src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_ipfix_logging.h>
  24 #include <nat/nat_det.h>
  25 #include <nat/nat64.h>
  26 #include <vnet/fib/fib_table.h>
  27 #include <vnet/fib/ip4_fib.h>
  28
  29 #include <vpp/app/version.h>
  30
  31 snat_main_t snat_main;
  32
  33
  34 /* Hook up input features */
  35 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  36   .arc_name = "ip4-unicast",
  37   .node_name = "nat44-in2out",
  38   .runs_before = VNET_FEATURES ("nat44-out2in"),
  39 };
  40 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  41   .arc_name = "ip4-unicast",
  42   .node_name = "nat44-out2in",
  43   .runs_before = VNET_FEATURES ("ip4-lookup"),
  44 };
  45 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  46   .arc_name = "ip4-unicast",
  47   .node_name = "nat44-det-in2out",
  48   .runs_before = VNET_FEATURES ("nat44-det-out2in"),
  49 };
  50 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  51   .arc_name = "ip4-unicast",
  52   .node_name = "nat44-det-out2in",
  53   .runs_before = VNET_FEATURES ("ip4-lookup"),
  54 };
  55 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  56   .arc_name = "ip4-unicast",
  57   .node_name = "nat44-in2out-worker-handoff",
  58   .runs_before = VNET_FEATURES ("nat44-out2in-worker-handoff"),
  59 };
  60 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  61   .arc_name = "ip4-unicast",
  62   .node_name = "nat44-out2in-worker-handoff",
  63   .runs_before = VNET_FEATURES ("ip4-lookup"),
  64 };
  65 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
  66   .arc_name = "ip4-unicast",
  67   .node_name = "nat44-in2out-fast",
  68   .runs_before = VNET_FEATURES ("nat44-out2in-fast"),
  69 };
  70 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
  71   .arc_name = "ip4-unicast",
  72   .node_name = "nat44-out2in-fast",
  73   .runs_before = VNET_FEATURES ("ip4-lookup"),
  74 };
  75 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
  76   .arc_name = "ip4-unicast",
  77   .node_name = "nat44-hairpin-dst",
  78   .runs_before = VNET_FEATURES ("ip4-lookup"),
  79 };
  80
  81 /* Hook up output features */
  82 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
  83   .arc_name = "ip4-output",
  84   .node_name = "nat44-in2out-output",
  85   .runs_before = VNET_FEATURES ("interface-output"),
  86 };
  87 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
  88   .arc_name = "ip4-output",
  89   .node_name = "nat44-in2out-output-worker-handoff",
  90   .runs_before = VNET_FEATURES ("interface-output"),
  91 };
  92 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
  93   .arc_name = "ip4-output",
  94   .node_name = "nat44-hairpin-src",
  95   .runs_before = VNET_FEATURES ("interface-output"),
  96 };
  97
  98 /* Hook up ip4-local features */
  99 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 100 {
 101   .arc_name = "ip4-local",
 102   .node_name = "nat44-hairpinning",
 103   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 104 };
 105
 106
 107 /* *INDENT-OFF* */
 108 VLIB_PLUGIN_REGISTER () = {
 109     .version = VPP_BUILD_VER,
 110     .description = "Network Address Translation",
 111 };
 112 /* *INDENT-ON* */
 113
 114 /**
 115  * @brief Add/del NAT address to FIB.
 116  *
 117  * Add the external NAT address to the FIB as receive entries. This ensures
 118  * that VPP will reply to ARP for this address and we don't need to enable
 119  * proxy ARP on the outside interface.
 120  *
 121  * @param addr IPv4 address.
 122  * @param plen address prefix length
 123  * @param sw_if_index Interface.
 124  * @param is_add If 0 delete, otherwise add.
 125  */
 126 void
 127 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 128                           int is_add)
 129 {
 130   fib_prefix_t prefix = {
 131     .fp_len = p_len,
 132     .fp_proto = FIB_PROTOCOL_IP4,
 133     .fp_addr = {
 134         .ip4.as_u32 = addr->as_u32,
 135     },
 136   };
 137   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 138
 139   if (is_add)
 140     fib_table_entry_update_one_path(fib_index,
 141                                     &prefix,
 142                                     FIB_SOURCE_PLUGIN_HI,
 143                                     (FIB_ENTRY_FLAG_CONNECTED |
 144                                      FIB_ENTRY_FLAG_LOCAL |
 145                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 146                                     DPO_PROTO_IP4,
 147                                     NULL,
 148                                     sw_if_index,
 149                                     ~0,
 150                                     1,
 151                                     NULL,
 152                                     FIB_ROUTE_PATH_FLAG_NONE);
 153   else
 154     fib_table_entry_delete(fib_index,
 155                            &prefix,
 156                            FIB_SOURCE_PLUGIN_HI);
 157 }
 158
 159 void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id)
 160 {
 161   snat_address_t * ap;
 162   snat_interface_t *i;
 163   vlib_thread_main_t *tm = vlib_get_thread_main ();
 164
 165   if (vrf_id != ~0)
 166     sm->vrf_mode = 1;
 167
 168   /* Check if address already exists */
 169   vec_foreach (ap, sm->addresses)
 170     {
 171       if (ap->addr.as_u32 == addr->as_u32)
 172         return;
 173     }
 174
 175   vec_add2 (sm->addresses, ap, 1);
 176   ap->addr = *addr;
 177   if (vrf_id != ~0)
 178     ap->fib_index =
 179       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 180                                          FIB_SOURCE_PLUGIN_HI);
 181   else
 182     ap->fib_index = ~0;
 183 #define _(N, i, n, s) \
 184   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 185   ap->busy_##n##_ports = 0; \
 186   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 187   foreach_snat_protocol
 188 #undef _
 189
 190   /* Add external address to FIB */
 191   pool_foreach (i, sm->interfaces,
 192   ({
 193     if (i->is_inside)
 194       continue;
 195
 196     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 197     break;
 198   }));
 199   pool_foreach (i, sm->output_feature_interfaces,
 200   ({
 201     if (i->is_inside)
 202       continue;
 203
 204     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 205     break;
 206   }));
 207 }
 208
 209 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 210                                                    ip4_address_t addr)
 211 {
 212   snat_static_mapping_t *m;
 213   pool_foreach (m, sm->static_mappings,
 214   ({
 215       if (m->external_addr.as_u32 == addr.as_u32)
 216         return 1;
 217   }));
 218
 219   return 0;
 220 }
 221
 222 void increment_v4_address (ip4_address_t * a)
 223 {
 224   u32 v;
 225
 226   v = clib_net_to_host_u32(a->as_u32) + 1;
 227   a->as_u32 = clib_host_to_net_u32(v);
 228 }
 229
 230 static void
 231 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 232                                        ip4_address_t l_addr,
 233                                        u16 l_port,
 234                                        u32 sw_if_index,
 235                                        u16 e_port,
 236                                        u32 vrf_id,
 237                                        snat_protocol_t proto,
 238                                        int addr_only,
 239                                        int is_add)
 240 {
 241   snat_static_map_resolve_t *rp;
 242
 243   vec_add2 (sm->to_resolve, rp, 1);
 244   rp->l_addr.as_u32 = l_addr.as_u32;
 245   rp->l_port = l_port;
 246   rp->sw_if_index = sw_if_index;
 247   rp->e_port = e_port;
 248   rp->vrf_id = vrf_id;
 249   rp->proto = proto;
 250   rp->addr_only = addr_only;
 251   rp->is_add = is_add;
 252 }
 253
 254 /**
 255  * @brief Add static mapping.
 256  *
 257  * Create static mapping between local addr+port and external addr+port.
 258  *
 259  * @param l_addr Local IPv4 address.
 260  * @param e_addr External IPv4 address.
 261  * @param l_port Local port number.
 262  * @param e_port External port number.
 263  * @param vrf_id VRF ID.
 264  * @param addr_only If 0 address port and pair mapping, otherwise address only.
 265  * @param sw_if_index External port instead of specific IP address.
 266  * @param is_add If 0 delete static mapping, otherwise add.
 267  *
 268  * @returns
 269  */
 270 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
 271                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 272                             u32 sw_if_index, snat_protocol_t proto, int is_add)
 273 {
 274   snat_main_t * sm = &snat_main;
 275   snat_static_mapping_t *m;
 276   snat_session_key_t m_key;
 277   clib_bihash_kv_8_8_t kv, value;
 278   snat_address_t *a = 0;
 279   u32 fib_index = ~0;
 280   uword * p;
 281   snat_interface_t *interface;
 282   int i;
 283
 284   /* If the external address is a specific interface address */
 285   if (sw_if_index != ~0)
 286     {
 287       ip4_address_t * first_int_addr;
 288
 289       /* Might be already set... */
 290       first_int_addr = ip4_interface_first_address
 291         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
 292
 293       /* DHCP resolution required? */
 294       if (first_int_addr == 0)
 295         {
 296           snat_add_static_mapping_when_resolved
 297             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 298              addr_only,  is_add);
 299           return 0;
 300         }
 301         else
 302           e_addr.as_u32 = first_int_addr->as_u32;
 303     }
 304
 305   m_key.addr = e_addr;
 306   m_key.port = addr_only ? 0 : e_port;
 307   m_key.protocol = addr_only ? 0 : proto;
 308   m_key.fib_index = sm->outside_fib_index;
 309   kv.key = m_key.as_u64;
 310   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 311     m = 0;
 312   else
 313     m = pool_elt_at_index (sm->static_mappings, value.value);
 314
 315   if (is_add)
 316     {
 317       if (m)
 318         return VNET_API_ERROR_VALUE_EXIST;
 319
 320       /* Convert VRF id to FIB index */
 321       if (vrf_id != ~0)
 322         {
 323           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
 324           if (!p)
 325             return VNET_API_ERROR_NO_SUCH_FIB;
 326           fib_index = p[0];
 327         }
 328       /* If not specified use inside VRF id from SNAT plugin startup config */
 329       else
 330         {
 331           fib_index = sm->inside_fib_index;
 332           vrf_id = sm->inside_vrf_id;
 333         }
 334
 335       /* Find external address in allocated addresses and reserve port for
 336          address and port pair mapping when dynamic translations enabled */
 337       if (!addr_only && !(sm->static_mapping_only))
 338         {
 339           for (i = 0; i < vec_len (sm->addresses); i++)
 340             {
 341               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 342                 {
 343                   a = sm->addresses + i;
 344                   /* External port must be unused */
 345                   switch (proto)
 346                     {
 347 #define _(N, j, n, s) \
 348                     case SNAT_PROTOCOL_##N: \
 349                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 350                         return VNET_API_ERROR_INVALID_VALUE; \
 351                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 352                       if (e_port > 1024) \
 353                         { \
 354                           a->busy_##n##_ports++; \
 355                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]++; \
 356                         } \
 357                       break;
 358                       foreach_snat_protocol
 359 #undef _
 360                     default:
 361                       clib_warning("unknown_protocol");
 362                       return VNET_API_ERROR_INVALID_VALUE_2;
 363                     }
 364                   break;
 365                 }
 366             }
 367           /* External address must be allocated */
 368           if (!a)
 369             return VNET_API_ERROR_NO_SUCH_ENTRY;
 370         }
 371
 372       pool_get (sm->static_mappings, m);
 373       memset (m, 0, sizeof (*m));
 374       m->local_addr = l_addr;
 375       m->external_addr = e_addr;
 376       m->addr_only = addr_only;
 377       m->vrf_id = vrf_id;
 378       m->fib_index = fib_index;
 379       if (!addr_only)
 380         {
 381           m->local_port = l_port;
 382           m->external_port = e_port;
 383           m->proto = proto;
 384         }
 385
 386       m_key.addr = m->local_addr;
 387       m_key.port = m->local_port;
 388       m_key.protocol = m->proto;
 389       m_key.fib_index = m->fib_index;
 390       kv.key = m_key.as_u64;
 391       kv.value = m - sm->static_mappings;
 392       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 393
 394       m_key.addr = m->external_addr;
 395       m_key.port = m->external_port;
 396       m_key.fib_index = sm->outside_fib_index;
 397       kv.key = m_key.as_u64;
 398       kv.value = m - sm->static_mappings;
 399       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
 400
 401       if (sm->workers)
 402         {
 403           ip4_header_t ip = {
 404             .src_address = m->local_addr,
 405           };
 406           m->worker_index = sm->worker_in2out_cb (&ip, m->fib_index);
 407         }
 408     }
 409   else
 410     {
 411       if (!m)
 412         return VNET_API_ERROR_NO_SUCH_ENTRY;
 413
 414       /* Free external address port */
 415       if (!addr_only && !(sm->static_mapping_only))
 416         {
 417           for (i = 0; i < vec_len (sm->addresses); i++)
 418             {
 419               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 420                 {
 421                   a = sm->addresses + i;
 422                   switch (proto)
 423                     {
 424 #define _(N, j, n, s) \
 425                     case SNAT_PROTOCOL_##N: \
 426                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 427                       if (e_port > 1024) \
 428                         { \
 429                           a->busy_##n##_ports--; \
 430                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]--; \
 431                         } \
 432                       break;
 433                       foreach_snat_protocol
 434 #undef _
 435                     default:
 436                       clib_warning("unknown_protocol");
 437                       return VNET_API_ERROR_INVALID_VALUE_2;
 438                     }
 439                   break;
 440                 }
 441             }
 442         }
 443
 444       m_key.addr = m->local_addr;
 445       m_key.port = m->local_port;
 446       m_key.protocol = m->proto;
 447       m_key.fib_index = m->fib_index;
 448       kv.key = m_key.as_u64;
 449       clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
 450
 451       m_key.addr = m->external_addr;
 452       m_key.port = m->external_port;
 453       m_key.fib_index = sm->outside_fib_index;
 454       kv.key = m_key.as_u64;
 455       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
 456
 457       /* Delete session(s) for static mapping if exist */
 458       if (!(sm->static_mapping_only) ||
 459           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
 460         {
 461           snat_user_key_t u_key;
 462           snat_user_t *u;
 463           dlist_elt_t * head, * elt;
 464           u32 elt_index, head_index, del_elt_index;
 465           u32 ses_index;
 466           u64 user_index;
 467           snat_session_t * s;
 468           snat_main_per_thread_data_t *tsm;
 469
 470           u_key.addr = m->local_addr;
 471           u_key.fib_index = m->fib_index;
 472           kv.key = u_key.as_u64;
 473           if (sm->num_workers)
 474             tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
 475           else
 476             tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 477           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 478             {
 479               user_index = value.value;
 480               u = pool_elt_at_index (tsm->users, user_index);
 481               if (u->nstaticsessions)
 482                 {
 483                   head_index = u->sessions_per_user_list_head_index;
 484                   head = pool_elt_at_index (tsm->list_pool, head_index);
 485                   elt_index = head->next;
 486                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 487                   ses_index = elt->value;
 488                   while (ses_index != ~0)
 489                     {
 490                       s =  pool_elt_at_index (tsm->sessions, ses_index);
 491                       del_elt_index = elt_index;
 492                       elt_index = elt->next;
 493                       elt = pool_elt_at_index (tsm->list_pool, elt_index);
 494                       ses_index = elt->value;
 495
 496                       if (!addr_only)
 497                         {
 498                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) &&
 499                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
 500                             continue;
 501                         }
 502
 503                       if (snat_is_unk_proto_session (s))
 504                         {
 505                           clib_bihash_kv_16_8_t up_kv;
 506                           nat_ed_ses_key_t up_key;
 507                           up_key.l_addr = s->in2out.addr;
 508                           up_key.r_addr = s->ext_host_addr;
 509                           up_key.fib_index = s->in2out.fib_index;
 510                           up_key.proto = s->in2out.port;
 511                           up_key.rsvd = 0;
 512                           up_key.l_port = 0;
 513                           up_kv.key[0] = up_key.as_u64[0];
 514                           up_kv.key[1] = up_key.as_u64[1];
 515                           if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
 516                                                         &up_kv, 0))
 517                             clib_warning ("in2out key del failed");
 518
 519                           up_key.l_addr = s->out2in.addr;
 520                           up_key.fib_index = s->out2in.fib_index;
 521                           up_kv.key[0] = up_key.as_u64[0];
 522                           up_kv.key[1] = up_key.as_u64[1];
 523                           if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
 524                                                         &up_kv, 0))
 525                             clib_warning ("out2in key del failed");
 526
 527                           goto delete;
 528                         }
 529                       /* log NAT event */
 530                       snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 531                                                           s->out2in.addr.as_u32,
 532                                                           s->in2out.protocol,
 533                                                           s->in2out.port,
 534                                                           s->out2in.port,
 535                                                           s->in2out.fib_index);
 536
 537                       value.key = s->in2out.as_u64;
 538                       if (clib_bihash_add_del_8_8 (&tsm->in2out, &value, 0))
 539                         clib_warning ("in2out key del failed");
 540                       value.key = s->out2in.as_u64;
 541                       if (clib_bihash_add_del_8_8 (&tsm->out2in, &value, 0))
 542                         clib_warning ("out2in key del failed");
 543 delete:
 544                       pool_put (tsm->sessions, s);
 545
 546                       clib_dlist_remove (tsm->list_pool, del_elt_index);
 547                       pool_put_index (tsm->list_pool, del_elt_index);
 548                       u->nstaticsessions--;
 549
 550                       if (!addr_only)
 551                         break;
 552                     }
 553                   if (addr_only)
 554                     {
 555                       pool_put (tsm->users, u);
 556                       clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 0);
 557                     }
 558                 }
 559             }
 560         }
 561
 562       /* Delete static mapping from pool */
 563       pool_put (sm->static_mappings, m);
 564     }
 565
 566   if (!addr_only)
 567     return 0;
 568
 569   /* Add/delete external address to FIB */
 570   pool_foreach (interface, sm->interfaces,
 571   ({
 572     if (interface->is_inside)
 573       continue;
 574
 575     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 576     break;
 577   }));
 578   pool_foreach (interface, sm->output_feature_interfaces,
 579   ({
 580     if (interface->is_inside)
 581       continue;
 582
 583     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 584     break;
 585   }));
 586
 587   return 0;
 588 }
 589
 590 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
 591                                      snat_protocol_t proto, u32 vrf_id,
 592                                      nat44_lb_addr_port_t *locals, u8 is_add)
 593 {
 594   snat_main_t * sm = &snat_main;
 595   snat_static_mapping_t *m;
 596   snat_session_key_t m_key;
 597   clib_bihash_kv_8_8_t kv, value;
 598   u32 fib_index;
 599   snat_address_t *a = 0;
 600   int i;
 601   nat44_lb_addr_port_t *local;
 602   u32 worker_index = 0;
 603   snat_main_per_thread_data_t *tsm;
 604
 605   m_key.addr = e_addr;
 606   m_key.port = e_port;
 607   m_key.protocol = proto;
 608   m_key.fib_index = sm->outside_fib_index;
 609   kv.key = m_key.as_u64;
 610   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 611     m = 0;
 612   else
 613     m = pool_elt_at_index (sm->static_mappings, value.value);
 614
 615   if (is_add)
 616     {
 617       if (m)
 618         return VNET_API_ERROR_VALUE_EXIST;
 619
 620       if (vec_len (locals) < 2)
 621         return VNET_API_ERROR_INVALID_VALUE;
 622
 623       fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
 624                                                      vrf_id,
 625                                                      FIB_SOURCE_PLUGIN_HI);
 626
 627       /* Find external address in allocated addresses and reserve port for
 628          address and port pair mapping when dynamic translations enabled */
 629       if (!sm->static_mapping_only)
 630         {
 631           for (i = 0; i < vec_len (sm->addresses); i++)
 632             {
 633               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 634                 {
 635                   a = sm->addresses + i;
 636                   /* External port must be unused */
 637                   switch (proto)
 638                     {
 639 #define _(N, j, n, s) \
 640                     case SNAT_PROTOCOL_##N: \
 641                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 642                         return VNET_API_ERROR_INVALID_VALUE; \
 643                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 644                       if (e_port > 1024) \
 645                         { \
 646                           a->busy_##n##_ports++; \
 647                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]++; \
 648                         } \
 649                       break;
 650                       foreach_snat_protocol
 651 #undef _
 652                     default:
 653                       clib_warning("unknown_protocol");
 654                       return VNET_API_ERROR_INVALID_VALUE_2;
 655                     }
 656                   break;
 657                 }
 658             }
 659           /* External address must be allocated */
 660           if (!a)
 661             return VNET_API_ERROR_NO_SUCH_ENTRY;
 662         }
 663
 664       pool_get (sm->static_mappings, m);
 665       memset (m, 0, sizeof (*m));
 666       m->external_addr = e_addr;
 667       m->addr_only = 0;
 668       m->vrf_id = vrf_id;
 669       m->fib_index = fib_index;
 670       m->external_port = e_port;
 671       m->proto = proto;
 672
 673       m_key.addr = m->external_addr;
 674       m_key.port = m->external_port;
 675       m_key.protocol = m->proto;
 676       m_key.fib_index = sm->outside_fib_index;
 677       kv.key = m_key.as_u64;
 678       kv.value = m - sm->static_mappings;
 679       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1))
 680         {
 681           clib_warning ("static_mapping_by_external key add failed");
 682           return VNET_API_ERROR_UNSPECIFIED;
 683         }
 684
 685       /* Assign worker */
 686       if (sm->workers)
 687         {
 688           worker_index = sm->first_worker_index +
 689             sm->workers[sm->next_worker++ % vec_len (sm->workers)];
 690           tsm = vec_elt_at_index (sm->per_thread_data, worker_index);
 691           m->worker_index = worker_index;
 692         }
 693       else
 694         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 695
 696       m_key.port = clib_host_to_net_u16 (m->external_port);
 697       kv.key = m_key.as_u64;
 698       kv.value = ~0ULL;
 699       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
 700         {
 701           clib_warning ("static_mapping_by_local key add failed");
 702           return VNET_API_ERROR_UNSPECIFIED;
 703         }
 704
 705       m_key.fib_index = m->fib_index;
 706       for (i = 0; i < vec_len (locals); i++)
 707         {
 708           m_key.addr = locals[i].addr;
 709           m_key.port = locals[i].port;
 710           kv.key = m_key.as_u64;
 711           kv.value = m - sm->static_mappings;
 712           clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 713           locals[i].prefix = (i == 0) ? locals[i].probability :\
 714             (locals[i - 1].prefix + locals[i].probability);
 715           vec_add1 (m->locals, locals[i]);
 716
 717           m_key.port = clib_host_to_net_u16 (locals[i].port);
 718           kv.key = m_key.as_u64;
 719           kv.value = ~0ULL;
 720           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
 721             {
 722               clib_warning ("in2out key add failed");
 723               return VNET_API_ERROR_UNSPECIFIED;
 724             }
 725         }
 726     }
 727   else
 728     {
 729       if (!m)
 730         return VNET_API_ERROR_NO_SUCH_ENTRY;
 731
 732       fib_table_unlock (m->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_HI);
 733
 734       /* Free external address port */
 735       if (!sm->static_mapping_only)
 736         {
 737           for (i = 0; i < vec_len (sm->addresses); i++)
 738             {
 739               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 740                 {
 741                   a = sm->addresses + i;
 742                   switch (proto)
 743                     {
 744 #define _(N, j, n, s) \
 745                     case SNAT_PROTOCOL_##N: \
 746                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 747                       if (e_port > 1024) \
 748                         { \
 749                           a->busy_##n##_ports--; \
 750                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]--; \
 751                         } \
 752                       break;
 753                       foreach_snat_protocol
 754 #undef _
 755                     default:
 756                       clib_warning("unknown_protocol");
 757                       return VNET_API_ERROR_INVALID_VALUE_2;
 758                     }
 759                   break;
 760                 }
 761             }
 762         }
 763
 764       tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
 765       m_key.addr = m->external_addr;
 766       m_key.port = m->external_port;
 767       m_key.protocol = m->proto;
 768       m_key.fib_index = sm->outside_fib_index;
 769       kv.key = m_key.as_u64;
 770       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0))
 771         {
 772           clib_warning ("static_mapping_by_external key del failed");
 773           return VNET_API_ERROR_UNSPECIFIED;
 774         }
 775
 776       m_key.port = clib_host_to_net_u16 (m->external_port);
 777       kv.key = m_key.as_u64;
 778       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
 779         {
 780           clib_warning ("outi2in key del failed");
 781           return VNET_API_ERROR_UNSPECIFIED;
 782         }
 783
 784       vec_foreach (local, m->locals)
 785         {
 786           m_key.addr = local->addr;
 787           m_key.port = local->port;
 788           m_key.fib_index = m->fib_index;
 789           kv.key = m_key.as_u64;
 790           if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
 791             {
 792               clib_warning ("static_mapping_by_local key del failed");
 793               return VNET_API_ERROR_UNSPECIFIED;
 794             }
 795
 796           m_key.port = clib_host_to_net_u16 (local->port);
 797           kv.key = m_key.as_u64;
 798           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
 799             {
 800               clib_warning ("in2out key del failed");
 801               return VNET_API_ERROR_UNSPECIFIED;
 802             }
 803         }
 804       vec_free(m->locals);
 805
 806       pool_put (sm->static_mappings, m);
 807     }
 808
 809   return 0;
 810 }
 811
 812 int snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm)
 813 {
 814   snat_address_t *a = 0;
 815   snat_session_t *ses;
 816   u32 *ses_to_be_removed = 0, *ses_index;
 817   clib_bihash_kv_8_8_t kv, value;
 818   snat_user_key_t user_key;
 819   snat_user_t *u;
 820   snat_main_per_thread_data_t *tsm;
 821   snat_static_mapping_t *m;
 822   snat_interface_t *interface;
 823   int i;
 824
 825   /* Find SNAT address */
 826   for (i=0; i < vec_len (sm->addresses); i++)
 827     {
 828       if (sm->addresses[i].addr.as_u32 == addr.as_u32)
 829         {
 830           a = sm->addresses + i;
 831           break;
 832         }
 833     }
 834   if (!a)
 835     return VNET_API_ERROR_NO_SUCH_ENTRY;
 836
 837   if (delete_sm)
 838     {
 839       pool_foreach (m, sm->static_mappings,
 840       ({
 841           if (m->external_addr.as_u32 == addr.as_u32)
 842             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
 843                                             m->local_port, m->external_port,
 844                                             m->vrf_id, m->addr_only, ~0,
 845                                             m->proto, 0);
 846       }));
 847     }
 848   else
 849     {
 850       /* Check if address is used in some static mapping */
 851       if (is_snat_address_used_in_static_mapping(sm, addr))
 852         {
 853           clib_warning ("address used in static mapping");
 854           return VNET_API_ERROR_UNSPECIFIED;
 855         }
 856     }
 857
 858   if (a->fib_index != ~0)
 859     fib_table_unlock(a->fib_index, FIB_PROTOCOL_IP4,
 860                      FIB_SOURCE_PLUGIN_HI);
 861
 862   /* Delete sessions using address */
 863   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
 864     {
 865       vec_foreach (tsm, sm->per_thread_data)
 866         {
 867           pool_foreach (ses, tsm->sessions, ({
 868             if (ses->out2in.addr.as_u32 == addr.as_u32)
 869               {
 870                 if (snat_is_unk_proto_session (ses))
 871                   {
 872                     clib_bihash_kv_16_8_t up_kv;
 873                     nat_ed_ses_key_t up_key;
 874                     up_key.l_addr = ses->in2out.addr;
 875                     up_key.r_addr = ses->ext_host_addr;
 876                     up_key.fib_index = ses->in2out.fib_index;
 877                     up_key.proto = ses->in2out.port;
 878                     up_key.rsvd = 0;
 879                     up_key.l_port = 0;
 880                     up_kv.key[0] = up_key.as_u64[0];
 881                     up_kv.key[1] = up_key.as_u64[1];
 882                     if (clib_bihash_add_del_16_8 (&sm->in2out_ed,
 883                                                   &up_kv, 0))
 884                       clib_warning ("in2out key del failed");
 885
 886                     up_key.l_addr = ses->out2in.addr;
 887                     up_key.fib_index = ses->out2in.fib_index;
 888                     up_kv.key[0] = up_key.as_u64[0];
 889                     up_kv.key[1] = up_key.as_u64[1];
 890                     if (clib_bihash_add_del_16_8 (&sm->out2in_ed,
 891                                                   &up_kv, 0))
 892                       clib_warning ("out2in key del failed");
 893                   }
 894                 else
 895                   {
 896                     /* log NAT event */
 897                     snat_ipfix_logging_nat44_ses_delete(ses->in2out.addr.as_u32,
 898                                                         ses->out2in.addr.as_u32,
 899                                                         ses->in2out.protocol,
 900                                                         ses->in2out.port,
 901                                                         ses->out2in.port,
 902                                                         ses->in2out.fib_index);
 903                     kv.key = ses->in2out.as_u64;
 904                     clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0);
 905                     kv.key = ses->out2in.as_u64;
 906                     clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0);
 907                   }
 908                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
 909                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
 910                 user_key.addr = ses->in2out.addr;
 911                 user_key.fib_index = ses->in2out.fib_index;
 912                 kv.key = user_key.as_u64;
 913                 if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 914                   {
 915                     u = pool_elt_at_index (tsm->users, value.value);
 916                     u->nsessions--;
 917                   }
 918               }
 919           }));
 920
 921           vec_foreach (ses_index, ses_to_be_removed)
 922             pool_put_index (tsm->sessions, ses_index[0]);
 923
 924           vec_free (ses_to_be_removed);
 925        }
 926     }
 927
 928   vec_del1 (sm->addresses, i);
 929
 930   /* Delete external address from FIB */
 931   pool_foreach (interface, sm->interfaces,
 932   ({
 933     if (interface->is_inside)
 934       continue;
 935
 936     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 937     break;
 938   }));
 939   pool_foreach (interface, sm->output_feature_interfaces,
 940   ({
 941     if (interface->is_inside)
 942       continue;
 943
 944     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
 945     break;
 946   }));
 947
 948   return 0;
 949 }
 950
 951 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
 952 {
 953   snat_main_t *sm = &snat_main;
 954   snat_interface_t *i;
 955   const char * feature_name;
 956   snat_address_t * ap;
 957   snat_static_mapping_t * m;
 958   snat_det_map_t * dm;
 959
 960   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
 961     feature_name = is_inside ?  "nat44-in2out-fast" : "nat44-out2in-fast";
 962   else
 963     {
 964       if (sm->num_workers > 1 && !sm->deterministic)
 965         feature_name = is_inside ?  "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff";
 966       else if (sm->deterministic)
 967         feature_name = is_inside ?  "nat44-det-in2out" : "nat44-det-out2in";
 968       else
 969         feature_name = is_inside ?  "nat44-in2out" : "nat44-out2in";
 970     }
 971
 972   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index,
 973                                !is_del, 0, 0);
 974
 975   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 976     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, 0);
 977
 978   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
 979     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
 980
 981   pool_foreach (i, sm->interfaces,
 982   ({
 983     if (i->sw_if_index == sw_if_index)
 984       {
 985         if (is_del)
 986           pool_put (sm->interfaces, i);
 987         else
 988           return VNET_API_ERROR_VALUE_EXIST;
 989
 990         goto fib;
 991       }
 992   }));
 993
 994   if (is_del)
 995     return VNET_API_ERROR_NO_SUCH_ENTRY;
 996
 997   pool_get (sm->interfaces, i);
 998   i->sw_if_index = sw_if_index;
 999   i->is_inside = is_inside;
1000
1001   /* Add/delete external addresses to FIB */
1002 fib:
1003   if (is_inside)
1004     {
1005       vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1006                                    sw_if_index, !is_del, 0, 0);
1007       return 0;
1008     }
1009
1010   vec_foreach (ap, sm->addresses)
1011     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1012
1013   pool_foreach (m, sm->static_mappings,
1014   ({
1015     if (!(m->addr_only))
1016       continue;
1017
1018     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1019   }));
1020
1021   pool_foreach (dm, sm->det_maps,
1022   ({
1023     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1024   }));
1025
1026   return 0;
1027 }
1028
1029 int snat_interface_add_del_output_feature (u32 sw_if_index,
1030                                            u8 is_inside,
1031                                            int is_del)
1032 {
1033   snat_main_t *sm = &snat_main;
1034   snat_interface_t *i;
1035   snat_address_t * ap;
1036   snat_static_mapping_t * m;
1037
1038   if (sm->deterministic ||
1039       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1040     return VNET_API_ERROR_UNSUPPORTED;
1041
1042   if (is_inside)
1043     {
1044       vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1045                                    sw_if_index, !is_del, 0, 0);
1046       vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1047                                    sw_if_index, !is_del, 0, 0);
1048       goto fq;
1049     }
1050
1051   if (sm->num_workers > 1)
1052     {
1053       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in-worker-handoff",
1054                                    sw_if_index, !is_del, 0, 0);
1055       vnet_feature_enable_disable ("ip4-output",
1056                                    "nat44-in2out-output-worker-handoff",
1057                                    sw_if_index, !is_del, 0, 0);
1058     }
1059   else
1060     {
1061       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in", sw_if_index,
1062                                    !is_del, 0, 0);
1063       vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1064                                    sw_if_index, !is_del, 0, 0);
1065     }
1066
1067 fq:
1068   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1069     sm->fq_in2out_output_index =
1070       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1071
1072   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1073     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1074
1075   pool_foreach (i, sm->output_feature_interfaces,
1076   ({
1077     if (i->sw_if_index == sw_if_index)
1078       {
1079         if (is_del)
1080           pool_put (sm->output_feature_interfaces, i);
1081         else
1082           return VNET_API_ERROR_VALUE_EXIST;
1083
1084         goto fib;
1085       }
1086   }));
1087
1088   if (is_del)
1089     return VNET_API_ERROR_NO_SUCH_ENTRY;
1090
1091   pool_get (sm->output_feature_interfaces, i);
1092   i->sw_if_index = sw_if_index;
1093   i->is_inside = is_inside;
1094
1095   /* Add/delete external addresses to FIB */
1096 fib:
1097   if (is_inside)
1098     return 0;
1099
1100   vec_foreach (ap, sm->addresses)
1101     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1102
1103   pool_foreach (m, sm->static_mappings,
1104   ({
1105     if (!(m->addr_only))
1106       continue;
1107
1108     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1109   }));
1110
1111   return 0;
1112 }
1113
1114 int snat_set_workers (uword * bitmap)
1115 {
1116   snat_main_t *sm = &snat_main;
1117   int i, j = 0;
1118
1119   if (sm->num_workers < 2)
1120     return VNET_API_ERROR_FEATURE_DISABLED;
1121
1122   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1123     return VNET_API_ERROR_INVALID_WORKER;
1124
1125   vec_free (sm->workers);
1126   clib_bitmap_foreach (i, bitmap,
1127     ({
1128       vec_add1(sm->workers, i);
1129       sm->per_thread_data[i].snat_thread_index = j;
1130       j++;
1131     }));
1132
1133   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1134   sm->num_snat_thread = _vec_len (sm->workers);
1135
1136   return 0;
1137 }
1138
1139
1140 static void
1141 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1142                                        uword opaque,
1143                                        u32 sw_if_index,
1144                                        ip4_address_t * address,
1145                                        u32 address_length,
1146                                        u32 if_address_index,
1147                                        u32 is_delete);
1148
1149 static clib_error_t * snat_init (vlib_main_t * vm)
1150 {
1151   snat_main_t * sm = &snat_main;
1152   clib_error_t * error = 0;
1153   ip4_main_t * im = &ip4_main;
1154   ip_lookup_main_t * lm = &im->lookup_main;
1155   uword *p;
1156   vlib_thread_registration_t *tr;
1157   vlib_thread_main_t *tm = vlib_get_thread_main ();
1158   uword *bitmap = 0;
1159   u32 i;
1160   ip4_add_del_interface_address_callback_t cb4;
1161
1162   sm->vlib_main = vm;
1163   sm->vnet_main = vnet_get_main();
1164   sm->ip4_main = im;
1165   sm->ip4_lookup_main = lm;
1166   sm->api_main = &api_main;
1167   sm->first_worker_index = 0;
1168   sm->next_worker = 0;
1169   sm->num_workers = 0;
1170   sm->num_snat_thread = 1;
1171   sm->workers = 0;
1172   sm->port_per_thread = 0xffff - 1024;
1173   sm->fq_in2out_index = ~0;
1174   sm->fq_out2in_index = ~0;
1175   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1176   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1177   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1178   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1179
1180   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1181   if (p)
1182     {
1183       tr = (vlib_thread_registration_t *) p[0];
1184       if (tr)
1185         {
1186           sm->num_workers = tr->count;
1187           sm->first_worker_index = tr->first_index;
1188         }
1189     }
1190
1191   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1192
1193   /* Use all available workers by default */
1194   if (sm->num_workers > 1)
1195     {
1196       for (i=0; i < sm->num_workers; i++)
1197         bitmap = clib_bitmap_set (bitmap, i, 1);
1198       snat_set_workers(bitmap);
1199       clib_bitmap_free (bitmap);
1200     }
1201   else
1202     {
1203       sm->per_thread_data[0].snat_thread_index = 0;
1204     }
1205
1206   error = snat_api_init(vm, sm);
1207   if (error)
1208     return error;
1209
1210   /* Set up the interface address add/del callback */
1211   cb4.function = snat_ip4_add_del_interface_address_cb;
1212   cb4.function_opaque = 0;
1213
1214   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1215
1216   /* Init IPFIX logging */
1217   snat_ipfix_logging_init(vm);
1218
1219   error = nat64_init(vm);
1220
1221   return error;
1222 }
1223
1224 VLIB_INIT_FUNCTION (snat_init);
1225
1226 void snat_free_outside_address_and_port (snat_main_t * sm,
1227                                          u32 thread_index,
1228                                          snat_session_key_t * k,
1229                                          u32 address_index)
1230 {
1231   snat_address_t *a;
1232   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
1233
1234   ASSERT (address_index < vec_len (sm->addresses));
1235
1236   a = sm->addresses + address_index;
1237
1238   switch (k->protocol)
1239     {
1240 #define _(N, i, n, s) \
1241     case SNAT_PROTOCOL_##N: \
1242       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
1243         port_host_byte_order) == 1); \
1244       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
1245         port_host_byte_order, 0); \
1246       a->busy_##n##_ports--; \
1247       a->busy_##n##_ports_per_thread[thread_index]--; \
1248       break;
1249       foreach_snat_protocol
1250 #undef _
1251     default:
1252       clib_warning("unknown_protocol");
1253       return;
1254     }
1255 }
1256
1257 /**
1258  * @brief Match NAT44 static mapping.
1259  *
1260  * @param sm          NAT main.
1261  * @param match       Address and port to match.
1262  * @param mapping     External or local address and port of the matched mapping.
1263  * @param by_external If 0 match by local address otherwise match by external
1264  *                    address.
1265  * @param is_addr_only If matched mapping is address only
1266  *
1267  * @returns 0 if match found otherwise 1.
1268  */
1269 int snat_static_mapping_match (snat_main_t * sm,
1270                                snat_session_key_t match,
1271                                snat_session_key_t * mapping,
1272                                u8 by_external,
1273                                u8 *is_addr_only)
1274 {
1275   clib_bihash_kv_8_8_t kv, value;
1276   snat_static_mapping_t *m;
1277   snat_session_key_t m_key;
1278   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
1279   u32 rand, lo = 0, hi, mid;
1280
1281   if (by_external)
1282     mapping_hash = &sm->static_mapping_by_external;
1283
1284   m_key.addr = match.addr;
1285   m_key.port = clib_net_to_host_u16 (match.port);
1286   m_key.protocol = match.protocol;
1287   m_key.fib_index = match.fib_index;
1288
1289   kv.key = m_key.as_u64;
1290
1291   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1292     {
1293       /* Try address only mapping */
1294       m_key.port = 0;
1295       m_key.protocol = 0;
1296       kv.key = m_key.as_u64;
1297       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1298         return 1;
1299     }
1300
1301   m = pool_elt_at_index (sm->static_mappings, value.value);
1302
1303   if (by_external)
1304     {
1305       if (vec_len (m->locals))
1306         {
1307           hi = vec_len (m->locals) - 1;
1308           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
1309           while (lo < hi)
1310             {
1311               mid = ((hi - lo) >> 1) + lo;
1312               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
1313             }
1314           if (!(m->locals[lo].prefix >= rand))
1315             return 1;
1316           mapping->addr = m->locals[lo].addr;
1317           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
1318         }
1319       else
1320         {
1321           mapping->addr = m->local_addr;
1322           /* Address only mapping doesn't change port */
1323           mapping->port = m->addr_only ? match.port
1324             : clib_host_to_net_u16 (m->local_port);
1325         }
1326       mapping->fib_index = m->fib_index;
1327       mapping->protocol = m->proto;
1328     }
1329   else
1330     {
1331       mapping->addr = m->external_addr;
1332       /* Address only mapping doesn't change port */
1333       mapping->port = m->addr_only ? match.port
1334         : clib_host_to_net_u16 (m->external_port);
1335       mapping->fib_index = sm->outside_fib_index;
1336     }
1337
1338   if (PREDICT_FALSE(is_addr_only != 0))
1339     *is_addr_only = m->addr_only;
1340
1341   return 0;
1342 }
1343
1344 static_always_inline u16
1345 snat_random_port (snat_main_t * sm, u16 min, u16 max)
1346 {
1347   return min + random_u32 (&sm->random_seed) /
1348     (random_u32_max() / (max - min + 1) + 1);
1349 }
1350
1351 int snat_alloc_outside_address_and_port (snat_main_t * sm,
1352                                          u32 fib_index,
1353                                          u32 thread_index,
1354                                          snat_session_key_t * k,
1355                                          u32 * address_indexp)
1356 {
1357   int i;
1358   snat_address_t *a;
1359   u32 portnum;
1360
1361   for (i = 0; i < vec_len (sm->addresses); i++)
1362     {
1363       a = sm->addresses + i;
1364       if (sm->vrf_mode && a->fib_index != ~0 && a->fib_index != fib_index)
1365         continue;
1366       switch (k->protocol)
1367         {
1368 #define _(N, j, n, s) \
1369         case SNAT_PROTOCOL_##N: \
1370           if (a->busy_##n##_ports_per_thread[thread_index] < sm->port_per_thread) \
1371             { \
1372               while (1) \
1373                 { \
1374                   portnum = (sm->port_per_thread * \
1375                     sm->per_thread_data[thread_index].snat_thread_index) + \
1376                     snat_random_port(sm, 1, sm->port_per_thread) + 1024; \
1377                   if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
1378                     continue; \
1379                   clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
1380                   a->busy_##n##_ports_per_thread[thread_index]++; \
1381                   a->busy_##n##_ports++; \
1382                   k->addr = a->addr; \
1383                   k->port = clib_host_to_net_u16(portnum); \
1384                   *address_indexp = i; \
1385                   return 0; \
1386                 } \
1387             } \
1388           break;
1389           foreach_snat_protocol
1390 #undef _
1391         default:
1392           clib_warning("unknown protocol");
1393           return 1;
1394         }
1395
1396     }
1397   /* Totally out of translations to use... */
1398   snat_ipfix_logging_addresses_exhausted(0);
1399   return 1;
1400 }
1401
1402
1403 static clib_error_t *
1404 add_address_command_fn (vlib_main_t * vm,
1405                         unformat_input_t * input,
1406                         vlib_cli_command_t * cmd)
1407 {
1408   unformat_input_t _line_input, *line_input = &_line_input;
1409   snat_main_t * sm = &snat_main;
1410   ip4_address_t start_addr, end_addr, this_addr;
1411   u32 start_host_order, end_host_order;
1412   u32 vrf_id = ~0;
1413   int i, count;
1414   int is_add = 1;
1415   int rv = 0;
1416   clib_error_t *error = 0;
1417
1418   /* Get a line of input. */
1419   if (!unformat_user (input, unformat_line_input, line_input))
1420     return 0;
1421
1422   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1423     {
1424       if (unformat (line_input, "%U - %U",
1425                     unformat_ip4_address, &start_addr,
1426                     unformat_ip4_address, &end_addr))
1427         ;
1428       else if (unformat (line_input, "tenant-vrf %u", &vrf_id))
1429         ;
1430       else if (unformat (line_input, "%U", unformat_ip4_address, &start_addr))
1431         end_addr = start_addr;
1432       else if (unformat (line_input, "del"))
1433         is_add = 0;
1434       else
1435         {
1436           error = clib_error_return (0, "unknown input '%U'",
1437             format_unformat_error, line_input);
1438           goto done;
1439         }
1440      }
1441
1442   if (sm->static_mapping_only)
1443     {
1444       error = clib_error_return (0, "static mapping only mode");
1445       goto done;
1446     }
1447
1448   start_host_order = clib_host_to_net_u32 (start_addr.as_u32);
1449   end_host_order = clib_host_to_net_u32 (end_addr.as_u32);
1450
1451   if (end_host_order < start_host_order)
1452     {
1453       error = clib_error_return (0, "end address less than start address");
1454       goto done;
1455     }
1456
1457   count = (end_host_order - start_host_order) + 1;
1458
1459   if (count > 1024)
1460     clib_warning ("%U - %U, %d addresses...",
1461                   format_ip4_address, &start_addr,
1462                   format_ip4_address, &end_addr,
1463                   count);
1464
1465   this_addr = start_addr;
1466
1467   for (i = 0; i < count; i++)
1468     {
1469       if (is_add)
1470         snat_add_address (sm, &this_addr, vrf_id);
1471       else
1472         rv = snat_del_address (sm, this_addr, 0);
1473
1474       switch (rv)
1475         {
1476         case VNET_API_ERROR_NO_SUCH_ENTRY:
1477           error = clib_error_return (0, "S-NAT address not exist.");
1478           goto done;
1479         case VNET_API_ERROR_UNSPECIFIED:
1480           error = clib_error_return (0, "S-NAT address used in static mapping.");
1481           goto done;
1482         default:
1483           break;
1484         }
1485
1486       increment_v4_address (&this_addr);
1487     }
1488
1489 done:
1490   unformat_free (line_input);
1491
1492   return error;
1493 }
1494
1495 VLIB_CLI_COMMAND (add_address_command, static) = {
1496   .path = "nat44 add address",
1497   .short_help = "nat44 add address <ip4-range-start> [- <ip4-range-end>] "
1498                 "[tenant-vrf <vrf-id>] [del]",
1499   .function = add_address_command_fn,
1500 };
1501
1502 static clib_error_t *
1503 snat_feature_command_fn (vlib_main_t * vm,
1504                           unformat_input_t * input,
1505                           vlib_cli_command_t * cmd)
1506 {
1507   unformat_input_t _line_input, *line_input = &_line_input;
1508   vnet_main_t * vnm = vnet_get_main();
1509   clib_error_t * error = 0;
1510   u32 sw_if_index;
1511   u32 * inside_sw_if_indices = 0;
1512   u32 * outside_sw_if_indices = 0;
1513   u8 is_output_feature = 0;
1514   int is_del = 0;
1515   int i;
1516
1517   sw_if_index = ~0;
1518
1519   /* Get a line of input. */
1520   if (!unformat_user (input, unformat_line_input, line_input))
1521     return 0;
1522
1523   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1524     {
1525       if (unformat (line_input, "in %U", unformat_vnet_sw_interface,
1526                     vnm, &sw_if_index))
1527         vec_add1 (inside_sw_if_indices, sw_if_index);
1528       else if (unformat (line_input, "out %U", unformat_vnet_sw_interface,
1529                          vnm, &sw_if_index))
1530         vec_add1 (outside_sw_if_indices, sw_if_index);
1531       else if (unformat (line_input, "output-feature"))
1532         is_output_feature = 1;
1533       else if (unformat (line_input, "del"))
1534         is_del = 1;
1535       else
1536         {
1537           error = clib_error_return (0, "unknown input '%U'",
1538             format_unformat_error, line_input);
1539           goto done;
1540         }
1541     }
1542
1543   if (vec_len (inside_sw_if_indices))
1544     {
1545       for (i = 0; i < vec_len(inside_sw_if_indices); i++)
1546         {
1547           sw_if_index = inside_sw_if_indices[i];
1548           if (is_output_feature)
1549             {
1550               if (snat_interface_add_del_output_feature (sw_if_index, 1, is_del))
1551                 {
1552                   error = clib_error_return (0, "%s %U failed",
1553                                              is_del ? "del" : "add",
1554                                              format_vnet_sw_interface_name, vnm,
1555                                              vnet_get_sw_interface (vnm,
1556                                                                     sw_if_index));
1557                   goto done;
1558                 }
1559             }
1560           else
1561             {
1562               if (snat_interface_add_del (sw_if_index, 1, is_del))
1563                 {
1564                   error = clib_error_return (0, "%s %U failed",
1565                                              is_del ? "del" : "add",
1566                                              format_vnet_sw_interface_name, vnm,
1567                                              vnet_get_sw_interface (vnm,
1568                                                                     sw_if_index));
1569                   goto done;
1570                 }
1571             }
1572         }
1573     }
1574
1575   if (vec_len (outside_sw_if_indices))
1576     {
1577       for (i = 0; i < vec_len(outside_sw_if_indices); i++)
1578         {
1579           sw_if_index = outside_sw_if_indices[i];
1580           if (is_output_feature)
1581             {
1582               if (snat_interface_add_del_output_feature (sw_if_index, 0, is_del))
1583                 {
1584                   error = clib_error_return (0, "%s %U failed",
1585                                              is_del ? "del" : "add",
1586                                              format_vnet_sw_interface_name, vnm,
1587                                              vnet_get_sw_interface (vnm,
1588                                                                     sw_if_index));
1589                   goto done;
1590                 }
1591             }
1592           else
1593             {
1594               if (snat_interface_add_del (sw_if_index, 0, is_del))
1595                 {
1596                   error = clib_error_return (0, "%s %U failed",
1597                                              is_del ? "del" : "add",
1598                                              format_vnet_sw_interface_name, vnm,
1599                                              vnet_get_sw_interface (vnm,
1600                                                                     sw_if_index));
1601                   goto done;
1602                 }
1603             }
1604         }
1605     }
1606
1607 done:
1608   unformat_free (line_input);
1609   vec_free (inside_sw_if_indices);
1610   vec_free (outside_sw_if_indices);
1611
1612   return error;
1613 }
1614
1615 VLIB_CLI_COMMAND (set_interface_snat_command, static) = {
1616   .path = "set interface nat44",
1617   .function = snat_feature_command_fn,
1618   .short_help = "set interface nat44 in <intfc> out <intfc> [output-feature] "
1619                 "[del]",
1620 };
1621
1622 uword
1623 unformat_snat_protocol (unformat_input_t * input, va_list * args)
1624 {
1625   u32 *r = va_arg (*args, u32 *);
1626
1627   if (0);
1628 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
1629   foreach_snat_protocol
1630 #undef _
1631   else
1632     return 0;
1633   return 1;
1634 }
1635
1636 u8 *
1637 format_snat_protocol (u8 * s, va_list * args)
1638 {
1639   u32 i = va_arg (*args, u32);
1640   u8 *t = 0;
1641
1642   switch (i)
1643     {
1644 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
1645       foreach_snat_protocol
1646 #undef _
1647     default:
1648       s = format (s, "unknown");
1649       return s;
1650     }
1651   s = format (s, "%s", t);
1652   return s;
1653 }
1654
1655 static clib_error_t *
1656 add_static_mapping_command_fn (vlib_main_t * vm,
1657                                unformat_input_t * input,
1658                                vlib_cli_command_t * cmd)
1659 {
1660   unformat_input_t _line_input, *line_input = &_line_input;
1661   clib_error_t * error = 0;
1662   ip4_address_t l_addr, e_addr;
1663   u32 l_port = 0, e_port = 0, vrf_id = ~0;
1664   int is_add = 1;
1665   int addr_only = 1;
1666   u32 sw_if_index = ~0;
1667   vnet_main_t * vnm = vnet_get_main();
1668   int rv;
1669   snat_protocol_t proto;
1670   u8 proto_set = 0;
1671
1672   /* Get a line of input. */
1673   if (!unformat_user (input, unformat_line_input, line_input))
1674     return 0;
1675
1676   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1677     {
1678       if (unformat (line_input, "local %U %u", unformat_ip4_address, &l_addr,
1679                     &l_port))
1680         addr_only = 0;
1681       else if (unformat (line_input, "local %U", unformat_ip4_address, &l_addr))
1682         ;
1683       else if (unformat (line_input, "external %U %u", unformat_ip4_address,
1684                          &e_addr, &e_port))
1685         addr_only = 0;
1686       else if (unformat (line_input, "external %U", unformat_ip4_address,
1687                          &e_addr))
1688         ;
1689       else if (unformat (line_input, "external %U %u",
1690                          unformat_vnet_sw_interface, vnm, &sw_if_index,
1691                          &e_port))
1692         addr_only = 0;
1693
1694       else if (unformat (line_input, "external %U",
1695                          unformat_vnet_sw_interface, vnm, &sw_if_index))
1696         ;
1697       else if (unformat (line_input, "vrf %u", &vrf_id))
1698         ;
1699       else if (unformat (line_input, "%U", unformat_snat_protocol, &proto))
1700         proto_set = 1;
1701       else if (unformat (line_input, "del"))
1702         is_add = 0;
1703       else
1704         {
1705           error = clib_error_return (0, "unknown input: '%U'",
1706             format_unformat_error, line_input);
1707           goto done;
1708         }
1709     }
1710
1711   if (!addr_only && !proto_set)
1712     {
1713       error = clib_error_return (0, "missing protocol");
1714       goto done;
1715     }
1716
1717   rv = snat_add_static_mapping(l_addr, e_addr, (u16) l_port, (u16) e_port,
1718                                vrf_id, addr_only, sw_if_index, proto, is_add);
1719
1720   switch (rv)
1721     {
1722     case VNET_API_ERROR_INVALID_VALUE:
1723       error = clib_error_return (0, "External port already in use.");
1724       goto done;
1725     case VNET_API_ERROR_NO_SUCH_ENTRY:
1726       if (is_add)
1727         error = clib_error_return (0, "External addres must be allocated.");
1728       else
1729         error = clib_error_return (0, "Mapping not exist.");
1730       goto done;
1731     case VNET_API_ERROR_NO_SUCH_FIB:
1732       error = clib_error_return (0, "No such VRF id.");
1733       goto done;
1734     case VNET_API_ERROR_VALUE_EXIST:
1735       error = clib_error_return (0, "Mapping already exist.");
1736       goto done;
1737     default:
1738       break;
1739     }
1740
1741 done:
1742   unformat_free (line_input);
1743
1744   return error;
1745 }
1746
1747 /*?
1748  * @cliexpar
1749  * @cliexstart{snat add static mapping}
1750  * Static mapping allows hosts on the external network to initiate connection
1751  * to to the local network host.
1752  * To create static mapping between local host address 10.0.0.3 port 6303 and
1753  * external address 4.4.4.4 port 3606 for TCP protocol use:
1754  *  vpp# nat44 add static mapping tcp local 10.0.0.3 6303 external 4.4.4.4 3606
1755  * If not runnig "static mapping only" NAT plugin mode use before:
1756  *  vpp# nat44 add address 4.4.4.4
1757  * To create static mapping between local and external address use:
1758  *  vpp# nat44 add static mapping local 10.0.0.3 external 4.4.4.4
1759  * @cliexend
1760 ?*/
1761 VLIB_CLI_COMMAND (add_static_mapping_command, static) = {
1762   .path = "nat44 add static mapping",
1763   .function = add_static_mapping_command_fn,
1764   .short_help =
1765     "nat44 add static mapping tcp|udp|icmp local <addr> [<port>] external <addr> [<port>] [vrf <table-id>] [del]",
1766 };
1767
1768 static clib_error_t *
1769 add_lb_static_mapping_command_fn (vlib_main_t * vm,
1770                                   unformat_input_t * input,
1771                                   vlib_cli_command_t * cmd)
1772 {
1773   unformat_input_t _line_input, *line_input = &_line_input;
1774   clib_error_t * error = 0;
1775   ip4_address_t l_addr, e_addr;
1776   u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0;
1777   int is_add = 1;
1778   int rv;
1779   snat_protocol_t proto;
1780   u8 proto_set = 0;
1781   nat44_lb_addr_port_t *locals = 0, local;
1782
1783   /* Get a line of input. */
1784   if (!unformat_user (input, unformat_line_input, line_input))
1785     return 0;
1786
1787   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1788     {
1789       if (unformat (line_input, "local %U:%u probability %u",
1790                     unformat_ip4_address, &l_addr, &l_port, &probability))
1791         {
1792           memset (&local, 0, sizeof (local));
1793           local.addr = l_addr;
1794           local.port = (u16) l_port;
1795           local.probability = (u8) probability;
1796           vec_add1 (locals, local);
1797         }
1798       else if (unformat (line_input, "external %U:%u", unformat_ip4_address,
1799                          &e_addr, &e_port))
1800         ;
1801       else if (unformat (line_input, "vrf %u", &vrf_id))
1802         ;
1803       else if (unformat (line_input, "protocol %U", unformat_snat_protocol,
1804                          &proto))
1805         proto_set = 1;
1806       else if (unformat (line_input, "del"))
1807         is_add = 0;
1808       else
1809         {
1810           error = clib_error_return (0, "unknown input: '%U'",
1811             format_unformat_error, line_input);
1812           goto done;
1813         }
1814     }
1815
1816   if (vec_len (locals) < 2)
1817     {
1818       error = clib_error_return (0, "at least two local must be set");
1819       goto done;
1820     }
1821
1822   if (!proto_set)
1823     {
1824       error = clib_error_return (0, "missing protocol");
1825       goto done;
1826     }
1827
1828   rv = nat44_add_del_lb_static_mapping (e_addr, (u16) e_port, proto, vrf_id,
1829                                         locals, is_add);
1830
1831   switch (rv)
1832     {
1833     case VNET_API_ERROR_INVALID_VALUE:
1834       error = clib_error_return (0, "External port already in use.");
1835       goto done;
1836     case VNET_API_ERROR_NO_SUCH_ENTRY:
1837       if (is_add)
1838         error = clib_error_return (0, "External addres must be allocated.");
1839       else
1840         error = clib_error_return (0, "Mapping not exist.");
1841       goto done;
1842     case VNET_API_ERROR_VALUE_EXIST:
1843       error = clib_error_return (0, "Mapping already exist.");
1844       goto done;
1845     default:
1846       break;
1847     }
1848
1849 done:
1850   unformat_free (line_input);
1851   vec_free (locals);
1852
1853   return error;
1854 }
1855
1856 VLIB_CLI_COMMAND (add_lb_static_mapping_command, static) = {
1857   .path = "nat44 add load-balancing static mapping",
1858   .function = add_lb_static_mapping_command_fn,
1859   .short_help =
1860     "nat44 add load-balancing static mapping protocol tcp|udp external <addr>:<port> local <addr>:<port> probability <n> [vrf <table-id>] [del]",
1861 };
1862
1863 static clib_error_t *
1864 set_workers_command_fn (vlib_main_t * vm,
1865                         unformat_input_t * input,
1866                         vlib_cli_command_t * cmd)
1867 {
1868   unformat_input_t _line_input, *line_input = &_line_input;
1869   uword *bitmap = 0;
1870   int rv = 0;
1871   clib_error_t *error = 0;
1872
1873   /* Get a line of input. */
1874   if (!unformat_user (input, unformat_line_input, line_input))
1875     return 0;
1876
1877   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1878     {
1879       if (unformat (line_input, "%U", unformat_bitmap_list, &bitmap))
1880         ;
1881       else
1882         {
1883           error = clib_error_return (0, "unknown input '%U'",
1884             format_unformat_error, line_input);
1885           goto done;
1886         }
1887      }
1888
1889   if (bitmap == 0)
1890     {
1891       error = clib_error_return (0, "List of workers must be specified.");
1892       goto done;
1893     }
1894
1895   rv = snat_set_workers(bitmap);
1896
1897   clib_bitmap_free (bitmap);
1898
1899   switch (rv)
1900     {
1901     case VNET_API_ERROR_INVALID_WORKER:
1902       error = clib_error_return (0, "Invalid worker(s).");
1903       goto done;
1904     case VNET_API_ERROR_FEATURE_DISABLED:
1905       error = clib_error_return (0,
1906         "Supported only if 2 or more workes available.");
1907       goto done;
1908     default:
1909       break;
1910     }
1911
1912 done:
1913   unformat_free (line_input);
1914
1915   return error;
1916 }
1917
1918 /*?
1919  * @cliexpar
1920  * @cliexstart{set snat workers}
1921  * Set NAT workers if 2 or more workers available, use:
1922  *  vpp# set snat workers 0-2,5
1923  * @cliexend
1924 ?*/
1925 VLIB_CLI_COMMAND (set_workers_command, static) = {
1926   .path = "set nat workers",
1927   .function = set_workers_command_fn,
1928   .short_help =
1929     "set nat workers <workers-list>",
1930 };
1931
1932 static clib_error_t *
1933 snat_ipfix_logging_enable_disable_command_fn (vlib_main_t * vm,
1934                                               unformat_input_t * input,
1935                                               vlib_cli_command_t * cmd)
1936 {
1937   unformat_input_t _line_input, *line_input = &_line_input;
1938   u32 domain_id = 0;
1939   u32 src_port = 0;
1940   u8 enable = 1;
1941   int rv = 0;
1942   clib_error_t *error = 0;
1943
1944   /* Get a line of input. */
1945   if (!unformat_user (input, unformat_line_input, line_input))
1946     return 0;
1947
1948   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
1949     {
1950       if (unformat (line_input, "domain %d", &domain_id))
1951         ;
1952       else if (unformat (line_input, "src-port %d", &src_port))
1953         ;
1954       else if (unformat (line_input, "disable"))
1955         enable = 0;
1956       else
1957         {
1958           error = clib_error_return (0, "unknown input '%U'",
1959             format_unformat_error, line_input);
1960           goto done;
1961         }
1962      }
1963
1964   rv = snat_ipfix_logging_enable_disable (enable, domain_id, (u16) src_port);
1965
1966   if (rv)
1967     {
1968       error = clib_error_return (0, "ipfix logging enable failed");
1969       goto done;
1970     }
1971
1972 done:
1973   unformat_free (line_input);
1974
1975   return error;
1976 }
1977
1978 /*?
1979  * @cliexpar
1980  * @cliexstart{snat ipfix logging}
1981  * To enable NAT IPFIX logging use:
1982  *  vpp# nat ipfix logging
1983  * To set IPFIX exporter use:
1984  *  vpp# set ipfix exporter collector 10.10.10.3 src 10.10.10.1
1985  * @cliexend
1986 ?*/
1987 VLIB_CLI_COMMAND (snat_ipfix_logging_enable_disable_command, static) = {
1988   .path = "nat ipfix logging",
1989   .function = snat_ipfix_logging_enable_disable_command_fn,
1990   .short_help = "nat ipfix logging [domain <domain-id>] [src-port <port>] [disable]",
1991 };
1992
1993 static u32
1994 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
1995 {
1996   snat_main_t *sm = &snat_main;
1997   u32 next_worker_index = 0;
1998   u32 hash;
1999
2000   next_worker_index = sm->first_worker_index;
2001   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2002          (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >>24);
2003
2004   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2005     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2006   else
2007     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2008
2009   return next_worker_index;
2010 }
2011
2012 static u32
2013 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2014 {
2015   snat_main_t *sm = &snat_main;
2016   udp_header_t *udp;
2017   u16 port;
2018   snat_session_key_t m_key;
2019   clib_bihash_kv_8_8_t kv, value;
2020   snat_static_mapping_t *m;
2021   nat_ed_ses_key_t key;
2022   clib_bihash_kv_16_8_t s_kv, s_value;
2023   snat_main_per_thread_data_t *tsm;
2024   snat_session_t *s;
2025   int i;
2026   u32 proto;
2027
2028   /* first try static mappings without port */
2029   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2030     {
2031       m_key.addr = ip0->dst_address;
2032       m_key.port = 0;
2033       m_key.protocol = 0;
2034       m_key.fib_index = rx_fib_index0;
2035       kv.key = m_key.as_u64;
2036       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2037         {
2038           m = pool_elt_at_index (sm->static_mappings, value.value);
2039           return m->worker_index;
2040         }
2041     }
2042
2043   proto = ip_proto_to_snat_proto (ip0->protocol);
2044   udp = ip4_next_header (ip0);
2045   port = udp->dst_port;
2046
2047   /* unknown protocol */
2048   if (PREDICT_FALSE (proto == ~0))
2049     {
2050       key.l_addr = ip0->dst_address;
2051       key.r_addr = ip0->src_address;
2052       key.fib_index = rx_fib_index0;
2053       key.proto = ip0->protocol;
2054       key.rsvd = 0;
2055       key.l_port = 0;
2056       s_kv.key[0] = key.as_u64[0];
2057       s_kv.key[1] = key.as_u64[1];
2058
2059       if (!clib_bihash_search_16_8 (&sm->out2in_ed, &s_kv, &s_value))
2060         {
2061           for (i = 0; i < _vec_len (sm->per_thread_data); i++)
2062             {
2063               tsm = vec_elt_at_index (sm->per_thread_data, i);
2064               if (!pool_is_free_index(tsm->sessions, s_value.value))
2065                 {
2066                   s = pool_elt_at_index (tsm->sessions, s_value.value);
2067                   if (s->out2in.addr.as_u32 == ip0->dst_address.as_u32 &&
2068                       s->out2in.port == ip0->protocol &&
2069                       snat_is_unk_proto_session (s))
2070                     return i;
2071                 }
2072             }
2073          }
2074
2075       /* if no session use current thread */
2076       return vlib_get_thread_index ();
2077     }
2078
2079   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
2080     {
2081       icmp46_header_t * icmp = (icmp46_header_t *) udp;
2082       icmp_echo_header_t *echo = (icmp_echo_header_t *)(icmp + 1);
2083       if (!icmp_is_error_message (icmp))
2084         port = echo->identifier;
2085       else
2086         {
2087           ip4_header_t *inner_ip = (ip4_header_t *)(echo + 1);
2088           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2089           void *l4_header = ip4_next_header (inner_ip);
2090           switch (proto)
2091             {
2092             case SNAT_PROTOCOL_ICMP:
2093               icmp = (icmp46_header_t*)l4_header;
2094               echo = (icmp_echo_header_t *)(icmp + 1);
2095               port = echo->identifier;
2096               break;
2097             case SNAT_PROTOCOL_UDP:
2098             case SNAT_PROTOCOL_TCP:
2099               port = ((tcp_udp_header_t*)l4_header)->src_port;
2100               break;
2101             default:
2102               return vlib_get_thread_index ();
2103             }
2104         }
2105     }
2106
2107   /* try static mappings with port */
2108   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2109     {
2110       m_key.addr = ip0->dst_address;
2111       m_key.port = clib_net_to_host_u16 (port);
2112       m_key.protocol = proto;
2113       m_key.fib_index = rx_fib_index0;
2114       kv.key = m_key.as_u64;
2115       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2116         {
2117           m = pool_elt_at_index (sm->static_mappings, value.value);
2118           return m->worker_index;
2119         }
2120     }
2121
2122   /* worker by outside port */
2123   return (u32) ((clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread);
2124 }
2125
2126 static clib_error_t *
2127 snat_config (vlib_main_t * vm, unformat_input_t * input)
2128 {
2129   snat_main_t * sm = &snat_main;
2130   u32 translation_buckets = 1024;
2131   u32 translation_memory_size = 128<<20;
2132   u32 user_buckets = 128;
2133   u32 user_memory_size = 64<<20;
2134   u32 max_translations_per_user = 100;
2135   u32 outside_vrf_id = 0;
2136   u32 inside_vrf_id = 0;
2137   u32 static_mapping_buckets = 1024;
2138   u32 static_mapping_memory_size = 64<<20;
2139   u8 static_mapping_only = 0;
2140   u8 static_mapping_connection_tracking = 0;
2141   snat_main_per_thread_data_t *tsm;
2142
2143   sm->deterministic = 0;
2144
2145   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2146     {
2147       if (unformat (input, "translation hash buckets %d", &translation_buckets))
2148         ;
2149       else if (unformat (input, "translation hash memory %d",
2150                          &translation_memory_size));
2151       else if (unformat (input, "user hash buckets %d", &user_buckets))
2152         ;
2153       else if (unformat (input, "user hash memory %d",
2154                          &user_memory_size))
2155         ;
2156       else if (unformat (input, "max translations per user %d",
2157                          &max_translations_per_user))
2158         ;
2159       else if (unformat (input, "outside VRF id %d",
2160                          &outside_vrf_id))
2161         ;
2162       else if (unformat (input, "inside VRF id %d",
2163                          &inside_vrf_id))
2164         ;
2165       else if (unformat (input, "static mapping only"))
2166         {
2167           static_mapping_only = 1;
2168           if (unformat (input, "connection tracking"))
2169             static_mapping_connection_tracking = 1;
2170         }
2171       else if (unformat (input, "deterministic"))
2172         sm->deterministic = 1;
2173       else
2174         return clib_error_return (0, "unknown input '%U'",
2175                                   format_unformat_error, input);
2176     }
2177
2178   /* for show commands, etc. */
2179   sm->translation_buckets = translation_buckets;
2180   sm->translation_memory_size = translation_memory_size;
2181   /* do not exceed load factor 10 */
2182   sm->max_translations = 10 * translation_buckets;
2183   sm->user_buckets = user_buckets;
2184   sm->user_memory_size = user_memory_size;
2185   sm->max_translations_per_user = max_translations_per_user;
2186   sm->outside_vrf_id = outside_vrf_id;
2187   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2188                                                              outside_vrf_id,
2189                                                              FIB_SOURCE_PLUGIN_HI);
2190   sm->inside_vrf_id = inside_vrf_id;
2191   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2192                                                             inside_vrf_id,
2193                                                             FIB_SOURCE_PLUGIN_HI);
2194   sm->static_mapping_only = static_mapping_only;
2195   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
2196
2197   if (sm->deterministic)
2198     {
2199       sm->in2out_node_index = snat_det_in2out_node.index;
2200       sm->in2out_output_node_index = ~0;
2201       sm->out2in_node_index = snat_det_out2in_node.index;
2202       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
2203       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
2204     }
2205   else
2206     {
2207       sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2208       sm->worker_out2in_cb = snat_get_worker_out2in_cb;
2209       sm->in2out_node_index = snat_in2out_node.index;
2210       sm->in2out_output_node_index = snat_in2out_output_node.index;
2211       sm->out2in_node_index = snat_out2in_node.index;
2212       if (!static_mapping_only ||
2213           (static_mapping_only && static_mapping_connection_tracking))
2214         {
2215           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
2216           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
2217
2218           vec_foreach (tsm, sm->per_thread_data)
2219             {
2220               clib_bihash_init_8_8 (&tsm->in2out, "in2out", translation_buckets,
2221                                     translation_memory_size);
2222
2223               clib_bihash_init_8_8 (&tsm->out2in, "out2in", translation_buckets,
2224                                     translation_memory_size);
2225
2226               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
2227                                     user_memory_size);
2228             }
2229
2230           clib_bihash_init_16_8 (&sm->in2out_ed, "in2out-ed",
2231                                  translation_buckets, translation_memory_size);
2232
2233           clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
2234                                  translation_buckets, translation_memory_size);
2235         }
2236       else
2237         {
2238           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
2239           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
2240         }
2241       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
2242                             "static_mapping_by_local", static_mapping_buckets,
2243                             static_mapping_memory_size);
2244
2245       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
2246                             "static_mapping_by_external", static_mapping_buckets,
2247                             static_mapping_memory_size);
2248     }
2249
2250   return 0;
2251 }
2252
2253 VLIB_CONFIG_FUNCTION (snat_config, "nat");
2254
2255 u8 * format_snat_session_state (u8 * s, va_list * args)
2256 {
2257   u32 i = va_arg (*args, u32);
2258   u8 *t = 0;
2259
2260   switch (i)
2261     {
2262 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
2263     foreach_snat_session_state
2264 #undef _
2265     default:
2266       t = format (t, "unknown");
2267     }
2268   s = format (s, "%s", t);
2269   return s;
2270 }
2271
2272 u8 * format_snat_key (u8 * s, va_list * args)
2273 {
2274   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
2275
2276   s = format (s, "%U proto %U port %d fib %d",
2277               format_ip4_address, &key->addr,
2278               format_snat_protocol, key->protocol,
2279               clib_net_to_host_u16 (key->port), key->fib_index);
2280   return s;
2281 }
2282
2283 u8 * format_snat_session (u8 * s, va_list * args)
2284 {
2285   snat_main_t * sm __attribute__((unused)) = va_arg (*args, snat_main_t *);
2286   snat_session_t * sess = va_arg (*args, snat_session_t *);
2287
2288   if (snat_is_unk_proto_session (sess))
2289     {
2290       s = format (s, "  i2o %U proto %u fib %u\n",
2291                   format_ip4_address, &sess->in2out.addr, sess->in2out.port,
2292                   sess->in2out.fib_index);
2293       s = format (s, "    o2i %U proto %u fib %u\n",
2294                   format_ip4_address, &sess->out2in.addr, sess->out2in.port,
2295                   sess->out2in.fib_index);
2296     }
2297   else
2298     {
2299       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
2300       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
2301     }
2302   if (sess->ext_host_addr.as_u32)
2303       s = format (s, "       external host %U\n",
2304                   format_ip4_address, &sess->ext_host_addr);
2305   s = format (s, "       last heard %.2f\n", sess->last_heard);
2306   s = format (s, "       total pkts %d, total bytes %lld\n",
2307               sess->total_pkts, sess->total_bytes);
2308   if (snat_is_session_static (sess))
2309     s = format (s, "       static translation\n");
2310   else
2311     s = format (s, "       dynamic translation\n");
2312   if (sess->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
2313     s = format (s, "       load-balancing\n");
2314
2315   return s;
2316 }
2317
2318 u8 * format_snat_user (u8 * s, va_list * args)
2319 {
2320   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
2321   snat_user_t * u = va_arg (*args, snat_user_t *);
2322   int verbose = va_arg (*args, int);
2323   dlist_elt_t * head, * elt;
2324   u32 elt_index, head_index;
2325   u32 session_index;
2326   snat_session_t * sess;
2327
2328   s = format (s, "%U: %d dynamic translations, %d static translations\n",
2329               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
2330
2331   if (verbose == 0)
2332     return s;
2333
2334   if (u->nsessions || u->nstaticsessions)
2335     {
2336       head_index = u->sessions_per_user_list_head_index;
2337       head = pool_elt_at_index (sm->list_pool, head_index);
2338
2339       elt_index = head->next;
2340       elt = pool_elt_at_index (sm->list_pool, elt_index);
2341       session_index = elt->value;
2342
2343       while (session_index != ~0)
2344         {
2345           sess = pool_elt_at_index (sm->sessions, session_index);
2346
2347           s = format (s, "  %U\n", format_snat_session, sm, sess);
2348
2349           elt_index = elt->next;
2350           elt = pool_elt_at_index (sm->list_pool, elt_index);
2351           session_index = elt->value;
2352         }
2353     }
2354
2355   return s;
2356 }
2357
2358 u8 * format_snat_static_mapping (u8 * s, va_list * args)
2359 {
2360   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
2361   nat44_lb_addr_port_t *local;
2362
2363   if (m->addr_only)
2364       s = format (s, "local %U external %U vrf %d",
2365                   format_ip4_address, &m->local_addr,
2366                   format_ip4_address, &m->external_addr,
2367                   m->vrf_id);
2368   else
2369    {
2370       if (vec_len (m->locals))
2371         {
2372           s = format (s, "%U vrf %d external %U:%d",
2373                       format_snat_protocol, m->proto,
2374                       m->vrf_id,
2375                       format_ip4_address, &m->external_addr, m->external_port);
2376           vec_foreach (local, m->locals)
2377             s = format (s, "\n  local %U:%d probability %d\%",
2378                         format_ip4_address, &local->addr, local->port,
2379                         local->probability);
2380         }
2381       else
2382         s = format (s, "%U local %U:%d external %U:%d vrf %d",
2383                     format_snat_protocol, m->proto,
2384                     format_ip4_address, &m->local_addr, m->local_port,
2385                     format_ip4_address, &m->external_addr, m->external_port,
2386                     m->vrf_id);
2387    }
2388   return s;
2389 }
2390
2391 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
2392 {
2393   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
2394   vnet_main_t *vnm = vnet_get_main();
2395
2396   if (m->addr_only)
2397       s = format (s, "local %U external %U vrf %d",
2398                   format_ip4_address, &m->l_addr,
2399                   format_vnet_sw_interface_name, vnm,
2400                   vnet_get_sw_interface (vnm, m->sw_if_index),
2401                   m->vrf_id);
2402   else
2403       s = format (s, "%U local %U:%d external %U:%d vrf %d",
2404                   format_snat_protocol, m->proto,
2405                   format_ip4_address, &m->l_addr, m->l_port,
2406                   format_vnet_sw_interface_name, vnm,
2407                   vnet_get_sw_interface (vnm, m->sw_if_index), m->e_port,
2408                   m->vrf_id);
2409
2410   return s;
2411 }
2412
2413 u8 * format_det_map_ses (u8 * s, va_list * args)
2414 {
2415   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
2416   ip4_address_t in_addr, out_addr;
2417   u32 in_offset, out_offset;
2418   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
2419   u32 * i = va_arg (*args, u32 *);
2420
2421   u32 user_index = *i / SNAT_DET_SES_PER_USER;
2422   in_addr.as_u32 = clib_host_to_net_u32 (
2423     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
2424   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
2425     clib_net_to_host_u32(det_map->in_addr.as_u32);
2426   out_offset = in_offset / det_map->sharing_ratio;
2427   out_addr.as_u32 = clib_host_to_net_u32(
2428     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
2429   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
2430               format_ip4_address, &in_addr,
2431               clib_net_to_host_u16 (ses->in_port),
2432               format_ip4_address, &out_addr,
2433               clib_net_to_host_u16 (ses->out.out_port),
2434               format_ip4_address, &ses->out.ext_host_addr,
2435               clib_net_to_host_u16 (ses->out.ext_host_port),
2436               format_snat_session_state, ses->state,
2437               ses->expire);
2438
2439   return s;
2440 }
2441
2442 static clib_error_t *
2443 show_snat_command_fn (vlib_main_t * vm,
2444                  unformat_input_t * input,
2445                  vlib_cli_command_t * cmd)
2446 {
2447   int verbose = 0;
2448   snat_main_t * sm = &snat_main;
2449   snat_user_t * u;
2450   snat_static_mapping_t *m;
2451   snat_interface_t *i;
2452   snat_address_t * ap;
2453   vnet_main_t *vnm = vnet_get_main();
2454   snat_main_per_thread_data_t *tsm;
2455   u32 users_num = 0, sessions_num = 0, *worker, *sw_if_index;
2456   uword j = 0;
2457   snat_static_map_resolve_t *rp;
2458   snat_det_map_t * dm;
2459   snat_det_session_t * ses;
2460
2461   if (unformat (input, "detail"))
2462     verbose = 1;
2463   else if (unformat (input, "verbose"))
2464     verbose = 2;
2465
2466   if (sm->static_mapping_only)
2467     {
2468       if (sm->static_mapping_connection_tracking)
2469         vlib_cli_output (vm, "NAT plugin mode: static mapping only connection "
2470                          "tracking");
2471       else
2472         vlib_cli_output (vm, "NAT plugin mode: static mapping only");
2473     }
2474   else if (sm->deterministic)
2475     {
2476       vlib_cli_output (vm, "NAT plugin mode: deterministic mapping");
2477     }
2478   else
2479     {
2480       vlib_cli_output (vm, "NAT plugin mode: dynamic translations enabled");
2481     }
2482
2483   if (verbose > 0)
2484     {
2485       pool_foreach (i, sm->interfaces,
2486       ({
2487         vlib_cli_output (vm, "%U %s", format_vnet_sw_interface_name, vnm,
2488                          vnet_get_sw_interface (vnm, i->sw_if_index),
2489                          i->is_inside ? "in" : "out");
2490       }));
2491
2492       pool_foreach (i, sm->output_feature_interfaces,
2493       ({
2494         vlib_cli_output (vm, "%U output-feature %s",
2495                          format_vnet_sw_interface_name, vnm,
2496                          vnet_get_sw_interface (vnm, i->sw_if_index),
2497                          i->is_inside ? "in" : "out");
2498       }));
2499
2500       if (vec_len (sm->auto_add_sw_if_indices))
2501         {
2502           vlib_cli_output (vm, "NAT44 pool addresses interfaces:");
2503           vec_foreach (sw_if_index, sm->auto_add_sw_if_indices)
2504             {
2505               vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
2506                                vnet_get_sw_interface (vnm, *sw_if_index));
2507             }
2508         }
2509
2510       vec_foreach (ap, sm->addresses)
2511         {
2512           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
2513           if (ap->fib_index != ~0)
2514               vlib_cli_output (vm, "  tenant VRF: %u",
2515                                ip4_fib_get(ap->fib_index)->table_id);
2516           else
2517             vlib_cli_output (vm, "  tenant VRF independent");
2518 #define _(N, i, n, s) \
2519           vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
2520           foreach_snat_protocol
2521 #undef _
2522         }
2523     }
2524
2525   if (sm->num_workers > 1)
2526     {
2527       vlib_cli_output (vm, "%d workers", vec_len (sm->workers));
2528       if (verbose > 0)
2529         {
2530           vec_foreach (worker, sm->workers)
2531             {
2532               vlib_worker_thread_t *w =
2533                 vlib_worker_threads + *worker + sm->first_worker_index;
2534               vlib_cli_output (vm, "  %s", w->name);
2535             }
2536         }
2537     }
2538
2539   if (sm->deterministic)
2540     {
2541       vlib_cli_output (vm, "udp timeout: %dsec", sm->udp_timeout);
2542       vlib_cli_output (vm, "tcp-established timeout: %dsec",
2543                        sm->tcp_established_timeout);
2544       vlib_cli_output (vm, "tcp-transitory timeout: %dsec",
2545                        sm->tcp_transitory_timeout);
2546       vlib_cli_output (vm, "icmp timeout: %dsec", sm->icmp_timeout);
2547       vlib_cli_output (vm, "%d deterministic mappings",
2548                        pool_elts (sm->det_maps));
2549       if (verbose > 0)
2550         {
2551           pool_foreach (dm, sm->det_maps,
2552           ({
2553             vlib_cli_output (vm, "in %U/%d out %U/%d\n",
2554                              format_ip4_address, &dm->in_addr, dm->in_plen,
2555                              format_ip4_address, &dm->out_addr, dm->out_plen);
2556             vlib_cli_output (vm, " outside address sharing ratio: %d\n",
2557                              dm->sharing_ratio);
2558             vlib_cli_output (vm, " number of ports per inside host: %d\n",
2559                              dm->ports_per_host);
2560             vlib_cli_output (vm, " sessions number: %d\n", dm->ses_num);
2561             if (verbose > 1)
2562               {
2563                 vec_foreach_index (j, dm->sessions)
2564                   {
2565                     ses = vec_elt_at_index (dm->sessions, j);
2566                     if (ses->in_port)
2567                       vlib_cli_output (vm, "  %U", format_det_map_ses, dm, ses,
2568                                        &j);
2569                   }
2570               }
2571           }));
2572         }
2573     }
2574   else
2575     {
2576       if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
2577         {
2578           vlib_cli_output (vm, "%d static mappings",
2579                            pool_elts (sm->static_mappings));
2580
2581           if (verbose > 0)
2582             {
2583               pool_foreach (m, sm->static_mappings,
2584               ({
2585                 vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2586               }));
2587             }
2588         }
2589       else
2590         {
2591           vec_foreach (tsm, sm->per_thread_data)
2592             {
2593               users_num += pool_elts (tsm->users);
2594               sessions_num += pool_elts (tsm->sessions);
2595             }
2596
2597           vlib_cli_output (vm, "%d users, %d outside addresses, %d active sessions,"
2598                            " %d static mappings",
2599                            users_num,
2600                            vec_len (sm->addresses),
2601                            sessions_num,
2602                            pool_elts (sm->static_mappings));
2603
2604           if (verbose > 0)
2605             {
2606               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->in2out_ed,
2607                                verbose - 1);
2608               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->out2in_ed,
2609                                verbose - 1);
2610               vec_foreach_index (j, sm->per_thread_data)
2611                 {
2612                   tsm = vec_elt_at_index (sm->per_thread_data, j);
2613
2614                   if (pool_elts (tsm->users) == 0)
2615                     continue;
2616
2617                   vlib_worker_thread_t *w = vlib_worker_threads + j;
2618                   vlib_cli_output (vm, "Thread %d (%s at lcore %u):", j, w->name,
2619                                    w->lcore_id);
2620                   vlib_cli_output (vm, "  %U", format_bihash_8_8, &tsm->in2out,
2621                                    verbose - 1);
2622                   vlib_cli_output (vm, "  %U", format_bihash_8_8, &tsm->out2in,
2623                                    verbose - 1);
2624                   vlib_cli_output (vm, "  %d list pool elements",
2625                                    pool_elts (tsm->list_pool));
2626
2627                   pool_foreach (u, tsm->users,
2628                   ({
2629                     vlib_cli_output (vm, "  %U", format_snat_user, tsm, u,
2630                                      verbose - 1);
2631                   }));
2632                 }
2633
2634               if (pool_elts (sm->static_mappings))
2635                 {
2636                   vlib_cli_output (vm, "static mappings:");
2637                   pool_foreach (m, sm->static_mappings,
2638                   ({
2639                     vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
2640                   }));
2641                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2642                     {
2643                       rp = sm->to_resolve + j;
2644                       vlib_cli_output (vm, "%U",
2645                                        format_snat_static_map_to_resolve, rp);
2646                     }
2647                 }
2648             }
2649         }
2650     }
2651   return 0;
2652 }
2653
2654 VLIB_CLI_COMMAND (show_snat_command, static) = {
2655     .path = "show nat44",
2656     .short_help = "show nat44",
2657     .function = show_snat_command_fn,
2658 };
2659
2660
2661 static void
2662 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2663                                        uword opaque,
2664                                        u32 sw_if_index,
2665                                        ip4_address_t * address,
2666                                        u32 address_length,
2667                                        u32 if_address_index,
2668                                        u32 is_delete)
2669 {
2670   snat_main_t *sm = &snat_main;
2671   snat_static_map_resolve_t *rp;
2672   u32 *indices_to_delete = 0;
2673   int i, j;
2674   int rv;
2675
2676   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2677     {
2678       if (sw_if_index == sm->auto_add_sw_if_indices[i])
2679         {
2680           if (!is_delete)
2681             {
2682               /* Don't trip over lease renewal, static config */
2683               for (j = 0; j < vec_len(sm->addresses); j++)
2684                 if (sm->addresses[j].addr.as_u32 == address->as_u32)
2685                   return;
2686
2687               snat_add_address (sm, address, ~0);
2688               /* Scan static map resolution vector */
2689               for (j = 0; j < vec_len (sm->to_resolve); j++)
2690                 {
2691                   rp = sm->to_resolve + j;
2692                   /* On this interface? */
2693                   if (rp->sw_if_index == sw_if_index)
2694                     {
2695                       /* Add the static mapping */
2696                       rv = snat_add_static_mapping (rp->l_addr,
2697                                                     address[0],
2698                                                     rp->l_port,
2699                                                     rp->e_port,
2700                                                     rp->vrf_id,
2701                                                     rp->addr_only,
2702                                                     ~0 /* sw_if_index */,
2703                                                     rp->proto,
2704                                                     rp->is_add);
2705                       if (rv)
2706                         clib_warning ("snat_add_static_mapping returned %d",
2707                                       rv);
2708                       vec_add1 (indices_to_delete, j);
2709                     }
2710                 }
2711               /* If we resolved any of the outstanding static mappings */
2712               if (vec_len(indices_to_delete))
2713                 {
2714                   /* Delete them */
2715                   for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2716                     vec_delete(sm->to_resolve, 1, j);
2717                   vec_free(indices_to_delete);
2718                 }
2719               return;
2720             }
2721           else
2722             {
2723               (void) snat_del_address(sm, address[0], 1);
2724               return;
2725             }
2726         }
2727     }
2728 }
2729
2730
2731 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del)
2732 {
2733   ip4_main_t * ip4_main = sm->ip4_main;
2734   ip4_address_t * first_int_addr;
2735   snat_static_map_resolve_t *rp;
2736   u32 *indices_to_delete = 0;
2737   int i, j;
2738
2739   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
2740                                                 0 /* just want the address*/);
2741
2742   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
2743     {
2744       if (sm->auto_add_sw_if_indices[i] == sw_if_index)
2745         {
2746           if (is_del)
2747             {
2748               /* if have address remove it */
2749               if (first_int_addr)
2750                   (void) snat_del_address (sm, first_int_addr[0], 1);
2751               else
2752                 {
2753                   for (j = 0; j < vec_len (sm->to_resolve); j++)
2754                     {
2755                       rp = sm->to_resolve + j;
2756                       if (rp->sw_if_index == sw_if_index)
2757                         vec_add1 (indices_to_delete, j);
2758                     }
2759                   if (vec_len(indices_to_delete))
2760                     {
2761                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
2762                         vec_del1(sm->to_resolve, j);
2763                       vec_free(indices_to_delete);
2764                     }
2765                 }
2766               vec_del1(sm->auto_add_sw_if_indices, i);
2767             }
2768           else
2769             return VNET_API_ERROR_VALUE_EXIST;
2770
2771           return 0;
2772         }
2773     }
2774
2775   if (is_del)
2776     return VNET_API_ERROR_NO_SUCH_ENTRY;
2777
2778   /* add to the auto-address list */
2779   vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
2780
2781   /* If the address is already bound - or static - add it now */
2782   if (first_int_addr)
2783       snat_add_address (sm, first_int_addr, ~0);
2784
2785   return 0;
2786 }
2787
2788 static clib_error_t *
2789 snat_add_interface_address_command_fn (vlib_main_t * vm,
2790                                        unformat_input_t * input,
2791                                        vlib_cli_command_t * cmd)
2792 {
2793   snat_main_t *sm = &snat_main;
2794   unformat_input_t _line_input, *line_input = &_line_input;
2795   u32 sw_if_index;
2796   int rv;
2797   int is_del = 0;
2798   clib_error_t *error = 0;
2799
2800   /* Get a line of input. */
2801   if (!unformat_user (input, unformat_line_input, line_input))
2802     return 0;
2803
2804   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2805     {
2806       if (unformat (line_input, "%U", unformat_vnet_sw_interface,
2807                     sm->vnet_main, &sw_if_index))
2808         ;
2809       else if (unformat (line_input, "del"))
2810         is_del = 1;
2811       else
2812         {
2813           error = clib_error_return (0, "unknown input '%U'",
2814                                      format_unformat_error, line_input);
2815           goto done;
2816         }
2817     }
2818
2819   rv = snat_add_interface_address (sm, sw_if_index, is_del);
2820
2821   switch (rv)
2822     {
2823     case 0:
2824       break;
2825
2826     default:
2827       error = clib_error_return (0, "snat_add_interface_address returned %d",
2828                                  rv);
2829       goto done;
2830     }
2831
2832 done:
2833   unformat_free (line_input);
2834
2835   return error;
2836 }
2837
2838 VLIB_CLI_COMMAND (snat_add_interface_address_command, static) = {
2839     .path = "nat44 add interface address",
2840     .short_help = "nat44 add interface address <interface> [del]",
2841     .function = snat_add_interface_address_command_fn,
2842 };
2843
2844 static clib_error_t *
2845 snat_det_map_command_fn (vlib_main_t * vm,
2846                          unformat_input_t * input,
2847                          vlib_cli_command_t * cmd)
2848 {
2849   snat_main_t *sm = &snat_main;
2850   unformat_input_t _line_input, *line_input = &_line_input;
2851   ip4_address_t in_addr, out_addr;
2852   u32 in_plen, out_plen;
2853   int is_add = 1, rv;
2854   clib_error_t *error = 0;
2855
2856   /* Get a line of input. */
2857   if (!unformat_user (input, unformat_line_input, line_input))
2858     return 0;
2859
2860   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2861     {
2862       if (unformat (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
2863         ;
2864       else if (unformat (line_input, "out %U/%u", unformat_ip4_address, &out_addr, &out_plen))
2865         ;
2866       else if (unformat (line_input, "del"))
2867         is_add = 0;
2868       else
2869         {
2870           error = clib_error_return (0, "unknown input '%U'",
2871                                      format_unformat_error, line_input);
2872           goto done;
2873         }
2874     }
2875
2876   unformat_free (line_input);
2877
2878   rv = snat_det_add_map(sm, &in_addr, (u8) in_plen, &out_addr, (u8)out_plen,
2879                         is_add);
2880
2881   if (rv)
2882     {
2883       error = clib_error_return (0, "snat_det_add_map return %d", rv);
2884       goto done;
2885     }
2886
2887 done:
2888   unformat_free (line_input);
2889
2890   return error;
2891 }
2892
2893 /*?
2894  * @cliexpar
2895  * @cliexstart{snat deterministic add}
2896  * Create bijective mapping of inside address to outside address and port range
2897  * pairs, with the purpose of enabling deterministic NAT to reduce logging in
2898  * CGN deployments.
2899  * To create deterministic mapping between inside network 10.0.0.0/18 and
2900  * outside network 1.1.1.0/30 use:
2901  * # vpp# nat44 deterministic add in 10.0.0.0/18 out 1.1.1.0/30
2902  * @cliexend
2903 ?*/
2904 VLIB_CLI_COMMAND (snat_det_map_command, static) = {
2905     .path = "nat44 deterministic add",
2906     .short_help = "nat44 deterministic add in <addr>/<plen> out <addr>/<plen> [del]",
2907     .function = snat_det_map_command_fn,
2908 };
2909
2910 static clib_error_t *
2911 snat_det_forward_command_fn (vlib_main_t * vm,
2912                              unformat_input_t * input,
2913                              vlib_cli_command_t * cmd)
2914 {
2915   snat_main_t *sm = &snat_main;
2916   unformat_input_t _line_input, *line_input = &_line_input;
2917   ip4_address_t in_addr, out_addr;
2918   u16 lo_port;
2919   snat_det_map_t * dm;
2920   clib_error_t *error = 0;
2921
2922   /* Get a line of input. */
2923   if (!unformat_user (input, unformat_line_input, line_input))
2924     return 0;
2925
2926   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2927     {
2928       if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
2929         ;
2930       else
2931         {
2932           error = clib_error_return (0, "unknown input '%U'",
2933                                      format_unformat_error, line_input);
2934           goto done;
2935         }
2936     }
2937
2938   unformat_free (line_input);
2939
2940   dm = snat_det_map_by_user(sm, &in_addr);
2941   if (!dm)
2942     vlib_cli_output (vm, "no match");
2943   else
2944     {
2945       snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
2946       vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
2947                        lo_port, lo_port + dm->ports_per_host - 1);
2948     }
2949
2950 done:
2951   unformat_free (line_input);
2952
2953   return error;
2954 }
2955
2956 /*?
2957  * @cliexpar
2958  * @cliexstart{snat deterministic forward}
2959  * Return outside address and port range from inside address for deterministic
2960  * NAT.
2961  * To obtain outside address and port of inside host use:
2962  *  vpp# nat44 deterministic forward 10.0.0.2
2963  *  1.1.1.0:<1054-1068>
2964  * @cliexend
2965 ?*/
2966 VLIB_CLI_COMMAND (snat_det_forward_command, static) = {
2967     .path = "nat44 deterministic forward",
2968     .short_help = "nat44 deterministic forward <addr>",
2969     .function = snat_det_forward_command_fn,
2970 };
2971
2972 static clib_error_t *
2973 snat_det_reverse_command_fn (vlib_main_t * vm,
2974                              unformat_input_t * input,
2975                              vlib_cli_command_t * cmd)
2976 {
2977   snat_main_t *sm = &snat_main;
2978   unformat_input_t _line_input, *line_input = &_line_input;
2979   ip4_address_t in_addr, out_addr;
2980   u32 out_port;
2981   snat_det_map_t * dm;
2982   clib_error_t *error = 0;
2983
2984   /* Get a line of input. */
2985   if (!unformat_user (input, unformat_line_input, line_input))
2986     return 0;
2987
2988   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2989     {
2990       if (unformat (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
2991         ;
2992       else
2993         {
2994           error =  clib_error_return (0, "unknown input '%U'",
2995                                       format_unformat_error, line_input);
2996         }
2997     }
2998
2999   unformat_free (line_input);
3000
3001   if (out_port < 1024 || out_port > 65535)
3002     {
3003       error = clib_error_return (0, "wrong port, must be <1024-65535>");
3004       goto done;
3005     }
3006
3007   dm = snat_det_map_by_out(sm, &out_addr);
3008   if (!dm)
3009     vlib_cli_output (vm, "no match");
3010   else
3011     {
3012       snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr);
3013       vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
3014     }
3015
3016 done:
3017   unformat_free (line_input);
3018
3019   return error;
3020 }
3021
3022 /*?
3023  * @cliexpar
3024  * @cliexstart{snat deterministic reverse}
3025  * Return inside address from outside address and port for deterministic NAT.
3026  * To obtain inside host address from outside address and port use:
3027  *  #vpp nat44 deterministic reverse 1.1.1.1:1276
3028  *  10.0.16.16
3029  * @cliexend
3030 ?*/
3031 VLIB_CLI_COMMAND (snat_det_reverse_command, static) = {
3032     .path = "nat44 deterministic reverse",
3033     .short_help = "nat44 deterministic reverse <addr>:<port>",
3034     .function = snat_det_reverse_command_fn,
3035 };
3036
3037 static clib_error_t *
3038 set_timeout_command_fn (vlib_main_t * vm,
3039                         unformat_input_t * input,
3040                         vlib_cli_command_t * cmd)
3041 {
3042   snat_main_t *sm = &snat_main;
3043   unformat_input_t _line_input, *line_input = &_line_input;
3044   clib_error_t *error = 0;
3045
3046   /* Get a line of input. */
3047   if (!unformat_user (input, unformat_line_input, line_input))
3048     return 0;
3049
3050   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3051     {
3052       if (unformat (line_input, "udp %u", &sm->udp_timeout))
3053         ;
3054       else if (unformat (line_input, "tcp-established %u",
3055                &sm->tcp_established_timeout))
3056         ;
3057       else if (unformat (line_input, "tcp-transitory %u",
3058                &sm->tcp_transitory_timeout))
3059         ;
3060       else if (unformat (line_input, "icmp %u", &sm->icmp_timeout))
3061         ;
3062       else if (unformat (line_input, "reset"))
3063         {
3064           sm->udp_timeout = SNAT_UDP_TIMEOUT;
3065           sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
3066           sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
3067           sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
3068         }
3069       else
3070         {
3071           error = clib_error_return (0, "unknown input '%U'",
3072                                      format_unformat_error, line_input);
3073           goto done;
3074         }
3075     }
3076
3077   unformat_free (line_input);
3078
3079 done:
3080   unformat_free (line_input);
3081
3082   return error;
3083 }
3084
3085 /*?
3086  * @cliexpar
3087  * @cliexstart{set snat deterministic timeout}
3088  * Set values of timeouts for deterministic NAT (in seconds), use:
3089  *  vpp# set nat44 deterministic timeout udp 120 tcp-established 7500
3090  *  tcp-transitory 250 icmp 90
3091  * To reset default values use:
3092  *  vpp# set nat44 deterministic timeout reset
3093  * @cliexend
3094 ?*/
3095 VLIB_CLI_COMMAND (set_timeout_command, static) = {
3096   .path = "set nat44 deterministic timeout",
3097   .function = set_timeout_command_fn,
3098   .short_help =
3099     "set nat44 deterministic timeout [udp <sec> | tcp-established <sec> "
3100     "tcp-transitory <sec> | icmp <sec> | reset]",
3101 };
3102
3103 static clib_error_t *
3104 snat_det_close_session_out_fn (vlib_main_t *vm,
3105                                unformat_input_t * input,
3106                                vlib_cli_command_t * cmd)
3107 {
3108   snat_main_t *sm = &snat_main;
3109   unformat_input_t _line_input, *line_input = &_line_input;
3110   ip4_address_t out_addr, ext_addr, in_addr;
3111   u32 out_port, ext_port;
3112   snat_det_map_t * dm;
3113   snat_det_session_t * ses;
3114   snat_det_out_key_t key;
3115   clib_error_t *error = 0;
3116
3117   /* Get a line of input. */
3118   if (!unformat_user (input, unformat_line_input, line_input))
3119     return 0;
3120
3121   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3122     {
3123       if (unformat (line_input, "%U:%d %U:%d",
3124                     unformat_ip4_address, &out_addr, &out_port,
3125                     unformat_ip4_address, &ext_addr, &ext_port))
3126         ;
3127       else
3128         {
3129           error = clib_error_return (0, "unknown input '%U'",
3130                                      format_unformat_error, line_input);
3131           goto done;
3132         }
3133     }
3134
3135   unformat_free (line_input);
3136
3137   dm = snat_det_map_by_out(sm, &out_addr);
3138   if (!dm)
3139     vlib_cli_output (vm, "no match");
3140   else
3141     {
3142       snat_det_reverse(dm, &ext_addr, (u16)out_port, &in_addr);
3143       key.ext_host_addr = out_addr;
3144       key.ext_host_port = ntohs((u16)ext_port);
3145       key.out_port = ntohs((u16)out_port);
3146       ses = snat_det_get_ses_by_out(dm, &out_addr, key.as_u64);
3147       if (!ses)
3148         vlib_cli_output (vm, "no match");
3149       else
3150        snat_det_ses_close(dm, ses);
3151     }
3152
3153 done:
3154   unformat_free (line_input);
3155
3156   return error;
3157 }
3158
3159 /*?
3160  * @cliexpar
3161  * @cliexstart{snat deterministic close session out}
3162  * Close session using outside ip address and port
3163  * and external ip address and port, use:
3164  *  vpp# nat44 deterministic close session out 1.1.1.1:1276 2.2.2.2:2387
3165  * @cliexend
3166 ?*/
3167 VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = {
3168   .path = "nat44 deterministic close session out",
3169   .short_help = "nat44 deterministic close session out "
3170                 "<out_addr>:<out_port> <ext_addr>:<ext_port>",
3171   .function = snat_det_close_session_out_fn,
3172 };
3173
3174 static clib_error_t *
3175 snat_det_close_session_in_fn (vlib_main_t *vm,
3176                               unformat_input_t * input,
3177                               vlib_cli_command_t * cmd)
3178 {
3179   snat_main_t *sm = &snat_main;
3180   unformat_input_t _line_input, *line_input = &_line_input;
3181   ip4_address_t in_addr, ext_addr;
3182   u32 in_port, ext_port;
3183   snat_det_map_t * dm;
3184   snat_det_session_t * ses;
3185   snat_det_out_key_t key;
3186   clib_error_t *error = 0;
3187
3188   /* Get a line of input. */
3189   if (!unformat_user (input, unformat_line_input, line_input))
3190     return 0;
3191
3192   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3193     {
3194       if (unformat (line_input, "%U:%d %U:%d",
3195                     unformat_ip4_address, &in_addr, &in_port,
3196                     unformat_ip4_address, &ext_addr, &ext_port))
3197         ;
3198       else
3199         {
3200           error = clib_error_return (0, "unknown input '%U'",
3201                                      format_unformat_error, line_input);
3202           goto done;
3203         }
3204     }
3205
3206   unformat_free (line_input);
3207
3208   dm = snat_det_map_by_user (sm, &in_addr);
3209   if (!dm)
3210     vlib_cli_output (vm, "no match");
3211   else
3212     {
3213       key.ext_host_addr = ext_addr;
3214       key.ext_host_port = ntohs ((u16)ext_port);
3215       ses = snat_det_find_ses_by_in (dm, &in_addr, ntohs((u16)in_port), key);
3216       if (!ses)
3217         vlib_cli_output (vm, "no match");
3218       else
3219         snat_det_ses_close(dm, ses);
3220     }
3221
3222 done:
3223   unformat_free(line_input);
3224
3225   return error;
3226 }
3227
3228 /*?
3229  * @cliexpar
3230  * @cliexstart{snat deterministic close_session_in}
3231  * Close session using inside ip address and port
3232  * and external ip address and port, use:
3233  *  vpp# nat44 deterministic close session in 3.3.3.3:3487 2.2.2.2:2387
3234  * @cliexend
3235 ?*/
3236 VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = {
3237   .path = "nat44 deterministic close session in",
3238   .short_help = "nat44 deterministic close session in "
3239                 "<in_addr>:<in_port> <ext_addr>:<ext_port>",
3240   .function = snat_det_close_session_in_fn,
3241 };