }
 458
 459 static uword
 460 nat44_classify_node_fn (vlib_main_t * vm,
 461                         vlib_node_runtime_t * node,
 462                         vlib_frame_t * frame)
 463 {
 464   return nat44_classify_node_fn_inline (vm, node, frame);
 465 };
 466
 467 VLIB_REGISTER_NODE (nat44_classify_node) = {
 468   .function = nat44_classify_node_fn,
 469   .name = "nat44-classify",
 470   .vector_size = sizeof (u32),
 471   .type = VLIB_NODE_TYPE_INTERNAL,
 472   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 473   .next_nodes = {
 474     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out",
 475     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in",
 476   },
 477 };
 478
 479 VLIB_NODE_FUNCTION_MULTIARCH (nat44_classify_node,
 480                               nat44_classify_node_fn);
 481
 482 static uword
 483 nat44_det_classify_node_fn (vlib_main_t * vm,
 484                             vlib_node_runtime_t * node,
 485                             vlib_frame_t * frame)
 486 {
 487   return nat44_classify_node_fn_inline (vm, node, frame);
 488 };
 489
 490 VLIB_REGISTER_NODE (nat44_det_classify_node) = {
 491   .function = nat44_det_classify_node_fn,
 492   .name = "nat44-det-classify",
 493   .vector_size = sizeof (u32),
 494   .type = VLIB_NODE_TYPE_INTERNAL,
 495   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 496   .next_nodes = {
 497     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out",
 498     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in",
 499   },
 500 };
 501
 502 VLIB_NODE_FUNCTION_MULTIARCH (nat44_det_classify_node,
 503                               nat44_det_classify_node_fn);
 504
 505 static uword
 506 nat44_handoff_classify_node_fn (vlib_main_t * vm,
 507                                 vlib_node_runtime_t * node,
 508                                 vlib_frame_t * frame)
 509 {
 510   return nat44_classify_node_fn_inline (vm, node, frame);
 511 };
 512
 513 VLIB_REGISTER_NODE (nat44_handoff_classify_node) = {
 514   .function = nat44_handoff_classify_node_fn,
 515   .name = "nat44-handoff-classify",
 516   .vector_size = sizeof (u32),
 517   .type = VLIB_NODE_TYPE_INTERNAL,
 518   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 519   .next_nodes = {
 520     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out-worker-handoff",
 521     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in-worker-handoff",
 522   },
 523 };
 524
 525 VLIB_NODE_FUNCTION_MULTIARCH (nat44_handoff_classify_node,
 526                               nat44_handoff_classify_node_fn);
 527
 528 /**
 529  * @brief Add/del NAT address to FIB.
 530  *
 531  * Add the external NAT address to the FIB as receive entries. This ensures
 532  * that VPP will reply to ARP for this address and we don't need to enable
 533  * proxy ARP on the outside interface.
 534  *
 535  * @param addr IPv4 address.
 536  * @param plen address prefix length
 537  * @param sw_if_index Interface.
 538  * @param is_add If 0 delete, otherwise add.
 539  */
 540 void
 541 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 542                           int is_add)
 543 {
 544   fib_prefix_t prefix = {
 545     .fp_len = p_len,
 546     .fp_proto = FIB_PROTOCOL_IP4,
 547     .fp_addr = {
 548         .ip4.as_u32 = addr->as_u32,
 549     },
 550   };
 551   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 552
 553   if (is_add)
 554     fib_table_entry_update_one_path(fib_index,
 555                                     &prefix,
 556                                     FIB_SOURCE_PLUGIN_LOW,
 557                                     (FIB_ENTRY_FLAG_CONNECTED |
 558                                      FIB_ENTRY_FLAG_LOCAL |
 559                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 560                                     DPO_PROTO_IP4,
 561                                     NULL,
 562                                     sw_if_index,
 563                                     ~0,
 564                                     1,
 565                                     NULL,
 566                                     FIB_ROUTE_PATH_FLAG_NONE);
 567   else
 568     fib_table_entry_delete(fib_index,
 569                            &prefix,
 570                            FIB_SOURCE_PLUGIN_LOW);
 571 }
 572
 573 void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id,
 574                        u8 twice_nat)
 575 {
 576   snat_address_t * ap;
 577   snat_interface_t *i;
 578   vlib_thread_main_t *tm = vlib_get_thread_main ();
 579
 580   /* Check if address already exists */
 581   vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
 582     {
 583       if (ap->addr.as_u32 == addr->as_u32)
 584         return;
 585     }
 586
 587   if (twice_nat)
 588     vec_add2 (sm->twice_nat_addresses, ap, 1);
 589   else
 590     vec_add2 (sm->addresses, ap, 1);
 591
 592   ap->addr = *addr;
 593   if (vrf_id != ~0)
 594     ap->fib_index =
 595       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 596                                          FIB_SOURCE_PLUGIN_LOW);
 597   else
 598     ap->fib_index = ~0;
 599 #define _(N, i, n, s) \
 600   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 601   ap->busy_##n##_ports = 0; \
 602   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 603   foreach_snat_protocol
 604 #undef _
 605
 606   if (twice_nat)
 607     return;
 608
 609   /* Add external address to FIB */
 610   pool_foreach (i, sm->interfaces,
 611   ({
 612     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 613       continue;
 614
 615     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 616     break;
 617   }));
 618   pool_foreach (i, sm->output_feature_interfaces,
 619   ({
 620     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 621       continue;
 622
 623     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 624     break;
 625   }));
 626 }
 627
 628 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 629                                                    ip4_address_t addr)
 630 {
 631   snat_static_mapping_t *m;
 632   pool_foreach (m, sm->static_mappings,
 633   ({
 634       if (m->external_addr.as_u32 == addr.as_u32)
 635         return 1;
 636   }));
 637
 638   return 0;
 639 }
 640
 641 void increment_v4_address (ip4_address_t * a)
 642 {
 643   u32 v;
 644
 645   v = clib_net_to_host_u32(a->as_u32) + 1;
 646   a->as_u32 = clib_host_to_net_u32(v);
 647 }
 648
 649 static void
 650 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 651                                        ip4_address_t l_addr,
 652                                        u16 l_port,
 653                                        u32 sw_if_index,
 654                                        u16 e_port,
 655                                        u32 vrf_id,
 656                                        snat_protocol_t proto,
 657                                        int addr_only,
 658                                        int is_add,
 659                                        u8 * tag)
 660 {
 661   snat_static_map_resolve_t *rp;
 662
 663   vec_add2 (sm->to_resolve, rp, 1);
 664   rp->l_addr.as_u32 = l_addr.as_u32;
 665   rp->l_port = l_port;
 666   rp->sw_if_index = sw_if_index;
 667   rp->e_port = e_port;
 668   rp->vrf_id = vrf_id;
 669   rp->proto = proto;
 670   rp->addr_only = addr_only;
 671   rp->is_add = is_add;
 672   rp->tag = vec_dup (tag);
 673 }
 674
 675 /**
 676  * @brief Add static mapping.
 677  *
 678  * Create static mapping between local addr+port and external addr+port.
 679  *
 680  * @param l_addr Local IPv4 address.
 681  * @param e_addr External IPv4 address.
 682  * @param l_port Local port number.
 683  * @param e_port External port number.
 684  * @param vrf_id VRF ID.
 685  * @param addr_only If 0 address port and pair mapping, otherwise address only.
 686  * @param sw_if_index External port instead of specific IP address.
 687  * @param is_add If 0 delete static mapping, otherwise add.
 688  * @param twice_nat If value is TWICE_NAT then translate external host address
 689  *                  and port.
 690  *                  If value is TWICE_NAT_SELF then translate external host
 691  *                  address and port whenever external host address equals
 692  *                  local address of internal host.
 693  * @param out2in_only If 1 rule match only out2in direction
 694  * @param tag - opaque string tag
 695  *
 696  * @returns
 697  */
 698 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
 699                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 700                             u32 sw_if_index, snat_protocol_t proto, int is_add,
 701                             twice_nat_type_t twice_nat, u8 out2in_only,
 702                             u8 * tag)
 703 {
 704   snat_main_t * sm = &snat_main;
 705   snat_static_mapping_t *m;
 706   snat_session_key_t m_key;
 707   clib_bihash_kv_8_8_t kv, value;
 708   snat_address_t *a = 0;
 709   u32 fib_index = ~0;
 710   uword * p;
 711   snat_interface_t *interface;
 712   int i;
 713   snat_main_per_thread_data_t *tsm;
 714   snat_user_key_t u_key;
 715   snat_user_t *u;
 716   dlist_elt_t * head, * elt;
 717   u32 elt_index, head_index;
 718   u32 ses_index;
 719   u64 user_index;
 720   snat_session_t * s;
 721   snat_static_map_resolve_t *rp, *rp_match = 0;
 722
 723   /* If the external address is a specific interface address */
 724   if (sw_if_index != ~0)
 725     {
 726       ip4_address_t * first_int_addr;
 727
 728       for (i = 0; i < vec_len (sm->to_resolve); i++)
 729         {
 730           rp = sm->to_resolve + i;
 731           if (rp->sw_if_index != sw_if_index &&
 732               rp->l_addr.as_u32 != l_addr.as_u32 &&
 733               rp->vrf_id != vrf_id && rp->addr_only != addr_only)
 734             continue;
 735
 736           if (!addr_only)
 737             {
 738               if (rp->l_port != l_port && rp->e_port != e_port && rp->proto != proto)
 739                 continue;
 740             }
 741
 742           rp_match = rp;
 743           break;
 744         }
 745
 746       /* Might be already set... */
 747       first_int_addr = ip4_interface_first_address
 748         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
 749
 750       if (is_add)
 751         {
 752           if (rp_match)
 753             return VNET_API_ERROR_VALUE_EXIST;
 754
 755           snat_add_static_mapping_when_resolved
 756             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 757              addr_only,  is_add, tag);
 758
 759           /* DHCP resolution required? */
 760           if (first_int_addr == 0)
 761             {
 762               return 0;
 763             }
 764           else
 765             {
 766               e_addr.as_u32 = first_int_addr->as_u32;
 767               /* Identity mapping? */
 768               if (l_addr.as_u32 == 0)
 769                 l_addr.as_u32 = e_addr.as_u32;
 770             }
 771         }
 772       else
 773         {
 774           if (!rp_match)
 775             return VNET_API_ERROR_NO_SUCH_ENTRY;
 776
 777           vec_del1 (sm->to_resolve, i);
 778
 779           if (first_int_addr)
 780             {
 781               e_addr.as_u32 = first_int_addr->as_u32;
 782               /* Identity mapping? */
 783               if (l_addr.as_u32 == 0)
 784                 l_addr.as_u32 = e_addr.as_u32;
 785             }
 786           else
 787             return 0;
 788         }
 789     }
 790
 791   m_key.addr = e_addr;
 792   m_key.port = addr_only ? 0 : e_port;
 793   m_key.protocol = addr_only ? 0 : proto;
 794   m_key.fib_index = sm->outside_fib_index;
 795   kv.key = m_key.as_u64;
 796   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 797     m = 0;
 798   else
 799     m = pool_elt_at_index (sm->static_mappings, value.value);
 800
 801   if (is_add)
 802     {
 803       if (m)
 804         return VNET_API_ERROR_VALUE_EXIST;
 805
 806       if (twice_nat && addr_only)
 807         return VNET_API_ERROR_UNSUPPORTED;
 808
 809       /* Convert VRF id to FIB index */
 810       if (vrf_id != ~0)
 811         {
 812           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
 813           if (!p)
 814             return VNET_API_ERROR_NO_SUCH_FIB;
 815           fib_index = p[0];
 816         }
 817       /* If not specified use inside VRF id from SNAT plugin startup config */
 818       else
 819         {
 820           fib_index = sm->inside_fib_index;
 821           vrf_id = sm->inside_vrf_id;
 822         }
 823
 824       if (!out2in_only)
 825         {
 826           m_key.addr = l_addr;
 827           m_key.port = addr_only ? 0 : l_port;
 828           m_key.protocol = addr_only ? 0 : proto;
 829           m_key.fib_index = fib_index;
 830           kv.key = m_key.as_u64;
 831           if (!clib_bihash_search_8_8 (&sm->static_mapping_by_local, &kv, &value))
 832             return VNET_API_ERROR_VALUE_EXIST;
 833         }
 834
 835       /* Find external address in allocated addresses and reserve port for
 836          address and port pair mapping when dynamic translations enabled */
 837       if (!(addr_only || sm->static_mapping_only || out2in_only))
 838         {
 839           for (i = 0; i < vec_len (sm->addresses); i++)
 840             {
 841               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 842                 {
 843                   a = sm->addresses + i;
 844                   /* External port must be unused */
 845                   switch (proto)
 846                     {
 847 #define _(N, j, n, s) \
 848                     case SNAT_PROTOCOL_##N: \
 849                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 850                         return VNET_API_ERROR_INVALID_VALUE; \
 851                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 852                       if (e_port > 1024) \
 853                         { \
 854                           a->busy_##n##_ports++; \
 855                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]++; \
 856                         } \
 857                       break;
 858                       foreach_snat_protocol
 859 #undef _
 860                     default:
 861                       clib_warning("unknown_protocol");
 862                       return VNET_API_ERROR_INVALID_VALUE_2;
 863                     }
 864                   break;
 865                 }
 866             }
 867           /* External address must be allocated */
 868           if (!a && (l_addr.as_u32 != e_addr.as_u32))
 869             {
 870               if (sw_if_index != ~0)
 871                 {
 872                   for (i = 0; i < vec_len (sm->to_resolve); i++)
 873                     {
 874                       rp = sm->to_resolve + i;
 875                       if (rp->addr_only)
 876                          continue;
 877                       if (rp->sw_if_index != sw_if_index &&
 878                           rp->l_addr.as_u32 != l_addr.as_u32 &&
 879                           rp->vrf_id != vrf_id && rp->l_port != l_port &&
 880                           rp->e_port != e_port && rp->proto != proto)
 881                         continue;
 882
 883                       vec_del1 (sm->to_resolve, i);
 884                       break;
 885                     }
 886                 }
 887               return VNET_API_ERROR_NO_SUCH_ENTRY;
 888             }
 889         }
 890
 891       pool_get (sm->static_mappings, m);
 892       memset (m, 0, sizeof (*m));
 893       m->tag = vec_dup (tag);
 894       m->local_addr = l_addr;
 895       m->external_addr = e_addr;
 896       m->addr_only = addr_only;
 897       m->vrf_id = vrf_id;
 898       m->fib_index = fib_index;
 899       m->twice_nat = twice_nat;
 900       m->out2in_only = out2in_only;
 901       if (!addr_only)
 902         {
 903           m->local_port = l_port;
 904           m->external_port = e_port;
 905           m->proto = proto;
 906         }
 907
 908       if (sm->workers)
 909         {
 910           ip4_header_t ip = {
 911             .src_address = m->local_addr,
 912           };
 913           m->worker_index = sm->worker_in2out_cb (&ip, m->fib_index);
 914           tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
 915         }
 916       else
 917         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 918
 919       m_key.addr = m->local_addr;
 920       m_key.port = m->local_port;
 921       m_key.protocol = m->proto;
 922       m_key.fib_index = m->fib_index;
 923       kv.key = m_key.as_u64;
 924       kv.value = m - sm->static_mappings;
 925       if (!out2in_only)
 926         clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 927       if (twice_nat || out2in_only)
 928         {
 929           m_key.port = clib_host_to_net_u16 (m->local_port);
 930           kv.key = m_key.as_u64;
 931           kv.value = ~0ULL;
 932           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
 933             clib_warning ("in2out key add failed");
 934         }
 935
 936       m_key.addr = m->external_addr;
 937       m_key.port = m->external_port;
 938       m_key.fib_index = sm->outside_fib_index;
 939       kv.key = m_key.as_u64;
 940       kv.value = m - sm->static_mappings;
 941       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
 942       if (twice_nat || out2in_only)
 943         {
 944           m_key.port = clib_host_to_net_u16 (e_port);
 945           kv.key = m_key.as_u64;
 946           kv.value = ~0ULL;
 947           if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
 948             clib_warning ("out2in key add failed");
 949         }
 950
 951       /* Delete dynamic sessions matching local address (+ local port) */
 952       if (!(sm->static_mapping_only))
 953         {
 954           u_key.addr = m->local_addr;
 955           u_key.fib_index = m->fib_index;
 956           kv.key = u_key.as_u64;
 957           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 958             {
 959               user_index = value.value;
 960               u = pool_elt_at_index (tsm->users, user_index);
 961               if (u->nsessions)
 962                 {
 963                   head_index = u->sessions_per_user_list_head_index;
 964                   head = pool_elt_at_index (tsm->list_pool, head_index);
 965                   elt_index = head->next;
 966                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 967                   ses_index = elt->value;
 968                   while (ses_index != ~0)
 969                     {
 970                       s =  pool_elt_at_index (tsm->sessions, ses_index);
 971                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
 972                       ses_index = elt->value;
 973
 974                       if (snat_is_session_static (s))
 975                         continue;
 976
 977                       if (!addr_only && (clib_net_to_host_u16 (s->in2out.port) != m->local_port))
 978                         continue;
 979
 980                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
 981                       clib_dlist_remove (tsm->list_pool, s->per_user_index);
 982                       pool_put_index (tsm->list_pool, s->per_user_index);
 983                       pool_put (tsm->sessions, s);
 984                       u->nsessions--;
 985
 986                       if (!addr_only)
 987                         break;
 988                     }
 989                 }
 990             }
 991         }
 992     }
 993   else
 994     {
 995       if (!m)
 996         {
 997           if (sw_if_index != ~0)
 998             return 0;
 999           else
1000             return VNET_API_ERROR_NO_SUCH_ENTRY;
1001         }
1002
1003       /* Free external address port */
1004       if (!(addr_only || sm->static_mapping_only || out2in_only))
1005         {
1006           for (i = 0; i < vec_len (sm->addresses); i++)
1007             {
1008               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1009                 {
1010                   a = sm->addresses + i;
1011                   switch (proto)
1012                     {
1013 #define _(N, j, n, s) \
1014                     case SNAT_PROTOCOL_##N: \
1015                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1016                       if (e_port > 1024) \
1017                         { \
1018                           a->busy_##n##_ports--; \
1019                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]--; \
1020                         } \
1021                       break;
1022                       foreach_snat_protocol
1023 #undef _
1024                     default:
1025                       clib_warning("unknown_protocol");
1026                       return VNET_API_ERROR_INVALID_VALUE_2;
1027                     }
1028                   break;
1029                 }
1030             }
1031         }
1032
1033       if (sm->num_workers > 1)
1034         tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
1035       else
1036         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1037
1038       m_key.addr = m->local_addr;
1039       m_key.port = m->local_port;
1040       m_key.protocol = m->proto;
1041       m_key.fib_index = m->fib_index;
1042       kv.key = m_key.as_u64;
1043       if (!out2in_only)
1044         clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
1045       if (twice_nat || out2in_only)
1046         {
1047           m_key.port = clib_host_to_net_u16 (m->local_port);
1048           kv.key = m_key.as_u64;
1049           kv.value = ~0ULL;
1050           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
1051             clib_warning ("in2out key del failed");
1052         }
1053
1054       m_key.addr = m->external_addr;
1055       m_key.port = m->external_port;
1056       m_key.fib_index = sm->outside_fib_index;
1057       kv.key = m_key.as_u64;
1058       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
1059       if (twice_nat || out2in_only)
1060         {
1061           m_key.port = clib_host_to_net_u16 (m->external_port);
1062           kv.key = m_key.as_u64;
1063           kv.value = ~0ULL;
1064           if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
1065             clib_warning ("out2in key del failed");
1066         }
1067
1068       /* Delete session(s) for static mapping if exist */
1069       if (!(sm->static_mapping_only) ||
1070           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
1071         {
1072           u_key.addr = m->local_addr;
1073           u_key.fib_index = m->fib_index;
1074           kv.key = u_key.as_u64;
1075           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1076             {
1077               user_index = value.value;
1078               u = pool_elt_at_index (tsm->users, user_index);
1079               if (u->nstaticsessions)
1080                 {
1081                   head_index = u->sessions_per_user_list_head_index;
1082                   head = pool_elt_at_index (tsm->list_pool, head_index);
1083                   elt_index = head->next;
1084                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1085                   ses_index = elt->value;
1086                   while (ses_index != ~0)
1087                     {
1088                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1089                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1090                       ses_index = elt->value;
1091
1092                       if (!addr_only)
1093                         {
1094                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) &&
1095                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
1096                             continue;
1097                         }
1098
1099                       if (is_lb_session (s))
1100                         continue;
1101
1102                       if (!snat_is_session_static (s))
1103                         continue;
1104
1105                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1106                       clib_dlist_remove (tsm->list_pool, s->per_user_index);
1107                       pool_put_index (tsm->list_pool, s->per_user_index);
1108                       pool_put (tsm->sessions, s);
1109                       u->nstaticsessions--;
1110
1111                       if (!addr_only)
1112                         break;
1113                     }
1114                   if (addr_only && (u->nstaticsessions == 0))
1115                     {
1116                       pool_put (tsm->users, u);
1117                       clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 0);
1118                     }
1119                 }
1120             }
1121         }
1122
1123       vec_free (m->tag);
1124       /* Delete static mapping from pool */
1125       pool_put (sm->static_mappings, m);
1126     }
1127
1128   if (!addr_only || (l_addr.as_u32 == e_addr.as_u32))
1129     return 0;
1130
1131   /* Add/delete external address to FIB */
1132   pool_foreach (interface, sm->interfaces,
1133   ({
1134     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1135       continue;
1136
1137     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1138     break;
1139   }));
1140   pool_foreach (interface, sm->output_feature_interfaces,
1141   ({
1142     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1143       continue;
1144
1145     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1146     break;
1147   }));
1148
1149   return 0;
1150 }
1151
1152 static int lb_local_exists (nat44_lb_addr_port_t * local,
1153                             ip4_address_t * e_addr, u16 e_port)
1154 {
1155   snat_main_t *sm = &snat_main;
1156   snat_static_mapping_t *m;
1157   nat44_lb_addr_port_t *ap;
1158
1159   /* *INDENT-OFF* */
1160   pool_foreach (m, sm->static_mappings,
1161   ({
1162       if (vec_len(m->locals))
1163         {
1164           if (m->external_port == e_port && m->external_addr.as_u32 == e_addr->as_u32)
1165             continue;
1166
1167           vec_foreach (ap, m->locals)
1168           {
1169             if (ap->port == local->port && ap->addr.as_u32 == local->addr.as_u32)
1170               return 1;
1171           }
1172         }
1173   }));
1174   /* *INDENT-ON* */
1175
1176   return 0;
1177 }
1178
1179 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
1180                                      snat_protocol_t proto, u32 vrf_id,
1181                                      nat44_lb_addr_port_t *locals, u8 is_add,
1182                                      twice_nat_type_t twice_nat, u8 out2in_only,
1183                                      u8 *tag)
1184 {
1185   snat_main_t * sm = &snat_main;
1186   snat_static_mapping_t *m;
1187   snat_session_key_t m_key;
1188   clib_bihash_kv_8_8_t kv, value;
1189   u32 fib_index;
1190   snat_address_t *a = 0;
1191   int i;
1192   nat44_lb_addr_port_t *local;
1193   u32 worker_index = 0, elt_index, head_index, ses_index;
1194   snat_main_per_thread_data_t *tsm;
1195   snat_user_key_t u_key;
1196   snat_user_t *u;
1197   snat_session_t * s;
1198   dlist_elt_t * head, * elt;
1199
1200   m_key.addr = e_addr;
1201   m_key.port = e_port;
1202   m_key.protocol = proto;
1203   m_key.fib_index = sm->outside_fib_index;
1204   kv.key = m_key.as_u64;
1205   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1206     m = 0;
1207   else
1208     m = pool_elt_at_index (sm->static_mappings, value.value);
1209
1210   if (is_add)
1211     {
1212       if (m)
1213         return VNET_API_ERROR_VALUE_EXIST;
1214
1215       if (vec_len (locals) < 2)
1216         return VNET_API_ERROR_INVALID_VALUE;
1217
1218       fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1219                                                      vrf_id,
1220                                                      FIB_SOURCE_PLUGIN_LOW);
1221
1222       /* Find external address in allocated addresses and reserve port for
1223          address and port pair mapping when dynamic translations enabled */
1224       if (!(sm->static_mapping_only || out2in_only))
1225         {
1226           for (i = 0; i < vec_len (sm->addresses); i++)
1227             {
1228               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1229                 {
1230                   a = sm->addresses + i;
1231                   /* External port must be unused */
1232                   switch (proto)
1233                     {
1234 #define _(N, j, n, s) \
1235                     case SNAT_PROTOCOL_##N: \
1236                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1237                         return VNET_API_ERROR_INVALID_VALUE; \
1238                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1239                       if (e_port > 1024) \
1240                         { \
1241                           a->busy_##n##_ports++; \
1242                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]++; \
1243                         } \
1244                       break;
1245                       foreach_snat_protocol
1246 #undef _
1247                     default:
1248                       clib_warning("unknown_protocol");
1249                       return VNET_API_ERROR_INVALID_VALUE_2;
1250                     }
1251                   break;
1252                 }
1253             }
1254           /* External address must be allocated */
1255           if (!a)
1256             return VNET_API_ERROR_NO_SUCH_ENTRY;
1257         }
1258
1259       pool_get (sm->static_mappings, m);
1260       memset (m, 0, sizeof (*m));
1261       m->tag = vec_dup (tag);
1262       m->external_addr = e_addr;
1263       m->addr_only = 0;
1264       m->vrf_id = vrf_id;
1265       m->fib_index = fib_index;
1266       m->external_port = e_port;
1267       m->proto = proto;
1268       m->twice_nat = twice_nat;
1269       m->out2in_only = out2in_only;
1270
1271       m_key.addr = m->external_addr;
1272       m_key.port = m->external_port;
1273       m_key.protocol = m->proto;
1274       m_key.fib_index = sm->outside_fib_index;
1275       kv.key = m_key.as_u64;
1276       kv.value = m - sm->static_mappings;
1277       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1))
1278         {
1279           clib_warning ("static_mapping_by_external key add failed");
1280           return VNET_API_ERROR_UNSPECIFIED;
1281         }
1282
1283       /* Assign worker */
1284       if (sm->workers)
1285         {
1286           worker_index = sm->first_worker_index +
1287             sm->workers[sm->next_worker++ % vec_len (sm->workers)];
1288           tsm = vec_elt_at_index (sm->per_thread_data, worker_index);
1289           m->worker_index = worker_index;
1290         }
1291       else
1292         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1293
1294       m_key.port = clib_host_to_net_u16 (m->external_port);
1295       kv.key = m_key.as_u64;
1296       kv.value = ~0ULL;
1297       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
1298         {
1299           clib_warning ("out2in key add failed");
1300           return VNET_API_ERROR_UNSPECIFIED;
1301         }
1302
1303       m_key.fib_index = m->fib_index;
1304       for (i = 0; i < vec_len (locals); i++)
1305         {
1306           m_key.addr = locals[i].addr;
1307           if (!out2in_only)
1308             {
1309               m_key.port = locals[i].port;
1310               kv.key = m_key.as_u64;
1311               kv.value = m - sm->static_mappings;
1312               clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
1313             }
1314           locals[i].prefix = (i == 0) ? locals[i].probability :\
1315             (locals[i - 1].prefix + locals[i].probability);
1316           vec_add1 (m->locals, locals[i]);
1317
1318           m_key.port = clib_host_to_net_u16 (locals[i].port);
1319           kv.key = m_key.as_u64;
1320           kv.value = ~0ULL;
1321           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
1322             {
1323               clib_warning ("in2out key add failed");
1324               return VNET_API_ERROR_UNSPECIFIED;
1325             }
1326         }
1327     }
1328   else
1329     {
1330       if (!m)
1331         return VNET_API_ERROR_NO_SUCH_ENTRY;
1332
1333       fib_table_unlock (m->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1334
1335       /* Free external address port */
1336       if (!(sm->static_mapping_only || out2in_only))
1337         {
1338           for (i = 0; i < vec_len (sm->addresses); i++)
1339             {
1340               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1341                 {
1342                   a = sm->addresses + i;
1343                   switch (proto)
1344                     {
1345 #define _(N, j, n, s) \
1346                     case SNAT_PROTOCOL_##N: \
1347                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1348                       if (e_port > 1024) \
1349                         { \
1350                           a->busy_##n##_ports--; \
1351                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]--; \
1352                         } \
1353                       break;
1354                       foreach_snat_protocol
1355 #undef _
1356                     default:
1357                       clib_warning("unknown_protocol");
1358                       return VNET_API_ERROR_INVALID_VALUE_2;
1359                     }
1360                   break;
1361                 }
1362             }
1363         }
1364
1365       tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
1366       m_key.addr = m->external_addr;
1367       m_key.port = m->external_port;
1368       m_key.protocol = m->proto;
1369       m_key.fib_index = sm->outside_fib_index;
1370       kv.key = m_key.as_u64;
1371       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0))
1372         {
1373           clib_warning ("static_mapping_by_external key del failed");
1374           return VNET_API_ERROR_UNSPECIFIED;
1375         }
1376
1377       m_key.port = clib_host_to_net_u16 (m->external_port);
1378       kv.key = m_key.as_u64;
1379       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
1380         {
1381           clib_warning ("outi2in key del failed");
1382           return VNET_API_ERROR_UNSPECIFIED;
1383         }
1384
1385       vec_foreach (local, m->locals)
1386         {
1387           m_key.addr = local->addr;
1388           if (!out2in_only)
1389             {
1390               m_key.port = local->port;
1391               m_key.fib_index = m->fib_index;
1392               kv.key = m_key.as_u64;
1393               if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1394                 {
1395                   clib_warning ("static_mapping_by_local key del failed");
1396                   return VNET_API_ERROR_UNSPECIFIED;
1397                 }
1398             }
1399
1400           if (!lb_local_exists(local, &e_addr, e_port))
1401             {
1402               m_key.port = clib_host_to_net_u16 (local->port);
1403               kv.key = m_key.as_u64;
1404               if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
1405                 {
1406                   clib_warning ("in2out key del failed");
1407                   return VNET_API_ERROR_UNSPECIFIED;
1408                 }
1409             }
1410           /* Delete sessions */
1411           u_key.addr = local->addr;
1412           u_key.fib_index = m->fib_index;
1413           kv.key = u_key.as_u64;
1414           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1415             {
1416               u = pool_elt_at_index (tsm->users, value.value);
1417               if (u->nstaticsessions)
1418                 {
1419                   head_index = u->sessions_per_user_list_head_index;
1420                   head = pool_elt_at_index (tsm->list_pool, head_index);
1421                   elt_index = head->next;
1422                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1423                   ses_index = elt->value;
1424                   while (ses_index != ~0)
1425                     {
1426                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1427                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1428                       ses_index = elt->value;
1429
1430                       if (!(is_lb_session (s)))
1431                         continue;
1432
1433                       if ((s->in2out.addr.as_u32 != local->addr.as_u32) &&
1434                           (clib_net_to_host_u16 (s->in2out.port) != local->port))
1435                         continue;
1436
1437                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1438                       clib_dlist_remove (tsm->list_pool, s->per_user_index);
1439                       pool_put_index (tsm->list_pool, s->per_user_index);
1440                       pool_put (tsm->sessions, s);
1441                       u->nstaticsessions--;
1442                     }
1443                 }
1444             }
1445         }
1446       vec_free(m->locals);
1447       vec_free(m->tag);
1448
1449       pool_put (sm->static_mappings, m);
1450     }
1451
1452   return 0;
1453 }
1454
1455 int
1456 snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm,
1457                   u8 twice_nat)
1458 {
1459   snat_address_t *a = 0;
1460   snat_session_t *ses;
1461   u32 *ses_to_be_removed = 0, *ses_index;
1462   clib_bihash_kv_8_8_t kv, value;
1463   snat_user_key_t user_key;
1464   snat_user_t *u;
1465   snat_main_per_thread_data_t *tsm;
1466   snat_static_mapping_t *m;
1467   snat_interface_t *interface;
1468   int i;
1469   snat_address_t *addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
1470
1471   /* Find SNAT address */
1472   for (i=0; i < vec_len (addresses); i++)
1473     {
1474       if (addresses[i].addr.as_u32 == addr.as_u32)
1475         {
1476           a = addresses + i;
1477           break;
1478         }
1479     }
1480   if (!a)
1481     return VNET_API_ERROR_NO_SUCH_ENTRY;
1482
1483   if (delete_sm)
1484     {
1485       pool_foreach (m, sm->static_mappings,
1486       ({
1487           if (m->external_addr.as_u32 == addr.as_u32)
1488             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1489                                             m->local_port, m->external_port,
1490                                             m->vrf_id, m->addr_only, ~0,
1491                                             m->proto, 0, m->twice_nat,
1492                                             m->out2in_only, m->tag);
1493       }));
1494     }
1495   else
1496     {
1497       /* Check if address is used in some static mapping */
1498       if (is_snat_address_used_in_static_mapping(sm, addr))
1499         {
1500           clib_warning ("address used in static mapping");
1501           return VNET_API_ERROR_UNSPECIFIED;
1502         }
1503     }
1504
1505   if (a->fib_index != ~0)
1506     fib_table_unlock(a->fib_index, FIB_PROTOCOL_IP4,
1507                      FIB_SOURCE_PLUGIN_LOW);
1508
1509   /* Delete sessions using address */
1510   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1511     {
1512       vec_foreach (tsm, sm->per_thread_data)
1513         {
1514           pool_foreach (ses, tsm->sessions, ({
1515             if (ses->out2in.addr.as_u32 == addr.as_u32)
1516               {
1517                 ses->outside_address_index = ~0;
1518                 nat_free_session_data (sm, ses, tsm - sm->per_thread_data);
1519                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
1520                 pool_put_index (tsm->list_pool, ses->per_user_index);
1521                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1522                 user_key.addr = ses->in2out.addr;
1523                 user_key.fib_index = ses->in2out.fib_index;
1524                 kv.key = user_key.as_u64;
1525                 if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1526                   {
1527                     u = pool_elt_at_index (tsm->users, value.value);
1528                     if (snat_is_session_static (ses))
1529                       u->nstaticsessions--;
1530                     else
1531                       u->nsessions--;
1532                   }
1533               }
1534           }));
1535
1536           vec_foreach (ses_index, ses_to_be_removed)
1537             pool_put_index (tsm->sessions, ses_index[0]);
1538
1539           vec_free (ses_to_be_removed);
1540        }
1541     }
1542
1543   if (twice_nat)
1544     {
1545       vec_del1 (sm->twice_nat_addresses, i);
1546       return 0;
1547     }
1548   else
1549     vec_del1 (sm->addresses, i);
1550
1551   /* Delete external address from FIB */
1552   pool_foreach (interface, sm->interfaces,
1553   ({
1554     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1555       continue;
1556
1557     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1558     break;
1559   }));
1560   pool_foreach (interface, sm->output_feature_interfaces,
1561   ({
1562     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1563       continue;
1564
1565     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1566     break;
1567   }));
1568
1569   return 0;
1570 }
1571
1572 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
1573 {
1574   snat_main_t *sm = &snat_main;
1575   snat_interface_t *i;
1576   const char * feature_name, *del_feature_name;
1577   snat_address_t * ap;
1578   snat_static_mapping_t * m;
1579   snat_det_map_t * dm;
1580
1581   if (sm->out2in_dpo && !is_inside)
1582     return VNET_API_ERROR_UNSUPPORTED;
1583
1584   pool_foreach (i, sm->output_feature_interfaces,
1585   ({
1586     if (i->sw_if_index == sw_if_index)
1587       return VNET_API_ERROR_VALUE_EXIST;
1588   }));
1589
1590   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1591     feature_name = is_inside ?  "nat44-in2out-fast" : "nat44-out2in-fast";
1592   else
1593     {
1594       if (sm->num_workers > 1 && !sm->deterministic)
1595         feature_name = is_inside ?  "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff";
1596       else if (sm->deterministic)
1597         feature_name = is_inside ?  "nat44-det-in2out" : "nat44-det-out2in";
1598       else
1599         feature_name = is_inside ?  "nat44-in2out" : "nat44-out2in";
1600     }
1601
1602   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1603     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, 0);
1604
1605   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1606     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1607
1608   pool_foreach (i, sm->interfaces,
1609   ({
1610     if (i->sw_if_index == sw_if_index)
1611       {
1612         if (is_del)
1613           {
1614             if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1615               {
1616                 if (is_inside)
1617                   i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1618                 else
1619                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1620
1621                 if (sm->num_workers > 1 && !sm->deterministic)
1622                   {
1623                     del_feature_name = "nat44-handoff-classify";
1624                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1625                                                  "nat44-out2in-worker-handoff";
1626                   }
1627                 else if (sm->deterministic)
1628                   {
1629                     del_feature_name = "nat44-det-classify";
1630                     feature_name = !is_inside ?  "nat44-det-in2out" :
1631                                                  "nat44-det-out2in";
1632                   }
1633                 else
1634                   {
1635                     del_feature_name = "nat44-classify";
1636                     feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1637                   }
1638
1639                 vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1640                                              sw_if_index, 0, 0, 0);
1641                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1642                                              sw_if_index, 1, 0, 0);
1643                 if (!is_inside)
1644                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1645                                                sw_if_index, 1, 0, 0);
1646               }
1647             else
1648               {
1649                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1650                                              sw_if_index, 0, 0, 0);
1651                 pool_put (sm->interfaces, i);
1652                 if (is_inside)
1653                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1654                                                sw_if_index, 0, 0, 0);
1655               }
1656           }
1657         else
1658           {
1659             if ((nat_interface_is_inside(i) && is_inside) ||
1660                 (nat_interface_is_outside(i) && !is_inside))
1661               return 0;
1662
1663             if (sm->num_workers > 1 && !sm->deterministic)
1664               {
1665                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1666                                                  "nat44-out2in-worker-handoff";
1667                 feature_name = "nat44-handoff-classify";
1668               }
1669             else if (sm->deterministic)
1670               {
1671                 del_feature_name = !is_inside ?  "nat44-det-in2out" :
1672                                                  "nat44-det-out2in";
1673                 feature_name = "nat44-det-classify";
1674               }
1675             else
1676               {
1677                 del_feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1678                 feature_name = "nat44-classify";
1679               }
1680
1681             vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1682                                          sw_if_index, 0, 0, 0);
1683             vnet_feature_enable_disable ("ip4-unicast", feature_name,
1684                                          sw_if_index, 1, 0, 0);
1685             if (!is_inside)
1686               vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1687                                            sw_if_index, 0, 0, 0);
1688             goto set_flags;
1689           }
1690
1691         goto fib;
1692       }
1693   }));
1694
1695   if (is_del)
1696     return VNET_API_ERROR_NO_SUCH_ENTRY;
1697
1698   pool_get (sm->interfaces, i);
1699   i->sw_if_index = sw_if_index;
1700   i->flags = 0;
1701   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, 1, 0, 0);
1702
1703   if (is_inside && !sm->out2in_dpo)
1704     vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1705                                  sw_if_index, 1, 0, 0);
1706
1707 set_flags:
1708   if (is_inside)
1709     {
1710       i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1711       return 0;
1712     }
1713   else
1714     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1715
1716   /* Add/delete external addresses to FIB */
1717 fib:
1718   vec_foreach (ap, sm->addresses)
1719     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1720
1721   pool_foreach (m, sm->static_mappings,
1722   ({
1723     if (!(m->addr_only) || (m->local_addr.as_u32 == m->external_addr.as_u32))
1724       continue;
1725
1726     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1727   }));
1728
1729   pool_foreach (dm, sm->det_maps,
1730   ({
1731     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1732   }));
1733
1734   return 0;
1735 }
1736
1737 int snat_interface_add_del_output_feature (u32 sw_if_index,
1738                                            u8 is_inside,
1739                                            int is_del)
1740 {
1741   snat_main_t *sm = &snat_main;
1742   snat_interface_t *i;
1743   snat_address_t * ap;
1744   snat_static_mapping_t * m;
1745
1746   if (sm->deterministic ||
1747       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1748     return VNET_API_ERROR_UNSUPPORTED;
1749
1750   pool_foreach (i, sm->interfaces,
1751   ({
1752     if (i->sw_if_index == sw_if_index)
1753       return VNET_API_ERROR_VALUE_EXIST;
1754   }));
1755
1756   if (is_inside)
1757     {
1758       vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1759                                    sw_if_index, !is_del, 0, 0);
1760       vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1761                                    sw_if_index, !is_del, 0, 0);
1762       goto fq;
1763     }
1764
1765   if (sm->num_workers > 1)
1766     {
1767       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in-worker-handoff",
1768                                    sw_if_index, !is_del, 0, 0);
1769       vnet_feature_enable_disable ("ip4-output",
1770                                    "nat44-in2out-output-worker-handoff",
1771                                    sw_if_index, !is_del, 0, 0);
1772     }
1773   else
1774     {
1775       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in", sw_if_index,
1776                                    !is_del, 0, 0);
1777       vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1778                                    sw_if_index, !is_del, 0, 0);
1779     }
1780
1781 fq:
1782   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1783     sm->fq_in2out_output_index =
1784       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1785
1786   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1787     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1788
1789   pool_foreach (i, sm->output_feature_interfaces,
1790   ({
1791     if (i->sw_if_index == sw_if_index)
1792       {
1793         if (is_del)
1794           pool_put (sm->output_feature_interfaces, i);
1795         else
1796           return VNET_API_ERROR_VALUE_EXIST;
1797
1798         goto fib;
1799       }
1800   }));
1801
1802   if (is_del)
1803     return VNET_API_ERROR_NO_SUCH_ENTRY;
1804
1805   pool_get (sm->output_feature_interfaces, i);
1806   i->sw_if_index = sw_if_index;
1807   i->flags = 0;
1808   if (is_inside)
1809     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1810   else
1811     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1812
1813   /* Add/delete external addresses to FIB */
1814 fib:
1815   if (is_inside)
1816     return 0;
1817
1818   vec_foreach (ap, sm->addresses)
1819     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1820
1821   pool_foreach (m, sm->static_mappings,
1822   ({
1823     if (!(m->addr_only)  || (m->local_addr.as_u32 == m->external_addr.as_u32))
1824       continue;
1825
1826     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1827   }));
1828
1829   return 0;
1830 }
1831
1832 int snat_set_workers (uword * bitmap)
1833 {
1834   snat_main_t *sm = &snat_main;
1835   int i, j = 0;
1836
1837   if (sm->num_workers < 2)
1838     return VNET_API_ERROR_FEATURE_DISABLED;
1839
1840   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1841     return VNET_API_ERROR_INVALID_WORKER;
1842
1843   vec_free (sm->workers);
1844   clib_bitmap_foreach (i, bitmap,
1845     ({
1846       vec_add1(sm->workers, i);
1847       sm->per_thread_data[sm->first_worker_index + i].snat_thread_index = j;
1848       j++;
1849     }));
1850
1851   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1852   sm->num_snat_thread = _vec_len (sm->workers);
1853
1854   return 0;
1855 }
1856
1857
1858 static void
1859 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1860                                        uword opaque,
1861                                        u32 sw_if_index,
1862                                        ip4_address_t * address,
1863                                        u32 address_length,
1864                                        u32 if_address_index,
1865                                        u32 is_delete);
1866
1867 static void
1868 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
1869                                  uword opaque,
1870                                  u32 sw_if_index,
1871                                  ip4_address_t * address,
1872                                  u32 address_length,
1873                                  u32 if_address_index,
1874                                  u32 is_delete);
1875
1876 static int
1877 nat_alloc_addr_and_port_default (snat_address_t * addresses,
1878                                  u32 fib_index,
1879                                  u32 thread_index,
1880                                  snat_session_key_t * k,
1881                                  u32 * address_indexp,
1882                                  u16 port_per_thread,
1883                                  u32 snat_thread_index);
1884
1885 static clib_error_t * snat_init (vlib_main_t * vm)
1886 {
1887   snat_main_t * sm = &snat_main;
1888   clib_error_t * error = 0;
1889   ip4_main_t * im = &ip4_main;
1890   ip_lookup_main_t * lm = &im->lookup_main;
1891   uword *p;
1892   vlib_thread_registration_t *tr;
1893   vlib_thread_main_t *tm = vlib_get_thread_main ();
1894   uword *bitmap = 0;
1895   u32 i;
1896   ip4_add_del_interface_address_callback_t cb4;
1897
1898   sm->vlib_main = vm;
1899   sm->vnet_main = vnet_get_main();
1900   sm->ip4_main = im;
1901   sm->ip4_lookup_main = lm;
1902   sm->api_main = &api_main;
1903   sm->first_worker_index = 0;
1904   sm->next_worker = 0;
1905   sm->num_workers = 0;
1906   sm->num_snat_thread = 1;
1907   sm->workers = 0;
1908   sm->port_per_thread = 0xffff - 1024;
1909   sm->fq_in2out_index = ~0;
1910   sm->fq_out2in_index = ~0;
1911   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1912   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1913   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1914   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1915   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
1916   sm->forwarding_enabled = 0;
1917
1918   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1919   if (p)
1920     {
1921       tr = (vlib_thread_registration_t *) p[0];
1922       if (tr)
1923         {
1924           sm->num_workers = tr->count;
1925           sm->first_worker_index = tr->first_index;
1926         }
1927     }
1928
1929   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1930
1931   /* Use all available workers by default */
1932   if (sm->num_workers > 1)
1933     {
1934       for (i=0; i < sm->num_workers; i++)
1935         bitmap = clib_bitmap_set (bitmap, i, 1);
1936       snat_set_workers(bitmap);
1937       clib_bitmap_free (bitmap);
1938     }
1939   else
1940     {
1941       sm->per_thread_data[0].snat_thread_index = 0;
1942     }
1943
1944   error = snat_api_init(vm, sm);
1945   if (error)
1946     return error;
1947
1948   /* Set up the interface address add/del callback */
1949   cb4.function = snat_ip4_add_del_interface_address_cb;
1950   cb4.function_opaque = 0;
1951
1952   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1953
1954   cb4.function = nat_ip4_add_del_addr_only_sm_cb;
1955   cb4.function_opaque = 0;
1956
1957   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1958
1959   nat_dpo_module_init ();
1960
1961   /* Init IPFIX logging */
1962   snat_ipfix_logging_init(vm);
1963
1964   /* Init NAT64 */
1965   error = nat64_init(vm);
1966   if (error)
1967     return error;
1968
1969   dslite_init(vm);
1970
1971   nat66_init();
1972
1973   /* Init virtual fragmenentation reassembly */
1974   return nat_reass_init(vm);
1975 }
1976
1977 VLIB_INIT_FUNCTION (snat_init);
1978
1979 void snat_free_outside_address_and_port (snat_address_t * addresses,
1980                                          u32 thread_index,
1981                                          snat_session_key_t * k,
1982                                          u32 address_index)
1983 {
1984   snat_address_t *a;
1985   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
1986
1987   ASSERT (address_index < vec_len (addresses));
1988
1989   a = addresses + address_index;
1990
1991   switch (k->protocol)
1992     {
1993 #define _(N, i, n, s) \
1994     case SNAT_PROTOCOL_##N: \
1995       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
1996         port_host_byte_order) == 1); \
1997       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
1998         port_host_byte_order, 0); \
1999       a->busy_##n##_ports--; \
2000       a->busy_##n##_ports_per_thread[thread_index]--; \
2001       break;
2002       foreach_snat_protocol
2003 #undef _
2004     default:
2005       clib_warning("unknown_protocol");
2006       return;
2007     }
2008 }
2009
2010 /**
2011  * @brief Match NAT44 static mapping.
2012  *
2013  * @param sm          NAT main.
2014  * @param match       Address and port to match.
2015  * @param mapping     External or local address and port of the matched mapping.
2016  * @param by_external If 0 match by local address otherwise match by external
2017  *                    address.
2018  * @param is_addr_only If matched mapping is address only
2019  * @param twice_nat If matched mapping is twice NAT.
2020  * @param lb If matched mapping is load-balanced.
2021  *
2022  * @returns 0 if match found otherwise 1.
2023  */
2024 int snat_static_mapping_match (snat_main_t * sm,
2025                                snat_session_key_t match,
2026                                snat_session_key_t * mapping,
2027                                u8 by_external,
2028                                u8 *is_addr_only,
2029                                twice_nat_type_t *twice_nat,
2030                                u8 *lb)
2031 {
2032   clib_bihash_kv_8_8_t kv, value;
2033   snat_static_mapping_t *m;
2034   snat_session_key_t m_key;
2035   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
2036   u32 rand, lo = 0, hi, mid;
2037
2038   if (by_external)
2039     mapping_hash = &sm->static_mapping_by_external;
2040
2041   m_key.addr = match.addr;
2042   m_key.port = clib_net_to_host_u16 (match.port);
2043   m_key.protocol = match.protocol;
2044   m_key.fib_index = match.fib_index;
2045
2046   kv.key = m_key.as_u64;
2047
2048   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2049     {
2050       /* Try address only mapping */
2051       m_key.port = 0;
2052       m_key.protocol = 0;
2053       kv.key = m_key.as_u64;
2054       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2055         return 1;
2056     }
2057
2058   m = pool_elt_at_index (sm->static_mappings, value.value);
2059
2060   if (by_external)
2061     {
2062       if (vec_len (m->locals))
2063         {
2064           hi = vec_len (m->locals) - 1;
2065           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
2066           while (lo < hi)
2067             {
2068               mid = ((hi - lo) >> 1) + lo;
2069               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
2070             }
2071           if (!(m->locals[lo].prefix >= rand))
2072             return 1;
2073           mapping->addr = m->locals[lo].addr;
2074           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
2075         }
2076       else
2077         {
2078           mapping->addr = m->local_addr;
2079           /* Address only mapping doesn't change port */
2080           mapping->port = m->addr_only ? match.port
2081             : clib_host_to_net_u16 (m->local_port);
2082         }
2083       mapping->fib_index = m->fib_index;
2084       mapping->protocol = m->proto;
2085     }
2086   else
2087     {
2088       mapping->addr = m->external_addr;
2089       /* Address only mapping doesn't change port */
2090       mapping->port = m->addr_only ? match.port
2091         : clib_host_to_net_u16 (m->external_port);
2092       mapping->fib_index = sm->outside_fib_index;
2093     }
2094
2095   if (PREDICT_FALSE(is_addr_only != 0))
2096     *is_addr_only = m->addr_only;
2097
2098   if (PREDICT_FALSE(twice_nat != 0))
2099     *twice_nat = m->twice_nat;
2100
2101   if (PREDICT_FALSE(lb != 0))
2102     *lb = vec_len (m->locals) > 0;
2103
2104   return 0;
2105 }
2106
2107 static_always_inline u16
2108 snat_random_port (u16 min, u16 max)
2109 {
2110   snat_main_t *sm = &snat_main;
2111   return min + random_u32 (&sm->random_seed) /
2112     (random_u32_max() / (max - min + 1) + 1);
2113 }
2114
2115 int
2116 snat_alloc_outside_address_and_port (snat_address_t * addresses,
2117                                      u32 fib_index,
2118                                      u32 thread_index,
2119                                      snat_session_key_t * k,
2120                                      u32 * address_indexp,
2121                                      u16 port_per_thread,
2122                                      u32 snat_thread_index)
2123 {
2124   snat_main_t *sm = &snat_main;
2125
2126   return sm->alloc_addr_and_port(addresses, fib_index, thread_index, k,
2127                                  address_indexp, port_per_thread,
2128                                  snat_thread_index);
2129 }
2130
2131 static int
2132 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2133                                  u32 fib_index,
2134                                  u32 thread_index,
2135                                  snat_session_key_t * k,
2136                                  u32 * address_indexp,
2137                                  u16 port_per_thread,
2138                                  u32 snat_thread_index)
2139 {
2140   int i, gi = 0;
2141   snat_address_t *a, *ga = 0;
2142   u32 portnum;
2143
2144   for (i = 0; i < vec_len (addresses); i++)
2145     {
2146       a = addresses + i;
2147       switch (k->protocol)
2148         {
2149 #define _(N, j, n, s) \
2150         case SNAT_PROTOCOL_##N: \
2151           if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
2152             { \
2153               if (a->fib_index == fib_index) \
2154                 { \
2155                   while (1) \
2156                     { \
2157                       portnum = (port_per_thread * \
2158                         snat_thread_index) + \
2159                         snat_random_port(1, port_per_thread) + 1024; \
2160                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2161                         continue; \
2162                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2163                       a->busy_##n##_ports_per_thread[thread_index]++; \
2164                       a->busy_##n##_ports++; \
2165                       k->addr = a->addr; \
2166                       k->port = clib_host_to_net_u16(portnum); \
2167                       *address_indexp = i; \
2168                       return 0; \
2169                     } \
2170                 } \
2171               else if (a->fib_index == ~0) \
2172                 { \
2173                   ga = a; \
2174                   gi = i; \
2175                 } \
2176             } \
2177           break;
2178           foreach_snat_protocol
2179 #undef _
2180         default:
2181           clib_warning("unknown protocol");
2182           return 1;
2183         }
2184
2185     }
2186
2187   if (ga)
2188     {
2189       a = ga;
2190       switch (k->protocol)
2191         {
2192 #define _(N, j, n, s) \
2193         case SNAT_PROTOCOL_##N: \
2194           while (1) \
2195             { \
2196               portnum = (port_per_thread * \
2197                 snat_thread_index) + \
2198                 snat_random_port(1, port_per_thread) + 1024; \
2199               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2200                 continue; \
2201               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2202               a->busy_##n##_ports_per_thread[thread_index]++; \
2203               a->busy_##n##_ports++; \
2204               k->addr = a->addr; \
2205               k->port = clib_host_to_net_u16(portnum); \
2206               *address_indexp = gi; \
2207               return 0; \
2208             }
2209           break;
2210           foreach_snat_protocol
2211 #undef _
2212         default:
2213           clib_warning ("unknown protocol");
2214           return 1;
2215         }
2216     }
2217
2218   /* Totally out of translations to use... */
2219   snat_ipfix_logging_addresses_exhausted(0);
2220   return 1;
2221 }
2222
2223 static int
2224 nat_alloc_addr_and_port_mape (snat_address_t * addresses,
2225                               u32 fib_index,
2226                               u32 thread_index,
2227                               snat_session_key_t * k,
2228                               u32 * address_indexp,
2229                               u16 port_per_thread,
2230                               u32 snat_thread_index)
2231 {
2232   snat_main_t *sm = &snat_main;
2233   snat_address_t *a = addresses;
2234   u16 m, ports, portnum, A, j;
2235   m = 16 - (sm->psid_offset + sm->psid_length);
2236   ports = (1 << (16 - sm->psid_length)) - (1 << m);
2237
2238   if (!vec_len (addresses))
2239     goto exhausted;
2240
2241   switch (k->protocol)
2242     {
2243 #define _(N, i, n, s) \
2244     case SNAT_PROTOCOL_##N: \
2245       if (a->busy_##n##_ports < ports) \
2246         { \
2247           while (1) \
2248             { \
2249               A = snat_random_port(1, pow2_mask(sm->psid_offset)); \
2250               j = snat_random_port(0, pow2_mask(m)); \
2251               portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \
2252               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2253                 continue; \
2254               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2255               a->busy_##n##_ports++; \
2256               k->addr = a->addr; \
2257               k->port = clib_host_to_net_u16 (portnum); \
2258               *address_indexp = i; \
2259               return 0; \
2260             } \
2261         } \
2262       break;
2263       foreach_snat_protocol
2264 #undef _
2265     default:
2266       clib_warning("unknown protocol");
2267       return 1;
2268     }
2269
2270 exhausted:
2271   /* Totally out of translations to use... */
2272   snat_ipfix_logging_addresses_exhausted(0);
2273   return 1;
2274 }
2275
2276 void
2277 nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add)
2278 {
2279   dpo_id_t dpo_v4 = DPO_INVALID;
2280   fib_prefix_t pfx = {
2281     .fp_proto = FIB_PROTOCOL_IP4,
2282     .fp_len = 32,
2283     .fp_addr.ip4.as_u32 = addr.as_u32,
2284   };
2285
2286   if (is_add)
2287     {
2288       nat_dpo_create (DPO_PROTO_IP4, 0, &dpo_v4);
2289       fib_table_entry_special_dpo_add (0, &pfx, FIB_SOURCE_PLUGIN_HI,
2290                                        FIB_ENTRY_FLAG_EXCLUSIVE, &dpo_v4);
2291       dpo_reset (&dpo_v4);
2292     }
2293   else
2294     {
2295       fib_table_entry_special_remove (0, &pfx, FIB_SOURCE_PLUGIN_HI);
2296     }
2297 }
2298
2299 uword
2300 unformat_snat_protocol (unformat_input_t * input, va_list * args)
2301 {
2302   u32 *r = va_arg (*args, u32 *);
2303
2304   if (0);
2305 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
2306   foreach_snat_protocol
2307 #undef _
2308   else
2309     return 0;
2310   return 1;
2311 }
2312
2313 u8 *
2314 format_snat_protocol (u8 * s, va_list * args)
2315 {
2316   u32 i = va_arg (*args, u32);
2317   u8 *t = 0;
2318
2319   switch (i)
2320     {
2321 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
2322       foreach_snat_protocol
2323 #undef _
2324     default:
2325       s = format (s, "unknown");
2326       return s;
2327     }
2328   s = format (s, "%s", t);
2329   return s;
2330 }
2331
2332 static u32
2333 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2334 {
2335   snat_main_t *sm = &snat_main;
2336   u32 next_worker_index = 0;
2337   u32 hash;
2338
2339   next_worker_index = sm->first_worker_index;
2340   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2341          (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >>24);
2342
2343   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2344     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2345   else
2346     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2347
2348   return next_worker_index;
2349 }
2350
2351 static u32
2352 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2353 {
2354   snat_main_t *sm = &snat_main;
2355   udp_header_t *udp;
2356   u16 port;
2357   snat_session_key_t m_key;
2358   clib_bihash_kv_8_8_t kv, value;
2359   snat_static_mapping_t *m;
2360   nat_ed_ses_key_t key;
2361   clib_bihash_kv_16_8_t s_kv, s_value;
2362   snat_main_per_thread_data_t *tsm;
2363   snat_session_t *s;
2364   int i;
2365   u32 proto;
2366   u32 next_worker_index = 0;
2367
2368   /* first try static mappings without port */
2369   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2370     {
2371       m_key.addr = ip0->dst_address;
2372       m_key.port = 0;
2373       m_key.protocol = 0;
2374       m_key.fib_index = rx_fib_index0;
2375       kv.key = m_key.as_u64;
2376       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2377         {
2378           m = pool_elt_at_index (sm->static_mappings, value.value);
2379           return m->worker_index;
2380         }
2381     }
2382
2383   proto = ip_proto_to_snat_proto (ip0->protocol);
2384   udp = ip4_next_header (ip0);
2385   port = udp->dst_port;
2386
2387   if (PREDICT_FALSE (ip4_is_fragment (ip0)))
2388     {
2389       if (PREDICT_FALSE (nat_reass_is_drop_frag (0)))
2390         return vlib_get_thread_index ();
2391
2392       if (PREDICT_TRUE (!ip4_is_first_fragment (ip0)))
2393         {
2394           nat_reass_ip4_t *reass;
2395
2396           reass = nat_ip4_reass_find (ip0->src_address, ip0->dst_address,
2397                                       ip0->fragment_id, ip0->protocol);
2398
2399           if (reass && (reass->thread_index != (u32) ~ 0))
2400             return reass->thread_index;
2401           else
2402             return vlib_get_thread_index ();
2403         }
2404     }
2405
2406   /* unknown protocol */
2407   if (PREDICT_FALSE (proto == ~0))
2408     {
2409       key.l_addr = ip0->dst_address;
2410       key.r_addr = ip0->src_address;
2411       key.fib_index = rx_fib_index0;
2412       key.proto = ip0->protocol;
2413       key.r_port = 0;
2414       key.l_port = 0;
2415       s_kv.key[0] = key.as_u64[0];
2416       s_kv.key[1] = key.as_u64[1];
2417
2418       if (!clib_bihash_search_16_8 (&sm->out2in_ed, &s_kv, &s_value))
2419         {
2420           for (i = 0; i < _vec_len (sm->per_thread_data); i++)
2421             {
2422               tsm = vec_elt_at_index (sm->per_thread_data, i);
2423               if (!pool_is_free_index(tsm->sessions, s_value.value))
2424                 {
2425                   s = pool_elt_at_index (tsm->sessions, s_value.value);
2426                   if (s->out2in.addr.as_u32 == ip0->dst_address.as_u32 &&
2427                       s->out2in.port == ip0->protocol &&
2428                       snat_is_unk_proto_session (s))
2429                     return i;
2430                 }
2431             }
2432          }
2433
2434       /* if no session use current thread */
2435       return vlib_get_thread_index ();
2436     }
2437
2438   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
2439     {
2440       icmp46_header_t * icmp = (icmp46_header_t *) udp;
2441       icmp_echo_header_t *echo = (icmp_echo_header_t *)(icmp + 1);
2442       if (!icmp_is_error_message (icmp))
2443         port = echo->identifier;
2444       else
2445         {
2446           ip4_header_t *inner_ip = (ip4_header_t *)(echo + 1);
2447           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2448           void *l4_header = ip4_next_header (inner_ip);
2449           switch (proto)
2450             {
2451             case SNAT_PROTOCOL_ICMP:
2452               icmp = (icmp46_header_t*)l4_header;
2453               echo = (icmp_echo_header_t *)(icmp + 1);
2454               port = echo->identifier;
2455               break;
2456             case SNAT_PROTOCOL_UDP:
2457             case SNAT_PROTOCOL_TCP:
2458               port = ((tcp_udp_header_t*)l4_header)->src_port;
2459               break;
2460             default:
2461               return vlib_get_thread_index ();
2462             }
2463         }
2464     }
2465
2466   /* try static mappings with port */
2467   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2468     {
2469       m_key.addr = ip0->dst_address;
2470       m_key.port = clib_net_to_host_u16 (port);
2471       m_key.protocol = proto;
2472       m_key.fib_index = rx_fib_index0;
2473       kv.key = m_key.as_u64;
2474       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2475         {
2476           m = pool_elt_at_index (sm->static_mappings, value.value);
2477           return m->worker_index;
2478         }
2479     }
2480
2481   /* worker by outside port */
2482   next_worker_index = sm->first_worker_index;
2483   next_worker_index +=
2484     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
2485   return next_worker_index;
2486 }
2487
2488 static clib_error_t *
2489 snat_config (vlib_main_t * vm, unformat_input_t * input)
2490 {
2491   snat_main_t * sm = &snat_main;
2492   nat66_main_t * nm = &nat66_main;
2493   u32 translation_buckets = 1024;
2494   u32 translation_memory_size = 128<<20;
2495   u32 user_buckets = 128;
2496   u32 user_memory_size = 64<<20;
2497   u32 max_translations_per_user = 100;
2498   u32 outside_vrf_id = 0;
2499   u32 outside_ip6_vrf_id = 0;
2500   u32 inside_vrf_id = 0;
2501   u32 static_mapping_buckets = 1024;
2502   u32 static_mapping_memory_size = 64<<20;
2503   u32 nat64_bib_buckets = 1024;
2504   u32 nat64_bib_memory_size = 128 << 20;
2505   u32 nat64_st_buckets = 2048;
2506   u32 nat64_st_memory_size = 256 << 20;
2507   u8 static_mapping_only = 0;
2508   u8 static_mapping_connection_tracking = 0;
2509   snat_main_per_thread_data_t *tsm;
2510   dslite_main_t * dm = &dslite_main;
2511
2512   sm->deterministic = 0;
2513   sm->out2in_dpo = 0;
2514
2515   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2516     {
2517       if (unformat (input, "translation hash buckets %d", &translation_buckets))
2518         ;
2519       else if (unformat (input, "translation hash memory %d",
2520                          &translation_memory_size));
2521       else if (unformat (input, "user hash buckets %d", &user_buckets))
2522         ;
2523       else if (unformat (input, "user hash memory %d",
2524                          &user_memory_size))
2525         ;
2526       else if (unformat (input, "max translations per user %d",
2527                          &max_translations_per_user))
2528         ;
2529       else if (unformat (input, "outside VRF id %d",
2530                          &outside_vrf_id))
2531         ;
2532       else if (unformat (input, "outside ip6 VRF id %d",
2533                          &outside_ip6_vrf_id))
2534         ;
2535       else if (unformat (input, "inside VRF id %d",
2536                          &inside_vrf_id))
2537         ;
2538       else if (unformat (input, "static mapping only"))
2539         {
2540           static_mapping_only = 1;
2541           if (unformat (input, "connection tracking"))
2542             static_mapping_connection_tracking = 1;
2543         }
2544       else if (unformat (input, "deterministic"))
2545         sm->deterministic = 1;
2546       else if (unformat (input, "nat64 bib hash buckets %d",
2547                          &nat64_bib_buckets))
2548         ;
2549       else if (unformat (input, "nat64 bib hash memory %d",
2550                          &nat64_bib_memory_size))
2551         ;
2552       else if (unformat (input, "nat64 st hash buckets %d", &nat64_st_buckets))
2553         ;
2554       else if (unformat (input, "nat64 st hash memory %d",
2555                          &nat64_st_memory_size))
2556         ;
2557       else if (unformat (input, "out2in dpo"))
2558         sm->out2in_dpo = 1;
2559       else if (unformat (input, "dslite ce"))
2560         dslite_set_ce(dm, 1);
2561       else
2562         return clib_error_return (0, "unknown input '%U'",
2563                                   format_unformat_error, input);
2564     }
2565
2566   /* for show commands, etc. */
2567   sm->translation_buckets = translation_buckets;
2568   sm->translation_memory_size = translation_memory_size;
2569   /* do not exceed load factor 10 */
2570   sm->max_translations = 10 * translation_buckets;
2571   sm->user_buckets = user_buckets;
2572   sm->user_memory_size = user_memory_size;
2573   sm->max_translations_per_user = max_translations_per_user;
2574   sm->outside_vrf_id = outside_vrf_id;
2575   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2576                                                              outside_vrf_id,
2577                                                              FIB_SOURCE_PLUGIN_HI);
2578   nm->outside_vrf_id = outside_ip6_vrf_id;
2579   nm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP6,
2580                                                              outside_ip6_vrf_id,
2581                                                              FIB_SOURCE_PLUGIN_HI);
2582   sm->inside_vrf_id = inside_vrf_id;
2583   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2584                                                             inside_vrf_id,
2585                                                             FIB_SOURCE_PLUGIN_HI);
2586   sm->static_mapping_only = static_mapping_only;
2587   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
2588
2589   nat64_set_hash(nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
2590                  nat64_st_memory_size);
2591
2592   if (sm->deterministic)
2593     {
2594       sm->in2out_node_index = snat_det_in2out_node.index;
2595       sm->in2out_output_node_index = ~0;
2596       sm->out2in_node_index = snat_det_out2in_node.index;
2597       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
2598       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
2599     }
2600   else
2601     {
2602       sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2603       sm->worker_out2in_cb = snat_get_worker_out2in_cb;
2604       sm->in2out_node_index = snat_in2out_node.index;
2605       sm->in2out_output_node_index = snat_in2out_output_node.index;
2606       sm->out2in_node_index = snat_out2in_node.index;
2607       if (!static_mapping_only ||
2608           (static_mapping_only && static_mapping_connection_tracking))
2609         {
2610           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
2611           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
2612
2613           vec_foreach (tsm, sm->per_thread_data)
2614             {
2615               clib_bihash_init_8_8 (&tsm->in2out, "in2out", translation_buckets,
2616                                     translation_memory_size);
2617
2618               clib_bihash_init_8_8 (&tsm->out2in, "out2in", translation_buckets,
2619                                     translation_memory_size);
2620
2621               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
2622                                     user_memory_size);
2623             }
2624
2625           clib_bihash_init_16_8 (&sm->in2out_ed, "in2out-ed",
2626                                  translation_buckets, translation_memory_size);
2627
2628           clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
2629                                  translation_buckets, translation_memory_size);
2630         }
2631       else
2632         {
2633           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
2634           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
2635         }
2636       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
2637                             "static_mapping_by_local", static_mapping_buckets,
2638                             static_mapping_memory_size);
2639
2640       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
2641                             "static_mapping_by_external", static_mapping_buckets,
2642                             static_mapping_memory_size);
2643     }
2644
2645   return 0;
2646 }
2647
2648 VLIB_CONFIG_FUNCTION (snat_config, "nat");
2649
2650 u8 * format_snat_session_state (u8 * s, va_list * args)
2651 {
2652   u32 i = va_arg (*args, u32);
2653   u8 *t = 0;
2654
2655   switch (i)
2656     {
2657 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
2658     foreach_snat_session_state
2659 #undef _
2660     default:
2661       t = format (t, "unknown");
2662     }
2663   s = format (s, "%s", t);
2664   return s;
2665 }
2666
2667 u8 * format_snat_key (u8 * s, va_list * args)
2668 {
2669   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
2670
2671   s = format (s, "%U proto %U port %d fib %d",
2672               format_ip4_address, &key->addr,
2673               format_snat_protocol, key->protocol,
2674               clib_net_to_host_u16 (key->port), key->fib_index);
2675   return s;
2676 }
2677
2678 u8 * format_snat_session (u8 * s, va_list * args)
2679 {
2680   snat_main_t * sm __attribute__((unused)) = va_arg (*args, snat_main_t *);
2681   snat_session_t * sess = va_arg (*args, snat_session_t *);
2682
2683   if (snat_is_unk_proto_session (sess))
2684     {
2685       s = format (s, "  i2o %U proto %u fib %u\n",
2686                   format_ip4_address, &sess->in2out.addr,
2687                   clib_net_to_host_u16 (sess->in2out.port),
2688                   sess->in2out.fib_index);
2689       s = format (s, "    o2i %U proto %u fib %u\n",
2690                   format_ip4_address, &sess->out2in.addr,
2691                   clib_net_to_host_u16 (sess->out2in.port),
2692                   sess->out2in.fib_index);
2693     }
2694   else
2695     {
2696       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
2697       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
2698     }
2699   if (is_ed_session (sess) || is_fwd_bypass_session (sess))
2700     {
2701       if (is_twice_nat_session (sess))
2702         {
2703           s = format (s, "       external host o2i %U:%d i2o %U:%d\n",
2704                       format_ip4_address, &sess->ext_host_addr,
2705                       clib_net_to_host_u16 (sess->ext_host_port),
2706                       format_ip4_address, &sess->ext_host_nat_addr,
2707                       clib_net_to_host_u16 (sess->ext_host_nat_port));
2708         }
2709       else
2710         {
2711           if (sess->ext_host_addr.as_u32)
2712               s = format (s, "       external host %U:%u\n",
2713                           format_ip4_address, &sess->ext_host_addr,
2714                           clib_net_to_host_u16 (sess->ext_host_port));
2715         }
2716     }
2717   s = format (s, "       last heard %.2f\n", sess->last_heard);
2718   s = format (s, "       total pkts %d, total bytes %lld\n",
2719               sess->total_pkts, sess->total_bytes);
2720   if (snat_is_session_static (sess))
2721     s = format (s, "       static translation\n");
2722   else
2723     s = format (s, "       dynamic translation\n");
2724   if (is_fwd_bypass_session (sess))
2725     s = format (s, "       forwarding-bypass\n");
2726   if (sess->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
2727     s = format (s, "       load-balancing\n");
2728   if (is_twice_nat_session (sess))
2729     s = format (s, "       twice-nat\n");
2730
2731   return s;
2732 }
2733
2734 u8 * format_snat_user (u8 * s, va_list * args)
2735 {
2736   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
2737   snat_user_t * u = va_arg (*args, snat_user_t *);
2738   int verbose = va_arg (*args, int);
2739   dlist_elt_t * head, * elt;
2740   u32 elt_index, head_index;
2741   u32 session_index;
2742   snat_session_t * sess;
2743
2744   s = format (s, "%U: %d dynamic translations, %d static translations\n",
2745               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
2746
2747   if (verbose == 0)
2748     return s;
2749
2750   if (u->nsessions || u->nstaticsessions)
2751     {
2752       head_index = u->sessions_per_user_list_head_index;
2753       head = pool_elt_at_index (sm->list_pool, head_index);
2754
2755       elt_index = head->next;
2756       elt = pool_elt_at_index (sm->list_pool, elt_index);
2757       session_index = elt->value;
2758
2759       while (session_index != ~0)
2760         {
2761           sess = pool_elt_at_index (sm->sessions, session_index);
2762
2763           s = format (s, "  %U\n", format_snat_session, sm, sess);
2764
2765           elt_index = elt->next;
2766           elt = pool_elt_at_index (sm->list_pool, elt_index);
2767           session_index = elt->value;
2768         }
2769     }
2770
2771   return s;
2772 }
2773
2774 u8 * format_snat_static_mapping (u8 * s, va_list * args)
2775 {
2776   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
2777   nat44_lb_addr_port_t *local;
2778
2779   if (m->addr_only)
2780       s = format (s, "local %U external %U vrf %d %s %s",
2781                   format_ip4_address, &m->local_addr,
2782                   format_ip4_address, &m->external_addr,
2783                   m->vrf_id,
2784                   m->twice_nat == TWICE_NAT ? "twice-nat" :
2785                   m->twice_nat == TWICE_NAT_SELF ? "self-twice-nat" : "",
2786                   m->out2in_only ? "out2in-only" : "");
2787   else
2788    {
2789       if (vec_len (m->locals))
2790         {
2791           s = format (s, "%U vrf %d external %U:%d %s %s",
2792                       format_snat_protocol, m->proto,
2793                       m->vrf_id,
2794                       format_ip4_address, &m->external_addr, m->external_port,
2795                       m->twice_nat == TWICE_NAT ? "twice-nat" :
2796                       m->twice_nat == TWICE_NAT_SELF ? "self-twice-nat" : "",
2797                       m->out2in_only ? "out2in-only" : "");
2798           vec_foreach (local, m->locals)
2799             s = format (s, "\n  local %U:%d probability %d\%",
2800                         format_ip4_address, &local->addr, local->port,
2801                         local->probability);
2802         }
2803       else
2804         s = format (s, "%U local %U:%d external %U:%d vrf %d %s %s",
2805                     format_snat_protocol, m->proto,
2806                     format_ip4_address, &m->local_addr, m->local_port,
2807                     format_ip4_address, &m->external_addr, m->external_port,
2808                     m->vrf_id,
2809                     m->twice_nat == TWICE_NAT ? "twice-nat" :
2810                     m->twice_nat == TWICE_NAT_SELF ? "self-twice-nat" : "",
2811                     m->out2in_only ? "out2in-only" : "");
2812    }
2813   return s;
2814 }
2815
2816 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
2817 {
2818   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
2819   vnet_main_t *vnm = vnet_get_main();
2820
2821   if (m->addr_only)
2822       s = format (s, "local %U external %U vrf %d",
2823                   format_ip4_address, &m->l_addr,
2824                   format_vnet_sw_if_index_name, vnm, m->sw_if_index,
2825                   m->vrf_id);
2826   else
2827       s = format (s, "%U local %U:%d external %U:%d vrf %d",
2828                   format_snat_protocol, m->proto,
2829                   format_ip4_address, &m->l_addr, m->l_port,
2830                   format_vnet_sw_if_index_name, vnm, m->sw_if_index,
2831                   m->e_port, m->vrf_id);
2832
2833   return s;
2834 }
2835
2836 u8 * format_det_map_ses (u8 * s, va_list * args)
2837 {
2838   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
2839   ip4_address_t in_addr, out_addr;
2840   u32 in_offset, out_offset;
2841   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
2842   u32 * i = va_arg (*args, u32 *);
2843
2844   u32 user_index = *i / SNAT_DET_SES_PER_USER;
2845   in_addr.as_u32 = clib_host_to_net_u32 (
2846     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
2847   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
2848     clib_net_to_host_u32(det_map->in_addr.as_u32);
2849   out_offset = in_offset / det_map->sharing_ratio;
2850   out_addr.as_u32 = clib_host_to_net_u32(
2851     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
2852   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
2853               format_ip4_address, &in_addr,
2854               clib_net_to_host_u16 (ses->in_port),
2855               format_ip4_address, &out_addr,
2856               clib_net_to_host_u16 (ses->out.out_port),
2857               format_ip4_address, &ses->out.ext_host_addr,
2858               clib_net_to_host_u16 (ses->out.ext_host_port),
2859               format_snat_session_state, ses->state,
2860               ses->expire);
2861
2862   return s;
2863 }
2864
2865 static void
2866 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
2867                                  uword opaque,
2868                                  u32 sw_if_index,
2869                                  ip4_address_t * address,
2870                                  u32 address_length,
2871                                  u32 if_address_index,
2872                                  u32 is_delete)
2873 {
2874   snat_main_t *sm = &snat_main;
2875   snat_static_map_resolve_t *rp;
2876   snat_static_mapping_t *m;
2877   snat_session_key_t m_key;
2878   clib_bihash_kv_8_8_t kv, value;
2879   int i, rv;
2880   ip4_address_t l_addr;
2881
2882   for (i = 0; i < vec_len (sm->to_resolve); i++)
2883     {
2884       rp = sm->to_resolve + i;
2885       if (rp->addr_only == 0)
2886         continue;
2887       if (rp->sw_if_index == sw_if_index)
2888         goto match;
2889     }
2890
2891   return;
2892
2893 match:
2894   m_key.addr.as_u32 = address->as_u32;
2895   m_key.port = rp->addr_only ? 0 : rp->e_port;
2896   m_key.protocol = rp->addr_only ? 0 : rp->proto;
2897   m_key.fib_index = sm->outside_fib_index;
2898   kv.key = m_key.as_u64;
2899   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2900     m = 0;
2901   else
2902     m = pool_elt_at_index (sm->static_mappings, value.value);
2903
2904   if (!is_delete)
2905     {
2906       /* Don't trip over lease renewal, static config */
2907       if (m)
2908         return;
2909     }
2910   else
2911     {
2912       if (!m)
2913         return;
2914     }
2915
2916   /* Indetity mapping? */
2917   if (rp->l_addr.as_u32 == 0)
2918     l_addr.as_u32 = address[0].as_u32;
2919   else
2920     l_addr.as_u32 = rp->l_addr.as_u32;
2921   /* Add the static mapping */
2922   rv = snat_add_static_mapping (l_addr,
2923                                 address[0],
2924                                 rp->l_port,
2925                                 rp->e_port,
2926                                 rp->vrf_id,
2927                                 rp->addr_only,
2928                                 ~0 /* sw_if_index */,
2929                                 rp->proto,
2930                                 !is_delete,
2931                                 0, 0, rp->tag);
2932   if (rv)
2933     clib_warning ("snat_add_static_mapping returned %d", rv);
2934 }
2935
2936 static void
2937 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2938                                        uword opaque,
2939                                        u32 sw_if_index,
2940                                        ip4_address_t * address,
2941                                        u32 address_length,
2942                                        u32 if_address_index,
2943                                        u32 is_delete)
2944 {
2945   snat_main_t *sm = &snat_main;
2946   snat_static_map_resolve_t *rp;
2947   ip4_address_t l_addr;
2948   int i, j;
2949   int rv;
2950   u8 twice_nat = 0;
2951   snat_address_t *addresses = sm->addresses;
2952
2953   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2954     {
2955       if (sw_if_index == sm->auto_add_sw_if_indices[i])
2956           goto match;
2957     }
2958
2959   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices_twice_nat); i++)
2960     {
2961       twice_nat = 1;
2962       addresses = sm->twice_nat_addresses;
2963       if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
2964           goto match;
2965     }
2966
2967   return;
2968
2969 match:
2970   if (!is_delete)
2971     {
2972       /* Don't trip over lease renewal, static config */
2973       for (j = 0; j < vec_len(addresses); j++)
2974         if (addresses[j].addr.as_u32 == address->as_u32)
2975           return;
2976
2977       snat_add_address (sm, address, ~0, twice_nat);
2978       /* Scan static map resolution vector */
2979       for (j = 0; j < vec_len (sm->to_resolve); j++)
2980         {
2981           rp = sm->to_resolve + j;
2982           if (rp->addr_only)
2983             continue;
2984           /* On this interface? */
2985           if (rp->sw_if_index == sw_if_index)
2986             {
2987               /* Indetity mapping? */
2988               if (rp->l_addr.as_u32 == 0)
2989                 l_addr.as_u32 = address[0].as_u32;
2990               else
2991                 l_addr.as_u32 = rp->l_addr.as_u32;
2992               /* Add the static mapping */
2993               rv = snat_add_static_mapping (l_addr,
2994                                             address[0],
2995                                             rp->l_port,
2996                                             rp->e_port,
2997                                             rp->vrf_id,
2998                                             rp->addr_only,
2999                                             ~0 /* sw_if_index */,
3000                                             rp->proto,
3001                                             rp->is_add,
3002                                             0, 0, rp->tag);
3003               if (rv)
3004                 clib_warning ("snat_add_static_mapping returned %d",
3005                               rv);
3006             }
3007         }
3008       return;
3009     }
3010   else
3011     {
3012       (void) snat_del_address(sm, address[0], 1, twice_nat);
3013       return;
3014     }
3015 }
3016
3017
3018 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del,
3019                                 u8 twice_nat)
3020 {
3021   ip4_main_t * ip4_main = sm->ip4_main;
3022   ip4_address_t * first_int_addr;
3023   snat_static_map_resolve_t *rp;
3024   u32 *indices_to_delete = 0;
3025   int i, j;
3026   u32 *auto_add_sw_if_indices =
3027     twice_nat ? sm->auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
3028
3029   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
3030                                                 0 /* just want the address*/);
3031
3032   for (i = 0; i < vec_len(auto_add_sw_if_indices); i++)
3033     {
3034       if (auto_add_sw_if_indices[i] == sw_if_index)
3035         {
3036           if (is_del)
3037             {
3038               /* if have address remove it */
3039               if (first_int_addr)
3040                   (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
3041               else
3042                 {
3043                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3044                     {
3045                       rp = sm->to_resolve + j;
3046                       if (rp->sw_if_index == sw_if_index)
3047                         vec_add1 (indices_to_delete, j);
3048                     }
3049                   if (vec_len(indices_to_delete))
3050                     {
3051                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
3052                         vec_del1(sm->to_resolve, j);
3053                       vec_free(indices_to_delete);
3054                     }
3055                 }
3056               if (twice_nat)
3057                 vec_del1(sm->auto_add_sw_if_indices_twice_nat, i);
3058               else
3059                 vec_del1(sm->auto_add_sw_if_indices, i);
3060             }
3061           else
3062             return VNET_API_ERROR_VALUE_EXIST;
3063
3064           return 0;
3065         }
3066     }
3067
3068   if (is_del)
3069     return VNET_API_ERROR_NO_SUCH_ENTRY;
3070
3071   /* add to the auto-address list */
3072   if (twice_nat)
3073     vec_add1(sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
3074   else
3075     vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
3076
3077   /* If the address is already bound - or static - add it now */
3078   if (first_int_addr)
3079       snat_add_address (sm, first_int_addr, ~0, twice_nat);
3080
3081   return 0;
3082 }
3083
3084 int
3085 nat44_del_session (snat_main_t *sm, ip4_address_t *addr, u16 port,
3086                    snat_protocol_t proto, u32 vrf_id, int is_in)
3087 {
3088   snat_main_per_thread_data_t *tsm;
3089   clib_bihash_kv_8_8_t kv, value;
3090   ip4_header_t ip;
3091   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3092   snat_session_key_t key;
3093   snat_session_t *s;
3094   clib_bihash_8_8_t *t;
3095   snat_user_key_t u_key;
3096   snat_user_t *u;
3097
3098   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3099   if (sm->num_workers > 1)
3100     tsm =
3101       vec_elt_at_index (sm->per_thread_data,
3102                         sm->worker_in2out_cb (&ip, fib_index));
3103   else
3104     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3105
3106   key.addr.as_u32 = addr->as_u32;
3107   key.port = clib_host_to_net_u16 (port);
3108   key.protocol = proto;
3109   key.fib_index = fib_index;
3110   kv.key = key.as_u64;
3111   t = is_in ? &tsm->in2out : &tsm->out2in;
3112   if (!clib_bihash_search_8_8 (t, &kv, &value))
3113     {
3114       if (pool_is_free_index (tsm->sessions, value.value))
3115         return VNET_API_ERROR_UNSPECIFIED;
3116
3117       s = pool_elt_at_index (tsm->sessions, value.value);
3118       kv.key = s->in2out.as_u64;
3119       clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0);
3120       kv.key = s->out2in.as_u64;
3121       clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0);
3122       u_key.addr = s->in2out.addr;
3123       u_key.fib_index = s->in2out.fib_index;
3124       kv.key = u_key.as_u64;
3125       if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
3126         {
3127           u = pool_elt_at_index (tsm->users, value.value);
3128           if (snat_is_session_static (s))
3129             u->nstaticsessions--;
3130           else
3131             u->nsessions--;
3132         }
3133       clib_dlist_remove (tsm->list_pool, s->per_user_index);
3134       pool_put_index (tsm->list_pool, s->per_user_index);
3135       pool_put (tsm->sessions, s);
3136       return 0;
3137     }
3138
3139   return VNET_API_ERROR_NO_SUCH_ENTRY;
3140 }
3141
3142 int
3143 nat44_del_ed_session (snat_main_t *sm, ip4_address_t *addr, u16 port,
3144                       ip4_address_t *eh_addr, u16 eh_port, u8 proto,
3145                       u32 vrf_id, int is_in)
3146 {
3147   ip4_header_t ip;
3148   clib_bihash_16_8_t *t;
3149   nat_ed_ses_key_t key;
3150   clib_bihash_kv_16_8_t kv, value;
3151   u32 thread_index;
3152   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3153   snat_session_t *s;
3154
3155   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3156   if (sm->num_workers > 1)
3157     thread_index = sm->worker_in2out_cb (&ip, fib_index);
3158   else
3159     thread_index = sm->num_workers;
3160
3161   t = is_in ? &sm->in2out_ed : &sm->out2in_ed;
3162   key.l_addr.as_u32 = addr->as_u32;
3163   key.r_addr.as_u32 = eh_addr->as_u32;
3164   key.l_port = clib_host_to_net_u16 (port);
3165   key.r_port = clib_host_to_net_u16 (eh_port);
3166   key.proto = proto;
3167   key.fib_index = clib_host_to_net_u32 (fib_index);
3168   kv.key[0] = key.as_u64[0];
3169   kv.key[1] = key.as_u64[1];
3170   if (clib_bihash_search_16_8 (t, &kv, &value))
3171     return VNET_API_ERROR_NO_SUCH_ENTRY;
3172
3173   if (pool_is_free_index (sm->per_thread_data[thread_index].sessions, value.value))
3174     return VNET_API_ERROR_UNSPECIFIED;
3175   s = pool_elt_at_index (sm->per_thread_data[thread_index].sessions, value.value);
3176   nat_free_session_data (sm, s, thread_index);
3177   nat44_delete_session (sm, s, thread_index);
3178   return 0;
3179 }
3180
3181 void
3182 nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, u16 psid_length)
3183 {
3184   snat_main_t *sm = &snat_main;
3185
3186   sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape;
3187   sm->psid = psid;
3188   sm->psid_offset = psid_offset;
3189   sm->psid_length = psid_length;
3190 }
3191
3192 void
3193 nat_set_alloc_addr_and_port_default (void)
3194 {
3195   snat_main_t *sm = &snat_main;
3196
3197   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
3198 }
3199