src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_dpo.h>
  24 #include <nat/nat_ipfix_logging.h>
  25 #include <nat/nat_det.h>
  26 #include <nat/nat64.h>
  27 #include <nat/nat66.h>
  28 #include <nat/dslite.h>
  29 #include <nat/nat_reass.h>
  30 #include <nat/nat_inlines.h>
  31 #include <nat/nat_affinity.h>
  32 #include <vnet/fib/fib_table.h>
  33 #include <vnet/fib/ip4_fib.h>
  34
  35 #include <vpp/app/version.h>
  36
  37 snat_main_t snat_main;
  38
  39 /* *INDENT-OFF* */
  40
  41 /* Hook up input features */
  42 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  43   .arc_name = "ip4-unicast",
  44   .node_name = "nat44-in2out",
  45   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  46 };
  47 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  48   .arc_name = "ip4-unicast",
  49   .node_name = "nat44-out2in",
  50   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  51                                "ip4-dhcp-client-detect"),
  52 };
  53 VNET_FEATURE_INIT (ip4_nat_classify, static) = {
  54   .arc_name = "ip4-unicast",
  55   .node_name = "nat44-classify",
  56   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  57 };
  58 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  59   .arc_name = "ip4-unicast",
  60   .node_name = "nat44-det-in2out",
  61   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  62 };
  63 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  64   .arc_name = "ip4-unicast",
  65   .node_name = "nat44-det-out2in",
  66   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  67                                "ip4-dhcp-client-detect"),
  68 };
  69 VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
  70   .arc_name = "ip4-unicast",
  71   .node_name = "nat44-det-classify",
  72   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  73 };
  74 VNET_FEATURE_INIT (ip4_nat44_ed_in2out, static) = {
  75   .arc_name = "ip4-unicast",
  76   .node_name = "nat44-ed-in2out",
  77   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  78 };
  79 VNET_FEATURE_INIT (ip4_nat44_ed_out2in, static) = {
  80   .arc_name = "ip4-unicast",
  81   .node_name = "nat44-ed-out2in",
  82   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  83                                "ip4-dhcp-client-detect"),
  84 };
  85 VNET_FEATURE_INIT (ip4_nat44_ed_classify, static) = {
  86   .arc_name = "ip4-unicast",
  87   .node_name = "nat44-ed-classify",
  88   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  89 };
  90 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  91   .arc_name = "ip4-unicast",
  92   .node_name = "nat44-in2out-worker-handoff",
  93   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  94 };
  95 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  96   .arc_name = "ip4-unicast",
  97   .node_name = "nat44-out2in-worker-handoff",
  98   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  99                                "ip4-dhcp-client-detect"),
 100 };
 101 VNET_FEATURE_INIT (ip4_nat_handoff_classify, static) = {
 102   .arc_name = "ip4-unicast",
 103   .node_name = "nat44-handoff-classify",
 104   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 105 };
 106 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
 107   .arc_name = "ip4-unicast",
 108   .node_name = "nat44-in2out-fast",
 109   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 110 };
 111 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
 112   .arc_name = "ip4-unicast",
 113   .node_name = "nat44-out2in-fast",
 114   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
 115                                "ip4-dhcp-client-detect"),
 116 };
 117 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
 118   .arc_name = "ip4-unicast",
 119   .node_name = "nat44-hairpin-dst",
 120   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 121 };
 122 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_dst, static) = {
 123   .arc_name = "ip4-unicast",
 124   .node_name = "nat44-ed-hairpin-dst",
 125   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 126 };
 127
 128 /* Hook up output features */
 129 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
 130   .arc_name = "ip4-output",
 131   .node_name = "nat44-in2out-output",
 132   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 133 };
 134 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
 135   .arc_name = "ip4-output",
 136   .node_name = "nat44-in2out-output-worker-handoff",
 137   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 138 };
 139 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
 140   .arc_name = "ip4-output",
 141   .node_name = "nat44-hairpin-src",
 142   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 143 };
 144 VNET_FEATURE_INIT (ip4_nat44_ed_in2out_output, static) = {
 145   .arc_name = "ip4-output",
 146   .node_name = "nat44-ed-in2out-output",
 147   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 148 };
 149 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_src, static) = {
 150   .arc_name = "ip4-output",
 151   .node_name = "nat44-ed-hairpin-src",
 152   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 153 };
 154
 155 /* Hook up ip4-local features */
 156 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 157 {
 158   .arc_name = "ip4-local",
 159   .node_name = "nat44-hairpinning",
 160   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 161 };
 162 VNET_FEATURE_INIT (ip4_nat44_ed_hairpinning, static) =
 163 {
 164   .arc_name = "ip4-local",
 165   .node_name = "nat44-ed-hairpinning",
 166   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 167 };
 168
 169
 170 VLIB_PLUGIN_REGISTER () = {
 171     .version = VPP_BUILD_VER,
 172     .description = "Network Address Translation",
 173 };
 174 /* *INDENT-ON* */
 175
 176 void
 177 nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index)
 178 {
 179   snat_session_key_t key;
 180   clib_bihash_kv_8_8_t kv;
 181   nat_ed_ses_key_t ed_key;
 182   clib_bihash_kv_16_8_t ed_kv;
 183   snat_main_per_thread_data_t *tsm =
 184     vec_elt_at_index (sm->per_thread_data, thread_index);
 185
 186   if (is_fwd_bypass_session (s))
 187     {
 188       ed_key.l_addr = s->in2out.addr;
 189       ed_key.r_addr = s->ext_host_addr;
 190       ed_key.l_port = s->in2out.port;
 191       ed_key.r_port = s->ext_host_port;
 192       ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 193       ed_key.fib_index = 0;
 194       ed_kv.key[0] = ed_key.as_u64[0];
 195       ed_kv.key[1] = ed_key.as_u64[1];
 196       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 197         nat_log_warn ("in2out_ed key del failed");
 198       return;
 199     }
 200
 201   /* session lookup tables */
 202   if (is_ed_session (s))
 203     {
 204       if (is_affinity_sessions (s))
 205         nat_affinity_unlock (s->ext_host_addr, s->out2in.addr,
 206                              s->in2out.protocol, s->out2in.port);
 207       ed_key.l_addr = s->out2in.addr;
 208       ed_key.r_addr = s->ext_host_addr;
 209       ed_key.fib_index = s->out2in.fib_index;
 210       if (snat_is_unk_proto_session (s))
 211         {
 212           ed_key.proto = s->in2out.port;
 213           ed_key.r_port = 0;
 214           ed_key.l_port = 0;
 215         }
 216       else
 217         {
 218           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 219           ed_key.l_port = s->out2in.port;
 220           ed_key.r_port = s->ext_host_port;
 221         }
 222       ed_kv.key[0] = ed_key.as_u64[0];
 223       ed_kv.key[1] = ed_key.as_u64[1];
 224       if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &ed_kv, 0))
 225         nat_log_warn ("out2in_ed key del failed");
 226       ed_key.l_addr = s->in2out.addr;
 227       ed_key.fib_index = s->in2out.fib_index;
 228       if (!snat_is_unk_proto_session (s))
 229         ed_key.l_port = s->in2out.port;
 230       if (is_twice_nat_session (s))
 231         {
 232           ed_key.r_addr = s->ext_host_nat_addr;
 233           ed_key.r_port = s->ext_host_nat_port;
 234         }
 235       ed_kv.key[0] = ed_key.as_u64[0];
 236       ed_kv.key[1] = ed_key.as_u64[1];
 237       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 238         nat_log_warn ("in2out_ed key del failed");
 239     }
 240   else
 241     {
 242       kv.key = s->in2out.as_u64;
 243       if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
 244         nat_log_warn ("in2out key del failed");
 245       kv.key = s->out2in.as_u64;
 246       if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
 247         nat_log_warn ("out2in key del failed");
 248     }
 249
 250   if (snat_is_unk_proto_session (s))
 251     return;
 252
 253   /* log NAT event */
 254   snat_ipfix_logging_nat44_ses_delete (s->in2out.addr.as_u32,
 255                                        s->out2in.addr.as_u32,
 256                                        s->in2out.protocol,
 257                                        s->in2out.port,
 258                                        s->out2in.port, s->in2out.fib_index);
 259
 260   /* Twice NAT address and port for external host */
 261   if (is_twice_nat_session (s))
 262     {
 263       key.protocol = s->in2out.protocol;
 264       key.port = s->ext_host_nat_port;
 265       key.addr.as_u32 = s->ext_host_nat_addr.as_u32;
 266       snat_free_outside_address_and_port (sm->twice_nat_addresses,
 267                                           thread_index, &key);
 268     }
 269
 270   if (snat_is_session_static (s))
 271     return;
 272
 273   snat_free_outside_address_and_port (sm->addresses, thread_index,
 274                                       &s->out2in);
 275 }
 276
 277 snat_user_t *
 278 nat_user_get_or_create (snat_main_t * sm, ip4_address_t * addr, u32 fib_index,
 279                         u32 thread_index)
 280 {
 281   snat_user_t *u = 0;
 282   snat_user_key_t user_key;
 283   clib_bihash_kv_8_8_t kv, value;
 284   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 285   dlist_elt_t *per_user_list_head_elt;
 286
 287   user_key.addr.as_u32 = addr->as_u32;
 288   user_key.fib_index = fib_index;
 289   kv.key = user_key.as_u64;
 290
 291   /* Ever heard of the "user" = src ip4 address before? */
 292   if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 293     {
 294       /* no, make a new one */
 295       pool_get (tsm->users, u);
 296       memset (u, 0, sizeof (*u));
 297       u->addr.as_u32 = addr->as_u32;
 298       u->fib_index = fib_index;
 299
 300       pool_get (tsm->list_pool, per_user_list_head_elt);
 301
 302       u->sessions_per_user_list_head_index = per_user_list_head_elt -
 303         tsm->list_pool;
 304
 305       clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
 306
 307       kv.value = u - tsm->users;
 308
 309       /* add user */
 310       if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
 311         nat_log_warn ("user_hash keay add failed");
 312     }
 313   else
 314     {
 315       u = pool_elt_at_index (tsm->users, value.value);
 316     }
 317
 318   return u;
 319 }
 320
 321 snat_session_t *
 322 nat_session_alloc_or_recycle (snat_main_t * sm, snat_user_t * u,
 323                               u32 thread_index)
 324 {
 325   snat_session_t *s;
 326   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 327   u32 oldest_per_user_translation_list_index, session_index;
 328   dlist_elt_t *oldest_per_user_translation_list_elt;
 329   dlist_elt_t *per_user_translation_list_elt;
 330
 331   /* Over quota? Recycle the least recently used translation */
 332   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 333     {
 334       oldest_per_user_translation_list_index =
 335         clib_dlist_remove_head (tsm->list_pool,
 336                                 u->sessions_per_user_list_head_index);
 337
 338       ASSERT (oldest_per_user_translation_list_index != ~0);
 339
 340       /* Add it back to the end of the LRU list */
 341       clib_dlist_addtail (tsm->list_pool,
 342                           u->sessions_per_user_list_head_index,
 343                           oldest_per_user_translation_list_index);
 344       /* Get the list element */
 345       oldest_per_user_translation_list_elt =
 346         pool_elt_at_index (tsm->list_pool,
 347                            oldest_per_user_translation_list_index);
 348
 349       /* Get the session index from the list element */
 350       session_index = oldest_per_user_translation_list_elt->value;
 351
 352       /* Get the session */
 353       s = pool_elt_at_index (tsm->sessions, session_index);
 354       nat_free_session_data (sm, s, thread_index);
 355       if (snat_is_session_static (s))
 356         u->nstaticsessions--;
 357       else
 358         u->nsessions--;
 359       s->flags = 0;
 360       s->total_bytes = 0;
 361       s->total_pkts = 0;
 362       s->state = 0;
 363       s->ext_host_addr.as_u32 = 0;
 364       s->ext_host_port = 0;
 365       s->ext_host_nat_addr.as_u32 = 0;
 366       s->ext_host_nat_port = 0;
 367     }
 368   else
 369     {
 370       pool_get (tsm->sessions, s);
 371       memset (s, 0, sizeof (*s));
 372
 373       /* Create list elts */
 374       pool_get (tsm->list_pool, per_user_translation_list_elt);
 375       clib_dlist_init (tsm->list_pool,
 376                        per_user_translation_list_elt - tsm->list_pool);
 377
 378       per_user_translation_list_elt->value = s - tsm->sessions;
 379       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 380       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 381
 382       clib_dlist_addtail (tsm->list_pool,
 383                           s->per_user_list_head_index,
 384                           per_user_translation_list_elt - tsm->list_pool);
 385     }
 386
 387   return s;
 388 }
 389
 390 snat_session_t *
 391 nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u, u32 thread_index,
 392                       f64 now)
 393 {
 394   snat_session_t *s;
 395   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 396   dlist_elt_t *per_user_translation_list_elt, *oldest_elt;
 397   u32 oldest_index;
 398   u64 sess_timeout_time;
 399
 400   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 401     {
 402       oldest_index =
 403         clib_dlist_remove_head (tsm->list_pool,
 404                                 u->sessions_per_user_list_head_index);
 405       oldest_elt = pool_elt_at_index (tsm->list_pool, oldest_index);
 406       s = pool_elt_at_index (tsm->sessions, oldest_elt->value);
 407       sess_timeout_time =
 408         s->last_heard + (f64) nat44_session_get_timeout (sm, s);
 409       if (now >= sess_timeout_time)
 410         {
 411           clib_dlist_addtail (tsm->list_pool,
 412                               u->sessions_per_user_list_head_index,
 413                               oldest_index);
 414           nat_free_session_data (sm, s, thread_index);
 415           if (snat_is_session_static (s))
 416             u->nstaticsessions--;
 417           else
 418             u->nsessions--;
 419           s->flags = 0;
 420           s->total_bytes = 0;
 421           s->total_pkts = 0;
 422           s->state = 0;
 423           s->ext_host_addr.as_u32 = 0;
 424           s->ext_host_port = 0;
 425           s->ext_host_nat_addr.as_u32 = 0;
 426           s->ext_host_nat_port = 0;
 427         }
 428       else
 429         {
 430           clib_dlist_addhead (tsm->list_pool,
 431                               u->sessions_per_user_list_head_index,
 432                               oldest_index);
 433           nat_log_warn ("max translations per user %U", format_ip4_address,
 434                         &u->addr);
 435           snat_ipfix_logging_max_entries_per_user
 436             (sm->max_translations_per_user, u->addr.as_u32);
 437           return 0;
 438         }
 439     }
 440   else
 441     {
 442       pool_get (tsm->sessions, s);
 443       memset (s, 0, sizeof (*s));
 444
 445       /* Create list elts */
 446       pool_get (tsm->list_pool, per_user_translation_list_elt);
 447       clib_dlist_init (tsm->list_pool,
 448                        per_user_translation_list_elt - tsm->list_pool);
 449
 450       per_user_translation_list_elt->value = s - tsm->sessions;
 451       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 452       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 453
 454       clib_dlist_addtail (tsm->list_pool,
 455                           s->per_user_list_head_index,
 456                           per_user_translation_list_elt - tsm->list_pool);
 457     }
 458   return s;
 459 }
 460
 461 void
 462 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 463                           int is_add)
 464 {
 465   fib_prefix_t prefix = {
 466     .fp_len = p_len,
 467     .fp_proto = FIB_PROTOCOL_IP4,
 468     .fp_addr = {
 469                 .ip4.as_u32 = addr->as_u32,
 470                 },
 471   };
 472   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 473
 474   if (is_add)
 475     fib_table_entry_update_one_path (fib_index,
 476                                      &prefix,
 477                                      FIB_SOURCE_PLUGIN_LOW,
 478                                      (FIB_ENTRY_FLAG_CONNECTED |
 479                                       FIB_ENTRY_FLAG_LOCAL |
 480                                       FIB_ENTRY_FLAG_EXCLUSIVE),
 481                                      DPO_PROTO_IP4,
 482                                      NULL,
 483                                      sw_if_index,
 484                                      ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
 485   else
 486     fib_table_entry_delete (fib_index, &prefix, FIB_SOURCE_PLUGIN_LOW);
 487 }
 488
 489 int
 490 snat_add_address (snat_main_t * sm, ip4_address_t * addr, u32 vrf_id,
 491                   u8 twice_nat)
 492 {
 493   snat_address_t *ap;
 494   snat_interface_t *i;
 495   vlib_thread_main_t *tm = vlib_get_thread_main ();
 496
 497   if (twice_nat && !sm->endpoint_dependent)
 498     return VNET_API_ERROR_FEATURE_DISABLED;
 499
 500   /* Check if address already exists */
 501   /* *INDENT-OFF* */
 502   vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
 503     {
 504       if (ap->addr.as_u32 == addr->as_u32)
 505         return VNET_API_ERROR_VALUE_EXIST;
 506     }
 507   /* *INDENT-ON* */
 508
 509   if (twice_nat)
 510     vec_add2 (sm->twice_nat_addresses, ap, 1);
 511   else
 512     vec_add2 (sm->addresses, ap, 1);
 513
 514   ap->addr = *addr;
 515   if (vrf_id != ~0)
 516     ap->fib_index =
 517       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 518                                          FIB_SOURCE_PLUGIN_LOW);
 519   else
 520     ap->fib_index = ~0;
 521 #define _(N, i, n, s) \
 522   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 523   ap->busy_##n##_ports = 0; \
 524   ap->busy_##n##_ports_per_thread = 0;\
 525   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 526   foreach_snat_protocol
 527 #undef _
 528     if (twice_nat)
 529     return 0;
 530
 531   /* Add external address to FIB */
 532   /* *INDENT-OFF* */
 533   pool_foreach (i, sm->interfaces,
 534   ({
 535     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 536       continue;
 537
 538     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 539     break;
 540   }));
 541   pool_foreach (i, sm->output_feature_interfaces,
 542   ({
 543     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 544       continue;
 545
 546     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 547     break;
 548   }));
 549   /* *INDENT-ON* */
 550
 551   return 0;
 552 }
 553
 554 static int
 555 is_snat_address_used_in_static_mapping (snat_main_t * sm, ip4_address_t addr)
 556 {
 557   snat_static_mapping_t *m;
 558   /* *INDENT-OFF* */
 559   pool_foreach (m, sm->static_mappings,
 560   ({
 561       if (m->external_addr.as_u32 == addr.as_u32)
 562         return 1;
 563   }));
 564   /* *INDENT-ON* */
 565
 566   return 0;
 567 }
 568
 569 void
 570 increment_v4_address (ip4_address_t * a)
 571 {
 572   u32 v;
 573
 574   v = clib_net_to_host_u32 (a->as_u32) + 1;
 575   a->as_u32 = clib_host_to_net_u32 (v);
 576 }
 577
 578 static void
 579 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 580                                        ip4_address_t l_addr,
 581                                        u16 l_port,
 582                                        u32 sw_if_index,
 583                                        u16 e_port,
 584                                        u32 vrf_id,
 585                                        snat_protocol_t proto,
 586                                        int addr_only, int is_add, u8 * tag,
 587                                        int twice_nat, int out2in_only,
 588                                        int identity_nat)
 589 {
 590   snat_static_map_resolve_t *rp;
 591
 592   vec_add2 (sm->to_resolve, rp, 1);
 593   rp->l_addr.as_u32 = l_addr.as_u32;
 594   rp->l_port = l_port;
 595   rp->sw_if_index = sw_if_index;
 596   rp->e_port = e_port;
 597   rp->vrf_id = vrf_id;
 598   rp->proto = proto;
 599   rp->addr_only = addr_only;
 600   rp->is_add = is_add;
 601   rp->twice_nat = twice_nat;
 602   rp->out2in_only = out2in_only;
 603   rp->identity_nat = identity_nat;
 604   rp->tag = vec_dup (tag);
 605 }
 606
 607 static u32
 608 get_thread_idx_by_port (u16 e_port)
 609 {
 610   snat_main_t *sm = &snat_main;
 611   u32 thread_idx = sm->num_workers;
 612   if (sm->num_workers > 1)
 613     {
 614       thread_idx =
 615         sm->first_worker_index +
 616         sm->workers[(e_port - 1024) / sm->port_per_thread];
 617     }
 618   return thread_idx;
 619 }
 620
 621 int
 622 snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr,
 623                          u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 624                          u32 sw_if_index, snat_protocol_t proto, int is_add,
 625                          twice_nat_type_t twice_nat, u8 out2in_only, u8 * tag,
 626                          u8 identity_nat)
 627 {
 628   snat_main_t *sm = &snat_main;
 629   snat_static_mapping_t *m;
 630   snat_session_key_t m_key;
 631   clib_bihash_kv_8_8_t kv, value;
 632   snat_address_t *a = 0;
 633   u32 fib_index = ~0;
 634   snat_interface_t *interface;
 635   int i;
 636   snat_main_per_thread_data_t *tsm;
 637   snat_user_key_t u_key;
 638   snat_user_t *u;
 639   dlist_elt_t *head, *elt;
 640   u32 elt_index, head_index;
 641   u32 ses_index;
 642   u64 user_index;
 643   snat_session_t *s;
 644   snat_static_map_resolve_t *rp, *rp_match = 0;
 645   nat44_lb_addr_port_t *local;
 646   u8 find = 0;
 647
 648   if (!sm->endpoint_dependent)
 649     {
 650       if (twice_nat || out2in_only)
 651         return VNET_API_ERROR_FEATURE_DISABLED;
 652     }
 653
 654   /* If the external address is a specific interface address */
 655   if (sw_if_index != ~0)
 656     {
 657       ip4_address_t *first_int_addr;
 658
 659       for (i = 0; i < vec_len (sm->to_resolve); i++)
 660         {
 661           rp = sm->to_resolve + i;
 662           if (rp->sw_if_index != sw_if_index ||
 663               rp->l_addr.as_u32 != l_addr.as_u32 ||
 664               rp->vrf_id != vrf_id || rp->addr_only != addr_only)
 665             continue;
 666
 667           if (!addr_only)
 668             {
 669               if (rp->l_port != l_port || rp->e_port != e_port
 670                   || rp->proto != proto)
 671                 continue;
 672             }
 673
 674           rp_match = rp;
 675           break;
 676         }
 677
 678       /* Might be already set... */
 679       first_int_addr = ip4_interface_first_address
 680         (sm->ip4_main, sw_if_index, 0 /* just want the address */ );
 681
 682       if (is_add)
 683         {
 684           if (rp_match)
 685             return VNET_API_ERROR_VALUE_EXIST;
 686
 687           snat_add_static_mapping_when_resolved
 688             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 689              addr_only, is_add, tag, twice_nat, out2in_only, identity_nat);
 690
 691           /* DHCP resolution required? */
 692           if (first_int_addr == 0)
 693             {
 694               return 0;
 695             }
 696           else
 697             {
 698               e_addr.as_u32 = first_int_addr->as_u32;
 699               /* Identity mapping? */
 700               if (l_addr.as_u32 == 0)
 701                 l_addr.as_u32 = e_addr.as_u32;
 702             }
 703         }
 704       else
 705         {
 706           if (!rp_match)
 707             return VNET_API_ERROR_NO_SUCH_ENTRY;
 708
 709           vec_del1 (sm->to_resolve, i);
 710
 711           if (first_int_addr)
 712             {
 713               e_addr.as_u32 = first_int_addr->as_u32;
 714               /* Identity mapping? */
 715               if (l_addr.as_u32 == 0)
 716                 l_addr.as_u32 = e_addr.as_u32;
 717             }
 718           else
 719             return 0;
 720         }
 721     }
 722
 723   m_key.addr = e_addr;
 724   m_key.port = addr_only ? 0 : e_port;
 725   m_key.protocol = addr_only ? 0 : proto;
 726   m_key.fib_index = 0;
 727   kv.key = m_key.as_u64;
 728   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 729     m = 0;
 730   else
 731     m = pool_elt_at_index (sm->static_mappings, value.value);
 732
 733   if (is_add)
 734     {
 735       if (m)
 736         {
 737           if (is_identity_static_mapping (m))
 738             {
 739               /* *INDENT-OFF* */
 740               vec_foreach (local, m->locals)
 741                 {
 742                   if (local->vrf_id == vrf_id)
 743                     return VNET_API_ERROR_VALUE_EXIST;
 744                 }
 745               /* *INDENT-ON* */
 746               vec_add2 (m->locals, local, 1);
 747               local->vrf_id = vrf_id;
 748               local->fib_index =
 749                 fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 750                                                    FIB_SOURCE_PLUGIN_LOW);
 751               m_key.addr = m->local_addr;
 752               m_key.port = m->local_port;
 753               m_key.protocol = m->proto;
 754               m_key.fib_index = local->fib_index;
 755               kv.key = m_key.as_u64;
 756               kv.value = m - sm->static_mappings;
 757               clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
 758               return 0;
 759             }
 760           else
 761             return VNET_API_ERROR_VALUE_EXIST;
 762         }
 763
 764       if (twice_nat && addr_only)
 765         return VNET_API_ERROR_UNSUPPORTED;
 766
 767       /* Convert VRF id to FIB index */
 768       if (vrf_id != ~0)
 769         fib_index =
 770           fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 771                                              FIB_SOURCE_PLUGIN_LOW);
 772       /* If not specified use inside VRF id from SNAT plugin startup config */
 773       else
 774         {
 775           fib_index = sm->inside_fib_index;
 776           vrf_id = sm->inside_vrf_id;
 777         }
 778
 779       if (!(out2in_only || identity_nat))
 780         {
 781           m_key.addr = l_addr;
 782           m_key.port = addr_only ? 0 : l_port;
 783           m_key.protocol = addr_only ? 0 : proto;
 784           m_key.fib_index = fib_index;
 785           kv.key = m_key.as_u64;
 786           if (!clib_bihash_search_8_8
 787               (&sm->static_mapping_by_local, &kv, &value))
 788             return VNET_API_ERROR_VALUE_EXIST;
 789         }
 790
 791       /* Find external address in allocated addresses and reserve port for
 792          address and port pair mapping when dynamic translations enabled */
 793       if (!(addr_only || sm->static_mapping_only || out2in_only))
 794         {
 795           for (i = 0; i < vec_len (sm->addresses); i++)
 796             {
 797               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 798                 {
 799                   a = sm->addresses + i;
 800                   /* External port must be unused */
 801                   switch (proto)
 802                     {
 803 #define _(N, j, n, s) \
 804                     case SNAT_PROTOCOL_##N: \
 805                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 806                         return VNET_API_ERROR_INVALID_VALUE; \
 807                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 808                       if (e_port > 1024) \
 809                         { \
 810                           a->busy_##n##_ports++; \
 811                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
 812                         } \
 813                       break;
 814                       foreach_snat_protocol
 815 #undef _
 816                     default:
 817                       nat_log_info ("unknown protocol");
 818                       return VNET_API_ERROR_INVALID_VALUE_2;
 819                     }
 820                   break;
 821                 }
 822             }
 823           /* External address must be allocated */
 824           if (!a && (l_addr.as_u32 != e_addr.as_u32))
 825             {
 826               if (sw_if_index != ~0)
 827                 {
 828                   for (i = 0; i < vec_len (sm->to_resolve); i++)
 829                     {
 830                       rp = sm->to_resolve + i;
 831                       if (rp->addr_only)
 832                         continue;
 833                       if (rp->sw_if_index != sw_if_index &&
 834                           rp->l_addr.as_u32 != l_addr.as_u32 &&
 835                           rp->vrf_id != vrf_id && rp->l_port != l_port &&
 836                           rp->e_port != e_port && rp->proto != proto)
 837                         continue;
 838
 839                       vec_del1 (sm->to_resolve, i);
 840                       break;
 841                     }
 842                 }
 843               return VNET_API_ERROR_NO_SUCH_ENTRY;
 844             }
 845         }
 846
 847       pool_get (sm->static_mappings, m);
 848       memset (m, 0, sizeof (*m));
 849       m->tag = vec_dup (tag);
 850       m->local_addr = l_addr;
 851       m->external_addr = e_addr;
 852       m->twice_nat = twice_nat;
 853       if (out2in_only)
 854         m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY;
 855       if (addr_only)
 856         m->flags |= NAT_STATIC_MAPPING_FLAG_ADDR_ONLY;
 857       if (identity_nat)
 858         {
 859           m->flags |= NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT;
 860           vec_add2 (m->locals, local, 1);
 861           local->vrf_id = vrf_id;
 862           local->fib_index = fib_index;
 863         }
 864       else
 865         {
 866           m->vrf_id = vrf_id;
 867           m->fib_index = fib_index;
 868         }
 869       if (!addr_only)
 870         {
 871           m->local_port = l_port;
 872           m->external_port = e_port;
 873           m->proto = proto;
 874         }
 875
 876       if (sm->num_workers > 1)
 877         {
 878           ip4_header_t ip = {
 879             .src_address = m->local_addr,
 880           };
 881           vec_add1 (m->workers, sm->worker_in2out_cb (&ip, m->fib_index));
 882           tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
 883         }
 884       else
 885         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 886
 887       m_key.addr = m->local_addr;
 888       m_key.port = m->local_port;
 889       m_key.protocol = m->proto;
 890       m_key.fib_index = fib_index;
 891       kv.key = m_key.as_u64;
 892       kv.value = m - sm->static_mappings;
 893       if (!out2in_only)
 894         clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
 895
 896       m_key.addr = m->external_addr;
 897       m_key.port = m->external_port;
 898       m_key.fib_index = 0;
 899       kv.key = m_key.as_u64;
 900       kv.value = m - sm->static_mappings;
 901       clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 1);
 902
 903       /* Delete dynamic sessions matching local address (+ local port) */
 904       if (!(sm->static_mapping_only))
 905         {
 906           u_key.addr = m->local_addr;
 907           u_key.fib_index = m->fib_index;
 908           kv.key = u_key.as_u64;
 909           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 910             {
 911               user_index = value.value;
 912               u = pool_elt_at_index (tsm->users, user_index);
 913               if (u->nsessions)
 914                 {
 915                   head_index = u->sessions_per_user_list_head_index;
 916                   head = pool_elt_at_index (tsm->list_pool, head_index);
 917                   elt_index = head->next;
 918                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 919                   ses_index = elt->value;
 920                   while (ses_index != ~0)
 921                     {
 922                       s = pool_elt_at_index (tsm->sessions, ses_index);
 923                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
 924                       ses_index = elt->value;
 925
 926                       if (snat_is_session_static (s))
 927                         continue;
 928
 929                       if (!addr_only
 930                           && (clib_net_to_host_u16 (s->in2out.port) !=
 931                               m->local_port))
 932                         continue;
 933
 934                       nat_free_session_data (sm, s,
 935                                              tsm - sm->per_thread_data);
 936                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
 937
 938                       if (!addr_only && !sm->endpoint_dependent)
 939                         break;
 940                     }
 941                 }
 942             }
 943         }
 944     }
 945   else
 946     {
 947       if (!m)
 948         {
 949           if (sw_if_index != ~0)
 950             return 0;
 951           else
 952             return VNET_API_ERROR_NO_SUCH_ENTRY;
 953         }
 954
 955       if (identity_nat)
 956         {
 957           for (i = 0; i < vec_len (m->locals); i++)
 958             {
 959               if (m->locals[i].vrf_id == vrf_id)
 960                 {
 961                   find = 1;
 962                   break;
 963                 }
 964             }
 965           if (!find)
 966             return VNET_API_ERROR_NO_SUCH_ENTRY;
 967
 968           fib_index = m->locals[i].fib_index;
 969           vec_del1 (m->locals, i);
 970         }
 971       else
 972         fib_index = m->fib_index;
 973
 974       /* Free external address port */
 975       if (!(addr_only || sm->static_mapping_only || out2in_only))
 976         {
 977           for (i = 0; i < vec_len (sm->addresses); i++)
 978             {
 979               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 980                 {
 981                   a = sm->addresses + i;
 982                   switch (proto)
 983                     {
 984 #define _(N, j, n, s) \
 985                     case SNAT_PROTOCOL_##N: \
 986                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 987                       if (e_port > 1024) \
 988                         { \
 989                           a->busy_##n##_ports--; \
 990                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
 991                         } \
 992                       break;
 993                       foreach_snat_protocol
 994 #undef _
 995                     default:
 996                       nat_log_info ("unknown protocol");
 997                       return VNET_API_ERROR_INVALID_VALUE_2;
 998                     }
 999                   break;
1000                 }
1001             }
1002         }
1003
1004       if (sm->num_workers > 1)
1005         tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
1006       else
1007         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1008
1009       m_key.addr = m->local_addr;
1010       m_key.port = m->local_port;
1011       m_key.protocol = m->proto;
1012       m_key.fib_index = fib_index;
1013       kv.key = m_key.as_u64;
1014       if (!out2in_only)
1015         clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0);
1016
1017       /* Delete session(s) for static mapping if exist */
1018       if (!(sm->static_mapping_only) ||
1019           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
1020         {
1021           u_key.addr = m->local_addr;
1022           u_key.fib_index = fib_index;
1023           kv.key = u_key.as_u64;
1024           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1025             {
1026               user_index = value.value;
1027               u = pool_elt_at_index (tsm->users, user_index);
1028               if (u->nstaticsessions)
1029                 {
1030                   head_index = u->sessions_per_user_list_head_index;
1031                   head = pool_elt_at_index (tsm->list_pool, head_index);
1032                   elt_index = head->next;
1033                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1034                   ses_index = elt->value;
1035                   while (ses_index != ~0)
1036                     {
1037                       s = pool_elt_at_index (tsm->sessions, ses_index);
1038                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1039                       ses_index = elt->value;
1040
1041                       if (!addr_only)
1042                         {
1043                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) ||
1044                               (clib_net_to_host_u16 (s->out2in.port) !=
1045                                e_port))
1046                             continue;
1047                         }
1048
1049                       if (is_lb_session (s))
1050                         continue;
1051
1052                       if (!snat_is_session_static (s))
1053                         continue;
1054
1055                       nat_free_session_data (sm, s,
1056                                              tsm - sm->per_thread_data);
1057                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1058
1059                       if (!addr_only && !sm->endpoint_dependent)
1060                         break;
1061                     }
1062                 }
1063             }
1064         }
1065
1066       fib_table_unlock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1067       if (vec_len (m->locals))
1068         return 0;
1069
1070       m_key.addr = m->external_addr;
1071       m_key.port = m->external_port;
1072       m_key.fib_index = 0;
1073       kv.key = m_key.as_u64;
1074       clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0);
1075
1076       vec_free (m->tag);
1077       vec_free (m->workers);
1078       /* Delete static mapping from pool */
1079       pool_put (sm->static_mappings, m);
1080     }
1081
1082   if (!addr_only || (l_addr.as_u32 == e_addr.as_u32))
1083     return 0;
1084
1085   /* Add/delete external address to FIB */
1086   /* *INDENT-OFF* */
1087   pool_foreach (interface, sm->interfaces,
1088   ({
1089     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1090       continue;
1091
1092     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1093     break;
1094   }));
1095   pool_foreach (interface, sm->output_feature_interfaces,
1096   ({
1097     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1098       continue;
1099
1100     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1101     break;
1102   }));
1103   /* *INDENT-ON* */
1104
1105   return 0;
1106 }
1107
1108 int
1109 nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
1110                                  snat_protocol_t proto,
1111                                  nat44_lb_addr_port_t * locals, u8 is_add,
1112                                  twice_nat_type_t twice_nat, u8 out2in_only,
1113                                  u8 * tag, u32 affinity)
1114 {
1115   snat_main_t *sm = &snat_main;
1116   snat_static_mapping_t *m;
1117   snat_session_key_t m_key;
1118   clib_bihash_kv_8_8_t kv, value;
1119   snat_address_t *a = 0;
1120   int i;
1121   nat44_lb_addr_port_t *local;
1122   u32 elt_index, head_index, ses_index;
1123   snat_main_per_thread_data_t *tsm;
1124   snat_user_key_t u_key;
1125   snat_user_t *u;
1126   snat_session_t *s;
1127   dlist_elt_t *head, *elt;
1128   uword *bitmap = 0;
1129
1130   if (!sm->endpoint_dependent)
1131     return VNET_API_ERROR_FEATURE_DISABLED;
1132
1133   m_key.addr = e_addr;
1134   m_key.port = e_port;
1135   m_key.protocol = proto;
1136   m_key.fib_index = 0;
1137   kv.key = m_key.as_u64;
1138   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1139     m = 0;
1140   else
1141     m = pool_elt_at_index (sm->static_mappings, value.value);
1142
1143   if (is_add)
1144     {
1145       if (m)
1146         return VNET_API_ERROR_VALUE_EXIST;
1147
1148       if (vec_len (locals) < 2)
1149         return VNET_API_ERROR_INVALID_VALUE;
1150
1151       /* Find external address in allocated addresses and reserve port for
1152          address and port pair mapping when dynamic translations enabled */
1153       if (!(sm->static_mapping_only || out2in_only))
1154         {
1155           for (i = 0; i < vec_len (sm->addresses); i++)
1156             {
1157               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1158                 {
1159                   a = sm->addresses + i;
1160                   /* External port must be unused */
1161                   switch (proto)
1162                     {
1163 #define _(N, j, n, s) \
1164                     case SNAT_PROTOCOL_##N: \
1165                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1166                         return VNET_API_ERROR_INVALID_VALUE; \
1167                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1168                       if (e_port > 1024) \
1169                         { \
1170                           a->busy_##n##_ports++; \
1171                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
1172                         } \
1173                       break;
1174                       foreach_snat_protocol
1175 #undef _
1176                     default:
1177                       nat_log_info ("unknown protocol");
1178                       return VNET_API_ERROR_INVALID_VALUE_2;
1179                     }
1180                   break;
1181                 }
1182             }
1183           /* External address must be allocated */
1184           if (!a)
1185             return VNET_API_ERROR_NO_SUCH_ENTRY;
1186         }
1187
1188       pool_get (sm->static_mappings, m);
1189       memset (m, 0, sizeof (*m));
1190       m->tag = vec_dup (tag);
1191       m->external_addr = e_addr;
1192       m->external_port = e_port;
1193       m->proto = proto;
1194       m->twice_nat = twice_nat;
1195       m->flags |= NAT_STATIC_MAPPING_FLAG_LB;
1196       if (out2in_only)
1197         m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY;
1198       m->affinity = affinity;
1199
1200       if (affinity)
1201         m->affinity_per_service_list_head_index =
1202           nat_affinity_get_per_service_list_head_index ();
1203       else
1204         m->affinity_per_service_list_head_index = ~0;
1205
1206       m_key.addr = m->external_addr;
1207       m_key.port = m->external_port;
1208       m_key.protocol = m->proto;
1209       m_key.fib_index = 0;
1210       kv.key = m_key.as_u64;
1211       kv.value = m - sm->static_mappings;
1212       if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 1))
1213         {
1214           nat_log_err ("static_mapping_by_external key add failed");
1215           return VNET_API_ERROR_UNSPECIFIED;
1216         }
1217
1218       m_key.fib_index = m->fib_index;
1219       for (i = 0; i < vec_len (locals); i++)
1220         {
1221           locals[i].fib_index =
1222             fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1223                                                locals[i].vrf_id,
1224                                                FIB_SOURCE_PLUGIN_LOW);
1225           m_key.addr = locals[i].addr;
1226           m_key.fib_index = locals[i].fib_index;
1227           if (!out2in_only)
1228             {
1229               m_key.port = locals[i].port;
1230               kv.key = m_key.as_u64;
1231               kv.value = m - sm->static_mappings;
1232               clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
1233             }
1234           locals[i].prefix = (i == 0) ? locals[i].probability :
1235             (locals[i - 1].prefix + locals[i].probability);
1236           vec_add1 (m->locals, locals[i]);
1237           if (sm->num_workers > 1)
1238             {
1239               ip4_header_t ip = {
1240                 .src_address = locals[i].addr,
1241               };
1242               bitmap =
1243                 clib_bitmap_set (bitmap,
1244                                  sm->worker_in2out_cb (&ip, m->fib_index), 1);
1245             }
1246         }
1247
1248       /* Assign workers */
1249       if (sm->num_workers > 1)
1250         {
1251           /* *INDENT-OFF* */
1252           clib_bitmap_foreach (i, bitmap,
1253             ({
1254                vec_add1(m->workers, i);
1255             }));
1256           /* *INDENT-ON* */
1257         }
1258     }
1259   else
1260     {
1261       if (!m)
1262         return VNET_API_ERROR_NO_SUCH_ENTRY;
1263
1264       if (!is_lb_static_mapping (m))
1265         return VNET_API_ERROR_INVALID_VALUE;
1266
1267       /* Free external address port */
1268       if (!(sm->static_mapping_only || out2in_only))
1269         {
1270           for (i = 0; i < vec_len (sm->addresses); i++)
1271             {
1272               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1273                 {
1274                   a = sm->addresses + i;
1275                   switch (proto)
1276                     {
1277 #define _(N, j, n, s) \
1278                     case SNAT_PROTOCOL_##N: \
1279                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1280                       if (e_port > 1024) \
1281                         { \
1282                           a->busy_##n##_ports--; \
1283                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
1284                         } \
1285                       break;
1286                       foreach_snat_protocol
1287 #undef _
1288                     default:
1289                       nat_log_info ("unknown protocol");
1290                       return VNET_API_ERROR_INVALID_VALUE_2;
1291                     }
1292                   break;
1293                 }
1294             }
1295         }
1296
1297       m_key.addr = m->external_addr;
1298       m_key.port = m->external_port;
1299       m_key.protocol = m->proto;
1300       m_key.fib_index = 0;
1301       kv.key = m_key.as_u64;
1302       if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0))
1303         {
1304           nat_log_err ("static_mapping_by_external key del failed");
1305           return VNET_API_ERROR_UNSPECIFIED;
1306         }
1307
1308       /* *INDENT-OFF* */
1309       vec_foreach (local, m->locals)
1310         {
1311           fib_table_unlock (local->fib_index, FIB_PROTOCOL_IP4,
1312                             FIB_SOURCE_PLUGIN_LOW);
1313           m_key.addr = local->addr;
1314           if (!out2in_only)
1315             {
1316               m_key.port = local->port;
1317               m_key.fib_index = local->fib_index;
1318               kv.key = m_key.as_u64;
1319               if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1320                 {
1321                   nat_log_err ("static_mapping_by_local key del failed");
1322                   return VNET_API_ERROR_UNSPECIFIED;
1323                 }
1324             }
1325
1326           if (sm->num_workers > 1)
1327             {
1328               ip4_header_t ip = {
1329                 .src_address = local->addr,
1330               };
1331               tsm = vec_elt_at_index (sm->per_thread_data,
1332                                       sm->worker_in2out_cb (&ip, m->fib_index));
1333             }
1334           else
1335             tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1336
1337           /* Delete sessions */
1338           u_key.addr = local->addr;
1339           u_key.fib_index = m->fib_index;
1340           kv.key = u_key.as_u64;
1341           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1342             {
1343               u = pool_elt_at_index (tsm->users, value.value);
1344               if (u->nstaticsessions)
1345                 {
1346                   head_index = u->sessions_per_user_list_head_index;
1347                   head = pool_elt_at_index (tsm->list_pool, head_index);
1348                   elt_index = head->next;
1349                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1350                   ses_index = elt->value;
1351                   while (ses_index != ~0)
1352                     {
1353                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1354                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1355                       ses_index = elt->value;
1356
1357                       if (!(is_lb_session (s)))
1358                         continue;
1359
1360                       if ((s->in2out.addr.as_u32 != local->addr.as_u32) ||
1361                           (clib_net_to_host_u16 (s->in2out.port) != local->port))
1362                         continue;
1363
1364                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1365                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1366                     }
1367                 }
1368             }
1369         }
1370       /* *INDENT-ON* */
1371       if (m->affinity)
1372         nat_affinity_flush_service (m->affinity_per_service_list_head_index);
1373       vec_free (m->locals);
1374       vec_free (m->tag);
1375       vec_free (m->workers);
1376
1377       pool_put (sm->static_mappings, m);
1378     }
1379
1380   return 0;
1381 }
1382
1383 int
1384 snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
1385                   u8 twice_nat)
1386 {
1387   snat_address_t *a = 0;
1388   snat_session_t *ses;
1389   u32 *ses_to_be_removed = 0, *ses_index;
1390   snat_main_per_thread_data_t *tsm;
1391   snat_static_mapping_t *m;
1392   snat_interface_t *interface;
1393   int i;
1394   snat_address_t *addresses =
1395     twice_nat ? sm->twice_nat_addresses : sm->addresses;
1396
1397   /* Find SNAT address */
1398   for (i = 0; i < vec_len (addresses); i++)
1399     {
1400       if (addresses[i].addr.as_u32 == addr.as_u32)
1401         {
1402           a = addresses + i;
1403           break;
1404         }
1405     }
1406   if (!a)
1407     return VNET_API_ERROR_NO_SUCH_ENTRY;
1408
1409   if (delete_sm)
1410     {
1411       /* *INDENT-OFF* */
1412       pool_foreach (m, sm->static_mappings,
1413       ({
1414           if (m->external_addr.as_u32 == addr.as_u32)
1415             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1416                                             m->local_port, m->external_port,
1417                                             m->vrf_id, is_addr_only_static_mapping(m), ~0,
1418                                             m->proto, 0, m->twice_nat,
1419                                             is_out2in_only_static_mapping(m), m->tag, is_identity_static_mapping(m));
1420       }));
1421       /* *INDENT-ON* */
1422     }
1423   else
1424     {
1425       /* Check if address is used in some static mapping */
1426       if (is_snat_address_used_in_static_mapping (sm, addr))
1427         {
1428           nat_log_notice ("address used in static mapping");
1429           return VNET_API_ERROR_UNSPECIFIED;
1430         }
1431     }
1432
1433   if (a->fib_index != ~0)
1434     fib_table_unlock (a->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1435
1436   /* Delete sessions using address */
1437   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1438     {
1439       /* *INDENT-OFF* */
1440       vec_foreach (tsm, sm->per_thread_data)
1441         {
1442           pool_foreach (ses, tsm->sessions, ({
1443             if (ses->out2in.addr.as_u32 == addr.as_u32)
1444               {
1445                 nat_free_session_data (sm, ses, tsm - sm->per_thread_data);
1446                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1447               }
1448           }));
1449
1450           vec_foreach (ses_index, ses_to_be_removed)
1451             {
1452               ses = pool_elt_at_index (tsm->sessions, ses_index[0]);
1453               nat44_delete_session (sm, ses, tsm - sm->per_thread_data);
1454             }
1455
1456           vec_free (ses_to_be_removed);
1457         }
1458       /* *INDENT-ON* */
1459     }
1460
1461 #define _(N, i, n, s) \
1462   clib_bitmap_free (a->busy_##n##_port_bitmap); \
1463   vec_free (a->busy_##n##_ports_per_thread);
1464   foreach_snat_protocol
1465 #undef _
1466     if (twice_nat)
1467     {
1468       vec_del1 (sm->twice_nat_addresses, i);
1469       return 0;
1470     }
1471   else
1472     vec_del1 (sm->addresses, i);
1473
1474   /* Delete external address from FIB */
1475   /* *INDENT-OFF* */
1476   pool_foreach (interface, sm->interfaces,
1477   ({
1478     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1479       continue;
1480
1481     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1482     break;
1483   }));
1484   pool_foreach (interface, sm->output_feature_interfaces,
1485   ({
1486     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1487       continue;
1488
1489     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1490     break;
1491   }));
1492   /* *INDENT-ON* */
1493
1494   return 0;
1495 }
1496
1497 int
1498 snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
1499 {
1500   snat_main_t *sm = &snat_main;
1501   snat_interface_t *i;
1502   const char *feature_name, *del_feature_name;
1503   snat_address_t *ap;
1504   snat_static_mapping_t *m;
1505   snat_det_map_t *dm;
1506   nat_outside_fib_t *outside_fib;
1507   u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
1508                                                        sw_if_index);
1509
1510   if (sm->out2in_dpo && !is_inside)
1511     return VNET_API_ERROR_UNSUPPORTED;
1512
1513   /* *INDENT-OFF* */
1514   pool_foreach (i, sm->output_feature_interfaces,
1515   ({
1516     if (i->sw_if_index == sw_if_index)
1517       return VNET_API_ERROR_VALUE_EXIST;
1518   }));
1519   /* *INDENT-ON* */
1520
1521   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1522     feature_name = is_inside ? "nat44-in2out-fast" : "nat44-out2in-fast";
1523   else
1524     {
1525       if (sm->num_workers > 1 && !sm->deterministic)
1526         feature_name =
1527           is_inside ? "nat44-in2out-worker-handoff" :
1528           "nat44-out2in-worker-handoff";
1529       else if (sm->deterministic)
1530         feature_name = is_inside ? "nat44-det-in2out" : "nat44-det-out2in";
1531       else if (sm->endpoint_dependent)
1532         feature_name = is_inside ? "nat44-ed-in2out" : "nat44-ed-out2in";
1533       else
1534         feature_name = is_inside ? "nat44-in2out" : "nat44-out2in";
1535     }
1536
1537   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1538     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index,
1539                                                       NAT_FQ_NELTS);
1540
1541   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1542     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index,
1543                                                       NAT_FQ_NELTS);
1544
1545   if (!is_inside)
1546     {
1547       /* *INDENT-OFF* */
1548       vec_foreach (outside_fib, sm->outside_fibs)
1549         {
1550           if (outside_fib->fib_index == fib_index)
1551             {
1552               if (is_del)
1553                 {
1554                   outside_fib->refcount--;
1555                   if (!outside_fib->refcount)
1556                     vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
1557                 }
1558               else
1559                 outside_fib->refcount++;
1560               goto feature_set;
1561             }
1562         }
1563       /* *INDENT-ON* */
1564       if (!is_del)
1565         {
1566           vec_add2 (sm->outside_fibs, outside_fib, 1);
1567           outside_fib->refcount = 1;
1568           outside_fib->fib_index = fib_index;
1569         }
1570     }
1571 feature_set:
1572   /* *INDENT-OFF* */
1573   pool_foreach (i, sm->interfaces,
1574   ({
1575     if (i->sw_if_index == sw_if_index)
1576       {
1577         if (is_del)
1578           {
1579             if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1580               {
1581                 if (is_inside)
1582                   i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1583                 else
1584                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1585
1586                 if (sm->num_workers > 1 && !sm->deterministic)
1587                   {
1588                     del_feature_name = "nat44-handoff-classify";
1589                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1590                                                  "nat44-out2in-worker-handoff";
1591                   }
1592                 else if (sm->deterministic)
1593                   {
1594                     del_feature_name = "nat44-det-classify";
1595                     feature_name = !is_inside ?  "nat44-det-in2out" :
1596                                                  "nat44-det-out2in";
1597                   }
1598                 else if (sm->endpoint_dependent)
1599                   {
1600                     del_feature_name = "nat44-ed-classify";
1601                     feature_name = !is_inside ?  "nat44-ed-in2out" :
1602                                                  "nat44-ed-out2in";
1603                   }
1604                 else
1605                   {
1606                     del_feature_name = "nat44-classify";
1607                     feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1608                   }
1609
1610                 vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1611                                              sw_if_index, 0, 0, 0);
1612                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1613                                              sw_if_index, 1, 0, 0);
1614                 if (!is_inside)
1615                   {
1616                     if (sm->endpoint_dependent)
1617                       vnet_feature_enable_disable ("ip4-local",
1618                                                    "nat44-ed-hairpinning",
1619                                                    sw_if_index, 1, 0, 0);
1620                     else if (!sm->deterministic)
1621                       vnet_feature_enable_disable ("ip4-local",
1622                                                    "nat44-hairpinning",
1623                                                    sw_if_index, 1, 0, 0);
1624                   }
1625               }
1626             else
1627               {
1628                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1629                                              sw_if_index, 0, 0, 0);
1630                 pool_put (sm->interfaces, i);
1631                 if (is_inside)
1632                   {
1633                     if (sm->endpoint_dependent)
1634                       vnet_feature_enable_disable ("ip4-local",
1635                                                    "nat44-ed-hairpinning",
1636                                                    sw_if_index, 0, 0, 0);
1637                     else if (!sm->deterministic)
1638                       vnet_feature_enable_disable ("ip4-local",
1639                                                    "nat44-hairpinning",
1640                                                    sw_if_index, 0, 0, 0);
1641                   }
1642               }
1643           }
1644         else
1645           {
1646             if ((nat_interface_is_inside(i) && is_inside) ||
1647                 (nat_interface_is_outside(i) && !is_inside))
1648               return 0;
1649
1650             if (sm->num_workers > 1 && !sm->deterministic)
1651               {
1652                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1653                                                  "nat44-out2in-worker-handoff";
1654                 feature_name = "nat44-handoff-classify";
1655               }
1656             else if (sm->deterministic)
1657               {
1658                 del_feature_name = !is_inside ?  "nat44-det-in2out" :
1659                                                  "nat44-det-out2in";
1660                 feature_name = "nat44-det-classify";
1661               }
1662             else if (sm->endpoint_dependent)
1663               {
1664                 del_feature_name = !is_inside ?  "nat44-ed-in2out" :
1665                                                  "nat44-ed-out2in";
1666                 feature_name = "nat44-ed-classify";
1667               }
1668             else
1669               {
1670                 del_feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1671                 feature_name = "nat44-classify";
1672               }
1673
1674             vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1675                                          sw_if_index, 0, 0, 0);
1676             vnet_feature_enable_disable ("ip4-unicast", feature_name,
1677                                          sw_if_index, 1, 0, 0);
1678             if (!is_inside)
1679               {
1680                 if (sm->endpoint_dependent)
1681                   vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
1682                                                sw_if_index, 0, 0, 0);
1683                 else if (!sm->deterministic)
1684                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1685                                                sw_if_index, 0, 0, 0);
1686               }
1687             goto set_flags;
1688           }
1689
1690         goto fib;
1691       }
1692   }));
1693   /* *INDENT-ON* */
1694
1695   if (is_del)
1696     return VNET_API_ERROR_NO_SUCH_ENTRY;
1697
1698   pool_get (sm->interfaces, i);
1699   i->sw_if_index = sw_if_index;
1700   i->flags = 0;
1701   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, 1, 0,
1702                                0);
1703
1704   if (is_inside && !sm->out2in_dpo)
1705     {
1706       if (sm->endpoint_dependent)
1707         vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
1708                                      sw_if_index, 1, 0, 0);
1709       else if (!sm->deterministic)
1710         vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1711                                      sw_if_index, 1, 0, 0);
1712     }
1713
1714 set_flags:
1715   if (is_inside)
1716     {
1717       i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1718       return 0;
1719     }
1720   else
1721     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1722
1723   /* Add/delete external addresses to FIB */
1724 fib:
1725   /* *INDENT-OFF* */
1726   vec_foreach (ap, sm->addresses)
1727     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1728
1729   pool_foreach (m, sm->static_mappings,
1730   ({
1731     if (!(is_addr_only_static_mapping(m)) || (m->local_addr.as_u32 == m->external_addr.as_u32))
1732       continue;
1733
1734     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1735   }));
1736
1737   pool_foreach (dm, sm->det_maps,
1738   ({
1739     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1740   }));
1741   /* *INDENT-ON* */
1742
1743   return 0;
1744 }
1745
1746 int
1747 snat_interface_add_del_output_feature (u32 sw_if_index,
1748                                        u8 is_inside, int is_del)
1749 {
1750   snat_main_t *sm = &snat_main;
1751   snat_interface_t *i;
1752   snat_address_t *ap;
1753   snat_static_mapping_t *m;
1754
1755   if (sm->deterministic ||
1756       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1757     return VNET_API_ERROR_UNSUPPORTED;
1758
1759   /* *INDENT-OFF* */
1760   pool_foreach (i, sm->interfaces,
1761   ({
1762     if (i->sw_if_index == sw_if_index)
1763       return VNET_API_ERROR_VALUE_EXIST;
1764   }));
1765   /* *INDENT-ON* */
1766
1767   if (is_inside)
1768     {
1769       if (sm->endpoint_dependent)
1770         {
1771           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-hairpin-dst",
1772                                        sw_if_index, !is_del, 0, 0);
1773           vnet_feature_enable_disable ("ip4-output", "nat44-ed-hairpin-src",
1774                                        sw_if_index, !is_del, 0, 0);
1775         }
1776       else
1777         {
1778           vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1779                                        sw_if_index, !is_del, 0, 0);
1780           vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1781                                        sw_if_index, !is_del, 0, 0);
1782         }
1783       goto fq;
1784     }
1785
1786   if (sm->num_workers > 1)
1787     {
1788       vnet_feature_enable_disable ("ip4-unicast",
1789                                    "nat44-out2in-worker-handoff",
1790                                    sw_if_index, !is_del, 0, 0);
1791       vnet_feature_enable_disable ("ip4-output",
1792                                    "nat44-in2out-output-worker-handoff",
1793                                    sw_if_index, !is_del, 0, 0);
1794     }
1795   else
1796     {
1797       if (sm->endpoint_dependent)
1798         {
1799           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-out2in",
1800                                        sw_if_index, !is_del, 0, 0);
1801           vnet_feature_enable_disable ("ip4-output", "nat44-ed-in2out-output",
1802                                        sw_if_index, !is_del, 0, 0);
1803         }
1804       else
1805         {
1806           vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in",
1807                                        sw_if_index, !is_del, 0, 0);
1808           vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1809                                        sw_if_index, !is_del, 0, 0);
1810         }
1811     }
1812
1813 fq:
1814   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1815     sm->fq_in2out_output_index =
1816       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1817
1818   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1819     sm->fq_out2in_index =
1820       vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1821
1822   /* *INDENT-OFF* */
1823   pool_foreach (i, sm->output_feature_interfaces,
1824   ({
1825     if (i->sw_if_index == sw_if_index)
1826       {
1827         if (is_del)
1828           pool_put (sm->output_feature_interfaces, i);
1829         else
1830           return VNET_API_ERROR_VALUE_EXIST;
1831
1832         goto fib;
1833       }
1834   }));
1835   /* *INDENT-ON* */
1836
1837   if (is_del)
1838     return VNET_API_ERROR_NO_SUCH_ENTRY;
1839
1840   pool_get (sm->output_feature_interfaces, i);
1841   i->sw_if_index = sw_if_index;
1842   i->flags = 0;
1843   if (is_inside)
1844     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1845   else
1846     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1847
1848   /* Add/delete external addresses to FIB */
1849 fib:
1850   if (is_inside)
1851     return 0;
1852
1853   /* *INDENT-OFF* */
1854   vec_foreach (ap, sm->addresses)
1855     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1856
1857   pool_foreach (m, sm->static_mappings,
1858   ({
1859     if (!((is_addr_only_static_mapping(m)))  || (m->local_addr.as_u32 == m->external_addr.as_u32))
1860       continue;
1861
1862     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1863   }));
1864   /* *INDENT-ON* */
1865
1866   return 0;
1867 }
1868
1869 int
1870 snat_set_workers (uword * bitmap)
1871 {
1872   snat_main_t *sm = &snat_main;
1873   int i, j = 0;
1874
1875   if (sm->num_workers < 2)
1876     return VNET_API_ERROR_FEATURE_DISABLED;
1877
1878   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1879     return VNET_API_ERROR_INVALID_WORKER;
1880
1881   vec_free (sm->workers);
1882   /* *INDENT-OFF* */
1883   clib_bitmap_foreach (i, bitmap,
1884     ({
1885       vec_add1(sm->workers, i);
1886       sm->per_thread_data[sm->first_worker_index + i].snat_thread_index = j;
1887       j++;
1888     }));
1889   /* *INDENT-ON* */
1890
1891   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1892   sm->num_snat_thread = _vec_len (sm->workers);
1893
1894   return 0;
1895 }
1896
1897
1898 static void
1899 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1900                                        uword opaque,
1901                                        u32 sw_if_index,
1902                                        ip4_address_t * address,
1903                                        u32 address_length,
1904                                        u32 if_address_index, u32 is_delete);
1905
1906 static void
1907 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
1908                                  uword opaque,
1909                                  u32 sw_if_index,
1910                                  ip4_address_t * address,
1911                                  u32 address_length,
1912                                  u32 if_address_index, u32 is_delete);
1913
1914 static int
1915 nat_alloc_addr_and_port_default (snat_address_t * addresses,
1916                                  u32 fib_index,
1917                                  u32 thread_index,
1918                                  snat_session_key_t * k,
1919                                  u16 port_per_thread, u32 snat_thread_index);
1920
1921 static clib_error_t *
1922 snat_init (vlib_main_t * vm)
1923 {
1924   snat_main_t *sm = &snat_main;
1925   clib_error_t *error = 0;
1926   ip4_main_t *im = &ip4_main;
1927   ip_lookup_main_t *lm = &im->lookup_main;
1928   uword *p;
1929   vlib_thread_registration_t *tr;
1930   vlib_thread_main_t *tm = vlib_get_thread_main ();
1931   uword *bitmap = 0;
1932   u32 i;
1933   ip4_add_del_interface_address_callback_t cb4;
1934   vlib_node_t *error_drop_node;
1935
1936   sm->vlib_main = vm;
1937   sm->vnet_main = vnet_get_main ();
1938   sm->ip4_main = im;
1939   sm->ip4_lookup_main = lm;
1940   sm->api_main = &api_main;
1941   sm->first_worker_index = 0;
1942   sm->num_workers = 0;
1943   sm->num_snat_thread = 1;
1944   sm->workers = 0;
1945   sm->port_per_thread = 0xffff - 1024;
1946   sm->fq_in2out_index = ~0;
1947   sm->fq_out2in_index = ~0;
1948   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1949   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1950   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1951   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1952   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
1953   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
1954   sm->forwarding_enabled = 0;
1955   sm->log_class = vlib_log_register_class ("nat", 0);
1956   error_drop_node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
1957   sm->error_node_index = error_drop_node->index;
1958   sm->mss_clamping = 0;
1959
1960   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1961   if (p)
1962     {
1963       tr = (vlib_thread_registration_t *) p[0];
1964       if (tr)
1965         {
1966           sm->num_workers = tr->count;
1967           sm->first_worker_index = tr->first_index;
1968         }
1969     }
1970
1971   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1972
1973   /* Use all available workers by default */
1974   if (sm->num_workers > 1)
1975     {
1976       for (i = 0; i < sm->num_workers; i++)
1977         bitmap = clib_bitmap_set (bitmap, i, 1);
1978       snat_set_workers (bitmap);
1979       clib_bitmap_free (bitmap);
1980     }
1981   else
1982     {
1983       sm->per_thread_data[0].snat_thread_index = 0;
1984     }
1985
1986   error = snat_api_init (vm, sm);
1987   if (error)
1988     return error;
1989
1990   /* Set up the interface address add/del callback */
1991   cb4.function = snat_ip4_add_del_interface_address_cb;
1992   cb4.function_opaque = 0;
1993
1994   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1995
1996   cb4.function = nat_ip4_add_del_addr_only_sm_cb;
1997   cb4.function_opaque = 0;
1998
1999   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2000
2001   nat_dpo_module_init ();
2002
2003   /* Init IPFIX logging */
2004   snat_ipfix_logging_init (vm);
2005
2006   /* Init NAT64 */
2007   error = nat64_init (vm);
2008   if (error)
2009     return error;
2010
2011   dslite_init (vm);
2012
2013   nat66_init ();
2014
2015   /* Init virtual fragmenentation reassembly */
2016   return nat_reass_init (vm);
2017 }
2018
2019 VLIB_INIT_FUNCTION (snat_init);
2020
2021 void
2022 snat_free_outside_address_and_port (snat_address_t * addresses,
2023                                     u32 thread_index, snat_session_key_t * k)
2024 {
2025   snat_address_t *a;
2026   u32 address_index;
2027   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
2028
2029   for (address_index = 0; address_index < vec_len (addresses);
2030        address_index++)
2031     {
2032       if (addresses[address_index].addr.as_u32 == k->addr.as_u32)
2033         break;
2034     }
2035
2036   ASSERT (address_index < vec_len (addresses));
2037
2038   a = addresses + address_index;
2039
2040   switch (k->protocol)
2041     {
2042 #define _(N, i, n, s) \
2043     case SNAT_PROTOCOL_##N: \
2044       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
2045         port_host_byte_order) == 1); \
2046       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
2047         port_host_byte_order, 0); \
2048       a->busy_##n##_ports--; \
2049       a->busy_##n##_ports_per_thread[thread_index]--; \
2050       break;
2051       foreach_snat_protocol
2052 #undef _
2053     default:
2054       nat_log_info ("unknown protocol");
2055       return;
2056     }
2057 }
2058
2059 int
2060 snat_static_mapping_match (snat_main_t * sm,
2061                            snat_session_key_t match,
2062                            snat_session_key_t * mapping,
2063                            u8 by_external,
2064                            u8 * is_addr_only,
2065                            twice_nat_type_t * twice_nat,
2066                            lb_nat_type_t * lb, ip4_address_t * ext_host_addr,
2067                            u8 * is_identity_nat)
2068 {
2069   clib_bihash_kv_8_8_t kv, value;
2070   snat_static_mapping_t *m;
2071   snat_session_key_t m_key;
2072   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
2073   u32 rand, lo = 0, hi, mid;
2074   u8 backend_index;
2075
2076   m_key.fib_index = match.fib_index;
2077   if (by_external)
2078     {
2079       mapping_hash = &sm->static_mapping_by_external;
2080       m_key.fib_index = 0;
2081     }
2082
2083   m_key.addr = match.addr;
2084   m_key.port = clib_net_to_host_u16 (match.port);
2085   m_key.protocol = match.protocol;
2086
2087   kv.key = m_key.as_u64;
2088
2089   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2090     {
2091       /* Try address only mapping */
2092       m_key.port = 0;
2093       m_key.protocol = 0;
2094       kv.key = m_key.as_u64;
2095       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2096         return 1;
2097     }
2098
2099   m = pool_elt_at_index (sm->static_mappings, value.value);
2100
2101   if (by_external)
2102     {
2103       if (is_lb_static_mapping (m))
2104         {
2105           if (PREDICT_FALSE (lb != 0))
2106             *lb = m->affinity ? AFFINITY_LB_NAT : LB_NAT;
2107           if (m->affinity)
2108             {
2109               if (nat_affinity_find_and_lock (ext_host_addr[0], match.addr,
2110                                               match.protocol, match.port,
2111                                               &backend_index))
2112                 goto get_local;
2113
2114               mapping->addr = m->locals[backend_index].addr;
2115               mapping->port =
2116                 clib_host_to_net_u16 (m->locals[backend_index].port);
2117               mapping->fib_index = m->locals[backend_index].fib_index;
2118               goto end;
2119             }
2120         get_local:
2121           hi = vec_len (m->locals) - 1;
2122           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
2123           while (lo < hi)
2124             {
2125               mid = ((hi - lo) >> 1) + lo;
2126               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
2127             }
2128           if (!(m->locals[lo].prefix >= rand))
2129             return 1;
2130           if (PREDICT_FALSE (sm->num_workers > 1))
2131             {
2132               ip4_header_t ip = {
2133                 .src_address = m->locals[lo].addr,
2134               };
2135               if (sm->worker_in2out_cb (&ip, m->fib_index) !=
2136                   vlib_get_thread_index ())
2137                 goto get_local;
2138             }
2139           mapping->addr = m->locals[lo].addr;
2140           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
2141           mapping->fib_index = m->locals[lo].fib_index;
2142           if (m->affinity)
2143             {
2144               if (nat_affinity_create_and_lock (ext_host_addr[0], match.addr,
2145                                                 match.protocol, match.port,
2146                                                 lo, m->affinity,
2147                                                 m->affinity_per_service_list_head_index))
2148                 nat_log_info ("create affinity record failed");
2149             }
2150         }
2151       else
2152         {
2153           if (PREDICT_FALSE (lb != 0))
2154             *lb = NO_LB_NAT;
2155           mapping->fib_index = m->fib_index;
2156           mapping->addr = m->local_addr;
2157           /* Address only mapping doesn't change port */
2158           mapping->port = is_addr_only_static_mapping (m) ? match.port
2159             : clib_host_to_net_u16 (m->local_port);
2160         }
2161       mapping->protocol = m->proto;
2162     }
2163   else
2164     {
2165       mapping->addr = m->external_addr;
2166       /* Address only mapping doesn't change port */
2167       mapping->port = is_addr_only_static_mapping (m) ? match.port
2168         : clib_host_to_net_u16 (m->external_port);
2169       mapping->fib_index = sm->outside_fib_index;
2170     }
2171
2172 end:
2173   if (PREDICT_FALSE (is_addr_only != 0))
2174     *is_addr_only = is_addr_only_static_mapping (m);
2175
2176   if (PREDICT_FALSE (twice_nat != 0))
2177     *twice_nat = m->twice_nat;
2178
2179   if (PREDICT_FALSE (is_identity_nat != 0))
2180     *is_identity_nat = is_identity_static_mapping (m);
2181
2182   return 0;
2183 }
2184
2185 static_always_inline u16
2186 snat_random_port (u16 min, u16 max)
2187 {
2188   snat_main_t *sm = &snat_main;
2189   return min + random_u32 (&sm->random_seed) /
2190     (random_u32_max () / (max - min + 1) + 1);
2191 }
2192
2193 int
2194 snat_alloc_outside_address_and_port (snat_address_t * addresses,
2195                                      u32 fib_index,
2196                                      u32 thread_index,
2197                                      snat_session_key_t * k,
2198                                      u16 port_per_thread,
2199                                      u32 snat_thread_index)
2200 {
2201   snat_main_t *sm = &snat_main;
2202
2203   return sm->alloc_addr_and_port (addresses, fib_index, thread_index, k,
2204                                   port_per_thread, snat_thread_index);
2205 }
2206
2207 static int
2208 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2209                                  u32 fib_index,
2210                                  u32 thread_index,
2211                                  snat_session_key_t * k,
2212                                  u16 port_per_thread, u32 snat_thread_index)
2213 {
2214   int i;
2215   snat_address_t *a, *ga = 0;
2216   u32 portnum;
2217
2218   for (i = 0; i < vec_len (addresses); i++)
2219     {
2220       a = addresses + i;
2221       switch (k->protocol)
2222         {
2223 #define _(N, j, n, s) \
2224         case SNAT_PROTOCOL_##N: \
2225           if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
2226             { \
2227               if (a->fib_index == fib_index) \
2228                 { \
2229                   while (1) \
2230                     { \
2231                       portnum = (port_per_thread * \
2232                         snat_thread_index) + \
2233                         snat_random_port(1, port_per_thread) + 1024; \
2234                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2235                         continue; \
2236                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2237                       a->busy_##n##_ports_per_thread[thread_index]++; \
2238                       a->busy_##n##_ports++; \
2239                       k->addr = a->addr; \
2240                       k->port = clib_host_to_net_u16(portnum); \
2241                       return 0; \
2242                     } \
2243                 } \
2244               else if (a->fib_index == ~0) \
2245                 { \
2246                   ga = a; \
2247                 } \
2248             } \
2249           break;
2250           foreach_snat_protocol
2251 #undef _
2252         default:
2253           nat_log_info ("unknown protocol");
2254           return 1;
2255         }
2256
2257     }
2258
2259   if (ga)
2260     {
2261       a = ga;
2262       switch (k->protocol)
2263         {
2264 #define _(N, j, n, s) \
2265         case SNAT_PROTOCOL_##N: \
2266           while (1) \
2267             { \
2268               portnum = (port_per_thread * \
2269                 snat_thread_index) + \
2270                 snat_random_port(1, port_per_thread) + 1024; \
2271               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2272                 continue; \
2273               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2274               a->busy_##n##_ports_per_thread[thread_index]++; \
2275               a->busy_##n##_ports++; \
2276               k->addr = a->addr; \
2277               k->port = clib_host_to_net_u16(portnum); \
2278               return 0; \
2279             }
2280           break;
2281           foreach_snat_protocol
2282 #undef _
2283         default:
2284           nat_log_info ("unknown protocol");
2285           return 1;
2286         }
2287     }
2288
2289   /* Totally out of translations to use... */
2290   snat_ipfix_logging_addresses_exhausted (0);
2291   return 1;
2292 }
2293
2294 static int
2295 nat_alloc_addr_and_port_mape (snat_address_t * addresses,
2296                               u32 fib_index,
2297                               u32 thread_index,
2298                               snat_session_key_t * k,
2299                               u16 port_per_thread, u32 snat_thread_index)
2300 {
2301   snat_main_t *sm = &snat_main;
2302   snat_address_t *a = addresses;
2303   u16 m, ports, portnum, A, j;
2304   m = 16 - (sm->psid_offset + sm->psid_length);
2305   ports = (1 << (16 - sm->psid_length)) - (1 << m);
2306
2307   if (!vec_len (addresses))
2308     goto exhausted;
2309
2310   switch (k->protocol)
2311     {
2312 #define _(N, i, n, s) \
2313     case SNAT_PROTOCOL_##N: \
2314       if (a->busy_##n##_ports < ports) \
2315         { \
2316           while (1) \
2317             { \
2318               A = snat_random_port(1, pow2_mask(sm->psid_offset)); \
2319               j = snat_random_port(0, pow2_mask(m)); \
2320               portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \
2321               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2322                 continue; \
2323               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2324               a->busy_##n##_ports++; \
2325               k->addr = a->addr; \
2326               k->port = clib_host_to_net_u16 (portnum); \
2327               return 0; \
2328             } \
2329         } \
2330       break;
2331       foreach_snat_protocol
2332 #undef _
2333     default:
2334       nat_log_info ("unknown protocol");
2335       return 1;
2336     }
2337
2338 exhausted:
2339   /* Totally out of translations to use... */
2340   snat_ipfix_logging_addresses_exhausted (0);
2341   return 1;
2342 }
2343
2344 static int
2345 nat_alloc_addr_and_port_range (snat_address_t * addresses,
2346                                u32 fib_index,
2347                                u32 thread_index,
2348                                snat_session_key_t * k,
2349                                u16 port_per_thread, u32 snat_thread_index)
2350 {
2351   snat_main_t *sm = &snat_main;
2352   snat_address_t *a = addresses;
2353   u16 portnum, ports;
2354
2355   ports = sm->end_port - sm->start_port + 1;
2356
2357   if (!vec_len (addresses))
2358     goto exhausted;
2359
2360   switch (k->protocol)
2361     {
2362 #define _(N, i, n, s) \
2363     case SNAT_PROTOCOL_##N: \
2364       if (a->busy_##n##_ports < ports) \
2365         { \
2366           while (1) \
2367             { \
2368               portnum = snat_random_port(sm->start_port, sm->end_port); \
2369               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2370                 continue; \
2371               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2372               a->busy_##n##_ports++; \
2373               k->addr = a->addr; \
2374               k->port = clib_host_to_net_u16 (portnum); \
2375               return 0; \
2376             } \
2377         } \
2378       break;
2379       foreach_snat_protocol
2380 #undef _
2381     default:
2382       nat_log_info ("unknown protocol");
2383       return 1;
2384     }
2385
2386 exhausted:
2387   /* Totally out of translations to use... */
2388   snat_ipfix_logging_addresses_exhausted (0);
2389   return 1;
2390 }
2391
2392 void
2393 nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add)
2394 {
2395   dpo_id_t dpo_v4 = DPO_INVALID;
2396   fib_prefix_t pfx = {
2397     .fp_proto = FIB_PROTOCOL_IP4,
2398     .fp_len = 32,
2399     .fp_addr.ip4.as_u32 = addr.as_u32,
2400   };
2401
2402   if (is_add)
2403     {
2404       nat_dpo_create (DPO_PROTO_IP4, 0, &dpo_v4);
2405       fib_table_entry_special_dpo_add (0, &pfx, FIB_SOURCE_PLUGIN_HI,
2406                                        FIB_ENTRY_FLAG_EXCLUSIVE, &dpo_v4);
2407       dpo_reset (&dpo_v4);
2408     }
2409   else
2410     {
2411       fib_table_entry_special_remove (0, &pfx, FIB_SOURCE_PLUGIN_HI);
2412     }
2413 }
2414
2415 u8 *
2416 format_session_kvp (u8 * s, va_list * args)
2417 {
2418   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2419   snat_session_key_t k;
2420
2421   k.as_u64 = v->key;
2422
2423   s = format (s, "%U session-index %llu", format_snat_key, &k, v->value);
2424
2425   return s;
2426 }
2427
2428 u8 *
2429 format_static_mapping_kvp (u8 * s, va_list * args)
2430 {
2431   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2432   snat_session_key_t k;
2433
2434   k.as_u64 = v->key;
2435
2436   s = format (s, "%U static-mapping-index %llu",
2437               format_static_mapping_key, &k, v->value);
2438
2439   return s;
2440 }
2441
2442 u8 *
2443 format_user_kvp (u8 * s, va_list * args)
2444 {
2445   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2446   snat_user_key_t k;
2447
2448   k.as_u64 = v->key;
2449
2450   s = format (s, "%U fib %d user-index %llu", format_ip4_address, &k.addr,
2451               k.fib_index, v->value);
2452
2453   return s;
2454 }
2455
2456 u8 *
2457 format_ed_session_kvp (u8 * s, va_list * args)
2458 {
2459   clib_bihash_kv_16_8_t *v = va_arg (*args, clib_bihash_kv_16_8_t *);
2460   nat_ed_ses_key_t k;
2461
2462   k.as_u64[0] = v->key[0];
2463   k.as_u64[1] = v->key[1];
2464
2465   s =
2466     format (s, "local %U:%d remote %U:%d proto %U fib %d session-index %llu",
2467             format_ip4_address, &k.l_addr, clib_net_to_host_u16 (k.l_port),
2468             format_ip4_address, &k.r_addr, clib_net_to_host_u16 (k.r_port),
2469             format_ip_protocol, k.proto, k.fib_index, v->value);
2470
2471   return s;
2472 }
2473
2474 static u32
2475 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2476 {
2477   snat_main_t *sm = &snat_main;
2478   u32 next_worker_index = 0;
2479   u32 hash;
2480
2481   next_worker_index = sm->first_worker_index;
2482   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2483     (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >> 24);
2484
2485   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2486     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2487   else
2488     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2489
2490   return next_worker_index;
2491 }
2492
2493 static u32
2494 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2495 {
2496   snat_main_t *sm = &snat_main;
2497   udp_header_t *udp;
2498   u16 port;
2499   snat_session_key_t m_key;
2500   clib_bihash_kv_8_8_t kv, value;
2501   snat_static_mapping_t *m;
2502   u32 proto;
2503   u32 next_worker_index = 0;
2504
2505   /* first try static mappings without port */
2506   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2507     {
2508       m_key.addr = ip0->dst_address;
2509       m_key.port = 0;
2510       m_key.protocol = 0;
2511       m_key.fib_index = rx_fib_index0;
2512       kv.key = m_key.as_u64;
2513       if (!clib_bihash_search_8_8
2514           (&sm->static_mapping_by_external, &kv, &value))
2515         {
2516           m = pool_elt_at_index (sm->static_mappings, value.value);
2517           return m->workers[0];
2518         }
2519     }
2520
2521   proto = ip_proto_to_snat_proto (ip0->protocol);
2522   udp = ip4_next_header (ip0);
2523   port = udp->dst_port;
2524
2525   if (PREDICT_FALSE (ip4_is_fragment (ip0)))
2526     {
2527       if (PREDICT_FALSE (nat_reass_is_drop_frag (0)))
2528         return vlib_get_thread_index ();
2529
2530       if (PREDICT_TRUE (!ip4_is_first_fragment (ip0)))
2531         {
2532           nat_reass_ip4_t *reass;
2533
2534           reass = nat_ip4_reass_find (ip0->src_address, ip0->dst_address,
2535                                       ip0->fragment_id, ip0->protocol);
2536
2537           if (reass && (reass->thread_index != (u32) ~ 0))
2538             return reass->thread_index;
2539           else
2540             return vlib_get_thread_index ();
2541         }
2542     }
2543
2544   /* unknown protocol */
2545   if (PREDICT_FALSE (proto == ~0))
2546     {
2547       /* use current thread */
2548       return vlib_get_thread_index ();
2549     }
2550
2551   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
2552     {
2553       icmp46_header_t *icmp = (icmp46_header_t *) udp;
2554       icmp_echo_header_t *echo = (icmp_echo_header_t *) (icmp + 1);
2555       if (!icmp_is_error_message (icmp))
2556         port = echo->identifier;
2557       else
2558         {
2559           ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1);
2560           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2561           void *l4_header = ip4_next_header (inner_ip);
2562           switch (proto)
2563             {
2564             case SNAT_PROTOCOL_ICMP:
2565               icmp = (icmp46_header_t *) l4_header;
2566               echo = (icmp_echo_header_t *) (icmp + 1);
2567               port = echo->identifier;
2568               break;
2569             case SNAT_PROTOCOL_UDP:
2570             case SNAT_PROTOCOL_TCP:
2571               port = ((tcp_udp_header_t *) l4_header)->src_port;
2572               break;
2573             default:
2574               return vlib_get_thread_index ();
2575             }
2576         }
2577     }
2578
2579   /* try static mappings with port */
2580   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2581     {
2582       m_key.addr = ip0->dst_address;
2583       m_key.port = clib_net_to_host_u16 (port);
2584       m_key.protocol = proto;
2585       m_key.fib_index = rx_fib_index0;
2586       kv.key = m_key.as_u64;
2587       if (!clib_bihash_search_8_8
2588           (&sm->static_mapping_by_external, &kv, &value))
2589         {
2590           m = pool_elt_at_index (sm->static_mappings, value.value);
2591           return m->workers[0];
2592         }
2593     }
2594
2595   /* worker by outside port */
2596   next_worker_index = sm->first_worker_index;
2597   next_worker_index +=
2598     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
2599   return next_worker_index;
2600 }
2601
2602 static u32
2603 nat44_ed_get_worker_out2in_cb (ip4_header_t * ip, u32 rx_fib_index)
2604 {
2605   snat_main_t *sm = &snat_main;
2606   clib_bihash_kv_8_8_t kv, value;
2607   u32 proto, next_worker_index = 0;
2608   udp_header_t *udp;
2609   u16 port;
2610   snat_static_mapping_t *m;
2611   u32 hash;
2612
2613   /* first try static mappings without port */
2614   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2615     {
2616       make_sm_kv (&kv, &ip->dst_address, 0, rx_fib_index, 0);
2617       if (!clib_bihash_search_8_8
2618           (&sm->static_mapping_by_external, &kv, &value))
2619         {
2620           m = pool_elt_at_index (sm->static_mappings, value.value);
2621           return m->workers[0];
2622         }
2623     }
2624
2625   proto = ip_proto_to_snat_proto (ip->protocol);
2626
2627   /* unknown protocol */
2628   if (PREDICT_FALSE (proto == ~0))
2629     {
2630       /* use current thread */
2631       return vlib_get_thread_index ();
2632     }
2633
2634   udp = ip4_next_header (ip);
2635   port = udp->dst_port;
2636
2637   if (PREDICT_FALSE (ip->protocol == IP_PROTOCOL_ICMP))
2638     {
2639       icmp46_header_t *icmp = (icmp46_header_t *) udp;
2640       icmp_echo_header_t *echo = (icmp_echo_header_t *) (icmp + 1);
2641       if (!icmp_is_error_message (icmp))
2642         port = echo->identifier;
2643       else
2644         {
2645           ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1);
2646           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2647           void *l4_header = ip4_next_header (inner_ip);
2648           switch (proto)
2649             {
2650             case SNAT_PROTOCOL_ICMP:
2651               icmp = (icmp46_header_t *) l4_header;
2652               echo = (icmp_echo_header_t *) (icmp + 1);
2653               port = echo->identifier;
2654               break;
2655             case SNAT_PROTOCOL_UDP:
2656             case SNAT_PROTOCOL_TCP:
2657               port = ((tcp_udp_header_t *) l4_header)->src_port;
2658               break;
2659             default:
2660               return vlib_get_thread_index ();
2661             }
2662         }
2663     }
2664
2665   /* try static mappings with port */
2666   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2667     {
2668       make_sm_kv (&kv, &ip->dst_address, proto, rx_fib_index,
2669                   clib_net_to_host_u16 (port));
2670       if (!clib_bihash_search_8_8
2671           (&sm->static_mapping_by_external, &kv, &value))
2672         {
2673           m = pool_elt_at_index (sm->static_mappings, value.value);
2674           if (!is_lb_static_mapping (m))
2675             return m->workers[0];
2676
2677           hash = ip->src_address.as_u32 + (ip->src_address.as_u32 >> 8) +
2678             (ip->src_address.as_u32 >> 16) + (ip->src_address.as_u32 >> 24);
2679
2680           if (PREDICT_TRUE (is_pow2 (_vec_len (m->workers))))
2681             return m->workers[hash & (_vec_len (m->workers) - 1)];
2682           else
2683             return m->workers[hash % _vec_len (m->workers)];
2684         }
2685     }
2686
2687   /* worker by outside port */
2688   next_worker_index = sm->first_worker_index;
2689   next_worker_index +=
2690     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
2691
2692   return next_worker_index;
2693 }
2694
2695 static clib_error_t *
2696 snat_config (vlib_main_t * vm, unformat_input_t * input)
2697 {
2698   snat_main_t *sm = &snat_main;
2699   nat66_main_t *nm = &nat66_main;
2700   u32 translation_buckets = 1024;
2701   u32 translation_memory_size = 128 << 20;
2702   u32 user_buckets = 128;
2703   u32 user_memory_size = 64 << 20;
2704   u32 max_translations_per_user = 100;
2705   u32 outside_vrf_id = 0;
2706   u32 outside_ip6_vrf_id = 0;
2707   u32 inside_vrf_id = 0;
2708   u32 static_mapping_buckets = 1024;
2709   u32 static_mapping_memory_size = 64 << 20;
2710   u32 nat64_bib_buckets = 1024;
2711   u32 nat64_bib_memory_size = 128 << 20;
2712   u32 nat64_st_buckets = 2048;
2713   u32 nat64_st_memory_size = 256 << 20;
2714   u8 static_mapping_only = 0;
2715   u8 static_mapping_connection_tracking = 0;
2716   snat_main_per_thread_data_t *tsm;
2717   dslite_main_t *dm = &dslite_main;
2718
2719   sm->deterministic = 0;
2720   sm->out2in_dpo = 0;
2721   sm->endpoint_dependent = 0;
2722
2723   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2724     {
2725       if (unformat
2726           (input, "translation hash buckets %d", &translation_buckets))
2727         ;
2728       else if (unformat (input, "translation hash memory %d",
2729                          &translation_memory_size));
2730       else if (unformat (input, "user hash buckets %d", &user_buckets))
2731         ;
2732       else if (unformat (input, "user hash memory %d", &user_memory_size))
2733         ;
2734       else if (unformat (input, "max translations per user %d",
2735                          &max_translations_per_user))
2736         ;
2737       else if (unformat (input, "outside VRF id %d", &outside_vrf_id))
2738         ;
2739       else if (unformat (input, "outside ip6 VRF id %d", &outside_ip6_vrf_id))
2740         ;
2741       else if (unformat (input, "inside VRF id %d", &inside_vrf_id))
2742         ;
2743       else if (unformat (input, "static mapping only"))
2744         {
2745           static_mapping_only = 1;
2746           if (unformat (input, "connection tracking"))
2747             static_mapping_connection_tracking = 1;
2748         }
2749       else if (unformat (input, "deterministic"))
2750         sm->deterministic = 1;
2751       else if (unformat (input, "nat64 bib hash buckets %d",
2752                          &nat64_bib_buckets))
2753         ;
2754       else if (unformat (input, "nat64 bib hash memory %d",
2755                          &nat64_bib_memory_size))
2756         ;
2757       else
2758         if (unformat (input, "nat64 st hash buckets %d", &nat64_st_buckets))
2759         ;
2760       else if (unformat (input, "nat64 st hash memory %d",
2761                          &nat64_st_memory_size))
2762         ;
2763       else if (unformat (input, "out2in dpo"))
2764         sm->out2in_dpo = 1;
2765       else if (unformat (input, "dslite ce"))
2766         dslite_set_ce (dm, 1);
2767       else if (unformat (input, "endpoint-dependent"))
2768         sm->endpoint_dependent = 1;
2769       else
2770         return clib_error_return (0, "unknown input '%U'",
2771                                   format_unformat_error, input);
2772     }
2773
2774   if (sm->deterministic && sm->endpoint_dependent)
2775     return clib_error_return (0,
2776                               "deterministic and endpoint-dependent modes are mutually exclusive");
2777
2778   if (static_mapping_only && (sm->deterministic || sm->endpoint_dependent))
2779     return clib_error_return (0,
2780                               "static mapping only mode available only for simple nat");
2781
2782   if (sm->out2in_dpo && (sm->deterministic || sm->endpoint_dependent))
2783     return clib_error_return (0,
2784                               "out2in dpo mode available only for simple nat");
2785
2786   /* for show commands, etc. */
2787   sm->translation_buckets = translation_buckets;
2788   sm->translation_memory_size = translation_memory_size;
2789   /* do not exceed load factor 10 */
2790   sm->max_translations = 10 * translation_buckets;
2791   sm->user_buckets = user_buckets;
2792   sm->user_memory_size = user_memory_size;
2793   sm->max_translations_per_user = max_translations_per_user;
2794   sm->outside_vrf_id = outside_vrf_id;
2795   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2796                                                              outside_vrf_id,
2797                                                              FIB_SOURCE_PLUGIN_HI);
2798   nm->outside_vrf_id = outside_ip6_vrf_id;
2799   nm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP6,
2800                                                              outside_ip6_vrf_id,
2801                                                              FIB_SOURCE_PLUGIN_HI);
2802   sm->inside_vrf_id = inside_vrf_id;
2803   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2804                                                             inside_vrf_id,
2805                                                             FIB_SOURCE_PLUGIN_HI);
2806   sm->static_mapping_only = static_mapping_only;
2807   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
2808
2809   nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
2810                   nat64_st_memory_size);
2811
2812   if (sm->deterministic)
2813     {
2814       sm->in2out_node_index = snat_det_in2out_node.index;
2815       sm->in2out_output_node_index = ~0;
2816       sm->out2in_node_index = snat_det_out2in_node.index;
2817       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
2818       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
2819     }
2820   else
2821     {
2822       if (sm->endpoint_dependent)
2823         {
2824           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2825           sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb;
2826           sm->in2out_node_index = nat44_ed_in2out_node.index;
2827           sm->in2out_output_node_index = nat44_ed_in2out_output_node.index;
2828           sm->out2in_node_index = nat44_ed_out2in_node.index;
2829           sm->icmp_match_in2out_cb = icmp_match_in2out_ed;
2830           sm->icmp_match_out2in_cb = icmp_match_out2in_ed;
2831           nat_affinity_init (vm);
2832         }
2833       else
2834         {
2835           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2836           sm->worker_out2in_cb = snat_get_worker_out2in_cb;
2837           sm->in2out_node_index = snat_in2out_node.index;
2838           sm->in2out_output_node_index = snat_in2out_output_node.index;
2839           sm->out2in_node_index = snat_out2in_node.index;
2840           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
2841           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
2842         }
2843       if (!static_mapping_only ||
2844           (static_mapping_only && static_mapping_connection_tracking))
2845         {
2846           /* *INDENT-OFF* */
2847           vec_foreach (tsm, sm->per_thread_data)
2848             {
2849               if (sm->endpoint_dependent)
2850                 {
2851                   clib_bihash_init_16_8 (&tsm->in2out_ed, "in2out-ed",
2852                                          translation_buckets,
2853                                          translation_memory_size);
2854                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->in2out_ed,
2855                                                       format_ed_session_kvp);
2856
2857                   clib_bihash_init_16_8 (&tsm->out2in_ed, "out2in-ed",
2858                                          translation_buckets,
2859                                          translation_memory_size);
2860                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->out2in_ed,
2861                                                       format_ed_session_kvp);
2862                 }
2863               else
2864                 {
2865                   clib_bihash_init_8_8 (&tsm->in2out, "in2out",
2866                                         translation_buckets,
2867                                         translation_memory_size);
2868                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->in2out,
2869                                                      format_session_kvp);
2870
2871                   clib_bihash_init_8_8 (&tsm->out2in, "out2in",
2872                                         translation_buckets,
2873                                         translation_memory_size);
2874                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->out2in,
2875                                                      format_session_kvp);
2876                 }
2877
2878               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
2879                                     user_memory_size);
2880               clib_bihash_set_kvp_format_fn_8_8 (&tsm->user_hash,
2881                                                  format_user_kvp);
2882             }
2883           /* *INDENT-ON* */
2884
2885         }
2886       else
2887         {
2888           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
2889           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
2890         }
2891       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
2892                             "static_mapping_by_local", static_mapping_buckets,
2893                             static_mapping_memory_size);
2894       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local,
2895                                          format_static_mapping_kvp);
2896
2897       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
2898                             "static_mapping_by_external",
2899                             static_mapping_buckets,
2900                             static_mapping_memory_size);
2901       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external,
2902                                          format_static_mapping_kvp);
2903     }
2904
2905   return 0;
2906 }
2907
2908 VLIB_CONFIG_FUNCTION (snat_config, "nat");
2909
2910 static void
2911 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
2912                                  uword opaque,
2913                                  u32 sw_if_index,
2914                                  ip4_address_t * address,
2915                                  u32 address_length,
2916                                  u32 if_address_index, u32 is_delete)
2917 {
2918   snat_main_t *sm = &snat_main;
2919   snat_static_map_resolve_t *rp;
2920   snat_static_mapping_t *m;
2921   snat_session_key_t m_key;
2922   clib_bihash_kv_8_8_t kv, value;
2923   int i, rv;
2924   ip4_address_t l_addr;
2925
2926   for (i = 0; i < vec_len (sm->to_resolve); i++)
2927     {
2928       rp = sm->to_resolve + i;
2929       if (rp->addr_only == 0)
2930         continue;
2931       if (rp->sw_if_index == sw_if_index)
2932         goto match;
2933     }
2934
2935   return;
2936
2937 match:
2938   m_key.addr.as_u32 = address->as_u32;
2939   m_key.port = rp->addr_only ? 0 : rp->e_port;
2940   m_key.protocol = rp->addr_only ? 0 : rp->proto;
2941   m_key.fib_index = sm->outside_fib_index;
2942   kv.key = m_key.as_u64;
2943   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2944     m = 0;
2945   else
2946     m = pool_elt_at_index (sm->static_mappings, value.value);
2947
2948   if (!is_delete)
2949     {
2950       /* Don't trip over lease renewal, static config */
2951       if (m)
2952         return;
2953     }
2954   else
2955     {
2956       if (!m)
2957         return;
2958     }
2959
2960   /* Indetity mapping? */
2961   if (rp->l_addr.as_u32 == 0)
2962     l_addr.as_u32 = address[0].as_u32;
2963   else
2964     l_addr.as_u32 = rp->l_addr.as_u32;
2965   /* Add the static mapping */
2966   rv = snat_add_static_mapping (l_addr,
2967                                 address[0],
2968                                 rp->l_port,
2969                                 rp->e_port,
2970                                 rp->vrf_id,
2971                                 rp->addr_only, ~0 /* sw_if_index */ ,
2972                                 rp->proto, !is_delete, rp->twice_nat,
2973                                 rp->out2in_only, rp->tag, rp->identity_nat);
2974   if (rv)
2975     nat_log_notice ("snat_add_static_mapping returned %d", rv);
2976 }
2977
2978 static void
2979 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2980                                        uword opaque,
2981                                        u32 sw_if_index,
2982                                        ip4_address_t * address,
2983                                        u32 address_length,
2984                                        u32 if_address_index, u32 is_delete)
2985 {
2986   snat_main_t *sm = &snat_main;
2987   snat_static_map_resolve_t *rp;
2988   ip4_address_t l_addr;
2989   int i, j;
2990   int rv;
2991   u8 twice_nat = 0;
2992   snat_address_t *addresses = sm->addresses;
2993
2994   for (i = 0; i < vec_len (sm->auto_add_sw_if_indices); i++)
2995     {
2996       if (sw_if_index == sm->auto_add_sw_if_indices[i])
2997         goto match;
2998     }
2999
3000   for (i = 0; i < vec_len (sm->auto_add_sw_if_indices_twice_nat); i++)
3001     {
3002       twice_nat = 1;
3003       addresses = sm->twice_nat_addresses;
3004       if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
3005         goto match;
3006     }
3007
3008   return;
3009
3010 match:
3011   if (!is_delete)
3012     {
3013       /* Don't trip over lease renewal, static config */
3014       for (j = 0; j < vec_len (addresses); j++)
3015         if (addresses[j].addr.as_u32 == address->as_u32)
3016           return;
3017
3018       (void) snat_add_address (sm, address, ~0, twice_nat);
3019       /* Scan static map resolution vector */
3020       for (j = 0; j < vec_len (sm->to_resolve); j++)
3021         {
3022           rp = sm->to_resolve + j;
3023           if (rp->addr_only)
3024             continue;
3025           /* On this interface? */
3026           if (rp->sw_if_index == sw_if_index)
3027             {
3028               /* Indetity mapping? */
3029               if (rp->l_addr.as_u32 == 0)
3030                 l_addr.as_u32 = address[0].as_u32;
3031               else
3032                 l_addr.as_u32 = rp->l_addr.as_u32;
3033               /* Add the static mapping */
3034               rv = snat_add_static_mapping (l_addr,
3035                                             address[0],
3036                                             rp->l_port,
3037                                             rp->e_port,
3038                                             rp->vrf_id,
3039                                             rp->addr_only,
3040                                             ~0 /* sw_if_index */ ,
3041                                             rp->proto,
3042                                             rp->is_add, rp->twice_nat,
3043                                             rp->out2in_only, rp->tag,
3044                                             rp->identity_nat);
3045               if (rv)
3046                 nat_log_notice ("snat_add_static_mapping returned %d", rv);
3047             }
3048         }
3049       return;
3050     }
3051   else
3052     {
3053       (void) snat_del_address (sm, address[0], 1, twice_nat);
3054       return;
3055     }
3056 }
3057
3058
3059 int
3060 snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
3061                             u8 twice_nat)
3062 {
3063   ip4_main_t *ip4_main = sm->ip4_main;
3064   ip4_address_t *first_int_addr;
3065   snat_static_map_resolve_t *rp;
3066   u32 *indices_to_delete = 0;
3067   int i, j;
3068   u32 *auto_add_sw_if_indices =
3069     twice_nat ? sm->
3070     auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
3071
3072   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index, 0        /* just want the address */
3073     );
3074
3075   for (i = 0; i < vec_len (auto_add_sw_if_indices); i++)
3076     {
3077       if (auto_add_sw_if_indices[i] == sw_if_index)
3078         {
3079           if (is_del)
3080             {
3081               /* if have address remove it */
3082               if (first_int_addr)
3083                 (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
3084               else
3085                 {
3086                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3087                     {
3088                       rp = sm->to_resolve + j;
3089                       if (rp->sw_if_index == sw_if_index)
3090                         vec_add1 (indices_to_delete, j);
3091                     }
3092                   if (vec_len (indices_to_delete))
3093                     {
3094                       for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
3095                         vec_del1 (sm->to_resolve, j);
3096                       vec_free (indices_to_delete);
3097                     }
3098                 }
3099               if (twice_nat)
3100                 vec_del1 (sm->auto_add_sw_if_indices_twice_nat, i);
3101               else
3102                 vec_del1 (sm->auto_add_sw_if_indices, i);
3103             }
3104           else
3105             return VNET_API_ERROR_VALUE_EXIST;
3106
3107           return 0;
3108         }
3109     }
3110
3111   if (is_del)
3112     return VNET_API_ERROR_NO_SUCH_ENTRY;
3113
3114   /* add to the auto-address list */
3115   if (twice_nat)
3116     vec_add1 (sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
3117   else
3118     vec_add1 (sm->auto_add_sw_if_indices, sw_if_index);
3119
3120   /* If the address is already bound - or static - add it now */
3121   if (first_int_addr)
3122     (void) snat_add_address (sm, first_int_addr, ~0, twice_nat);
3123
3124   return 0;
3125 }
3126
3127 int
3128 nat44_del_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
3129                    snat_protocol_t proto, u32 vrf_id, int is_in)
3130 {
3131   snat_main_per_thread_data_t *tsm;
3132   clib_bihash_kv_8_8_t kv, value;
3133   ip4_header_t ip;
3134   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3135   snat_session_key_t key;
3136   snat_session_t *s;
3137   clib_bihash_8_8_t *t;
3138
3139   if (sm->endpoint_dependent)
3140     return VNET_API_ERROR_UNSUPPORTED;
3141
3142   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3143   if (sm->num_workers > 1)
3144     tsm =
3145       vec_elt_at_index (sm->per_thread_data,
3146                         sm->worker_in2out_cb (&ip, fib_index));
3147   else
3148     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3149
3150   key.addr.as_u32 = addr->as_u32;
3151   key.port = clib_host_to_net_u16 (port);
3152   key.protocol = proto;
3153   key.fib_index = fib_index;
3154   kv.key = key.as_u64;
3155   t = is_in ? &tsm->in2out : &tsm->out2in;
3156   if (!clib_bihash_search_8_8 (t, &kv, &value))
3157     {
3158       if (pool_is_free_index (tsm->sessions, value.value))
3159         return VNET_API_ERROR_UNSPECIFIED;
3160
3161       s = pool_elt_at_index (tsm->sessions, value.value);
3162       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
3163       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3164       return 0;
3165     }
3166
3167   return VNET_API_ERROR_NO_SUCH_ENTRY;
3168 }
3169
3170 int
3171 nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
3172                       ip4_address_t * eh_addr, u16 eh_port, u8 proto,
3173                       u32 vrf_id, int is_in)
3174 {
3175   ip4_header_t ip;
3176   clib_bihash_16_8_t *t;
3177   nat_ed_ses_key_t key;
3178   clib_bihash_kv_16_8_t kv, value;
3179   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3180   snat_session_t *s;
3181   snat_main_per_thread_data_t *tsm;
3182
3183   if (!sm->endpoint_dependent)
3184     return VNET_API_ERROR_FEATURE_DISABLED;
3185
3186   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3187   if (sm->num_workers > 1)
3188     tsm =
3189       vec_elt_at_index (sm->per_thread_data,
3190                         sm->worker_in2out_cb (&ip, fib_index));
3191   else
3192     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3193
3194   t = is_in ? &tsm->in2out_ed : &tsm->out2in_ed;
3195   key.l_addr.as_u32 = addr->as_u32;
3196   key.r_addr.as_u32 = eh_addr->as_u32;
3197   key.l_port = clib_host_to_net_u16 (port);
3198   key.r_port = clib_host_to_net_u16 (eh_port);
3199   key.proto = proto;
3200   key.fib_index = fib_index;
3201   kv.key[0] = key.as_u64[0];
3202   kv.key[1] = key.as_u64[1];
3203   if (clib_bihash_search_16_8 (t, &kv, &value))
3204     return VNET_API_ERROR_NO_SUCH_ENTRY;
3205
3206   if (pool_is_free_index (tsm->sessions, value.value))
3207     return VNET_API_ERROR_UNSPECIFIED;
3208   s = pool_elt_at_index (tsm->sessions, value.value);
3209   nat_free_session_data (sm, s, tsm - sm->per_thread_data);
3210   nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3211   return 0;
3212 }
3213
3214 void
3215 nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, u16 psid_length)
3216 {
3217   snat_main_t *sm = &snat_main;
3218
3219   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_MAPE;
3220   sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape;
3221   sm->psid = psid;
3222   sm->psid_offset = psid_offset;
3223   sm->psid_length = psid_length;
3224 }
3225
3226 void
3227 nat_set_alloc_addr_and_port_range (u16 start_port, u16 end_port)
3228 {
3229   snat_main_t *sm = &snat_main;
3230
3231   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_RANGE;
3232   sm->alloc_addr_and_port = nat_alloc_addr_and_port_range;
3233   sm->start_port = start_port;
3234   sm->end_port = end_port;
3235 }
3236
3237 void
3238 nat_set_alloc_addr_and_port_default (void)
3239 {
3240   snat_main_t *sm = &snat_main;
3241
3242   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
3243   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
3244 }
3245
3246 /*
3247  * fd.io coding-style-patch-verification: ON
3248  *
3249  * Local Variables:
3250  * eval: (c-set-style "gnu")
3251  * End:
3252  */